@Override
  public byte[] retrievePassword(AuthenticationTokenIdentifier identifier) throws InvalidToken {
    long now = EnvironmentEdgeManager.currentTime();
    if (identifier.getExpirationDate() < now) {
      throw new InvalidToken("Token has expired");
    }
    AuthenticationKey masterKey = allKeys.get(identifier.getKeyId());
    if (masterKey == null) {
      if (zkWatcher.getWatcher().isAborted()) {
        LOG.error("ZKWatcher is abort");
        throw new InvalidToken(
          "Token keys could not be sync from zookeeper" + " because of ZKWatcher abort");
      }
      synchronized (this) {
        if (!leaderElector.isAlive() || leaderElector.isStopped()) {
          LOG.warn("Thread leaderElector[" + leaderElector.getName() + ":" + leaderElector.getId()
            + "] is stopped or not alive");
          leaderElector.start();
          LOG.info("Thread leaderElector [" + leaderElector.getName() + ":" + leaderElector.getId()
            + "] is started");
        }
      }
      zkWatcher.refreshKeys();
      if (LOG.isDebugEnabled()) {
        LOG.debug("Sync token keys from zookeeper");
      }
      masterKey = allKeys.get(identifier.getKeyId());
    }
    if (masterKey == null) {
      throw new InvalidToken("Unknown master key for token (id=" + identifier.getKeyId() + ")");
    }
    // regenerate the password
    return createPassword(identifier.getBytes(), masterKey.getKey());
  }
Create a new secret manager instance for generating keys.
@param conf              Configuration to use
@param zk                Connection to zookeeper for handling leader elections
@param keyUpdateInterval Time (in milliseconds) between rolling a new master key for token
                         signing
@param tokenMaxLifetime  Maximum age (in milliseconds) before a token expires and is no longer
                         valid
hbase-server/src/main/java/org/apache/hadoop/hbase/security/token/AuthenticationTokenSecretManager.java