private ByteString getTokenWithUgi(final String appId, UserGroupInformation ugi) throws ServiceException {
    if (client == null) {
      client = new LlapManagementProtocolClientImpl(conf, clientInstance.getHost(), clientInstance.getManagementPort(),
          retryPolicy, socketFactory);
    }
    client.withUgi(ugi);

    GetTokenRequestProto.Builder req = GetTokenRequestProto.newBuilder();
    if (!StringUtils.isBlank(appId)) {
      req.setAppId(appId);
    }
    return client.getDelegationToken(null, req.build()).getToken();
  }
Tries to fetch token by LlapManagementProtocolClientImpl with a kerberos login.
1. Logs in to kerberos
2. Obtains an authenticated ugi
3. Fetches a delegation token from a daemon.
This is supposed to be used if currentToken is not available or expired.
Kerberos login is a valid use-case if there is no other way to authenticate and get a new token. It always
means communication with the KDC, but if we use delegation token in at least ~90% of the time,
KDC should not become the bottleneck.
llap-client/src/java/org/apache/hadoop/hive/llap/security/LlapTokenClient.java