private void setupIDP(boolean useSignedAssertions, String authMode, List<String> groups,
      String tokenExpirySecs) throws Exception {
    Map<String, String> configOverlay = new HashMap<>();
    configOverlay.put(ConfVars.HIVE_SERVER2_SAML_CALLBACK_URL.varname,
        "http://localhost:" + miniHS2.getHttpPort()
            + "/sso/saml?client_name=HiveSaml2Client");
    if (groups != null) {
      configOverlay.put(ConfVars.HIVE_SERVER2_SAML_GROUP_ATTRIBUTE_NAME.varname,
          IDP_GROUP_ATTRIBUTE_NAME);
      configOverlay.put(ConfVars.HIVE_SERVER2_SAML_GROUP_FILTER.varname,
          Joiner.on(',').join(groups));
    } else {
      // reset the configs since the previous test may have set them.
      configOverlay.put(ConfVars.HIVE_SERVER2_SAML_GROUP_ATTRIBUTE_NAME.varname, "");
      configOverlay.put(ConfVars.HIVE_SERVER2_SAML_GROUP_FILTER.varname, "");
    }
    if (tokenExpirySecs != null) {
      configOverlay.put(ConfVars.HIVE_SERVER2_SAML_CALLBACK_TOKEN_TTL.varname,
          tokenExpirySecs);
    } else {
      configOverlay.put(ConfVars.HIVE_SERVER2_SAML_CALLBACK_TOKEN_TTL.varname,
          ConfVars.HIVE_SERVER2_SAML_CALLBACK_TOKEN_TTL.defaultStrVal);
    }
    miniHS2.start(configOverlay);
    Map<String, String> idpEnv = getIdpEnv(useSignedAssertions, authMode);
    idpContainer = new GenericContainer<>(
        DockerImageName.parse("vihangk1/docker-test-saml-idp"))
        .withExposedPorts(8080, 8443)
        .withEnv(idpEnv);
    idpContainer.start();
    Integer ssoPort = idpContainer.getMappedPort(8080);
    writeIdpMetadataFile(ssoPort, idpMetadataFile);
  }
End to end tests for the SAML based SSO authentication. The test instantiates a SAML
2.0 compliant IDP provider (SimpleSAMLPHP) in a docker container. The container is
configured such that it's IDP service is run on a random port which is available. See
{@link #setupIDP(boolean, String)} for details.
<p>
The HS2 is configured with the IDP's metadata file which is derived from a template.
The metadata file contains the IDP's public certificate. The template should be
post-processed to replace the port number where the service is running.
<p>
The test uses TestContainers library for managing the life-cycle of the IDP container.
It uses HTMLUnit to simulate the browser interaction (provide user/password) of the
end user.
itests/hive-unit/src/test/java/org/apache/hive/service/auth/saml/TestHttpSamlAuthentication.java