This was noticed on a secure cluster where the namenode had an upper case hostname and the following command was issued
hadoop dfs -ls webhdfs://NN:PORT/PATH
the above command failed because delegation token retrieval failed.
Upon looking at the kerberos logs it was determined that we tried to get the ticket for kerberos principal with upper case hostnames and that host did not exit in kerberos. We should convert the hostnames to lower case. Take a look at
HADOOP-7988 where the same fix was applied on a different class.
I have noticed this issue exists on branch-1. Will investigate trunk and branch-2 and update accordingly.