Providing Kerberos Credentials using a Keytab File

Configure Kerberos for the DataStax Enterprise (DSE) clients, including dsetool, DSE FS, DSE Graph, and DSE Spark.


  1. Create the keytab file with kadmin:

    Start kadmin:


    Create file:

    ktadd -k <file_name> <principal_name>
  2. Log in using kinit:

    kinit -k -t <file_name> <principal_name>
  3. Create a Java Authentication and Authorization Service (JAAS) configuration file for the DSE Client:

    1. Create a file named .java.login.config and put it in the home directory.

    2. Define the variables required to use a keytab file:

      DseClient {



      Absolute path to the keytab file. For example, /home/adam/krb5_opsc.keytab.


      The fully qualified principal name. For example, dse_admin/dse1.lan@EXAMPLE.COM.

    For more information on the available settings see the documentation for

  4. Optional: If the JAAS configuration is not in the default location or has the default name, customize the location using one of the following methods:

Was this helpful?

Give Feedback

How can we improve the documentation?

© 2024 DataStax | Privacy policy | Terms of use

Apache, Apache Cassandra, Cassandra, Apache Tomcat, Tomcat, Apache Lucene, Apache Solr, Apache Hadoop, Hadoop, Apache Pulsar, Pulsar, Apache Spark, Spark, Apache TinkerPop, TinkerPop, Apache Kafka and Kafka are either registered trademarks or trademarks of the Apache Software Foundation or its subsidiaries in Canada, the United States and/or other countries. Kubernetes is the registered trademark of the Linux Foundation.

General Inquiries: +1 (650) 389-6000,