@Sam Red There could be a couple of reasons here. First make sure the KDC and Kadmin is running assuming you are on RHEL/Centos7 Check the current status these 2 deamons should be running # systemctl status krb5kdc.service # systemctl status kadmin.service If they are not running please, enable them so at next reboot they autostart # systemctl enable kadmin.service # systemctl enable krb5kdc.service Start the services # systemctl start krb5kdc.service # systemctl start kadmin.service As the root user check that the principals are in the KDC database # kadmin.local Authenticating as principal root/admin@RELAY.COM with password. kadmin.local: listprincs First forcefully expire the current kerberos credentials, log on as user hdfs or whatever # kdestroy Validate that no credentials are cached # klist klist: No credentials cache found (filename: /tmp/krb5cc_0) To see what keytab entries in that keytab file, use klist # klist -kte /etc/security/keytabs/spnego.service.keytab Keytab name: FILE:/etc/security/keytabs/spnego.service.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 1 08/24/2017 15:42:23 HTTP/hostname@RELAY.COM (aes256-cts-hmac-sha1-96) 1 08/24/2017 15:42:23 HTTP/hostname@RELAY.COM (des-cbc-md5) 1 08/24/2017 15:42:23 HTTP/hostname@RELAY.COM (arcfour-hmac) 1 08/24/2017 15:42:23 HTTP/hostname@RELAY.COM (aes128-cts-hmac-sha1-96) 1 08/24/2017 15:42:23 HTTP/hostname@RELAY.COM (des3-cbc-sha1) The grab a valid kerberos using the info above # kinit -kt /etc/security/keytabs/spnego.service.keytab HTTP/hostname@RELAY.COM Now retry ... View more

@Pooja Kamle Ranger admin in HDP 2.5 has a new property for a truststore. So if using ldaps, you need to import the ldapserver cert to the ranger admin truststore , property name ranger.truststore.file. Although no log is being showed for failed connection to ldapserver, setting ranger to debug will show that ranger admin is not able to establish SSL connection to ldap server and there by not able to validate the user login. usersync has similar property ranger.usersync.truststore.file which must already have ldap server cert in it,is usersync is working correctly?. If not use the same truststore file for ranger.truststore.file Make sure that you set the UserSearchFilter as sAMAccountName={0} if using AD for ldap accounts. ... View more