I'd change the first paragraph to read slightly different:
+ <p>In a secure cluster, the user is authenticated via Kerberos'
+ kinit command. Because of scalability concerns, we don't push
+ the client's Kerberos' tickets in MapReduce jobs. Instead, we
+ acquire delegation tokens from each HDFS NameNode that the job
+ will use and store them in the job as part of job submission.
+ The delegation tokens are automatically obtained
+ for the HDFS that holds the staging directories, where the job
+ job files are written, and any HDFS systems referenced by
+ FileInputFormats, FileOutputFormats, DistCp, and the
+ distributed cache.
+ Other applications require to set the configuration
+ "mapreduce.job.hdfs-servers" for all NameNodes that tasks might
+ need to talk during the job execution. This is a comma separated
+ list of file system names, such as "hdfs://nn1/,hdfs://nn2/".
+ These tokens are passed to the JobTracker
+ as part of the job submission as <a href="ext:api/org/apache/hadoop/
+ security/credentials">Credentials</a>. </p>