Kerberos authentication in Hadoop - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary purpose of Kerberos in Hadoop?

Kerberos is used in Hadoop clusters for security. What is its main role?

A To authenticate users and services securely using tickets

B To encrypt data stored in HDFS automatically

C To manage resource allocation among cluster nodes

D To monitor cluster health and performance

💡 Hint

Think about how Kerberos helps prove identity without sending passwords.

Kerberos provides a secure way to authenticate users and services by issuing tickets, preventing password exposure.

❓ Predict Output

intermediate

What is the output of this Kerberos ticket command?

Given the command klist run after successful authentication, what output will it show?

Hadoop

klist

A List of valid Kerberos tickets with expiration times

B Error: command not found

C List of Hadoop cluster nodes

D Current HDFS directory contents

💡 Hint

Consider what klist is used for in Kerberos.

The klist command displays the current Kerberos tickets held by the user, including expiration times.

❓ data_output

advanced

What is the result of this Hadoop Kerberos authentication code snippet?

Consider this Java snippet for authenticating a user with Kerberos in Hadoop:

Configuration conf = new Configuration();
conf.set("hadoop.security.authentication", "kerberos");
UserGroupInformation.setConfiguration(conf);
UserGroupInformation.loginUserFromKeytab("[e-mail]", "/path/to/user.keytab");
String user = UserGroupInformation.getCurrentUser().getUserName();
System.out.println(user);

What will be printed?

A Exception thrown at loginUserFromKeytab

B [e-mail]

C null

D user

💡 Hint

Check what getUserName() returns after login.

The getUserName() method returns the simple username part, not the full principal.

🔧 Debug

advanced

Why does this Kerberos authentication fail in Hadoop?

Given this error message when running a Hadoop job with Kerberos enabled:

javax.security.auth.login.LoginException: Cannot obtain password from user

Which of the following is the most likely cause?

A The Hadoop cluster is not running

B The user does not have HDFS read permissions

C The keytab file path is incorrect or inaccessible

D The Kerberos ticket has expired but was renewed automatically

💡 Hint

Check file paths and permissions related to authentication files.

This error usually means the keytab file cannot be read or found, so the password cannot be retrieved for login.

🚀 Application

expert

How many valid Kerberos tickets will be listed after these commands?

A user runs these commands in order:

kinit -kt /path/to/user1.keytab [e-mail]
kinit -kt /path/to/user2.keytab [e-mail]
klist

How many valid tickets will klist show?

A 2

B 1

C 0

D Depends on the Kerberos configuration

💡 Hint

Consider how kinit manages tickets in the default ticket cache.

By default, kinit overwrites the existing ticket cache, so only the last ticket is valid.