static void processProxyuserConfig(AppConfig conf) {
    for(Map.Entry<String, String> confEnt : conf) {
      if(confEnt.getKey().startsWith(CONF_PROXYUSER_PREFIX)
          && confEnt.getKey().endsWith(CONF_GROUPS_SUFFIX)) {
        //process user groups for which doAs is authorized
        String proxyUser = 
            confEnt.getKey().substring(CONF_PROXYUSER_PREFIX.length(), 
            confEnt.getKey().lastIndexOf(CONF_GROUPS_SUFFIX));
        Set<String> groups;
        if("*".equals(confEnt.getValue())) {
          groups = WILD_CARD;
          LOG.debug("User [{}] is authorized to do doAs any user.", proxyUser);
        }
        else if(confEnt.getValue() != null && confEnt.getValue().trim().length() > 0) {
          groups = new HashSet<String>(Arrays.asList(confEnt.getValue().trim().split(",")));
          if(LOG.isDebugEnabled()) {
            LOG.debug("User [" + proxyUser + 
                "] is authorized to do doAs for users in the following groups: ["
                + confEnt.getValue().trim() + "]");
          }
        }
        else {
          groups = Collections.emptySet();
          LOG.debug("User [{}] is authorized to do doAs for users in the following groups: []", proxyUser);
        }
        proxyUserGroups.put(proxyUser, groups);
      }
      else if(confEnt.getKey().startsWith(CONF_PROXYUSER_PREFIX)
          && confEnt.getKey().endsWith(CONF_HOSTS_SUFFIX)) {
        //process hosts from which doAs requests are authorized
        String proxyUser = confEnt.getKey().substring(CONF_PROXYUSER_PREFIX.length(), 
            confEnt.getKey().lastIndexOf(CONF_HOSTS_SUFFIX));
        Set<String> hosts;
        if("*".equals(confEnt.getValue())) {
          hosts = WILD_CARD;
          LOG.debug("User [{}] is authorized to do doAs from any host.", proxyUser);
        }
        else if(confEnt.getValue() != null && confEnt.getValue().trim().length() > 0) {
          String[] hostValues = confEnt.getValue().trim().split(",");
          hosts = new HashSet<String>();
          for(String hostname : hostValues) {
            String nhn = normalizeHostname(hostname);
            if(nhn != null) {
              hosts.add(nhn);
            }
          }
          if(LOG.isDebugEnabled()) {
            LOG.debug("User [" + proxyUser + 
                "] is authorized to do doAs from the following hosts: ["
                + confEnt.getValue().trim() + "]");
          }
        }
        else {
          hosts = Collections.emptySet();
          LOG.debug("User [{}] is authorized to do doAs from the following hosts: []", proxyUser);
        }
        proxyUserHosts.put(proxyUser, hosts);
      }
    }
  }
When WebHCat is run with doAs query parameter this class ensures that user making the
call is allowed to impersonate doAs user and is making a call from authorized host.
hcatalog/webhcat/svr/src/main/java/org/apache/hive/hcatalog/templeton/ProxyUserSupport.java