@Test
public void testCheckUserAccessToQueue() throws Exception {

  ResourceManager mockRM = mock(ResourceManager.class);
  Configuration conf = new YarnConfiguration();
  // Inject a mock scheduler implementation.
  // Only admin user has ADMINISTER_QUEUE access.
  // For SUBMIT_APPLICATION ACL, both of admin/yarn user have acess
  ResourceScheduler mockScheduler = new FifoScheduler() {
    @Override
    public synchronized boolean checkAccess(UserGroupInformation callerUGI,
        QueueACL acl, String queueName) {
      if (acl == QueueACL.ADMINISTER_QUEUE) {
        if (callerUGI.getUserName().equals("admin")) {
          return true;
        }
      } else {
        if (ImmutableSet.of("admin", "yarn").contains(callerUGI.getUserName())) {
          return true;
        }
      }
      return false;
    }
  };
  when(mockRM.getResourceScheduler()).thenReturn(mockScheduler);
  RMWebServices webSvc =
      new RMWebServices(mockRM, conf, mock(HttpServletResponse.class));
  boolean caughtException = false;
  // Case 1: Only queue admin user can access other user's information
  HttpServletRequest mockHsr = mockHttpServletRequestByUserName("non-admin");
  try {
    webSvc.checkUserAccessToQueue("queue", "jack",
        QueueACL.SUBMIT_APPLICATIONS.name(), mockHsr);
  } catch (ForbiddenException e) {
    caughtException = true;
  }
  Assert.assertTrue(caughtException);
  // Case 2: request an unknown ACL causes BAD_REQUEST
  mockHsr = mockHttpServletRequestByUserName("admin");
  caughtException = false;
  try {
    webSvc.checkUserAccessToQueue("queue", "jack", "XYZ_ACL", mockHsr);
  } catch (BadRequestException e) {
    caughtException = true;
  }
  Assert.assertTrue(caughtException);
  // Case 3: get FORBIDDEN for rejected ACL
  mockHsr = mockHttpServletRequestByUserName("admin");
  Assert.assertFalse(webSvc.checkUserAccessToQueue("queue", "jack",
      QueueACL.SUBMIT_APPLICATIONS.name(), mockHsr).isAllowed());
  Assert.assertFalse(webSvc.checkUserAccessToQueue("queue", "jack",
      QueueACL.ADMINISTER_QUEUE.name(), mockHsr).isAllowed());
  // Case 4: get OK for listed ACLs
  mockHsr = mockHttpServletRequestByUserName("admin");
  Assert.assertTrue(webSvc.checkUserAccessToQueue("queue", "admin",
      QueueACL.SUBMIT_APPLICATIONS.name(), mockHsr).isAllowed());
  Assert.assertTrue(webSvc.checkUserAccessToQueue("queue", "admin",
      QueueACL.ADMINISTER_QUEUE.name(), mockHsr).isAllowed());
  // Case 5: get OK only for SUBMIT_APP acl for "yarn" user
  mockHsr = mockHttpServletRequestByUserName("admin");
  Assert.assertTrue(webSvc.checkUserAccessToQueue("queue", "yarn",
      QueueACL.SUBMIT_APPLICATIONS.name(), mockHsr).isAllowed());
  Assert.assertFalse(webSvc.checkUserAccessToQueue("queue", "yarn",
      QueueACL.ADMINISTER_QUEUE.name(), mockHsr).isAllowed());
}