@@ -11,23 +11,29 @@ import (

 // TODO remove this in favor of kubernetes types

-type unionAuthRequestHandler []authenticator.Request

+type Authenticator struct {

+	Handlers    []authenticator.Request

+	FailOnError bool

+}

 // NewUnionAuthentication returns a request authenticator that validates credentials using a chain of authenticator.Request objects

-func NewUnionAuthentication(authRequestHandlers []authenticator.Request) authenticator.Request {

-	return unionAuthRequestHandler(authRequestHandlers)

+func NewUnionAuthentication(authRequestHandlers ...authenticator.Request) authenticator.Request {

+	return &Authenticator{Handlers: authRequestHandlers}

 }

 // AuthenticateRequest authenticates the request using a chain of authenticator.Request objects.  The first

 // success returns that identity.  Errors are only returned if no matches are found.

-func (authHandler unionAuthRequestHandler) AuthenticateRequest(req *http.Request) (authapi.UserInfo, bool, error) {

+func (authHandler *Authenticator) AuthenticateRequest(req *http.Request) (authapi.UserInfo, bool, error) {

 	errors := []error{}

-	for _, currAuthRequestHandler := range authHandler {

+	for _, currAuthRequestHandler := range authHandler.Handlers {

 		info, ok, err := currAuthRequestHandler.AuthenticateRequest(req)

 		if err == nil && ok {

 			return info, ok, err

 		}

 		if err != nil {

+			if authHandler.FailOnError {

+				return nil, false, err

+			}

 			errors = append(errors, err)

 		}

 	}

@@ -7,7 +7,6 @@ import (

 	"testing"

 	authapi "github.com/openshift/origin/pkg/auth/api"

-	"github.com/openshift/origin/pkg/auth/authenticator"

 )

 type mockAuthRequestHandler struct {

@@ -23,7 +22,7 @@ func (mock *mockAuthRequestHandler) AuthenticateRequest(req *http.Request) (auth

 func TestAuthenticateRequestSecondPasses(t *testing.T) {

 	handler1 := &mockAuthRequestHandler{}

 	handler2 := &mockAuthRequestHandler{isAuthenticated: true}

-	authRequestHandler := NewUnionAuthentication([]authenticator.Request{handler1, handler2})

+	authRequestHandler := NewUnionAuthentication(handler1, handler2)

 	req, _ := http.NewRequest("GET", "http://example.org", nil)

 	_, isAuthenticated, err := authRequestHandler.AuthenticateRequest(req)

@@ -38,7 +37,7 @@ func TestAuthenticateRequestSecondPasses(t *testing.T) {

 func TestAuthenticateRequestSuppressUnnecessaryErrors(t *testing.T) {

 	handler1 := &mockAuthRequestHandler{err: errors.New("first")}

 	handler2 := &mockAuthRequestHandler{isAuthenticated: true}

-	authRequestHandler := NewUnionAuthentication([]authenticator.Request{handler1, handler2})

+	authRequestHandler := NewUnionAuthentication(handler1, handler2)

 	req, _ := http.NewRequest("GET", "http://example.org", nil)

 	_, isAuthenticated, err := authRequestHandler.AuthenticateRequest(req)

@@ -53,7 +52,7 @@ func TestAuthenticateRequestSuppressUnnecessaryErrors(t *testing.T) {

 func TestAuthenticateRequestNonePass(t *testing.T) {

 	handler1 := &mockAuthRequestHandler{}

 	handler2 := &mockAuthRequestHandler{}

-	authRequestHandler := NewUnionAuthentication([]authenticator.Request{handler1, handler2})

+	authRequestHandler := NewUnionAuthentication(handler1, handler2)

 	req, _ := http.NewRequest("GET", "http://example.org", nil)

 	_, isAuthenticated, err := authRequestHandler.AuthenticateRequest(req)

@@ -68,7 +67,7 @@ func TestAuthenticateRequestNonePass(t *testing.T) {

 func TestAuthenticateRequestAdditiveErrors(t *testing.T) {

 	handler1 := &mockAuthRequestHandler{err: errors.New("first")}

 	handler2 := &mockAuthRequestHandler{err: errors.New("second")}

-	authRequestHandler := NewUnionAuthentication([]authenticator.Request{handler1, handler2})

+	authRequestHandler := NewUnionAuthentication(handler1, handler2)

 	req, _ := http.NewRequest("GET", "http://example.org", nil)

 	_, isAuthenticated, err := authRequestHandler.AuthenticateRequest(req)

@@ -2,6 +2,7 @@ package filetoken

 import (

 	"encoding/csv"

+	"errors"

 	"io"

 	"os"

@@ -52,7 +53,7 @@ func NewTokenAuthenticator(path string) (*TokenAuthenticator, error) {

 func (a *TokenAuthenticator) AuthenticateToken(value string) (api.UserInfo, bool, error) {

 	user, ok := a.tokens[value]

 	if !ok {

-		return nil, false, nil

+		return nil, false, errors.New("Invalid token")

 	}

 	return user, true, nil

 }

@@ -249,8 +249,11 @@ func TestAuthenticateTokenNotFound(t *testing.T) {

 	if found {

 		t.Error("Found token, but it should be missing!")

 	}

-	if err != nil {

-		t.Error("Unexpected error: %v", err)

+	if err == nil {

+		t.Error("Expected not found error")

+	}

+	if !apierrs.IsNotFound(err) {

+		t.Error("Expected not found error")

 	}

 	if userInfo != nil {

 		t.Error("Unexpected user: %v", userInfo)

@@ -288,7 +291,7 @@ func TestAuthenticateTokenExpired(t *testing.T) {

 	if found {

 		t.Error("Found token, but it should be missing!")

 	}

-	if err != nil {

+	if err != ErrExpired {

 		t.Error("Unexpected error: %v", err)

 	}

 	if userInfo != nil {

@@ -1,10 +1,9 @@

 package registry

 import (

+	"errors"

 	"time"

-	"github.com/GoogleCloudPlatform/kubernetes/pkg/api/errors"

-

 	"github.com/openshift/origin/pkg/auth/api"

 	"github.com/openshift/origin/pkg/oauth/registry/accesstoken"

 	"github.com/openshift/origin/pkg/oauth/scope"

@@ -14,6 +13,8 @@ type TokenAuthenticator struct {

 	registry accesstoken.Registry

 }

+var ErrExpired = errors.New("Token is expired")

+

 func NewTokenAuthenticator(registry accesstoken.Registry) *TokenAuthenticator {

 	return &TokenAuthenticator{

 		registry: registry,

@@ -22,14 +23,11 @@ func NewTokenAuthenticator(registry accesstoken.Registry) *TokenAuthenticator {

 func (a *TokenAuthenticator) AuthenticateToken(value string) (api.UserInfo, bool, error) {

 	token, err := a.registry.GetAccessToken(value)

-	if errors.IsNotFound(err) {

-		return nil, false, nil

-	}

 	if err != nil {

 		return nil, false, err

 	}

 	if token.CreationTimestamp.Time.Add(time.Duration(token.ExpiresIn) * time.Second).Before(time.Now()) {

-		return nil, false, nil

+		return nil, false, ErrExpired

 	}

 	return &api.DefaultUserInfo{

 		Name:  token.UserName,

@@ -369,7 +369,7 @@ func (c *AuthConfig) getAuthenticationRequestHandler(sessionStore session.Store)

 		authRequestHandlers = append(authRequestHandlers, c.getAuthenticationRequestHandlerFromType(currType, sessionStore))

 	}

-	authRequestHandler := unionrequest.NewUnionAuthentication(authRequestHandlers)

+	authRequestHandler := unionrequest.NewUnionAuthentication(authRequestHandlers...)

 	return authRequestHandler

 }

@@ -316,7 +316,7 @@ func start(cfg *config, args []string) error {

 		if err != nil {

 			glog.Fatalf("Error creating TokenAuthenticator: %v", err)

 		}

-		authenticators = append(authenticators, group.NewGroupAdder(bearertoken.New(tokenAuthenticator), []string{authenticatedGroup}))

+		authenticators = append(authenticators, bearertoken.New(tokenAuthenticator))

 		var roots *x509.CertPool

 		if osmaster.TLS {

@@ -375,7 +375,7 @@ func start(cfg *config, args []string) error {

 			opts := x509request.DefaultVerifyOptions()

 			opts.Roots = roots

 			certauth := x509request.New(opts, x509request.CommonNameUserConversion)

-			authenticators = append(authenticators, group.NewGroupAdder(certauth, []string{authenticatedGroup}))

+			authenticators = append(authenticators, certauth)

 		} else {

 			// No security, use the same client config for all OpenShift clients

 			osClientConfig := kclient.Config{Host: cfg.MasterAddr.URL.String(), Version: latest.Version}

@@ -384,11 +384,15 @@ func start(cfg *config, args []string) error {

 		}

 		// TODO: make anonymous auth optional?

-		// TODO: should this map to a real user persisted in etcd?

-		authenticators = append(authenticators, authenticator.RequestFunc(func(req *http.Request) (api.UserInfo, bool, error) {

-			return &api.DefaultUserInfo{Name: unauthenticatedUsername, Groups: []string{unauthenticatedGroup}}, true, nil

-		}))

-		osmaster.Authenticator = unionrequest.NewUnionAuthentication(authenticators)

+		osmaster.Authenticator = &unionrequest.Authenticator{

+			FailOnError: true,

+			Handlers: []authenticator.Request{

+				group.NewGroupAdder(unionrequest.NewUnionAuthentication(authenticators...), []string{authenticatedGroup}),

+				authenticator.RequestFunc(func(req *http.Request) (api.UserInfo, bool, error) {

+					return &api.DefaultUserInfo{Name: unauthenticatedUsername, Groups: []string{unauthenticatedGroup}}, true, nil

+				}),

+			},

+		}

 		osmaster.BuildClients()

 		osmaster.EnsureCORSAllowedOrigins(cfg.CORSAllowedOrigins)