@@ -1,13 +1,8 @@

 package api

-// TODO: Add display name to common meta?

-type UserInfo interface {

-	GetName() string

-	GetUID() string

-	GetGroups() []string

-	GetScope() string

-	GetExtra() map[string]string

-}

+import (

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

+)

 // UserIdentityInfo contains information about an identity.  Identities are distinct from users.  An authentication server of

 // some kind (like oauth for example) describes an identity.  Our system controls the users mapped to this identity.

@@ -20,11 +15,11 @@ type UserIdentityInfo interface {

 	GetExtra() map[string]string

 }

-// UserIdentityMapper maps UserIdentities into UserInfo objects to allow different user abstractions within auth code.

+// UserIdentityMapper maps UserIdentities into user.Info objects to allow different user abstractions within auth code.

 type UserIdentityMapper interface {

 	// UserFor takes an identity, ignores the passed identity.Provider, forces the provider value to some other value and then creates the mapping.

-	// It returns the corresponding UserInfo

-	UserFor(identityInfo UserIdentityInfo) (UserInfo, error)

+	// It returns the corresponding user.Info

+	UserFor(identityInfo UserIdentityInfo) (user.Info, error)

 }

 type Client interface {

@@ -41,34 +36,6 @@ type Grant struct {

 	RedirectURI string

 }

-type DefaultUserInfo struct {

-	Name   string

-	UID    string

-	Groups []string

-	Scope  string

-	Extra  map[string]string

-}

-

-func (i *DefaultUserInfo) GetName() string {

-	return i.Name

-}

-

-func (i *DefaultUserInfo) GetUID() string {

-	return i.UID

-}

-

-func (i *DefaultUserInfo) GetGroups() []string {

-	return i.Groups

-}

-

-func (i *DefaultUserInfo) GetScope() string {

-	return i.Scope

-}

-

-func (i *DefaultUserInfo) GetExtra() map[string]string {

-	return i.Extra

-}

-

 type DefaultUserIdentityInfo struct {

 	UserName     string

 	ProviderName string

@@ -3,31 +3,32 @@ package authenticator

 import (

 	"net/http"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/openshift/origin/pkg/auth/api"

 )

 type Token interface {

-	AuthenticateToken(token string) (api.UserInfo, bool, error)

+	AuthenticateToken(token string) (user.Info, bool, error)

 }

 type Request interface {

-	AuthenticateRequest(req *http.Request) (api.UserInfo, bool, error)

+	AuthenticateRequest(req *http.Request) (user.Info, bool, error)

 }

 type Password interface {

-	AuthenticatePassword(user, password string) (api.UserInfo, bool, error)

+	AuthenticatePassword(user, password string) (user.Info, bool, error)

 }

 type Assertion interface {

-	AuthenticateAssertion(assertionType, data string) (api.UserInfo, bool, error)

+	AuthenticateAssertion(assertionType, data string) (user.Info, bool, error)

 }

 type Client interface {

-	AuthenticateClient(client api.Client) (api.UserInfo, bool, error)

+	AuthenticateClient(client api.Client) (user.Info, bool, error)

 }

-type RequestFunc func(req *http.Request) (api.UserInfo, bool, error)

+type RequestFunc func(req *http.Request) (user.Info, bool, error)

-func (f RequestFunc) AuthenticateRequest(req *http.Request) (api.UserInfo, bool, error) {

+func (f RequestFunc) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {

 	return f(req)

 }

@@ -5,6 +5,7 @@ import (

 	"github.com/golang/glog"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	authapi "github.com/openshift/origin/pkg/auth/api"

 	"github.com/openshift/origin/pkg/auth/authenticator"

 )

@@ -20,7 +21,7 @@ func New(identityMapper authapi.UserIdentityMapper) authenticator.Password {

 }

 // AuthenticatePassword approves any login attempt with non-blank username and password

-func (a alwaysAcceptPasswordAuthenticator) AuthenticatePassword(username, password string) (authapi.UserInfo, bool, error) {

+func (a alwaysAcceptPasswordAuthenticator) AuthenticatePassword(username, password string) (user.Info, bool, error) {

 	if username == "" || password == "" {

 		return nil, false, nil

 	}

@@ -9,7 +9,7 @@ import (

 	"github.com/golang/glog"

-	"github.com/openshift/origin/pkg/auth/api"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	authapi "github.com/openshift/origin/pkg/auth/api"

 	"github.com/openshift/origin/pkg/auth/authenticator"

 )

@@ -46,7 +46,7 @@ func New(url string, mapper authapi.UserIdentityMapper) authenticator.Password {

 	return &Authenticator{url, mapper}

 }

-func (a *Authenticator) AuthenticatePassword(username, password string) (api.UserInfo, bool, error) {

+func (a *Authenticator) AuthenticatePassword(username, password string) (user.Info, bool, error) {

 	req, err := http.NewRequest("GET", a.url, nil)

 	if err != nil {

 		return nil, false, err

@@ -3,6 +3,7 @@ package oauthpassword

 import (

 	"fmt"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/RangelReale/osincli"

 	"github.com/golang/glog"

 	authapi "github.com/openshift/origin/pkg/auth/api"

@@ -18,7 +19,7 @@ func New(client *osincli.Client, identityMapper authapi.UserIdentityMapper) auth

 	return &Authenticator{identityMapper, client}

 }

-func (a *Authenticator) AuthenticatePassword(username, password string) (authapi.UserInfo, bool, error) {

+func (a *Authenticator) AuthenticatePassword(username, password string) (user.Info, bool, error) {

 	areq := a.client.NewAccessRequest(osincli.PASSWORD, nil)

 	areq.CustomParameters["username"] = username

 	areq.CustomParameters["password"] = password

@@ -3,8 +3,8 @@ package registry

 import (

 	"net/http"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	kclient "github.com/GoogleCloudPlatform/kubernetes/pkg/client"

-	"github.com/openshift/origin/pkg/auth/api"

 	"github.com/openshift/origin/pkg/client"

 	oclient "github.com/openshift/origin/pkg/oauth/client"

 )

@@ -26,7 +26,7 @@ func New(token OAuthAccessTokenSource, host string, rt http.RoundTripper) *Authe

 	return &Authenticator{token, host, rt}

 }

-func (a *Authenticator) AuthenticatePassword(username, password string) (api.UserInfo, bool, error) {

+func (a *Authenticator) AuthenticatePassword(username, password string) (user.Info, bool, error) {

 	token, ok, err := a.token.AuthenticatePassword(username, password)

 	if !ok || err != nil {

 		return nil, false, err

@@ -38,14 +38,14 @@ func (a *Authenticator) AuthenticatePassword(username, password string) (api.Use

 	if err != nil {

 		return nil, false, err

 	}

-	user, err := client.Users().Get("~")

+	u, err := client.Users().Get("~")

 	if err != nil {

 		return nil, false, err

 	}

-	info := &api.DefaultUserInfo{

-		Name: user.Name,

-		UID:  string(user.UID),

+	info := &user.DefaultInfo{

+		Name: u.Name,

+		UID:  string(u.UID),

 	}

 	return info, true, nil

@@ -6,7 +6,8 @@ import (

 	"net/http"

 	"strings"

-	authapi "github.com/openshift/origin/pkg/auth/api"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

+

 	"github.com/openshift/origin/pkg/auth/authenticator"

 )

@@ -18,7 +19,7 @@ func NewBasicAuthAuthentication(passwordAuthenticator authenticator.Password) au

 	return &basicAuthRequestHandler{passwordAuthenticator}

 }

-func (authHandler *basicAuthRequestHandler) AuthenticateRequest(req *http.Request) (authapi.UserInfo, bool, error) {

+func (authHandler *basicAuthRequestHandler) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {

 	username, password, err := getBasicAuthInfo(req)

 	if err != nil {

 		return nil, false, err

@@ -4,7 +4,7 @@ import (

 	"net/http"

 	"testing"

-	authapi "github.com/openshift/origin/pkg/auth/api"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 )

 const (

@@ -14,14 +14,14 @@ const (

 )

 type mockPasswordAuthenticator struct {

-	returnUser      authapi.UserInfo

+	returnUser      user.Info

 	isAuthenticated bool

 	err             error

 	passedUser      string

 	passedPassword  string

 }

-func (mock *mockPasswordAuthenticator) AuthenticatePassword(username, password string) (authapi.UserInfo, bool, error) {

+func (mock *mockPasswordAuthenticator) AuthenticatePassword(username, password string) (user.Info, bool, error) {

 	mock.passedUser = username

 	mock.passedPassword = password

@@ -4,7 +4,7 @@ import (

 	"net/http"

 	"strings"

-	"github.com/openshift/origin/pkg/auth/api"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/openshift/origin/pkg/auth/authenticator"

 )

@@ -16,7 +16,7 @@ func New(auth authenticator.Token) *Authenticator {

 	return &Authenticator{auth}

 }

-func (a *Authenticator) AuthenticateRequest(req *http.Request) (api.UserInfo, bool, error) {

+func (a *Authenticator) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {

 	auth := strings.TrimSpace(req.Header.Get("Authorization"))

 	if auth == "" {

 		return nil, false, nil

@@ -4,7 +4,7 @@ import (

 	"errors"

 	"net/http"

-	"github.com/openshift/origin/pkg/auth/api"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 )

 type Context interface {

@@ -19,14 +19,14 @@ func NewAuthenticator(context Context) *Authenticator {

 	return &Authenticator{context}

 }

-func (a *Authenticator) AuthenticateRequest(req *http.Request) (api.UserInfo, bool, error) {

+func (a *Authenticator) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {

 	obj, ok := a.context.Get(req)

 	if !ok {

 		return nil, false, nil

 	}

-	user, ok := obj.(api.UserInfo)

+	user, ok := obj.(user.Info)

 	if !ok {

-		return nil, false, errors.New("the context object is not an api.UserInfo")

+		return nil, false, errors.New("the context object is not a user.Info")

 	}

 	return user, true, nil

 }

@@ -6,7 +6,7 @@ import (

 	"github.com/golang/glog"

-	"github.com/openshift/origin/pkg/auth/api"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	authapi "github.com/openshift/origin/pkg/auth/api"

 )

@@ -30,7 +30,7 @@ func NewAuthenticator(config *Config, mapper authapi.UserIdentityMapper) *Authen

 	return &Authenticator{config, mapper}

 }

-func (a *Authenticator) AuthenticateRequest(req *http.Request) (api.UserInfo, bool, error) {

+func (a *Authenticator) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {

 	username := ""

 	for _, header := range a.config.UserNameHeaders {

 		header = strings.TrimSpace(header)

@@ -4,13 +4,14 @@ import (

 	"net/http"

 	"testing"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/openshift/origin/pkg/auth/api"

 )

 type TestUserIdentityMapper struct{}

-func (m *TestUserIdentityMapper) UserFor(identityInfo api.UserIdentityInfo) (api.UserInfo, error) {

-	return &api.DefaultUserInfo{Name: identityInfo.GetUserName()}, nil

+func (m *TestUserIdentityMapper) UserFor(identityInfo api.UserIdentityInfo) (user.Info, error) {

+	return &user.DefaultInfo{Name: identityInfo.GetUserName()}, nil

 }

 func TestRequestHeader(t *testing.T) {

@@ -4,7 +4,7 @@ import (

 	"net/http"

 	"strings"

-	"github.com/openshift/origin/pkg/auth/api"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/openshift/origin/pkg/auth/authenticator"

 )

@@ -21,7 +21,7 @@ func New(param string, auth authenticator.Token) *Authenticator {

 	return &Authenticator{param, auth}

 }

-func (a *Authenticator) AuthenticateRequest(req *http.Request) (api.UserInfo, bool, error) {

+func (a *Authenticator) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {

 	token := strings.TrimSpace(req.FormValue(a.param))

 	if token == "" {

 		return nil, false, nil

@@ -5,7 +5,7 @@ import (

 	kerrors "github.com/GoogleCloudPlatform/kubernetes/pkg/util/errors"

-	authapi "github.com/openshift/origin/pkg/auth/api"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/openshift/origin/pkg/auth/authenticator"

 )

@@ -23,7 +23,7 @@ func NewUnionAuthentication(authRequestHandlers ...authenticator.Request) authen

 // AuthenticateRequest authenticates the request using a chain of authenticator.Request objects.  The first

 // success returns that identity.  Errors are only returned if no matches are found.

-func (authHandler *Authenticator) AuthenticateRequest(req *http.Request) (authapi.UserInfo, bool, error) {

+func (authHandler *Authenticator) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {

 	errors := []error{}

 	for _, currAuthRequestHandler := range authHandler.Handlers {

 		info, ok, err := currAuthRequestHandler.AuthenticateRequest(req)

@@ -6,16 +6,16 @@ import (

 	"strings"

 	"testing"

-	authapi "github.com/openshift/origin/pkg/auth/api"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 )

 type mockAuthRequestHandler struct {

-	returnUser      authapi.UserInfo

+	returnUser      user.Info

 	isAuthenticated bool

 	err             error

 }

-func (mock *mockAuthRequestHandler) AuthenticateRequest(req *http.Request) (authapi.UserInfo, bool, error) {

+func (mock *mockAuthRequestHandler) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {

 	return mock.returnUser, mock.isAuthenticated, mock.err

 }

@@ -4,20 +4,20 @@ import (

 	"crypto/x509"

 	"net/http"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/GoogleCloudPlatform/kubernetes/pkg/util/errors"

-	"github.com/openshift/origin/pkg/auth/api"

 )

 // UserConversion defines an interface for extracting user info from a client certificate chain

 type UserConversion interface {

-	User(chain []*x509.Certificate) (api.UserInfo, bool, error)

+	User(chain []*x509.Certificate) (user.Info, bool, error)

 }

 // UserConversionFunc is a function that implements the UserConversion interface.

-type UserConversionFunc func(chain []*x509.Certificate) (api.UserInfo, bool, error)

+type UserConversionFunc func(chain []*x509.Certificate) (user.Info, bool, error)

 // User implements x509.UserConversion

-func (f UserConversionFunc) User(chain []*x509.Certificate) (api.UserInfo, bool, error) {

+func (f UserConversionFunc) User(chain []*x509.Certificate) (user.Info, bool, error) {

 	return f(chain)

 }

@@ -28,13 +28,13 @@ type Authenticator struct {

 }

 // New returns a request.Authenticator that verifies client certificates using the provided

-// VerifyOptions, and converts valid certificate chains into api.UserInfo using the provided UserConversion

+// VerifyOptions, and converts valid certificate chains into user.Info using the provided UserConversion

 func New(opts x509.VerifyOptions, user UserConversion) *Authenticator {

 	return &Authenticator{opts, user}

 }

 // AuthenticateRequest authenticates the request using presented client certificates

-func (a *Authenticator) AuthenticateRequest(req *http.Request) (api.UserInfo, bool, error) {

+func (a *Authenticator) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {

 	if req.TLS == nil {

 		return nil, false, nil

 	}

@@ -71,25 +71,25 @@ func DefaultVerifyOptions() x509.VerifyOptions {

 }

 // CommonNameUserConversion builds user info from a certificate chain using the subject's CommonName

-var CommonNameUserConversion = UserConversionFunc(func(chain []*x509.Certificate) (api.UserInfo, bool, error) {

+var CommonNameUserConversion = UserConversionFunc(func(chain []*x509.Certificate) (user.Info, bool, error) {

 	if len(chain[0].Subject.CommonName) == 0 {

 		return nil, false, nil

 	}

-	return &api.DefaultUserInfo{Name: chain[0].Subject.CommonName}, true, nil

+	return &user.DefaultInfo{Name: chain[0].Subject.CommonName}, true, nil

 })

 // DNSNameUserConversion builds user info from a certificate chain using the first DNSName on the certificate

-var DNSNameUserConversion = UserConversionFunc(func(chain []*x509.Certificate) (api.UserInfo, bool, error) {

+var DNSNameUserConversion = UserConversionFunc(func(chain []*x509.Certificate) (user.Info, bool, error) {

 	if len(chain[0].DNSNames) == 0 {

 		return nil, false, nil

 	}

-	return &api.DefaultUserInfo{Name: chain[0].DNSNames[0]}, true, nil

+	return &user.DefaultInfo{Name: chain[0].DNSNames[0]}, true, nil

 })

 // EmailAddressUserConversion builds user info from a certificate chain using the first EmailAddress on the certificate

-var EmailAddressUserConversion = UserConversionFunc(func(chain []*x509.Certificate) (api.UserInfo, bool, error) {

+var EmailAddressUserConversion = UserConversionFunc(func(chain []*x509.Certificate) (user.Info, bool, error) {

 	if len(chain[0].EmailAddresses) == 0 {

 		return nil, false, nil

 	}

-	return &api.DefaultUserInfo{Name: chain[0].EmailAddresses[0]}, true, nil

+	return &user.DefaultInfo{Name: chain[0].EmailAddresses[0]}, true, nil

 })

@@ -9,7 +9,7 @@ import (

 	"testing"

 	"time"

-	"github.com/openshift/origin/pkg/auth/api"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 )

 const (

@@ -452,7 +452,7 @@ func TestX509(t *testing.T) {

 		"custom conversion error": {

 			Opts:  getDefaultVerifyOptions(t),

 			Certs: getCerts(t, clientCNCert),

-			User: UserConversionFunc(func(chain []*x509.Certificate) (api.UserInfo, bool, error) {

+			User: UserConversionFunc(func(chain []*x509.Certificate) (user.Info, bool, error) {

 				return nil, false, errors.New("custom error")

 			}),

@@ -462,8 +462,8 @@ func TestX509(t *testing.T) {

 		"custom conversion success": {

 			Opts:  getDefaultVerifyOptions(t),

 			Certs: getCerts(t, clientCNCert),

-			User: UserConversionFunc(func(chain []*x509.Certificate) (api.UserInfo, bool, error) {

-				return &api.DefaultUserInfo{Name: "custom"}, true, nil

+			User: UserConversionFunc(func(chain []*x509.Certificate) (user.Info, bool, error) {

+				return &user.DefaultInfo{Name: "custom"}, true, nil

 			}),

 			ExpectUserName: "custom",

@@ -6,12 +6,12 @@ import (

 	"io"

 	"os"

-	"github.com/openshift/origin/pkg/auth/api"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 )

 type TokenAuthenticator struct {

 	path   string

-	tokens map[string]*api.DefaultUserInfo

+	tokens map[string]*user.DefaultInfo

 }

 func NewTokenAuthenticator(path string) (*TokenAuthenticator, error) {

@@ -21,7 +21,7 @@ func NewTokenAuthenticator(path string) (*TokenAuthenticator, error) {

 	}

 	defer file.Close()

-	tokens := make(map[string]*api.DefaultUserInfo)

+	tokens := make(map[string]*user.DefaultInfo)

 	reader := csv.NewReader(file)

 	for {

 		record, err := reader.Read()

@@ -31,15 +31,14 @@ func NewTokenAuthenticator(path string) (*TokenAuthenticator, error) {

 		if err != nil {

 			return nil, err

 		}

-		if len(record) < 3 {

+		if len(record) < 2 {

 			continue

 		}

-		obj := &api.DefaultUserInfo{

-			Name:  record[1],

-			Scope: record[2],

+		obj := &user.DefaultInfo{

+			Name: record[1],

 		}

-		if len(record) > 3 {

-			obj.UID = record[3]

+		if len(record) > 2 {

+			obj.UID = record[2]

 		}

 		tokens[record[0]] = obj

 	}

@@ -50,7 +49,7 @@ func NewTokenAuthenticator(path string) (*TokenAuthenticator, error) {

 	}, nil

 }

-func (a *TokenAuthenticator) AuthenticateToken(value string) (api.UserInfo, bool, error) {

+func (a *TokenAuthenticator) AuthenticateToken(value string) (user.Info, bool, error) {

 	user, ok := a.tokens[value]

 	if !ok {

 		return nil, false, errors.New("Invalid token")

@@ -3,7 +3,7 @@ package group

 import (

 	"net/http"

-	"github.com/openshift/origin/pkg/auth/api"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/openshift/origin/pkg/auth/authenticator"

 )

@@ -13,17 +13,15 @@ type GroupAdder struct {

 	Groups        []string

 }

-func (g *GroupAdder) AuthenticateRequest(req *http.Request) (api.UserInfo, bool, error) {

-	user, ok, err := g.Authenticator.AuthenticateRequest(req)

+func (g *GroupAdder) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {

+	u, ok, err := g.Authenticator.AuthenticateRequest(req)

 	if err != nil || !ok {

 		return nil, ok, err

 	}

-	return &api.DefaultUserInfo{

-		Name:   user.GetName(),

-		UID:    user.GetUID(),

-		Groups: append(user.GetGroups(), g.Groups...),

-		Scope:  user.GetScope(),

-		Extra:  user.GetExtra(),

+	return &user.DefaultInfo{

+		Name:   u.GetName(),

+		UID:    u.GetUID(),

+		Groups: append(u.GetGroups(), g.Groups...),

 	}, true, nil

 }

@@ -5,15 +5,15 @@ import (

 	"reflect"

 	"testing"

-	"github.com/openshift/origin/pkg/auth/api"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/openshift/origin/pkg/auth/authenticator"

 )

 func TestGroupAdder(t *testing.T) {

 	adder := authenticator.Request(

 		NewGroupAdder(

-			authenticator.RequestFunc(func(req *http.Request) (api.UserInfo, bool, error) {

-				return &api.DefaultUserInfo{Name: "user", Groups: []string{"original"}}, true, nil

+			authenticator.RequestFunc(func(req *http.Request) (user.Info, bool, error) {

+				return &user.DefaultInfo{Name: "user", Groups: []string{"original"}}, true, nil

 			}),

 			[]string{"added"},

 		),

@@ -6,10 +6,10 @@ import (

 	"net/http"

 	"net/url"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/RangelReale/osincli"

 	"github.com/golang/glog"

-	"github.com/openshift/origin/pkg/auth/api"

 	authapi "github.com/openshift/origin/pkg/auth/api"

 	"github.com/openshift/origin/pkg/auth/oauth/handlers"

 )

@@ -168,7 +168,7 @@ func (defaultState) Check(state string, w http.ResponseWriter, req *http.Request

 	return true, nil

 }

-func (defaultState) AuthenticationSucceeded(user api.UserInfo, state string, w http.ResponseWriter, req *http.Request) (bool, error) {

+func (defaultState) AuthenticationSucceeded(user user.Info, state string, w http.ResponseWriter, req *http.Request) (bool, error) {

 	values, err := url.ParseQuery(state)

 	if err != nil {

 		return false, err

@@ -6,6 +6,7 @@ import (

 	"github.com/RangelReale/osin"

 	"github.com/golang/glog"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/openshift/origin/pkg/auth/api"

 	"github.com/openshift/origin/pkg/auth/authenticator"

 )

@@ -53,7 +54,7 @@ func NewAccessAuthenticator(password authenticator.Password, assertion authentic

 // HandleAccess implements osinserver.AccessHandler

 func (h *AccessAuthenticator) HandleAccess(ar *osin.AccessRequest, w http.ResponseWriter) error {

 	var (

-		info api.UserInfo

+		info user.Info

 		ok   bool

 		err  error

 	)

@@ -103,16 +104,16 @@ type fixedAuthenticator struct {

 }

 // AuthenticatePassword implements authenticator.Password

-func (f *fixedAuthenticator) AuthenticatePassword(user, password string) (api.UserInfo, bool, error) {

+func (f *fixedAuthenticator) AuthenticatePassword(user, password string) (user.Info, bool, error) {

 	return nil, f.allow, nil

 }

 // AuthenticateAssertion implements authenticator.Assertion

-func (f *fixedAuthenticator) AuthenticateAssertion(assertionType, data string) (api.UserInfo, bool, error) {

+func (f *fixedAuthenticator) AuthenticateAssertion(assertionType, data string) (user.Info, bool, error) {

 	return nil, f.allow, nil

 }

 // AuthenticateClient implements authenticator.Client

-func (f *fixedAuthenticator) AuthenticateClient(client api.Client) (api.UserInfo, bool, error) {

+func (f *fixedAuthenticator) AuthenticateClient(client api.Client) (user.Info, bool, error) {

 	return nil, f.allow, nil

 }

@@ -5,6 +5,7 @@ import (

 	"github.com/golang/glog"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	authapi "github.com/openshift/origin/pkg/auth/api"

 )

@@ -16,7 +17,7 @@ func (EmptyAuth) AuthenticationNeeded(client authapi.Client, w http.ResponseWrit

 type EmptySuccess struct{}

-func (EmptySuccess) AuthenticationSucceeded(user authapi.UserInfo, state string, w http.ResponseWriter, req *http.Request) (bool, error) {

+func (EmptySuccess) AuthenticationSucceeded(user user.Info, state string, w http.ResponseWriter, req *http.Request) (bool, error) {

 	glog.V(4).Infof("AuthenticationSucceeded: %v (state=%s)", user, state)

 	return false, nil

 }

@@ -8,6 +8,7 @@ import (

 	"github.com/RangelReale/osin"

 	"github.com/golang/glog"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/openshift/origin/pkg/auth/api"

 	oapi "github.com/openshift/origin/pkg/oauth/api"

 	"github.com/openshift/origin/pkg/oauth/registry/clientauthorization"

@@ -41,9 +42,9 @@ func (h *GrantCheck) HandleAuthorize(ar *osin.AuthorizeRequest, w http.ResponseW

 	// Reset request to unauthorized until we verify the grant

 	ar.Authorized = false

-	user, ok := ar.UserData.(api.UserInfo)

+	user, ok := ar.UserData.(user.Info)

 	if !ok || user == nil {

-		return h.errorHandler.GrantError(errors.New("the provided user data is not api.UserInfo"), w, ar.HttpRequest)

+		return h.errorHandler.GrantError(errors.New("the provided user data is not user.Info"), w, ar.HttpRequest)

 	}

 	grant := &api.Grant{

@@ -75,7 +76,7 @@ func NewEmptyGrant() GrantHandler {

 }

 // GrantNeeded implements the GrantHandler interface

-func (emptyGrant) GrantNeeded(user api.UserInfo, grant *api.Grant, w http.ResponseWriter, req *http.Request) (bool, error) {

+func (emptyGrant) GrantNeeded(user user.Info, grant *api.Grant, w http.ResponseWriter, req *http.Request) (bool, error) {

 	return false, nil

 }

@@ -90,7 +91,7 @@ func NewAutoGrant(authregistry clientauthorization.Registry) GrantHandler {

 }

 // GrantNeeded implements the GrantHandler interface

-func (g *autoGrant) GrantNeeded(user api.UserInfo, grant *api.Grant, w http.ResponseWriter, req *http.Request) (bool, error) {

+func (g *autoGrant) GrantNeeded(user user.Info, grant *api.Grant, w http.ResponseWriter, req *http.Request) (bool, error) {

 	clientAuthID := g.authregistry.ClientAuthorizationName(user.GetName(), grant.Client.GetId())

 	clientAuth, err := g.authregistry.GetClientAuthorization(clientAuthID)

 	if err == nil {

@@ -142,7 +143,7 @@ func NewRedirectGrant(url string) GrantHandler {

 }

 // GrantNeeded implements the GrantHandler interface

-func (g *redirectGrant) GrantNeeded(user api.UserInfo, grant *api.Grant, w http.ResponseWriter, req *http.Request) (bool, error) {

+func (g *redirectGrant) GrantNeeded(user user.Info, grant *api.Grant, w http.ResponseWriter, req *http.Request) (bool, error) {

 	// If the current request has an error=grant_denied parameter, the user denied the grant

 	if err := req.FormValue("error"); err == GrantDeniedError {

 		return false, nil

@@ -3,6 +3,7 @@ package handlers

 import (

 	"net/http"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/openshift/origin/pkg/auth/api"

 )

@@ -35,19 +36,19 @@ type AuthenticationErrorHandler interface {

 type AuthenticationSuccessHandler interface {

 	// AuthenticationSucceeded reacts to a user authenticating, returns true if the response was written,

 	// and returns false if the response was not written.

-	AuthenticationSucceeded(user api.UserInfo, state string, w http.ResponseWriter, req *http.Request) (bool, error)

+	AuthenticationSucceeded(user user.Info, state string, w http.ResponseWriter, req *http.Request) (bool, error)

 }

 // GrantChecker is responsible for determining if a user has authorized a client for a requested grant

 type GrantChecker interface {

 	// HasAuthorizedClient returns true if the user has authorized the client for the requested grant

-	HasAuthorizedClient(user api.UserInfo, grant *api.Grant) (bool, error)

+	HasAuthorizedClient(user user.Info, grant *api.Grant) (bool, error)

 }

 // GrantHandler handles errors during the grant process, or the client requests an unauthorized grant

 type GrantHandler interface {

 	// GrantNeeded reacts when a client requests an unauthorized grant, and returns true if the response was written

-	GrantNeeded(user api.UserInfo, grant *api.Grant, w http.ResponseWriter, req *http.Request) (handled bool, err error)

+	GrantNeeded(user user.Info, grant *api.Grant, w http.ResponseWriter, req *http.Request) (handled bool, err error)

 }

 // GrantErrorHandler reacts to grant errors

@@ -62,7 +63,7 @@ type GrantErrorHandler interface {

 // the chain is aborted.

 type AuthenticationSuccessHandlers []AuthenticationSuccessHandler

-func (all AuthenticationSuccessHandlers) AuthenticationSucceeded(user api.UserInfo, state string, w http.ResponseWriter, req *http.Request) (bool, error) {

+func (all AuthenticationSuccessHandlers) AuthenticationSucceeded(user user.Info, state string, w http.ResponseWriter, req *http.Request) (bool, error) {

 	for _, h := range all {

 		if handled, err := h.AuthenticationSucceeded(user, state, w, req); handled || err != nil {

 			return handled, err

@@ -5,6 +5,7 @@ import (

 	"github.com/GoogleCloudPlatform/kubernetes/pkg/api/errors"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/openshift/origin/pkg/auth/api"

 	"github.com/openshift/origin/pkg/oauth/registry/clientauthorization"

 	"github.com/openshift/origin/pkg/oauth/scope"

@@ -18,7 +19,7 @@ func NewClientAuthorizationGrantChecker(registry clientauthorization.Registry) *

 	return &ClientAuthorizationGrantChecker{registry}

 }

-func (c *ClientAuthorizationGrantChecker) HasAuthorizedClient(user api.UserInfo, grant *api.Grant) (approved bool, err error) {

+func (c *ClientAuthorizationGrantChecker) HasAuthorizedClient(user user.Info, grant *api.Grant) (approved bool, err error) {

 	id := c.registry.ClientAuthorizationName(user.GetName(), grant.Client.GetId())

 	authorization, err := c.registry.GetClientAuthorization(id)

 	if errors.IsNotFound(err) {

@@ -12,6 +12,7 @@ import (

 	"github.com/GoogleCloudPlatform/kubernetes/pkg/util"

 	"github.com/RangelReale/osincli"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/openshift/origin/pkg/auth/api"

 	"github.com/openshift/origin/pkg/auth/oauth/handlers"

 	oapi "github.com/openshift/origin/pkg/oauth/api"

@@ -21,7 +22,7 @@ import (

 )

 type testHandlers struct {

-	User         api.UserInfo

+	User         user.Info

 	Authenticate bool

 	Err          error

 	AuthNeed     bool

@@ -48,11 +49,11 @@ func (h *testHandlers) AuthenticationError(err error, w http.ResponseWriter, req

 	return true, nil

 }

-func (h *testHandlers) AuthenticateRequest(req *http.Request) (api.UserInfo, bool, error) {

+func (h *testHandlers) AuthenticateRequest(req *http.Request) (user.Info, bool, error) {

 	return h.User, h.Authenticate, h.Err

 }

-func (h *testHandlers) GrantNeeded(user api.UserInfo, grant *api.Grant, w http.ResponseWriter, req *http.Request) (bool, error) {

+func (h *testHandlers) GrantNeeded(user user.Info, grant *api.Grant, w http.ResponseWriter, req *http.Request) (bool, error) {

 	h.GrantNeed = true

 	return h.GrantNeedHandled, h.GrantNeedErr

 }

@@ -86,7 +87,7 @@ func TestRegistryAndServer(t *testing.T) {

 		Client      *oapi.OAuthClient

 		ClientAuth  *oapi.OAuthClientAuthorization

 		AuthSuccess bool

-		AuthUser    api.UserInfo

+		AuthUser    user.Info

 		Scope       string

 		Check       func(*testHandlers, *http.Request)

 	}{

@@ -101,7 +102,7 @@ func TestRegistryAndServer(t *testing.T) {

 		"needs grant": {

 			Client:      validClient,

 			AuthSuccess: true,

-			AuthUser: &api.DefaultUserInfo{

+			AuthUser: &user.DefaultInfo{

 				Name: "user",

 			},

 			Check: func(h *testHandlers, _ *http.Request) {

@@ -113,7 +114,7 @@ func TestRegistryAndServer(t *testing.T) {

 		"has non covered grant": {

 			Client:      validClient,

 			AuthSuccess: true,

-			AuthUser: &api.DefaultUserInfo{

+			AuthUser: &user.DefaultInfo{

 				Name: "user",

 			},

 			ClientAuth: &oapi.OAuthClientAuthorization{

@@ -131,7 +132,7 @@ func TestRegistryAndServer(t *testing.T) {

 		"has covered grant": {

 			Client:      validClient,

 			AuthSuccess: true,

-			AuthUser: &api.DefaultUserInfo{

+			AuthUser: &user.DefaultInfo{

 				Name: "user",

 			},

 			ClientAuth: &oapi.OAuthClientAuthorization{

@@ -149,7 +150,7 @@ func TestRegistryAndServer(t *testing.T) {

 		"has auth and grant": {

 			Client:      validClient,

 			AuthSuccess: true,

-			AuthUser: &api.DefaultUserInfo{

+			AuthUser: &user.DefaultInfo{

 				Name: "user",

 			},

 			ClientAuth: validClientAuth,

@@ -4,9 +4,8 @@ import (

 	"errors"

 	"time"

-	"github.com/openshift/origin/pkg/auth/api"

+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"

 	"github.com/openshift/origin/pkg/oauth/registry/accesstoken"

-	"github.com/openshift/origin/pkg/oauth/scope"

 )

 type TokenAuthenticator struct {

@@ -21,7 +20,7 @@ func NewTokenAuthenticator(registry accesstoken.Registry) *TokenAuthenticator {