update: I have made some progress, placed the krb5.ini file.  Currently at: ERROR: Caused by: com.cloudera.hiveserver2.support.exceptions.GeneralException: [Cloudera][HiveJDBCDriver](500168) Error creating login context using ticket cache: Unable to obtain Principal Name for authentication . ERROR: ... 12 more ERROR: Caused by: javax.security.auth.login.LoginException: Unable to obtain Principal Name for authentication  May I get an example of a jaas.conf file I did find some using keytab etc while my setup is memory based sharing of tgt tickets.  I appreciate your time. Thank you in advance. ... View more

Dear @chethan, much thanks for the reply.  I am using Kerberos outbound only setup and I have followed all steps including registry key change to allow TGTSession sharing (WIN Memory).  I have not se any jaas.conf.  The examples I find use file based cache.  Also, below is a debug output of what the session sees: get normal credential >>> KrbCreds found the default ticket granting ticket in credential cache. Java config name: null Native config name: C:\Windows\krb5.ini Loaded from native config >>> Obtained TGT from LSA: Credentials: client=demo@DC1.PW.ORG server=krbtgt/DC1.PW.ORG@DC1.PW.ORG authTime=20240425145720Z startTime=20240425145720Z endTime=20240426005720Z renewTill=null flags=INITIAL;PRE-AUTHENT Question, when I go to C:\Windows\krb5.ini (of demo user) there is no such file,  how should I interpret this? #2 all jaas config sample I see are pointing to file-based cache or where IWA is enabled.  I have not, what I have done is enabled WIN memory sharing of the TGT ticket, enabled unconstrained delegation, ensure all steps & settings nuances for a WIN are placed. I do appreciate the help!!! ... View more

Hello, I have been stuck with this issue, giving the error, any insight is deeply appreciated. Using HDP 2.6.5 Exception in thread "main" java.lang.NoClassDefFoundError: org/apache/hadoop/hive/thrift/TFilterTransport at java.lang.ClassLoader.defineClass1(Native Method) at java.lang.ClassLoader.defineClass(ClassLoader.java:803) at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142) at java.net.URLClassLoader.defineClass(URLClassLoader.java:442) at java.net.URLClassLoader.access$100(URLClassLoader.java:64) at java.net.URLClassLoader$1.run(URLClassLoader.java:354) at java.net.URLClassLoader$1.run(URLClassLoader.java:348) at java.security.AccessController.doPrivileged(Native Method) at java.net.URLClassLoader.findClass(URLClassLoader.java:347) at java.lang.ClassLoader.loadClass(ClassLoader.java:425) at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:315) at java.lang.ClassLoader.loadClass(ClassLoader.java:358) at org.apache.hive.jdbc.HiveConnection.createBinaryTransport(HiveConnection.java:415) at org.apache.hive.jdbc.HiveConnection.openTransport(HiveConnection.java:192) at org.apache.hive.jdbc.HiveConnection.<init>(HiveConnection.java:156) at org.apache.hive.jdbc.HiveDriver.connect(HiveDriver.java:105) at HiveCheck.main(HiveCheck.java:388) Caused by: java.lang.ClassNotFoundException: org.apache.hadoop.hive.thrift.TFilterTransport at java.net.URLClassLoader$1.run(URLClassLoader.java:359) at java.net.URLClassLoader$1.run(URLClassLoader.java:348) at java.security.AccessController.doPrivileged(Native Method) at java.net.URLClassLoader.findClass(URLClassLoader.java:347) at java.lang.ClassLoader.loadClass(ClassLoader.java:425) at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:315) at java.lang.ClassLoader.loadClass(ClassLoader.java:358) ... 17 more 2018-08-01 11:34:13,942 DEBUG [Thread-0] util.Shell (Shell.java:isSetsidSupported(778)) - setsid exited with exit code 0 ... View more

@emaxwell Your explanation, specially last paragraph, is the most closest explanation I have come across, of what we are trying to resolve. Indeed (using SAS client on a desktop) that connects to a SAS server (as in a session) and the need is to pass the user's kerberos ticket to HDP from that server. We have turned the registry setting in WIN server so the ticket cache is shareable, but no go. I was wondering if there is any doc or step by step that is available? Also, the steps you showed in code section above, needs to be done for ea. end user on the client (to HDP) server? There is NO direct end-user login to the server (only via clients). Is there anything that could have WIN OS perform kinit on behalf of the end user and pass that ticket to HDP. Any insight is appreciated as we are going in circle. *(Still discovering kerberos not expert level) ... View more

@Ravi MutyalaWill this work where client (desktop) connects to its server (win server) which then acts as a client to the HDP cluster. There is no direct login. We are not finding much info. Any advice? ... View more

Precise pain point we see, if on Linux one could do PAM but zero info on WIN. I would add, how does one have WIN OS to kinit on a user's (session) behalf? ... View more