<div dir="ltr">Hi, I am trying to setup cross domain trust between FreeIPA and MIT Kerberos. I have already created krbtgt in the both FreeIPA and MIT Kerberos. I can successfully get Kerberos ticket from the both domains.However when I try to access Hadoop using the FreeIPA domain then I get this error in trace log. Wondering what is missing? Service ticket not found in the subject>>> Realm doInitialParse: cRealm=[<a href="http://TEST.COM">TEST.COM</a>], sRealm=[<a href="http://TEST2.COM">TEST2.COM</a>]>>> Realm parseCapaths: no cfg entry>>> Credentials acquireServiceCreds: main loop: [0] tempService=krbtgt/<a href="mailto:TEST2.COM@TEST.COM">TEST2.COM@TEST.COM</a>Using builtin default etypes for default_tgs_enctypesdefault etypes for default_tgs_enctypes: 18 17 16 23 1 3.>>> CksumType: sun.security.krb5.internal.crypto.RsaMd5CksumType>>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1ETypegetKDCFromDNS using UDP>>> KrbKdcReq send: kdc=<a href="http://test2company.com">test2company.com</a>. UDP:88, timeout=30000, number of retries =3, #bytes=701>>> KDCCommunication: kdc=<a href="http://test2company.com">test2company.com</a>. UDP:88, timeout=30000,Attempt =1, #bytes=701>>> KrbKdcReq send: #bytes read=637>>> KdcAccessibility: remove test2company.com.:88>>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType>>> Credentials acquireServiceCreds: global OK-AS-DELEGATE turned off at krbtgt/<a href="mailto:TEST2.COM@TEST.COM">TEST2.COM@TEST.COM</a>>>> Credentials acquireServiceCreds: got tgt>>> Credentials acquireServiceCreds: got right tgt>>> Credentials acquireServiceCreds: obtaining service creds for nn/<a href="mailto:testcompany.com@TEST2.COM">testcompany.com@TEST2.COM</a>Using builtin default etypes for default_tgs_enctypesdefault etypes for default_tgs_enctypes: 18 17 16 23 1 3.>>> CksumType: sun.security.krb5.internal.crypto.RsaMd5CksumType>>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType>>> KrbKdcReq send: kdc=<a href="http://testcompany.com">testcompany.com</a> UDP:88, timeout=30000, number of retries =3, #bytes=662 >>> KDCCommunication: kdc=<a href="http://testcompany.com">testcompany.com</a> UDP:88, timeout=30000,Attempt =1, #bytes=662 >>> KrbKdcReq send: #bytes read=150>>> KdcAccessibility: remove <a href="http://testcompany.com">testcompany.com</a>>>> KDCRep: init() encoding tag is 126 req type is 13>>>KRBError: cTime is Sun Jun 01 13:55:49 EDT 1975 170877349000 sTime is Sat Apr 09 15:01:16 EDT 2016 1460228476000 suSec is 693381 error code is 31 error Message is Integrity check on decrypted field failed realm is <a href="http://TEST2.COM">TEST2.COM</a> sname is nn/<a href="http://testcompany.com">testcompany.com</a> msgType is 30<div> </div></div>