Tom is investigating this for the customer to include in a patch and the right approach

When  connecting via Kerberos we are having difficulty.  Can we change the default driver to Microsoft or remove the NTLM setting.

https://docs.microsoft.com/en-us/sql/connect/jdbc/using-kerberos-integrated-authentication-to-connect-to-sql-server?view=sql-server-2017

In Aqua Data Studio you can switch that over to use the Microsoft driver in the server properties and connect using Kerberos integrated security.  See attached screenshots. They can also add the principal and password to the login, if required. Not knowing how your Kerberos is configured,you will probably also need a krb5.ini and jaas.config file. A kinit is also required to update the ticket cache.