public TableMetaStore build() {
      if (disableAuth && configuration != null) {
        LOG.info("Build table meta store with local configuration:" + configuration);
        return new TableMetaStore(configuration);
      } else {
        readProperties();
        if (AUTH_METHOD_SIMPLE.equals(authMethod) || AUTH_METHOD_KERBEROS.equals(authMethod)) {
          Preconditions.checkNotNull(hdfsSite);
          Preconditions.checkNotNull(coreSite);
        }
        if (AUTH_METHOD_SIMPLE.equals(authMethod)) {
          Preconditions.checkNotNull(hadoopUsername);
        } else if (AUTH_METHOD_KERBEROS.equals(authMethod)) {
          Preconditions.checkNotNull(krbConf);
          Preconditions.checkNotNull(krbKeyTab);
          Preconditions.checkNotNull(krbPrincipal);
        } else if (AUTH_METHOD_AK_SK.equals(authMethod)) {
          Preconditions.checkNotNull(accessKey);
          Preconditions.checkNotNull(secretKey);
        } else if (authMethod != null) {
          throw new IllegalArgumentException("Unsupported auth method:" + authMethod);
        }

        LOG.info(
            "Build table meta store with configurations: authMethod:{}, hadoopUsername:{}, krbPrincipal:{}",
            authMethod,
            hadoopUsername,
            krbPrincipal);
        return new TableMetaStore(
            metaStoreSite,
            hdfsSite,
            coreSite,
            authMethod,
            hadoopUsername,
            krbKeyTab,
            krbConf,
            krbPrincipal,
            accessKey,
            secretKey,
            disableAuth);
      }
    }
Login with configured catalog user and create a proxy user ugi. Then the operations are
performed within the doAs method of this proxy user ugi.
amoro-common/src/main/java/org/apache/amoro/table/TableMetaStore.java