title: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided
body: <p>I am getting this error when i try to connect to hive metastore using Spark SQL HiveContext.</p>
  
  <p>i am running this on standalone cluster using spark-submit command from my desktop, not from the hadoop cluster.</p>
  
  <p>Is it something to do with Security related issue? do i have to add something in the hive_site.xml? is there anything we need to update in the below entry?</p>
  
  <pre><code>&lt;property&gt;
      &lt;name&gt;hive.metastore.sasl.enabled&lt;/name&gt;
      &lt;value&gt;true&lt;/value&gt;
    &lt;/property&gt;
    &lt;property&gt;
      &lt;name&gt;hive.server2.authentication&lt;/name&gt;
      &lt;value&gt;kerberos&lt;/value&gt;
    &lt;/property&gt;
  </code></pre>
  
  <p>The spark version is 1.4.0 and the hive-site.xml is placed under conf folder.</p>
  
  <p>below is the error log.</p>
  
  <pre><code>15/08/25 18:27:15 INFO HiveContext: Initializing execution hive, version 0.13.1
  15/08/25 18:27:16 INFO metastore: Trying to connect to metastore with URI thrift://metastore.com:9083
  15/08/25 18:27:16 ERROR TSaslTransport: SASL negotiation failure
  javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Ker
  beros tgt)]
          at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:211)
          at org.apache.thrift.transport.TSaslClientTransport.handleSaslStartMessage(TSaslClientTransport.java:94)
          at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:253)
          at org.apache.thrift.transport.TSaslClientTransport.open(TSaslClientTransport.java:37)
          at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:52)
          at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:49)
          at java.security.AccessController.doPrivileged(Native Method)
          at javax.security.auth.Subject.doAs(Subject.java:422)
          at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1548)
          at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport.open(TUGIAssumingTransport.java:49)
          at org.apache.hadoop.hive.metastore.HiveMetaStoreClient.open(HiveMetaStoreClient.java:336)
          at org.apache.hadoop.hive.metastore.HiveMetaStoreClient.&lt;init&gt;(HiveMetaStoreClient.java:214)
          at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
          at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
          at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
          at java.lang.reflect.Constructor.newInstance(Constructor.java:422)
          at org.apache.hadoop.hive.metastore.MetaStoreUtils.newInstance(MetaStoreUtils.java:1410)
          at org.apache.hadoop.hive.metastore.RetryingMetaStoreClient.&lt;init&gt;(RetryingMetaStoreClient.java:62)
          at org.apache.hadoop.hive.metastore.RetryingMetaStoreClient.getProxy(RetryingMetaStoreClient.java:72)
          at org.apache.hadoop.hive.ql.metadata.Hive.createMetaStoreClient(Hive.java:2453)
          at org.apache.hadoop.hive.ql.metadata.Hive.getMSC(Hive.java:2465)
          at org.apache.hadoop.hive.ql.session.SessionState.start(SessionState.java:340)
          at org.apache.spark.sql.hive.client.ClientWrapper.&lt;init&gt;(ClientWrapper.scala:105)
          at org.apache.spark.sql.hive.HiveContext.executionHive$lzycompute(HiveContext.scala:163)
          at org.apache.spark.sql.hive.HiveContext.executionHive(HiveContext.scala:161)
          at org.apache.spark.sql.hive.HiveContext.&lt;init&gt;(HiveContext.scala:167)
          at com.cap1.ct.SparkSQLHive.main(SparkSQLHive.java:17)
          at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
          at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
          at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
          at java.lang.reflect.Method.invoke(Method.java:497)
          at org.apache.spark.deploy.SparkSubmit$.org$apache$spark$deploy$SparkSubmit$$runMain(SparkSubmit.scala:664)
          at org.apache.spark.deploy.SparkSubmit$.doRunMain$1(SparkSubmit.scala:169)
          at org.apache.spark.deploy.SparkSubmit$.submit(SparkSubmit.scala:192)
          at org.apache.spark.deploy.SparkSubmit$.main(SparkSubmit.scala:111)
          at org.apache.spark.deploy.SparkSubmit.main(SparkSubmit.scala)
  Caused by: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)
          at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Krb5InitCredential.java:147)
          at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:122)
          at sun.security.jgss.krb5.Krb5MechFactory.getMechanismContext(Krb5MechFactory.java:187)
          at sun.security.jgss.GSSManagerImpl.getMechanismContext(GSSManagerImpl.java:224)
          at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:212)
          at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179)
          at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:192)
          ... 35 more
  15/08/25 18:27:16 WARN metastore: Failed to connect to the MetaStore Server...
  15/08/25 18:27:16 INFO metastore: Waiting 1 seconds before next connection attempt.
  15/08/25 18:27:17 INFO metastore: Trying to connect to metastore with URI thrift://metastore.com:9083
  15/08/25 18:27:17 ERROR TSaslTransport: SASL negotiation failure
  javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Ker
  beros tgt)]
          at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:211)
          at org.apache.thrift.transport.TSaslClientTransport.handleSaslStartMessage(TSaslClientTransport.java:94)
          at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:253)
          at org.apache.thrift.transport.TSaslClientTransport.open(TSaslClientTransport.java:37)
          at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:52)
          at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:49)
          at java.security.AccessController.doPrivileged(Native Method)
          at javax.security.auth.Subject.doAs(Subject.java:422)
          at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1548)
          at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport.open(TUGIAssumingTransport.java:49)
          at org.apache.hadoop.hive.metastore.HiveMetaStoreClient.open(HiveMetaStoreClient.java:336)
          at org.apache.hadoop.hive.metastore.HiveMetaStoreClient.&lt;init&gt;(HiveMetaStoreClient.java:214)
          at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
          at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
          at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
          at java.lang.reflect.Constructor.newInstance(Constructor.java:422)
          at org.apache.hadoop.hive.metastore.MetaStoreUtils.newInstance(MetaStoreUtils.java:1410)
          at org.apache.hadoop.hive.metastore.RetryingMetaStoreClient.&lt;init&gt;(RetryingMetaStoreClient.java:62)
          at org.apache.hadoop.hive.metastore.RetryingMetaStoreClient.getProxy(RetryingMetaStoreClient.java:72)
          at org.apache.hadoop.hive.ql.metadata.Hive.createMetaStoreClient(Hive.java:2453)
          at org.apache.hadoop.hive.ql.metadata.Hive.getMSC(Hive.java:2465)
          at org.apache.hadoop.hive.ql.session.SessionState.start(SessionState.java:340)
          at org.apache.spark.sql.hive.client.ClientWrapper.&lt;init&gt;(ClientWrapper.scala:105)
          at org.apache.spark.sql.hive.HiveContext.executionHive$lzycompute(HiveContext.scala:163)
          at org.apache.spark.sql.hive.HiveContext.executionHive(HiveContext.scala:161)
          at org.apache.spark.sql.hive.HiveContext.&lt;init&gt;(HiveContext.scala:167)
          at com.cap1.ct.SparkSQLHive.main(SparkSQLHive.java:17)
          at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
          at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
          at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
          at java.lang.reflect.Method.invoke(Method.java:497)
          at org.apache.spark.deploy.SparkSubmit$.org$apache$spark$deploy$SparkSubmit$$runMain(SparkSubmit.scala:664)
          at org.apache.spark.deploy.SparkSubmit$.doRunMain$1(SparkSubmit.scala:169)
          at org.apache.spark.deploy.SparkSubmit$.submit(SparkSubmit.scala:192)
          at org.apache.spark.deploy.SparkSubmit$.main(SparkSubmit.scala:111)
          at org.apache.spark.deploy.SparkSubmit.main(SparkSubmit.scala)
  Caused by: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)
          at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Krb5InitCredential.java:147)
          at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:122)
          at sun.security.jgss.krb5.Krb5MechFactory.getMechanismContext(Krb5MechFactory.java:187)
          at sun.security.jgss.GSSManagerImpl.getMechanismContext(GSSManagerImpl.java:224)
          at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:212)
          at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179)
          at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:192)
          ... 35 more
  </code></pre>