Using a Hadoop Cluster with Kerberos Authentication

When submitting a job or accessing HDFS on a Hadoop cluster running with Kerberos security, the configuration object used to establish the connection to the cluster (creating a JobClient or a FileSystem instance) must include the JobTracker and/or NameNode Kerberos principals.

If Hadoop uses Kerberos principals of the form mapred/JOBTRACKER_HOSTNAME@REALM and hdfs/NAMENODE_HOSTNAME@REALM , Oozie will resolve the principals correctly without any change required when submitting jobs to Oozie.

However, if the Kerberos principals don't follow the above rule, the Oozie job configuration properties must include the following 2 properties set to the right values:

• mapreduce.jobtracker.kerberos.principal : the Kerberos principal name of the Hadoop Jobtracker (i.e. mapred/bluesky@FOO.BAR ).
• dfs.namenode.kerberos.principal : the Kerberos principal name of the Hadoop Namenode (i.e. hdfs/bluesky@FOO.BAR ).