code: private String doKerberosAuth(HttpServletRequest request)
        throws HttpAuthenticationException {
      // Try authenticating with the http/_HOST principal
      if (httpUGI != null) {
        try {
          return httpUGI.doAs(new HttpKerberosServerAction(request, httpUGI));
        } catch (Exception e) {
          LOG.info("Failed to authenticate with http/_HOST kerberos principal, " +
              "trying with hive/_HOST kerberos principal");
        }
      }
      // Now try with hive/_HOST principal
      try {
        return serviceUGI.doAs(new HttpKerberosServerAction(request, serviceUGI));
      } catch (Exception e) {
        LOG.error("Failed to authenticate with hive/_HOST kerberos principal");
        throw new HttpAuthenticationException(e);
      }
  
    }
docs: Do the GSS-API kerberos authentication.
  We already have a logged in subject in the form of serviceUGI,
  which GSS-API will extract information from.
  In case of a SPNego request we use the httpUGI,
  for the authenticating service tickets.
  @param request
  @return
  @throws HttpAuthenticationException