private void constructKerberosUgi() throws Exception {
      Path confPath = generateKrbConfPath();
      String krbConfFile = saveConfInPath(confPath, KRB_CONF_FILE_NAME, krbConf);
      String keyTabFile = saveConfInPath(confPath, KEY_TAB_FILE_NAME, krbKeyTab);
      System.clearProperty(HADOOP_USER_PROPERTY);
      System.setProperty(KRB5_CONF_PROPERTY, krbConfFile);
      if (System.getProperty("java.vendor").contains("IBM")) {
        ReflectionUtils.invoke("com.ibm.security.krb5.internal.Config", "refresh");
      } else {
        ReflectionUtils.invoke("sun.security.krb5.Config", "refresh");
      }
      UserGroupInformation.setConfiguration(getConfiguration());
      KerberosName.resetDefaultRealm();
      this.ugi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(krbPrincipal, keyTabFile);
    }
Login with configured catalog user and create a proxy user ugi. Then the operations are
performed within the doAs method of this proxy user ugi.
amoro-common/src/main/java/org/apache/amoro/table/TableMetaStore.java