@Override
  public UserIdentity login(String username, Object credentials, ServletRequest request) {
    if (!(request instanceof HttpServletRequest)) {
      return null;
    }
    String doAsUser = request.getParameter(DO_AS);
    if (doAsUser == null && _fallbackToSpnegoAllowed) {
      SpnegoUserIdentity fallbackIdentity = (SpnegoUserIdentity) _fallbackSpnegoLoginService.login(username, credentials, request);
      SpnegoUserPrincipal fallbackPrincipal = (SpnegoUserPrincipal) fallbackIdentity.getUserPrincipal();
      if (!fallbackIdentity.isEstablished()) {
        LOG.info("Service user {} isn't authorized as spnego fallback principal", fallbackPrincipal.getName());
      }
      return fallbackIdentity;
    } else {
      SpnegoUserIdentity serviceIdentity = (SpnegoUserIdentity) _delegateSpnegoLoginService.login(username, credentials, request);
      SpnegoUserPrincipal servicePrincipal = (SpnegoUserPrincipal) serviceIdentity.getUserPrincipal();
      LOG.info("Authorizing proxy user {} from {} service", doAsUser, servicePrincipal.getName());
      UserIdentity doAsIdentity = null;
      if (doAsUser != null && !doAsUser.isEmpty()) {
        doAsIdentity = _endUserAuthorizer.getUserIdentity((HttpServletRequest) request, doAsUser);
      }

      Principal principal = new TrustedProxyPrincipal(doAsUser, servicePrincipal);
      Subject subject = new Subject(READ_ONLY_SUBJECT, Collections.singleton(principal), Collections.emptySet(), Collections.emptySet());

      if (!serviceIdentity.isEstablished()) {
        LOG.info("Service user {} isn't authorized as a trusted proxy", servicePrincipal.getName());
        return new SpnegoUserIdentity(subject, principal, null);
      } else {
        if (doAsIdentity == null) {
          LOG.info("Couldn't authorize user {}", doAsUser);
        }
        return new SpnegoUserIdentity(subject, principal, doAsIdentity);
      }
    }
  }
@Test
  public void testInvalidAuthServiceUser() {
    SpnegoLoginServiceWithAuthServiceLifecycle mockSpnegoLoginService = mock(SpnegoLoginServiceWithAuthServiceLifecycle.class);
    SpnegoLoginServiceWithAuthServiceLifecycle mockFallbackLoginService = mock(SpnegoLoginServiceWithAuthServiceLifecycle.class);

    SpnegoUserPrincipal servicePrincipal = new SpnegoUserPrincipal(TEST_SERVICE_USER, ENCODED_TOKEN);
    Subject subject = new Subject(true, Collections.singleton(servicePrincipal), Collections.emptySet(), Collections.emptySet());
    SpnegoUserIdentity result = new SpnegoUserIdentity(subject, servicePrincipal, null);
    expect(mockSpnegoLoginService.login(anyString(), anyObject(), anyObject())).andReturn(result);

    TestAuthorizer userAuthorizer = new TestAuthorizer(TEST_USER);

    HttpServletRequest mockRequest = mock(HttpServletRequest.class);
    expect(mockRequest.getParameter(DO_AS)).andReturn(TEST_USER);
    replay(mockSpnegoLoginService);

    TrustedProxyLoginService trustedProxyLoginService = new TrustedProxyLoginService(mockSpnegoLoginService, mockFallbackLoginService,
            userAuthorizer, false);
    UserIdentity doAsIdentity = trustedProxyLoginService.login(null, ENCODED_TOKEN, mockRequest);
    assertNotNull(doAsIdentity);
    assertFalse(((SpnegoUserIdentity) doAsIdentity).isEstablished());
  }