Oozie jobs do not pass credentials

Kite doesn't currently support how Oozie passes credentials to java actions:

Long-story-short, you can get the tokens from an environment variable called HADOOP_TOKEN_FILE_LOCATION. This points to a file that contains the tokens. You can then set that to "mapreduce.job.credentials.binary" in a JobConf that you use from launching jobs from the Java Action . . .

On a related note, Oozie normally prepares a Configuration with the properties specified in the site files given to Oozie + the <configuration> section in your action. Most actions pass this config along to child jobs automatically; however, the Java action does not (because you're writing the code). You can get the Configuration Oozie prepared from a System Property named "oozie.action.conf.xml"; it's not currently in the documentation, but OOZIE-1696 has it. So if you wanted the <configuration> section and the mapred-site to be applied instead of just the default config, you should do this first, and then do the tokens to this configuration.

The URI code should pick up the oozie.action.conf.xml file and apply it to the environment config it builds, and the Hive support should correctly set up the credentials.