public static void updateCredentialProviderPasswordForJobs(Configuration jobConf) {
    String credstorePassword = getJobCredentialProviderPassword(jobConf);
    if (credstorePassword != null) {
      String execEngine = jobConf.get(ConfVars.HIVE_EXECUTION_ENGINE.varname);

      if ("mr".equalsIgnoreCase(execEngine) || "tez".equalsIgnoreCase(execEngine)) {
        // if the execution engine is MR/Tez set the map/reduce env with the credential store password
        Collection<String> redactedProperties =
            jobConf.getStringCollection(MRJobConfig.MR_JOB_REDACTED_PROPERTIES);
        /*
         * There are AM + task related environment props below, used for both MR and Tez.
         * Hiveserver2 copies some of them while creating the vertex in
         * DagUtils.createVertex -> setTaskEnvironment(getContainerEnvironment(conf)).
         * So for clarity's sake, TEZ_TASK_LAUNCH_ENV is not added here to avoid confusion of
         * taking care of task env twice. Comments below clarifies which execution engine relies on which property.
         * "MR -> Tez" means that DagUtils copies them to tez tasks' environment.
         */
        Stream.of(
            JobConf.MAPRED_MAP_TASK_ENV, // MR -> Tez
            JobConf.MAPRED_REDUCE_TASK_ENV, // MR -> Tez
            MRJobConfig.MR_AM_ADMIN_USER_ENV, // MR
            TezConfiguration.TEZ_AM_LAUNCH_ENV) // Tez

            .forEach(property -> {
              addKeyValuePair(jobConf, property,
                  Constants.HADOOP_CREDENTIAL_PASSWORD_ENVVAR, credstorePassword);
              redactedProperties.add(property);
            });

        // Hide sensitive configuration values from MR HistoryUI by telling MR to redact the following list.
        jobConf.set(MRJobConfig.MR_JOB_REDACTED_PROPERTIES,
            StringUtils.join(redactedProperties, COMMA));
      }
    }
  }
Updates the job configuration with the job specific credential provider information available
in the HiveConf.It uses the environment variables HADOOP_CREDSTORE_PASSWORD or
HIVE_JOB_CREDSTORE_PASSWORD to get the custom password for all the keystores configured in the
provider path. This usage of environment variables is similar in lines with Hadoop credential
provider mechanism for getting the keystore passwords. The other way of communicating the
password is through a file which stores the password in clear-text which needs to be readable
by all the consumers and therefore is not supported.

<ul>
<li>If HIVE_SERVER2_JOB_CREDENTIAL_PROVIDER_PATH is set in the hive configuration this method
overrides the MR job configuration property hadoop.security.credential.provider.path with its
value. If not set then it does not change the value of hadoop.security.credential.provider.path
<li>In order to choose the password for the credential provider we check :

  (1) if job credential provider path HIVE_SERVER2_JOB_CREDENTIAL_PROVIDER_PATH is set we check if
      HIVE_SERVER2_JOB_CREDSTORE_PASSWORD_ENVVAR is set. If it is set we use it.
  (2) If password is not set using (1) above we use HADOOP_CREDSTORE_PASSWORD if it is set.
  (3) If none of those are set, we do not set any password in the MR task environment. In this
      case the hadoop credential provider should use the default password of "none" automatically
</ul>
@param jobConf - job specific configuration
common/src/java/org/apache/hadoop/hive/conf/HiveConfUtil.java