Pārlūkot izejas kodu

[raz] Skip using RAZ DTs for FS operation authorisation RAZ check (#3302)

- With these changes, we are now directly talking to RAZ endpoint for FS operation authorisation checks either via Kerberos or JWT.
- This completely removes using RAZ delegation tokens from the flow now. Earlier we use to get RAZ DTs via Kerberos (and future JWT) and pass that DT to RAZ again along with FS operation authorisation call, but it's direct now and removing this hop.


- Fixed existing UTs and added new UTs
- Tested in a live cluster - Hue is working fine using Kerberos to call RAZ. All existing FS operations looks good.
- Tested fetching JWT from Knox also in the live cluster and Hue is successful in getting it and passing to RAZ.
- However, RAZ is not configured to validate the incoming JWT and then authorise the FS operations. So we cannot fully test the existing FS operations E2E yet for JWT scenario. This will be tested when RAZ changes are done from their side.
Harsh Gupta 2 gadi atpakaļ
vecāks
revīzija
5e3a74867c

+ 25 - 26
desktop/core/src/desktop/lib/raz/clients_test.py

@@ -71,29 +71,28 @@ class AdlsRazClientTest(unittest.TestCase):
     self.username = 'csso_hueuser'
   
   def test_check_rename_operation(self):
-    with patch('desktop.lib.raz.raz_client.RazToken.get_delegation_token') as raz_token:
-      with patch('desktop.lib.raz.raz_client.requests.post') as requests_post:
-        with patch('desktop.lib.raz.raz_client.uuid.uuid4') as uuid:
-          with patch('desktop.lib.raz.raz_client.RazClient.check_access') as check_access:
-
-            reset = RAZ.API_URL.set_for_testing('https://raz_url:8000')
-            check_access.return_value = {'token': 'some_random_sas_token'}
-
-            try:
-              sas_token = AdlsRazClient(
-                username=self.username
-              ).get_url(
-                action='PUT',
-                path='https://gethuestorage.dfs.core.windows.net/data/user/csso_hueuser/rename_destination_dir',
-                headers={'x-ms-version': '2019-12-12', 'x-ms-rename-source': '/data/user/csso_hueuser/rename_source_dir'})
-
-              check_access.assert_called_with(
-                headers={
-                  'x-ms-version': '2019-12-12', 
-                  'x-ms-rename-source': '/data/user/csso_hueuser/rename_source_dir?some_random_sas_token'
-                },
-                method='PUT',
-                url='https://gethuestorage.dfs.core.windows.net/data/user/csso_hueuser/rename_destination_dir'
-              )
-            finally:
-              reset()
+    with patch('desktop.lib.raz.raz_client.requests.post') as requests_post:
+      with patch('desktop.lib.raz.raz_client.uuid.uuid4') as uuid:
+        with patch('desktop.lib.raz.raz_client.RazClient.check_access') as check_access:
+
+          reset = RAZ.API_URL.set_for_testing('https://raz_url:8000')
+          check_access.return_value = {'token': 'some_random_sas_token'}
+
+          try:
+            sas_token = AdlsRazClient(
+              username=self.username
+            ).get_url(
+              action='PUT',
+              path='https://gethuestorage.dfs.core.windows.net/data/user/csso_hueuser/rename_destination_dir',
+              headers={'x-ms-version': '2019-12-12', 'x-ms-rename-source': '/data/user/csso_hueuser/rename_source_dir'})
+
+            check_access.assert_called_with(
+              headers={
+                'x-ms-version': '2019-12-12', 
+                'x-ms-rename-source': '/data/user/csso_hueuser/rename_source_dir?some_random_sas_token'
+              },
+              method='PUT',
+              url='https://gethuestorage.dfs.core.windows.net/data/user/csso_hueuser/rename_destination_dir'
+            )
+          finally:
+            reset()

+ 22 - 60
desktop/core/src/desktop/lib/raz/raz_client.py

@@ -19,15 +19,12 @@
 import base64
 import json
 import logging
-import socket
 import sys
 import uuid
 
 import requests
 import requests_kerberos
 
-from datetime import datetime, timedelta
-
 from desktop.conf import AUTH_USERNAME
 from desktop.lib.exceptions_renderable import PopupException
 from desktop.lib.sdxaas.knox_jwt import fetch_jwt
@@ -44,60 +41,11 @@ else:
 LOG = logging.getLogger(__name__)
 
 
-class RazToken:
-
-  def __init__(self, raz_url, auth_type):
-    self.raz_url = raz_url
-    self.auth_handler = requests_kerberos.HTTPKerberosAuth(mutual_authentication=requests_kerberos.OPTIONAL)
-    self.init_time = datetime.now()
-    self.raz_token = None
-    self.auth_type = auth_type
-
-    o = lib_urlparse(self.raz_url)
-    if not o.netloc:
-      raise PopupException('Could not parse the host of the Raz server %s' % self.raz_url)
-    self.raz_hostname, self.raz_port = o.netloc.split(':')
-    self.scheme = o.scheme
-
-
-  def get_delegation_token(self, user):
-    ip_address = socket.gethostbyname(self.raz_hostname)
-    GET_PARAMS = {
-      "op": "GETDELEGATIONTOKEN",
-      "service": "%s:%s" % (ip_address, self.raz_port),
-      "renewer": AUTH_USERNAME.get(),
-      "doAs": user
-    }
-
-    if self.auth_type == 'kerberos':
-      r = requests.get(self.raz_url, GET_PARAMS, auth=self.auth_handler, verify=False)
-    elif self.auth_type == 'jwt':
-      jwt_token = fetch_jwt()
-      if jwt_token is None:
-        raise PopupException('Knox JWT is not available to send to RAZ.')
-
-      _headers = {'Authorization': 'Bearer %s' % (jwt_token)}
-      r = requests.get(self.raz_url, GET_PARAMS, headers=_headers, verify=False)
-
-    self.raz_token = json.loads(r.text)['Token']['urlString']
-    LOG.debug('Raz token: %s' % self.raz_token)
-
-    return self.raz_token
-
-
-  def renew_delegation_token(self, user):
-    if self.raz_token is None:
-      self.raz_token = self.get_delegation_token(user=user)
-    if (self.init_time - timedelta(hours=8)) > datetime.now():
-      r = requests.put("%s?op=RENEWDELEGATIONTOKEN&token=%s"%(self.raz_url, self.raz_token), auth=self.auth_handler, verify=False)
-    return self.raz_token
-
-
 class RazClient(object):
 
-  def __init__(self, raz_url, raz_token, username, service='s3', service_name='cm_s3', cluster_name='myCluster'):
+  def __init__(self, raz_url, auth_type, username, service='s3', service_name='cm_s3', cluster_name='myCluster'):
     self.raz_url = raz_url.strip('/')
-    self.raz_token = raz_token
+    self.auth_type = auth_type
     self.username = username
     self.service = service
 
@@ -145,7 +93,7 @@ class RazClient(object):
       "context": {}
     }
     request_headers = {"Content-Type": "application/json"}
-    raz_url = "%s/api/authz/%s/access?delegation=%s" % (self.raz_url, self.service, self.raz_token)
+    raz_url = "%s/api/authz/%s/access?doAs=%s" % (self.raz_url, self.service, self.username)
 
     if self.service == 'adls':
       self._make_adls_request(request_data, method, path, url_params, resource_path)
@@ -154,7 +102,8 @@ class RazClient(object):
 
     LOG.debug('Raz url: %s' % raz_url)
     LOG.debug("Sending access check headers: {%s} request_data: {%s}" % (request_headers, request_data))
-    raz_req = requests.post(raz_url, headers=request_headers, json=request_data, verify=False)
+
+    raz_req = self._handle_raz_req(raz_url, request_headers, request_data)
 
     signed_response_result = None
     signed_response = None
@@ -191,6 +140,22 @@ class RazClient(object):
             return dict([(i.key, i.value) for i in signed_response.signer_generated_headers])
 
 
+  def _handle_raz_req(self, raz_url, request_headers, request_data):
+    if self.auth_type == 'kerberos':
+      auth_handler = requests_kerberos.HTTPKerberosAuth(mutual_authentication=requests_kerberos.OPTIONAL)
+      raz_req = requests.post(raz_url, headers=request_headers, json=request_data, auth=auth_handler, verify=False)
+    elif self.auth_type == 'jwt':
+      jwt_token = fetch_jwt()
+
+      if jwt_token is None:
+        raise PopupException('Knox JWT is not available to send to RAZ.')
+
+      request_headers['Authorization'] = 'Bearer %s' % (jwt_token)
+      raz_req = requests.post(raz_url, headers=request_headers, json=request_data, verify=False)
+
+    return raz_req
+
+
   def _make_adls_request(self, request_data, method, path, url_params, resource_path):
     resource_path = resource_path.split('/', 1)
 
@@ -314,7 +279,4 @@ def get_raz_client(raz_url, username, auth='kerberos', service='s3', service_nam
   if not username:
     raise PopupException('No username set.')
 
-  raz = RazToken(raz_url, auth)
-  raz_token = raz.get_delegation_token(user=username)
-
-  return RazClient(raz_url, raz_token, username, service=service, service_name=service_name, cluster_name=cluster_name)
+  return RazClient(raz_url, auth, username, service=service, service_name=service_name, cluster_name=cluster_name)

+ 167 - 206
desktop/core/src/desktop/lib/raz/raz_client_test.py

@@ -18,11 +18,9 @@ import base64
 import sys
 import unittest
 
-from datetime import timedelta
 from nose.tools import assert_equal, assert_true, assert_raises
 
-from desktop.conf import RAZ
-from desktop.lib.raz.raz_client import RazToken, RazClient, get_raz_client
+from desktop.lib.raz.raz_client import RazClient, get_raz_client
 from desktop.lib.exceptions_renderable import PopupException
 
 if sys.version_info[0] > 2:
@@ -31,160 +29,122 @@ else:
   from mock import patch, Mock
 
 
-class RazTokenTest(unittest.TestCase):
+class RazClientTest(unittest.TestCase):
 
   def setUp(self):
     self.username = 'gethue'
+    self.raz_url = 'https://raz.gethue.com:8080'
 
-  def test_create(self):
-    with patch('desktop.lib.raz.raz_client.requests_kerberos.HTTPKerberosAuth') as HTTPKerberosAuth:
-      token = RazToken(raz_url='https://raz.gethue.com:8080', auth_type='kerberos')
-
-      assert_equal('raz.gethue.com', token.raz_hostname)
-      assert_equal('8080', token.raz_port)
-      assert_equal('https', token.scheme)
-      assert_equal('kerberos', token.auth_type)
-
-
-  def test_get_delegation_token(self):
-    with patch('desktop.lib.raz.raz_client.requests_kerberos.HTTPKerberosAuth') as HTTPKerberosAuth:
-      with patch('desktop.lib.raz.raz_client.requests.get') as requests_get:
-        with patch('desktop.lib.raz.raz_client.socket.gethostbyname') as gethostbyname:
-          with patch('desktop.lib.raz.raz_client.fetch_jwt') as fetch_jwt:
-            
-            gethostbyname.return_value = '128.0.0.1'
-            requests_get.return_value = Mock(
-              text='{"Token":{"urlString":"f3VLQVkuBCfGSyOLzI9PoxqHTjANUzMgZGVsZWdhdGlvbhExMC44MC4xNjQuMzc6NjA4Mg"}}'
-            )
-
-            # When auth type is Kerberos
-            token = RazToken(raz_url='https://raz.gethue.com:8080', auth_type='kerberos')
-            t = token.get_delegation_token(user=self.username)
-
-            fetch_jwt.assert_not_called()
-            assert_equal('f3VLQVkuBCfGSyOLzI9PoxqHTjANUzMgZGVsZWdhdGlvbhExMC44MC4xNjQuMzc6NjA4Mg', t)
-
-            # When auth type is JWT
-            fetch_jwt.return_value = 'test_jwt_token'
-
-            token = RazToken(raz_url='https://raz.gethue.com:8080', auth_type='jwt')
-            t = token.get_delegation_token(user=self.username)
-
-            fetch_jwt.assert_called()
-            assert_equal('f3VLQVkuBCfGSyOLzI9PoxqHTjANUzMgZGVsZWdhdGlvbhExMC44MC4xNjQuMzc6NjA4Mg', t)
-
-            fetch_jwt.return_value = None # Should raise PopupException
+    self.s3_path = 'https://gethue-test.s3.amazonaws.com/gethue/data/customer.csv'
+    self.adls_path = 'https://gethuestorage.dfs.core.windows.net/gethue-container/user/csso_hueuser/customer.csv'
 
-            token = RazToken(raz_url='https://raz.gethue.com:8080', auth_type='jwt')
-            assert_raises(PopupException, token.get_delegation_token, user=self.username)
 
+  def test_get_raz_client_adls(self):
+    client = get_raz_client(
+      raz_url=self.raz_url,
+      username=self.username,
+      auth='kerberos',
+      service='adls',
+      service_name='gethue_adls',
+      cluster_name='gethueCluster'
+    )
 
-  def test_renew_delegation_token(self):
-    with patch('desktop.lib.raz.raz_client.requests.get') as requests_get:
-      with patch('desktop.lib.raz.raz_client.socket.gethostbyname') as gethostbyname:
-        requests_get.return_value = Mock(
-          text='{"Token":{"urlString":"f3VLQVkuBCfGSyOLzI9PoxqHTjANUzMgZGVsZWdhdGlvbhExMC44MC4xNjQuMzc6NjA4Mg"}}'
-        )
-        gethostbyname.return_value = '128.0.0.1'
-        token = RazToken(raz_url='https://raz.gethue.com:8080', auth_type='kerberos')
+    assert_true(isinstance(client, RazClient))
 
-        t = token.renew_delegation_token(user=self.username)
+    assert_equal(client.raz_url, self.raz_url)
+    assert_equal(client.service_name, 'gethue_adls')
+    assert_equal(client.cluster_name, 'gethueCluster')
 
-        assert_equal(t, 'f3VLQVkuBCfGSyOLzI9PoxqHTjANUzMgZGVsZWdhdGlvbhExMC44MC4xNjQuMzc6NjA4Mg')
 
-        with patch('desktop.lib.raz.raz_client.requests.put') as requests_put:
-          token.init_time += timedelta(hours=9)
+  def test_check_access_adls(self):
+    with patch('desktop.lib.sdxaas.knox_jwt.requests_kerberos.HTTPKerberosAuth') as HTTPKerberosAuth:
+      with patch('desktop.lib.raz.raz_client.requests.post') as requests_post:
+        with patch('desktop.lib.raz.raz_client.uuid.uuid4') as uuid:
+
+          requests_post.return_value = Mock(
+            json=Mock(return_value=
+            {
+              'operResult': {
+                'result': 'ALLOWED',
+                'additionalInfo': {
+                  "ADLS_DSAS": "nulltenantIdnullnullbnullALLOWEDnullnull1.05nSlN7t/QiPJ1OFlCruTEPLibFbAhEYYj5wbJuaeQqs="
+                  }
+                }
+              }
+            )
+          )
+          uuid.return_value = 'mock_request_id'
 
-          t = token.renew_delegation_token(user=self.username)
+          client = RazClient(
+            self.raz_url, 'kerberos', username=self.username, service="adls", service_name="cm_adls", cluster_name="cl1"
+          )
 
-          requests_put.assert_called()
+          # Read file operation
+          resp = client.check_access(method='GET', url=self.adls_path)
+
+          requests_post.assert_called_with(
+            "https://raz.gethue.com:8080/api/authz/adls/access?doAs=gethue",
+            auth=HTTPKerberosAuth(),
+            headers={"Content-Type": "application/json"},
+            json={
+              'requestId': 'mock_request_id',
+              'serviceType': 'adls',
+              'serviceName': 'cm_adls',
+              'user': 'gethue',
+              'userGroups': [],
+              'clientIpAddress': '',
+              'clientType': 'adls',
+              'clusterName': 'cl1',
+              'clusterType': '',
+              'sessionId': '',
+              'accessTime': '',
+              'context': {},
+              'operation': {
+                'resource': {
+                  'storageaccount': 'gethuestorage',
+                  'container': 'gethue-container',
+                  'relativepath': '/user/csso_hueuser/customer.csv'
+                },
+                'action': 'read',
+                'accessTypes': ['read']
+              }
+            },
+            verify=False
+          )
+          assert_equal(resp['token'], "nulltenantIdnullnullbnullALLOWEDnullnull1.05nSlN7t/QiPJ1OFlCruTEPLibFbAhEYYj5wbJuaeQqs=")
 
 
-class RazClientTest(unittest.TestCase):
+  def test_handle_raz_req(self):
+    with patch('desktop.lib.sdxaas.knox_jwt.requests_kerberos.HTTPKerberosAuth') as HTTPKerberosAuth:
+      with patch('desktop.lib.raz.raz_client.requests.post') as requests_post:
+        with patch('desktop.lib.raz.raz_client.fetch_jwt') as fetch_jwt:
 
-  def setUp(self):
-    self.username = 'gethue'
-    self.raz_url = 'https://raz.gethue.com:8080'
-    self.raz_token = "mock_RAZ_token"
+          request_headers = {}
+          request_data = Mock()
 
-    self.s3_path = 'https://gethue-test.s3.amazonaws.com/gethue/data/customer.csv'
-    self.adls_path = 'https://gethuestorage.dfs.core.windows.net/gethue-container/user/csso_hueuser/customer.csv'
+          # When auth type is Kerberos
+          client = RazClient(self.raz_url, 'kerberos', username=self.username, service="adls", service_name="cm_adls", cluster_name="cl1")
+          raz_req = client._handle_raz_req(self.raz_url, request_headers, request_data)
 
+          fetch_jwt.assert_not_called()
 
-  def test_get_raz_client_adls(self):
-    with patch('desktop.lib.raz.raz_client.RazToken') as RazToken:
-      client = get_raz_client(
-        raz_url=self.raz_url,
-        username=self.username,
-        auth='kerberos',
-        service='adls',
-        service_name='gethue_adls',
-        cluster_name='gethueCluster'
-      )
+          # When auth type is JWT
+          fetch_jwt.return_value = 'test_jwt_token'
 
-      assert_true(isinstance(client, RazClient))
+          client = RazClient(self.raz_url, 'jwt', username=self.username, service="adls", service_name="cm_adls", cluster_name="cl1")
+          raz_req = client._handle_raz_req(self.raz_url, request_headers, request_data)
 
-      assert_equal(client.raz_url, self.raz_url)
-      assert_equal(client.service_name, 'gethue_adls')
-      assert_equal(client.cluster_name, 'gethueCluster')
+          fetch_jwt.assert_called()
 
+          # Should raise PopupException when JWT is None
+          fetch_jwt.return_value = None 
 
-  def test_check_access_adls(self):
-    with patch('desktop.lib.raz.raz_client.requests.post') as requests_post:
-      with patch('desktop.lib.raz.raz_client.uuid.uuid4') as uuid:
-
-        requests_post.return_value = Mock(
-          json=Mock(return_value=
-          {
-            'operResult': {
-              'result': 'ALLOWED',
-              'additionalInfo': {
-                "ADLS_DSAS": "nulltenantIdnullnullbnullALLOWEDnullnull1.05nSlN7t/QiPJ1OFlCruTEPLibFbAhEYYj5wbJuaeQqs="
-                }
-              }
-            }
-          )
-        )
-        uuid.return_value = 'mock_request_id'
-
-        client = RazClient(self.raz_url, self.raz_token, username=self.username, service="adls", service_name="cm_adls", cluster_name="cl1")
-
-        # Read file operation
-        resp = client.check_access(method='GET', url=self.adls_path)
-
-        requests_post.assert_called_with(
-          "https://raz.gethue.com:8080/api/authz/adls/access?delegation=mock_RAZ_token",
-          headers={"Content-Type": "application/json"},
-          json={
-            'requestId': 'mock_request_id', 
-            'serviceType': 'adls', 
-            'serviceName': 'cm_adls', 
-            'user': 'gethue', 
-            'userGroups': [], 
-            'clientIpAddress': '', 
-            'clientType': 'adls', 
-            'clusterName': 'cl1', 
-            'clusterType': '', 
-            'sessionId': '', 
-            'accessTime': '', 
-            'context': {}, 
-            'operation': {
-              'resource': {
-                'storageaccount': 'gethuestorage', 
-                'container': 'gethue-container', 
-                'relativepath': '/user/csso_hueuser/customer.csv'
-              },
-              'action': 'read', 
-              'accessTypes': ['read']
-            }
-          },
-          verify=False
-        )
-        assert_equal(resp['token'], "nulltenantIdnullnullbnullALLOWEDnullnull1.05nSlN7t/QiPJ1OFlCruTEPLibFbAhEYYj5wbJuaeQqs=")
+          # token = RazToken(raz_url='https://raz.gethue.com:8080', auth_type='jwt')
+          assert_raises(PopupException, client._handle_raz_req, self.raz_url, request_headers, request_data)
 
 
   def test_handle_adls_action_types_mapping(self):
-    client = RazClient(self.raz_url, self.raz_token, username=self.username, service="adls", service_name="cm_adls", cluster_name="cl1")
+    client = RazClient(self.raz_url, 'kerberos', username=self.username, service="adls", service_name="cm_adls", cluster_name="cl1")
 
     # List directory
     method = 'GET'
@@ -274,7 +234,7 @@ class RazClientTest(unittest.TestCase):
 
 
   def test_handle_relative_path(self):
-    client = RazClient(self.raz_url, self.raz_token, username=self.username, service="adls", service_name="cm_adls", cluster_name="cl1")
+    client = RazClient(self.raz_url, 'kerberos', username=self.username, service="adls", service_name="cm_adls", cluster_name="cl1")
 
     # No relative path condition
     method = 'GET'
@@ -310,86 +270,87 @@ class RazClientTest(unittest.TestCase):
 
 
   def test_get_raz_client_s3(self):
-    with patch('desktop.lib.raz.raz_client.RazToken') as RazToken:
-      client = get_raz_client(
-        raz_url=self.raz_url,
-        username=self.username,
-        auth='kerberos',
-        service='s3',
-        service_name='gethue_s3',
-        cluster_name='gethueCluster'
-      )
+    client = get_raz_client(
+      raz_url=self.raz_url,
+      username=self.username,
+      auth='kerberos',
+      service='s3',
+      service_name='gethue_s3',
+      cluster_name='gethueCluster'
+    )
 
-      assert_true(isinstance(client, RazClient))
+    assert_true(isinstance(client, RazClient))
 
-      assert_equal(client.raz_url, self.raz_url)
-      assert_equal(client.service_name, 'gethue_s3')
-      assert_equal(client.cluster_name, 'gethueCluster')
+    assert_equal(client.raz_url, self.raz_url)
+    assert_equal(client.service_name, 'gethue_s3')
+    assert_equal(client.cluster_name, 'gethueCluster')
 
 
   def test_check_access_s3(self):
-    with patch('desktop.lib.raz.raz_client.requests.post') as requests_post:
-      with patch('desktop.lib.raz.raz_client.raz_signer.SignResponseProto') as SignResponseProto:
-        with patch('desktop.lib.raz.raz_client.base64.b64decode') as b64decode:
-          with patch('desktop.lib.raz.raz_client.uuid.uuid4') as uuid:
-
-            requests_post.return_value = Mock(
-              json=Mock(return_value=
-                {
-                  'operResult': {
-                    'result': 'ALLOWED',
-                    'additionalInfo': {
-                        'S3_SIGN_RESPONSE': 'My signed URL'
+    with patch('desktop.lib.sdxaas.knox_jwt.requests_kerberos.HTTPKerberosAuth') as HTTPKerberosAuth:
+      with patch('desktop.lib.raz.raz_client.requests.post') as requests_post:
+        with patch('desktop.lib.raz.raz_client.raz_signer.SignResponseProto') as SignResponseProto:
+          with patch('desktop.lib.raz.raz_client.base64.b64decode') as b64decode:
+            with patch('desktop.lib.raz.raz_client.uuid.uuid4') as uuid:
+
+              requests_post.return_value = Mock(
+                json=Mock(return_value=
+                  {
+                    'operResult': {
+                      'result': 'ALLOWED',
+                      'additionalInfo': {
+                          'S3_SIGN_RESPONSE': 'My signed URL'
+                      }
                     }
                   }
-                }
+                )
               )
-            )
-            b64decode.return_value = 'https://gethue-test.s3.amazonaws.com/gethue/data/customer.csv?AWSAccessKeyId=AKIA23E77ZX2HVY76YGL&' \
-                'Signature=3lhK%2BwtQ9Q2u5VDIqb4MEpoY3X4%3D&Expires=1617207304'
-
-            SignResponseProto.return_value = Mock(
-              FromString=Mock(
-                return_value=Mock(
-                  signer_generated_headers=[
-                    Mock(key='AWSAccessKeyId', value='AKIA23E77ZX2HVY76YGL')
-                  ]
+              b64decode.return_value = 'https://gethue-test.s3.amazonaws.com/gethue/data/customer.csv' \
+                  '?AWSAccessKeyId=AKIA23E77ZX2HVY76YGL&Signature=3lhK%2BwtQ9Q2u5VDIqb4MEpoY3X4%3D&Expires=1617207304'
+
+              SignResponseProto.return_value = Mock(
+                FromString=Mock(
+                  return_value=Mock(
+                    signer_generated_headers=[
+                      Mock(key='AWSAccessKeyId', value='AKIA23E77ZX2HVY76YGL')
+                    ]
+                  )
                 )
               )
-            )
-            uuid.return_value = 'mock_request_id'
-
-            client = RazClient(self.raz_url, self.raz_token, username=self.username)
-
-            resp = client.check_access(method='GET', url=self.s3_path)
-
-            if sys.version_info[0] > 2:
-              signed_request = 'CiRodHRwczovL2dldGh1ZS10ZXN0LnMzLmFtYXpvbmF3cy5jb20Q' \
-                'ATIYZ2V0aHVlL2RhdGEvY3VzdG9tZXIuY3N2OABCAnMzSgJzMw=='
-            else:
-              signed_request = b'CiRodHRwczovL2dldGh1ZS10ZXN0LnMzLmFtYXpvbmF3cy5jb20Q' \
-                b'ATIYZ2V0aHVlL2RhdGEvY3VzdG9tZXIuY3N2OABCAnMzSgJzMw=='
-
-            requests_post.assert_called_with(
-              'https://raz.gethue.com:8080/api/authz/s3/access?delegation=mock_RAZ_token', 
-              headers={'Content-Type': 'application/json', 'Accept-Encoding': 'gzip,deflate'}, 
-              json={
-                'requestId': 'mock_request_id',
-                'serviceType': 's3',
-                'serviceName': 'cm_s3',
-                'user': 'gethue',
-                'userGroups': [],
-                'clientIpAddress': '',
-                'clientType': '',
-                'clusterName': 'myCluster',
-                'clusterType': '',
-                'sessionId': '',
-                'accessTime': '',
-                'context': {
-                  'S3_SIGN_REQUEST': signed_request
-                }
-              },
-              verify=False
-            )
-            assert_true(resp)
-            assert_equal(resp['AWSAccessKeyId'], 'AKIA23E77ZX2HVY76YGL')
+              uuid.return_value = 'mock_request_id'
+
+              client = RazClient(self.raz_url, 'kerberos', username=self.username)
+
+              resp = client.check_access(method='GET', url=self.s3_path)
+
+              if sys.version_info[0] > 2:
+                signed_request = 'CiRodHRwczovL2dldGh1ZS10ZXN0LnMzLmFtYXpvbmF3cy5jb20Q' \
+                  'ATIYZ2V0aHVlL2RhdGEvY3VzdG9tZXIuY3N2OABCAnMzSgJzMw=='
+              else:
+                signed_request = b'CiRodHRwczovL2dldGh1ZS10ZXN0LnMzLmFtYXpvbmF3cy5jb20Q' \
+                  b'ATIYZ2V0aHVlL2RhdGEvY3VzdG9tZXIuY3N2OABCAnMzSgJzMw=='
+
+              requests_post.assert_called_with(
+                'https://raz.gethue.com:8080/api/authz/s3/access?doAs=gethue',
+                auth=HTTPKerberosAuth(),
+                headers={'Content-Type': 'application/json', 'Accept-Encoding': 'gzip,deflate'}, 
+                json={
+                  'requestId': 'mock_request_id',
+                  'serviceType': 's3',
+                  'serviceName': 'cm_s3',
+                  'user': 'gethue',
+                  'userGroups': [],
+                  'clientIpAddress': '',
+                  'clientType': '',
+                  'clusterName': 'myCluster',
+                  'clusterType': '',
+                  'sessionId': '',
+                  'accessTime': '',
+                  'context': {
+                    'S3_SIGN_REQUEST': signed_request
+                  }
+                },
+                verify=False
+              )
+              assert_true(resp)
+              assert_equal(resp['AWSAccessKeyId'], 'AKIA23E77ZX2HVY76YGL')