@Override
  public void getAuthenticationToken(RpcController controller,
    AuthenticationProtos.GetAuthenticationTokenRequest request,
    RpcCallback<AuthenticationProtos.GetAuthenticationTokenResponse> done) {
    AuthenticationProtos.GetAuthenticationTokenResponse.Builder response =
      AuthenticationProtos.GetAuthenticationTokenResponse.newBuilder();

    try {
      if (secretManager == null) {
        throw new IOException("No secret manager configured for token authentication");
      }
      User currentUser = RpcServer.getRequestUser()
        .orElseThrow(() -> new AccessDeniedException("No authenticated user for request!"));
      UserGroupInformation ugi = currentUser.getUGI();
      if (!isAllowedDelegationTokenOp(ugi)) {
        LOG.warn("Token generation denied for user=" + currentUser.getName() + ", authMethod="
          + ugi.getAuthenticationMethod());
        throw new AccessDeniedException(
          "Token generation only allowed for Kerberos authenticated clients");
      }

      Token<AuthenticationTokenIdentifier> token =
        secretManager.generateToken(currentUser.getName());
      response.setToken(ClientTokenUtil.toToken(token)).build();
    } catch (IOException ioe) {
      CoprocessorRpcUtils.setControllerException(controller, ioe);
    }
    done.run(response.build());
  }
@param ugi A user group information.
@return true if delegation token operation is allowed
hbase-server/src/main/java/org/apache/hadoop/hbase/security/token/TokenProvider.java