@Test
public void testGetProxyUgi() throws IOException {

  conf.set(DFSConfigKeys.FS_DEFAULT_NAME_KEY, "hdfs://localhost:4321/");
  ServletContext context = mock(ServletContext.class);
  String realUser = "TheDoctor";
  String user = "TheNurse";
  conf.set(DFSConfigKeys.HADOOP_SECURITY_AUTHENTICATION, "kerberos");
  
  conf.set(ProxyUsers.getProxySuperuserGroupConfKey(realUser), "*");
  conf.set(ProxyUsers.getProxySuperuserIpConfKey(realUser), "*");
  ProxyUsers.refreshSuperUserGroupsConfiguration(conf);
  UserGroupInformation.setConfiguration(conf);
  UserGroupInformation ugi;
  HttpServletRequest request;
  
  // have to be auth-ed with remote user
  request = getMockRequest(null, null, user);
  try {
    JspHelper.getUGI(context, request, conf);
    Assert.fail("bad request allowed");
  } catch (IOException ioe) {
    Assert.assertEquals(
        "Security enabled but user not authenticated by filter",
        ioe.getMessage());
  }
  request = getMockRequest(null, realUser, user);
  try {
    JspHelper.getUGI(context, request, conf);
    Assert.fail("bad request allowed");
  } catch (IOException ioe) {
    Assert.assertEquals(
        "Security enabled but user not authenticated by filter",
        ioe.getMessage());
  }
  
  // proxy ugi for user via remote user
  request = getMockRequest(realUser, null, user);
  ugi = JspHelper.getUGI(context, request, conf);
  Assert.assertNotNull(ugi.getRealUser());
  Assert.assertEquals(ugi.getRealUser().getShortUserName(), realUser);
  Assert.assertEquals(ugi.getShortUserName(), user);
  checkUgiFromAuth(ugi);
  
  // proxy ugi for user vi a remote user = real user
  request = getMockRequest(realUser, realUser, user);
  ugi = JspHelper.getUGI(context, request, conf);
  Assert.assertNotNull(ugi.getRealUser());
  Assert.assertEquals(ugi.getRealUser().getShortUserName(), realUser);
  Assert.assertEquals(ugi.getShortUserName(), user);
  checkUgiFromAuth(ugi);
  
  // proxy ugi for user via remote user != real user
  request = getMockRequest(realUser, user, user);
  try {
    JspHelper.getUGI(context, request, conf);
    Assert.fail("bad request allowed");
  } catch (IOException ioe) {
    Assert.assertEquals(
        "Usernames not matched: name="+user+" != expected="+realUser,
        ioe.getMessage());
  }
  
  // try to get get a proxy user with unauthorized user
  try {
    request = getMockRequest(user, null, realUser);
    JspHelper.getUGI(context, request, conf);
    Assert.fail("bad proxy request allowed");
  } catch (AuthorizationException ae) {
    Assert.assertEquals(
        "User: " + user + " is not allowed to impersonate " + realUser,
         ae.getMessage());
  }
  try {
    request = getMockRequest(user, user, realUser);
    JspHelper.getUGI(context, request, conf);
    Assert.fail("bad proxy request allowed");
  } catch (AuthorizationException ae) {
    Assert.assertEquals(
        "User: " + user + " is not allowed to impersonate " + realUser,
         ae.getMessage());
  }
}