static void validate(String proxyUser, String proxyHost, String doAsUser) throws 
      NotAuthorizedException {
    assertNotEmpty(proxyUser, "proxyUser",
        "If you're attempting to use user-impersonation via a proxy user, please make sure that "
            + CONF_PROXYUSER_PREFIX + "#USER#" + CONF_HOSTS_SUFFIX + " and "
            + CONF_PROXYUSER_PREFIX + "#USER#" + CONF_GROUPS_SUFFIX
            + " are configured correctly");
    assertNotEmpty(proxyHost, "proxyHost",
        "If you're attempting to use user-impersonation via a proxy user, please make sure that "
            + CONF_PROXYUSER_PREFIX + proxyUser + CONF_HOSTS_SUFFIX + " and "
            + CONF_PROXYUSER_PREFIX + proxyUser + CONF_GROUPS_SUFFIX
            + " are configured correctly");
    assertNotEmpty(doAsUser, Server.DO_AS_PARAM);
    LOG.debug(MessageFormat.format("Authorization check proxyuser [{0}] host [{1}] doAs [{2}]",
        proxyUser, proxyHost, doAsUser));
    if (proxyUserHosts.containsKey(proxyUser)) {
      proxyHost = normalizeHostname(proxyHost);
      validateRequestorHost(proxyUser, proxyHost);
      validateGroup(proxyUser, doAsUser);
    }
    else {
      throw new NotAuthorizedException(MessageFormat.format(
          "User [{0}] not defined as proxyuser", proxyUser));
    }
  }
Verifies a that proxyUser is making the request from authorized host and that doAs user
belongs to one of the groups for which proxyUser is allowed to impersonate users.

@param proxyUser user name of the proxy (logged in) user.
@param proxyHost host the proxy user is making the request from.
@param doAsUser user the proxy user is impersonating.
@throws NotAuthorizedException thrown if the user is not allowed to perform the proxyuser request.
hcatalog/webhcat/svr/src/main/java/org/apache/hive/hcatalog/templeton/ProxyUserSupport.java