private void reLoginKerberosUgi() {
      synchronized (UserGroupInformation.class) {
        String oldKeytabFile = null;
        String oldPrincipal = null;
        if (UGI_REFLECT) {
          try {
            // use reflection to set private static field of UserGroupInformation for re-login
            // to fix static field reuse bug before hadoop-common version 3.1.0
            oldKeytabFile = (String) UGI_KEYTAB_FIELD.get(null);
            oldPrincipal = (String) UGI_PRINCIPLE_FIELD.get(null);
          } catch (IllegalAccessException e) {
            UGI_REFLECT = false;
            LOG.warn("Get kerberos configuration through reflection failed.", e);
          }
        }

        String oldSystemPrincipal = System.getProperty("sun.security.krb5.principal");
        boolean systemPrincipalChanged = false;
        try {
          if (!UserGroupInformation.isSecurityEnabled()) {
            UserGroupInformation.setConfiguration(getConfiguration());
            LOG.info(
                "Reset authentication method to Kerberos, isSecurityEnabled {},"
                    + " AuthenticationMethod {}, isKeytab {}",
                UserGroupInformation.isSecurityEnabled(),
                ugi.getAuthenticationMethod().toString(),
                ugi.isFromKeytab());
          }

          if (UGI_REFLECT) {
            try {
              UGI_PRINCIPLE_FIELD.set(null, krbPrincipal);
              UGI_KEYTAB_FIELD.set(null, getConfPath(confCachePath, KEY_TAB_FILE_NAME));
            } catch (IllegalAccessException e) {
              UGI_REFLECT = false;
              LOG.warn("Set kerberos configuration through reflection failed", e);
            }
          }

          if (oldSystemPrincipal != null && !oldSystemPrincipal.equals(krbPrincipal)) {
            System.setProperty("sun.security.krb5.principal", krbPrincipal);
            systemPrincipalChanged = true;
          }
          ugi.checkTGTAndReloginFromKeytab();
        } catch (Exception e) {
          throw new RuntimeException("Re-login from keytab failed", e);
        } finally {
          if (UGI_REFLECT) {
            try {
              UGI_PRINCIPLE_FIELD.set(null, oldPrincipal);
              UGI_KEYTAB_FIELD.set(null, oldKeytabFile);
            } catch (IllegalAccessException e) {
              UGI_REFLECT = false;
              LOG.warn("Get kerberos configuration through reflection failed", e);
            }
          }
          if (systemPrincipalChanged) {
            System.setProperty("sun.security.krb5.principal", oldSystemPrincipal);
          }
        }
      }
    }
Login with configured catalog user and create a proxy user ugi. Then the operations are
performed within the doAs method of this proxy user ugi.
amoro-common/src/main/java/org/apache/amoro/table/TableMetaStore.java