@InterfaceAudience.Private
  public static User loginClient(Configuration conf) throws IOException {
    UserProvider provider = UserProvider.instantiate(conf);
    User user = provider.getCurrent();
    boolean securityOn = provider.isHBaseSecurityEnabled() && provider.isHadoopSecurityEnabled();

    if (securityOn) {
      boolean fromKeytab = provider.shouldLoginFromKeytab();
      if (user.getUGI().hasKerberosCredentials()) {
        // There's already a login user.
        // But we should avoid misuse credentials which is a dangerous security issue,
        // so here check whether user specified a keytab and a principal:
        // 1. Yes, check if user principal match.
        // a. match, just return.
        // b. mismatch, login using keytab.
        // 2. No, user may login through kinit, this is the old way, also just return.
        if (fromKeytab) {
          return checkPrincipalMatch(conf, user.getUGI().getUserName())
            ? user
            : loginFromKeytabAndReturnUser(provider);
        }
        return user;
      } else if (fromKeytab) {
        // Kerberos is on and client specify a keytab and principal, but client doesn't login yet.
        return loginFromKeytabAndReturnUser(provider);
      }
    }
    return user;
  }
For kerberized cluster, return login user (from kinit or from keytab if specified). For
non-kerberized cluster, return system user.
@param conf configuartion file
@throws IOException login exception
hbase-common/src/main/java/org/apache/hadoop/hbase/AuthUtil.java