@Override
  public void configure(Configuration conf,
    Collection<SaslClientAuthenticationProvider> providers) {
    if (this.conf != null) {
      throw new IllegalStateException("configure() should only be called once");
    }
    this.conf = Objects.requireNonNull(conf);

    for (SaslClientAuthenticationProvider provider : Objects.requireNonNull(providers)) {
      final String name = provider.getSaslAuthMethod().getName();
      if (SimpleSaslAuthenticationProvider.SASL_AUTH_METHOD.getName().contentEquals(name)) {
        if (simpleAuth != null) {
          throw new IllegalStateException(
            "Encountered multiple SimpleSaslClientAuthenticationProvider instances");
        }
        simpleAuth = (SimpleSaslClientAuthenticationProvider) provider;
      } else if (GssSaslAuthenticationProvider.SASL_AUTH_METHOD.getName().equals(name)) {
        if (krbAuth != null) {
          throw new IllegalStateException(
            "Encountered multiple GssSaslClientAuthenticationProvider instances");
        }
        krbAuth = (GssSaslClientAuthenticationProvider) provider;
      } else if (DigestSaslAuthenticationProvider.SASL_AUTH_METHOD.getName().equals(name)) {
        if (digestAuth != null) {
          throw new IllegalStateException(
            "Encountered multiple DigestSaslClientAuthenticationProvider instances");
        }
        digestAuth = (DigestSaslClientAuthenticationProvider) provider;
        digestAuthTokenKind = new Text(digestAuth.getTokenKind());
      } else {
        LOG.warn("Ignoring unknown SaslClientAuthenticationProvider: {}", provider.getClass());
      }
    }
    if (simpleAuth == null || krbAuth == null || digestAuth == null) {
      throw new IllegalStateException("Failed to load SIMPLE, KERBEROS, and DIGEST authentication "
        + "providers. Classpath is not sane.");
    }
  }
Default implementation of {@link AuthenticationProviderSelector} which can choose from the
authentication implementations which HBase provides out of the box: Simple, Kerberos, and
Delegation Token authentication. This implementation will ignore any
{@link SaslAuthenticationProvider}'s which are available on the classpath or specified in the
configuration because HBase cannot correctly choose which token should be returned to a client
when multiple are present. It is expected that users implement their own
{@link AuthenticationProviderSelector} when writing a custom provider. This implementation is not
thread-safe. {@link #configure(Configuration, Collection)} and
{@link #selectProvider(String, User)} is not safe if they are called concurrently.
hbase-client/src/main/java/org/apache/hadoop/hbase/security/provider/BuiltInProviderSelector.java