As you are accesing it from the Cross realm, your widows-based clients should know the KDC location to create proper SPNEGO token. You need either create a separate policy in your AD for that type of users or you can manually from command line add mappings in client machine's registeries so that they would know about your Hadoop realm KDC: ksetup /addkdc HADOOP.DOMAIN.COM hadoop.nodewithkdc.com ksetup /addhosttorealmmap hadoop.nodewithkdc.com HADOOP.DOMAIN.COM ... View more