When using the HADOOP procedure or a LIBNAME statement with the Hadoop engine to write data to Hadoop, you might get the following Kerberos error:

Client cannot authenticate via:[TOKEN, KERBEROS];

Symptoms

When making a LIBNAME connection to Hadoop, you might get an error that the LIBNAME statement did not assign successfully:

LIBNAME myhive HADOOP SERVER='server_name.sas.com' HDFS_TEMPDIR='/sasuser';
ERROR: HDFS_TEMPDIR directory /sasuser does not exist or is inaccessible.
ERROR: Error in the LIBNAME statement.

To check the permission on the HDFS_TEMPDIR directory, you can try writing to HDFS by using PROC HADOOP, which results in the following error:

PROC HADOOP VERBOSE;
HDFS MKDIR="/sasuser/test";
ERROR: java.io.IOException: Failed on local exception: java.io.IOException: org.apache.hadoop.security.AccessControlException:
Client cannot authenticate via:[TOKEN, KERBEROS]; Host Details : local host is: "<hostname>";
destination host is: "<hostname>":8020;

Similarly, the LIBNAME statement might assign successfully without the HDFS_TEMPDIR option. But, when trying to write data to HDFS, you get the same error:

LIBNAME myhive HADOOP SERVER='server_name.sas.com';
NOTE: Libref MYHIVE was successfully assigned as follows:
Engine: HADOOP

DATA myhive.tablename;
SET sashelp.cars;
RUN;
ERROR: java.io.IOException: Failed on local exception: java.io.IOException: org.apache.hadoop.security.AccessControlException:
Client cannot authenticate via:[TOKEN, KERBEROS]; Host Details : local host is: "<hostname>";
destination host is: "<hostname>":8020;

Cause

This is not actually a Kerberos issue as indicated by the error. The LIBNAME statement should assign correctly without using the HDFS_TEMPDIR option and be able to read data from Hadoop. The error occurs only when you try to write data.

The issue appears to be a Java classpath issue with some releases of Hadoop.

Workaround

To work around this issue, make a copy of the core-site.xml and move it into the SAS_HADOOP_JAR_PATH directory.