The following curl command gives the token (but uses the name node directly).
$ curl -s --negotiate -u : "http://<active-namenode-hostname>:50070/webhdfs/v1/?op=GETDELEGATIONTOKEN"
Is it possible to use dfs.nameservices property to get the token instead.