@Test
  public void testNoKrbSASLTokenAuthNeg() throws Exception {
    hs2Conn = DriverManager.getConnection(miniHS2.getBaseJdbcURL()
        + "default;user=" + SASL_NONKRB_USER1 + ";password=" + SASL_NONKRB_PWD);
    verifyProperty(SESSION_USER_NAME, SASL_NONKRB_USER1);

    try {
      // retrieve token and store in the cache
      String token = ((HiveConnection)hs2Conn).getDelegationToken(
          MiniHiveKdc.HIVE_TEST_USER_1, MiniHiveKdc.HIVE_SERVICE_PRINCIPAL);

      fail(SASL_NONKRB_USER1 + " shouldn't be allowed to retrieve token for " +
          MiniHiveKdc.HIVE_TEST_USER_2);
    } catch (SQLException e) {
      // Expected error
      assertTrue(e.getMessage().contains("Delegation token only supported over remote client with kerberos authentication"));
    } finally {
      hs2Conn.close();
    }
  }
Negative test for token based authentication
Verify that token is not applicable to non-Kerberos SASL user
@throws Exception
itests/hive-minikdc/src/test/java/org/apache/hive/minikdc/TestJdbcNonKrbSASLWithMiniKdc.java