private static void validateGroup(String proxyUser, String doAsUser) throws 
      NotAuthorizedException {
    Set<String> validGroups = proxyUserGroups.get(proxyUser);
    if(validGroups == WILD_CARD) {
      return;
    }
    else if(validGroups == null || validGroups.isEmpty()) {
      throw new NotAuthorizedException(
          MessageFormat.format(
            "Unauthorized proxyuser [{0}] for doAsUser [{1}], not in proxyuser groups",
            proxyUser, doAsUser));
    }
    Groups groupsInfo = new Groups(Main.getAppConfigInstance());
    try {
      List<String> userGroups = groupsInfo.getGroups(doAsUser);
      for (String g : validGroups) {
        if (userGroups.contains(g)) {
          return;
        }
      }
    }
    catch (IOException ex) {//thrown, for example, if there is no such user on the system
      LOG.warn(MessageFormat.format("Unable to get list of groups for doAsUser [{0}].",
          doAsUser), ex);
    }
    throw new NotAuthorizedException(
      MessageFormat.format(
        "Unauthorized proxyuser [{0}] for doAsUser [{1}], not in proxyuser groups",
            proxyUser, doAsUser));
  }
Verifies a that proxyUser is making the request from authorized host and that doAs user
belongs to one of the groups for which proxyUser is allowed to impersonate users.

@param proxyUser user name of the proxy (logged in) user.
@param proxyHost host the proxy user is making the request from.
@param doAsUser user the proxy user is impersonating.
@throws NotAuthorizedException thrown if the user is not allowed to perform the proxyuser request.
hcatalog/webhcat/svr/src/main/java/org/apache/hive/hcatalog/templeton/ProxyUserSupport.java