public UserGroupInformation getUGI() {
      if (ugi == null) {
        try {
          if (TableMetaStore.AUTH_METHOD_SIMPLE.equals(authMethod)) {
            ugi = UserGroupInformation.createRemoteUser(hadoopUsername);
          } else if (TableMetaStore.AUTH_METHOD_KERBEROS.equals(authMethod)) {
            constructKerberosUgi();
          }
          LOG.info("Completed to build ugi {}", authInformation());
        } catch (Exception e) {
          throw new RuntimeException("Fail to init user group information", e);
        }
      } else {
        if (TableMetaStore.AUTH_METHOD_KERBEROS.equals(authMethod)) {
          // re-construct
          if (!ugi.getAuthenticationMethod().toString().equals(authMethod)
              || (!ugi.getUserName().equals(krbPrincipal)
                  && !StringUtils.substringBefore(ugi.getUserName(), "@").equals(krbPrincipal))) {
            try {
              constructKerberosUgi();
              LOG.info("Completed to re-build ugi {}", authInformation());
            } catch (Exception e) {
              throw new RuntimeException("Fail to init user group information", e);
            }
          } else {
            // re-login
            reLoginKerberosUgi();
          }
        }
      }
      return ugi;
    }
Login with configured catalog user and create a proxy user ugi. Then the operations are
performed within the doAs method of this proxy user ugi.
amoro-common/src/main/java/org/apache/amoro/table/TableMetaStore.java