@Override
  public void open() throws TTransportException {
    try {
      AccessControlContext context = AccessController.getContext();
      Subject subject = Subject.getSubject(context);
      Subject.doAs(subject, new PrivilegedExceptionAction<Void>() {
        public Void run() {
          try {
            wrapped.open();
          } catch (TTransportException tte) {
            // Wrap the transport exception in an RTE, since Subject.doAs() then goes
            // and unwraps this for us out of the doAs block. We then unwrap one
            // more time in our catch clause to get back the TTE. (ugh)
            throw new RuntimeException(tte);
          }
          return null;
        }
      });
    } catch (PrivilegedActionException ioe) {
      throw new RuntimeException("Received an ioe we never threw!", ioe);
    } catch (RuntimeException rte) {
      if (rte.getCause() instanceof TTransportException) {
        throw (TTransportException) rte.getCause();
      } else {
        throw rte;
      }
    }
  }
This is used on the client side, where the API explicitly opens a transport to
the server using the Subject.doAs().
service/src/java/org/apache/hive/service/auth/TSubjectAssumingTransport.java