title: Running any Hadoop command fails after enabling security.
body: <p>I was trying to enable Kerberos for my <strong>CDH 4.3</strong> (via Cloudera Manager) test bed. So after changing authentication from Simple to Kerberos in the WebUI, I'm unable to do any hadoop operations as shown below. Is there anyway to specify the keytab explicitly?</p>
  
  <pre><code>[root@host-dn15 ~]# su - hdfs
  -bash-4.1$ hdfs dfs -ls /
  13/09/10 08:15:35 ERROR security.UserGroupInformation: PriviledgedActionException as:hdfs (auth:KERBEROS) cause:javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
  13/09/10 08:15:35 WARN ipc.Client: Exception encountered while connecting to the server : javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
  13/09/10 08:15:35 ERROR security.UserGroupInformation: PriviledgedActionException as:hdfs (auth:KERBEROS) cause:java.io.IOException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
  ls: Failed on local exception: java.io.IOException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]; Host Details : local host is: "host-dn15.hadoop.com/192.168.10.227"; destination host is: "host-dn15.hadoop.com":8020;
  -bash-4.1$ kdestroy
  -bash-4.1$ kinit
  Password for hdfs@HADOOP.COM:
  -bash-4.1$ klist
  Ticket cache: FILE:/tmp/krb5cc_494
  Default principal: hdfs@HADOOP.COM
  
  Valid starting     Expires            Service principal
  09/10/13 08:20:31  09/11/13 08:20:31  krbtgt/HADOOP.COM@HADOOP.COM
      renew until 09/10/13 08:20:31
  
  -bash-4.1$ klist -e
  Ticket cache: FILE:/tmp/krb5cc_494
  Default principal: hdfs@HADOOP.COM
  
  Valid starting     Expires            Service principal
  09/10/13 08:20:31  09/11/13 08:20:31  krbtgt/HADOOP.COM@HADOOP.COM
      renew until 09/10/13 08:20:31, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
  -bash-4.1$
  </code></pre>
  
  <p>So I took a good look at the namenode log,</p>
  
  <pre><code>2013-09-10 10:02:06,085 INFO org.apache.hadoop.ipc.Server: IPC Server listener on 8022: readAndProcess threw exception javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: Failure unspecified at GSS-API level (Mechanism level: Encryption type AES256 CTS mode with HMAC SHA1-96 is not supported/enabled)] from client 10.132.100.228. Count of bytes read: 0
  javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: Failure unspecified at GSS-API level (Mechanism level: Encryption type AES256 CTS mode with HMAC SHA1-96 is not supported/enabled)]
  </code></pre>
  
  <p>JCE policy files are Installed already on all nodes.</p>
  
  <pre><code>[root@host-dn15 security]# sha256sum ./local_policy.jar
  4a5c8f64107c349c662ea688563e5cd07d675255289ab25246a3a46fc4f85767  ./local_policy.jar
  [root@host-dn15 security]# sha256sum ./US_export_policy.jar
  b800fef6edc0f74560608cecf3775f7a91eb08d6c3417aed81a87c6371726115  ./US_export_policy.jar
  [root@host-dn15 security]# sha256sum ./local_policy.jar.bak
  7b26d0e16722e5d84062240489dea16acef3ea2053c6ae279933499feae541ab  ./local_policy.jar.bak
  [root@host-dn15 security]# sha256sum ./US_export_policy.jar.bak
  832133c52ed517df991d69770f97c416d2e9afd874cb4f233a751b23087829a3  ./US_export_policy.jar.bak
  [root@host-dn15 security]#
  </code></pre>
  
  <p>And the list of principals in the realm.</p>
  
  <pre><code>kadmin:  listprincs
  HTTP/host-dn15.hadoop.com@HADOOP.COM
  HTTP/host-dn16.hadoop.com@HADOOP.COM
  HTTP/host-dn17.hadoop.com@HADOOP.COM
  K/M@HADOOP.COM
  cloudera-scm/admin@HADOOP.COM
  hbase/host-dn15.hadoop.com@HADOOP.COM
  hbase/host-dn16.hadoop.com@HADOOP.COM
  hbase/host-dn17.hadoop.com@HADOOP.COM
  hdfs/host-dn15.hadoop.com@HADOOP.COM
  hdfs/host-dn16.hadoop.com@HADOOP.COM
  hdfs/host-dn17.hadoop.com@HADOOP.COM
  hdfs@HADOOP.COM
  hue/host-dn15.hadoop.com@HADOOP.COM
  host-dn16/hadoop.com@HADOOP.COM
  kadmin/admin@HADOOP.COM
  kadmin/changepw@HADOOP.COM
  kadmin/host-dn15.hadoop.com@HADOOP.COM
  krbtgt/HADOOP.COM@HADOOP.COM
  mapred/host-dn15.hadoop.com@HADOOP.COM
  mapred/host-dn16.hadoop.com@HADOOP.COM
  mapred/host-dn17.hadoop.com@HADOOP.COM
  root/admin@HADOOP.COM
  root@HADOOP.COM
  zookeeper/host-dn15.hadoop.com@HADOOP.COM
  kadmin:  exit
  [root@host-dn15 ~]#
  </code></pre>
  
  <p>exported the keytab for hdfs and used to kinit.</p>
  
  <pre><code>-bash-4.1$ kinit -kt ./hdfs.keytab hdfs
  -bash-4.1$ klist
  Ticket cache: FILE:/tmp/krb5cc_494
  Default principal: hdfs@HADOOP.COM
  
  Valid starting     Expires            Service principal
  09/10/13 09:49:42  09/11/13 09:49:42  krbtgt/HADOOP.COM@HADOOP.COM
      renew until 09/10/13 09:49:42
  </code></pre>
  
  <p>Everything went futile. Any idea??</p>
  
  <p>Thanks ahead,</p>