When submitting a job or accessing HDFS on a Hadoop cluster running with Kerberos security, the configuration object used to establish the connection to the cluster (creating a JobClient or a FileSystem instance) must include the JobTracker and/or NameNode Kerberos principals.
If Hadoop uses Kerberos principals of the form mapred/JOBTRACKER_HOSTNAME@REALM and hdfs/NAMENODE_HOSTNAME@REALM , Oozie will resolve the principals correctly without any change required when submitting jobs to Oozie.
However, if the Kerberos principals don't follow the above rule, the Oozie job configuration properties must include the following 2 properties set to the right values:
There are not required changed in existing workflow applications.
The 2 configuration properties mentioned above are not allowed in workflow action configuration sections.
All actions in a workflow application must interact with the same Hadoop JobTracker and NameNode.