hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/http/TestHttpServerWithSpengo.java - hadoop - Git at Google

 /**
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
  * regarding copyright ownership.  The ASF licenses this file
  * to you under the Apache License, Version 2.0 (the
  * "License"); you may not use this file except in compliance
  * with the License.  You may obtain a copy of the License at
  * <p>
  * http://www.apache.org/licenses/LICENSE-2.0
  * <p>
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
 package org.apache.hadoop.http;

 import org.apache.hadoop.conf.Configuration;
 import org.apache.hadoop.fs.CommonConfigurationKeys;
 import org.apache.hadoop.minikdc.MiniKdc;
 import org.apache.hadoop.net.NetUtils;
 import org.apache.hadoop.security.AuthenticationFilterInitializer;
 import org.apache.hadoop.security.SecurityUtil;
 import org.apache.hadoop.security.UserGroupInformation;
 import org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod;
 import org.apache.hadoop.security.authentication.KerberosTestUtils;
 import org.apache.hadoop.security.authentication.client.AuthenticatedURL;
 import org.apache.hadoop.security.authentication.client.AuthenticationException;
 import org.apache.hadoop.security.authentication.server.AuthenticationFilter;
 import org.apache.hadoop.security.authentication.server.AuthenticationToken;
 import org.apache.hadoop.security.authentication.util.Signer;
 import org.apache.hadoop.security.authentication.util.SignerSecretProvider;
 import org.apache.hadoop.security.authentication.util.StringSignerSecretProviderCreator;
 import org.apache.hadoop.security.authorize.AccessControlList;
 import org.apache.hadoop.security.authorize.ProxyUsers;
 import org.ietf.jgss.GSSException;
 import org.junit.AfterClass;
 import org.junit.BeforeClass;
 import org.junit.Test;
 import org.junit.Assert;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

 import java.io.File;
 import java.io.FileWriter;
 import java.io.Writer;
 import java.net.HttpURLConnection;
 import java.net.URI;
 import java.net.URL;
 import java.security.AccessController;
 import java.security.PrivilegedExceptionAction;
 import java.util.HashSet;
 import java.util.Properties;
 import java.util.Set;
 import javax.security.auth.Subject;
 import javax.servlet.ServletContext;

 import static org.junit.Assert.assertTrue;

 /**
  * This class is tested for http server with SPENGO authentication.
  */
 public class TestHttpServerWithSpengo {

   static final Logger LOG =
       LoggerFactory.getLogger(TestHttpServerWithSpengo.class);

   private static final String SECRET_STR = "secret";
   private static final String HTTP_USER = "HTTP";
   private static final String PREFIX = "hadoop.http.authentication.";
   private static final long TIMEOUT = 20000;

   private static File httpSpnegoKeytabFile = new File(
       KerberosTestUtils.getKeytabFile());
   private static String httpSpnegoPrincipal =
       KerberosTestUtils.getServerPrincipal();
   private static String realm = KerberosTestUtils.getRealm();

   private static File testRootDir = new File("target",
       TestHttpServerWithSpengo.class.getName() + "-root");
   private static MiniKdc testMiniKDC;
   private static File secretFile = new File(testRootDir, SECRET_STR);

   private static UserGroupInformation authUgi;

   @BeforeClass
   public static void setUp() throws Exception {
     try {
       testMiniKDC = new MiniKdc(MiniKdc.createConf(), testRootDir);
       testMiniKDC.start();
       testMiniKDC.createPrincipal(
           httpSpnegoKeytabFile, HTTP_USER + "/localhost", "keytab-user");
     } catch (Exception e) {
       assertTrue("Couldn't setup MiniKDC", false);
     }

     System.setProperty("sun.security.krb5.debug", "true");
     Configuration conf = new Configuration();
     SecurityUtil.setAuthenticationMethod(AuthenticationMethod.KERBEROS, conf);
     UserGroupInformation.setConfiguration(conf);
     authUgi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(
         "keytab-user", httpSpnegoKeytabFile.toString());
     Writer w = new FileWriter(secretFile);
     w.write("secret");
     w.close();
   }

   @AfterClass
   public static void tearDown() {
     if (testMiniKDC != null) {
       testMiniKDC.stop();
     }
   }

   /**
    * groupA
    *  - userA
    * groupB
    *  - userA, userB
    * groupC
    *  - userC
    * SPNEGO filter has been enabled.
    * userA has the privilege to impersonate users in groupB.
    * userA has admin access to all default servlets, but userB
    * and userC don't have. So "/logs" can only be accessed by userA.
    * @throws Exception
    */
   @Test
   public void testAuthenticationWithProxyUser() throws Exception {

     Configuration spengoConf = getSpengoConf(new Configuration());

     //setup logs dir
     System.setProperty("hadoop.log.dir", testRootDir.getAbsolutePath());

     // Setup user group
     UserGroupInformation.createUserForTesting("userA",
         new String[]{"groupA", "groupB"});
     UserGroupInformation.createUserForTesting("userB",
         new String[]{"groupB"});
     UserGroupInformation.createUserForTesting("userC",
         new String[]{"groupC"});

     // Make userA impersonate users in groupB
     spengoConf.set("hadoop.proxyuser.userA.hosts", "*");
     spengoConf.set("hadoop.proxyuser.userA.groups", "groupB");
     ProxyUsers.refreshSuperUserGroupsConfiguration(spengoConf);

     HttpServer2 httpServer = null;
     try {
       // Create http server to test.
       httpServer = getCommonBuilder()
           .setConf(spengoConf)
           .setACL(new AccessControlList("userA groupA"))
           .build();
       httpServer.start();

       // Get signer to encrypt token
       Signer signer = getSignerToEncrypt();

       // setup auth token for userA
       AuthenticatedURL.Token token = getEncryptedAuthToken(signer, "userA");

       String serverURL = "http://" +
           NetUtils.getHostPortString(httpServer.getConnectorAddress(0)) + "/";

       // The default authenticator is kerberos.
       AuthenticatedURL authUrl = new AuthenticatedURL();

       // userA impersonates userB, it's allowed.
       for (String servlet :
           new String[]{"stacks", "jmx", "conf"}) {
         HttpURLConnection conn = authUrl
             .openConnection(new URL(serverURL + servlet + "?doAs=userB"),
                 token);
         Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
       }

       // userA cannot impersonate userC, it fails.
       for (String servlet :
           new String[]{"stacks", "jmx", "conf"}){
         HttpURLConnection conn = authUrl
             .openConnection(new URL(serverURL + servlet + "?doAs=userC"),
                 token);
         Assert.assertEquals(HttpURLConnection.HTTP_FORBIDDEN,
             conn.getResponseCode());
       }

       // "/logs" and "/logLevel" require admin authorization,
       // only userA has the access.
       for (String servlet :
           new String[]{"logLevel", "logs"}) {
         HttpURLConnection conn = authUrl
             .openConnection(new URL(serverURL + servlet), token);
         Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
       }

       // Setup token for userB
       token = getEncryptedAuthToken(signer, "userB");

       // userB cannot access these servlets.
       for (String servlet :
           new String[]{"logLevel", "logs"}) {
         HttpURLConnection conn = authUrl
             .openConnection(new URL(serverURL + servlet), token);
         Assert.assertEquals(HttpURLConnection.HTTP_FORBIDDEN,
             conn.getResponseCode());
       }

     } finally {
       if (httpServer != null) {
         httpServer.stop();
       }
     }
   }

   @Test
   public void testSessionCookie() throws Exception {
     Configuration conf = new Configuration();
     conf.set(HttpServer2.FILTER_INITIALIZER_PROPERTY,
         AuthenticationFilterInitializer.class.getName());
     conf.set(PREFIX + "type", "kerberos");
     conf.setBoolean(PREFIX + "simple.anonymous.allowed", false);
     conf.set(PREFIX + "signer.secret.provider",
         TestSignerSecretProvider.class.getName());

     conf.set(PREFIX + "kerberos.keytab",
         httpSpnegoKeytabFile.getAbsolutePath());
     conf.set(PREFIX + "kerberos.principal", httpSpnegoPrincipal);
     conf.set(PREFIX + "cookie.domain", realm);
     conf.setBoolean(CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION,
         true);

     //setup logs dir
     System.setProperty("hadoop.log.dir", testRootDir.getAbsolutePath());

     HttpServer2 httpServer = null;
     // Create http server to test.
     httpServer = getCommonBuilder()
         .setConf(conf)
         .build();
     httpServer.start();

     // Get signer to encrypt token
     final Signer signer = new Signer(new TestSignerSecretProvider());
     final AuthenticatedURL authUrl = new AuthenticatedURL();

     final URL url = new URL("http://" + NetUtils.getHostPortString(
         httpServer.getConnectorAddress(0)) + "/conf");

     // this illustrates an inconsistency with AuthenticatedURL.  the
     // authenticator is only called when the token is not set.  if the
     // authenticator fails then it must throw an AuthenticationException to
     // the caller, yet the caller may see 401 for subsequent requests
     // that require re-authentication like token expiration.
     final UserGroupInformation simpleUgi =
         UserGroupInformation.createRemoteUser("simple-user");

     authUgi.doAs(new PrivilegedExceptionAction<Void>() {
       @Override
       public Void run() throws Exception {
         TestSignerSecretProvider.rollSecret();
         HttpURLConnection conn = null;
         AuthenticatedURL.Token token = new AuthenticatedURL.Token();

         // initial request should trigger authentication and set the token.
         conn = authUrl.openConnection(url, token);
         Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
         Assert.assertTrue(token.isSet());
         String cookie = token.toString();

         // token should not change.
         conn = authUrl.openConnection(url, token);
         Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
         Assert.assertTrue(token.isSet());
         Assert.assertEquals(cookie, token.toString());

         // roll secret to invalidate token.
         TestSignerSecretProvider.rollSecret();
         conn = authUrl.openConnection(url, token);
         // this may or may not happen.  under normal circumstances the
         // jdk will silently renegotiate and the client never sees a 401.
         // however in some cases the jdk will give up doing spnego.  since
         // the token is already set, the authenticator isn't invoked (which
         // would do the spnego if the jdk doesn't), which causes the client
         // to see a 401.
         if (conn.getResponseCode() == HttpURLConnection.HTTP_UNAUTHORIZED) {
           // if this happens, the token should be cleared which means the
           // next request should succeed and receive a new token.
           Assert.assertFalse(token.isSet());
           conn = authUrl.openConnection(url, token);
         }

         // token should change.
         Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
         Assert.assertTrue(token.isSet());
         Assert.assertNotEquals(cookie, token.toString());
         cookie = token.toString();

         // token should not change.
         for (int i=0; i < 3; i++) {
           conn = authUrl.openConnection(url, token);
           Assert.assertEquals("attempt"+i,
               HttpURLConnection.HTTP_OK, conn.getResponseCode());
           Assert.assertTrue(token.isSet());
           Assert.assertEquals(cookie, token.toString());
         }

         // blow out the kerberos creds test only auth token is used.
         Subject s = Subject.getSubject(AccessController.getContext());
         Set<Object> oldCreds = new HashSet<>(s.getPrivateCredentials());
         s.getPrivateCredentials().clear();

         // token should not change.
         for (int i=0; i < 3; i++) {
           try {
             conn = authUrl.openConnection(url, token);
             Assert.assertEquals("attempt"+i,
                 HttpURLConnection.HTTP_OK, conn.getResponseCode());
           } catch (AuthenticationException ae) {
             Assert.fail("attempt"+i+" "+ae);
           }
           Assert.assertTrue(token.isSet());
           Assert.assertEquals(cookie, token.toString());
         }

         // invalidate token.  connections should fail now and token should be
         // unset.
         TestSignerSecretProvider.rollSecret();
         conn = authUrl.openConnection(url, token);
         Assert.assertEquals(
             HttpURLConnection.HTTP_UNAUTHORIZED, conn.getResponseCode());
         Assert.assertFalse(token.isSet());
         Assert.assertEquals("", token.toString());

         // restore the kerberos creds, should work again.
         s.getPrivateCredentials().addAll(oldCreds);
         conn = authUrl.openConnection(url, token);
         Assert.assertEquals(
             HttpURLConnection.HTTP_OK, conn.getResponseCode());
         Assert.assertTrue(token.isSet());
         cookie = token.toString();

         // token should not change.
         for (int i=0; i < 3; i++) {
           conn = authUrl.openConnection(url, token);
           Assert.assertEquals("attempt"+i,
               HttpURLConnection.HTTP_OK, conn.getResponseCode());
           Assert.assertTrue(token.isSet());
           Assert.assertEquals(cookie, token.toString());
         }
         return null;
       }
     });

     simpleUgi.doAs(new PrivilegedExceptionAction<Void>() {
       @Override
       public Void run() throws Exception {
         TestSignerSecretProvider.rollSecret();
         AuthenticatedURL authUrl = new AuthenticatedURL();
         AuthenticatedURL.Token token = new AuthenticatedURL.Token();
         HttpURLConnection conn = null;

         // initial connect with unset token will trigger authenticator which
         // should fail since we have no creds and leave token unset.
         try {
           authUrl.openConnection(url, token);
           Assert.fail("should fail with no credentials");
         } catch (AuthenticationException ae) {
           Assert.assertNotNull(ae.getCause());
           Assert.assertEquals(GSSException.class, ae.getCause().getClass());
           GSSException gsse = (GSSException)ae.getCause();
           Assert.assertEquals(GSSException.NO_CRED, gsse.getMajor());
         } catch (Throwable t) {
           Assert.fail("Unexpected exception" + t);
         }
         Assert.assertFalse(token.isSet());

         // create a valid token and save its value.
         token = getEncryptedAuthToken(signer, "valid");
         String cookie = token.toString();

         // server should accept token.  after the request the token should
         // be set to the same value (ie. server didn't reissue cookie)
         conn = authUrl.openConnection(url, token);
         Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
         Assert.assertTrue(token.isSet());
         Assert.assertEquals(cookie, token.toString());

         conn = authUrl.openConnection(url, token);
         Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
         Assert.assertTrue(token.isSet());
         Assert.assertEquals(cookie, token.toString());

         // change the secret to effectively invalidate the cookie.  see above
         // regarding inconsistency.  the authenticator has no way to know the
         // token is bad, so the client will encounter a 401 instead of
         // AuthenticationException.
         TestSignerSecretProvider.rollSecret();
         conn = authUrl.openConnection(url, token);
         Assert.assertEquals(
             HttpURLConnection.HTTP_UNAUTHORIZED, conn.getResponseCode());
         Assert.assertFalse(token.isSet());
         Assert.assertEquals("", token.toString());
         return null;
       }
     });
   }

   public static class TestSignerSecretProvider extends SignerSecretProvider {
     static int n = 0;
     static byte[] secret;

     static void rollSecret() {
       secret = ("secret[" + (n++) + "]").getBytes();
     }

     public TestSignerSecretProvider() {
     }

     @Override
     public void init(Properties config, ServletContext servletContext,
             long tokenValidity) throws Exception {
       rollSecret();
     }

     @Override
     public byte[] getCurrentSecret() {
       return secret;
     }

     @Override
     public byte[][] getAllSecrets() {
       return new byte[][]{secret};
     }
   }

   private AuthenticatedURL.Token getEncryptedAuthToken(Signer signer,
       String user) throws Exception {
     AuthenticationToken token =
         new AuthenticationToken(user, user, "kerberos");
     token.setExpires(System.currentTimeMillis() + TIMEOUT);
     return new AuthenticatedURL.Token(signer.sign(token.toString()));
   }

   private Signer getSignerToEncrypt() throws Exception {
     SignerSecretProvider secretProvider =
         StringSignerSecretProviderCreator.newStringSignerSecretProvider();
     Properties secretProviderProps = new Properties();
     secretProviderProps.setProperty(
         AuthenticationFilter.SIGNATURE_SECRET, SECRET_STR);
     secretProvider.init(secretProviderProps, null, TIMEOUT);
     return new Signer(secretProvider);
   }

   private Configuration getSpengoConf(Configuration conf) {
     conf = new Configuration();
     conf.set(HttpServer2.FILTER_INITIALIZER_PROPERTY,
         AuthenticationFilterInitializer.class.getName());
     conf.set(PREFIX + "type", "kerberos");
     conf.setBoolean(PREFIX + "simple.anonymous.allowed", false);
     conf.set(PREFIX + "signature.secret.file",
         secretFile.getAbsolutePath());
     conf.set(PREFIX + "kerberos.keytab",
         httpSpnegoKeytabFile.getAbsolutePath());
     conf.set(PREFIX + "kerberos.principal", httpSpnegoPrincipal);
     conf.set(PREFIX + "cookie.domain", realm);
     conf.setBoolean(CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION,
         true);
     return conf;
   }

   private HttpServer2.Builder getCommonBuilder() throws Exception {
     return new HttpServer2.Builder().setName("test")
         .addEndpoint(new URI("http://localhost:0"))
         .setFindPort(true);
   }
 }
	/**
	* Licensed to the Apache Software Foundation (ASF) under one
	* or more contributor license agreements. See the NOTICE file
	* distributed with this work for additional information
	* regarding copyright ownership. The ASF licenses this file
	* to you under the Apache License, Version 2.0 (the
	* "License"); you may not use this file except in compliance
	* with the License. You may obtain a copy of the License at
	* <p>
	* http://www.apache.org/licenses/LICENSE-2.0
	* <p>
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/
	package org.apache.hadoop.http;

	import org.apache.hadoop.conf.Configuration;
	import org.apache.hadoop.fs.CommonConfigurationKeys;
	import org.apache.hadoop.minikdc.MiniKdc;
	import org.apache.hadoop.net.NetUtils;
	import org.apache.hadoop.security.AuthenticationFilterInitializer;
	import org.apache.hadoop.security.SecurityUtil;
	import org.apache.hadoop.security.UserGroupInformation;
	import org.apache.hadoop.security.UserGroupInformation.AuthenticationMethod;
	import org.apache.hadoop.security.authentication.KerberosTestUtils;
	import org.apache.hadoop.security.authentication.client.AuthenticatedURL;
	import org.apache.hadoop.security.authentication.client.AuthenticationException;
	import org.apache.hadoop.security.authentication.server.AuthenticationFilter;
	import org.apache.hadoop.security.authentication.server.AuthenticationToken;
	import org.apache.hadoop.security.authentication.util.Signer;
	import org.apache.hadoop.security.authentication.util.SignerSecretProvider;
	import org.apache.hadoop.security.authentication.util.StringSignerSecretProviderCreator;
	import org.apache.hadoop.security.authorize.AccessControlList;
	import org.apache.hadoop.security.authorize.ProxyUsers;
	import org.ietf.jgss.GSSException;
	import org.junit.AfterClass;
	import org.junit.BeforeClass;
	import org.junit.Test;
	import org.junit.Assert;
	import org.slf4j.Logger;
	import org.slf4j.LoggerFactory;

	import java.io.File;
	import java.io.FileWriter;
	import java.io.Writer;
	import java.net.HttpURLConnection;
	import java.net.URI;
	import java.net.URL;
	import java.security.AccessController;
	import java.security.PrivilegedExceptionAction;
	import java.util.HashSet;
	import java.util.Properties;
	import java.util.Set;
	import javax.security.auth.Subject;
	import javax.servlet.ServletContext;

	import static org.junit.Assert.assertTrue;

	/**
	* This class is tested for http server with SPENGO authentication.
	*/
	public class TestHttpServerWithSpengo {

	static final Logger LOG =
	LoggerFactory.getLogger(TestHttpServerWithSpengo.class);

	private static final String SECRET_STR = "secret";
	private static final String HTTP_USER = "HTTP";
	private static final String PREFIX = "hadoop.http.authentication.";
	private static final long TIMEOUT = 20000;

	private static File httpSpnegoKeytabFile = new File(
	KerberosTestUtils.getKeytabFile());
	private static String httpSpnegoPrincipal =
	KerberosTestUtils.getServerPrincipal();
	private static String realm = KerberosTestUtils.getRealm();

	private static File testRootDir = new File("target",
	TestHttpServerWithSpengo.class.getName() + "-root");
	private static MiniKdc testMiniKDC;
	private static File secretFile = new File(testRootDir, SECRET_STR);

	private static UserGroupInformation authUgi;

	@BeforeClass
	public static void setUp() throws Exception {
	try {
	testMiniKDC = new MiniKdc(MiniKdc.createConf(), testRootDir);
	testMiniKDC.start();
	testMiniKDC.createPrincipal(
	httpSpnegoKeytabFile, HTTP_USER + "/localhost", "keytab-user");
	} catch (Exception e) {
	assertTrue("Couldn't setup MiniKDC", false);
	}

	System.setProperty("sun.security.krb5.debug", "true");
	Configuration conf = new Configuration();
	SecurityUtil.setAuthenticationMethod(AuthenticationMethod.KERBEROS, conf);
	UserGroupInformation.setConfiguration(conf);
	authUgi = UserGroupInformation.loginUserFromKeytabAndReturnUGI(
	"keytab-user", httpSpnegoKeytabFile.toString());
	Writer w = new FileWriter(secretFile);
	w.write("secret");
	w.close();
	}

	@AfterClass
	public static void tearDown() {
	if (testMiniKDC != null) {
	testMiniKDC.stop();
	}
	}

	/**
	* groupA
	* - userA
	* groupB
	* - userA, userB
	* groupC
	* - userC
	* SPNEGO filter has been enabled.
	* userA has the privilege to impersonate users in groupB.
	* userA has admin access to all default servlets, but userB
	* and userC don't have. So "/logs" can only be accessed by userA.
	* @throws Exception
	*/
	@Test
	public void testAuthenticationWithProxyUser() throws Exception {

	Configuration spengoConf = getSpengoConf(new Configuration());

	//setup logs dir
	System.setProperty("hadoop.log.dir", testRootDir.getAbsolutePath());

	// Setup user group
	UserGroupInformation.createUserForTesting("userA",
	new String[]{"groupA", "groupB"});
	UserGroupInformation.createUserForTesting("userB",
	new String[]{"groupB"});
	UserGroupInformation.createUserForTesting("userC",
	new String[]{"groupC"});

	// Make userA impersonate users in groupB
	spengoConf.set("hadoop.proxyuser.userA.hosts", "*");
	spengoConf.set("hadoop.proxyuser.userA.groups", "groupB");
	ProxyUsers.refreshSuperUserGroupsConfiguration(spengoConf);

	HttpServer2 httpServer = null;
	try {
	// Create http server to test.
	httpServer = getCommonBuilder()
	.setConf(spengoConf)
	.setACL(new AccessControlList("userA groupA"))
	.build();
	httpServer.start();

	// Get signer to encrypt token
	Signer signer = getSignerToEncrypt();

	// setup auth token for userA
	AuthenticatedURL.Token token = getEncryptedAuthToken(signer, "userA");

	String serverURL = "http://" +
	NetUtils.getHostPortString(httpServer.getConnectorAddress(0)) + "/";

	// The default authenticator is kerberos.
	AuthenticatedURL authUrl = new AuthenticatedURL();

	// userA impersonates userB, it's allowed.
	for (String servlet :
	new String[]{"stacks", "jmx", "conf"}) {
	HttpURLConnection conn = authUrl
	.openConnection(new URL(serverURL + servlet + "?doAs=userB"),
	token);
	Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
	}

	// userA cannot impersonate userC, it fails.
	for (String servlet :
	new String[]{"stacks", "jmx", "conf"}){
	HttpURLConnection conn = authUrl
	.openConnection(new URL(serverURL + servlet + "?doAs=userC"),
	token);
	Assert.assertEquals(HttpURLConnection.HTTP_FORBIDDEN,
	conn.getResponseCode());
	}

	// "/logs" and "/logLevel" require admin authorization,
	// only userA has the access.
	for (String servlet :
	new String[]{"logLevel", "logs"}) {
	HttpURLConnection conn = authUrl
	.openConnection(new URL(serverURL + servlet), token);
	Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
	}

	// Setup token for userB
	token = getEncryptedAuthToken(signer, "userB");

	// userB cannot access these servlets.
	for (String servlet :
	new String[]{"logLevel", "logs"}) {
	HttpURLConnection conn = authUrl
	.openConnection(new URL(serverURL + servlet), token);
	Assert.assertEquals(HttpURLConnection.HTTP_FORBIDDEN,
	conn.getResponseCode());
	}

	} finally {
	if (httpServer != null) {
	httpServer.stop();
	}
	}
	}

	@Test
	public void testSessionCookie() throws Exception {
	Configuration conf = new Configuration();
	conf.set(HttpServer2.FILTER_INITIALIZER_PROPERTY,
	AuthenticationFilterInitializer.class.getName());
	conf.set(PREFIX + "type", "kerberos");
	conf.setBoolean(PREFIX + "simple.anonymous.allowed", false);
	conf.set(PREFIX + "signer.secret.provider",
	TestSignerSecretProvider.class.getName());

	conf.set(PREFIX + "kerberos.keytab",
	httpSpnegoKeytabFile.getAbsolutePath());
	conf.set(PREFIX + "kerberos.principal", httpSpnegoPrincipal);
	conf.set(PREFIX + "cookie.domain", realm);
	conf.setBoolean(CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION,
	true);

	//setup logs dir
	System.setProperty("hadoop.log.dir", testRootDir.getAbsolutePath());

	HttpServer2 httpServer = null;
	// Create http server to test.
	httpServer = getCommonBuilder()
	.setConf(conf)
	.build();
	httpServer.start();

	// Get signer to encrypt token
	final Signer signer = new Signer(new TestSignerSecretProvider());
	final AuthenticatedURL authUrl = new AuthenticatedURL();

	final URL url = new URL("http://" + NetUtils.getHostPortString(
	httpServer.getConnectorAddress(0)) + "/conf");

	// this illustrates an inconsistency with AuthenticatedURL. the
	// authenticator is only called when the token is not set. if the
	// authenticator fails then it must throw an AuthenticationException to
	// the caller, yet the caller may see 401 for subsequent requests
	// that require re-authentication like token expiration.
	final UserGroupInformation simpleUgi =
	UserGroupInformation.createRemoteUser("simple-user");

	authUgi.doAs(new PrivilegedExceptionAction<Void>() {
	@Override
	public Void run() throws Exception {
	TestSignerSecretProvider.rollSecret();
	HttpURLConnection conn = null;
	AuthenticatedURL.Token token = new AuthenticatedURL.Token();

	// initial request should trigger authentication and set the token.
	conn = authUrl.openConnection(url, token);
	Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
	Assert.assertTrue(token.isSet());
	String cookie = token.toString();

	// token should not change.
	conn = authUrl.openConnection(url, token);
	Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
	Assert.assertTrue(token.isSet());
	Assert.assertEquals(cookie, token.toString());

	// roll secret to invalidate token.
	TestSignerSecretProvider.rollSecret();
	conn = authUrl.openConnection(url, token);
	// this may or may not happen. under normal circumstances the
	// jdk will silently renegotiate and the client never sees a 401.
	// however in some cases the jdk will give up doing spnego. since
	// the token is already set, the authenticator isn't invoked (which
	// would do the spnego if the jdk doesn't), which causes the client
	// to see a 401.
	if (conn.getResponseCode() == HttpURLConnection.HTTP_UNAUTHORIZED) {
	// if this happens, the token should be cleared which means the
	// next request should succeed and receive a new token.
	Assert.assertFalse(token.isSet());
	conn = authUrl.openConnection(url, token);
	}

	// token should change.
	Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
	Assert.assertTrue(token.isSet());
	Assert.assertNotEquals(cookie, token.toString());
	cookie = token.toString();

	// token should not change.
	for (int i=0; i < 3; i++) {
	conn = authUrl.openConnection(url, token);
	Assert.assertEquals("attempt"+i,
	HttpURLConnection.HTTP_OK, conn.getResponseCode());
	Assert.assertTrue(token.isSet());
	Assert.assertEquals(cookie, token.toString());
	}

	// blow out the kerberos creds test only auth token is used.
	Subject s = Subject.getSubject(AccessController.getContext());
	Set<Object> oldCreds = new HashSet<>(s.getPrivateCredentials());
	s.getPrivateCredentials().clear();

	// token should not change.
	for (int i=0; i < 3; i++) {
	try {
	conn = authUrl.openConnection(url, token);
	Assert.assertEquals("attempt"+i,
	HttpURLConnection.HTTP_OK, conn.getResponseCode());
	} catch (AuthenticationException ae) {
	Assert.fail("attempt"+i+" "+ae);
	}
	Assert.assertTrue(token.isSet());
	Assert.assertEquals(cookie, token.toString());
	}

	// invalidate token. connections should fail now and token should be
	// unset.
	TestSignerSecretProvider.rollSecret();
	conn = authUrl.openConnection(url, token);
	Assert.assertEquals(
	HttpURLConnection.HTTP_UNAUTHORIZED, conn.getResponseCode());
	Assert.assertFalse(token.isSet());
	Assert.assertEquals("", token.toString());

	// restore the kerberos creds, should work again.
	s.getPrivateCredentials().addAll(oldCreds);
	conn = authUrl.openConnection(url, token);
	Assert.assertEquals(
	HttpURLConnection.HTTP_OK, conn.getResponseCode());
	Assert.assertTrue(token.isSet());
	cookie = token.toString();

	// token should not change.
	for (int i=0; i < 3; i++) {
	conn = authUrl.openConnection(url, token);
	Assert.assertEquals("attempt"+i,
	HttpURLConnection.HTTP_OK, conn.getResponseCode());
	Assert.assertTrue(token.isSet());
	Assert.assertEquals(cookie, token.toString());
	}
	return null;
	}
	});

	simpleUgi.doAs(new PrivilegedExceptionAction<Void>() {
	@Override
	public Void run() throws Exception {
	TestSignerSecretProvider.rollSecret();
	AuthenticatedURL authUrl = new AuthenticatedURL();
	AuthenticatedURL.Token token = new AuthenticatedURL.Token();
	HttpURLConnection conn = null;

	// initial connect with unset token will trigger authenticator which
	// should fail since we have no creds and leave token unset.
	try {
	authUrl.openConnection(url, token);
	Assert.fail("should fail with no credentials");
	} catch (AuthenticationException ae) {
	Assert.assertNotNull(ae.getCause());
	Assert.assertEquals(GSSException.class, ae.getCause().getClass());
	GSSException gsse = (GSSException)ae.getCause();
	Assert.assertEquals(GSSException.NO_CRED, gsse.getMajor());
	} catch (Throwable t) {
	Assert.fail("Unexpected exception" + t);
	}
	Assert.assertFalse(token.isSet());

	// create a valid token and save its value.
	token = getEncryptedAuthToken(signer, "valid");
	String cookie = token.toString();

	// server should accept token. after the request the token should
	// be set to the same value (ie. server didn't reissue cookie)
	conn = authUrl.openConnection(url, token);
	Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
	Assert.assertTrue(token.isSet());
	Assert.assertEquals(cookie, token.toString());

	conn = authUrl.openConnection(url, token);
	Assert.assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
	Assert.assertTrue(token.isSet());
	Assert.assertEquals(cookie, token.toString());

	// change the secret to effectively invalidate the cookie. see above
	// regarding inconsistency. the authenticator has no way to know the
	// token is bad, so the client will encounter a 401 instead of
	// AuthenticationException.
	TestSignerSecretProvider.rollSecret();
	conn = authUrl.openConnection(url, token);
	Assert.assertEquals(
	HttpURLConnection.HTTP_UNAUTHORIZED, conn.getResponseCode());
	Assert.assertFalse(token.isSet());
	Assert.assertEquals("", token.toString());
	return null;
	}
	});
	}

	public static class TestSignerSecretProvider extends SignerSecretProvider {
	static int n = 0;
	static byte[] secret;

	static void rollSecret() {
	secret = ("secret[" + (n++) + "]").getBytes();
	}

	public TestSignerSecretProvider() {
	}

	@Override
	public void init(Properties config, ServletContext servletContext,
	long tokenValidity) throws Exception {
	rollSecret();
	}

	@Override
	public byte[] getCurrentSecret() {
	return secret;
	}

	@Override
	public byte[][] getAllSecrets() {
	return new byte[][]{secret};
	}
	}

	private AuthenticatedURL.Token getEncryptedAuthToken(Signer signer,
	String user) throws Exception {
	AuthenticationToken token =
	new AuthenticationToken(user, user, "kerberos");
	token.setExpires(System.currentTimeMillis() + TIMEOUT);
	return new AuthenticatedURL.Token(signer.sign(token.toString()));
	}

	private Signer getSignerToEncrypt() throws Exception {
	SignerSecretProvider secretProvider =
	StringSignerSecretProviderCreator.newStringSignerSecretProvider();
	Properties secretProviderProps = new Properties();
	secretProviderProps.setProperty(
	AuthenticationFilter.SIGNATURE_SECRET, SECRET_STR);
	secretProvider.init(secretProviderProps, null, TIMEOUT);
	return new Signer(secretProvider);
	}

	private Configuration getSpengoConf(Configuration conf) {
	conf = new Configuration();
	conf.set(HttpServer2.FILTER_INITIALIZER_PROPERTY,
	AuthenticationFilterInitializer.class.getName());
	conf.set(PREFIX + "type", "kerberos");
	conf.setBoolean(PREFIX + "simple.anonymous.allowed", false);
	conf.set(PREFIX + "signature.secret.file",
	secretFile.getAbsolutePath());
	conf.set(PREFIX + "kerberos.keytab",
	httpSpnegoKeytabFile.getAbsolutePath());
	conf.set(PREFIX + "kerberos.principal", httpSpnegoPrincipal);
	conf.set(PREFIX + "cookie.domain", realm);
	conf.setBoolean(CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION,
	true);
	return conf;
	}

	private HttpServer2.Builder getCommonBuilder() throws Exception {
	return new HttpServer2.Builder().setName("test")
	.addEndpoint(new URI("http://localhost:0"))
	.setFindPort(true);
	}
	}