private static String getDoAsQueryParam(String queryString) {
    if (LOG.isDebugEnabled()) {
      LOG.debug("URL query string:" + queryString);
    }
    if (queryString == null) {
      return null;
    }
    Map<String, String[]> params = javax.servlet.http.HttpUtils.parseQueryString( queryString );
    Set<String> keySet = params.keySet();
    for (String key: keySet) {
      if (key.equalsIgnoreCase("doAs")) {
        return params.get(key)[0];
      }
    }
    return null;
  }
Do the GSS-API kerberos authentication.
We already have a logged in subject in the form of serviceUGI,
which GSS-API will extract information from.
In case of a SPNego request we use the httpUGI,
for the authenticating service tickets.
@param request Request to act on
@return client principal name
@throws HttpAuthenticationException on error authenticating the user
service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java