[3/4] ambari git commit: AMBARI-21216. Add support for consecutive login failure accounting (rlevas)

[rl...@apache.org]

http://git-wip-us.apache.org/repos/asf/ambari/blob/f760516c/ambari-server/src/test/java/org/apache/ambari/server/security/authentication/AmbariJWTAuthenticationFilterTest.java
----------------------------------------------------------------------
diff --git a/ambari-server/src/test/java/org/apache/ambari/server/security/authentication/AmbariJWTAuthenticationFilterTest.java b/ambari-server/src/test/java/org/apache/ambari/server/security/authentication/AmbariJWTAuthenticationFilterTest.java
index 961e65d..14c1032 100644
--- a/ambari-server/src/test/java/org/apache/ambari/server/security/authentication/AmbariJWTAuthenticationFilterTest.java
+++ b/ambari-server/src/test/java/org/apache/ambari/server/security/authentication/AmbariJWTAuthenticationFilterTest.java
@@ -18,8 +18,12 @@
 
 package org.apache.ambari.server.security.authentication;
 
+import static org.easymock.EasyMock.anyObject;
+import static org.easymock.EasyMock.capture;
+import static org.easymock.EasyMock.eq;
 import static org.easymock.EasyMock.expect;
 import static org.easymock.EasyMock.expectLastCall;
+import static org.easymock.EasyMock.newCapture;
 
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
@@ -28,24 +32,31 @@ import java.security.interfaces.RSAPrivateKey;
 import java.security.interfaces.RSAPublicKey;
 import java.util.Calendar;
 import java.util.Collections;
-import java.util.Date;
+import java.util.List;
 
 import javax.servlet.FilterChain;
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.apache.ambari.server.audit.AuditLogger;
 import org.apache.ambari.server.configuration.Configuration;
 import org.apache.ambari.server.orm.entities.UserAuthenticationEntity;
 import org.apache.ambari.server.orm.entities.UserEntity;
 import org.apache.ambari.server.security.AmbariEntryPoint;
-import org.apache.ambari.server.security.authorization.PermissionHelper;
+import org.apache.ambari.server.security.authorization.AmbariGrantedAuthority;
+import org.apache.ambari.server.security.authorization.User;
+import org.apache.ambari.server.security.authorization.UserAuthenticationType;
 import org.apache.ambari.server.security.authorization.Users;
 import org.apache.ambari.server.security.authorization.jwt.JwtAuthenticationProperties;
+import org.easymock.Capture;
+import org.easymock.CaptureType;
 import org.easymock.EasyMockSupport;
+import org.junit.Assert;
+import org.junit.Before;
 import org.junit.BeforeClass;
 import org.junit.Test;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
 
 import com.nimbusds.jose.JOSEException;
 import com.nimbusds.jose.JWSAlgorithm;
@@ -58,6 +69,14 @@ public class AmbariJWTAuthenticationFilterTest extends EasyMockSupport {
   private static RSAPublicKey publicKey;
   private static RSAPrivateKey privateKey;
 
+  private AmbariAuthenticationEventHandler eventHandler;
+
+  private AmbariEntryPoint entryPoint;
+
+  private Configuration configuration;
+
+  private Users users;
+
   @BeforeClass
   public static void generateKeyPair() throws NoSuchAlgorithmException {
     KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
@@ -67,11 +86,9 @@ public class AmbariJWTAuthenticationFilterTest extends EasyMockSupport {
     privateKey = (RSAPrivateKey) keyPair.getPrivate();
   }
 
-  @Test
-  public void testDoFilterSuccess() throws Exception {
-    SignedJWT token = getSignedToken("foobar");
-
-    AmbariEntryPoint entryPoint = createMock(AmbariEntryPoint.class);
+  @Before
+  public void setUp() {
+    SecurityContextHolder.getContext().setAuthentication(null);
 
     JwtAuthenticationProperties properties = createMock(JwtAuthenticationProperties.class);
     expect(properties.getAuthenticationProviderUrl()).andReturn("some url").once();
@@ -80,96 +97,115 @@ public class AmbariJWTAuthenticationFilterTest extends EasyMockSupport {
     expect(properties.getCookieName()).andReturn("chocolate chip").once();
     expect(properties.getOriginalUrlQueryParam()).andReturn("question").once();
 
-    Configuration configuration = createMock(Configuration.class);
+    users = createMock(Users.class);
+    eventHandler = createMock(AmbariAuthenticationEventHandler.class);
+    entryPoint = createMock(AmbariEntryPoint.class);
+    configuration = createMock(Configuration.class);
+
     expect(configuration.getJwtProperties()).andReturn(properties).once();
+  }
 
-    UserEntity userEntity = createMock(UserEntity.class);
-    expect(userEntity.getAuthenticationEntities()).andReturn(Collections.<UserAuthenticationEntity>emptyList()).once();
 
-    Users users = createMock(Users.class);
-    expect(users.getUserEntity("test-user")).andReturn(userEntity).once();
+  @Test (expected = IllegalArgumentException.class)
+  public void ensureNonNullEventHandler() {
+    new AmbariJWTAuthenticationFilter(entryPoint, configuration, users, null);
+  }
+
+  @Test
+  public void testDoFilterSuccessful() throws Exception {
+    Capture<? extends AmbariAuthenticationFilter> captureFilter = newCapture(CaptureType.ALL);
 
-    AuditLogger auditLogger = createMock(AuditLogger.class);
-    expect(auditLogger.isEnabled()).andReturn(false).times(2);
+    SignedJWT token = getSignedToken();
 
-    PermissionHelper permissionHelper = createMock(PermissionHelper.class);
+    HttpServletRequest request = createMock(HttpServletRequest.class);
+    HttpServletResponse response = createMock(HttpServletResponse.class);
+    FilterChain filterChain = createMock(FilterChain.class);
 
     Cookie cookie = createMock(Cookie.class);
     expect(cookie.getName()).andReturn("chocolate chip").once();
     expect(cookie.getValue()).andReturn(token.serialize()).once();
 
+    expect(request.getCookies()).andReturn(new Cookie[]{cookie}).once();
+
+    UserAuthenticationEntity userAuthenticationEntity = createMock(UserAuthenticationEntity.class);
+    expect(userAuthenticationEntity.getAuthenticationType()).andReturn(UserAuthenticationType.JWT).anyTimes();
 
-    HttpServletRequest servletRequest = createMock(HttpServletRequest.class);
-    expect(servletRequest.getCookies()).andReturn(new Cookie[]{cookie}).once();
+    UserEntity userEntity = createMock(UserEntity.class);
+    expect(userEntity.getAuthenticationEntities()).andReturn(Collections.singletonList(userAuthenticationEntity)).once();
 
-    HttpServletResponse servletResponse = createMock(HttpServletResponse.class);
+    expect(users.getUserEntity("test-user")).andReturn(userEntity).once();
+    expect(users.getUserAuthorities(userEntity)).andReturn(Collections.<AmbariGrantedAuthority>emptyList()).once();
+    expect(users.getUser(userEntity)).andReturn(createMock(User.class)).once();
 
-    FilterChain filterChain = createMock(FilterChain.class);
-    filterChain.doFilter(servletRequest, servletResponse);
+    eventHandler.beforeAttemptAuthentication(capture(captureFilter), eq(request), eq(response));
+    expectLastCall().once();
+    eventHandler.onSuccessfulAuthentication(capture(captureFilter), eq(request), eq(response), anyObject(Authentication.class));
     expectLastCall().once();
 
-    replayAll();
+    filterChain.doFilter(request, response);
+    expectLastCall().once();
 
-    AmbariJWTAuthenticationFilter filter = new AmbariJWTAuthenticationFilter(entryPoint, configuration, users, auditLogger, permissionHelper);
-    filter.doFilter(servletRequest, servletResponse, filterChain);
+    replayAll();
 
+    // WHEN
+    AmbariJWTAuthenticationFilter filter = new AmbariJWTAuthenticationFilter(entryPoint, configuration, users, eventHandler);
+    filter.doFilter(request, response, filterChain);
+    // THEN
     verifyAll();
-  }
 
-  @Test
-  public void testDoFilterFailure() throws Exception {
-    AmbariEntryPoint entryPoint = createMock(AmbariEntryPoint.class);
-
-    JwtAuthenticationProperties properties = createMock(JwtAuthenticationProperties.class);
-    expect(properties.getAuthenticationProviderUrl()).andReturn("some url").once();
-    expect(properties.getPublicKey()).andReturn(publicKey).once();
-    expect(properties.getAudiences()).andReturn(Collections.singletonList("foobar")).once();
-    expect(properties.getCookieName()).andReturn("chocolate chip").once();
-    expect(properties.getOriginalUrlQueryParam()).andReturn("question").once();
-
-    Configuration configuration = createMock(Configuration.class);
-    expect(configuration.getJwtProperties()).andReturn(properties).once();
+    List<? extends AmbariAuthenticationFilter> capturedFilters = captureFilter.getValues();
+    for(AmbariAuthenticationFilter capturedFiltered : capturedFilters) {
+      Assert.assertSame(filter, capturedFiltered);
+    }
+  }
 
-    Users users = createMock(Users.class);
 
-    AuditLogger auditLogger = createMock(AuditLogger.class);
-    expect(auditLogger.isEnabled()).andReturn(false).times(2);
+  @Test
+  public void testDoFilterUnsuccessful() throws Exception {
+    Capture<? extends AmbariAuthenticationFilter> captureFilter = newCapture(CaptureType.ALL);
 
-    PermissionHelper permissionHelper = createMock(PermissionHelper.class);
+    SignedJWT token = getSignedToken();
+    // GIVEN
+    HttpServletRequest request = createMock(HttpServletRequest.class);
+    HttpServletResponse response = createMock(HttpServletResponse.class);
+    FilterChain filterChain = createMock(FilterChain.class);
 
     Cookie cookie = createMock(Cookie.class);
     expect(cookie.getName()).andReturn("chocolate chip").once();
-    expect(cookie.getValue()).andReturn("invalid token").once();
+    expect(cookie.getValue()).andReturn(token.serialize()).once();
 
+    expect(request.getCookies()).andReturn(new Cookie[]{cookie}).once();
 
-    HttpServletRequest servletRequest = createMock(HttpServletRequest.class);
-    expect(servletRequest.getCookies()).andReturn(new Cookie[]{cookie}).once();
+    expect(users.getUserEntity("test-user")).andReturn(null).once();
 
-    HttpServletResponse servletResponse = createMock(HttpServletResponse.class);
+    eventHandler.beforeAttemptAuthentication(capture(captureFilter), eq(request), eq(response));
+    expectLastCall().once();
+    eventHandler.onUnsuccessfulAuthentication(capture(captureFilter), eq(request), eq(response), anyObject(AmbariAuthenticationException.class));
+    expectLastCall().once();
 
-    FilterChain filterChain = createMock(FilterChain.class);
-    filterChain.doFilter(servletRequest, servletResponse);
+    entryPoint.commence(eq(request), eq(response), anyObject(AmbariAuthenticationException.class));
     expectLastCall().once();
 
     replayAll();
-
-    AmbariJWTAuthenticationFilter filter = new AmbariJWTAuthenticationFilter(entryPoint, configuration, users, auditLogger, permissionHelper);
-    filter.doFilter(servletRequest, servletResponse, filterChain);
-
+    // WHEN
+    AmbariJWTAuthenticationFilter filter = new AmbariJWTAuthenticationFilter(entryPoint, configuration, users, eventHandler);
+    filter.doFilter(request, response, filterChain);
+    // THEN
     verifyAll();
-  }
-
 
-  private SignedJWT getSignedToken(String audience) throws JOSEException {
-    Calendar calendar = Calendar.getInstance();
-    calendar.setTimeInMillis(System.currentTimeMillis());
-    calendar.add(Calendar.DATE, 1); //add one day
-    return getSignedToken(calendar.getTime(), audience);
+    List<? extends AmbariAuthenticationFilter> capturedFilters = captureFilter.getValues();
+    for (AmbariAuthenticationFilter capturedFiltered : capturedFilters) {
+      Assert.assertSame(filter, capturedFiltered);
+    }
   }
 
-  private SignedJWT getSignedToken(Date expirationTime, String audience) throws JOSEException {
+  private SignedJWT getSignedToken() throws JOSEException {
     RSASSASigner signer = new RSASSASigner(privateKey);
 
+    Calendar expirationTime = Calendar.getInstance();
+    expirationTime.setTimeInMillis(System.currentTimeMillis());
+    expirationTime.add(Calendar.DATE, 1); //add one day
+
     Calendar calendar = Calendar.getInstance();
     calendar.setTimeInMillis(System.currentTimeMillis());
     JWTClaimsSet claimsSet = new JWTClaimsSet();
@@ -177,9 +213,9 @@ public class AmbariJWTAuthenticationFilterTest extends EasyMockSupport {
     claimsSet.setIssuer("unit-test");
     claimsSet.setIssueTime(calendar.getTime());
 
-    claimsSet.setExpirationTime(expirationTime);
+    claimsSet.setExpirationTime(expirationTime.getTime());
 
-    claimsSet.setAudience(audience);
+    claimsSet.setAudience("foobar");
 
     SignedJWT signedJWT = new SignedJWT(new JWSHeader(JWSAlgorithm.RS256), claimsSet);
     signedJWT.sign(signer);

http://git-wip-us.apache.org/repos/asf/ambari/blob/f760516c/ambari-server/src/test/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosAuthenticationFilterTest.java
----------------------------------------------------------------------
diff --git a/ambari-server/src/test/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosAuthenticationFilterTest.java b/ambari-server/src/test/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosAuthenticationFilterTest.java
index 5503fac..a0b7aca 100644
--- a/ambari-server/src/test/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosAuthenticationFilterTest.java
+++ b/ambari-server/src/test/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosAuthenticationFilterTest.java
@@ -18,35 +18,71 @@
 
 package org.apache.ambari.server.security.authentication.kerberos;
 
+import static org.easymock.EasyMock.anyObject;
+import static org.easymock.EasyMock.capture;
+import static org.easymock.EasyMock.eq;
 import static org.easymock.EasyMock.expect;
+import static org.easymock.EasyMock.expectLastCall;
+import static org.easymock.EasyMock.getCurrentArguments;
+import static org.easymock.EasyMock.newCapture;
 
+import java.io.IOException;
+import java.util.List;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
 
-import org.apache.ambari.server.audit.AuditLogger;
 import org.apache.ambari.server.configuration.Configuration;
-import org.apache.ambari.server.security.authorization.PermissionHelper;
+import org.apache.ambari.server.security.AmbariEntryPoint;
+import org.apache.ambari.server.security.authentication.AmbariAuthenticationEventHandler;
+import org.apache.ambari.server.security.authentication.AmbariAuthenticationException;
+import org.apache.ambari.server.security.authentication.AmbariAuthenticationFilter;
+import org.apache.ambari.server.security.authentication.InvalidUsernamePasswordCombinationException;
+import org.easymock.Capture;
+import org.easymock.CaptureType;
 import org.easymock.EasyMockSupport;
+import org.easymock.IAnswer;
 import org.junit.Assert;
+import org.junit.Before;
 import org.junit.Test;
 import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.AuthenticationEntryPoint;
 
 public class AmbariKerberosAuthenticationFilterTest extends EasyMockSupport {
+  private Configuration configuration;
+
+  private AuthenticationEntryPoint entryPoint;
+
+  private AuthenticationManager authenticationManager;
+
+  private AmbariAuthenticationEventHandler eventHandler;
+
+  @Before
+  public void setUp() {
+    SecurityContextHolder.getContext().setAuthentication(null);
+
+    entryPoint = createMock(AmbariEntryPoint.class);
+    configuration = createMock(Configuration.class);
+    authenticationManager = createMock(AuthenticationManager.class);
+    eventHandler = createMock(AmbariAuthenticationEventHandler.class);
+  }
+
+  @Test (expected = IllegalArgumentException.class)
+  public void ensureNonNullEventHandler() {
+    new AmbariKerberosAuthenticationFilter(authenticationManager, entryPoint, configuration, null);
+  }
+
   @Test
   public void shouldApplyTrue() throws Exception {
     HttpServletRequest httpServletRequest = createMock(HttpServletRequest.class);
     expect(httpServletRequest.getHeader("Authorization")).andReturn("Negotiate .....").once();
 
-    AmbariKerberosAuthenticationProperties properties = createMock(AmbariKerberosAuthenticationProperties.class);
-    expect(properties.isKerberosAuthenticationEnabled()).andReturn(true).once();
-
-    Configuration configuration = createMock(Configuration.class);
-    expect(configuration.getKerberosAuthenticationProperties()).andReturn(properties).once();
-
-    AuthenticationManager authenticationManager = createMock(AuthenticationManager.class);
-    AuthenticationEntryPoint entryPoint = createMock(AuthenticationEntryPoint.class);
-    AuditLogger auditLogger = createMock(AuditLogger.class);
-    PermissionHelper permissionHelper = createMock(PermissionHelper.class);
+    expect(configuration.getKerberosAuthenticationProperties()).andReturn(createProperties(true)).once();
 
     replayAll();
 
@@ -54,8 +90,7 @@ public class AmbariKerberosAuthenticationFilterTest extends EasyMockSupport {
         authenticationManager,
         entryPoint,
         configuration,
-        auditLogger,
-        permissionHelper
+        eventHandler
     );
 
     Assert.assertTrue(filter.shouldApply(httpServletRequest));
@@ -68,16 +103,7 @@ public class AmbariKerberosAuthenticationFilterTest extends EasyMockSupport {
     HttpServletRequest httpServletRequest = createMock(HttpServletRequest.class);
     expect(httpServletRequest.getHeader("Authorization")).andReturn(null).once();
 
-    AmbariKerberosAuthenticationProperties properties = createMock(AmbariKerberosAuthenticationProperties.class);
-    expect(properties.isKerberosAuthenticationEnabled()).andReturn(true).once();
-
-    Configuration configuration = createMock(Configuration.class);
-    expect(configuration.getKerberosAuthenticationProperties()).andReturn(properties).once();
-
-    AuthenticationManager authenticationManager = createMock(AuthenticationManager.class);
-    AuthenticationEntryPoint entryPoint = createMock(AuthenticationEntryPoint.class);
-    AuditLogger auditLogger = createMock(AuditLogger.class);
-    PermissionHelper permissionHelper = createMock(PermissionHelper.class);
+    expect(configuration.getKerberosAuthenticationProperties()).andReturn(createProperties(true)).once();
 
     replayAll();
 
@@ -85,8 +111,7 @@ public class AmbariKerberosAuthenticationFilterTest extends EasyMockSupport {
         authenticationManager,
         entryPoint,
         configuration,
-        auditLogger,
-        permissionHelper
+        eventHandler
     );
 
     Assert.assertFalse(filter.shouldApply(httpServletRequest));
@@ -98,16 +123,7 @@ public class AmbariKerberosAuthenticationFilterTest extends EasyMockSupport {
   public void shouldApplyNotFalseEnabled() throws Exception {
     HttpServletRequest httpServletRequest = createMock(HttpServletRequest.class);
 
-    AmbariKerberosAuthenticationProperties properties = createMock(AmbariKerberosAuthenticationProperties.class);
-    expect(properties.isKerberosAuthenticationEnabled()).andReturn(false).once();
-
-    Configuration configuration = createMock(Configuration.class);
-    expect(configuration.getKerberosAuthenticationProperties()).andReturn(properties).once();
-
-    AuthenticationManager authenticationManager = createMock(AuthenticationManager.class);
-    AuthenticationEntryPoint entryPoint = createMock(AuthenticationEntryPoint.class);
-    AuditLogger auditLogger = createMock(AuditLogger.class);
-    PermissionHelper permissionHelper = createMock(PermissionHelper.class);
+    expect(configuration.getKerberosAuthenticationProperties()).andReturn(createProperties(false)).once();
 
     replayAll();
 
@@ -115,8 +131,7 @@ public class AmbariKerberosAuthenticationFilterTest extends EasyMockSupport {
         authenticationManager,
         entryPoint,
         configuration,
-        auditLogger,
-        permissionHelper
+        eventHandler
     );
 
     Assert.assertFalse(filter.shouldApply(httpServletRequest));
@@ -125,9 +140,95 @@ public class AmbariKerberosAuthenticationFilterTest extends EasyMockSupport {
   }
 
   @Test
-  public void doFilter() throws Exception {
-    // Skip this test since the real work is being done by SpnegoAuthenticationProcessingFilter, which
-    // is a class in the Spring libraries.
+  public void testDoFilterSuccessful() throws IOException, ServletException {
+    Capture<? extends AmbariAuthenticationFilter> captureFilter = newCapture(CaptureType.ALL);
+
+    // GIVEN
+    HttpServletRequest request = createMock(HttpServletRequest.class);
+    HttpServletResponse response = createMock(HttpServletResponse.class);
+    HttpSession session = createMock(HttpSession.class);
+    FilterChain filterChain = createMock(FilterChain.class);
+
+    expect(request.getHeader("Authorization")).andReturn("Negotiate ").once();
+    expect(request.getRemoteAddr()).andReturn("1.2.3.4").once();
+    expect(request.getSession(false)).andReturn(session).once();
+    expect(session.getId()).andReturn("sessionID").once();
+
+    expect(authenticationManager.authenticate(anyObject(Authentication.class)))
+        .andAnswer(new IAnswer<Authentication>() {
+          @Override
+          public Authentication answer() throws Throwable {
+            return (Authentication) getCurrentArguments()[0];
+          }
+        })
+        .anyTimes();
+
+    expect(configuration.getKerberosAuthenticationProperties()).andReturn(createProperties(true)).once();
+
+    eventHandler.beforeAttemptAuthentication(capture(captureFilter), eq(request), eq(response));
+    expectLastCall().once();
+    eventHandler.onSuccessfulAuthentication(capture(captureFilter), eq(request), eq(response), anyObject(Authentication.class));
+    expectLastCall().once();
+
+    filterChain.doFilter(request, response);
+    expectLastCall().once();
+
+    replayAll();
+    // WHEN
+    AmbariAuthenticationFilter filter = new AmbariKerberosAuthenticationFilter(authenticationManager, entryPoint, configuration, eventHandler);
+    filter.doFilter(request, response, filterChain);
+    // THEN
+    verifyAll();
+
+    List<? extends AmbariAuthenticationFilter> capturedFilters = captureFilter.getValues();
+    for (AmbariAuthenticationFilter capturedFiltered : capturedFilters) {
+      Assert.assertSame(filter, capturedFiltered);
+    }
   }
 
+  @Test
+  public void testDoFilterUnsuccessful() throws IOException, ServletException {
+    Capture<? extends AmbariAuthenticationFilter> captureFilter = newCapture(CaptureType.ALL);
+
+    // GIVEN
+    HttpServletRequest request = createMock(HttpServletRequest.class);
+    HttpServletResponse response = createMock(HttpServletResponse.class);
+    HttpSession session = createMock(HttpSession.class);
+    FilterChain filterChain = createMock(FilterChain.class);
+
+    expect(request.getHeader("Authorization")).andReturn("Negotiate ").once();
+    expect(request.getRemoteAddr()).andReturn("1.2.3.4").once();
+    expect(request.getSession(false)).andReturn(session).once();
+    expect(session.getId()).andReturn("sessionID").once();
+
+    expect(authenticationManager.authenticate(anyObject(Authentication.class))).andThrow(new InvalidUsernamePasswordCombinationException("user")).once();
+
+    expect(configuration.getKerberosAuthenticationProperties()).andReturn(createProperties(true)).once();
+
+    eventHandler.beforeAttemptAuthentication(capture(captureFilter), eq(request), eq(response));
+    expectLastCall().once();
+    eventHandler.onUnsuccessfulAuthentication(capture(captureFilter), eq(request), eq(response), anyObject(AmbariAuthenticationException.class));
+    expectLastCall().once();
+
+    entryPoint.commence(eq(request), eq(response), anyObject(AmbariAuthenticationException.class));
+    expectLastCall().once();
+
+    replayAll();
+    // WHEN
+    AmbariAuthenticationFilter filter = new AmbariKerberosAuthenticationFilter(authenticationManager, entryPoint, configuration, eventHandler);
+    filter.doFilter(request, response, filterChain);
+    // THEN
+    verifyAll();
+
+    List<? extends AmbariAuthenticationFilter> capturedFilters = captureFilter.getValues();
+    for (AmbariAuthenticationFilter capturedFiltered : capturedFilters) {
+      Assert.assertSame(filter, capturedFiltered);
+    }
+  }
+
+  private AmbariKerberosAuthenticationProperties createProperties(Boolean enabled) {
+    AmbariKerberosAuthenticationProperties properties = createMock(AmbariKerberosAuthenticationProperties.class);
+    expect(properties.isKerberosAuthenticationEnabled()).andReturn(enabled).once();
+    return properties;
+  }
 }
\ No newline at end of file

http://git-wip-us.apache.org/repos/asf/ambari/blob/f760516c/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariAuthorizationProviderDisableUserTest.java
----------------------------------------------------------------------
diff --git a/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariAuthorizationProviderDisableUserTest.java b/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariAuthorizationProviderDisableUserTest.java
index 33100dd..fea7fb9 100644
--- a/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariAuthorizationProviderDisableUserTest.java
+++ b/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariAuthorizationProviderDisableUserTest.java
@@ -26,6 +26,7 @@ import org.apache.ambari.server.orm.dao.UserDAO;
 import org.apache.ambari.server.orm.entities.PrincipalEntity;
 import org.apache.ambari.server.orm.entities.UserAuthenticationEntity;
 import org.apache.ambari.server.orm.entities.UserEntity;
+import org.apache.ambari.server.security.authentication.InvalidUsernamePasswordCombinationException;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;

http://git-wip-us.apache.org/repos/asf/ambari/blob/f760516c/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariLdapAuthenticationProviderForDNWithSpaceTest.java
----------------------------------------------------------------------
diff --git a/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariLdapAuthenticationProviderForDNWithSpaceTest.java b/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariLdapAuthenticationProviderForDNWithSpaceTest.java
index 1bf122e..fd967c2 100644
--- a/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariLdapAuthenticationProviderForDNWithSpaceTest.java
+++ b/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariLdapAuthenticationProviderForDNWithSpaceTest.java
@@ -30,6 +30,7 @@ import org.apache.ambari.server.orm.GuiceJpaInitializer;
 import org.apache.ambari.server.orm.dao.UserDAO;
 import org.apache.ambari.server.orm.entities.UserEntity;
 import org.apache.ambari.server.security.ClientSecurityType;
+import org.apache.ambari.server.security.authentication.InvalidUsernamePasswordCombinationException;
 import org.apache.directory.server.annotations.CreateLdapServer;
 import org.apache.directory.server.annotations.CreateTransport;
 import org.apache.directory.server.core.annotations.ApplyLdifFiles;

http://git-wip-us.apache.org/repos/asf/ambari/blob/f760516c/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariLdapAuthenticationProviderTest.java
----------------------------------------------------------------------
diff --git a/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariLdapAuthenticationProviderTest.java b/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariLdapAuthenticationProviderTest.java
index d9eb335..a613a18 100644
--- a/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariLdapAuthenticationProviderTest.java
+++ b/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariLdapAuthenticationProviderTest.java
@@ -33,6 +33,7 @@ import org.apache.ambari.server.orm.GuiceJpaInitializer;
 import org.apache.ambari.server.orm.dao.UserDAO;
 import org.apache.ambari.server.orm.entities.UserEntity;
 import org.apache.ambari.server.security.ClientSecurityType;
+import org.apache.ambari.server.security.authentication.InvalidUsernamePasswordCombinationException;
 import org.apache.directory.server.annotations.CreateLdapServer;
 import org.apache.directory.server.annotations.CreateTransport;
 import org.apache.directory.server.core.annotations.ApplyLdifFiles;

http://git-wip-us.apache.org/repos/asf/ambari/blob/f760516c/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariLocalUserProviderTest.java
----------------------------------------------------------------------
diff --git a/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariLocalUserProviderTest.java b/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariLocalUserProviderTest.java
index 65a5400..133fc9f 100644
--- a/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariLocalUserProviderTest.java
+++ b/ambari-server/src/test/java/org/apache/ambari/server/security/authorization/AmbariLocalUserProviderTest.java
@@ -35,6 +35,7 @@ import org.apache.ambari.server.orm.dao.UserDAO;
 import org.apache.ambari.server.orm.entities.PrincipalEntity;
 import org.apache.ambari.server.orm.entities.UserAuthenticationEntity;
 import org.apache.ambari.server.orm.entities.UserEntity;
+import org.apache.ambari.server.security.authentication.InvalidUsernamePasswordCombinationException;
 import org.junit.AfterClass;
 import org.junit.Before;
 import org.junit.BeforeClass;