Hello. I am conducting a POC on Starrocks 4.0.6. I am attempting to create an external Iceberg catalog using an HMS with Kerberos authentication as the metastore. The catalog is created, but it does not work. The Kerberos authentication is the issue. Here is the SQL for the catalog I created. How do I create a catalog?

CREATE EXTERNAL CATALOG iceberg_hms
PROPERTIES (
    "type" = "iceberg",
    "iceberg.catalog.type" = "hive",
    "hadoop.security.authentication" = "kerberos",
    "hadoop.kerberos.principal" = "hive/pay-dev-cdp-hadoop-base-m3.gcp.kpay-in.net@PAYDEV2.HADOOP",
    "hadoop.kerberos.keytab" = "/home/deploy/starrocks/hive.keytab",
    "hive.metastore.uris" = "<thrift://pay-dev-cdp-hadoop-base-m3.gcp.kpay-in.net:9083>",                     
    "hive.metastore.sasl.enabled" = "true",
    "hive.metastore.kerberos.principal" = "hive/_HOST@PAYDEV2.HADOOP",
    "hive.metastore.client.kerberos.principal" = "hive/pay-dev-cdp-hadoop-base-m3.gcp.kpay-in.net@PAYDEV2.HADOOP",
    "hive.metastore.client.keytab" = "/home/deploy/starrocks/hive.keytab",
    "aws.s3.enable_path_style_access" = "true",
    "aws.s3.use_instance_profile" = "false",
    "aws.s3.region" = "default",
    "aws.s3.endpoint" = "[endpoint]",
    "aws.s3.access_key" = "[access_key]",
    "aws.s3.secret_key" = "[secret_key]",
    "aws.s3.enable_ssl" = "false"
 );

When I enable krb5.debug logging and check the logs, there are no attempts at Kerberos authentication other than an attempt to use the '/tmp/krb5cc_1000' cache. It seems that the Kerberos-related settings are not being applied to the catalog or are not working.

I am using Java 17 and have added these Java options.

I am using Java 17, and while troubleshooting, I added the following Java options.

JAVA_OPTS="-Dlog4j2.formatMsgNoLookups=true -Xmx4g \
    -XX:+UseG1GC -Xlog:gc*:${LOG_DIR}/fe.gc.log.$DATE:time \
    -XX:ErrorFile=${LOG_DIR}/hs_err_pid%p.log \
    -Djava.security.policy=${STARROCKS_HOME}/conf/udf_security.policy \
    -Djava.security.krb5.conf=/etc/krb5.conf \
    -Djavax.security.auth.useSubjectCredsOnly=false \
    -Dsun.security.krb5.debug=true -Dsun.security.jgss.debug=true \
    --add-opens=java.base/java.net=ALL-UNNAMED \
    --add-opens=java.base/java.lang=ALL-UNNAMED \
    --add-opens=java.base/java.util=ALL-UNNAMED \
    --add-opens=java.base/java.nio=ALL-UNNAMED \
    --add-opens=java.base/sun.nio.ch=ALL-UNNAMED \
    --add-opens=java.security.jgss/sun.security.krb5=ALL-UNNAMED \
"