@Override
  public void service(final HttpServletRequest request, final HttpServletResponse response)
    throws ServletException, IOException {
    final HttpServletRequest lowerCaseRequest = toLowerCase(request);
    final String doAsUserFromQuery = lowerCaseRequest.getParameter("doas");
    RESTServlet servlet = RESTServlet.getInstance();
    if (doAsUserFromQuery != null) {
      Configuration conf = servlet.getConfiguration();
      if (!servlet.supportsProxyuser()) {
        throw new ServletException("Support for proxyuser is not configured");
      }
      // Authenticated remote user is attempting to do 'doAs' proxy user.
      UserGroupInformation ugi = UserGroupInformation.createRemoteUser(request.getRemoteUser());
      // create and attempt to authorize a proxy user (the client is attempting
      // to do proxy user)
      ugi = UserGroupInformation.createProxyUser(doAsUserFromQuery, ugi);
      // validate the proxy user authorization
      try {
        ProxyUsers.authorize(ugi, request.getRemoteAddr(), conf);
      } catch (AuthorizationException e) {
        throw new ServletException(e.getMessage());
      }
      servlet.setEffectiveUser(doAsUserFromQuery);
    } else {
      String effectiveUser = request.getRemoteUser();
      servlet.setEffectiveUser(effectiveUser);
    }
    super.service(request, response);
  }
This container is used only if authentication and impersonation is enabled. The remote request
user is used as a proxy user for impersonation in invoking any REST service.
hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServletContainer.java