public synchronized boolean validateClientIdentifier(String relayStateKey,
      String clientIdentifier) {
    HiveSamlRelayStateInfo relayStateInfo = relayStateCache.getIfPresent(relayStateKey);
    if (relayStateInfo == null) {
      return false;
    }
    relayStateCache.invalidate(relayStateKey);
    LOG.debug("Validating client identifier {} with {}", clientIdentifier,
        relayStateInfo.getClientIdentifier());
    return String.valueOf(relayStateInfo.getClientIdentifier()).equals(clientIdentifier);
  }
Given a relayState and a client identifier, this method makes sure that the relay
state exists and that the client identifier matches with the relay state. Note that
this is one-time use only. Once successfully validated, the same relayState and
client identifier cannot be validated again. This is mainly used to make sure that
the SAML token issued by the Hiveserver2 is only used once.
service/src/java/org/apache/hive/service/auth/saml/HiveSamlRelayStateStore.java