public void addCredentials(BaseWork work, DAG dag, JobConf conf) {
    Set<URI> fileSinkUris = new HashSet<URI>();
    Set<TableDesc> fileSinkTableDescs = new HashSet<TableDesc>();
    collectNeededFileSinkData(work, fileSinkUris, fileSinkTableDescs);

    if (work instanceof MapWork){
      Set<Path> paths = ((MapWork)work).getPathToAliases().keySet();
      if (!paths.isEmpty()) {
        Iterator<URI> pathIterator = Iterators.transform(paths.iterator(), new Function<Path, URI>() {
          @Override
          public URI apply(Path path) {
            return path.toUri();
          }
        });

        Set<URI> uris = new HashSet<URI>();
        Iterators.addAll(uris, pathIterator);

        if (LOG.isDebugEnabled()) {
          for (URI uri: uris) {
            LOG.debug("Marking MapWork input URI as needing credentials: " + uri);
          }
        }
        dag.addURIsForCredentials(uris);
      }
      getCredentialsFromSuppliers(work, fileSinkTableDescs, dag, conf);
    }
    getCredentialsForFileSinks(work, fileSinkUris, dag);
  }
Set up credentials for the base work on secure clusters
ql/src/java/org/apache/hadoop/hive/ql/exec/tez/DagUtils.java