HADOOP-11099. KMS return HTTP UNAUTHORIZED 401 on ACL failure. (tucu)

hadoop-common-project/hadoop-common/CHANGES.txt

@@ -824,6 +824,8 @@ Release 2.6.0 - UNRELEASED
     HADOOP-11062. CryptoCodec testcases requiring OpenSSL should be run 
     only if -Pnative is used. (asuresh via tucu)
 
+    HADOOP-11099. KMS return HTTP UNAUTHORIZED 401 on ACL failure. (tucu)
+
 Release 2.5.1 - 2014-09-05
 
   INCOMPATIBLE CHANGES

hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSExceptionsProvider.java

@@ -79,7 +79,7 @@ public class KMSExceptionsProvider implements ExceptionMapper<Exception> {
       // we don't audit here because we did it already when checking access
       doAudit = false;
     } else if (throwable instanceof AuthorizationException) {
-      status = Response.Status.UNAUTHORIZED;
+      status = Response.Status.FORBIDDEN;
       // we don't audit here because we did it already when checking access
       doAudit = false;
     } else if (throwable instanceof AccessControlException) {