ProxyTrustingFilter implements Filter { public void doFilter( final ServletRequest request, final ServletResponse response, final FilterChain chain ) throws IOException, ServletException { if ( ( trustedIpAddrs != null ) && ( request instanceof HttpServletRequest ) ) { final HttpServletRequest req = (HttpServletRequest) request; String remoteHost = req.getRemoteAddr(); if ( isTrusted( remoteHost ) ) { String name = getTrustUser( req ); if ( !isEmpty( name ) ) { try { becomeUser( name ); HttpSession httpSession = req.getSession(); httpSession.setAttribute( PentahoSystem.PENTAHO_SESSION_KEY, PentahoSessionHolder.getSession() ); SecurityContext authWrapper = new SecurityContext() { private static final long serialVersionUID = 1L; private Authentication authentication; public Authentication getAuthentication() { return authentication; }; public void setAuthentication( Authentication authentication ) { this.authentication = authentication; }; }; authWrapper.setAuthentication( SecurityContextHolder.getContext().getAuthentication() ); httpSession.setAttribute( HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, authWrapper ); } catch ( Exception e ) { throw new ServletException( e ); } } } } chain.doFilter( request, response ); }  Log getLogger(); void init( final FilterConfig filterConfiguration ); void doFilter( final ServletRequest request, final ServletResponse response, final FilterChain chain ); void destroy(); static void main( final String[] args ); boolean isEmpty( String str );  }
@Test public void doFilterForUntrusted() throws Exception { request.setRemoteHost( UNTRUSTED_IP ); filter.doFilter( request, new MockHttpServletResponse(), new MockFilterChain() ); verify( securityHelper, never() ).runAsUser( anyString(), any( Callable.class ) ); }