@Test
public void testGetNonProxyUgi() throws IOException {

  conf.set(DFSConfigKeys.FS_DEFAULT_NAME_KEY, "hdfs://localhost:4321/");
  ServletContext context = mock(ServletContext.class);
  String realUser = "TheDoctor";
  String user = "TheNurse";
  conf.set(DFSConfigKeys.HADOOP_SECURITY_AUTHENTICATION, "kerberos");
  UserGroupInformation.setConfiguration(conf);
  UserGroupInformation ugi;
  HttpServletRequest request;
  
  // have to be auth-ed with remote user
  request = getMockRequest(null, null, null);
  try {
    JspHelper.getUGI(context, request, conf);
    Assert.fail("bad request allowed");
  } catch (IOException ioe) {
    Assert.assertEquals(
        "Security enabled but user not authenticated by filter",
        ioe.getMessage());
  }
  request = getMockRequest(null, realUser, null);
  try {
    JspHelper.getUGI(context, request, conf);
    Assert.fail("bad request allowed");
  } catch (IOException ioe) {
    Assert.assertEquals(
        "Security enabled but user not authenticated by filter",
        ioe.getMessage());
  }
  
  // ugi for remote user
  request = getMockRequest(realUser, null, null);
  ugi = JspHelper.getUGI(context, request, conf);
  Assert.assertNull(ugi.getRealUser());
  Assert.assertEquals(ugi.getShortUserName(), realUser);
  checkUgiFromAuth(ugi);
  
  // ugi for remote user = real user
  request = getMockRequest(realUser, realUser, null);
  ugi = JspHelper.getUGI(context, request, conf);
  Assert.assertNull(ugi.getRealUser());
  Assert.assertEquals(ugi.getShortUserName(), realUser);
  checkUgiFromAuth(ugi);
  
  // if there is remote user via SPNEGO, ignore user.name param
  request = getMockRequest(realUser, user, null);
  ugi = JspHelper.getUGI(context, request, conf);
  Assert.assertNull(ugi.getRealUser());
  Assert.assertEquals(ugi.getShortUserName(), realUser);
  checkUgiFromAuth(ugi);
}