Kerberos Debug Notes

Some notes for Kerberos debugging in a secure HDP setup:

1. Setting Debug Logs
   To enable debug logs in Java for Kerberos sun.security.krb5.debug needs to be set to true. Doing this for Hadoop can be done in the hadoop-env.sh file by adding it to the HADOOP_OPTS environment variable:

   export HADOOP_OPTS="-Dsun.security.krb5.debug=true"

   Additionally the HADOOP_JAAS_DEBUG variable can be set also:

   HADOOP_JAAS_DEBUG

   Receiving traces in bash/shell can be enabled by setting the following environment variable:

   export KRB5_TRACE=/dev/stdout

2. Testing auth_to_local Settings
   Setting the auth_to_local rules correclty can be quite crucial. This is especially true for KDS trust environments. The rules can be easily tested with the HadoopKerberosName call of Hadoop security. You can run it as:

   $ hadoop org.apache.hadoop.security.HadoopKerberosName pinc@REALM.COM