[fix](filesystem) replace throttled kerberos relogin with proactive TGT refresh to fix flaky GSS failure

[CalvinKirs]

What problem does this PR solve?

Issue Number: close #xxx

Related PR: #62023

Problem Summary:

The regression case test_two_hive_kerberos fails intermittently with:

GSSException: No valid credentials provided
...
Caused by: javax.security.auth.login.LoginException: Cannot read from System.in

Root cause: the KerberosHadoopAuthenticator in fe-filesystem-hdfs (introduced in #62023) relies on Hadoop's UserGroupInformation.checkTGTAndReloginFromKeytab(), which has a hard-coded 60s relogin throttle (hasSufficientTimeElapsed). When the TGT expires inside that throttle window, the relogin is silently skipped, the subsequent SASL handshake finds no valid ticket, and the JAAS fallback path tries to prompt on System.in — which fails in a server process.

Fix: replace the throttled reactive relogin with trino's proactive TGT refresh model (ported 1:1 from trino 435 KerberosAuthentication / CachingKerberosHadoopAuthentication / KerberosTicketUtils):

• Login eagerly at construction with explicit JAAS options (doNotPrompt=true, useKeyTab=true, storeKey=true, isInitiator=true) — doNotPrompt=true makes the System.in prompt path impossible.
• Compute the next refresh time as ticket start + 80% of ticket lifetime.
• On each doAs, if past the refresh point, perform a fresh keytab login (no throttle) and swap the new credentials into the existing Subject in place, so the cached UGI stays valid.
• A failed refresh does not advance the refresh time, so the next call retries immediately; the failure is wrapped as IOException to keep the SPI's checked-exception contract.

The vendored KerberosTicketUtils is placed in fe-foundation (org.apache.doris.foundation.security) and provided to filesystem plugins through fe-filesystem-spi, which also lets fe-common's HadoopKerberosAuthenticator drop its io.trino import.

Release note

None

Check List (For Author)

• Test

  • Regression test
  • Unit Test
  • Manual test (add detailed scripts or steps below)
  • No need to test or manual test. Explain why:
    • This is a refactor/code format and no logic has been changed.
    • Previous test can cover this change.
    • No code files have been changed.
    • Other reason

• Behavior changed:

  • No.
  • Yes. Kerberos keytab relogin in fe-filesystem-hdfs is now proactive (refresh at 80% of TGT lifetime, unthrottled) instead of Hadoop's reactive relogin with a 60s throttle.

• Does this need documentation?

  • No.
  • Yes.

Check List (For Reviewer who merge this PR)

• Confirm the release note
• Confirm test cases
• Confirm document
• Add branch pick label

[hello-stephen]

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
3. What features were added. Why was this function added?
4. Which code was refactored and why was this part of the code refactored?
5. Which functions were optimized and what is the difference before and after the optimization?

[CalvinKirs]

run buildall

[CalvinKirs]

/review

[github-actions]

Automated review result: no blocking code issues found in this PR.

Checkpoint conclusions:

• Goal/test: The change addresses the HDFS filesystem Kerberos relogin throttle by replacing checkTGTAndReloginFromKeytab() with explicit JAAS keytab login plus proactive TGT refresh at 80% lifetime. The added unit tests cover eager login, fresh-ticket no-op behavior, stale-ticket refresh without throttle, IOException propagation, constructor login failure wrapping, and retry after refresh failure. GitHub-visible COMPILE, CheckStyle, and FE UT checks are passing.
• Scope/focus: The patch is focused on moving KerberosTicketUtils into fe-foundation, wiring dependencies, and updating the HDFS filesystem authenticator. No additional user-provided review focus was present.
• Concurrency/lifecycle: The cached Subject/UGI lifecycle is explicit and stable. Refresh is serialized on the authenticator instance, UGI global configuration remains under the existing process-wide lock, and I did not find a new deadlock or shared-state race distinct from the Trino-style credential swap this code ports.
• Configuration/compatibility: No new user-facing config, thrift protocol, storage format, or rolling-upgrade compatibility concern was introduced. The new fe-foundation dependency is available to fe-common, fe-core, and filesystem provider runtime loading paths.
• Parallel paths: The separate FE common Kerberos authenticator already uses the same proactive refresh utility; no remaining production use of Hadoop's throttled checkTGTAndReloginFromKeytab() was found.
• Error handling: Constructor login failures keep the existing unchecked construction contract, and refresh failures are converted back to the filesystem SPI's checked IOException contract. Interrupted actions restore the interrupt flag.
• Security model: I read SECURITY.md and threat-model.md because this touches authentication. The affected HDFS/external filesystem path is admin-connected external storage under the model; I did not find a client-facing authentication or RBAC regression.
• Observability: Existing login success logging plus refresh logging includes the principal and refresh time; that looks sufficient for this narrow relogin path.

Note: gh pr checks currently shows TeamCity P0 Regression, FE coverage, and performance checks failing, but their logs require TeamCity authentication from this runner. I did not classify those opaque CI failures as code findings; they still need normal CI follow-up before merge.

[github-actions]

PR approved by at least one committer and no changes requested.

[github-actions]

PR approved by anyone and no changes requested.

[CalvinKirs]

run p0
run performance

[hello-stephen]

FE Regression Coverage Report

Increment line coverage 0.00% (0/1020) 🎉
Increment coverage report
Complete coverage report

[CalvinKirs]

run performance

[CalvinKirs]

run performance

[CalvinKirs]

run buildall

[hello-stephen]

FE Regression Coverage Report

Increment line coverage 0.00% (0/561) 🎉
Increment coverage report
Complete coverage report

[CalvinKirs]

run buildall

[hello-stephen]

FE UT Coverage Report

Increment line coverage `` 🎉
Increment coverage report
Complete coverage report

[CalvinKirs]

run performance

[CalvinKirs]

run buildall

[hello-stephen]

TPC-H: Total hot run time: 29254 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpch-tools
Tpch sf100 test result on commit c0bab40a03f7d7dfb3f1c06e03eb1358922c1917, data reload: false
------ Round 1 ----------------------------------
============================================
q1	17831	4097	4019	4019
q2	2016	309	191	191
q3	10314	1407	823	823
q4	4684	475	340	340
q5	7499	899	589	589
q6	186	168	136	136
q7	766	840	617	617
q8	9333	1491	1698	1491
q9	5591	4532	4547	4532
q10	6784	1790	1537	1537
q11	437	278	253	253
q12	636	421	287	287
q13	18097	3403	2775	2775
q14	259	261	245	245
q15	q16	787	770	711	711
q17	1033	989	1032	989
q18	6856	5908	5622	5622
q19	1320	1254	1137	1137
q20	490	429	273	273
q21	6049	2650	2383	2383
q22	421	362	304	304
Total cold run time: 101389 ms
Total hot run time: 29254 ms
----- Round 2, with runtime_filter_mode=off -----
============================================
q1	4394	4291	4313	4291
q2	331	340	224	224
q3	4557	5044	4426	4426
q4	2080	2135	1383	1383
q5	4422	4297	4520	4297
q6	239	181	128	128
q7	1717	1774	1882	1774
q8	2638	2214	2157	2157
q9	8247	8445	8087	8087
q10	4864	4701	4294	4294
q11	556	435	384	384
q12	773	796	554	554
q13	3231	3559	2936	2936
q14	304	300	282	282
q15	q16	736	752	670	670
q17	1350	1330	1322	1322
q18	8145	7194	7152	7152
q19	1169	1164	1146	1146
q20	2205	2211	1952	1952
q21	5264	4626	4514	4514
q22	517	451	390	390
Total cold run time: 57739 ms
Total hot run time: 52363 ms

[hello-stephen]

TPC-DS: Total hot run time: 173140 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpcds-tools
TPC-DS sf100 test result on commit c0bab40a03f7d7dfb3f1c06e03eb1358922c1917, data reload: false
query5	4309	624	489	489
query6	435	184	176	176
query7	4844	511	314	314
query8	332	191	170	170
query9	8755	4146	4139	4139
query10	450	311	260	260
query11	5938	2350	2113	2113
query12	151	101	113	101
query13	1313	629	442	442
query14	6223	5317	5002	5002
query14_1	4353	4310	4349	4310
query15	222	201	183	183
query16	1001	484	475	475
query17	956	736	600	600
query18	2466	480	362	362
query19	209	189	152	152
query20	114	110	118	110
query21	232	144	122	122
query22	13709	13667	13462	13462
query23	17506	16581	16152	16152
query23_1	16267	16276	16368	16276
query24	7518	1818	1334	1334
query24_1	1349	1310	1305	1305
query25	584	470	406	406
query26	1298	333	180	180
query27	2665	592	328	328
query28	4517	2093	2081	2081
query29	1085	631	543	543
query30	319	236	199	199
query31	1109	1077	962	962
query32	111	62	60	60
query33	531	316	251	251
query34	1208	1298	700	700
query35	761	790	679	679
query36	1382	1388	1196	1196
query37	153	108	103	103
query38	1888	1716	1687	1687
query39	915	921	914	914
query39_1	895	865	865	865
query40	233	124	103	103
query41	65	63	64	63
query42	88	88	89	88
query43	322	322	277	277
query44	1428	809	799	799
query45	205	181	184	181
query46	1111	1180	725	725
query47	2359	2320	2256	2256
query48	401	429	291	291
query49	581	428	326	326
query50	985	359	258	258
query51	4470	4339	4318	4318
query52	81	81	70	70
query53	254	264	190	190
query54	262	220	201	201
query55	74	70	66	66
query56	237	230	236	230
query57	1459	1418	1311	1311
query58	239	216	208	208
query59	1616	1603	1440	1440
query60	276	244	218	218
query61	153	146	179	146
query62	688	651	587	587
query63	227	192	193	192
query64	2521	747	592	592
query65	4874	4769	4711	4711
query66	1797	484	347	347
query67	29847	29671	29634	29634
query68	3515	1555	869	869
query69	409	310	265	265
query70	1127	943	947	943
query71	310	236	215	215
query72	2921	2725	2349	2349
query73	870	787	442	442
query74	5163	4936	4780	4780
query75	2581	2567	2187	2187
query76	2329	1174	793	793
query77	345	383	295	295
query78	12325	12421	11852	11852
query79	1209	1294	776	776
query80	517	456	383	383
query81	452	292	249	249
query82	234	160	130	130
query83	273	269	247	247
query84	297	145	110	110
query85	821	572	418	418
query86	331	308	296	296
query87	1840	1828	1772	1772
query88	3696	2829	2806	2806
query89	407	386	328	328
query90	2157	192	195	192
query91	183	175	134	134
query92	60	61	56	56
query93	1527	1539	987	987
query94	551	346	326	326
query95	709	470	352	352
query96	1073	824	374	374
query97	2714	2677	2569	2569
query98	228	222	199	199
query99	1203	1151	986	986
Total cold run time: 257773 ms
Total hot run time: 173140 ms

[hello-stephen]

ClickBench: Total hot run time: 25.33 s

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/clickbench-tools
ClickBench test result on commit c0bab40a03f7d7dfb3f1c06e03eb1358922c1917, data reload: false
query1	0.01	0.01	0.01
query2	0.09	0.05	0.05
query3	0.26	0.14	0.14
query4	1.61	0.15	0.14
query5	0.23	0.24	0.22
query6	1.19	1.09	1.02
query7	0.04	0.01	0.01
query8	0.06	0.05	0.04
query9	0.38	0.30	0.31
query10	0.62	0.57	0.56
query11	0.19	0.14	0.14
query12	0.18	0.14	0.14
query13	0.45	0.46	0.48
query14	1.02	1.02	1.02
query15	0.62	0.59	0.59
query16	0.31	0.33	0.32
query17	1.11	1.11	1.09
query18	0.23	0.21	0.21
query19	2.10	2.01	1.94
query20	0.01	0.01	0.01
query21	15.50	0.19	0.14
query22	4.93	0.06	0.05
query23	16.14	0.31	0.12
query24	2.93	0.43	0.33
query25	0.11	0.05	0.05
query26	0.76	0.20	0.14
query27	0.04	0.03	0.04
query28	3.48	0.92	0.54
query29	12.50	4.37	3.45
query30	0.28	0.16	0.15
query31	2.77	0.62	0.31
query32	3.22	0.61	0.50
query33	3.17	3.29	3.29
query34	15.56	4.21	3.52
query35	3.57	3.51	3.51
query36	0.57	0.45	0.43
query37	0.09	0.07	0.06
query38	0.05	0.04	0.04
query39	0.04	0.03	0.03
query40	0.17	0.17	0.15
query41	0.08	0.03	0.03
query42	0.04	0.02	0.02
query43	0.04	0.04	0.03
Total cold run time: 96.75 s
Total hot run time: 25.33 s

[CalvinKirs]

/review

[github-actions]

Automated review summary for PR 64394.

I reviewed the Kerberos refresh change across the HDFS filesystem plugin, the shared Kerberos ticket helper moved into fe-foundation, the fe-common import/dependency adjustment, the filesystem SPI/module dependency propagation, the new unit tests, and the cdc_client build-script change.

Critical checkpoint conclusions:

• Goal/test proof: the PR replaces Hadoop UGI's throttled keytab relogin in the HDFS filesystem plugin with proactive 80% TGT refresh, and adds focused unit coverage for refresh timing, in-place credential swap, retry after failed refresh, and helper behavior.
• Scope/focus: changes are focused on Kerberos ticket refresh and the required module/build dependency wiring.
• Concurrency/lifecycle: refresh is serialized through synchronized getUGI(), keeps the same Subject/UGI for cached Hadoop clients, and follows the same in-place credential replacement pattern as the referenced Trino implementation.
• Configuration/compatibility: no new user-facing config items or storage/protocol format changes. Existing Kerberos properties continue to drive the authenticator path.
• Parallel paths: the older fe-common Kerberos authenticator now imports the shared helper; HDFS plugin packaging and SPI/fe-foundation classpath behavior were checked.
• Tests/results: new Java unit tests cover the key refresh paths. I did not run FE Maven tests/builds because this checkout lacks thirdparty/installed, thirdparty/installed/bin/protoc, and thrift, and fe/AGENTS.md says to stop FE build when protoc is absent.
• Security/threat model: reviewed SECURITY.md and threat-model.md because the PR touches Kerberos authentication. I found no new in-model security issue or trust-boundary change.
• Observability/performance: refresh logs are lightweight and occur only on login/refresh; no hot-path excessive work beyond the synchronized refresh check.

Subagent conclusions:

• optimizer-rewrite: no optimizer/rewrite or semantic-equivalence findings; convergence round 1 returned NO_NEW_VALUABLE_FINDINGS.
• tests-session-config: no test/session/config/build candidate findings; convergence round 1 returned NO_NEW_VALUABLE_FINDINGS.
• No duplicate candidates or accepted inline comments remained. Proposed final comment set was empty, so this review is summary-only.

No additional user focus was provided.

[github-actions]

PR approved by at least one committer and no changes requested.