Java Code Examples for org.apache.hadoop.hdfs.security.token.delegation.DelegationTokenIdentifier#readFields()

The following examples show how to use org.apache.hadoop.hdfs.security.token.delegation.DelegationTokenIdentifier#readFields() . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: TestDelegationTokenForProxyUser.java    From hadoop with Apache License 2.0 6 votes vote down vote up
@Test(timeout=20000)
public void testDelegationTokenWithRealUser() throws IOException {
  try {
    Token<?>[] tokens = proxyUgi
        .doAs(new PrivilegedExceptionAction<Token<?>[]>() {
          @Override
          public Token<?>[] run() throws IOException {
            return cluster.getFileSystem().addDelegationTokens("RenewerUser", null);
          }
        });
    DelegationTokenIdentifier identifier = new DelegationTokenIdentifier();
    byte[] tokenId = tokens[0].getIdentifier();
    identifier.readFields(new DataInputStream(new ByteArrayInputStream(
        tokenId)));
    Assert.assertEquals(identifier.getUser().getUserName(), PROXY_USER);
    Assert.assertEquals(identifier.getUser().getRealUser().getUserName(),
        REAL_USER);
  } catch (InterruptedException e) {
    //Do Nothing
  }
}
 
Example 2
Source File: TestDelegationTokenForProxyUser.java    From big-c with Apache License 2.0 6 votes vote down vote up
@Test(timeout=20000)
public void testDelegationTokenWithRealUser() throws IOException {
  try {
    Token<?>[] tokens = proxyUgi
        .doAs(new PrivilegedExceptionAction<Token<?>[]>() {
          @Override
          public Token<?>[] run() throws IOException {
            return cluster.getFileSystem().addDelegationTokens("RenewerUser", null);
          }
        });
    DelegationTokenIdentifier identifier = new DelegationTokenIdentifier();
    byte[] tokenId = tokens[0].getIdentifier();
    identifier.readFields(new DataInputStream(new ByteArrayInputStream(
        tokenId)));
    Assert.assertEquals(identifier.getUser().getUserName(), PROXY_USER);
    Assert.assertEquals(identifier.getUser().getRealUser().getUserName(),
        REAL_USER);
  } catch (InterruptedException e) {
    //Do Nothing
  }
}
 
Example 3
Source File: DataNodeUGIProvider.java    From hadoop with Apache License 2.0 5 votes vote down vote up
private UserGroupInformation tokenUGI() throws IOException {
  Token<DelegationTokenIdentifier> token = params.delegationToken();
  ByteArrayInputStream buf =
    new ByteArrayInputStream(token.getIdentifier());
  DataInputStream in = new DataInputStream(buf);
  DelegationTokenIdentifier id = new DelegationTokenIdentifier();
  id.readFields(in);
  UserGroupInformation ugi = id.getUser();
  ugi.addToken(token);
  return ugi;
}
 
Example 4
Source File: JspHelper.java    From hadoop with Apache License 2.0 5 votes vote down vote up
private static UserGroupInformation getTokenUGI(ServletContext context,
                                                HttpServletRequest request,
                                                String tokenString,
                                                Configuration conf)
                                                    throws IOException {
  final Token<DelegationTokenIdentifier> token =
      new Token<DelegationTokenIdentifier>();
  token.decodeFromUrlString(tokenString);
  InetSocketAddress serviceAddress = getNNServiceAddress(context, request);
  if (serviceAddress != null) {
    SecurityUtil.setTokenService(token, serviceAddress);
    token.setKind(DelegationTokenIdentifier.HDFS_DELEGATION_KIND);
  }

  ByteArrayInputStream buf =
      new ByteArrayInputStream(token.getIdentifier());
  DataInputStream in = new DataInputStream(buf);
  DelegationTokenIdentifier id = new DelegationTokenIdentifier();
  id.readFields(in);
  if (context != null) {
    final NameNode nn = NameNodeHttpServer.getNameNodeFromContext(context);
    if (nn != null) {
      // Verify the token.
      nn.getNamesystem().verifyToken(id, token.getPassword());
    }
  }
  UserGroupInformation ugi = id.getUser();
  ugi.addToken(token);
  return ugi;
}
 
Example 5
Source File: TestDelegationToken.java    From hadoop with Apache License 2.0 5 votes vote down vote up
@Test
public void testDelegationTokenSecretManager() throws Exception {
  Token<DelegationTokenIdentifier> token = generateDelegationToken(
      "SomeUser", "JobTracker");
  // Fake renewer should not be able to renew
  try {
	  dtSecretManager.renewToken(token, "FakeRenewer");
	  Assert.fail("should have failed");
  } catch (AccessControlException ace) {
    // PASS
  }
 dtSecretManager.renewToken(token, "JobTracker");
  DelegationTokenIdentifier identifier = new DelegationTokenIdentifier();
  byte[] tokenId = token.getIdentifier();
  identifier.readFields(new DataInputStream(
           new ByteArrayInputStream(tokenId)));
  Assert.assertTrue(null != dtSecretManager.retrievePassword(identifier));
  LOG.info("Sleep to expire the token");
 Thread.sleep(6000);
 //Token should be expired
 try {
   dtSecretManager.retrievePassword(identifier);
   //Should not come here
   Assert.fail("Token should have expired");
 } catch (InvalidToken e) {
   //Success
 }
 dtSecretManager.renewToken(token, "JobTracker");
 LOG.info("Sleep beyond the max lifetime");
 Thread.sleep(5000);
 try {
	  dtSecretManager.renewToken(token, "JobTracker");
	  Assert.fail("should have been expired");
 } catch (InvalidToken it) {
   // PASS
 }
}
 
Example 6
Source File: TestDelegationToken.java    From hadoop with Apache License 2.0 5 votes vote down vote up
@SuppressWarnings("unchecked")
private void checkTokenIdentifier(UserGroupInformation ugi, final Token<?> token)
    throws Exception {
  Assert.assertNotNull(token);
  // should be able to use token.decodeIdentifier() but webhdfs isn't
  // registered with the service loader for token decoding
  DelegationTokenIdentifier identifier = new DelegationTokenIdentifier();
  byte[] tokenId = token.getIdentifier();
  DataInputStream in = new DataInputStream(new ByteArrayInputStream(tokenId));
  try {
    identifier.readFields(in);
  } finally {
    in.close();
  }
  Assert.assertNotNull(identifier);
  LOG.info("A valid token should have non-null password, and should be renewed successfully");
  Assert.assertTrue(null != dtSecretManager.retrievePassword(identifier));
  dtSecretManager.renewToken((Token<DelegationTokenIdentifier>) token, "JobTracker");
  ugi.doAs(
      new PrivilegedExceptionAction<Object>() {
        @Override
        public Object run() throws Exception {
          token.renew(config);
          token.cancel(config);
          return null;
        }
      });
}
 
Example 7
Source File: TestDelegationTokensWithHA.java    From hadoop with Apache License 2.0 5 votes vote down vote up
@Test(timeout = 300000)
public void testDelegationTokenDFSApi() throws Exception {
  final Token<DelegationTokenIdentifier> token =
      getDelegationToken(fs, "JobTracker");
  DelegationTokenIdentifier identifier = new DelegationTokenIdentifier();
  byte[] tokenId = token.getIdentifier();
  identifier.readFields(new DataInputStream(
           new ByteArrayInputStream(tokenId)));

  // Ensure that it's present in the NN's secret manager and can
  // be renewed directly from there.
  LOG.info("A valid token should have non-null password, " +
      "and should be renewed successfully");
  assertTrue(null != dtSecretManager.retrievePassword(identifier));
  dtSecretManager.renewToken(token, "JobTracker");
  
  // Use the client conf with the failover info present to check
  // renewal.
  Configuration clientConf = dfs.getConf();
  doRenewOrCancel(token, clientConf, TokenTestAction.RENEW);
  
  // Using a configuration that doesn't have the logical nameservice
  // configured should result in a reasonable error message.
  Configuration emptyConf = new Configuration();
  try {
    doRenewOrCancel(token, emptyConf, TokenTestAction.RENEW);
    fail("Did not throw trying to renew with an empty conf!");
  } catch (IOException ioe) {
    GenericTestUtils.assertExceptionContains(
        "Unable to map logical nameservice URI", ioe);
  }

  
  // Ensure that the token can be renewed again after a failover.
  cluster.transitionToStandby(0);
  cluster.transitionToActive(1);
  doRenewOrCancel(token, clientConf, TokenTestAction.RENEW);
  
  doRenewOrCancel(token, clientConf, TokenTestAction.CANCEL);
}
 
Example 8
Source File: DataNodeUGIProvider.java    From big-c with Apache License 2.0 5 votes vote down vote up
private UserGroupInformation tokenUGI() throws IOException {
  Token<DelegationTokenIdentifier> token = params.delegationToken();
  ByteArrayInputStream buf =
    new ByteArrayInputStream(token.getIdentifier());
  DataInputStream in = new DataInputStream(buf);
  DelegationTokenIdentifier id = new DelegationTokenIdentifier();
  id.readFields(in);
  UserGroupInformation ugi = id.getUser();
  ugi.addToken(token);
  return ugi;
}
 
Example 9
Source File: JspHelper.java    From big-c with Apache License 2.0 5 votes vote down vote up
private static UserGroupInformation getTokenUGI(ServletContext context,
                                                HttpServletRequest request,
                                                String tokenString,
                                                Configuration conf)
                                                    throws IOException {
  final Token<DelegationTokenIdentifier> token =
      new Token<DelegationTokenIdentifier>();
  token.decodeFromUrlString(tokenString);
  InetSocketAddress serviceAddress = getNNServiceAddress(context, request);
  if (serviceAddress != null) {
    SecurityUtil.setTokenService(token, serviceAddress);
    token.setKind(DelegationTokenIdentifier.HDFS_DELEGATION_KIND);
  }

  ByteArrayInputStream buf =
      new ByteArrayInputStream(token.getIdentifier());
  DataInputStream in = new DataInputStream(buf);
  DelegationTokenIdentifier id = new DelegationTokenIdentifier();
  id.readFields(in);
  if (context != null) {
    final NameNode nn = NameNodeHttpServer.getNameNodeFromContext(context);
    if (nn != null) {
      // Verify the token.
      nn.getNamesystem().verifyToken(id, token.getPassword());
    }
  }
  UserGroupInformation ugi = id.getUser();
  ugi.addToken(token);
  return ugi;
}
 
Example 10
Source File: TestDelegationToken.java    From big-c with Apache License 2.0 5 votes vote down vote up
@Test
public void testDelegationTokenSecretManager() throws Exception {
  Token<DelegationTokenIdentifier> token = generateDelegationToken(
      "SomeUser", "JobTracker");
  // Fake renewer should not be able to renew
  try {
	  dtSecretManager.renewToken(token, "FakeRenewer");
	  Assert.fail("should have failed");
  } catch (AccessControlException ace) {
    // PASS
  }
 dtSecretManager.renewToken(token, "JobTracker");
  DelegationTokenIdentifier identifier = new DelegationTokenIdentifier();
  byte[] tokenId = token.getIdentifier();
  identifier.readFields(new DataInputStream(
           new ByteArrayInputStream(tokenId)));
  Assert.assertTrue(null != dtSecretManager.retrievePassword(identifier));
  LOG.info("Sleep to expire the token");
 Thread.sleep(6000);
 //Token should be expired
 try {
   dtSecretManager.retrievePassword(identifier);
   //Should not come here
   Assert.fail("Token should have expired");
 } catch (InvalidToken e) {
   //Success
 }
 dtSecretManager.renewToken(token, "JobTracker");
 LOG.info("Sleep beyond the max lifetime");
 Thread.sleep(5000);
 try {
	  dtSecretManager.renewToken(token, "JobTracker");
	  Assert.fail("should have been expired");
 } catch (InvalidToken it) {
   // PASS
 }
}
 
Example 11
Source File: TestDelegationToken.java    From big-c with Apache License 2.0 5 votes vote down vote up
@SuppressWarnings("unchecked")
private void checkTokenIdentifier(UserGroupInformation ugi, final Token<?> token)
    throws Exception {
  Assert.assertNotNull(token);
  // should be able to use token.decodeIdentifier() but webhdfs isn't
  // registered with the service loader for token decoding
  DelegationTokenIdentifier identifier = new DelegationTokenIdentifier();
  byte[] tokenId = token.getIdentifier();
  DataInputStream in = new DataInputStream(new ByteArrayInputStream(tokenId));
  try {
    identifier.readFields(in);
  } finally {
    in.close();
  }
  Assert.assertNotNull(identifier);
  LOG.info("A valid token should have non-null password, and should be renewed successfully");
  Assert.assertTrue(null != dtSecretManager.retrievePassword(identifier));
  dtSecretManager.renewToken((Token<DelegationTokenIdentifier>) token, "JobTracker");
  ugi.doAs(
      new PrivilegedExceptionAction<Object>() {
        @Override
        public Object run() throws Exception {
          token.renew(config);
          token.cancel(config);
          return null;
        }
      });
}
 
Example 12
Source File: TestDelegationTokensWithHA.java    From big-c with Apache License 2.0 5 votes vote down vote up
@Test(timeout = 300000)
public void testDelegationTokenDFSApi() throws Exception {
  final Token<DelegationTokenIdentifier> token =
      getDelegationToken(fs, "JobTracker");
  DelegationTokenIdentifier identifier = new DelegationTokenIdentifier();
  byte[] tokenId = token.getIdentifier();
  identifier.readFields(new DataInputStream(
           new ByteArrayInputStream(tokenId)));

  // Ensure that it's present in the NN's secret manager and can
  // be renewed directly from there.
  LOG.info("A valid token should have non-null password, " +
      "and should be renewed successfully");
  assertTrue(null != dtSecretManager.retrievePassword(identifier));
  dtSecretManager.renewToken(token, "JobTracker");
  
  // Use the client conf with the failover info present to check
  // renewal.
  Configuration clientConf = dfs.getConf();
  doRenewOrCancel(token, clientConf, TokenTestAction.RENEW);
  
  // Using a configuration that doesn't have the logical nameservice
  // configured should result in a reasonable error message.
  Configuration emptyConf = new Configuration();
  try {
    doRenewOrCancel(token, emptyConf, TokenTestAction.RENEW);
    fail("Did not throw trying to renew with an empty conf!");
  } catch (IOException ioe) {
    GenericTestUtils.assertExceptionContains(
        "Unable to map logical nameservice URI", ioe);
  }

  
  // Ensure that the token can be renewed again after a failover.
  cluster.transitionToStandby(0);
  cluster.transitionToActive(1);
  doRenewOrCancel(token, clientConf, TokenTestAction.RENEW);
  
  doRenewOrCancel(token, clientConf, TokenTestAction.CANCEL);
}
 
Example 13
Source File: ImageLoaderCurrent.java    From hadoop with Apache License 2.0 4 votes vote down vote up
/**
 * Process the Delegation Token related section in fsimage.
 * 
 * @param in DataInputStream to process
 * @param v Visitor to walk over records
 */
private void processDelegationTokens(DataInputStream in, ImageVisitor v)
    throws IOException {
  v.visit(ImageElement.CURRENT_DELEGATION_KEY_ID, in.readInt());
  int numDKeys = in.readInt();
  v.visitEnclosingElement(ImageElement.DELEGATION_KEYS,
      ImageElement.NUM_DELEGATION_KEYS, numDKeys);
  for(int i =0; i < numDKeys; i++) {
    DelegationKey key = new DelegationKey();
    key.readFields(in);
    v.visit(ImageElement.DELEGATION_KEY, key.toString());
  }
  v.leaveEnclosingElement();
  v.visit(ImageElement.DELEGATION_TOKEN_SEQUENCE_NUMBER, in.readInt());
  int numDTokens = in.readInt();
  v.visitEnclosingElement(ImageElement.DELEGATION_TOKENS,
      ImageElement.NUM_DELEGATION_TOKENS, numDTokens);
  for(int i=0; i<numDTokens; i++){
    DelegationTokenIdentifier id = new  DelegationTokenIdentifier();
    id.readFields(in);
    long expiryTime = in.readLong();
    v.visitEnclosingElement(ImageElement.DELEGATION_TOKEN_IDENTIFIER);
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_KIND,
        id.getKind().toString());
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_SEQNO,
        id.getSequenceNumber());
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_OWNER,
        id.getOwner().toString());
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_RENEWER,
        id.getRenewer().toString());
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_REALUSER,
        id.getRealUser().toString());
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_ISSUE_DATE,
        id.getIssueDate());
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_MAX_DATE,
        id.getMaxDate());
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_EXPIRY_TIME,
        expiryTime);
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_MASTER_KEY_ID,
        id.getMasterKeyId());
    v.leaveEnclosingElement(); // DELEGATION_TOKEN_IDENTIFIER
  }
  v.leaveEnclosingElement(); // DELEGATION_TOKENS
}
 
Example 14
Source File: TestDelegationTokensWithHA.java    From hadoop with Apache License 2.0 4 votes vote down vote up
/**
 * Test if StandbyException can be thrown from StandbyNN, when it's requested for 
 * password. (HDFS-6475). With StandbyException, the client can failover to try
 * activeNN.
 */
@Test(timeout = 300000)
public void testDelegationTokenStandbyNNAppearFirst() throws Exception {
  // make nn0 the standby NN, and nn1 the active NN
  cluster.transitionToStandby(0);
  cluster.transitionToActive(1);

  final DelegationTokenSecretManager stSecretManager = 
      NameNodeAdapter.getDtSecretManager(
          nn1.getNamesystem());

  // create token
  final Token<DelegationTokenIdentifier> token =
      getDelegationToken(fs, "JobTracker");
  final DelegationTokenIdentifier identifier = new DelegationTokenIdentifier();
  byte[] tokenId = token.getIdentifier();
  identifier.readFields(new DataInputStream(
           new ByteArrayInputStream(tokenId)));

  assertTrue(null != stSecretManager.retrievePassword(identifier));

  final UserGroupInformation ugi = UserGroupInformation
      .createRemoteUser("JobTracker");
  ugi.addToken(token);
  
  ugi.doAs(new PrivilegedExceptionAction<Object>() {
    @Override
    public Object run() {
      try {
        try {
          byte[] tmppw = dtSecretManager.retrievePassword(identifier);
          fail("InvalidToken with cause StandbyException is expected"
              + " since nn0 is standby");
          return tmppw;
        } catch (IOException e) {
          // Mimic the UserProvider class logic (server side) by throwing
          // SecurityException here
          throw new SecurityException(
              SecurityUtil.FAILED_TO_GET_UGI_MSG_HEADER + " " + e, e);
        }
      } catch (Exception oe) {
        //
        // The exception oe caught here is
        //     java.lang.SecurityException: Failed to obtain user group
        //     information: org.apache.hadoop.security.token.
        //     SecretManager$InvalidToken: StandbyException
        //
        HttpServletResponse response = mock(HttpServletResponse.class);
        ExceptionHandler eh = new ExceptionHandler();
        eh.initResponse(response);
        
        // The Response (resp) below is what the server will send to client          
        //
        // BEFORE HDFS-6475 fix, the resp.entity is
        //     {"RemoteException":{"exception":"SecurityException",
        //      "javaClassName":"java.lang.SecurityException",
        //      "message":"Failed to obtain user group information: 
        //      org.apache.hadoop.security.token.SecretManager$InvalidToken:
        //        StandbyException"}}
        // AFTER the fix, the resp.entity is
        //     {"RemoteException":{"exception":"StandbyException",
        //      "javaClassName":"org.apache.hadoop.ipc.StandbyException",
        //      "message":"Operation category READ is not supported in
        //       state standby"}}
        //
        Response resp = eh.toResponse(oe);
        
        // Mimic the client side logic by parsing the response from server
        //
        Map<?, ?> m = (Map<?, ?>)JSON.parse(resp.getEntity().toString());
        RemoteException re = JsonUtil.toRemoteException(m);
        Exception unwrapped = ((RemoteException)re).unwrapRemoteException(
            StandbyException.class);
        assertTrue (unwrapped instanceof StandbyException);
        return null;
      }
    }
  });
}
 
Example 15
Source File: ImageLoaderCurrent.java    From big-c with Apache License 2.0 4 votes vote down vote up
/**
 * Process the Delegation Token related section in fsimage.
 * 
 * @param in DataInputStream to process
 * @param v Visitor to walk over records
 */
private void processDelegationTokens(DataInputStream in, ImageVisitor v)
    throws IOException {
  v.visit(ImageElement.CURRENT_DELEGATION_KEY_ID, in.readInt());
  int numDKeys = in.readInt();
  v.visitEnclosingElement(ImageElement.DELEGATION_KEYS,
      ImageElement.NUM_DELEGATION_KEYS, numDKeys);
  for(int i =0; i < numDKeys; i++) {
    DelegationKey key = new DelegationKey();
    key.readFields(in);
    v.visit(ImageElement.DELEGATION_KEY, key.toString());
  }
  v.leaveEnclosingElement();
  v.visit(ImageElement.DELEGATION_TOKEN_SEQUENCE_NUMBER, in.readInt());
  int numDTokens = in.readInt();
  v.visitEnclosingElement(ImageElement.DELEGATION_TOKENS,
      ImageElement.NUM_DELEGATION_TOKENS, numDTokens);
  for(int i=0; i<numDTokens; i++){
    DelegationTokenIdentifier id = new  DelegationTokenIdentifier();
    id.readFields(in);
    long expiryTime = in.readLong();
    v.visitEnclosingElement(ImageElement.DELEGATION_TOKEN_IDENTIFIER);
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_KIND,
        id.getKind().toString());
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_SEQNO,
        id.getSequenceNumber());
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_OWNER,
        id.getOwner().toString());
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_RENEWER,
        id.getRenewer().toString());
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_REALUSER,
        id.getRealUser().toString());
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_ISSUE_DATE,
        id.getIssueDate());
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_MAX_DATE,
        id.getMaxDate());
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_EXPIRY_TIME,
        expiryTime);
    v.visit(ImageElement.DELEGATION_TOKEN_IDENTIFIER_MASTER_KEY_ID,
        id.getMasterKeyId());
    v.leaveEnclosingElement(); // DELEGATION_TOKEN_IDENTIFIER
  }
  v.leaveEnclosingElement(); // DELEGATION_TOKENS
}
 
Example 16
Source File: TestDelegationTokensWithHA.java    From big-c with Apache License 2.0 4 votes vote down vote up
/**
 * Test if StandbyException can be thrown from StandbyNN, when it's requested for 
 * password. (HDFS-6475). With StandbyException, the client can failover to try
 * activeNN.
 */
@Test(timeout = 300000)
public void testDelegationTokenStandbyNNAppearFirst() throws Exception {
  // make nn0 the standby NN, and nn1 the active NN
  cluster.transitionToStandby(0);
  cluster.transitionToActive(1);

  final DelegationTokenSecretManager stSecretManager = 
      NameNodeAdapter.getDtSecretManager(
          nn1.getNamesystem());

  // create token
  final Token<DelegationTokenIdentifier> token =
      getDelegationToken(fs, "JobTracker");
  final DelegationTokenIdentifier identifier = new DelegationTokenIdentifier();
  byte[] tokenId = token.getIdentifier();
  identifier.readFields(new DataInputStream(
           new ByteArrayInputStream(tokenId)));

  assertTrue(null != stSecretManager.retrievePassword(identifier));

  final UserGroupInformation ugi = UserGroupInformation
      .createRemoteUser("JobTracker");
  ugi.addToken(token);
  
  ugi.doAs(new PrivilegedExceptionAction<Object>() {
    @Override
    public Object run() {
      try {
        try {
          byte[] tmppw = dtSecretManager.retrievePassword(identifier);
          fail("InvalidToken with cause StandbyException is expected"
              + " since nn0 is standby");
          return tmppw;
        } catch (IOException e) {
          // Mimic the UserProvider class logic (server side) by throwing
          // SecurityException here
          throw new SecurityException(
              SecurityUtil.FAILED_TO_GET_UGI_MSG_HEADER + " " + e, e);
        }
      } catch (Exception oe) {
        //
        // The exception oe caught here is
        //     java.lang.SecurityException: Failed to obtain user group
        //     information: org.apache.hadoop.security.token.
        //     SecretManager$InvalidToken: StandbyException
        //
        HttpServletResponse response = mock(HttpServletResponse.class);
        ExceptionHandler eh = new ExceptionHandler();
        eh.initResponse(response);
        
        // The Response (resp) below is what the server will send to client          
        //
        // BEFORE HDFS-6475 fix, the resp.entity is
        //     {"RemoteException":{"exception":"SecurityException",
        //      "javaClassName":"java.lang.SecurityException",
        //      "message":"Failed to obtain user group information: 
        //      org.apache.hadoop.security.token.SecretManager$InvalidToken:
        //        StandbyException"}}
        // AFTER the fix, the resp.entity is
        //     {"RemoteException":{"exception":"StandbyException",
        //      "javaClassName":"org.apache.hadoop.ipc.StandbyException",
        //      "message":"Operation category READ is not supported in
        //       state standby"}}
        //
        Response resp = eh.toResponse(oe);
        
        // Mimic the client side logic by parsing the response from server
        //
        Map<?, ?> m = (Map<?, ?>)JSON.parse(resp.getEntity().toString());
        RemoteException re = JsonUtil.toRemoteException(m);
        Exception unwrapped = ((RemoteException)re).unwrapRemoteException(
            StandbyException.class);
        assertTrue (unwrapped instanceof StandbyException);
        return null;
      }
    }
  });
}