The issue was found after
HADOOP-13988 by Hadoop-HDFS test (TestAclsEndToEnd). Sorry both Jenkins and I was not able to catch it. HADOOP-13988 fixed the issue for KMSClientProvider secure proxy user(token) use case. But the non-secure proxy user case should not be affected by the new logic. The ticket is open to fix it.