boolean validateGroup(AmbariTProxyConfiguration tProxyConfiguration, String proxyUserName, UserEntity userEntity) {
    String allowedGroups = tProxyConfiguration.getAllowedGroups(proxyUserName);

    if (StringUtils.isNotEmpty(allowedGroups)) {
      Set<String> groupSpecs = Arrays.stream(allowedGroups.split("\\s*,\\s*"))
          .map(s -> s.trim().toLowerCase())
          .collect(toSet());

      if (groupSpecs.contains("*")) {
        return true;
      } else {
        Set<MemberEntity> memberEntities = userEntity.getMemberEntities();
        if (memberEntities != null) {
          for (MemberEntity memberEntity : memberEntities) {
            GroupEntity group = memberEntity.getGroup();
            if (group != null) {
              String groupName = group.getGroupName();
              if (StringUtils.isNotEmpty(groupName) && groupSpecs.contains(groupName.toLowerCase())) {
                return true;
              }
            }
          }
        }
      }
    }

    return false;
  }
Constructor.
<p>
Given the Ambari {@link Configuration}, initializes the {@link KerberosName} class using
the <code>auth-to-local</code> rules from {@link AmbariKerberosAuthenticationProperties#getAuthToLocalRules()}.

@param configuration the Ambari configuration data
@param users         the Ambari users access object
ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariProxiedUserDetailsService.java