code: private static EsToken obtainEsToken(final RestClient client, User user) {
          // TODO: Should we extend this to basic authentication at some point?
          KerberosPrincipal principal = user.getKerberosPrincipal();
          if (user.isProxyUser()) {
              principal = user.getRealUserProvider().getUser().getKerberosPrincipal();
          }
          Assert.isTrue(principal != null, "Kerberos credentials are missing on current user");
          return user.doAs(new PrivilegedExceptionAction<EsToken>() {
              @Override
              public EsToken run() {
                  return client.createNewApiToken(newKeyName());
              }
          });
      }
docs: Obtain the given user's authentication token from Elasticsearch by performing the getAuthToken operation
  as the given user, thus ensuring the subject's private credentials available on the thread's access control
  context for the life of the operation.
  @param client The Elasticsearch client
  @param user the user object that contains credentials for obtaining an auth token
  @return the authentication token in ES-Hadoop specific format.