@Test
  public void dataWriterCanStillOnlyWriteAfterFailover() throws Exception {
    // Connect to the server that will fail
    ClientVM client = createAndInitializeClientAndCache("dataWrite");

    // Client should be able to write but not read.
    client.invoke(() -> {
      Region<String, String> region = ClusterStartupRule.getClientCache().getRegion(regionName);
      // Puts do not throw
      // Assert that the client can put
      region.put(client_k1, client_v1);
      region.put(client_k2, client_v2, null);
      region.putIfAbsent(client_k3, client_v3);
      region.putAll(clientData45);
      region.putAll(clientData67, null);
      // Assert that the client cannot get
      assertThatThrownBy(() -> region.get(server_k1))
          .hasCauseInstanceOf(NotAuthorizedException.class);
      assertThatThrownBy(() -> region.get(server_k2, null))
          .hasCauseInstanceOf(NotAuthorizedException.class);
      // An unauthorized getAll does not throw; it just does not return the requested values.
      // See GEODE-3632.
      assertThat(region.getAll(serverData.keySet())).isEmpty();
      assertThat(region.getAll(serverData.keySet(), null)).isEmpty();
    });

    // Initialize client cache and region. Get the port of the primary connected server.
    MemberVM server_to_fail = determinePrimaryServer(client);

    // Bring down primary server
    server_to_fail.stop(true);

    // Confirm failover
    MemberVM secondaryServer = (server1.getPort() == server_to_fail.getPort()) ? server2 : server1;
    await().until(() -> getPrimaryServerPort(client) == secondaryServer.getPort());

    // Confirm permissions: client should still only be able to write and not read.
    client.invoke(() -> {
      Region<String, String> region = ClusterStartupRule.getClientCache().getRegion(regionName);
      // Puts do not throw
      // Assert that the client can put
      region.put(client_k1, client_v1);
      region.put(client_k2, client_v2, null);
      region.putIfAbsent(client_k3, client_v3);
      region.putAll(clientData45);
      region.putAll(clientData67, null);
      // Assert that the client cannot get
      assertThatThrownBy(() -> region.get(server_k1))
          .hasCauseInstanceOf(NotAuthorizedException.class);
      assertThatThrownBy(() -> region.get(server_k2, null))
          .hasCauseInstanceOf(NotAuthorizedException.class);
      // An unauthorized getAll does not throw; it just does not return the requested values.
      // See GEODE-3632.
      assertThat(region.getAll(serverData.keySet())).isEmpty();
      assertThat(region.getAll(serverData.keySet(), null)).isEmpty();
    });
  }
This test class reproduces the tests present in
{@link ClientDataAuthorizationUsingLegacySecurityDUnitTest} and confirms that permissions are
maintained over failover.
geode-core/src/upgradeTest/java/org/apache/geode/security/ClientDataAuthorizationUsingLegacySecurityWithFailoverDUnitTest.java