@Test
public void testCreateKey() throws Exception {

  final Configuration conf = new Configuration();
  KeyProvider kp = 
      new UserProvider.Factory().createProvider(new URI("user:///"), conf);
  KeyACLs mock = mock(KeyACLs.class);
  when(mock.isACLPresent("foo", KeyOpType.MANAGEMENT)).thenReturn(true);
  UserGroupInformation u1 = UserGroupInformation.createRemoteUser("u1");
  when(mock.hasAccessToKey("foo", u1, KeyOpType.MANAGEMENT)).thenReturn(true);
  final KeyProviderCryptoExtension kpExt =
      new KeyAuthorizationKeyProvider(
          KeyProviderCryptoExtension.createKeyProviderCryptoExtension(kp),
          mock);
  u1.doAs(
      new PrivilegedExceptionAction<Void>() {
        @Override
        public Void run() throws Exception {
          try {
            kpExt.createKey("foo", SecureRandom.getSeed(16),
                newOptions(conf));
          } catch (IOException ioe) {
            Assert.fail("User should be Authorized !!");
          }
          // "bar" key not configured
          try {
            kpExt.createKey("bar", SecureRandom.getSeed(16),
                newOptions(conf));
            Assert.fail("User should NOT be Authorized !!");
          } catch (IOException ioe) {
            // Ignore
          }
          return null;
        }
      }
      );
  // Unauthorized User
  UserGroupInformation.createRemoteUser("badGuy").doAs(
      new PrivilegedExceptionAction<Void>() {
        @Override
        public Void run() throws Exception {
          try {
            kpExt.createKey("foo", SecureRandom.getSeed(16),
                newOptions(conf));
            Assert.fail("User should NOT be Authorized !!");
          } catch (IOException ioe) {
            // Ignore
          }
          return null;
        }
      }
      );
}