@Override
  public String validate(String encodedToken) throws HttpSamlAuthenticationException {
    String token = decode(encodedToken);
    Map<String, String> keyValue = new HashMap<>();
    if (!parse(token, keyValue)) {
      throw new HttpSamlAuthenticationException("Invalid token");
    }
    String tokenStr = getTokenStr(keyValue.get(USER), keyValue.get(ID),
        keyValue.get(CREATE_TIME), keyValue.get(RELAY_STATE));
    String signature = getSign(tokenStr);
    if (!signatureMatches(keyValue.get(SIGN), signature)) {
      throw new HttpSamlAuthenticationException("Token could not be verified");
    }
    if (isExpired(System.currentTimeMillis(),
        Long.parseLong(keyValue.get(CREATE_TIME)))) {
      throw new HttpSamlAuthenticationException("Token is expired");
    }
    return keyValue.get(USER);
  }
A token is generated when the SAML assertion is successfully validated. This Token
is passed back to the client (Jdbc/ODBC Driver) via the browser. This token is
presented by the subsequent http request as a bearer token.
service/src/java/org/apache/hive/service/auth/saml/HiveSamlAuthTokenGenerator.java