# Kerberos

> For the complete documentation index, see [llms.txt](https://www.jetbrains.com/help/idea/2026.3/llms.txt).

Kerberos is a network authentication protocol that provides a secure way to authenticate clients and servers over an insecure network.

You can use Kerberos to authenticate connections to [HDFS](big-data-tools-hdfs.html).

Procedure: Install the Remote File Systems plugin

This functionality relies on the   plugin, which   you need to install and enable.

> **Note:**
> The Remote File Systems plugin is not available in IntelliJ IDEA without the Ultimate subscription.

1. Press `Ctrl+Alt+S` (Windows), `⌘ Comma` (macOS), `⌘ Comma` (IntelliJ IDEA Classic (macOS)), `⌘ Comma` (macOS System Shortcuts), `Ctrl+Alt+S` (XWin), `Ctrl+Alt+S` (GNOME), `Ctrl+Alt+S` (KDE), `Ctrl+Alt+S` (Emacs), `Ctrl+Alt+S` (Sublime Text), `⌘ Comma` (Sublime Text (macOS)), `Ctrl+Alt+S` (Visual Studio), `⌘ Comma` (Visual Studio (macOS)), `Ctrl+Alt+S` (NetBeans), `Ctrl+Alt+S` (Eclipse), `⌘ Comma` (Eclipse (macOS)) to open settings and then select `Plugins`.

2. Find the Remote File Systems plugin, and click Install. Restart the IDE if prompted.

> **Note:**
> The Remote File Systems plugin depends on the [Big Data Tools Core](https://plugins.jetbrains.com/plugin/21713-big-data-tools-core) plugin, which provides the Big Data Tools tool window, the connection settings, and the Kerberos authentication settings. Big Data Tools Core is installed together with Remote File Systems and is listed as a separate plugin. Keep both plugins enabled.

Procedure: Use Kerberos to authenticate in HDFS

1. In the  Big Data Tools  window, click ![Add a connection](https://resources.jetbrains.com/help/img/idea/2026.3/app-client.expui.general.add.svg) and select HDFS. Or, if you want to edit an existing connection, select it and click ![Edit a connection](https://resources.jetbrains.com/help/img/idea/2026.3/app-client.expui.general.settings.svg).

2. Open the Kerberos settings: In the Configuration source, select Custom, and, under Authentication, select Kerberos.

3. If you want to use the Kerberos ticket cache created by the [kinit](https://web.mit.edu/kerberos/krb5-1.12/doc/user/user_commands/kinit.html) tool, select Use kinit cache.

Otherwise, in the Authentication by list, select the authentication method:

* Keytab: enter your Kerberos principal, such as john@EXAMPLE.ORG, and a path to the [keytab](https://web.mit.edu/kerberos/krb5-devel/doc/basic/keytab_def.html) file.

* Password: enter your Kerberos principal, such as john@EXAMPLE.ORG, and the principal password.

* JAAS config: specify the path to the [JAAS Login Configuration File](https://docs.oracle.com/javase/7/docs/technotes/guides/security/jgss/tutorials/LoginConfigFile.html). IntelliJ IDEA detects JAAS entries in the file, and you can then select the one you want to use for authentication in the JAAS entry list. Alternatively, click Generate JAAS entry to generate a new JAAS entry and add it to the file. > **Note:** > The path to a JAAS Login Configuration File is a global setting. It applies to all HDFS connections that use Kerberos in your IDE.

4. Click IDE Kerberos settings. In the window that opens, in the Krb5 config field, specify your `krb5.conf` or `krb5.ini` file or keep the default one.

> **Note:**
> The path to a krb5.conf file is a global setting. It applies to all other connections that use Kerberos in your IDE. You can also access global Kerberos settings in `Settings | Appearance & Behavior | System Settings | Kerberos Authentication`.

Procedure: Enable debug logging

If you have issues with Kerberos authentication, you can enable logging of Kerberos and Java Generic Security Services (JGSS) debug messages. The logs are then available in `Help | Show Log in Finder` and `Help | Open Log in Editor`.

1. In the Settings dialog (`Ctrl+Alt+S` (Windows), `⌘ Comma` (macOS), `⌘ Comma` (IntelliJ IDEA Classic (macOS)), `⌘ Comma` (macOS System Shortcuts), `Ctrl+Alt+S` (XWin), `Ctrl+Alt+S` (GNOME), `Ctrl+Alt+S` (KDE), `Ctrl+Alt+S` (Emacs), `Ctrl+Alt+S` (Sublime Text), `⌘ Comma` (Sublime Text (macOS)), `Ctrl+Alt+S` (Visual Studio), `⌘ Comma` (Visual Studio (macOS)), `Ctrl+Alt+S` (NetBeans), `Ctrl+Alt+S` (Eclipse), `⌘ Comma` (Eclipse (macOS))), go to `Appearance & Behavior | System Settings | Kerberos Authentication`.

2. Select the Kerberos debug logging and JGSS debug logging checkboxes.