As per Token Management API docs client_credentials grant type should allows us to create a token simply as the authenticated user (e.g. for Kerberos users when request to create a token would include Authorization: Negotiate **spnego-token** HTTP header), but currently Elasticsearch complains if user is not granted a cluster:admin/xpack/security/token/create cluster privilege.

Is it expected that all Kerberos users should be granted cluster:admin/xpack/security/token/create cluster privilege?

/cc @jkakavas @bizybot @kobelb