For doc purpose and if it could be helpful to someone We took krb5.ini that was used at the CDP cluster and saved it to client WIN server We used LogLevel=6 LogPath=<some-path> in our jdbc URI to enable trace level log Based on findings from the trace level logs java.security.auth.login.config was pointing to an incorrect login module.  Since we turned on memory based cache, removing pointer to the java.security.auth.login.config forced correct tgt ticket to be picked.  We did not opt for a custom jaas.conf either. There were minor tweak of domain & realm value. This resolved our issue. ... View more