fix ugi with kerberos