private static Token<LlapTokenIdentifier> getLlapToken(
      String user, final Configuration conf) throws IOException {
    // TODO: parts of this should be moved out of TezSession to reuse the clients, but there's
    //       no good place for that right now (HIVE-13698).
    // TODO: De-link from SessionState. A TezSession can be linked to different Hive Sessions via the pool.
    SessionState session = SessionState.get();
    boolean isInHs2 = session != null && session.isHiveServerQuery();
    Token<LlapTokenIdentifier> token = null;
    // For Tez, we don't use appId to distinguish the tokens.

    LlapCoordinator coordinator = null;
    if (isInHs2) {
      // We are in HS2, get the token locally.
      // TODO: coordinator should be passed in; HIVE-13698. Must be initialized for now.
      coordinator = LlapCoordinator.getInstance();
      if (coordinator == null) {
        throw new IOException("LLAP coordinator not initialized; cannot get LLAP tokens");
      }
      // Signing is not required for Tez.
      token = coordinator.getLocalTokenClient(conf, user).createToken(null, null, false);
    } else {
      // We are not in HS2; always create a new client for now.
      token = new LlapTokenClient(conf).getDelegationToken(null);
    }
    LOG.info("Obtained a LLAP token: " + token);
    return token;
  }
Check if Kerberos authentication is enabled.
This is used by:
- HS2 (upon Tez session creation)
In secure scenarios HS2 might either be logged on (by Kerberos) by itself or by a launcher
script it was forked from. In the latter case UGI.getLoginUser().isFromKeytab() returns false,
hence UGI.getLoginUser().hasKerberosCredentials() is a tightest setting we can check against.
ql/src/java/org/apache/hadoop/hive/ql/exec/tez/TezSessionState.java