anchor.diff:  
   - Noted the name of the Kerberos \<realm\> in which your cluster resides.
   
  +- Installed the Kerberos client packages on **each** Greenplum Database segment host if they are not already installed. You must have superuser permissions to install operating system packages. For example:
  +
  +    ``` shell
  +    root@gphost$ rpm -qa | grep krb
  +    root@gphost$ yum install krb5-libs krb5-workstation
  +    ```
  +
   
   ## <a id="procedure"></a>Procedure
   
  -Perform the following steps to configure PXF for a secure HDFS. You will perform operations on the Kerberos KDC server and Greenplum Database segment hosts.
  +There are different procedures for configuring PXF for secure HDFS with a [Microsoft Active Directory KDC Server](#proc_ad) vs. with an [MIT Kerberos KDC Server](#proc_mit).
   
  -**Perform the following steps on Kerberos KDC server host**:
  +
  +### <a id="proc_ad"></a>Configuring PXF with a Microsoft Active Directory Kerberos KDC Server
  +
  +When you configure PXF for secure HDFS using an AD Kerberos KDC server, you will perform tasks on both the KDC server host and the Greenplum Database master host.
  +
  +**Perform the following steps the Active Directory domain controller**:
  +
  +1. Start **Active Directory Users and Computers**.
  +2. Expand the forest domain and the top-level UNIX organizational unit that describes your Greenplum user domain.
  +3. Select **Service Accounts**, right-click, then select **New->User**.
  +4. Type a name, eg. `ServiceGreenplumPROD1`, and change the login name to `gpadmin`. Note that the login name should be in compliance with POSIX standard and match hadoop.proxyuser.<name>.hosts/groups in the Hadoop `core-site.xml` and `PXF_PRINCIPAL` in `$PXF_CONF/conf/pxf-env.sh`.
  +5. Type and confirm the Active Directory service account password. Select the **User cannot change password** and **Password never expires** check boxes, then click **Next**. For security reasons, if you can't have **Password never expires** checked, you will need to generate new keytab file (step 7) every time you change the password of the service account. 
  +6. Click **Finish** to complete the creation of the new user principal. 
  +7. Open Powershell or a command prompt and run the `ktpass` command to generate the keytab file. For example:
  +
  +    ``` shell
  +    powershell#>ktpass -out pxf.service.keytab -princ gpadmin@EXAMPLE.COM -mapUser ServiceGreenplumPROD1 -pass ******* -crypto all -ptype KRB5_NT_PRINCIPAL
  +    ```
  +
  +    With Active Directory, the principal and the keytab file are shared by all Greenplum Database segment hosts. 
  +	
  +8. Copy the `pxf.service.keytab` file to the Greenplum master host.
  +
  +**Perform the following steps on the Greenplum Database master host**:
  +
  +1. Log in to the Greenplum Database master host. For example:
  +
  +    ``` shell
  +    $ ssh gpadmin@<gpmaster>
  +    ```
  +    
  +2. Open the `$PXF_CONF/conf/pxf-env.sh` file in an editor. Update the `PXF_KEYTAB` and `PXF_PRINCIPAL` settings, if required, specifying the location of the keytab file and the Kerberos principal. Replace `EXAMPLE.COM` with your Kerberos realm.
  +
  +    ``` shell
  +    export PXF_KEYTAB="${PXF_CONF}/keytabs/pxf.service.keytab"
  +    export PXF_PRINCIPAL="gpadmin@EXAMPLE.COM"
  +    ```
  +    
  +4. Save the file and exit the editor.
  +
  +5. Synchronize the PXF configuration to your Greenplum Database cluster and restart PXF. For example:
  +
  +    ``` shell
  +    gpadmin@master$ $GPHOME/pxf/bin/pxf cluster sync
  +    gpadmin@master$ $GPHOME/pxf/bin/pxf cluster stop
  +    gpadmin@master$ $GPHOME/pxf/bin/pxf cluster start
  +    ```
  +
  +6. Step 5 does not synchronize the keytabs in `$PXF_CONF`. You must distribute the keytab file to `$PXF_CONF/keytabs/`. Locate the keytab file, copy the file to the `$PXF_CONF` user configuration directory, and set required permissions. For example:
  +	
  +    ``` shell
  +    gpadmin@gpmaster$ gpscp -f hostfile_all pxf.service.keytab =:$PXF_CONF/keytabs/
  +    gpadmin@gpmaster$ gpssh -f hostfile_all chmod 400 $PXF_CONF/keytabs/pxf.service.keytab
  +    ```
  +	
  +
  +### <a id="proc_mit"></a>Configuring PXF with an MIT Kerberos KDC Server
  +
  +When you configure PXF for secure HDFS using an MIT Kerberos KDC server, you will perform tasks on both the KDC server host and the Greenplum Database master host.
  +
  +**Perform the following steps on the MIT Kerberos KDC server host**:
   
   1.  Log in to the Kerberos KDC server as the `root` user.
   
  
positive.code:     
      PXF automatically replaces ` _HOST` with the FQDN of the segment host.
  
  6. Restart PXF on the segment host:
  
      ``` shell
      gpadmin@seghost$ $GPHOME/pxf/bin/pxf restart
      ```
  
  
negative.code:     root@kdc-server$ ssh host3.example.com chmod 400 /usr/local/greenplum-pxf/keytabs/pxf.service.keytab
      ```
  
  **Perform the following steps on the Greenplum Database master host**:
  
  1. Log in to the master host. For example:
  
      ``` shell
      $ ssh gpadmin@<gpmaster>
      ```
      
  2. Open the PXF `pxf-env.sh` user configuration file in the editor of your choice. For example, to open the file with `vi` when `PXF_CONF=/usr/local/greenplum-pxf`:
  
      ``` shell
      gpadmin@seghost$ vi /usr/local/greenplum-pxf/conf/pxf-env.sh
      ```
      
  3. Update the `PXF_KEYTAB` and `PXF_PRINCIPAL` settings, if required. Specify the location of the keytab file and the Kerberos principal, substituting your realm. *The default values for these settings are identified below*:
  
      ``` shell
      export PXF_KEYTAB="${PXF_CONF}/keytabs/pxf.service.keytab"
  