public LlapTokenLocalClient getLocalTokenClient(
      final Configuration conf, String clusterUser) throws IOException {
    // Note that we create the cluster name from user conf (hence, a user can target a cluster),
    // but then we create the signer using hiveConf (hence, we control the ZK config and stuff).
    assert UserGroupInformation.isSecurityEnabled();
    String clusterName = LlapUtil.generateClusterName(conf);
    // This assumes that the LLAP cluster and session are both running under HS2 user.
    final String clusterId = DaemonId.createClusterString(clusterUser, clusterName);
    try {
      return localClientCache.get(clusterId, new Callable<LlapTokenLocalClientImpl>() {
        @Override
        public LlapTokenLocalClientImpl call() throws Exception {
          return new LlapTokenLocalClientImpl(hiveConf, clusterId);
        }
      });
    } catch (ExecutionException e) {
      throw new IOException(e);
    }
  }
We'll keep signers per cluster around for some time, for reuse.
llap-client/src/java/org/apache/hadoop/hive/llap/coordinator/LlapCoordinator.java