anchor.diff:  
   Next, we need to tell NiFi to use this as our JAAS configuration. This is done by setting a JVM System Property, so we will edit the `conf/bootstrap.conf` file.
   If the Client has already been configured to use Kerberos, this is not necessary, as it was done above. Otherwise, we will add the following line to our _bootstrap.conf_ file:
  - 
  +
   [source]
   java.arg.15=-Djava.security.auth.login.config=./conf/zookeeper-jaas.conf
   
  
positive.code: [source]
  2016-01-08 16:08:57,888 ERROR [pool-26-thread-1-SendThread(localhost:2181)] o.a.zookeeper.client.ZooKeeperSaslClient An error: (java.security.PrivilegedActionException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - LOOKING_UP_SERVER)]) occurred when evaluating Zookeeper Quorum Member's  received SASL token. Zookeeper Client will go to AUTH_FAILED state.
  
  If there are problems communicating or authenticating with Kerberos, 
  link:http://docs.oracle.com/javase/7/docs/technotes/guides/security/jgss/tutorials/Troubleshooting.html[this Troubleshooting Guide] may be of value.
  
  One of the most important notes in the above Troubleshooting guide is the mechanism for turning on Debug output for Kerberos.
  
negative.code: 
  This will cause the debug output to be written to the NiFi Bootstrap log file. By default, this is located at _$NIFI_HOME/logs/nifi-bootstrap.log_.
  This output can be rather verbose but provides extremely valuable information for troubleshooting Kerberos failures.
  
  
  
  