Through some great testing by Kevin Liew, we got an early warning that PQS' support for SPNEGO authentication didn't work for clients coming from a realm other than the server.
I put a fix in CALCITE-1282 to allow configuration, but we'll need to update an API call to configure the Avatica server.
Upgrade to Apache Avatica 1.9.0
Release Avatica 1.9.0
Avatica will only accept SPNEGO-authenticated clients from the same realm as the server's principal