@Test
public void testGetUgiFromToken() throws IOException {

  conf.set(DFSConfigKeys.FS_DEFAULT_NAME_KEY, "hdfs://localhost:4321/");
  ServletContext context = mock(ServletContext.class);
  String realUser = "TheDoctor";
  String user = "TheNurse";
  conf.set(DFSConfigKeys.HADOOP_SECURITY_AUTHENTICATION, "kerberos");
  UserGroupInformation.setConfiguration(conf);
  UserGroupInformation ugi;
  HttpServletRequest request;
  
  Text ownerText = new Text(user);
  DelegationTokenIdentifier dtId = new DelegationTokenIdentifier(
      ownerText, ownerText, new Text(realUser));
  Token<DelegationTokenIdentifier> token = new Token<DelegationTokenIdentifier>(
      dtId, new DummySecretManager(0, 0, 0, 0));
  String tokenString = token.encodeToUrlString();
  
  // token with no auth-ed user
  request = getMockRequest(null, null, null);
  when(request.getParameter(JspHelper.DELEGATION_PARAMETER_NAME)).thenReturn(
      tokenString);
  ugi = JspHelper.getUGI(context, request, conf);
  Assert.assertNotNull(ugi.getRealUser());
  Assert.assertEquals(ugi.getRealUser().getShortUserName(), realUser);
  Assert.assertEquals(ugi.getShortUserName(), user);
  checkUgiFromToken(ugi);
  
  // token with auth-ed user
  request = getMockRequest(realUser, null, null);
  when(request.getParameter(JspHelper.DELEGATION_PARAMETER_NAME)).thenReturn(
      tokenString);
  ugi = JspHelper.getUGI(context, request, conf);
  Assert.assertNotNull(ugi.getRealUser());
  Assert.assertEquals(ugi.getRealUser().getShortUserName(), realUser);
  Assert.assertEquals(ugi.getShortUserName(), user);    
  checkUgiFromToken(ugi);
  
  // completely different user, token trumps auth
  request = getMockRequest("rogue", null, null);
  when(request.getParameter(JspHelper.DELEGATION_PARAMETER_NAME)).thenReturn(
      tokenString);
  ugi = JspHelper.getUGI(context, request, conf);
  Assert.assertNotNull(ugi.getRealUser());
  Assert.assertEquals(ugi.getRealUser().getShortUserName(), realUser);
  Assert.assertEquals(ugi.getShortUserName(), user);    
  checkUgiFromToken(ugi);
  
  // expected case
  request = getMockRequest(null, user, null);
  when(request.getParameter(JspHelper.DELEGATION_PARAMETER_NAME)).thenReturn(
      tokenString);
  ugi = JspHelper.getUGI(context, request, conf);
  Assert.assertNotNull(ugi.getRealUser());
  Assert.assertEquals(ugi.getRealUser().getShortUserName(), realUser);
  Assert.assertEquals(ugi.getShortUserName(), user);    
  checkUgiFromToken(ugi);
  
  // can't proxy with a token!
  request = getMockRequest(null, null, "rogue");
  when(request.getParameter(JspHelper.DELEGATION_PARAMETER_NAME)).thenReturn(
      tokenString);
  try {
    JspHelper.getUGI(context, request, conf);
    Assert.fail("bad request allowed");
  } catch (IOException ioe) {
    Assert.assertEquals(
        "Usernames not matched: name=rogue != expected="+user,
        ioe.getMessage());
  }
  
  // can't proxy with a token!
  request = getMockRequest(null, user, "rogue");
  when(request.getParameter(JspHelper.DELEGATION_PARAMETER_NAME)).thenReturn(
      tokenString);
  try {
    JspHelper.getUGI(context, request, conf);
    Assert.fail("bad request allowed");
  } catch (IOException ioe) {
    Assert.assertEquals(
        "Usernames not matched: name=rogue != expected="+user,
        ioe.getMessage());
  }
}