hadoop-common/src/main/java/com/streamsets/datacollector/security/HadoopSecurityUtil.java
public static UserGroupInformation getProxyUser(
    String user,                    // Hadoop user (HDFS User, HBase user, generally the to-be-impersonated user in component's configuration)
    Stage.Context context,          // Stage context object
    UserGroupInformation loginUser, // Login UGI (sdc user)
    List<Stage.ConfigIssue> issues, // Reports errors
    String configGroup,             // Group where "HDFS User" is present
    String configName               // Config name of "HDFS User"
  ) {
    // Should we always impersonate current user?
    boolean alwaysImpersonate = context.getConfiguration().get(
      HadoopConfigConstants.IMPERSONATION_ALWAYS_CURRENT_USER,
      false
    );

    // If so, propagate current user to "user" (the one to be impersonated)
    if(alwaysImpersonate) {
      if(!StringUtils.isEmpty(user)) {
        issues.add(context.createConfigIssue(configGroup, configName, Errors.HADOOP_00001));
      }
      user = context.getUserContext().getAliasName();
    }

    // If impersonated user is empty, simply return login UGI (no impersonation performed)
    if(StringUtils.isEmpty(user)) {
      return loginUser;
    }

    // Optionally lower case the user name
    boolean lowerCase = context.getConfiguration().get(
      HadoopConfigConstants.LOWERCASE_USER,
      false
    );
    if(lowerCase) {
      user = user.toLowerCase();
    }
    return UserGroupInformation.createProxyUser(user, loginUser);
  }
public static UserGroupInformation getProxyUser(
    String user,                    // Hadoop user (HDFS User, HBase user, generally the to-be-impersonated user in component's configuration)
    Stage.Context context,          // Stage context object
    UserGroupInformation loginUser, // Login UGI (sdc user)
    List<Stage.ConfigIssue> issues, // Reports errors
    String configGroup,             // Group where "HDFS User" is present
    String configName               // Config name of "HDFS User"
  ) {
    // Should we always impersonate current user?
    boolean alwaysImpersonate = context.getConfiguration().get(
      HadoopConfigConstants.IMPERSONATION_ALWAYS_CURRENT_USER,
      false
    );

    // If so, propagate current user to "user" (the one to be impersonated)
    if(alwaysImpersonate) {
      if(!StringUtils.isEmpty(user)) {
        issues.add(context.createConfigIssue(configGroup, configName, Errors.HADOOP_00001));
      }
      user = context.getUserContext().getAliasName();
    }

    // If impersonated user is empty, simply return login UGI (no impersonation performed)
    if(StringUtils.isEmpty(user)) {
      return loginUser;
    }

    // Optionally lower case the user name
    boolean lowerCase = context.getConfiguration().get(
      HadoopConfigConstants.LOWERCASE_USER,
      false
    );
    if(lowerCase) {
      user = user.toLowerCase();
    }
    return UserGroupInformation.createProxyUser(user, loginUser);
  }
Return UGI object that should be used for any remote operation.

This object will be impersonate according to the configuration. This method is meant to be called once during
initialization and it's expected that caller will cache the result for a lifetime of the stage execution.