Major Description
The KnoxShell kerberos authentication support depends on the default facility for locating the JAAS Configuration to apply, defaulting to the jaas.conf file packaged in its own JAR. In some cases, an alternative JAAS conf has been set (overriding the internal one), which likely does not have the expected entry (i.e., "com.sun.security.jgss.initiate").
Instead, a Configuration instance based explicitly on this internal jaas.conf file can be created and employed, making the behavior much more deterministic.