private void processConnectionHeader(ByteBuff buf) throws IOException {
    this.connectionHeader = ConnectionHeader.parseFrom(createCis(buf));

    // we want to copy the attributes prior to releasing the buffer so that they don't get corrupted
    // eventually
    if (connectionHeader.getAttributeList().isEmpty()) {
      this.connectionAttributes = Collections.emptyMap();
    } else {
      this.connectionAttributes =
        Maps.newHashMapWithExpectedSize(connectionHeader.getAttributeList().size());
      for (HBaseProtos.NameBytesPair nameBytesPair : connectionHeader.getAttributeList()) {
        this.connectionAttributes.put(nameBytesPair.getName(),
          nameBytesPair.getValue().toByteArray());
      }
    }
    String serviceName = connectionHeader.getServiceName();
    if (serviceName == null) {
      throw new EmptyServiceNameException();
    }
    this.service = RpcServer.getService(this.rpcServer.services, serviceName);
    if (this.service == null) {
      throw new UnknownServiceException(serviceName);
    }
    setupCellBlockCodecs();
    sendConnectionHeaderResponseIfNeeded();
    UserGroupInformation protocolUser = createUser(connectionHeader);
    if (!useSasl) {
      ugi = protocolUser;
      if (ugi != null) {
        ugi.setAuthenticationMethod(AuthenticationMethod.SIMPLE);
      }
      // audit logging for SASL authenticated users happens in saslReadAndProcess()
      if (authenticatedWithFallback) {
        RpcServer.LOG.warn("Allowed fallback to SIMPLE auth for {} connecting from {}", ugi,
          getHostAddress());
      }
    } else {
      // user is authenticated
      ugi.setAuthenticationMethod(provider.getSaslAuthMethod().getAuthMethod());
      // Now we check if this is a proxy user case. If the protocol user is
      // different from the 'user', it is a proxy user scenario. However,
      // this is not allowed if user authenticated with DIGEST.
      if ((protocolUser != null) && (!protocolUser.getUserName().equals(ugi.getUserName()))) {
        if (!provider.supportsProtocolAuthentication()) {
          // Not allowed to doAs if token authentication is used
          throw new AccessDeniedException("Authenticated user (" + ugi
            + ") doesn't match what the client claims to be (" + protocolUser + ")");
        } else {
          // Effective user can be different from authenticated user
          // for simple auth or kerberos auth
          // The user is the real user. Now we create a proxy user
          UserGroupInformation realUser = ugi;
          ugi = UserGroupInformation.createProxyUser(protocolUser.getUserName(), realUser);
          // Now the user is a proxy user, set Authentication method Proxy.
          ugi.setAuthenticationMethod(AuthenticationMethod.PROXY);
        }
      }
    }
    String version;
    if (this.connectionHeader.hasVersionInfo()) {
      // see if this connection will support RetryImmediatelyException
      this.retryImmediatelySupported = VersionInfoUtil.hasMinimumVersion(getVersionInfo(), 1, 2);
      version = this.connectionHeader.getVersionInfo().getVersion();
    } else {
      version = "UNKNOWN";
    }
    RpcServer.AUDITLOG.info("Connection from {}:{}, version={}, sasl={}, ugi={}, service={}",
      this.hostAddress, this.remotePort, version, this.useSasl, this.ugi, serviceName);
  }
No protobuf encoding of raw sasl messages
hbase-server/src/main/java/org/apache/hadoop/hbase/ipc/ServerRpcConnection.java