TTransportFactory getAuthTransFactory(boolean useSSL, Configuration conf) throws LoginException {
    TTransportFactory transportFactory;
    TSaslServerTransport.Factory serverTransportFactory;

    if (isSASLWithKerberizedHadoop()) {
      try {
        if (useFramedTransport) {
          throw new LoginException("Framed transport is not supported with SASL enabled.");
        }
        serverTransportFactory = saslServer.createSaslServerTransportFactory(
                MetaStoreUtils.getMetaStoreSaslProperties(conf, useSSL));
        transportFactory = saslServer.wrapTransportFactoryInClientUGI(serverTransportFactory);
      } catch (TTransportException e) {
        throw new LoginException(e.getMessage());
      }
      if (authTypeStr.equalsIgnoreCase(AuthConstants.AuthTypes.KERBEROS.getAuthName())) {
        // no-op
      } else if (authTypeStr.equalsIgnoreCase(AuthConstants.AuthTypes.NONE.getAuthName()) ||
          authTypeStr.equalsIgnoreCase(AuthConstants.AuthTypes.LDAP.getAuthName()) ||
          authTypeStr.equalsIgnoreCase(AuthConstants.AuthTypes.PAM.getAuthName()) ||
          authTypeStr.equalsIgnoreCase(AuthConstants.AuthTypes.CUSTOM.getAuthName()) ||
          authTypeStr.equalsIgnoreCase(AuthConstants.AuthTypes.CONFIG.getAuthName())) {
        try {
          MetaStorePlainSaslHelper.init();
          LOG.debug("Adding server definition for PLAIN SaSL with authentication "+ authTypeStr +
                  " to transport factory " + serverTransportFactory);
          serverTransportFactory.addServerDefinition("PLAIN",
              authTypeStr, null, new HashMap<String, String>(),
              new MetaStorePlainSaslHelper.PlainServerCallbackHandler(authTypeStr, conf));
        } catch (AuthenticationException e) {
          throw new LoginException("Error setting callback handler" + e);
        }
      } else {
        throw new LoginException("Unsupported authentication type " + authTypeStr);
      }
    } else {
      if (authTypeStr.equalsIgnoreCase(AuthConstants.AuthTypes.NONE.getAuthName()) ||
              authTypeStr.equalsIgnoreCase(AuthConstants.AuthTypes.LDAP.getAuthName()) ||
              authTypeStr.equalsIgnoreCase(AuthConstants.AuthTypes.PAM.getAuthName()) ||
              authTypeStr.equalsIgnoreCase(AuthConstants.AuthTypes.CUSTOM.getAuthName()) ||
              authTypeStr.equalsIgnoreCase(AuthConstants.AuthTypes.CONFIG.getAuthName())) {
        if (useFramedTransport) {
          throw new LoginException("Framed transport is not supported with password based " +
                  "authentication enabled.");

        }
        if (executeSetUGI) {
          throw new LoginException("Setting " + ConfVars.EXECUTE_SET_UGI + " is not supported " +
                  "with password based authentication enabled.");
        }
        LOG.info("Using plain SASL transport factory with " + authTypeStr + " authentication");
        transportFactory = MetaStorePlainSaslHelper.getPlainTransportFactory(authTypeStr, conf);
      } else if (authTypeStr.equalsIgnoreCase(AuthConstants.AuthTypes.NOSASL.getAuthName())) {
        if (executeSetUGI) {
          transportFactory = useFramedTransport ?
                  new ChainedTTransportFactory(new TFramedTransport.Factory(),
                          new TUGIContainingTransport.Factory())
                  :new TUGIContainingTransport.Factory();
        } else {
          transportFactory = useFramedTransport ?
                  new TFramedTransport.Factory() : new TTransportFactory();
        }
      } else {
        throw new LoginException("Unsupported authentication type " + authTypeStr);
      }
    }

    return transportFactory;
  }
This class helps in some aspects of authentication. It creates the proper Thrift classes for the
given configuration as well as helps with authenticating requests.

This is copied from HiveAuthFactory and modified to be used for HMS. But we should see if we can
use same code for both Hive and HMS.
standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/AuthFactory.java