@Test
  public void testIsAuthTypeEnabled() throws Exception {

    assertTrue(
      // isAuthTypeEnabled should be true when Kerberos authentication is enabled
      // and Kerberos authentication is initiated with "Authorization: Negotiate ..." header
      createThriftHttpServletWithAuthTypes(
        ImmutableList.of(AuthTypes.LDAP, AuthTypes.KERBEROS, AuthTypes.SAML)
      ).isAuthTypeEnabled(
        createMockHttpServletRequest(ImmutableMap.of(HttpAuthUtils.AUTHORIZATION,
          Optional.of("Negotiate anyToken"))),
        AuthTypes.KERBEROS
      )
    );

    assertFalse(
      // isAuthTypeEnabled should be false when Kerberos authentication is disabled
      // and Kerberos authentication is initiated with "Authorization: Negotiate ..." header
      createThriftHttpServletWithAuthTypes(
        ImmutableList.of(AuthTypes.SAML, AuthTypes.LDAP)
      ).isAuthTypeEnabled(
        createMockHttpServletRequest(ImmutableMap.of(HttpAuthUtils.AUTHORIZATION,
          Optional.of("Negotiate anyToken"))),
        AuthTypes.KERBEROS
      )
    );

    assertTrue(
      // isAuthTypeEnabled should be true when Kerberos authentication is enabled
      // and delegation token received in X-Hive-Delegation-Token header
      createThriftHttpServletWithAuthTypes(
        ImmutableList.of(AuthTypes.LDAP, AuthTypes.KERBEROS, AuthTypes.SAML)
      ).isAuthTypeEnabled(
        createMockHttpServletRequest(ImmutableMap.of(HIVE_DELEGATION_TOKEN_HEADER,
          Optional.of("any Hive delegation token"))),
        AuthTypes.KERBEROS
      )
    );

    assertFalse(
      // isAuthTypeEnabled should be false when Kerberos authentication is disabled
      // and delegation token received in X-Hive-Delegation-Token header
      createThriftHttpServletWithAuthTypes(
        ImmutableList.of(AuthTypes.SAML, AuthTypes.LDAP)
      ).isAuthTypeEnabled(
        createMockHttpServletRequest(ImmutableMap.of(HIVE_DELEGATION_TOKEN_HEADER,
          Optional.of("any Hive delegation token"))),
        AuthTypes.KERBEROS
      )
    );

    assertTrue(
      // isAuthTypeEnabled should be true when JWT authentication is enabled
      // and JWT authentication is initiated with "Authorization: Bearer jwt...token" header
      createThriftHttpServletWithAuthTypes(
        ImmutableList.of(AuthTypes.KERBEROS, AuthTypes.JWT, AuthTypes.SAML, AuthTypes.LDAP)
      ).isAuthTypeEnabled(
        createMockHttpServletRequest(ImmutableMap.of(HttpAuthUtils.AUTHORIZATION,
          Optional.of("Bearer any.jwt.token"))),
        AuthTypes.JWT
      )
    );

    assertFalse(
      // isAuthTypeEnabled should be false when JWT authentication is disabled
      // and JWT authentication is initiated with "Authorization: Bearer jwt...token" header
      createThriftHttpServletWithAuthTypes(
        ImmutableList.of(AuthTypes.KERBEROS, AuthTypes.SAML, AuthTypes.LDAP)
      ).isAuthTypeEnabled(
        createMockHttpServletRequest(ImmutableMap.of(HttpAuthUtils.AUTHORIZATION,
          Optional.of("Bearer any.jwt.token"))),
        AuthTypes.JWT
      )
    );

    assertTrue(
      // isAuthTypeEnabled should be true when SAML authentication is enabled
      // and SAML authentication is initiated with "Authorization: Bearer saml.token" header
      createThriftHttpServletWithAuthTypes(
        ImmutableList.of(AuthTypes.KERBEROS, AuthTypes.SAML, AuthTypes.LDAP)
      ).isAuthTypeEnabled(
        createMockHttpServletRequest(ImmutableMap.of(HttpAuthUtils.AUTHORIZATION,
          Optional.of("Bearer anySamlToken"))),
        AuthTypes.SAML
      )
    );

    assertFalse(
      // isAuthTypeEnabled should be false when SAML authentication is disabled
      // and SAML authentication is initiated with "Authorization: Bearer saml.token" header
      createThriftHttpServletWithAuthTypes(
        ImmutableList.of(AuthTypes.KERBEROS, AuthTypes.LDAP)
      ).isAuthTypeEnabled(
        createMockHttpServletRequest(ImmutableMap.of(HttpAuthUtils.AUTHORIZATION,
          Optional.of("Bearer anySamlToken"))),
        AuthTypes.SAML
      )
    );

    assertTrue(
      // isAuthTypeEnabled should be true when SAML authentication is enabled,
      // no "Authorization" header received, but X-Hive-Token-Response-Port header
      // indicates SAML authentication
      createThriftHttpServletWithAuthTypes(
        ImmutableList.of(AuthTypes.KERBEROS, AuthTypes.SAML, AuthTypes.LDAP)
      ).isAuthTypeEnabled(
        createMockHttpServletRequest(ImmutableMap.of(HiveSamlUtils.SSO_TOKEN_RESPONSE_PORT,
          Optional.of("4321"))),
        AuthTypes.SAML
      )
    );

    assertFalse(
      // isAuthTypeEnabled should be false when SAML authentication is disabled,
      // no "Authorization" header received and X-Hive-Token-Response-Port header
      // is present
      createThriftHttpServletWithAuthTypes(
        ImmutableList.of(AuthTypes.KERBEROS, AuthTypes.LDAP)
      ).isAuthTypeEnabled(
        createMockHttpServletRequest(ImmutableMap.of(HiveSamlUtils.SSO_TOKEN_RESPONSE_PORT,
          Optional.of("4321"))),
        AuthTypes.SAML
      )
    );

    assertTrue(
      // isAuthTypeEnabled should be true when LDAP authentication is enabled
      // and LDAP authentication is initiated with "Authorization: Basic ..." header
      createThriftHttpServletWithAuthTypes(
        ImmutableList.of(AuthTypes.KERBEROS, AuthTypes.SAML, AuthTypes.LDAP)
      ).isAuthTypeEnabled(
        createMockHttpServletRequest(ImmutableMap.of(HttpAuthUtils.AUTHORIZATION,
          Optional.of("Basic base64EncodedCredentials"))),
        AuthTypes.LDAP
      )
    );

    assertFalse(
      // isAuthTypeEnabled should be false when LDAP authentication is disabled
      // and LDAP authentication is initiated with "Authorization: Basic ..." header
      createThriftHttpServletWithAuthTypes(
        ImmutableList.of(AuthTypes.KERBEROS, AuthTypes.SAML)
      ).isAuthTypeEnabled(
        createMockHttpServletRequest(ImmutableMap.of(HttpAuthUtils.AUTHORIZATION,
          Optional.of("Basic base64EncodedCredentials"))),
        AuthTypes.LDAP
      )
    );

    assertFalse(
      // isAuthTypeEnabled should be false when JWT authentication is enabled
      // but there is no JWT token in the Authorization header
      createThriftHttpServletWithAuthTypes(
        ImmutableList.of(AuthTypes.JWT, AuthTypes.SAML, AuthTypes.LDAP)
      ).isAuthTypeEnabled(
        createMockHttpServletRequest(),
        AuthTypes.JWT
      )
    );

    assertFalse(
      // isAuthTypeEnabled should be false when JWT authentication is enabled
      // but checking Kerberos authentication
      createThriftHttpServletWithAuthTypes(
        ImmutableList.of(AuthTypes.JWT, AuthTypes.SAML, AuthTypes.LDAP, AuthTypes.KERBEROS)
      ).isAuthTypeEnabled(
        createMockHttpServletRequest(),
        AuthTypes.KERBEROS
      )
    );

  }
Tests the logic that determines whether a given authentication mode
should be checked based on the Authorization header.
itests/hive-minikdc/src/test/java/org/apache/hive/minikdc/TestIsAuthTypeEnabled.java