Code review comment: I do not get this part. Why do we create a new Token, and why do not we use the one received from Hive?  Like: ```                                 String tokenString =                                         client.getDelegationToken(freshUGI.getUserName(), renewer);                                 token.decodeFromUrlString(tokenString);                                 credentials.addToken(token.getKind(), token); ```

Code under review:
public ObtainedDelegationTokens obtainDelegationTokens() throws Exception {
        UserGroupInformation freshUGI = kerberosLoginProvider.doLoginAndReturnUGI();
        return freshUGI.doAs(
                (PrivilegedExceptionAction<ObtainedDelegationTokens>)
                        () -> {
                            Preconditions.checkNotNull(hiveConf);
                            Hive hive = Hive.get((HiveConf) hiveConf);
                            Clock clock = Clock.systemDefaultZone();
                            try {
                                LOG.info("Obtaining Kerberos security token for HiveServer2");

                                String principal =
                                        hiveConf.getTrimmed(
                                                "hive.metastore.kerberos.principal", "");

                                String tokenStr =
                                        hive.getDelegationToken(
                                                UserGroupInformation.getCurrentUser().getUserName(),
                                                principal);
                                Token<HiveServer2DelegationTokenIdentifier> hive2Token =
                                        new Token<>();
                                hive2Token.decodeFromUrlString(tokenStr);

                                Credentials credentials = new Credentials();
                                credentials.addToken(hive2Token.getKind(), hive2Token);

                                HiveServer2DelegationTokenIdentifier tokenIdentifier =
                                        getTokenIdentifier(hive2Token);

                                if (tokenRenewalInterval == null) {
                                    tokenRenewalInterval =
                                            getTokenRenewalInterval(
                                                    clock, tokenIdentifier, hive, tokenStr);
                                }
                                Optional<Long> validUntil =
                                        tokenRenewalInterval.flatMap(
                                                interval ->
                                                        getTokenRenewalDate(
                                                                clock, tokenIdentifier, interval));

                                return new ObtainedDelegationTokens(
                                        HadoopDelegationTokenConverter.serialize(credentials),
                                        validUntil);

                            } catch (Exception e) {
                                LOG.error(
                                        "Failed to obtain delegation token for {}",
                                        this.serviceName(),
                                        e);
                                throw new FlinkRuntimeException(e);
                            } finally {
                                Hive.closeCurrent();
                            }
                        });
    }

Line commented on: Token<HiveServer2DelegationTokenIdentifier> hive2Token =

Revised code:
public ObtainedDelegationTokens obtainDelegationTokens() throws Exception {
        UserGroupInformation freshUGI = kerberosLoginProvider.doLoginAndReturnUGI();
        return freshUGI.doAs(
                (PrivilegedExceptionAction<ObtainedDelegationTokens>)
                        () -> {
                            Preconditions.checkNotNull(hiveConf);
                            Hive hive = Hive.get((HiveConf) hiveConf);
                            Clock clock = Clock.systemDefaultZone();
                            try {
                                LOG.info("Obtaining Kerberos security token for HiveServer2");

                                String principal =
                                        hiveConf.getTrimmed(
                                                "hive.metastore.kerberos.principal", "");

                                String tokenStr =
                                        hive.getDelegationToken(
                                                UserGroupInformation.getCurrentUser().getUserName(),
                                                principal);
                                Token<DelegationTokenIdentifier> hive2Token = new Token<>();
                                hive2Token.decodeFromUrlString(tokenStr);

                                Credentials credentials = new Credentials();
                                credentials.addToken(hive2Token.getKind(), hive2Token);

                                DelegationTokenIdentifier tokenIdentifier =
                                        hive2Token.decodeIdentifier();

                                if (tokenRenewalInterval == null) {
                                    tokenRenewalInterval =
                                            getTokenRenewalInterval(
                                                    clock, tokenIdentifier, hive, tokenStr);
                                }
                                Optional<Long> validUntil =
                                        getTokenRenewalDate(
                                                clock, tokenIdentifier, tokenRenewalInterval);

                                return new ObtainedDelegationTokens(
                                        HadoopDelegationTokenConverter.serialize(credentials),
                                        validUntil);

                            } catch (Exception e) {
                                LOG.error(
                                        "Failed to obtain delegation token for {}",
                                        this.serviceName(),
                                        e);
                                throw new FlinkRuntimeException(e);
                            } finally {
                                Hive.closeCurrent();
                            }
                        });
    }