Whenever there is unspecified error bubbling up from Kerberos API calls, impala does not print the minor code:
At present , the error message looks like -
"SASL message (Kerberos (external)): GSSAPI Error: Unspecified GSS failure. Minor code may provide more information ()"
It will help if specific minor code is printed.
For eg like-
GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Unknown code krb5 194)
Error code 194 refers to "Credentials cache file permissions incorrect". In this situation you are probably using a cron job to create a ticket but the LDAP user cannot read the ticket cache file. Make sure the cache file is owned by the user trying to make the client connection.
GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Unknown code krb5 195)
This can happen if you simply have not done a kinit if you are working from the command line. However, in the case of a service it may mean that client process cannot find the ticket cache file. You will need to let the LDAP server know where the cache file is.