private String doSamlAuth(HttpServletRequest request, HttpServletResponse response)
      throws HttpAuthenticationException {
    String token = extractBearerToken(request, response);
    if (token == null) {
      throw new HttpSamlAuthenticationException("Token not found.");
    }
    String clientIdentifier = request.getHeader(HiveSamlUtils.SSO_CLIENT_IDENTIFIER);
    if (clientIdentifier == null) {
      throw new HttpSamlAuthenticationException("Client identifier not found.");
    }
    String user = HiveSamlAuthTokenGenerator.get(hiveConf).validate(token);
    LOG.info("Successfully validated the token for user {}", user);
    // token is valid; now confirm if the client identifier matches with the relay state.
    Map<String, String> keyValues = new HashMap<>();
    if (HiveSamlAuthTokenGenerator.parse(token, keyValues)) {
      String relayStateKey = keyValues.get(HiveSamlAuthTokenGenerator.RELAY_STATE);
      if (!HiveSamlRelayStateStore.get()
          .validateClientIdentifier(relayStateKey, clientIdentifier)) {
        throw new HttpSamlAuthenticationException(
            "Client identifier could not be validated");
      }
    }
    return user;
  }
This method validates the bearer token in the request. If the token is not or if the
token is not valid it throws a {@link HttpSamlAuthenticationException}. A token is
valid only if all the following conditions are met.
1. Token signature is valid.
2. Token is not expired.
3. Token maps to a relayState which has a matching client identifier in the request.
service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java