public Void run() {
           try {
             wrapped.open();
           } catch (TTransportException tte) {
             // Wrap the transport exception in an RTE, since UGI.doAs() then goes
             // and unwraps this for us out of the doAs block. We then unwrap one
             // more time in our catch clause to get back the TTE. (ugh)
             throw new RuntimeException(tte);
           }
           return null;
         }
The Thrift SASL transports call Sasl.createSaslServer and Sasl.createSaslClient
inside open(). So, we need to assume the correct UGI when the transport is opened
so that the SASL mechanisms have access to the right principal. This transport
wraps the Sasl transports to set up the right UGI context for open().

This is used on the client side, where the API explicitly opens a transport to
the server.
standalone-metastore/metastore-common/src/main/java/org/apache/hadoop/hive/metastore/security/TUGIAssumingTransport.java