code: private String getProxyUser(String realUser, Map<String, String> sessionConf,
        String ipAddress) throws HiveSQLException {
      String proxyUser = null;
      // Http transport mode.
      // We set the thread local proxy username, in ThriftHttpServlet.
      if (cliService.getHiveConf().getVar(
          ConfVars.HIVE_SERVER2_TRANSPORT_MODE).equalsIgnoreCase("http")) {
        proxyUser = SessionManager.getProxyUserName();
        LOG.debug("Proxy user from query string: " + proxyUser);
      }
  
      if (proxyUser == null && sessionConf != null && sessionConf.containsKey(HiveAuthFactory.HS2_PROXY_USER)) {
        String proxyUserFromThriftBody = sessionConf.get(HiveAuthFactory.HS2_PROXY_USER);
        LOG.debug("Proxy user from thrift body: " + proxyUserFromThriftBody);
        proxyUser = proxyUserFromThriftBody;
      }
  
      if (proxyUser == null) {
        return realUser;
      }
  
      // check whether substitution is allowed
      if (!hiveConf.getBoolVar(HiveConf.ConfVars.HIVE_SERVER2_ALLOW_USER_SUBSTITUTION)) {
        throw new HiveSQLException("Proxy user substitution is not allowed");
      }
  
      // If there's no authentication, then directly substitute the user
      if (HiveAuthFactory.AuthTypes.NONE.toString()
          .equalsIgnoreCase(hiveConf.getVar(ConfVars.HIVE_SERVER2_AUTHENTICATION))) {
        return proxyUser;
      }
  
      // Verify proxy user privilege of the realUser for the proxyUser
      HiveAuthFactory.verifyProxyAccess(realUser, proxyUser, ipAddress, hiveConf);
      LOG.debug("Verified proxy user: " + proxyUser);
      return proxyUser;
    }
docs: If the proxy user name is provided then check privileges to substitute the user.
  @param realUser
  @param sessionConf
  @param ipAddress
  @return
  @throws HiveSQLException