将kerberized hortonworks群集从2.5.3升级到2.6.1后，所有服务（hdfs、hive、spark、zookeeper等）都无法通过kerberos获取凭据，出现以下错误：

>>>KRBError:
         sTime is Wed Jun 14 11:52:10 CEST 2017 1497433930000
         suSec is 825974
         error code is 14
         error Message is**KDC has no support for encryption type**
         sname is krbtgt/BIGDATACLUSTER.EXAMPLE.COM@JUST.EXAMPLE.COM
         msgType is 30
>>> Credentials acquireServiceCreds: no tgt; searching thru capath
>>> Credentials acquireServiceCreds: no tgt; cannot get creds
KrbException: Fail to create credential. (63) - No service creds

/etc/krb5.conf文件没有更改（在升级之前它一直在工作）：

[libdefaults]
 renew_lifetime = 7d
  forwardable = true
  default_realm = BIGDATACLUSTER.EXAMPLE.COM
  ticket_lifetime = 10h

[domain_realm]
  .EXAMPLE.com = JUST.EXAMPLE.COM
  .BIGDATACLUSTER.EXAMPLE.com = BIGDATACLUSTER.EXAMPLE.COM
  BIGDATACLUSTER.EXAMPLE.com = BIGDATACLUSTER.EXAMPLE.COM

[realms]
  BIGDATACLUSTER.EXAMPLE.COM = {
    admin_server=MACHINE1.EXAMPLE.com
    rdns = false
    kdc = MACHINE1.EXAMPLE.com
    default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
    default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
    permitted_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
  }

[capaths]
        JUST.EXAMPLE.COM = {
                BIGDATACLUSTER.EXAMPLE.COM = .
        }

信托看起来是这样的：

addprinc -e "aes256-cts:normal aes128-cts:normal arcfour-hmac:normal" krbtgt/BIGDATACLUSTER.EXAMPLE.COM@JUST.EXAMPLE.COM

这就是我们尝试过的：
验证了java和jce，一切正常
重新生成所有密钥表并重新启动集群-选中信任的“其他域支持kerberos aes加密”复选框，即选中。
请看答案。看来这最后一点就是问题所在。