public void doKerberosAuth(ServletRequest request, ServletResponse response, FilterChain filterChainWrapper, FilterChain filterChain)
            throws IOException, ServletException {
        boolean unauthorizedResponse = true;
        int errCode = HttpServletResponse.SC_UNAUTHORIZED;
        AuthenticationException authenticationEx = null;
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        boolean isHttps = "https".equals(httpRequest.getScheme());
        AuthenticationHandler authHandler = getAuthenticationHandler();
        try {
            boolean newToken = false;
            AuthenticationToken token;
            try {
                token = getToken(httpRequest);
            } catch (AuthenticationException ex) {
                LOG.warn("AuthenticationToken ignored: {}", ex.getMessage());
                // will be sent back in a 401 unless filter authenticates
                authenticationEx = ex;
                token = null;
            }
            if (authHandler.managementOperation(token, httpRequest, httpResponse)) {
                if (token == null) {
                    if (LOG.isDebugEnabled()) {
                        LOG.debug("Request [{}] triggering authentication", getRequestURL(httpRequest));
                    }
                    token = authHandler.authenticate(httpRequest, httpResponse);
                    if (token != null && token.getExpires() != 0 &&
                            token != AuthenticationToken.ANONYMOUS) {
                        token.setExpires(System.currentTimeMillis() + getValidity() * 1000);
                    }
                    newToken = true;
                }
                if (token != null) {
                    unauthorizedResponse = false;
                    if (LOG.isDebugEnabled()) {
                        LOG.debug("Request [{}] user [{}] authenticated", getRequestURL(httpRequest), token.getUserName());
                    }
                    final AuthenticationToken authToken = token;
                    httpRequest = new HttpServletRequestWrapper(httpRequest) {

                        @Override
                        public String getAuthType() {
                            return authToken.getType();
                        }

                        @Override
                        public String getRemoteUser() {
                            return authToken.getUserName();
                        }

                        @Override
                        public Principal getUserPrincipal() {
                            return (authToken != AuthenticationToken.ANONYMOUS) ? authToken : null;
                        }
                    };
                    if (newToken && !token.isExpired() && token != AuthenticationToken.ANONYMOUS) {
                        String signedToken = signer.sign(token.toString());
                        createAuthCookie(httpResponse, signedToken, getCookieDomain(),
                                getCookiePath(), token.getExpires(), isHttps);
                    }

                    filterChainWrapper.doFilter(httpRequest, httpResponse);
                }
            } else {
                unauthorizedResponse = false;
            }
        } catch (AuthenticationException ex) {
            // exception from the filter itself is fatal
            errCode = HttpServletResponse.SC_FORBIDDEN;
            authenticationEx = ex;
            LOG.warn("Authentication exception: {}", ex.getMessage(), ex);
        }
        if (unauthorizedResponse) {
            if (!httpResponse.isCommitted()) {
                createAuthCookie(httpResponse, "", getCookieDomain(),
                        getCookiePath(), 0, isHttps);
                // If response code is 401. Then WWW-Authenticate Header should be
                // present.. reset to 403 if not found..
                if ((errCode == HttpServletResponse.SC_UNAUTHORIZED)
                        && (!httpResponse.containsHeader(
                        KerberosAuthenticator.WWW_AUTHENTICATE))) {
                    errCode = HttpServletResponse.SC_FORBIDDEN;
                }
                if (authenticationEx == null) { // added this code for atlas error handling and fallback
                    if (!supportKeyTabBrowserLogin && isBrowser(httpRequest.getHeader("User-Agent"))) {
                        filterChain.doFilter(request, response);
                    } else {
                        boolean chk = true;
                        Collection<String> headerNames = httpResponse.getHeaderNames();
                        for (String headerName : headerNames) {
                            String value = httpResponse.getHeader(headerName);
                            if (headerName.equalsIgnoreCase("Set-Cookie") && value.startsWith("ATLASSESSIONID")) {
                                chk = false;
                                break;
                            }
                        }
                        String authHeader = httpRequest.getHeader("Authorization");
                        if (authHeader == null && chk) {
                            filterChain.doFilter(request, response);
                        } else if (authHeader != null && authHeader.startsWith("Basic")) {
                            filterChain.doFilter(request, response);
                        }
                    }
                } else {
                    httpResponse.sendError(errCode, authenticationEx.getMessage());
                }
            }
        }
    }
public void doKerberosAuth ( ServletRequest request , ServletResponse response , FilterChain filterChainWrapper , FilterChain filterChain ) throws IOException , ServletException { boolean unauthorizedResponse = true ; int errCode = HttpServletResponse . SC_UNAUTHORIZED ; AuthenticationException authenticationEx = null ; HttpServletRequest httpRequest = ( HttpServletRequest ) request ; HttpServletResponse httpResponse = ( HttpServletResponse ) response ; boolean isHttps = "https" . equals ( httpRequest . getScheme ( ) ) ; AuthenticationHandler authHandler = getAuthenticationHandler ( ) ; try { boolean newToken = false ; AuthenticationToken token ; try { token = getToken ( httpRequest ) ; } catch ( AuthenticationException ex ) { LOG . warn ( "AuthenticationToken ignored: {}" , ex . getMessage ( ) ) ; authenticationEx = ex ; token = null ; } if ( authHandler . managementOperation ( token , httpRequest , httpResponse ) ) { if ( token == null ) { if ( LOG . isDebugEnabled ( ) ) { LOG . debug ( "Request [{}] triggering authentication" , getRequestURL ( httpRequest ) ) ; } token = authHandler . authenticate ( httpRequest , httpResponse ) ; if ( token != null && token . getExpires ( ) != 0 && token != AuthenticationToken . ANONYMOUS ) { token . setExpires ( System . currentTimeMillis ( ) + getValidity ( ) * 1000 ) ; } newToken = true ; } if ( token != null ) { unauthorizedResponse = false ; if ( LOG . isDebugEnabled ( ) ) { LOG . debug ( "Request [{}] user [{}] authenticated" , getRequestURL ( httpRequest ) , token . getUserName ( ) ) ; } final AuthenticationToken authToken = token ; httpRequest = new HttpServletRequestWrapper ( httpRequest ) { @ Override public String getAuthType ( ) { return authToken . getType ( ) ; } @ Override public String getRemoteUser ( ) { return authToken . getUserName ( ) ; } @ Override public Principal getUserPrincipal ( ) { return ( authToken != AuthenticationToken . ANONYMOUS ) ? authToken : null ; } } ; if ( newToken && ! token . isExpired ( ) && token != AuthenticationToken . ANONYMOUS ) { String signedToken = signer . sign ( token . toString ( ) ) ; createAuthCookie ( httpResponse , signedToken , getCookieDomain ( ) , getCookiePath ( ) , token . getExpires ( ) , isHttps ) ; } filterChainWrapper . doFilter ( httpRequest , httpResponse ) ; } } else { unauthorizedResponse = false ; } } catch ( AuthenticationException ex ) { errCode = HttpServletResponse . SC_FORBIDDEN ; authenticationEx = ex ; LOG . warn ( "Authentication exception: {}" , ex . getMessage ( ) , ex ) ; } if ( unauthorizedResponse ) { if ( ! httpResponse . isCommitted ( ) ) { createAuthCookie ( httpResponse , "" , getCookieDomain ( ) , getCookiePath ( ) , 0 , isHttps ) ; if ( ( errCode == HttpServletResponse . SC_UNAUTHORIZED ) && ( ! httpResponse . containsHeader ( KerberosAuthenticator . WWW_AUTHENTICATE ) ) ) { errCode = HttpServletResponse . SC_FORBIDDEN ; } if ( authenticationEx == null ) { if ( ! supportKeyTabBrowserLogin && isBrowser ( httpRequest . getHeader ( "User-Agent" ) ) ) { filterChain . doFilter ( request , response ) ; } else { boolean chk = true ; Collection < String > headerNames = httpResponse . getHeaderNames ( ) ; for ( String headerName : headerNames ) { String value = httpResponse . getHeader ( headerName ) ; if ( headerName . equalsIgnoreCase ( "Set-Cookie" ) && value . startsWith ( "ATLASSESSIONID" ) ) { chk = false ; break ; } } String authHeader = httpRequest . getHeader ( "Authorization" ) ; if ( authHeader == null && chk ) { filterChain . doFilter ( request , response ) ; } else if ( authHeader != null && authHeader . startsWith ( "Basic" ) ) { filterChain . doFilter ( request , response ) ; } } } else { httpResponse . sendError ( errCode , authenticationEx . getMessage ( ) ) ; } } } }
This method is copied from hadoop auth lib, code added for error handling and fallback to other auth methods

If the request has a valid authentication token it allows the request to continue to the target resource,
otherwise it triggers an authentication sequence using the configured {@link org.apache.hadoop.security.authentication.server.AuthenticationHandler}.

@param request     the request object.
@param response    the response object.
@param filterChain the filter chain object.

@throws IOException      thrown if an IO error occurred.
@throws ServletException thrown if a processing error occurred.