@Test
public void testDecryptEEK() throws Throwable {

	if (!UNRESTRICTED_POLICIES_INSTALLED) {
		return;
	}
	
    // bob should have permission to generate EEK
    final UserGroupInformation ugi = UserGroupInformation.createRemoteUser("bob");
    ugi.doAs(new PrivilegedExceptionAction<Void>() {
        public Void run() throws Exception {
            KMSWebApp.getACLs().assertAccess(Type.DECRYPT_EEK, ugi, KMSOp.DECRYPT_EEK, "newkey1", "127.0.0.1");
            return null;
        }
    });
    // "eve" should not have permission to decrypt EEK
    final UserGroupInformation ugi2 = UserGroupInformation.createRemoteUser("eve");
    ugi2.doAs(new PrivilegedExceptionAction<Void>() {
        public Void run() throws Exception {
            try {
                KMSWebApp.getACLs().assertAccess(Type.DECRYPT_EEK, ugi2, KMSOp.DECRYPT_EEK, "newkey1", "127.0.0.1");
                Assert.fail("Failure expected");
            } catch (AuthorizationException ex) {
                LOG.error(ex);
            }
            return null;
        }
    });
    // the IT group should not have permission to decrypt EEK
    final UserGroupInformation ugi3 = UserGroupInformation.createUserForTesting("alice", new String[]{"IT"});
    ugi3.doAs(new PrivilegedExceptionAction<Void>() {
        public Void run() throws Exception {
            try {
                KMSWebApp.getACLs().assertAccess(Type.DECRYPT_EEK, ugi3, KMSOp.DECRYPT_EEK, "newkey1", "127.0.0.1");
                Assert.fail("Failure expected");
            } catch (AuthorizationException ex) {
                LOG.error(ex);
            }
            return null;
        }
    });
}