Currently, Impala Shell cannot connect directly to Impalad if it's configured with a proxy load balancer and kerberos. In this configuration, Impalad will present a credential that uses the load balancer's host. Impala Shell expects the impalad host. This mismatch caused the failure.
It is actually possible for the Impala Shell to expect a different host name in the credential. When setting up the SASL connection in sasl_factory(), we just need to set the load balancer's host in the sasl_client.setAttr("host").