public static TTransport getTokenTransport(String tokenStr, String host,
    TTransport underlyingTransport, Map<String, String> saslProps) throws SaslException {
    HadoopThriftAuthBridge.Client authBridge =
      HadoopThriftAuthBridge.getBridge().createClientWithConf("kerberos");

    try {
      return authBridge.createClientTransport(null, host, "DIGEST", tokenStr, underlyingTransport,
                                              saslProps);
    } catch (IOException e) {
      throw new SaslException("Failed to open client transport", e);
    }
  }
Helper to wrap the {@code underlyingTransport} into an assumed kerberos principal.
The function is used for kerberos based authentication, where {@code kerberosAuthType}
is set to {@code fromSubject}. If also performs a substitution of {@code _HOST} to the
local host name, if required.

@param principal The kerberos principal to assume
@param host Host, used to replace the {@code _HOST} with
@param underlyingTransport The I/O transport to wrap
@param saslProps SASL property map
@return The wrapped transport
@throws IOException
service/src/java/org/apache/hive/service/auth/KerberosSaslHelper.java