code: public static void obtainTokenForJob(final RestClient client, User user, Job job) {
          Token<EsTokenIdentifier> token = obtainToken(client, user);
          if (token == null) {
              throw new EsHadoopException("No token returned for user " + user.getKerberosPrincipal().getName());
          }
          Text clusterName = token.getService();
          if (LOG.isDebugEnabled()) {
              LOG.debug("Obtained token " + EsTokenIdentifier.KIND_NAME.toString() + " for user " +
                      user.getKerberosPrincipal().getName() + " on cluster " + clusterName.toString());
          }
          job.getCredentials().addToken(clusterName, token);
      }
docs: Obtain an authentication token on behalf of the given user and add it to
  the credentials for the given map reduce job. This version always obtains
  a fresh authentication token instead of checking for existing ones on the
  current user.
  
  @param client The Elasticsearch client
  @param user The user for whom to obtain the token
  @param job The job instance in which the token should be stored