@Override
      public void process(final TProtocol inProt, final TProtocol outProt) throws TException {
       TTransport trans = inProt.getTransport();
       if (!(trans instanceof TSaslServerTransport)) {
         throw new TException("Unexpected non-SASL transport " + trans.getClass());
       }
       TSaslServerTransport saslTrans = (TSaslServerTransport)trans;
       SaslServer saslServer = saslTrans.getSaslServer();
       String authId = saslServer.getAuthorizationID();
       LOG.debug("Sasl Server AUTH ID: {}", authId);
       String endUser = authId;

       Socket socket = ((TSocket)(saslTrans.getUnderlyingTransport())).getSocket();
       remoteAddress.set(socket.getInetAddress());

       String mechanismName = saslServer.getMechanismName();
       userAuthMechanism.set(mechanismName);
       if (AuthMethod.PLAIN.getMechanismName().equalsIgnoreCase(mechanismName)) {
         remoteUser.set(endUser);
         wrapped.process(inProt, outProt);
         return;
       }

       authenticationMethod.set(AuthenticationMethod.KERBEROS);
       if(AuthMethod.TOKEN.getMechanismName().equalsIgnoreCase(mechanismName)) {
         try {
           TokenIdentifier tokenId = SaslRpcServer.getIdentifier(authId,
               secretManager);
           endUser = tokenId.getUser().getUserName();
           authenticationMethod.set(AuthenticationMethod.TOKEN);
         } catch (InvalidToken e) {
           throw new TException(e.getMessage());
         }
       }

       UserGroupInformation clientUgi = null;
       try {
         if (useProxy) {
           clientUgi = UserGroupInformation.createProxyUser(
               endUser, UserGroupInformation.getLoginUser());
           remoteUser.set(clientUgi.getShortUserName());
           LOG.debug("Set remoteUser: {}", remoteUser.get());
           clientUgi.doAs(new PrivilegedExceptionAction<Boolean>() {

             @Override
             public Boolean run() {
               try {
                 wrapped.process(inProt, outProt);
                 return true;
               } catch (TException te) {
                 throw new RuntimeException(te);
               }
             }
           });
           return;
         } else {
           // use the short user name for the request
           UserGroupInformation endUserUgi = UserGroupInformation.createRemoteUser(endUser);
           remoteUser.set(endUserUgi.getShortUserName());
           LOG.debug("Set remoteUser: {}, from endUser: {}", remoteUser.get(),
               endUser);
           wrapped.process(inProt, outProt);
           return;
         }
       } catch (RuntimeException rte) {
         if (rte.getCause() instanceof TException) {
           throw (TException)rte.getCause();
         }
         throw rte;
       } catch (InterruptedException ie) {
         throw new RuntimeException(ie); // unexpected!
       } catch (IOException ioe) {
         throw new RuntimeException(ioe); // unexpected!
       } finally {
         if (clientUgi != null) {
           try {
             FileSystem.closeAllForUGI(clientUgi);
           } catch (IOException exception) {
             LOG.error("Could not clean up file-system handles for UGI: "
                 + clientUgi, exception);
           }
         }
       }
      }
Processor that pulls the SaslServer object out of the transport, and
assumes the remote user's UGI before calling through to the original
processor.

This is used on the server side to set the UGI for each specific call.
standalone-metastore/metastore-common/src/main/java/org/apache/hadoop/hive/metastore/security/HadoopThriftAuthBridge.java