private static void validateRequestorHost(String proxyUser, String hostname) throws 
      NotAuthorizedException {
    Set<String> validHosts = proxyUserHosts.get(proxyUser);
    if (validHosts == WILD_CARD) {
      return;
    }
    if (validHosts == null || !validHosts.contains(hostname)) {
      throw new NotAuthorizedException(MessageFormat.format(
          "Unauthorized host [{0}] for proxyuser [{1}]", hostname, proxyUser));
    }
  }
Verifies a that proxyUser is making the request from authorized host and that doAs user
belongs to one of the groups for which proxyUser is allowed to impersonate users.

@param proxyUser user name of the proxy (logged in) user.
@param proxyHost host the proxy user is making the request from.
@param doAsUser user the proxy user is impersonating.
@throws NotAuthorizedException thrown if the user is not allowed to perform the proxyuser request.
hcatalog/webhcat/svr/src/main/java/org/apache/hive/hcatalog/templeton/ProxyUserSupport.java