Release version 2.0.1

Add RemoteUserDetailsService, fix MiniAccumulo test, simplify SSL configuration and allow more types of SSL keyStores and trustStores
Bump version to 2.0.1-SNAPSHOT
2026-11-10 03:41:25 -10:00 · 2024-01-26 13:10:20 -05:00 · 2024-01-26 13:07:26 -05:00 · 2024-01-17 10:42:09 -05:00 · 2024-01-17 10:42:09 -05:00 · 2024-01-17 10:42:09 -05:00
136 changed files with 6948 additions and 7003 deletions
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.5</version>
+    <version>2.0.1</version>
  </parent>
  <artifactId>timely-analytics</artifactId>
  <!--
@@ -13,10 +13,6 @@ CONF_DIR=${BASE_DIR}/conf

 . ${BIN_DIR}/timely-balancer-env.sh

-HOST_IP=$(hostname -I | awk '{print $1}')
-HOST=$(hostname -s)
-HOST_FQDN=$(hostname -f)
-
 for i in $(seq 1 $NUM_PROFILES); do
    if [ "$NUM_PROFILES" -eq "1" ]; then
        FILENAME=timely-balancer.yml
@@ -26,9 +22,6 @@ for i in $(seq 1 $NUM_PROFILES); do

    echo "creating configuration file ${CONF_DIR}/${FILENAME}"
    cp ${CONF_DIR}/timely-balancer-template.yml ${CONF_DIR}/${FILENAME}
-    sed -i "s/\${HOST}/${HOST}/g" ${CONF_DIR}/${FILENAME}
-    sed -i "s/\${HOST_FQDN}/${HOST_FQDN}/g" ${CONF_DIR}/${FILENAME}
-    sed -i "s/\${HOST_IP}/${HOST_IP}/g" ${CONF_DIR}/${FILENAME}
    sed -i "s/\${ZOOKEEPERS}/${ZOOKEEPERS}/g" ${CONF_DIR}/${FILENAME}
    MULTIPLE=$(($i - 1))
    TCP_PORT=$(($TCP_PORT_START + $MULTIPLE * $PORT_INCREMENT))
@@ -8,13 +8,17 @@ WEBSOCKET_PORT_START=4244
 UDP_PORT_START=4245
 PORT_INCREMENT=100

-SERVER_CERTIFICATE_FILE=
-SERVER_KEY_FILE=
-SERVER_KEY_PASSWORD=
-SERVER_USE_GENERATED_KEYPAIR=true
-CLIENT_KEY_FILE=
-CLIENT_KEY_TYPE=pkcs12
-CLIENT_KEY_PASSWORD=
-TRUST_STORE_PEM=
-TRUST_STORE_JKS=
+HOST_IP=0.0.0.0
+HOST=$(hostname -s)
+HOST_FQDN=$(hostname -f)
+
+GENERATE_KEYS=true
+TRUST_STORE_TYPE=
+TRUST_STORE_FILE=
 TRUST_STORE_PASSWORD=
+KEY_STORE_TYPE=
+KEY_STORE_FILE=
+KEY_STORE_PASSWORD=
+AUTHORIZATION_URL=
+AUTHORIZATION_CERTIFICATE_TYPE=
+AUTHORIZATION_CERTIFICATE_FILE=
@@ -10,6 +10,10 @@ fi

 THIS_DIR="${THIS_SCRIPT%/*}"

+set -a
+. ${THIS_DIR}/timely-balancer-env.sh
+set +a
+
 if [ -n "$1" ]; then
  export PROFILE_NUM=$1
  PROFILE_ARG="--spring.profiles.active=${PROFILE_NUM}"
@@ -0,0 +1,9 @@
+trust.store.type=${TRUST_STORE_TYPE}
+trust.store.file=${TRUST_STORE_FILE}
+trust.store.password=${TRUST_STORE_PASSWORD}
+key.store.type=${KEY_STORE_TYPE}
+key.store.file=${KEY_STORE_FILE}
+key.store.password=${KEY_STORE_PASSWORD}
+authorization.url=${AUTHORIZATION_URL}
+authorization.certificate.type=${AUTHORIZATION_CERTIFICATE_TYPE}
+authorization.certificate.file=${AUTHORIZATION_CERTIFICATE_FILE}
@@ -1,51 +1,44 @@
 <beans:beans xmlns="http://www.springframework.org/schema/security"
-             xmlns:beans="http://www.springframework.org/schema/beans"
-             xmlns:util="http://www.springframework.org/schema/util"
-             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-             xsi:schemaLocation="http://www.springframework.org/schema/beans
+			 xmlns:beans="http://www.springframework.org/schema/beans"
+			 xmlns:util="http://www.springframework.org/schema/util"
+			 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+			 xmlns:context="http://www.springframework.org/schema/context"
+			 xsi:schemaLocation="http://www.springframework.org/schema/beans
 								 http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
 								 http://www.springframework.org/schema/security
 								 http://www.springframework.org/schema/security/spring-security.xsd
 								 http://www.springframework.org/schema/util
-								 http://www.springframework.org/schema/util/spring-util.xsd">
-		          
-	<beans:bean id="x509PrincipalExtractor" class="org.springframework.security.web.authentication.preauth.x509.SubjectDnX509PrincipalExtractor">
-		<beans:property name="subjectDnRegex" value="CN=(.*?)(?:,|$)"/>
+								 http://www.springframework.org/schema/util/spring-util.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">
+
+	<context:property-placeholder location="classpath:security.properties"/>
+
+	<beans:bean id="clientSsl" class="timely.configuration.ClientSsl">
+		<beans:property name="trustStoreType" value="${trust.store.type}"/>
+		<beans:property name="trustStoreFile" value="${trust.store.file}"/>
+		<beans:property name="trustStorePassword" value="${trust.store.password}"/>
+		<beans:property name="keyStoreType" value="${key.store.type}"/>
+		<beans:property name="keyStoreFile" value="${key.store.file}"/>
+		<beans:property name="keyStorePassword" value="${key.store.password}"/>
 	</beans:bean>

-	<beans:bean id="timelyUserDetailsService" class="timely.auth.UserDetailsService">
-		<beans:property name="users">
-			<util:list>
-				<beans:bean class="timely.auth.TimelyUser">
-					<beans:constructor-arg name="subjectDn">
-						<beans:value>CN=example.com</beans:value>
-					</beans:constructor-arg>
-					<beans:constructor-arg name="auths">
-						<util:list>
-							<beans:value>D</beans:value>
-							<beans:value>E</beans:value>
-							<beans:value>F</beans:value>
-						</util:list>
-					</beans:constructor-arg>
-					<beans:constructor-arg name="roles">
-						<util:list>
-							<beans:value>G</beans:value>
-							<beans:value>H</beans:value>
-							<beans:value>I</beans:value>
-						</util:list>
-					</beans:constructor-arg>
-				</beans:bean>
-			</util:list>
-		</beans:property>
+	<beans:bean id="authorizationProperties" class="timely.configuration.AuthorizationProperties">
+		<beans:property name="authorizationUrl" value="${authorization.url}"/>
+		<beans:property name="publicCertificateType" value="${authorization.certificate.type}"/>
+		<beans:property name="publicCertificateFile" value="${authorization.certificate.file}"/>
 	</beans:bean>
-    
-    <beans:bean id="x509AuthorizationProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
-    	<beans:property name="preAuthenticatedUserDetailsService" ref="timelyUserDetailsService" />
-    </beans:bean>
-    
-    <user-service id="usernamePasswordService">
-    	<user name="test" password="test1" authorities="A,B,C" />
-    </user-service>
+
+	<beans:bean id="remoteUserDetailsService" class="timely.auth.RemoteUserDetailsService">
+		<beans:constructor-arg ref="clientSsl"/>
+		<beans:constructor-arg ref="authorizationProperties"/>
+	</beans:bean>
+
+	<beans:bean id="x509AuthorizationProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
+		<beans:property name="preAuthenticatedUserDetailsService" ref="remoteUserDetailsService" />
+	</beans:bean>
+
+	<user-service id="usernamePasswordService">
+		<user name="test" password="test1" authorities="A,B,C" />
+	</user-service>

 	<beans:bean id="noOpPasswordEncoder" class="org.springframework.security.crypto.password.NoOpPasswordEncoder"/>

@@ -53,7 +46,7 @@
 		<beans:property name="userDetailsService" ref="usernamePasswordService"/>
 		<beans:property name="passwordEncoder" ref="noOpPasswordEncoder"/>
 	</beans:bean>
-	    
+
 	<authentication-manager alias="authenticationManager">
 		<!-- X509 PreAuthenticated authorization provider -->
 		<authentication-provider ref="x509AuthorizationProvider"/>
@@ -13,23 +13,25 @@ timely-balancer:
    allow-anonymous-http-access: true
    allow-anonymous-ws-access: true
    serverSsl:
-      certificate-file: ${SERVER_CERTIFICATE_FILE}
-      key-file: ${SERVER_KEY_FILE}
-      key-password: ${SERVER_KEY_PASSWORD}
-      use-generated-keypair: ${SERVER_USE_GENERATED_KEYPAIR}
-      trust-store-file: ${TRUST_STORE_PEM}
-      use-openssl: true
-      #use-ciphers:
+      key-store-type: ${KEY_STORE_TYPE}
+      key-store-file: ${KEY_STORE_FILE}
+      key-store-password: ${KEY_STORE_PASSWORD}
+      use-generated-keypair: ${GENERATE_KEYS}
+      ignore-ssl-handshake-errors: true
+      trust-store-type: ${TRUST_STORE_TYPE}
+      trust-store-file: ${TRUST_STORE_FILE}
+      trust-store-password: ${TRUST_STORE_PASSWORD}
    clientSsl:
-      keyFile: ${CLIENT_KEY_FILE}
-      keyType: ${CLIENT_KEY_TYPE}
-      keyPassword: ${CLIENT_KEY_PASSWORD}
-      trustStoreFile: ${TRUST_STORE_JKS}
-      trustStoreType: jks
-      trustStorePassword: ${TRUST_STORE_PASSWORD}
-    jwtCheckKeyStore:
-    jwtCheckKeyType:
-    jwtCheckKeyPassword:
+      key-store-type: ${KEY_STORE_TYPE}
+      key-store-file: ${KEY_STORE_FILE}
+      key-store-password: ${KEY_STORE_PASSWORD}
+      trust-store-type: ${TRUST_STORE_TYPE}
+      trust-store-file: ${TRUST_STORE_FILE}
+      trust-store-password: ${TRUST_STORE_PASSWORD}
+    jwtSsl:
+      key-store-type: ${AUTHORIZATION_CERTIFICATE_TYPE}
+      key-store-file: ${AUTHORIZATION_CERTIFICATE_FILE}
+      key-store-password: ${AUTHORIZATION_CERTIFICATE_PASSWORD}
  cache:
    enabled: false
    metric-age-off-hours:
@@ -13,30 +13,32 @@ timely-balancer:
    allow-anonymous-http-access: true
    allow-anonymous-ws-access: true
    serverSsl:
-      certificate-file:
-      key-file:
-      #key-password:
+      key-store-type:
+      key-store-file:
+      key-store-password:
      use-generated-keypair: true
+      ignore-ssl-handshake-errors: true
+      trust-store-type:
      trust-store-file:
-      use-openssl: true
-      #use-ciphers:
+      trust-store-password:
    clientSsl:
-      keyFile:
-      keyType: pkcs12
-      #keyPassword:
-      trustStoreFile:
-      trustStoreType: jks
-      #trustStorePassword:
-    jwtCheckKeyStore:
-    jwtCheckKeyType:
-    jwtCheckKeyPassword:
+      key-store-type:
+      key-store-file:
+      key-store-password:
+      trust-store-type:
+      trust-store-file:
+      trust-store-password:
+    jwtSsl:
+      key-store-type:
+      key-store-file:
+      key-store-password:
  cache:
    enabled: false
    metric-age-off-hours:
      default: 26
    nonCachedMetrics:
  server:
-    ip: 127.0.0.1
+    ip: 0.0.0.0
    tcpPort: 4242
    numTcpPools: 1
    tcpBufferSize: 100
@@ -77,7 +79,7 @@ timely-balancer:
      testOnReturn: false
  http:
    host: localhost
-    ip: 127.0.0.1
+    ip: 0.0.0.0
    port: 4243
    redirect-path: /secure-me
    strict-transport-max-age: 608400
@@ -106,7 +108,7 @@ timely-balancer:
      testOnBorrow: false
      testOnReturn: false
  websocket:
-    ip: 127.0.0.1
+    ip: 0.0.0.0
    port: 5244
    timeout: 60
    subscription-lag: 120
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.5</version>
+    <version>2.0.1</version>
  </parent>
  <artifactId>timely-balancer</artifactId>
  <dependencies>
@@ -51,12 +51,6 @@
    <dependency>
      <groupId>org.apache.accumulo</groupId>
      <artifactId>accumulo-core</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>org.slf4j</groupId>
-          <artifactId>slf4j-log4j12</artifactId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.apache.accumulo</groupId>
@@ -97,12 +91,6 @@
    <dependency>
      <groupId>org.apache.hadoop</groupId>
      <artifactId>hadoop-common</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>jdk.tools</groupId>
-          <artifactId>jdk.tools</artifactId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.apache.hadoop</groupId>
@@ -119,12 +107,6 @@
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>org.springframework.boot</groupId>
-          <artifactId>spring-boot-starter-logging</artifactId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
@@ -1,10 +1,10 @@
 package timely.balancer;

+import static org.apache.accumulo.core.conf.ConfigurationTypeHelper.getTimeInMillis;
 import static timely.Server.SERVICE_DISCOVERY_PATH;
 import static timely.store.cache.DataStoreCache.NON_CACHED_METRICS;
 import static timely.store.cache.DataStoreCache.NON_CACHED_METRICS_LOCK_PATH;

-import java.io.File;
 import java.net.InetSocketAddress;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
@@ -51,13 +51,11 @@ import io.netty.handler.ssl.OpenSslServerContext;
 import io.netty.handler.ssl.OpenSslServerSessionContext;
 import io.netty.handler.ssl.SslContext;
 import io.netty.handler.ssl.SslContextBuilder;
-import io.netty.handler.ssl.SslProvider;
 import io.netty.handler.ssl.util.SelfSignedCertificate;
 import io.netty.handler.stream.ChunkedWriteHandler;
 import io.netty.handler.timeout.IdleStateHandler;
 import io.netty.util.NettyRuntime;
 import io.netty.util.internal.SystemPropertyUtil;
-import org.apache.accumulo.core.conf.AccumuloConfiguration;
 import org.apache.curator.RetryPolicy;
 import org.apache.curator.framework.CuratorFramework;
 import org.apache.curator.framework.CuratorFrameworkFactory;
@@ -71,8 +69,8 @@ import org.springframework.boot.builder.SpringApplicationBuilder;
 import org.springframework.context.ConfigurableApplicationContext;
 import timely.auth.AuthCache;
 import timely.auth.JWTTokenHandler;
+import timely.auth.util.SslHelper;
 import timely.balancer.configuration.BalancerConfiguration;
-import timely.balancer.configuration.ClientSsl;
 import timely.balancer.configuration.SpringBootstrap;
 import timely.balancer.connection.http.HttpClientPool;
 import timely.balancer.connection.tcp.TcpClientPool;
@@ -86,6 +84,7 @@ import timely.balancer.netty.ws.WsRelayHandler;
 import timely.balancer.resolver.BalancedMetricResolver;
 import timely.balancer.resolver.MetricResolver;
 import timely.client.http.HttpClient;
+import timely.configuration.ClientSsl;
 import timely.configuration.ServerSsl;
 import timely.netty.http.HttpStaticFileServerHandler;
 import timely.netty.http.NonSslRedirectHandler;
@@ -323,32 +322,13 @@ public class Balancer {
            SelfSignedCertificate ssc = new SelfSignedCertificate("localhost", begin, end);
            ssl = SslContextBuilder.forServer(ssc.certificate(), ssc.privateKey());
        } else {
-            String cert = sslCfg.getCertificateFile();
-            String key = sslCfg.getKeyFile();
-            String keyPass = sslCfg.getKeyPassword();
-            if (null == cert || null == key) {
+            if (null == sslCfg.getKeyStoreFile()) {
                throw new IllegalArgumentException("Check your SSL properties, something is wrong.");
            }
-            ssl = SslContextBuilder.forServer(new File(cert), new File(key), keyPass);
+            ssl = SslHelper.getSslContextBuilder(sslCfg);
        }
-
-        ssl.ciphers(sslCfg.getUseCiphers());
-
        // Can't set to REQUIRE because the CORS pre-flight requests will fail.
        ssl.clientAuth(ClientAuth.OPTIONAL);
-
-        Boolean useOpenSSL = sslCfg.isUseOpenssl();
-        if (useOpenSSL) {
-            ssl.sslProvider(SslProvider.OPENSSL);
-        } else {
-            ssl.sslProvider(SslProvider.JDK);
-        }
-        String trustStore = sslCfg.getTrustStoreFile();
-        if (null != trustStore) {
-            if (!trustStore.isEmpty()) {
-                ssl.trustManager(new File(trustStore));
-            }
-        }
        return ssl.build();
    }

@@ -356,7 +336,7 @@ public class Balancer {

        ClientSsl ssl = config.getSecurity().getClientSsl();
        return HttpClient.getSSLContext(ssl.getTrustStoreFile(), ssl.getTrustStoreType(), ssl.getTrustStorePassword(),
-                ssl.getKeyFile(), ssl.getKeyType(), ssl.getKeyPassword());
+                ssl.getKeyStoreFile(), ssl.getKeyStoreType(), ssl.getKeyStorePassword());
    }

    private void ensureZkPaths(CuratorFramework curatorFramework, String[] paths) {
@@ -378,15 +358,14 @@ public class Balancer {

        // start curator framework
        RetryPolicy retryPolicy = new RetryForever(1000);
-        int timeout = Long.valueOf(AccumuloConfiguration.getTimeInMillis(balancerConfig.getZooKeeper().getTimeout()))
-                .intValue();
+        int timeout = Long.valueOf(getTimeInMillis(balancerConfig.getZooKeeper().getTimeout())).intValue();
        curatorFramework = CuratorFrameworkFactory.newClient(balancerConfig.getZooKeeper().getServers(), timeout, 10000,
                retryPolicy);
        curatorFramework.start();
        ensureZkPaths(curatorFramework, zkPaths);

        AuthCache.configure(balancerConfig.getSecurity());
-        JWTTokenHandler.init(balancerConfig.getSecurity(), null);
+        JWTTokenHandler.init(balancerConfig.getSecurity().getJwtSsl(), null);
        final boolean useEpoll = useEpoll();
        Class<? extends ServerSocketChannel> channelClass;
        Class<? extends Channel> datagramChannelClass;
@@ -537,12 +516,12 @@ public class Balancer {
                ch.pipeline().addLast("queryDecoder", new timely.netty.http.HttpRequestDecoder(
                        balancerConfig.getSecurity(), balancerConfig.getHttp()));
                ch.pipeline().addLast("fileServer", new HttpStaticFileServerHandler().setIgnoreSslHandshakeErrors(
-                        balancerConfig.getSecurity().getServerSsl().isUseGeneratedKeypair()));
+                        balancerConfig.getSecurity().getServerSsl().isIgnoreSslHandshakeErrors()));
                ch.pipeline().addLast("login",
                        new X509LoginRequestHandler(balancerConfig.getSecurity(), balancerConfig.getHttp()));
                ch.pipeline().addLast("httpRelay", new HttpRelayHandler(metricResolver, httpClientPool));
                ch.pipeline().addLast("error", new TimelyExceptionHandler().setIgnoreSslHandshakeErrors(
-                        balancerConfig.getSecurity().getServerSsl().isUseGeneratedKeypair()));
+                        balancerConfig.getSecurity().getServerSsl().isIgnoreSslHandshakeErrors()));
            }
        };
    }
@@ -3,6 +3,7 @@ package timely.balancer.configuration;
 import javax.validation.Valid;

 import org.springframework.boot.context.properties.NestedConfigurationProperty;
+import timely.configuration.ClientSsl;
 import timely.configuration.Security;

 public class BalancerSecurity extends Security {
@@ -1,77 +0,0 @@
-package timely.balancer.configuration;
-
-public class ClientSsl {
-
-    private String keyFile;
-    private String keyType;
-    private String keyPassword;
-    private String trustStoreFile;
-    private String trustStoreType;
-    private String trustStorePassword;
-    private boolean useClientCert = true;
-    private boolean hostVerificationEnabled = true;
-
-    public String getKeyFile() {
-        return keyFile;
-    }
-
-    public void setKeyFile(String keyFile) {
-        this.keyFile = keyFile;
-    }
-
-    public String getKeyType() {
-        return keyType;
-    }
-
-    public void setKeyType(String keyType) {
-        this.keyType = keyType;
-    }
-
-    public String getKeyPassword() {
-        return keyPassword;
-    }
-
-    public void setKeyPassword(String keyPassword) {
-        this.keyPassword = keyPassword;
-    }
-
-    public String getTrustStoreFile() {
-        return trustStoreFile;
-    }
-
-    public void setTrustStoreFile(String trustStoreFile) {
-        this.trustStoreFile = trustStoreFile;
-    }
-
-    public String getTrustStoreType() {
-        return trustStoreType;
-    }
-
-    public void setTrustStoreType(String trustStoreType) {
-        this.trustStoreType = trustStoreType;
-    }
-
-    public String getTrustStorePassword() {
-        return trustStorePassword;
-    }
-
-    public void setTrustStorePassword(String trustStorePassword) {
-        this.trustStorePassword = trustStorePassword;
-    }
-
-    public void setUseClientCert(boolean useClientCert) {
-        this.useClientCert = useClientCert;
-    }
-
-    public boolean isUseClientCert() {
-        return useClientCert;
-    }
-
-    public void setHostVerificationEnabled(boolean hostVerificationEnabled) {
-        this.hostVerificationEnabled = hostVerificationEnabled;
-    }
-
-    public boolean isHostVerificationEnabled() {
-        return hostVerificationEnabled;
-    }
-}
@@ -31,8 +31,8 @@ import java.util.concurrent.locks.ReentrantReadWriteLock;

 import com.csvreader.CsvReader;
 import com.csvreader.CsvWriter;
-import org.apache.commons.lang.StringUtils;
 import org.apache.commons.lang3.SerializationUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.apache.curator.framework.CuratorFramework;
 import org.apache.curator.framework.recipes.atomic.DistributedAtomicLong;
 import org.apache.curator.framework.recipes.atomic.DistributedAtomicValue;
@@ -4,13 +4,13 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.5</version>
+    <version>2.0.1</version>
  </parent>
  <artifactId>timely-client</artifactId>
  <properties>
    <!-- PEP 440 compliant version gets substituted into src/main/python/template/setup.py -->
    <!-- use .dev0 instead of -SNAPSHOT -->
-    <python.client.version>1.3.5</python.client.version>
+    <python.client.version>2.0.1</python.client.version>
  </properties>
  <dependencies>
    <dependency>
@@ -33,7 +33,7 @@ public class TcpClient implements AutoCloseable {

    /**
     * Opens a TCP connection to the specified host and port
-     * 
+     *
     * @throws IOException
     *             if an error occurs
     */
@@ -45,7 +45,7 @@ public class TcpClient implements AutoCloseable {

    /**
     * Write a metric to Timely
-     * 
+     *
     * @param metric
     *            newline terminated string representation of Timely metric
     */
@@ -69,7 +69,7 @@ public class TcpClient implements AutoCloseable {

    /**
     * Closes the tcp connection to Timely
-     * 
+     *
     * @throws IOException
     *             if an error occurs
     */
@@ -6,7 +6,6 @@ import java.util.Map;
 import javax.websocket.CloseReason;
 import javax.websocket.Endpoint;
 import javax.websocket.EndpointConfig;
-import javax.websocket.MessageHandler;
 import javax.websocket.Session;

 import org.slf4j.Logger;
@@ -19,12 +18,8 @@ public abstract class ClientHandler extends Endpoint {
    @Override
    public void onOpen(Session session, EndpointConfig config) {
        LOG.info("Websocket session {} opened.", session.getId());
-        session.addMessageHandler(new MessageHandler.Whole<String>() {
-
-            @Override
-            public void onMessage(String message) {
-                LOG.info("Message received on Websocket session {}: {}", session.getId(), message);
-            }
+        session.addMessageHandler(String.class, message -> {
+            LOG.info("Message received on Websocket session {}: {}", session.getId(), message);
        });
    }

@@ -6,7 +6,9 @@ import java.lang.reflect.Modifier;
 import java.util.HashSet;
 import java.util.Set;
 import java.util.Stack;
-import java.util.logging.Logger;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;

 /**
 * A simple interface that objects can implement to return the object size.
@@ -46,7 +48,7 @@ public interface ObjectSizeOf {

    public static class Sizer {

-        private static final Logger log = Logger.getLogger(Sizer.class.getCanonicalName());
+        private static final Logger LOG = LoggerFactory.getLogger(Sizer.class);
        public static final short OBJECT_OVERHEAD = 8;
        public static final short ARRAY_OVERHEAD = 12;
        public static final short REFERENCE = 4;
@@ -150,7 +152,7 @@ public interface ObjectSizeOf {
                            }
                        }
                    } catch (Throwable t) {
-                        log.warning("Unable to determine object size for " + o);
+                        LOG.warn("Unable to determine object size for " + o, t);
                    }
                    if (debug) {
                        System.out.println(o.getClass().getCanonicalName() + "=" + size);
@@ -46,7 +46,7 @@ public class TagListParser implements Parser<List<Tag>>, Combiner<Collection<Tag
    /**
     * An alternative combiner for a map of string to string instead of a list of
     * tags
-     * 
+     *
     * @return string representation
     */
    public String combine(Map<String, String> tags) {
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.5</version>
+    <version>2.0.1</version>
  </parent>
  <artifactId>collectd-nsq-plugin</artifactId>
  <dependencies>
@@ -36,6 +36,7 @@ public class WriteNSQPlugin extends CollectDPluginParent
    private String topic = "metrics#ephemeral";
    private String endpoint = null;
    private GenericObjectPool<CloseableHttpClient> clientPool = null;
+    private Random random = new Random();

    // pool should be limited by the number of WriteThreads configured in
    // collectd
@@ -88,10 +89,10 @@ public class WriteNSQPlugin extends CollectDPluginParent
            if (client != null) {
                clientPool.returnObject(client);
            }
-                try {
-                    out.close();
-                } catch (IOException e) {
-                }
+            try {
+                out.close();
+            } catch (IOException e) {
+            }
        }
        return 0;
    }
@@ -139,7 +140,7 @@ public class WriteNSQPlugin extends CollectDPluginParent
                    if (hosts.length == 1) {
                        host = hosts[0];
                    } else {
-                        host = hosts[new Random().nextInt(hosts.length)];
+                        host = hosts[random.nextInt(hosts.length)];
                    }
                    break;
                case "Port":
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.5</version>
+    <version>2.0.1</version>
  </parent>
  <artifactId>collectd-plugin-parent</artifactId>
  <dependencies>
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.5</version>
+    <version>2.0.1</version>
  </parent>
  <artifactId>collectd-timely-plugin</artifactId>
  <dependencies>
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.5</version>
+    <version>2.0.1</version>
  </parent>
  <artifactId>timely-common</artifactId>
  <dependencies>
@@ -1,42 +0,0 @@
-#!/bin/bash
-
-if [[ `uname` == "Darwin" ]]; then
-        THIS_SCRIPT=`python -c 'import os,sys; print os.path.realpath(sys.argv[1])' $0`
-        TCNATIVE_SUFFIX="jnilib"
-else
-        THIS_SCRIPT=`readlink -f $0`
-        TCNATIVE_SUFFIX="so"
-fi
-
-THIS_DIR="${THIS_SCRIPT%/*}"
-NATIVE_DIR="${THIS_DIR}/META-INF/native"
-BASE_DIR=${THIS_DIR}/..
-TMP_DIR="${BASE_DIR}/tmp"
-CONF_DIR="${BASE_DIR}/conf"
-LIB_DIR="${BASE_DIR}/lib"
-NUM_SERVER_THREADS=4
-
-if [[ -e ${TMP_DIR} ]]; then
-  rm -rf ${TMP_DIR}
-fi
-mkdir ${TMP_DIR}
-
-if [[ -e ${NATIVE_DIR} ]]; then
-  rm -rf ${NATIVE_DIR}
-fi
-mkdir -p ${NATIVE_DIR}
-
-pushd ${BASE_DIR}/bin
-$JAVA_HOME/bin/jar xf ${LIB_DIR}/netty-tcnative-boringssl-static*.jar META-INF/native/libnetty_tcnative_linux_x86_64.${TCNATIVE_SUFFIX}
-$JAVA_HOME/bin/jar xf ${LIB_DIR}/netty-all*.jar META-INF/native/libnetty_transport_native_epoll_x86_64.${TCNATIVE_SUFFIX}
-popd
-
-export CLASSPATH="${CONF_DIR}:${LIB_DIR}/*:${HADOOP_CONF_DIR}"
-JVM_ARGS="-Xmx1G -Xms1G -Dio.netty.eventLoopThreads=${NUM_SERVER_THREADS} Dlog4j.configurationFile=${CONF_DIR}/log4j2-spring.xml"
-JVM_ARGS="${JVM_ARGS} -DLog4jContextSelector=org.apache.logging.log4j.core.async.AsyncLoggerContextSelector"
-JVM_ARGS="${JVM_ARGS} -Djava.library.path=${NATIVE_DIR}"
-
-#JVM_ARGS="${JVM_ARGS} -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005"
-
-echo "$JAVA_HOME/bin/java ${JVM_ARGS} timely.grafana.auth.GrafanaAuth --spring.config.name=grafana-auth"
-$JAVA_HOME/bin/java ${JVM_ARGS} timely.grafana.auth.GrafanaAuth --spring.config.name=grafana-auth
@@ -1,55 +0,0 @@
-grafana-auth:
-  grafana:
-    host: localhost
-    port: 3001
-  security:
-    session-max-age: 86400
-    cache-expiration-minutes: 60
-    cache-refresh-minutes: 5
-    allow-anonymous-http-access: true
-    allow-anonymous-ws-access: true
-    serverSsl:
-      certificate-file:
-      key-file:
-      #key-password:
-      use-generated-keypair: true
-      trust-store-file:
-      use-openssl: true
-      #use-ciphers:
-    clientSsl:
-      keyFile:
-      keyType: pkcs12
-      #keyPassword:
-      trustStoreFile:
-      trustStoreType: jks
-      #trustStorePassword:
-  http:
-    host: localhost
-    ip: 127.0.0.1
-    port: 3000
-    redirect-path: /secure-me
-    strict-transport-max-age: 608400
-    cors:
-      allow-any-origin: false
-      allow-null-origin: false
-      allow-credentials: true
-      allowed-origins:
-      allowed-methods: DELETE,GET,HEAD,OPTIONS,PUT,POST
-      allowed-headers: content-type
-    httpClientPool:
-      minIdlePerKey: 0
-      maxIdlePerKey: 40
-      maxTotalPerKey: 40
-      maxTotal: -1
-      lifo: true
-      fairness: false
-      maxWaitMillis: -1
-      minEvictableIdleTimeMillis: 1800000
-      evictorShutdownTimeoutMillis: 10000
-      softMinEvictableIdleTimeMillis: -1
-      numTestsPerEvictionRun: 3
-      timeBetweenEvictionRunsMillis: -1
-      blockWhenExhausted: true
-      jmxEnabled: true
-      testOnBorrow: false
-      testOnReturn: false
@@ -1,13 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Configuration status="warn" monitorInterval="60">
-  <Appenders>
-    <Console name="Console" target="SYSTEM_OUT">
-      <PatternLayout pattern="%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n"/>
-    </Console>
-  </Appenders>
-  <Loggers>
-    <Root level="error" includeLocation="false">
-      <AppenderRef ref="Console" level="error" />
-    </Root>
-  </Loggers>
-</Configuration>
@@ -1,29 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Configuration status="warn" monitorInterval="60">
-  <Properties>
-    <Property name="PID">????</Property>
-    <Property name="LOG_PATTERN">%clr{%d{yyyy-MM-dd HH:mm:ss.SSS}}{faint} %clr{%5p} %clr{${sys:PID}}{magenta} %clr{---}{faint} %clr{[%15.15t]}{faint} %clr{%-40.40c{1.}}{cyan} %clr{:}{faint} %m%n%wEx</Property>
-  </Properties>
-  <Appenders>
-    <RollingRandomAccessFile name="Rolling" fileName="/srv/logs/timely/grafana-auth.log"
-    						 filePattern="/srv/logs/timely/$${date:yyyy-MM}/grafana-auth-%d{MM-dd-yyyy}-%i.log.gz">
-      <PatternLayout pattern="${LOG_PATTERN}"/>
-      <Policies>
-      	<SizeBasedTriggeringPolicy size="1024 MB" />
-      </Policies>
-      <DefaultRolloverStrategy max="10" />
-    </RollingRandomAccessFile>
-    <Console name="Console" target="SYSTEM_OUT">
-      <PatternLayout pattern="${LOG_PATTERN}"/>
-    </Console>
-  </Appenders>
-  <Loggers>
-    <Root level="trace" includeLocation="false">
-      <AppenderRef ref="Console" level="warn" />
-      <AppenderRef ref="Rolling" level="trace" />
-    </Root>
-    <Logger name="timely" additivity="false">
-      <AppenderRef ref="Console" level="debug" />
-    </Logger>
-  </Loggers>
-</Configuration>
@@ -1,71 +0,0 @@
-<beans:beans xmlns="http://www.springframework.org/schema/security"
-             xmlns:beans="http://www.springframework.org/schema/beans"
-             xmlns:util="http://www.springframework.org/schema/util"
-             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-             xsi:schemaLocation="http://www.springframework.org/schema/beans
-								 http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
-								 http://www.springframework.org/schema/security
-								 http://www.springframework.org/schema/security/spring-security.xsd
-								 http://www.springframework.org/schema/util
-								 http://www.springframework.org/schema/util/spring-util.xsd">
-		          
-	<beans:bean id="x509PrincipalExtractor" class="org.springframework.security.web.authentication.preauth.x509.SubjectDnX509PrincipalExtractor">
-		<beans:property name="subjectDnRegex" value="CN=(.*?)(?:,|$)"/>
-	</beans:bean>
-
-	<beans:bean id="timelyUserDetailsService" class="timely.auth.UserDetailsService">
-		<beans:property name="users">
-			<util:list>
-				<beans:bean class="timely.auth.TimelyUser">
-					<beans:constructor-arg name="subjectDn">
-						<beans:value>CN=example.com</beans:value>
-					</beans:constructor-arg>
-					<beans:constructor-arg name="auths">
-						<util:list>
-							<beans:value>D</beans:value>
-							<beans:value>E</beans:value>
-							<beans:value>F</beans:value>
-						</util:list>
-					</beans:constructor-arg>
-					<beans:constructor-arg name="roles">
-						<util:list>
-							<beans:value>G</beans:value>
-							<beans:value>H</beans:value>
-							<beans:value>I</beans:value>
-						</util:list>
-					</beans:constructor-arg>
-				</beans:bean>
-			</util:list>
-		</beans:property>
-	</beans:bean>
-    
-    <beans:bean id="x509AuthorizationProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
-    	<beans:property name="preAuthenticatedUserDetailsService" ref="timelyUserDetailsService" />
-    </beans:bean>
-    
-    <user-service id="usernamePasswordService">
-    	<user name="test" password="test1" authorities="A,B,C" />
-    </user-service>
-
-	<beans:bean id="noOpPasswordEncoder" class="org.springframework.security.crypto.password.NoOpPasswordEncoder"/>
-
-	<beans:bean id="UserNamePasswordAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
-		<beans:property name="userDetailsService" ref="usernamePasswordService"/>
-		<beans:property name="passwordEncoder" ref="noOpPasswordEncoder"/>
-	</beans:bean>
-	    
-	<authentication-manager alias="authenticationManager">
-		<!-- X509 PreAuthenticated authorization provider -->
-		<authentication-provider ref="x509AuthorizationProvider"/>
-		<!-- Basic authorization provider, validates provided username and password -->
-		<authentication-provider ref="UserNamePasswordAuthenticationProvider" />
-	</authentication-manager>
-
-	<util:list id="requiredRoles" value-type="java.lang.String">
-		<beans:value></beans:value>
-	</util:list>
-
-	<util:list id="requiredAuths" value-type="java.lang.String">
-		<beans:value></beans:value>
-	</util:list>
-</beans:beans>
@@ -1,295 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
-  <modelVersion>4.0.0</modelVersion>
-  <parent>
-    <groupId>timely</groupId>
-    <artifactId>timely</artifactId>
-    <version>1.3.5</version>
-  </parent>
-  <artifactId>grafana-auth</artifactId>
-  <dependencies>
-    <dependency>
-      <groupId>com.fasterxml.jackson.core</groupId>
-      <artifactId>jackson-annotations</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>com.fasterxml.jackson.core</groupId>
-      <artifactId>jackson-core</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>com.fasterxml.jackson.core</groupId>
-      <artifactId>jackson-databind</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>com.fasterxml.jackson.datatype</groupId>
-      <artifactId>jackson-datatype-jdk8</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>com.github.ben-manes.caffeine</groupId>
-      <artifactId>caffeine</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>com.google.flatbuffers</groupId>
-      <artifactId>flatbuffers-java</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>commons-beanutils</groupId>
-      <artifactId>commons-beanutils</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>io.github.lukehutch</groupId>
-      <artifactId>fast-classpath-scanner</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>io.netty</groupId>
-      <artifactId>netty-all</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>net.sourceforge.javacsv</groupId>
-      <artifactId>javacsv</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.accumulo</groupId>
-      <artifactId>accumulo-core</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>org.slf4j</groupId>
-          <artifactId>slf4j-log4j12</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.accumulo</groupId>
-      <artifactId>accumulo-minicluster</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.commons</groupId>
-      <artifactId>commons-collections4</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.commons</groupId>
-      <artifactId>commons-lang3</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.commons</groupId>
-      <artifactId>commons-pool2</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.curator</groupId>
-      <artifactId>curator-client</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.curator</groupId>
-      <artifactId>curator-framework</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.curator</groupId>
-      <artifactId>curator-recipes</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.curator</groupId>
-      <artifactId>curator-x-discovery</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.hadoop</groupId>
-      <artifactId>hadoop-client</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.hadoop</groupId>
-      <artifactId>hadoop-common</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>jdk.tools</groupId>
-          <artifactId>jdk.tools</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.hadoop</groupId>
-      <artifactId>hadoop-minicluster</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>slf4j-api</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-websocket</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-starter</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>org.springframework.boot</groupId>
-          <artifactId>spring-boot-starter-logging</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-starter-log4j2</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-starter-validation</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.security</groupId>
-      <artifactId>spring-security-config</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.security</groupId>
-      <artifactId>spring-security-web</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>timely</groupId>
-      <artifactId>timely-balancer</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>timely</groupId>
-      <artifactId>timely-client</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>timely</groupId>
-      <artifactId>timely-common</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>timely</groupId>
-      <artifactId>timely-server</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>com.lmax</groupId>
-      <artifactId>disruptor</artifactId>
-      <scope>runtime</scope>
-    </dependency>
-    <dependency>
-      <groupId>io.netty</groupId>
-      <artifactId>netty-tcnative-boringssl-static</artifactId>
-      <scope>runtime</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.logging.log4j</groupId>
-      <artifactId>log4j-api</artifactId>
-      <scope>runtime</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.logging.log4j</groupId>
-      <artifactId>log4j-core</artifactId>
-      <scope>runtime</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.logging.log4j</groupId>
-      <artifactId>log4j-slf4j-impl</artifactId>
-      <scope>runtime</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.javassist</groupId>
-      <artifactId>javassist</artifactId>
-      <scope>runtime</scope>
-    </dependency>
-    <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.jsoup</groupId>
-      <artifactId>jsoup</artifactId>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-test-autoconfigure</artifactId>
-      <scope>test</scope>
-    </dependency>
-  </dependencies>
-  <build>
-    <plugins>
-      <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-assembly-plugin</artifactId>
-        <executions>
-          <execution>
-            <id>assemble</id>
-            <goals>
-              <goal>single</goal>
-            </goals>
-            <phase>package</phase>
-            <configuration>
-              <descriptors>
-                <descriptor>src/main/dist/assembly.xml</descriptor>
-              </descriptors>
-            </configuration>
-          </execution>
-        </executions>
-      </plugin>
-      <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-dependency-plugin</artifactId>
-        <executions>
-          <execution>
-            <id>copy-dependencies</id>
-            <goals>
-              <goal>copy-dependencies</goal>
-            </goals>
-            <phase>prepare-package</phase>
-            <configuration>
-              <excludeArtifactIds>junit</excludeArtifactIds>
-              <outputDirectory>${project.build.directory}/lib</outputDirectory>
-            </configuration>
-          </execution>
-          <execution>
-            <id>unpack-native</id>
-            <goals>
-              <goal>unpack</goal>
-            </goals>
-            <phase>process-test-classes</phase>
-            <configuration>
-              <artifactItems>
-                <artifactItem>
-                  <groupId>io.netty</groupId>
-                  <artifactId>netty-tcnative-boringssl-static</artifactId>
-                  <version>${version.netty-tcnative}</version>
-                  <type>jar</type>
-                  <overWrite>false</overWrite>
-                  <outputDirectory>${project.build.directory}/native</outputDirectory>
-                  <includes>**/*.so</includes>
-                </artifactItem>
-              </artifactItems>
-            </configuration>
-          </execution>
-        </executions>
-      </plugin>
-      <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-failsafe-plugin</artifactId>
-      </plugin>
-      <plugin>
-        <groupId>org.codehaus.mojo</groupId>
-        <artifactId>build-helper-maven-plugin</artifactId>
-        <executions>
-          <execution>
-            <id>add-source</id>
-            <goals>
-              <goal>add-source</goal>
-            </goals>
-            <phase>generate-sources</phase>
-            <configuration>
-              <sources>
-                <source>src/main/generated-java</source>
-              </sources>
-            </configuration>
-          </execution>
-        </executions>
-      </plugin>
-    </plugins>
-    <extensions>
-      <!-- Use os-maven-plugin to initialize the "os.detected" properties -->
-      <extension>
-        <groupId>kr.motd.maven</groupId>
-        <artifactId>os-maven-plugin</artifactId>
-      </extension>
-    </extensions>
-  </build>
-</project>
@@ -1,55 +0,0 @@
-<assembly xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3" 
-  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-  xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3 http://maven.apache.org/xsd/assembly-1.1.3.xsd">
-  <id>dist</id>
-  <formats>
-    <format>tar.gz</format>
-  </formats>
-  <fileSets>
-    <fileSet>
-      <directory>${project.basedir}</directory>
-      <outputDirectory></outputDirectory>
-      <includes>
-        <include>README*</include>
-        <include>LICENSE*</include>
-        <include>NOTICE*</include>
-      </includes>
-    </fileSet>
-    <fileSet>
-      <directory>${project.build.directory}</directory>
-      <outputDirectory>lib</outputDirectory>
-      <includes>
-        <include>timely*.jar</include>
-        <include>grafana*.jar</include>
-      </includes>
-    </fileSet>
-    <fileSet>
-      <directory>${project.build.directory}/lib</directory>
-      <outputDirectory>lib</outputDirectory>
-      <includes>
-        <include>*.jar</include>
-      </includes>
-     </fileSet>
-    <fileSet>
-      <directory>${project.basedir}/bin</directory>
-      <outputDirectory>bin</outputDirectory>
-      <includes>
-        <include>**/*</include>
-      </includes>
-     </fileSet>
-    <fileSet>
-      <directory>${project.basedir}/conf</directory>
-      <outputDirectory>conf</outputDirectory>
-      <includes>
-        <include>*</include>
-      </includes>
-     </fileSet>
-	<fileSet>
-	  <directory>${project.basedir}/src/main/resources/webapp</directory>
-	  <outputDirectory>bin/webapp</outputDirectory>
-	  <includes>
-		<include>*</include>
-	  </includes>
-	</fileSet>
-  </fileSets>
-</assembly>
@@ -1,322 +0,0 @@
-package timely.grafana.auth;
-
-import java.io.File;
-import java.net.InetSocketAddress;
-import java.nio.charset.StandardCharsets;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.List;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.Future;
-import java.util.concurrent.TimeUnit;
-
-import javax.net.ssl.SSLContext;
-
-import io.netty.bootstrap.ServerBootstrap;
-import io.netty.buffer.PooledByteBufAllocator;
-import io.netty.channel.Channel;
-import io.netty.channel.ChannelFuture;
-import io.netty.channel.ChannelHandler;
-import io.netty.channel.ChannelInitializer;
-import io.netty.channel.ChannelOption;
-import io.netty.channel.EventLoopGroup;
-import io.netty.channel.epoll.EpollEventLoopGroup;
-import io.netty.channel.epoll.EpollServerSocketChannel;
-import io.netty.channel.nio.NioEventLoopGroup;
-import io.netty.channel.socket.ServerSocketChannel;
-import io.netty.channel.socket.SocketChannel;
-import io.netty.channel.socket.nio.NioServerSocketChannel;
-import io.netty.handler.codec.http.HttpContentCompressor;
-import io.netty.handler.codec.http.HttpContentDecompressor;
-import io.netty.handler.codec.http.HttpObjectAggregator;
-import io.netty.handler.codec.http.HttpRequestDecoder;
-import io.netty.handler.codec.http.HttpResponseEncoder;
-import io.netty.handler.logging.LoggingHandler;
-import io.netty.handler.ssl.ClientAuth;
-import io.netty.handler.ssl.OpenSslServerContext;
-import io.netty.handler.ssl.OpenSslServerSessionContext;
-import io.netty.handler.ssl.SslContext;
-import io.netty.handler.ssl.SslContextBuilder;
-import io.netty.handler.ssl.SslProvider;
-import io.netty.handler.ssl.util.SelfSignedCertificate;
-import io.netty.handler.stream.ChunkedWriteHandler;
-import io.netty.util.internal.SystemPropertyUtil;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.boot.WebApplicationType;
-import org.springframework.boot.builder.SpringApplicationBuilder;
-import org.springframework.context.ConfigurableApplicationContext;
-import timely.auth.AuthCache;
-import timely.balancer.configuration.ClientSsl;
-import timely.balancer.connection.http.HttpClientPool;
-import timely.client.http.HttpClient;
-import timely.configuration.ServerSsl;
-import timely.grafana.auth.configuration.GrafanaAuthConfiguration;
-import timely.grafana.auth.configuration.SpringBootstrap;
-import timely.grafana.auth.netty.http.GrafanaRelayHandler;
-import timely.grafana.auth.netty.http.GrafanaRequestDecoder;
-import timely.netty.http.HttpStaticFileServerHandler;
-import timely.netty.http.NonSslRedirectHandler;
-import timely.netty.http.TimelyExceptionHandler;
-import timely.netty.http.auth.X509LoginRequestHandler;
-
-public class GrafanaAuth {
-
-    private static final Logger LOG = LoggerFactory.getLogger(GrafanaAuth.class);
-    private static final int EPOLL_MIN_MAJOR_VERSION = 2;
-    private static final int EPOLL_MIN_MINOR_VERSION = 6;
-    private static final int EPOLL_MIN_PATCH_VERSION = 32;
-    private static final String OS_NAME = "os.name";
-    private static final String OS_VERSION = "os.version";
-    protected static final CountDownLatch LATCH = new CountDownLatch(1);
-    static ConfigurableApplicationContext applicationContext;
-
-    private final GrafanaAuthConfiguration grafanaAuthConfig;
-    private EventLoopGroup httpWorkerGroup = null;
-    private EventLoopGroup httpBossGroup = null;
-    protected Channel httpChannelHandle = null;
-    protected volatile boolean shutdown = false;
-
-    public GrafanaAuth(GrafanaAuthConfiguration grafanaAuthConfig) throws Exception {
-        this.grafanaAuthConfig = grafanaAuthConfig;
-    }
-
-    protected static ConfigurableApplicationContext initializeContext(String[] args) {
-        SpringApplicationBuilder builder = new SpringApplicationBuilder(SpringBootstrap.class);
-        builder.web(WebApplicationType.NONE);
-        builder.registerShutdownHook(false);
-        return builder.run(args);
-    }
-
-    private void shutdownHook() {
-
-        final Runnable shutdownRunner = () -> {
-            if (!shutdown) {
-                shutdown();
-            }
-        };
-        final Thread hook = new Thread(shutdownRunner, "shutdown-hook-thread");
-        Runtime.getRuntime().addShutdownHook(hook);
-    }
-
-    public void shutdown() {
-        List<ChannelFuture> channelFutures = new ArrayList<>();
-
-        if (httpChannelHandle != null) {
-            LOG.info("Closing httpChannelHandle");
-            channelFutures.add(httpChannelHandle.close());
-        }
-
-        // wait for the channels to shutdown
-        channelFutures.forEach(f -> {
-            try {
-                f.get();
-            } catch (final Exception e) {
-                LOG.error("Channel:" + f.channel().config() + " -> " + e.getMessage(), e);
-            }
-        });
-
-        int quietPeriod = grafanaAuthConfig.getShutdownQuietPeriod();
-        List<Future<?>> groupFutures = new ArrayList<>();
-
-        if (httpBossGroup != null) {
-            LOG.info("Shutting down httpBossGroup");
-            groupFutures.add(httpBossGroup.shutdownGracefully(quietPeriod, 10, TimeUnit.SECONDS));
-        }
-
-        if (httpWorkerGroup != null) {
-            LOG.info("Shutting down httpWorkerGroup");
-            groupFutures.add(httpWorkerGroup.shutdownGracefully(quietPeriod, 10, TimeUnit.SECONDS));
-        }
-
-        groupFutures.parallelStream().forEach(f -> {
-            try {
-                f.get();
-            } catch (final Exception e) {
-                LOG.error("Group:" + f.toString() + " -> " + e.getMessage(), e);
-            }
-        });
-
-        if (applicationContext != null) {
-            LOG.info("Closing applicationContext");
-            applicationContext.close();
-        }
-
-        this.shutdown = true;
-        LOG.info("Server shut down.");
-    }
-
-    private static boolean useEpoll() {
-
-        // Should we just return true if this is Linux and if we get an error
-        // during Epoll
-        // setup handle it there?
-        final String os = SystemPropertyUtil.get(OS_NAME).toLowerCase().trim();
-        final String[] version = SystemPropertyUtil.get(OS_VERSION).toLowerCase().trim().split("\\.");
-        if (os.startsWith("linux") && version.length >= 3) {
-            final int major = Integer.parseInt(version[0]);
-            if (major > EPOLL_MIN_MAJOR_VERSION) {
-                return true;
-            } else if (major == EPOLL_MIN_MAJOR_VERSION) {
-                final int minor = Integer.parseInt(version[1]);
-                if (minor > EPOLL_MIN_MINOR_VERSION) {
-                    return true;
-                } else if (minor == EPOLL_MIN_MINOR_VERSION) {
-                    final int patch = Integer.parseInt(version[2].substring(0, 2));
-                    return patch >= EPOLL_MIN_PATCH_VERSION;
-                } else {
-                    return false;
-                }
-            } else {
-                return false;
-            }
-        } else {
-            return false;
-        }
-    }
-
-    protected SslContext createSSLContext(GrafanaAuthConfiguration config) throws Exception {
-
-        ServerSsl sslCfg = config.getSecurity().getServerSsl();
-        Boolean generate = sslCfg.isUseGeneratedKeypair();
-        SslContextBuilder ssl;
-        if (generate) {
-            LOG.warn("Using generated self signed server certificate");
-            Date begin = new Date();
-            Date end = new Date(begin.getTime() + 86400000);
-            SelfSignedCertificate ssc = new SelfSignedCertificate("localhost", begin, end);
-            ssl = SslContextBuilder.forServer(ssc.certificate(), ssc.privateKey());
-        } else {
-            String cert = sslCfg.getCertificateFile();
-            String key = sslCfg.getKeyFile();
-            String keyPass = sslCfg.getKeyPassword();
-            if (null == cert || null == key) {
-                throw new IllegalArgumentException("Check your SSL properties, something is wrong.");
-            }
-            ssl = SslContextBuilder.forServer(new File(cert), new File(key), keyPass);
-        }
-
-        ssl.ciphers(sslCfg.getUseCiphers());
-
-        // Can't set to REQUIRE because the CORS pre-flight requests will fail.
-        ssl.clientAuth(ClientAuth.OPTIONAL);
-
-        Boolean useOpenSSL = sslCfg.isUseOpenssl();
-        if (useOpenSSL) {
-            ssl.sslProvider(SslProvider.OPENSSL);
-        } else {
-            ssl.sslProvider(SslProvider.JDK);
-        }
-        String trustStore = sslCfg.getTrustStoreFile();
-        if (null != trustStore) {
-            if (!trustStore.isEmpty()) {
-                ssl.trustManager(new File(trustStore));
-            }
-        }
-        return ssl.build();
-    }
-
-    protected SSLContext createSSLClientContext(GrafanaAuthConfiguration config) throws Exception {
-
-        ClientSsl ssl = config.getSecurity().getClientSsl();
-        return HttpClient.getSSLContext(ssl.getTrustStoreFile(), ssl.getTrustStoreType(), ssl.getTrustStorePassword(),
-                ssl.getKeyFile(), ssl.getKeyType(), ssl.getKeyPassword());
-    }
-
-    public void run() throws Exception {
-
-        AuthCache.configure(grafanaAuthConfig.getSecurity());
-        final boolean useEpoll = useEpoll();
-        Class<? extends ServerSocketChannel> channelClass;
-        if (useEpoll) {
-            httpWorkerGroup = new EpollEventLoopGroup();
-            httpBossGroup = new EpollEventLoopGroup();
-            channelClass = EpollServerSocketChannel.class;
-        } else {
-            httpWorkerGroup = new NioEventLoopGroup();
-            httpBossGroup = new NioEventLoopGroup();
-            channelClass = NioServerSocketChannel.class;
-        }
-        LOG.info("Using channel class {}", channelClass.getSimpleName());
-
-        final int httpPort = grafanaAuthConfig.getHttp().getPort();
-        final String httpIp = grafanaAuthConfig.getHttp().getIp();
-        SslContext sslCtx = createSSLContext(grafanaAuthConfig);
-        if (sslCtx instanceof OpenSslServerContext) {
-            OpenSslServerContext openssl = (OpenSslServerContext) sslCtx;
-            String application = "GrafanaAuth_" + httpPort;
-            OpenSslServerSessionContext opensslCtx = openssl.sessionContext();
-            opensslCtx.setSessionCacheEnabled(true);
-            opensslCtx.setSessionCacheSize(128);
-            opensslCtx.setSessionIdContext(application.getBytes(StandardCharsets.UTF_8));
-            opensslCtx.setSessionTimeout(grafanaAuthConfig.getSecurity().getSessionMaxAge());
-        }
-        SSLContext clientSSLContext = createSSLClientContext(grafanaAuthConfig);
-        final ServerBootstrap httpServer = new ServerBootstrap();
-        httpServer.group(httpBossGroup, httpWorkerGroup);
-        httpServer.channel(channelClass);
-        httpServer.handler(new LoggingHandler());
-        HttpClientPool httpClientPool = new HttpClientPool(grafanaAuthConfig.getSecurity(), grafanaAuthConfig.getHttp(),
-                clientSSLContext);
-        httpServer.childHandler(setupHttpChannel(grafanaAuthConfig, sslCtx, httpClientPool));
-        httpServer.option(ChannelOption.ALLOCATOR, PooledByteBufAllocator.DEFAULT);
-        httpServer.option(ChannelOption.SO_BACKLOG, 128);
-        httpServer.option(ChannelOption.SO_KEEPALIVE, true);
-        httpChannelHandle = httpServer.bind(httpIp, httpPort).sync().channel();
-        final String httpAddress = ((InetSocketAddress) httpChannelHandle.localAddress()).getAddress().getHostAddress();
-
-        shutdownHook();
-        LOG.info("Server started. Listening on {}:{} for HTTP traffic", httpAddress, httpPort);
-    }
-
-    public static void main(String[] args) throws Exception {
-
-        GrafanaAuth.applicationContext = GrafanaAuth.initializeContext(args);
-        GrafanaAuthConfiguration grafanaAuthConf = GrafanaAuth.applicationContext
-                .getBean(GrafanaAuthConfiguration.class);
-
-        GrafanaAuth grafanaAuth = new GrafanaAuth(grafanaAuthConf);
-        try {
-            grafanaAuth.run();
-            LATCH.await();
-        } catch (final InterruptedException e) {
-            LOG.info("Server shutting down.");
-        } catch (Exception e) {
-            LOG.error("Error running server.", e);
-        } finally {
-            try {
-                grafanaAuth.shutdown();
-            } catch (Exception e) {
-                System.exit(1);
-            }
-        }
-    }
-
-    protected ChannelHandler setupHttpChannel(GrafanaAuthConfiguration config, SslContext sslCtx,
-            HttpClientPool httpClientPool) {
-
-        return new ChannelInitializer<SocketChannel>() {
-
-            @Override
-            protected void initChannel(SocketChannel ch) throws Exception {
-
-                ch.pipeline().addLast("ssl", new NonSslRedirectHandler(config.getHttp(), sslCtx));
-                ch.pipeline().addLast("encoder", new HttpResponseEncoder());
-                ch.pipeline().addLast("decoder", new HttpRequestDecoder());
-                ch.pipeline().addLast("compressor", new HttpContentCompressor());
-                ch.pipeline().addLast("decompressor", new HttpContentDecompressor());
-                // high maximum contentLength so that grafana snapshots can be delivered
-                // might not be necessary if inbound chunking (while proxying) is handled
-                ch.pipeline().addLast("aggregator", new HttpObjectAggregator(2097152));
-                ch.pipeline().addLast("chunker", new ChunkedWriteHandler());
-                ch.pipeline().addLast("grafanaDecoder",
-                        new GrafanaRequestDecoder(config.getSecurity(), config.getHttp()));
-                ch.pipeline().addLast("fileServer", new HttpStaticFileServerHandler());
-                ch.pipeline().addLast("login", new X509LoginRequestHandler(config.getSecurity(), config.getHttp()));
-                ch.pipeline().addLast("httpRelay", new GrafanaRelayHandler(config, httpClientPool));
-                ch.pipeline().addLast("error", new TimelyExceptionHandler()
-                        .setIgnoreSslHandshakeErrors(config.getSecurity().getServerSsl().isUseGeneratedKeypair()));
-            }
-        };
-    }
-}
@@ -1,32 +0,0 @@
-package timely.grafana.auth.configuration;
-
-public class Grafana {
-
-    private String host = "localhost";
-    private Integer port = 3000;
-    private String protocol = "http";
-
-    public void setHost(String host) {
-        this.host = host;
-    }
-
-    public String getHost() {
-        return host;
-    }
-
-    public void setPort(Integer port) {
-        this.port = port;
-    }
-
-    public Integer getPort() {
-        return port;
-    }
-
-    public void setProtocol(String protocol) {
-        this.protocol = protocol;
-    }
-
-    public String getProtocol() {
-        return protocol;
-    }
-}
@@ -1,54 +0,0 @@
-package timely.grafana.auth.configuration;
-
-import javax.validation.Valid;
-
-import org.springframework.boot.context.properties.ConfigurationProperties;
-import org.springframework.boot.context.properties.NestedConfigurationProperty;
-import org.springframework.stereotype.Component;
-import org.springframework.validation.annotation.Validated;
-import timely.balancer.configuration.BalancerHttp;
-import timely.balancer.configuration.BalancerSecurity;
-
-@Validated
-@Component
-@ConfigurationProperties(prefix = "grafana-auth")
-public class GrafanaAuthConfiguration {
-
-    @Valid
-    @NestedConfigurationProperty
-    private BalancerHttp http = new BalancerHttp();
-
-    @Valid
-    @NestedConfigurationProperty
-    private BalancerSecurity security = new BalancerSecurity();
-
-    @Valid
-    @NestedConfigurationProperty
-    private Grafana grafana = new Grafana();
-
-    private Integer shutdownQuietPeriod = 5;
-
-    public BalancerSecurity getSecurity() {
-        return security;
-    }
-
-    public BalancerHttp getHttp() {
-        return http;
-    }
-
-    public Grafana getGrafana() {
-        return grafana;
-    }
-
-    /**
-     * Time to wait (in seconds) for connections to finish and to make sure no new
-     * connections happen before shutting down Netty event loop groups.
-     */
-    public int getShutdownQuietPeriod() {
-        return this.shutdownQuietPeriod;
-    }
-
-    public void setShutdownQuietPeriod(Integer quietPeriod) {
-        this.shutdownQuietPeriod = quietPeriod;
-    }
-}
@@ -1,7 +0,0 @@
-package timely.grafana.auth.configuration;
-
-import org.springframework.boot.autoconfigure.SpringBootApplication;
-
-@SpringBootApplication(scanBasePackageClasses = { SpringBootstrap.class })
-public class SpringBootstrap {
-}
@@ -1,234 +0,0 @@
-package timely.grafana.auth.netty.http;
-
-import static io.netty.handler.codec.http.HttpHeaderNames.CONTENT_LENGTH;
-
-import java.io.ByteArrayOutputStream;
-import java.net.URLEncoder;
-import java.nio.charset.StandardCharsets;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-
-import com.google.common.collect.Multimap;
-import io.netty.buffer.Unpooled;
-import io.netty.channel.ChannelHandlerContext;
-import io.netty.channel.SimpleChannelInboundHandler;
-import io.netty.handler.codec.http.DefaultFullHttpResponse;
-import io.netty.handler.codec.http.FullHttpRequest;
-import io.netty.handler.codec.http.FullHttpResponse;
-import io.netty.handler.codec.http.HttpMethod;
-import io.netty.handler.codec.http.HttpResponseStatus;
-import io.netty.handler.codec.http.HttpVersion;
-import io.netty.util.ReferenceCountUtil;
-import org.apache.http.Header;
-import org.apache.http.HttpEntity;
-import org.apache.http.client.methods.CloseableHttpResponse;
-import org.apache.http.client.methods.HttpDelete;
-import org.apache.http.client.methods.HttpGet;
-import org.apache.http.client.methods.HttpHead;
-import org.apache.http.client.methods.HttpOptions;
-import org.apache.http.client.methods.HttpPost;
-import org.apache.http.client.methods.HttpPut;
-import org.apache.http.entity.StringEntity;
-import org.apache.http.impl.client.CloseableHttpClient;
-import org.apache.http.message.BasicHeader;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.util.StreamUtils;
-import timely.api.request.timeseries.HttpRequest;
-import timely.api.response.TimelyException;
-import timely.auth.TimelyPrincipal;
-import timely.auth.TimelyUser;
-import timely.auth.util.DnUtils;
-import timely.auth.util.HttpHeaderUtils;
-import timely.balancer.connection.TimelyBalancedHost;
-import timely.balancer.connection.http.HttpClientPool;
-import timely.grafana.auth.configuration.GrafanaAuthConfiguration;
-import timely.grafana.request.GrafanaRequest;
-import timely.netty.http.TimelyHttpHandler;
-import timely.netty.http.auth.TimelyAuthenticationToken;
-
-public class GrafanaRelayHandler extends SimpleChannelInboundHandler<HttpRequest> implements TimelyHttpHandler {
-
-    private static final Logger LOG = LoggerFactory.getLogger(GrafanaRelayHandler.class);
-    private final HttpClientPool httpClientPool;
-    private GrafanaAuthConfiguration config;
-
-    public GrafanaRelayHandler(GrafanaAuthConfiguration config, HttpClientPool httpClientPool) {
-        this.config = config;
-        this.httpClientPool = httpClientPool;
-    }
-
-    @Override
-    public void channelRead0(ChannelHandlerContext ctx, HttpRequest msg) throws Exception {
-
-        CloseableHttpClient client = null;
-        CloseableHttpResponse relayedResponse = null;
-        FullHttpRequest request = null;
-        GrafanaRequest grafanaRequest;
-        TimelyBalancedHost k = null;
-        String relayURI = null;
-        try {
-            try {
-                request = msg.getHttpRequest();
-                String originalURI = request.uri();
-                originalURI = encodeURI(originalURI);
-
-                if (msg instanceof GrafanaRequest) {
-                    grafanaRequest = (GrafanaRequest) msg;
-                } else {
-                    throw new UnsupportedOperationException("Request not supported");
-                }
-                TimelyAuthenticationToken token = grafanaRequest.getToken();
-                if (token == null) {
-                    throw new IllegalStateException("No token on grafana request");
-                }
-
-                String protocol = config.getGrafana().getProtocol();
-                String host = config.getGrafana().getHost();
-                Integer port = config.getGrafana().getPort();
-                k = TimelyBalancedHost.of(host, -1, port, -1, -1, null);
-                client = httpClientPool.borrowObject(k);
-                Multimap<String, String> headers = HttpHeaderUtils.toMultimap(request.headers());
-
-                // If incoming user sets these headers, do not relay them
-                headers.removeAll("x-webauth-user");
-                headers.removeAll("x-webauth-name");
-                TimelyPrincipal principal = token.getTimelyPrincipal();
-                TimelyUser user = principal.getPrimaryUser();
-                String subjectDn = user.getDn().subjectDN();
-                String userName = DnUtils.getCommonName(subjectDn);
-                String loginName = DnUtils.getShortName(subjectDn);
-                headers.put("x-webauth-user", loginName);
-                headers.put("x-webauth-name", userName);
-                List<Header> relayedHeaderList = new ArrayList<>();
-                for (Map.Entry<String, String> h : headers.entries()) {
-                    if (!h.getKey().equals(CONTENT_LENGTH.toString())) {
-                        relayedHeaderList.add(new BasicHeader(h.getKey(), h.getValue()));
-                    }
-                }
-                Header[] headerArray = new Header[relayedHeaderList.size()];
-                relayedHeaderList.toArray(headerArray);
-                relayURI = protocol + "://" + host + ":" + port + originalURI;
-                if (request.method().equals(HttpMethod.HEAD)) {
-                    HttpHead relayedRequest = new HttpHead(relayURI);
-                    if (headerArray.length > 0) {
-                        relayedRequest.setHeaders(headerArray);
-                    }
-                    relayedResponse = client.execute(relayedRequest);
-                } else if (request.method().equals(HttpMethod.GET)) {
-                    HttpGet relayedRequest = new HttpGet(relayURI);
-                    if (headerArray.length > 0) {
-                        relayedRequest.setHeaders(headerArray);
-                    }
-                    relayedResponse = client.execute(relayedRequest);
-                } else if (request.method().equals(HttpMethod.POST)) {
-                    HttpPost relayedRequest = new HttpPost(relayURI);
-                    String content = request.content().toString(StandardCharsets.UTF_8);
-                    StringEntity entity = new StringEntity(content);
-                    relayedRequest.setEntity(entity);
-                    if (headerArray.length > 0) {
-                        relayedRequest.setHeaders(headerArray);
-                    }
-                    relayedResponse = client.execute(relayedRequest);
-                } else if (request.method().equals(HttpMethod.PUT)) {
-                    HttpPut relayedRequest = new HttpPut(relayURI);
-                    String content = request.content().toString(StandardCharsets.UTF_8);
-                    StringEntity entity = new StringEntity(content);
-                    relayedRequest.setEntity(entity);
-                    if (headerArray.length > 0) {
-                        relayedRequest.setHeaders(headerArray);
-                    }
-                    relayedResponse = client.execute(relayedRequest);
-                } else if (request.method().equals(HttpMethod.DELETE)) {
-                    HttpDelete relayedRequest = new HttpDelete(relayURI);
-                    if (headerArray.length > 0) {
-                        relayedRequest.setHeaders(headerArray);
-                    }
-                    relayedResponse = client.execute(relayedRequest);
-                } else if (request.method().equals(HttpMethod.OPTIONS)) {
-                    HttpOptions relayedRequest = new HttpOptions(relayURI);
-                    if (headerArray.length > 0) {
-                        relayedRequest.setHeaders(headerArray);
-                    }
-                    relayedResponse = client.execute(relayedRequest);
-                }
-            } catch (Exception e) {
-                String message = e.getMessage();
-                if (message == null) {
-                    LOG.error("", e);
-                } else {
-                    LOG.error(message, e);
-                }
-                this.sendHttpError(ctx, new TimelyException(HttpResponseStatus.INTERNAL_SERVER_ERROR.code(),
-                        e.getMessage(), e.getLocalizedMessage(), e));
-                return;
-            } finally {
-                if (request != null) {
-                    ReferenceCountUtil.release(request);
-                }
-            }
-
-            FullHttpResponse response = null;
-            if (relayedResponse == null) {
-                this.sendHttpError(ctx, new TimelyException(HttpResponseStatus.METHOD_NOT_ALLOWED.code(),
-                        "Method not allowed", "Method not allowed"));
-            } else {
-                LOG.debug("RequestURL:{} ResponseCode:{}", relayURI, relayedResponse.getStatusLine().getStatusCode());
-                HttpEntity httpEntity = relayedResponse.getEntity();
-                if (httpEntity == null) {
-                    response = new DefaultFullHttpResponse(HttpVersion.HTTP_1_1,
-                            HttpResponseStatus.valueOf(relayedResponse.getStatusLine().getStatusCode()));
-                } else {
-                    ByteArrayOutputStream baos = new MyByteArrayOutputStream();
-                    StreamUtils.copy(httpEntity.getContent(), baos);
-                    response = new DefaultFullHttpResponse(HttpVersion.HTTP_1_1,
-                            HttpResponseStatus.valueOf(relayedResponse.getStatusLine().getStatusCode()),
-                            Unpooled.copiedBuffer(baos.toByteArray()));
-                    response.headers().set(CONTENT_LENGTH, response.content().readableBytes());
-                }
-                for (Header h : relayedResponse.getAllHeaders()) {
-                    response.headers().add(h.getName(), h.getValue());
-                }
-                sendResponse(ctx, response);
-            }
-        } finally {
-            if (relayedResponse != null) {
-                relayedResponse.close();
-            }
-            if (client != null && k != null) {
-                httpClientPool.returnObject(k, client);
-            } else {
-                LOG.error("NOT RETURNING CONNECTION! " + msg.getHttpRequest().uri());
-            }
-        }
-    }
-
-    static public class MyByteArrayOutputStream extends ByteArrayOutputStream {
-
-        public MyByteArrayOutputStream() {
-        }
-
-        public MyByteArrayOutputStream(int size) {
-            super(size);
-        }
-
-        public int getCount() {
-            return count;
-        }
-
-        public byte[] getBuf() {
-            return buf;
-        }
-    }
-
-    static public String encodeURI(String s) {
-        try {
-            s = s.replaceAll("\\{", URLEncoder.encode("{", "UTF-8"));
-            s = s.replaceAll("\\}", URLEncoder.encode("}", "UTF-8"));
-        } catch (Exception e) {
-
-        }
-        return s;
-    }
-}
@@ -1,133 +0,0 @@
-package timely.grafana.auth.netty.http;
-
-import java.security.cert.X509Certificate;
-import java.util.Collection;
-import java.util.List;
-
-import com.google.common.collect.Multimap;
-import io.netty.channel.ChannelHandlerContext;
-import io.netty.handler.codec.MessageToMessageDecoder;
-import io.netty.handler.codec.http.FullHttpRequest;
-import io.netty.handler.codec.http.HttpHeaderNames;
-import io.netty.handler.codec.http.QueryStringDecoder;
-import io.netty.handler.codec.http.cookie.ServerCookieDecoder;
-import org.apache.commons.lang3.StringUtils;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import timely.api.request.AuthenticatedRequest;
-import timely.api.request.timeseries.HttpRequest;
-import timely.api.response.StrictTransportResponse;
-import timely.api.response.TimelyException;
-import timely.auth.AuthCache;
-import timely.auth.AuthenticationService;
-import timely.auth.SubjectIssuerDNPair;
-import timely.auth.TimelyPrincipal;
-import timely.auth.util.HttpHeaderUtils;
-import timely.configuration.Http;
-import timely.configuration.Security;
-import timely.grafana.request.GrafanaRequest;
-import timely.netty.Constants;
-import timely.netty.http.TimelyHttpHandler;
-import timely.netty.http.auth.TimelyAuthenticationToken;
-
-public class GrafanaRequestDecoder extends MessageToMessageDecoder<FullHttpRequest> implements TimelyHttpHandler {
-
-    private static final Logger LOG = LoggerFactory.getLogger(GrafanaRequestDecoder.class);
-    private static final String LOG_RECEIVED_REQUEST = "Received HTTP request {}";
-    private static final String LOG_PARSED_REQUEST = "Parsed request {}";
-
-    private final Security security;
-    private final String nonSecureRedirectAddress;
-
-    public GrafanaRequestDecoder(Security security, Http http) {
-
-        this.security = security;
-        this.nonSecureRedirectAddress = http.getRedirectPath();
-    }
-
-    public static String getSessionId(FullHttpRequest msg) {
-        Multimap<String, String> headers = HttpHeaderUtils.toMultimap(msg.headers());
-        Collection<String> cookies = headers.get(HttpHeaderNames.COOKIE.toString());
-        final StringBuilder buf = new StringBuilder();
-        cookies.forEach(h -> {
-            ServerCookieDecoder.STRICT.decode(h).forEach(c -> {
-                if (c.name().equals(Constants.COOKIE_NAME)) {
-                    if (buf.length() == 0) {
-                        buf.append(c.value());
-                    }
-                }
-            });
-        });
-        if (buf.length() == 0) {
-            return null;
-        } else {
-            return buf.toString();
-        }
-    }
-
-    @Override
-    protected void decode(ChannelHandlerContext ctx, FullHttpRequest msg, List<Object> out) throws Exception {
-
-        LOG.trace(LOG_RECEIVED_REQUEST, msg);
-
-        final String uri = msg.uri();
-        final QueryStringDecoder decoder = new QueryStringDecoder(uri);
-        if (decoder.path().equals(nonSecureRedirectAddress)) {
-            out.add(new StrictTransportResponse());
-            return;
-        }
-
-        final String sessionId = getSessionId(msg);
-        LOG.trace("SessionID: " + sessionId);
-
-        HttpRequest request;
-        try {
-            request = new GrafanaRequest();
-            Multimap<String, String> headers = HttpHeaderUtils.toMultimap(msg.headers());
-            ((AuthenticatedRequest) request).addHeaders(headers);
-            X509Certificate clientCert = AuthenticationService.getClientCertificate(ctx);
-            TimelyAuthenticationToken token;
-            if (StringUtils.isNotBlank(sessionId)) {
-                TimelyPrincipal principal;
-                ((AuthenticatedRequest) request).setSessionId(sessionId);
-                if (AuthCache.containsKey(sessionId)) {
-                    principal = AuthCache.get(sessionId);
-                } else {
-                    principal = TimelyPrincipal.anonymousPrincipal();
-                }
-                SubjectIssuerDNPair dn = principal.getPrimaryUser().getDn();
-                token = AuthenticationService.getAuthenticationToken(null, dn.subjectDN(), dn.issuerDN());
-            } else if (clientCert != null) {
-                token = AuthenticationService.getAuthenticationToken(clientCert, headers);
-            } else {
-                SubjectIssuerDNPair dn = TimelyPrincipal.anonymousPrincipal().getPrimaryUser().getDn();
-                token = AuthenticationService.getAuthenticationToken(null, dn.subjectDN(), dn.issuerDN());
-            }
-            ((AuthenticatedRequest) request).setToken(token);
-            request.setHttpRequest(msg.copy());
-            LOG.trace(LOG_PARSED_REQUEST, request);
-            request.validate();
-            out.add(request);
-        } catch (UnsupportedOperationException | NullPointerException e) {
-            // Return the original http request to route to the static file
-            // server
-            msg.retain();
-            out.add(msg);
-            return;
-        }
-        try {
-            try {
-                AuthenticationService.enforceAccess((AuthenticatedRequest) request);
-            } catch (TimelyException e) {
-                if (!security.isAllowAnonymousHttpAccess()) {
-                    throw e;
-                }
-            }
-        } catch (Exception e) {
-            out.clear();
-            throw e;
-        }
-
-    }
-
-}
@@ -1,32 +0,0 @@
-package timely.grafana.request;
-
-import io.netty.handler.codec.http.FullHttpRequest;
-import io.netty.handler.codec.http.QueryStringDecoder;
-import timely.api.annotation.Http;
-import timely.api.request.AuthenticatedRequest;
-import timely.api.request.HttpGetRequest;
-import timely.api.request.HttpPostRequest;
-
-@Http(path = "/")
-public class GrafanaRequest extends AuthenticatedRequest implements HttpGetRequest, HttpPostRequest {
-
-    private FullHttpRequest httpRequest = null;
-
-    @Override
-    public HttpGetRequest parseQueryParameters(QueryStringDecoder decoder) throws Exception {
-        return new GrafanaRequest();
-    }
-
-    @Override
-    public HttpPostRequest parseBody(String content) throws Exception {
-        return new GrafanaRequest();
-    }
-
-    public void setHttpRequest(FullHttpRequest httpRequest) {
-        this.httpRequest = httpRequest;
-    }
-
-    public FullHttpRequest getHttpRequest() {
-        return httpRequest;
-    }
-}
@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<FindBugsFilter>
-  <Match>
-    <Class name="timely.grafana.auth.netty.http.GrafanaRelayHandler$MyByteArrayOutputStream" />
-    <Method name="getBuf" />
-    <Bug pattern="EI_EXPOSE_REP" />
-  </Match>
-  <Match>
-    <!-- this is bad practice, but changing it would change behavior; probably needs more triage -->
-    <Class name="timely.grafana.auth.netty.http.GrafanaRequestDecoder" />
-    <Method name="decode" />
-    <Bug pattern="DCN_NULLPOINTER_EXCEPTION" />
-  </Match>
-  <Match>
-    <!-- these are probably avoidable, but needs further triage to fix -->
-    <Bug pattern="EI_EXPOSE_REP" />
-  </Match>
-  <Match>
-    <!-- these are probably avoidable, but needs further triage to fix -->
-    <Bug pattern="EI_EXPOSE_REP2" />
-  </Match>
-</FindBugsFilter>
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.5</version>
+    <version>2.0.1</version>
  </parent>
  <artifactId>timely-app</artifactId>
  <packaging>pom</packaging>
@@ -28,8 +28,8 @@
      }
    ],
    "screenshots": [],
-    "version": "1.3.5",
-    "updated": "2022-01-07"
+    "version": "2.0.1",
+    "updated": "2024-01-26"
  },
  "dependencies": {
    "classnames": "2.2.6",
@@ -7,5 +7,5 @@ require (
 	github.com/hashicorp/go-hclog v0.16.1
 	github.com/mattn/go-colorable v0.1.6 // indirect
 	github.com/prometheus/common v0.29.0 // indirect
-	golang.org/x/net v0.0.0-20210614182718-04defd469f4e // indirect
+	golang.org/x/net v0.17.0 // indirect
 )
@@ -398,6 +398,7 @@ github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.etcd.io/etcd v0.0.0-20191023171146-3cf2f69b5738/go.mod h1:dnLIgRNXwCJa5e+c6mIZCrds/GIG4ncV9HhK5PX7jPg=
 go.opencensus.io v0.20.1/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
@@ -423,6 +424,8 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -453,6 +456,8 @@ golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzB
 golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180530234432-1e491301e022/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -490,9 +495,13 @@ golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81R
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200904194848-62affa334b73/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210614182718-04defd469f4e h1:XpT3nA5TvE525Ne3hInMh6+GETgn27Zfm9dxsThnX2Q=
-golang.org/x/net v0.0.0-20210614182718-04defd469f4e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -509,6 +518,8 @@ golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -556,16 +567,30 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210309074719-68d13333faf2/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40 h1:JWgyZ1qgdTaF3N3oxC+MdTV7qvEEgHo3otj+HB5CM7Q=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6 h1:aRYxNxv6iGQlyVaZmk6ZgYEDa+Jg18DxebPSrd6bg1M=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -618,6 +643,8 @@ golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc
 golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1,6 +1,6 @@
 {
  "name": "timely-datasource",
-  "version": "1.3.5",
+  "version": "2.0.1",
  "description": "Timely",
  "backend": true,
  "alerting": true,
@@ -14,17 +14,17 @@
  "author": "Grafana Labs",
  "license": "Apache-2.0",
  "devDependencies": {
-    "@grafana/toolkit": "^8.2.2"
+    "@grafana/toolkit": "^8.4.5"
  },
  "engines": {
-    "node": ">=12 <13"
+    "node": ">=12 <17"
  },
  "dependencies": {
-    "@grafana/data": "8.2.3",
-    "@grafana/runtime": "8.2.2",
+    "@grafana/data": "^8.4.5",
+    "@grafana/runtime": "^8.4.5",
    "@grafana/slate-react": "0.22.10-grafana",
-    "@grafana/ui": "8.2.2",
-    "@material-ui/core": "4.12.3",
+    "@grafana/ui": "^8.4.5",
+    "@material-ui/core": "^4.12.3",
    "@types/classnames": "2.3.1",
    "@types/lodash": "4.14.176",
    "@types/react-bootstrap-typeahead": "5.1.8",
@@ -3,7 +3,7 @@
  <modelVersion>4.0.0</modelVersion>
  <groupId>timely</groupId>
  <artifactId>timely</artifactId>
-  <version>1.3.5</version>
+  <version>2.0.1</version>
  <packaging>pom</packaging>
  <name>Timely</name>
  <description>A secure and scalable time series database based on Apache Accumulo</description>
@@ -20,7 +20,6 @@
    <module>grafana</module>
    <module>analytics</module>
    <module>balancer</module>
-    <module>grafana-auth</module>
  </modules>
  <scm>
    <connection>scm:git:https://github.com/NationalSecurityAgency/timely.git</connection>
@@ -34,65 +33,82 @@
  <properties>
    <assembly.tarLongFileMode>posix</assembly.tarLongFileMode>
    <collectd-api-jar>/usr/share/collectd/java/collectd-api.jar</collectd-api-jar>
-    <maven.compiler.source>1.8</maven.compiler.source>
-    <maven.compiler.target>1.8</maven.compiler.target>
+    <maven.compiler.source>11</maven.compiler.source>
+    <maven.compiler.target>11</maven.compiler.target>
    <!-- Configure the os-maven-plugin extension to expand the classifier on -->
    <!-- Fedora-"like" systems. -->
    <os.detection.classifierWithLikes>fedora</os.detection.classifierWithLikes>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
-    <version.accumulo>1.9.3</version.accumulo>
+    <surefire.forkCount>1C</surefire.forkCount>
+    <version.accumulo>2.1.2</version.accumulo>
    <version.buildnumber-maven>1.4</version.buildnumber-maven>
-    <version.caffeine>2.6.2</version.caffeine>
+    <version.caffeine>3.1.6</version.caffeine>
    <version.collectd>5.7.1</version.collectd>
    <version.commons-collections4>4.3</version.commons-collections4>
-    <version.commons-lang3>3.8.1</version.commons-lang3>
+    <version.commons-lang3>3.13.0</version.commons-lang3>
+    <version.commons-logging>1.1.1</version.commons-logging>
    <version.commons-pool2>2.6.1</version.commons-pool2>
+    <version.commons-text>1.10.0</version.commons-text>
+    <version.compression.gorilla>2.1.1</version.compression.gorilla>
    <version.curator>4.1.0</version.curator>
+    <version.datawave-in-memory-accumulo>2.1.1</version.datawave-in-memory-accumulo>
    <version.disruptor>3.4.2</version.disruptor>
    <version.easymock>4.0.2</version.easymock>
    <version.eclipse-lifecycle>1.0.0</version.eclipse-lifecycle>
    <version.fast-classpath-scanner>3.1.13</version.fast-classpath-scanner>
    <version.flink>1.1.4</version.flink>
    <version.google-flatbuffers>1.10.0</version.google-flatbuffers>
-    <version.guava>29.0-jre</version.guava>
-    <version.hadoop>2.7.7</version.hadoop>
+    <version.guava>32.0.0-jre</version.guava>
+    <version.hadoop>3.3.3</version.hadoop>
    <version.httpcomponents>4.5.13</version.httpcomponents>
-    <version.impsort>1.6.2</version.impsort>
-    <version.jackson>2.10.0</version.jackson>
-    <version.jackson.databind>2.10.0</version.jackson.databind>
+    <version.impsort>1.9.0</version.impsort>
+    <version.jackson>2.13.3</version.jackson>
+    <version.jackson.databind>2.12.7.1</version.jackson.databind>
    <version.jacoco>0.8.4</version.jacoco>
+    <version.jakarta.websocket-api>1.1.1</version.jakarta.websocket-api>
    <version.javacsv>2.0</version.javacsv>
    <version.javassist>3.24.1-GA</version.javassist>
    <version.jcip-annotations>1.0</version.jcip-annotations>
    <version.jjwt>0.11.2</version.jjwt>
-    <version.jsoup>1.14.2</version.jsoup>
+    <version.jsoup>1.15.3</version.jsoup>
    <version.junit>4.13.1</version.junit>
-    <version.log4j>2.17.1</version.log4j>
+    <version.log4j2>2.20.0</version.log4j2>
    <version.maven-assembly>3.1.1</version.maven-assembly>
    <version.maven-build-helper>3.0.0</version.maven-build-helper>
    <version.maven-compiler>3.8.1</version.maven-compiler>
    <version.maven-dependency>3.1.1</version.maven-dependency>
+    <version.maven-failsafe-plugin>3.2.5</version.maven-failsafe-plugin>
    <version.maven-jar>3.1.2</version.maven-jar>
    <version.maven-pmd>3.12.0</version.maven-pmd>
    <version.maven-rpm>2.2.0</version.maven-rpm>
    <version.maven-shade>3.2.1</version.maven-shade>
-    <version.maven-surefire>3.0.0-M3</version.maven-surefire>
-    <version.netty>4.1.42.Final</version.netty>
-    <version.netty-tcnative>2.0.25.Final</version.netty-tcnative>
+    <version.maven-surefire-plugin>3.2.5</version.maven-surefire-plugin>
+    <version.micrometer>1.11.1</version.micrometer>
+    <version.netty>4.1.45.Final</version.netty>
+    <version.netty-tcnative>2.0.29.Final</version.netty-tcnative>
    <version.os-maven>1.5.0.Final</version.os-maven>
    <version.powermock>1.6.4</version.powermock>
+    <version.reactor-netty>0.8.5.RELEASE</version.reactor-netty>
    <version.slf4j>1.7.26</version.slf4j>
-    <version.spotbugs-maven>4.5.0.0</version.spotbugs-maven>
+    <version.spotbugs-maven>4.7.3.5</version.spotbugs-maven>
    <version.spring-boot>2.1.3.RELEASE</version.spring-boot>
+    <version.spring-webflux>5.1.4.RELEASE</version.spring-webflux>
    <version.tyrus>1.15</version.tyrus>
  </properties>
  <dependencyManagement>
    <dependencies>
+      <dependency>
+        <groupId>io.netty</groupId>
+        <artifactId>netty-bom</artifactId>
+        <version>${version.netty}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
      <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-bom</artifactId>
-        <version>${version.log4j}</version>
+        <version>${version.log4j2}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
@@ -117,7 +133,17 @@
      <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-databind</artifactId>
-        <version>${version.jackson.databind}</version>
+        <version>${version.jackson}</version>
+      </dependency>
+      <dependency>
+        <groupId>com.fasterxml.jackson.dataformat</groupId>
+        <artifactId>jackson-dataformat-xml</artifactId>
+        <version>${version.jackson}</version>
+      </dependency>
+      <dependency>
+        <groupId>com.fasterxml.jackson.dataformat</groupId>
+        <artifactId>jackson-dataformat-yaml</artifactId>
+        <version>${version.jackson}</version>
      </dependency>
      <dependency>
        <groupId>com.fasterxml.jackson.datatype</groupId>
@@ -149,10 +175,26 @@
        <artifactId>commons-beanutils</artifactId>
        <version>1.9.4</version>
      </dependency>
+      <dependency>
+        <groupId>commons-logging</groupId>
+        <artifactId>commons-logging</artifactId>
+        <version>${version.commons-logging}</version>
+      </dependency>
      <dependency>
        <groupId>fi.iki.yak</groupId>
        <artifactId>compression-gorilla</artifactId>
-        <version>2.1.1</version>
+        <version>${version.compression.gorilla}</version>
+      </dependency>
+      <dependency>
+        <groupId>gov.nsa.datawave.contrib</groupId>
+        <artifactId>datawave-in-memory-accumulo</artifactId>
+        <version>${version.datawave-in-memory-accumulo}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>org.apache.accumulo</groupId>
+            <artifactId>*</artifactId>
+          </exclusion>
+        </exclusions>
      </dependency>
      <dependency>
        <groupId>io.github.lukehutch</groupId>
@@ -163,12 +205,23 @@
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-impl</artifactId>
        <version>${version.jjwt}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>log4j</groupId>
+            <artifactId>log4j</artifactId>
+          </exclusion>
+        </exclusions>
      </dependency>
      <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-jackson</artifactId>
        <version>${version.jjwt}</version>
      </dependency>
+      <dependency>
+        <groupId>io.micrometer</groupId>
+        <artifactId>micrometer-core</artifactId>
+        <version>${version.micrometer}</version>
+      </dependency>
      <dependency>
        <groupId>io.netty</groupId>
        <artifactId>netty-all</artifactId>
@@ -179,6 +232,16 @@
        <artifactId>netty-tcnative-boringssl-static</artifactId>
        <version>${version.netty-tcnative}</version>
      </dependency>
+      <dependency>
+        <groupId>io.projectreactor.netty</groupId>
+        <artifactId>reactor-netty</artifactId>
+        <version>${version.reactor-netty}</version>
+      </dependency>
+      <dependency>
+        <groupId>jakarta.websocket</groupId>
+        <artifactId>jakarta.websocket-api</artifactId>
+        <version>${version.jakarta.websocket-api}</version>
+      </dependency>
      <dependency>
        <groupId>net.sourceforge.javacsv</groupId>
        <artifactId>javacsv</artifactId>
@@ -193,6 +256,14 @@
            <groupId>io.netty</groupId>
            <artifactId>netty</artifactId>
          </exclusion>
+          <exclusion>
+            <groupId>log4j</groupId>
+            <artifactId>log4j</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-log4j12</artifactId>
+          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
@@ -204,6 +275,10 @@
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-log4j12</artifactId>
          </exclusion>
+          <exclusion>
+            <groupId>log4j</groupId>
+            <artifactId>log4j</artifactId>
+          </exclusion>
        </exclusions>
      </dependency>
      <dependency>
@@ -221,6 +296,11 @@
        <artifactId>commons-pool2</artifactId>
        <version>${version.commons-pool2}</version>
      </dependency>
+      <dependency>
+        <groupId>org.apache.commons</groupId>
+        <artifactId>commons-text</artifactId>
+        <version>${version.commons-text}</version>
+      </dependency>
      <dependency>
        <groupId>org.apache.curator</groupId>
        <artifactId>curator-client</artifactId>
@@ -245,30 +325,68 @@
        <groupId>org.apache.flink</groupId>
        <artifactId>flink-clients_2.11</artifactId>
        <version>${version.flink}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>log4j</groupId>
+            <artifactId>log4j</artifactId>
+          </exclusion>
+        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.apache.flink</groupId>
        <artifactId>flink-java</artifactId>
        <version>${version.flink}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>log4j</groupId>
+            <artifactId>log4j</artifactId>
+          </exclusion>
+        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.apache.flink</groupId>
        <artifactId>flink-streaming-java_2.11</artifactId>
        <version>${version.flink}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>log4j</groupId>
+            <artifactId>log4j</artifactId>
+          </exclusion>
+        </exclusions>
      </dependency>
      <dependency>
        <groupId>org.apache.hadoop</groupId>
        <artifactId>hadoop-client</artifactId>
        <version>${version.hadoop}</version>
        <exclusions>
+          <exclusion>
+            <groupId>ch.qos.reload4j</groupId>
+            <artifactId>reload4j</artifactId>
+          </exclusion>
          <exclusion>
            <groupId>io.netty</groupId>
            <artifactId>netty</artifactId>
          </exclusion>
+          <exclusion>
+            <groupId>javax.websocket</groupId>
+            <artifactId>javax.websocket-api</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>javax.websocket</groupId>
+            <artifactId>javax.websocket-client-api</artifactId>
+          </exclusion>
          <exclusion>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-log4j12</artifactId>
          </exclusion>
+          <exclusion>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-reload4j</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>log4j</groupId>
+            <artifactId>log4j</artifactId>
+          </exclusion>
          <exclusion>
            <groupId>org.mortbay.jetty</groupId>
            <artifactId>jetty-util</artifactId>
@@ -280,10 +398,26 @@
        <artifactId>hadoop-common</artifactId>
        <version>${version.hadoop}</version>
        <exclusions>
+          <exclusion>
+            <groupId>ch.qos.reload4j</groupId>
+            <artifactId>reload4j</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>jdk.tools</groupId>
+            <artifactId>jdk.tools</artifactId>
+          </exclusion>
          <exclusion>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-log4j12</artifactId>
          </exclusion>
+          <exclusion>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-reload4j</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>log4j</groupId>
+            <artifactId>log4j</artifactId>
+          </exclusion>
          <exclusion>
            <groupId>org.mortbay.jetty</groupId>
            <artifactId>jetty</artifactId>
@@ -299,14 +433,34 @@
        <artifactId>hadoop-minicluster</artifactId>
        <version>${version.hadoop}</version>
        <exclusions>
+          <exclusion>
+            <groupId>ch.qos.reload4j</groupId>
+            <artifactId>reload4j</artifactId>
+          </exclusion>
          <exclusion>
            <groupId>io.netty</groupId>
            <artifactId>netty</artifactId>
          </exclusion>
+          <exclusion>
+            <groupId>javax.websocket</groupId>
+            <artifactId>javax.websocket-api</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>javax.websocket</groupId>
+            <artifactId>javax.websocket-client-api</artifactId>
+          </exclusion>
          <exclusion>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-log4j12</artifactId>
          </exclusion>
+          <exclusion>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-reload4j</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>log4j</groupId>
+            <artifactId>log4j</artifactId>
+          </exclusion>
          <exclusion>
            <groupId>org.mortbay.jetty</groupId>
            <artifactId>jetty</artifactId>
@@ -322,6 +476,12 @@
        <artifactId>httpclient</artifactId>
        <version>${version.httpcomponents}</version>
      </dependency>
+      <dependency>
+        <!-- This bridge allows log4j2 to work with code that is still using the log4j 1.2 classes/api -->
+        <groupId>org.apache.logging.log4j</groupId>
+        <artifactId>log4j-1.2-api</artifactId>
+        <version>${version.log4j2}</version>
+      </dependency>
      <dependency>
        <groupId>org.glassfish.tyrus</groupId>
        <artifactId>tyrus-client</artifactId>
@@ -342,6 +502,27 @@
        <artifactId>slf4j-api</artifactId>
        <version>${version.slf4j}</version>
      </dependency>
+      <dependency>
+        <groupId>org.slf4j</groupId>
+        <artifactId>slf4j-log4j12</artifactId>
+        <version>${version.slf4j}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.springframework</groupId>
+        <artifactId>spring-webflux</artifactId>
+        <version>${version.spring-webflux}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter</artifactId>
+        <version>${version.spring-boot}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-logging</artifactId>
+          </exclusion>
+        </exclusions>
+      </dependency>
      <dependency>
        <groupId>timely</groupId>
        <artifactId>collectd-plugin-parent</artifactId>
@@ -419,14 +600,13 @@
        <plugin>
          <groupId>net.revelc.code.formatter</groupId>
          <artifactId>formatter-maven-plugin</artifactId>
-          <version>2.11.0</version>
+          <version>2.22.0</version>
          <configuration>
            <compilerCompliance>${maven.compiler.source}</compilerCompliance>
            <compilerSource>${maven.compiler.source}</compilerSource>
            <compilerTargetPlatform>${maven.compiler.target}</compilerTargetPlatform>
            <configFile>${project.parent.basedir}/eclipse/Eclipse-Formatter.xml</configFile>
            <lineEnding>LF</lineEnding>
-            <overrideConfigCompilerVersion>true</overrideConfigCompilerVersion>
            <skipCssFormatting>true</skipCssFormatting>
            <skipHtmlFormatting>true</skipHtmlFormatting>
            <skipJsFormatting>true</skipJsFormatting>
@@ -460,20 +640,57 @@
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-compiler-plugin</artifactId>
          <version>${version.maven-compiler}</version>
+          <configuration>
+            <source>${maven.compiler.source}</source>
+            <target>${maven.compiler.target}</target>
+          </configuration>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-dependency-plugin</artifactId>
          <version>${version.maven-dependency}</version>
        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-enforcer-plugin</artifactId>
+          <version>3.0.0</version>
+          <executions>
+            <execution>
+              <id>enforce-banned-dependencies</id>
+              <goals>
+                <goal>enforce</goal>
+              </goals>
+              <configuration>
+                <rules>
+                  <bannedDependencies>
+                    <excludes>
+                      <!-- do not use the following slf4j binders -->
+                      <exclude>ch.qos.reload4j:reload4j</exclude>
+                      <exclude>org.slf4j:slf4j-reload4j</exclude>
+                      <!-- spring boot microservices do not use 1.x versions of log4j -->
+                      <exclude>log4j:log4j</exclude>
+                      <!-- spring boot microservices do not use 1.x versions of junit -->
+                      <exclude>junit:junit</exclude>
+                    </excludes>
+                    <includes>
+                      <!-- some spring boot microservices include test dependencies which use 1.x versions of junit -->
+                      <include>junit:junit:*:*:test</include>
+                    </includes>
+                  </bannedDependencies>
+                </rules>
+                <fail>true</fail>
+              </configuration>
+            </execution>
+          </executions>
+        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-failsafe-plugin</artifactId>
-          <version>${version.maven-surefire}</version>
+          <version>${version.maven-failsafe-plugin}</version>
          <configuration>
-            <argLine>${failsafeArgLine} -Djava.library.path=${project.build.directory}/native/META-INF/native/libnetty_tcnative_linux_x86_64.so -Dzookeeper.sasl.client=false</argLine>
+            <argLine>${failsafeArgLine} -Djava.library.path=${project.build.directory}/native/META-INF/native/libnetty_tcnative_linux_x86_64.so -XX:+TieredCompilation -XX:TieredStopAtLevel=1  -Dfile.encoding=UTF8 -Duser.timezone=GMT -Xmx1024m -Dapple.awt.UIElement=true -Djava.security.krb5.realm= -Djava.security.krb5.kdc= -Dzookeeper.sasl.client=false</argLine>
            <includes>
-              <include>**/*.java</include>
+              <include>**/*IT.java</include>
            </includes>
            <groups>timely.test.IntegrationTest</groups>
            <redirectTestOutputToFile>true</redirectTestOutputToFile>
@@ -504,6 +721,11 @@
            </archive>
          </configuration>
        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-resources-plugin</artifactId>
+          <version>3.1.0</version>
+        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-shade-plugin</artifactId>
@@ -512,9 +734,16 @@
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-surefire-plugin</artifactId>
-          <version>${version.maven-surefire}</version>
+          <version>${version.maven-surefire-plugin}</version>
          <configuration>
-            <argLine>${sureFireArgLine} -Djava.library.path=${project.build.directory}/native/META-INF/native/libnetty-tcnative_linux_x86_64.so -Dzookeeper.sasl.client=false</argLine>
+            <reuseForks>false</reuseForks>
+            <forkCount>${surefire.forkCount}</forkCount>
+            <threadCount>1</threadCount>
+            <threadCountClasses>1</threadCountClasses>
+            <threadCountMethods>0</threadCountMethods>
+            <threadCountSuites>0</threadCountSuites>
+            <argLine>${sureFireArgLine} -Djava.library.path=${project.build.directory}/native/META-INF/native/libnetty_tcnative_linux_x86_64.so -XX:+TieredCompilation -XX:TieredStopAtLevel=1  -Dfile.encoding=UTF8 -Duser.timezone=GMT -Xmx1024m -Dapple.awt.UIElement=true -Djava.security.krb5.realm= -Djava.security.krb5.kdc= -Dzookeeper.sasl.client=false</argLine>
+            <runOrder>random</runOrder>
            <excludedGroups>timely.test.IntegrationTest</excludedGroups>
            <redirectTestOutputToFile>true</redirectTestOutputToFile>
          </configuration>
@@ -684,6 +913,35 @@
          </execution>
        </executions>
      </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-enforcer-plugin</artifactId>
+        <version>3.0.0-M3</version>
+        <executions>
+          <execution>
+            <id>enforce-no-snapshots</id>
+            <goals>
+              <goal>enforce</goal>
+            </goals>
+            <configuration>
+              <rules>
+                <requireReleaseDeps>
+                  <message>Snapshot dependencies are prohibited on a release build.</message>
+                  <onlyWhenRelease>true</onlyWhenRelease>
+                </requireReleaseDeps>
+                <requireJavaVersion>
+                  <version>${java.version}</version>
+                </requireJavaVersion>
+              </rules>
+              <fail>true</fail>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-surefire-plugin</artifactId>
+      </plugin>
    </plugins>
  </build>
  <reporting>
@@ -755,7 +1013,7 @@
        </property>
      </activation>
      <properties>
-        <maven.compiler.release>8</maven.compiler.release>
+        <maven.compiler.release>${maven.compiler.target}</maven.compiler.release>
      </properties>
      <build>
        <pluginManagement>
@@ -818,10 +1076,7 @@
      </build>
    </profile>
    <profile>
-      <id>jdk-release-flag</id>
-      <activation>
-        <jdk>[9,)</jdk>
-      </activation>
+      <id>jdk8</id>
      <properties>
        <maven.compiler.release>8</maven.compiler.release>
      </properties>
@@ -13,10 +13,6 @@ CONF_DIR=${BASE_DIR}/conf

 . ${BIN_DIR}/timely-env.sh

-HOST_IP=$(hostname -I | awk '{print $1}')
-HOST=$(hostname -s)
-HOST_FQDN=$(hostname -f)
-
 for i in $(seq 1 $NUM_PROFILES); do
    if [ "$NUM_PROFILES" -eq "1" ]; then
        FILENAME=timely.yml
@@ -26,9 +22,6 @@ for i in $(seq 1 $NUM_PROFILES); do

    echo "creating configuration file ${CONF_DIR}/${FILENAME}"
    cp ${CONF_DIR}/timely-template.yml ${CONF_DIR}/${FILENAME}
-    sed -i "s/\${HOST}/${HOST}/g" ${CONF_DIR}/${FILENAME}
-    sed -i "s/\${HOST_FQDN}/${HOST_FQDN}/g" ${CONF_DIR}/${FILENAME}
-    sed -i "s/\${HOST_IP}/${HOST_IP}/g" ${CONF_DIR}/${FILENAME}
    sed -i "s/\${ZOOKEEPERS}/${ZOOKEEPERS}/g" ${CONF_DIR}/${FILENAME}
    sed -i "s/\${AGE_OFF_DAYS}/${AGE_OFF_DAYS}/g" ${CONF_DIR}/${FILENAME}
    MULTIPLE=$(($i - 1))
@@ -9,4 +9,19 @@ UDP_PORT_START=4245
 PORT_INCREMENT=100
 AGE_OFF_DAYS=7
 ACCUMULO_USER=root
-ACCUMULO_PASSWORD=secret
+ACCUMULO_PASSWORD=secret
+
+HOST_IP=0.0.0.0
+HOST=$(hostname -s)
+HOST_FQDN=$(hostname -f)
+
+GENERATE_KEYS=true
+TRUST_STORE_TYPE=
+TRUST_STORE_FILE=
+TRUST_STORE_PASSWORD=
+KEY_STORE_TYPE=
+KEY_STORE_FILE=
+KEY_STORE_PASSWORD=
+AUTHORIZATION_URL=
+AUTHORIZATION_CERTIFICATE_TYPE=
+AUTHORIZATION_CERTIFICATE_FILE=
@@ -10,6 +10,10 @@ fi

 THIS_DIR="${THIS_SCRIPT%/*}"

+set -a
+. ${THIS_DIR}/timely-env.sh
+set +a
+
 if [ -n "$1" ]; then
  export PROFILE_NUM=$1
  PROFILE_ARG="--spring.profiles.active=${PROFILE_NUM}"
@@ -53,11 +57,9 @@ if [ "$PID" == "" ]; then
    JVM_ARGS="${JVM_ARGS} -DLog4jContextSelector=org.apache.logging.log4j.core.async.AsyncLoggerContextSelector"
    JVM_ARGS="${JVM_ARGS} -Djava.library.path=${NATIVE_DIR}"

-    JVM_ARGS="${JVM_ARGS} -Xmx4G -Xms4G -XX:NewSize=1G -XX:MaxNewSize=1G -XX:+UnlockDiagnosticVMOptions"
-    JVM_ARGS="${JVM_ARGS} -XX:+UseConcMarkSweepGC -XX:+CMSScavengeBeforeRemark -XX:+ScavengeBeforeFullGC -XX:ReservedCodeCacheSize=384M -XX:+UseCodeCacheFlushing -XX:+UseParNewGC"
-    JVM_ARGS="${JVM_ARGS} -XX:SurvivorRatio=8 -XX:ParallelGCThreads=16 -XX:ConcGCThreads=8 -XX:+UseCondCardMark  -XX:ParGCCardsPerStrideChunk=32768"
-    JVM_ARGS="${JVM_ARGS} -XX:+CMSClassUnloadingEnabled -XX:+CMSParallelRemarkEnabled -XX:CMSInitiatingOccupancyFraction=30 -XX:+UseCMSInitiatingOccupancyOnly"
+    JVM_ARGS="${JVM_ARGS} -Xmx4G -Xms4G -XX:NewSize=1G -XX:MaxNewSize=1G"
    JVM_ARGS="${JVM_ARGS} -XX:+UseCompressedOops -XX:+UseNUMA -Djava.net.preferIPv4Stack=true"
+    JVM_ARGS="${JVM_ARGS} -XX:+UseG1GC -XX:MaxGCPauseMillis=4000 -XX:ParallelGCThreads=20 -XX:+UseStringDeduplication"

    echo "$JAVA_HOME/bin/java ${JVM_ARGS} timely.Server --spring.config.name=timely ${PROFILE_ARG}"
    nohup $JAVA_HOME/bin/java ${JVM_ARGS} timely.Server --spring.config.name=timely ${PROFILE_ARG} >> ${LOG_DIR}/timely-server${PROFILE_NUM}-startup.log 2>&1 &
@@ -0,0 +1,9 @@
+trust.store.type=${TRUST_STORE_TYPE}
+trust.store.file=${TRUST_STORE_FILE}
+trust.store.password=${TRUST_STORE_PASSWORD}
+key.store.type=${KEY_STORE_TYPE}
+key.store.file=${KEY_STORE_FILE}
+key.store.password=${KEY_STORE_PASSWORD}
+authorization.url=${AUTHORIZATION_URL}
+authorization.certificate.type=${AUTHORIZATION_CERTIFICATE_TYPE}
+authorization.certificate.file=${AUTHORIZATION_CERTIFICATE_FILE}
@@ -1,46 +1,39 @@
 <beans:beans xmlns="http://www.springframework.org/schema/security"
-             xmlns:beans="http://www.springframework.org/schema/beans"
-             xmlns:util="http://www.springframework.org/schema/util"
-             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-             xsi:schemaLocation="http://www.springframework.org/schema/beans
+			 xmlns:beans="http://www.springframework.org/schema/beans"
+			 xmlns:util="http://www.springframework.org/schema/util"
+			 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+			 xmlns:context="http://www.springframework.org/schema/context"
+			 xsi:schemaLocation="http://www.springframework.org/schema/beans
 								 http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
 								 http://www.springframework.org/schema/security
 								 http://www.springframework.org/schema/security/spring-security.xsd
 								 http://www.springframework.org/schema/util
-								 http://www.springframework.org/schema/util/spring-util.xsd">
+								 http://www.springframework.org/schema/util/spring-util.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">
 		          
-	<beans:bean id="x509PrincipalExtractor" class="org.springframework.security.web.authentication.preauth.x509.SubjectDnX509PrincipalExtractor">
-		<beans:property name="subjectDnRegex" value="CN=(.*?)(?:,|$)"/>
-	</beans:bean>	
+	<context:property-placeholder location="classpath:security.properties"/>

-    <beans:bean id="timelyUserDetailsService" class="timely.auth.UserDetailsService">
-    	<beans:property name="users">
-    		<util:list>
-				<beans:bean class="timely.auth.TimelyUser">
-					<beans:constructor-arg name="subjectDn">
-						<beans:value>CN=example.com</beans:value>
-					</beans:constructor-arg>
-					<beans:constructor-arg name="auths">
-						<util:list>
-							<beans:value>D</beans:value>
-							<beans:value>E</beans:value>
-							<beans:value>F</beans:value>
-						</util:list>
-					</beans:constructor-arg>
-					<beans:constructor-arg name="roles">
-						<util:list>
-							<beans:value>G</beans:value>
-							<beans:value>H</beans:value>
-							<beans:value>I</beans:value>
-						</util:list>
-					</beans:constructor-arg>
-				</beans:bean>
-    		</util:list>
-    	</beans:property>
+	<beans:bean id="clientSsl" class="timely.configuration.ClientSsl">
+		<beans:property name="trustStoreType" value="${trust.store.type}"/>
+		<beans:property name="trustStoreFile" value="${trust.store.file}"/>
+		<beans:property name="trustStorePassword" value="${trust.store.password}"/>
+		<beans:property name="keyStoreType" value="${key.store.type}"/>
+		<beans:property name="keyStoreFile" value="${key.store.file}"/>
+		<beans:property name="keyStorePassword" value="${key.store.password}"/>
+	</beans:bean>
+
+	<beans:bean id="authorizationProperties" class="timely.configuration.AuthorizationProperties">
+		<beans:property name="authorizationUrl" value="${authorization.url}"/>
+		<beans:property name="publicCertificateType" value="${authorization.certificate.type}"/>
+		<beans:property name="publicCertificateFile" value="${authorization.certificate.file}"/>
+	</beans:bean>
+
+    <beans:bean id="remoteUserDetailsService" class="timely.auth.RemoteUserDetailsService">
+    	<beans:constructor-arg ref="clientSsl"/>
+		<beans:constructor-arg ref="authorizationProperties"/>
    </beans:bean>
    
    <beans:bean id="x509AuthorizationProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
-    	<beans:property name="preAuthenticatedUserDetailsService" ref="timelyUserDetailsService" />
+    	<beans:property name="preAuthenticatedUserDetailsService" ref="remoteUserDetailsService" />
    </beans:bean>
    
    <user-service id="usernamePasswordService">
@@ -24,13 +24,19 @@ timely:
    cache-refresh-minutes: 5
    allow-anonymous-http-access: true
    allow-anonymous-ws-access: true
-    server-ssl:
-      certificate-file:
-      key-file:
-      key-password: timely
+    serverSsl:
+      key-store-type:
+      key-store-file:
+      key-store-password:
      use-generated-keypair: true
+      ignore-ssl-handshake-errors: true
+      trust-store-type:
      trust-store-file:
-      use-openssl: false
+      trust-store-password:
+    jwtSsl:
+      key-store-type:
+      key-store-file:
+      key-store-password:
  server:
    ip: 0.0.0.0
    tcp-port: 54321
@@ -28,17 +28,19 @@ timely:
    cache-refresh-minutes: 5
    allow-anonymous-http-access: true
    allow-anonymous-ws-access: true
-    server-ssl:
-      certificate-file:
-      key-file:
-      key-password:
-      use-generated-keypair: true
-      trust-store-file:
-      use-openssl: true
-      #use-ciphers:
-    jwtCheckKeyStore:
-    jwtCheckKeyType:
-    jwtCheckKeyPassword:
+    serverSsl:
+      key-store-type: ${KEY_STORE_TYPE}
+      key-store-file: ${KEY_STORE_FILE}
+      key-store-password: ${KEY_STORE_PASSWORD}
+      use-generated-keypair: ${GENERATE_KEYS}
+      ignore-ssl-handshake-errors: true
+      trust-store-type: ${TRUST_STORE_TYPE}
+      trust-store-file: ${TRUST_STORE_FILE}
+      trust-store-password: ${TRUST_STORE_PASSWORD}
+    jwtSsl:
+      key-store-type: ${AUTHORIZATION_CERTIFICATE_TYPE}
+      key-store-file: ${AUTHORIZATION_CERTIFICATE_FILE}
+      key-store-password: ${AUTHORIZATION_CERTIFICATE_PASSWORD}
  server:
    ip: ${HOST_IP}
    tcp-port: ${TCP_PORT}
@@ -27,17 +27,19 @@ timely:
    cache-refresh-minutes: 5
    allow-anonymous-http-access: true
    allow-anonymous-ws-access: true
-    server-ssl:
-      certificate-file:
-      key-file:
-      key-password:
+    serverSsl:
+      key-store-type:
+      key-store-file:
+      key-store-password:
      use-generated-keypair: true
+      ignore-ssl-handshake-errors: true
+      trust-store-type:
      trust-store-file:
-      use-openssl: true
-      #use-ciphers:
-    jwtCheckKeyStore:
-    jwtCheckKeyType:
-    jwtCheckKeyPassword:
+      trust-store-password:
+    jwtSsl:
+      key-store-type:
+      key-store-file:
+      key-store-password:
  server:
    ip: 0.0.0.0
    tcp-port: 4242
@@ -4,7 +4,7 @@
  <parent>
    <groupId>timely</groupId>
    <artifactId>timely</artifactId>
-    <version>1.3.5</version>
+    <version>2.0.1</version>
  </parent>
  <artifactId>timely-server</artifactId>
  <dependencies>
@@ -44,6 +44,10 @@
      <groupId>fi.iki.yak</groupId>
      <artifactId>compression-gorilla</artifactId>
    </dependency>
+    <dependency>
+      <groupId>gov.nsa.datawave.contrib</groupId>
+      <artifactId>datawave-in-memory-accumulo</artifactId>
+    </dependency>
    <dependency>
      <groupId>io.github.lukehutch</groupId>
      <artifactId>fast-classpath-scanner</artifactId>
@@ -56,19 +60,25 @@
      <groupId>io.jsonwebtoken</groupId>
      <artifactId>jjwt-jackson</artifactId>
    </dependency>
+    <dependency>
+      <groupId>io.micrometer</groupId>
+      <artifactId>micrometer-core</artifactId>
+    </dependency>
    <dependency>
      <groupId>io.netty</groupId>
      <artifactId>netty-all</artifactId>
    </dependency>
+    <dependency>
+      <groupId>io.projectreactor.netty</groupId>
+      <artifactId>reactor-netty</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>jakarta.websocket</groupId>
+      <artifactId>jakarta.websocket-api</artifactId>
+    </dependency>
    <dependency>
      <groupId>org.apache.accumulo</groupId>
      <artifactId>accumulo-core</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>org.slf4j</groupId>
-          <artifactId>slf4j-log4j12</artifactId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.apache.accumulo</groupId>
@@ -105,12 +115,6 @@
    <dependency>
      <groupId>org.apache.hadoop</groupId>
      <artifactId>hadoop-common</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>jdk.tools</groupId>
-          <artifactId>jdk.tools</artifactId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.apache.hadoop</groupId>
@@ -120,15 +124,13 @@
      <groupId>org.slf4j</groupId>
      <artifactId>slf4j-api</artifactId>
    </dependency>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-webflux</artifactId>
+    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>org.springframework.boot</groupId>
-          <artifactId>spring-boot-starter-logging</artifactId>
-        </exclusion>
-      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
@@ -170,11 +172,6 @@
      <artifactId>log4j-core</artifactId>
      <scope>runtime</scope>
    </dependency>
-    <dependency>
-      <groupId>org.apache.logging.log4j</groupId>
-      <artifactId>log4j-slf4j-impl</artifactId>
-      <scope>runtime</scope>
-    </dependency>
    <dependency>
      <groupId>org.javassist</groupId>
      <artifactId>javassist</artifactId>
@@ -291,6 +288,14 @@
          </execution>
        </executions>
      </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <configuration>
+          <source>11</source>
+          <target>11</target>
+        </configuration>
+      </plugin>
    </plugins>
    <extensions>
      <!-- Use os-maven-plugin to initialize the "os.detected" properties -->
@@ -1,9 +1,9 @@
 package timely;

+import static org.apache.accumulo.core.conf.ConfigurationTypeHelper.getTimeInMillis;
 import static timely.store.cache.DataStoreCache.NON_CACHED_METRICS;
 import static timely.store.cache.DataStoreCache.NON_CACHED_METRICS_LOCK_PATH;

-import java.io.File;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.UnknownHostException;
@@ -11,6 +11,7 @@ import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
+import java.util.Properties;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.Future;
 import java.util.concurrent.TimeUnit;
@@ -54,13 +55,13 @@ import io.netty.handler.ssl.OpenSslServerContext;
 import io.netty.handler.ssl.OpenSslServerSessionContext;
 import io.netty.handler.ssl.SslContext;
 import io.netty.handler.ssl.SslContextBuilder;
-import io.netty.handler.ssl.SslProvider;
 import io.netty.handler.ssl.util.SelfSignedCertificate;
 import io.netty.handler.stream.ChunkedWriteHandler;
 import io.netty.handler.timeout.IdleStateHandler;
 import io.netty.util.NettyRuntime;
 import io.netty.util.internal.SystemPropertyUtil;
-import org.apache.accumulo.core.conf.AccumuloConfiguration;
+import org.apache.accumulo.core.client.AccumuloClient;
+import org.apache.accumulo.core.conf.ClientProperty;
 import org.apache.curator.RetryPolicy;
 import org.apache.curator.framework.CuratorFramework;
 import org.apache.curator.framework.CuratorFrameworkFactory;
@@ -81,6 +82,8 @@ import org.springframework.context.ConfigurableApplicationContext;
 import timely.auth.AuthCache;
 import timely.auth.JWTTokenHandler;
 import timely.auth.VisibilityCache;
+import timely.auth.util.SslHelper;
+import timely.configuration.Accumulo;
 import timely.configuration.Configuration;
 import timely.configuration.Cors;
 import timely.configuration.ServerSsl;
@@ -141,6 +144,7 @@ public class Server {
    static ConfigurableApplicationContext applicationContext;

    private final Configuration config;
+    private AccumuloClient accumuloClient;
    private EventLoopGroup tcpWorkerGroup = null;
    private EventLoopGroup tcpBossGroup = null;
    private EventLoopGroup httpWorkerGroup = null;
@@ -303,9 +307,11 @@ public class Server {
        // wait for the channels to shutdown
        channelFutures.forEach(f -> {
            try {
-                f.get();
+                if (!f.isDone()) {
+                    f.get();
+                }
            } catch (final Exception e) {
-                LOG.error("Channel:" + f.channel().config() + " -> " + e.getMessage(), e);
+                LOG.error("Channel:" + f.channel().config() + " -> " + e.getMessage());
            }
        });

@@ -413,17 +419,40 @@ public class Server {
        LOG.info("Server shut down.");
    }

-    public Server(Configuration conf, int eventLoopThreads) throws Exception {
+    public Server(Configuration conf, AccumuloClient accumuloClient, int eventLoopThreads) {

        DEFAULT_EVENT_LOOP_THREADS = eventLoopThreads;
        this.config = conf;
+        if (accumuloClient == null) {
+            this.accumuloClient = createAccumuloClient((conf));
+        } else {
+            this.accumuloClient = accumuloClient;
+        }
    }

-    public Server(Configuration conf) throws Exception {
+    public Server(Configuration conf, AccumuloClient accumuloClient) {
+        this(conf, accumuloClient, Math.max(1,
+                SystemPropertyUtil.getInt("io.netty.eventLoopThreads", NettyRuntime.availableProcessors() * 2)));
+    }

-        DEFAULT_EVENT_LOOP_THREADS = Math.max(1,
-                SystemPropertyUtil.getInt("io.netty.eventLoopThreads", NettyRuntime.availableProcessors() * 2));
-        this.config = conf;
+    public Server(Configuration conf) {
+        this(conf, null);
+    }
+
+    private AccumuloClient createAccumuloClient(Configuration conf) {
+        Properties properties = new Properties();
+        Accumulo accumuloConf = conf.getAccumulo();
+        properties.put(ClientProperty.INSTANCE_NAME.getKey(), accumuloConf.getInstanceName());
+        properties.put(ClientProperty.INSTANCE_ZOOKEEPERS.getKey(), accumuloConf.getZookeepers());
+        properties.put(ClientProperty.INSTANCE_ZOOKEEPERS_TIMEOUT.getKey(), accumuloConf.getZookeeperTimeout());
+        properties.put(ClientProperty.AUTH_PRINCIPAL.getKey(), accumuloConf.getUsername());
+        properties.put(ClientProperty.AUTH_TOKEN.getKey(), accumuloConf.getPassword());
+        properties.put(ClientProperty.AUTH_TYPE.getKey(), "password");
+        return org.apache.accumulo.core.client.Accumulo.newClient().from(properties).build();
+    }
+
+    public void setAccumuloClient(AccumuloClient accumuloClient) {
+        this.accumuloClient = accumuloClient;
    }

    private void ensureZkPaths(CuratorFramework curatorFramework, String[] paths) {
@@ -465,8 +494,7 @@ public class Server {
    public void run() throws Exception {

        RetryPolicy retryPolicy = new RetryForever(1000);
-        int timeout = Long.valueOf(AccumuloConfiguration.getTimeInMillis(config.getAccumulo().getZookeeperTimeout()))
-                .intValue();
+        int timeout = Long.valueOf(getTimeInMillis(config.getAccumulo().getZookeeperTimeout())).intValue();
        curatorFramework = CuratorFrameworkFactory.newClient(config.getAccumulo().getZookeepers(), timeout, 10000,
                retryPolicy);
        curatorFramework.start();
@@ -474,7 +502,7 @@ public class Server {

        int nettyThreads = Math.max(1,
                SystemPropertyUtil.getInt("io.netty.eventLoopThreads", Runtime.getRuntime().availableProcessors() * 2));
-        dataStore = DataStoreFactory.create(config, nettyThreads);
+        dataStore = DataStoreFactory.create(config, accumuloClient, nettyThreads);
        if (config.getCache().isEnabled()) {
            dataStoreCache = new DataStoreCache(curatorFramework, config);
            dataStoreCache.setInternalMetrics(dataStore.getInternalMetrics());
@@ -484,7 +512,7 @@ public class Server {
        MetaCacheFactory.getCache(config);
        AuthCache.configure(config.getSecurity());
        VisibilityCache.init(config);
-        JWTTokenHandler.init(config.getSecurity(), config.getAccumulo());
+        JWTTokenHandler.init(config.getSecurity().getJwtSsl(), accumuloClient);
        final boolean useEpoll = useEpoll();
        Class<? extends ServerSocketChannel> channelClass;
        Class<? extends Channel> datagramChannelClass;
@@ -520,7 +548,6 @@ public class Server {
        tcpServer.childHandler(setupTcpChannel());
        tcpServer.option(ChannelOption.ALLOCATOR, PooledByteBufAllocator.DEFAULT);
        tcpServer.option(ChannelOption.SO_BACKLOG, 128);
-        tcpServer.option(ChannelOption.SO_KEEPALIVE, true);
        final int tcpPort = config.getServer().getTcpPort();
        final String tcpIp = config.getServer().getIp();
        tcpChannelHandle = tcpServer.bind(tcpIp, tcpPort).sync().channel();
@@ -545,7 +572,6 @@ public class Server {
        httpServer.childHandler(setupHttpChannel(config, sslCtx));
        httpServer.option(ChannelOption.ALLOCATOR, PooledByteBufAllocator.DEFAULT);
        httpServer.option(ChannelOption.SO_BACKLOG, 128);
-        httpServer.option(ChannelOption.SO_KEEPALIVE, true);
        httpChannelHandle = httpServer.bind(httpIp, httpPort).sync().channel();
        final String httpAddress = ((InetSocketAddress) httpChannelHandle.localAddress()).getAddress().getHostAddress();

@@ -558,9 +584,7 @@ public class Server {
        wsServer.childHandler(setupWSChannel(sslCtx, config));
        wsServer.option(ChannelOption.ALLOCATOR, PooledByteBufAllocator.DEFAULT);
        wsServer.option(ChannelOption.SO_BACKLOG, 128);
-        wsServer.option(ChannelOption.SO_KEEPALIVE, true);
-        /* Not sure if next two lines are necessary */
-        wsServer.option(ChannelOption.SO_SNDBUF, 1048576);
+        /* Not sure if next line is necessary */
        wsServer.option(ChannelOption.WRITE_BUFFER_WATER_MARK, new WriteBufferWaterMark(620145, 838860));
        wsChannelHandle = wsServer.bind(wsIp, wsPort).sync().channel();
        final String wsAddress = ((InetSocketAddress) wsChannelHandle.localAddress()).getAddress().getHostAddress();
@@ -591,38 +615,19 @@ public class Server {
        Boolean generate = sslCfg.isUseGeneratedKeypair();
        SslContextBuilder ssl;
        if (generate) {
-            LOG.warn("Using generated self signed server certificate");
+            LOG.info("Using generated self signed server certificate");
            Date begin = new Date();
            Date end = new Date(begin.getTime() + TimeUnit.DAYS.toMillis(7));
            SelfSignedCertificate ssc = new SelfSignedCertificate("localhost", begin, end);
            ssl = SslContextBuilder.forServer(ssc.certificate(), ssc.privateKey());
        } else {
-            String cert = sslCfg.getCertificateFile();
-            String key = sslCfg.getKeyFile();
-            String keyPass = sslCfg.getKeyPassword();
-            if (null == cert || null == key) {
+            if (null == sslCfg.getKeyStoreFile()) {
                throw new IllegalArgumentException("Check your SSL properties, something is wrong.");
            }
-            ssl = SslContextBuilder.forServer(new File(cert), new File(key), keyPass);
+            ssl = SslHelper.getSslContextBuilder(sslCfg);
        }
-
-        ssl.ciphers(sslCfg.getUseCiphers());
-
        // Can't set to REQUIRE because the CORS pre-flight requests will fail.
        ssl.clientAuth(ClientAuth.OPTIONAL);
-
-        Boolean useOpenSSL = sslCfg.isUseOpenssl();
-        if (useOpenSSL) {
-            ssl.sslProvider(SslProvider.OPENSSL);
-        } else {
-            ssl.sslProvider(SslProvider.JDK);
-        }
-        String trustStore = sslCfg.getTrustStoreFile();
-        if (null != trustStore) {
-            if (!trustStore.isEmpty()) {
-                ssl.trustManager(new File(trustStore));
-            }
-        }
        return ssl.build();
    }

@@ -661,7 +666,7 @@ public class Server {
                ch.pipeline().addLast("queryDecoder",
                        new timely.netty.http.HttpRequestDecoder(config.getSecurity(), config.getHttp()));
                ch.pipeline().addLast("fileServer", new HttpStaticFileServerHandler()
-                        .setIgnoreSslHandshakeErrors(config.getSecurity().getServerSsl().isUseGeneratedKeypair()));
+                        .setIgnoreSslHandshakeErrors(config.getSecurity().getServerSsl().isIgnoreSslHandshakeErrors()));
                ch.pipeline().addLast("strict", new StrictTransportHandler(config));
                ch.pipeline().addLast("login", new X509LoginRequestHandler(config.getSecurity(), config.getHttp()));
                ch.pipeline().addLast("doLogin",
@@ -675,7 +680,7 @@ public class Server {
                ch.pipeline().addLast("cache", new HttpCacheRequestHandler(dataStoreCache));
                ch.pipeline().addLast("put", new HttpMetricPutHandler(dataStore));
                ch.pipeline().addLast("error", new TimelyExceptionHandler()
-                        .setIgnoreSslHandshakeErrors(config.getSecurity().getServerSsl().isUseGeneratedKeypair()));
+                        .setIgnoreSslHandshakeErrors(config.getSecurity().getServerSsl().isIgnoreSslHandshakeErrors()));

            }
        };
@@ -3,10 +3,11 @@ package timely;
 import java.io.File;
 import java.io.IOException;

+import org.apache.accumulo.core.client.AccumuloClient;
 import org.apache.accumulo.core.client.AccumuloException;
 import org.apache.accumulo.core.client.AccumuloSecurityException;
-import org.apache.accumulo.core.client.Connector;
 import org.apache.accumulo.core.client.admin.SecurityOperations;
+import org.apache.accumulo.core.client.security.tokens.PasswordToken;
 import org.apache.accumulo.core.security.Authorizations;
 import org.apache.accumulo.minicluster.MemoryUnit;
 import org.apache.accumulo.minicluster.MiniAccumuloCluster;
@@ -73,9 +74,8 @@ public class StandaloneServer extends Server {
            System.err.println("Error starting MiniAccumuloCluster: " + e.getMessage());
            System.exit(1);
        }
-        try {
-            Connector conn = mac.getConnector("root", "secret");
-            SecurityOperations sops = conn.securityOperations();
+        try (AccumuloClient accumuloClient = mac.createAccumuloClient("root", new PasswordToken("secret"))) {
+            SecurityOperations sops = accumuloClient.securityOperations();
            Authorizations rootAuths = new Authorizations("A", "B", "C", "D", "E", "F", "G", "H", "I");
            sops.changeUserAuthorizations("root", rootAuths);
        } catch (AccumuloException | AccumuloSecurityException e) {
@@ -125,7 +125,7 @@ public class AuthCache {
    }

    public static Collection<Authorizations> getAuthorizations(AuthenticatedRequest request, Security security) {
-        Collection<Authorizations> auths;
+        Collection<Authorizations> auths = Collections.singletonList(Authorizations.EMPTY);
        boolean anonAccessAllowed;
        if (request instanceof AuthenticatedWebSocketRequest) {
            anonAccessAllowed = security.isAllowAnonymousWsAccess();
@@ -137,7 +137,7 @@ public class AuthCache {
        String oauthToken = request.getRequestHeader(AuthenticationService.AUTH_HEADER);
        if (oauthToken != null) {
            auths = getAuthorizations(token.getTimelyPrincipal().getName());
-        } else if (StringUtils.isBlank(sessionId) && token.getClientCert() == null) {
+        } else if (StringUtils.isBlank(sessionId) && token != null && token.getClientCert() == null) {
            if (anonAccessAllowed) {
                auths = Collections.singletonList(Authorizations.EMPTY);
            } else {
@@ -146,7 +146,7 @@ public class AuthCache {
            }
        } else if (StringUtils.isNotBlank(sessionId)) {
            auths = getAuthorizations(sessionId);
-        } else {
+        } else if (token != null && token.getTimelyPrincipal() != null) {
            auths = getAuthorizations(token.getTimelyPrincipal().getName());
        }
        return auths;
@@ -27,8 +27,8 @@ import timely.netty.http.auth.TimelyUserDetails;
 public class AuthenticationService {

    private static final Logger LOG = LoggerFactory.getLogger(AuthenticationService.class);
-    private static ApplicationContext springContext = null;
-    private static AuthenticationManager authManager = null;
+    private static ApplicationContext springContext;
+    private static AuthenticationManager authManager;
    private static ConcurrentHashMap<String, Object> fetchingEntity = new ConcurrentHashMap<>();
    private static ConcurrentHashMap<String, Object> fetchingPrincipal = new ConcurrentHashMap<>();
    private static Collection<String> requiredRoles;
@@ -161,9 +161,8 @@ public class AuthenticationService {
                                    }
                                    verifiedPrincipal = new TimelyPrincipal(authenticatedTimelyUsers);
                                    AuthCache.put(verifiedPrincipal.getName(), verifiedPrincipal);
-                                    LOG.debug("Authenticated user {} for request {} with authorizations {}",
-                                            verifiedPrincipal.getName(), request.toString(),
-                                            verifiedPrincipal.getAuthorizationsString());
+                                    LOG.debug("Authenticated user {} with authorizations {}",
+                                            verifiedPrincipal.getName(), verifiedPrincipal.getAuthorizationsString());
                                } else {
                                    LOG.trace("Verified principal {} in AuthCache on 2nd attempt", entity);
                                }
@@ -9,7 +9,7 @@ import org.apache.accumulo.core.iterators.IteratorEnvironment;
 import org.apache.accumulo.core.iterators.OptionDescriber;
 import org.apache.accumulo.core.iterators.SortedKeyValueIterator;
 import org.apache.accumulo.core.iterators.WrappingIterator;
-import org.apache.accumulo.core.iterators.system.VisibilityFilter;
+import org.apache.accumulo.core.iteratorsImpl.system.VisibilityFilter;
 import org.apache.accumulo.core.security.Authorizations;
 import org.apache.log4j.Logger;

@@ -7,13 +7,13 @@ import java.util.List;
 import java.util.Map;

 import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.AuthenticationUserDetailsService;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
 import timely.netty.http.auth.TimelyUserDetails;

-public class UserDetailsService implements
-        org.springframework.security.core.userdetails.AuthenticationUserDetailsService<PreAuthenticatedAuthenticationToken> {
+public class FileUserDetailsService implements AuthenticationUserDetailsService<PreAuthenticatedAuthenticationToken> {

    private HashMap<String, TimelyUser> users;

@@ -7,24 +7,24 @@ import java.security.KeyStore;
 import java.security.cert.Certificate;
 import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
-import java.util.*;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+import java.util.TreeSet;
 import java.util.stream.Collectors;

 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.datatype.guava.GuavaModule;
-import io.jsonwebtoken.*;
-import org.apache.accumulo.core.client.ClientConfiguration;
-import org.apache.accumulo.core.client.Connector;
-import org.apache.accumulo.core.client.Instance;
-import org.apache.accumulo.core.client.ZooKeeperInstance;
-import org.apache.accumulo.core.client.security.tokens.PasswordToken;
+import io.jsonwebtoken.Claims;
+import io.jsonwebtoken.Jws;
+import io.jsonwebtoken.Jwts;
+import org.apache.accumulo.core.client.AccumuloClient;
 import org.apache.accumulo.core.security.Authorizations;
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.util.ResourceUtils;
-import timely.configuration.Accumulo;
-import timely.configuration.Security;
+import timely.configuration.JwtSsl;

 /**
 * Converts between a String encoded JSON Web Token and a collection of
@@ -37,23 +37,23 @@ public class JWTTokenHandler {
    private static ObjectMapper objectMapper;
    private static Collection<String> accumuloAuths = new TreeSet<>();

-    public static void init(Security security, Accumulo accumulo) {
-        if (StringUtils.isNotBlank(security.getJwtCheckKeyStore())) {
+    public static void init(JwtSsl ssl, AccumuloClient accumuloClient) {
+        if (StringUtils.isNotBlank(ssl.getKeyStoreFile())) {
            try {
-                String type = security.getJwtCheckKeyType();
+                String type = ssl.getKeyStoreType();
                if (type != null && type.equals("X.509")) {
                    CertificateFactory factory = CertificateFactory.getInstance("X.509");
-                    InputStream is = ResourceUtils.getURL(security.getJwtCheckKeyStore()).openStream();
+                    InputStream is = ResourceUtils.getURL(ssl.getKeyStoreFile()).openStream();
                    X509Certificate certificate = (X509Certificate) factory.generateCertificate(is);
                    JWTTokenHandler.signatureCheckKey = certificate.getPublicKey();
                } else {
                    KeyStore keyStore = KeyStore.getInstance(type == null ? "JKS" : type);
-                    char[] keyPassword = security.getJwtCheckKeyPassword() == null ? null
-                            : security.getJwtCheckKeyPassword().toCharArray();
-                    keyStore.load(ResourceUtils.getURL(security.getJwtCheckKeyStore()).openStream(), keyPassword);
+                    char[] keyPassword = ssl.getKeyStorePassword() == null ? null
+                            : ssl.getKeyStorePassword().toCharArray();
+                    keyStore.load(ResourceUtils.getURL(ssl.getKeyStoreFile()).openStream(), keyPassword);
                    String alias = keyStore.aliases().nextElement();
-                    Certificate cert = keyStore.getCertificate(alias);
-                    JWTTokenHandler.signatureCheckKey = cert.getPublicKey();
+                    Certificate certificate = keyStore.getCertificate(alias);
+                    JWTTokenHandler.signatureCheckKey = certificate.getPublicKey();
                }
            } catch (Exception e) {
                throw new IllegalStateException("Invalid SSL configuration.", e);
@@ -61,18 +61,11 @@ public class JWTTokenHandler {
        }
        JWTTokenHandler.objectMapper = new ObjectMapper();
        JWTTokenHandler.objectMapper.registerModule(new GuavaModule());
-        if (accumulo != null) {
+
+        if (accumuloClient != null) {
            try {
-                final Map<String, String> properties = new HashMap<>();
-                properties.put("instance.name", accumulo.getInstanceName());
-                properties.put("instance.zookeeper.host", accumulo.getZookeepers());
-                properties.put("instance.zookeeper.timeout", accumulo.getZookeeperTimeout());
-                final ClientConfiguration aconf = ClientConfiguration.fromMap(properties);
-                final Instance instance = new ZooKeeperInstance(aconf);
-                Connector connector = instance.getConnector(accumulo.getUsername(),
-                        new PasswordToken(accumulo.getPassword()));
-                Authorizations currentAccumuloAuths = connector.securityOperations()
-                        .getUserAuthorizations(connector.whoami());
+                Authorizations currentAccumuloAuths = accumuloClient.securityOperations()
+                        .getUserAuthorizations(accumuloClient.whoami());
                currentAccumuloAuths.iterator()
                        .forEachRemaining(a -> accumuloAuths.add(new String(a, Charset.forName("UTF-8"))));
            } catch (Exception e) {
@@ -0,0 +1,152 @@
+package timely.auth;
+
+import static timely.auth.AuthenticationService.PRINCIPALS_CLAIM;
+
+import java.util.ArrayList;
+import java.util.Collection;
+
+import io.netty.handler.ssl.SslContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.http.client.reactive.ClientHttpConnector;
+import org.springframework.http.client.reactive.ReactorClientHttpConnector;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.AuthenticationUserDetailsService;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
+import org.springframework.web.reactive.function.client.WebClient;
+import reactor.netty.http.client.HttpClient;
+import timely.auth.util.SslHelper;
+import timely.configuration.AuthorizationProperties;
+import timely.configuration.ClientSsl;
+import timely.netty.http.auth.TimelyAuthenticationToken;
+import timely.netty.http.auth.TimelyUserDetails;
+
+public class RemoteUserDetailsService implements AuthenticationUserDetailsService<PreAuthenticatedAuthenticationToken> {
+
+    static private final Logger log = LoggerFactory.getLogger(RemoteUserDetailsService.class);
+    private WebClient webClient;
+    private ClientSsl clientSsl;
+    private AuthorizationProperties authorizationProperties;
+
+    public RemoteUserDetailsService() {
+
+    }
+
+    public RemoteUserDetailsService(ClientSsl clientSsl, AuthorizationProperties authorizationProperties)
+            throws Exception {
+        this.clientSsl = clientSsl;
+        this.authorizationProperties = authorizationProperties;
+        initialize();
+    }
+
+    public void initialize() throws Exception {
+        WebClient.Builder webClientBuilder = WebClient.builder();
+        SslContext sslContext = SslHelper.getSslContext(clientSsl);
+        HttpClient httpClient = HttpClient.create().secure(sslContextSpec -> sslContextSpec.sslContext(sslContext));
+        ClientHttpConnector httpConnector = new ReactorClientHttpConnector(httpClient);
+        this.webClient = webClientBuilder.clientConnector(httpConnector)
+                .baseUrl(authorizationProperties.getAuthorizationUrl()).build();
+    }
+
+    public void setClientSsl(ClientSsl clientSsl) {
+        this.clientSsl = clientSsl;
+    }
+
+    public void setAuthorizationProperties(AuthorizationProperties authorizationProperties) {
+        this.authorizationProperties = authorizationProperties;
+    }
+
+    @Override
+    public UserDetails loadUserDetails(PreAuthenticatedAuthenticationToken token) throws UsernameNotFoundException {
+        TimelyUserDetails userDetails = null;
+        if (!(token instanceof TimelyAuthenticationToken)) {
+            log.error("Unexpected type for token: {}", token.getClass().getName());
+        }
+        TimelyAuthenticationToken timelyToken = (TimelyAuthenticationToken) token;
+        TimelyPrincipal principal = timelyToken.getTimelyPrincipal();
+        String subjectDN = principal.getPrimaryUser().getDn().subjectDN();
+        String issuerDN = principal.getPrimaryUser().getDn().issuerDN();
+        try {
+            log.trace("Authenticating {} via the authorization microservice", subjectDN);
+            // @formatter:off
+            String jwt = webClient.get()
+                    .header(TimelyAuthenticationToken.PROXIED_ENTITIES_HEADER, subjectDN)
+                    .header(TimelyAuthenticationToken.PROXIED_ISSUERS_HEADER, issuerDN)
+                    .retrieve()
+                    .bodyToMono(String.class)
+                    .block();
+            // @formatter:on
+            log.trace("Authenticated {} via the authorization microservice with {} result", subjectDN,
+                    jwt == null ? "null" : "non-null");
+            if (jwt != null) {
+                Collection<TimelyUser> timelyUsers = JWTTokenHandler.createUsersFromToken(jwt, PRINCIPALS_CLAIM);
+                if (timelyUsers.iterator().hasNext()) {
+                    userDetails = getTimelyUserDetails(timelyUsers.iterator().next());
+                }
+            }
+            if (userDetails == null) {
+                throw new UsernameNotFoundException("No entities found for " + subjectDN);
+            }
+        } catch (Exception e) {
+            log.error("Failed performing lookup of {}: {}", subjectDN, e);
+            throw new UsernameNotFoundException(e.getMessage(), e);
+        }
+        return userDetails;
+    }
+
+    private TimelyUserDetails getTimelyUserDetails(TimelyUser timelyUser) {
+        return new TimelyUserDetails() {
+
+            private static final long serialVersionUID = 1L;
+
+            @Override
+            public Collection<SimpleGrantedAuthority> getAuthorities() {
+                final Collection<SimpleGrantedAuthority> auths = new ArrayList<>();
+                timelyUser.getAuths().forEach(a -> {
+                    auths.add(new SimpleGrantedAuthority(a));
+                });
+                return auths;
+            }
+
+            @Override
+            public Collection<String> getRoles() {
+                final Collection<String> roles = new ArrayList<>();
+                roles.addAll(timelyUser.getRoles());
+                return roles;
+            }
+
+            @Override
+            public String getPassword() {
+                return "";
+            }
+
+            @Override
+            public String getUsername() {
+                return timelyUser.getName();
+            }
+
+            @Override
+            public boolean isAccountNonExpired() {
+                return true;
+            }
+
+            @Override
+            public boolean isAccountNonLocked() {
+                return true;
+            }
+
+            @Override
+            public boolean isCredentialsNonExpired() {
+                return true;
+            }
+
+            @Override
+            public boolean isEnabled() {
+                return true;
+            }
+
+        };
+    }
+}
@@ -9,11 +9,11 @@ import com.google.common.collect.Lists;
 import org.apache.accumulo.core.client.IteratorSetting;
 import org.apache.accumulo.core.client.IteratorSetting.Column;
 import org.apache.accumulo.core.client.ScannerBase;
-import org.apache.accumulo.core.client.impl.ScannerOptions;
 import org.apache.accumulo.core.client.sample.SamplerConfiguration;
+import org.apache.accumulo.core.clientImpl.ScannerOptions;
 import org.apache.accumulo.core.data.Key;
 import org.apache.accumulo.core.data.Value;
-import org.apache.accumulo.core.data.thrift.IterInfo;
+import org.apache.accumulo.core.dataImpl.thrift.IterInfo;
 import org.apache.accumulo.core.security.Authorizations;
 import org.apache.hadoop.io.Text;

@@ -28,6 +28,7 @@ public class ScannerBaseDelegate implements ScannerBase {
    private static final String SYSTEM_ITERATOR_NAME_PREFIX = "sys_";

    protected final ScannerBase delegate;
+    protected ConsistencyLevel consistencyLevel = ConsistencyLevel.IMMEDIATE;

    public ScannerBaseDelegate(ScannerBase delegate) {
        this.delegate = delegate;
@@ -221,6 +222,16 @@ public class ScannerBaseDelegate implements ScannerBase {
        return delegate.getClassLoaderContext();
    }

+    @Override
+    public ConsistencyLevel getConsistencyLevel() {
+        return consistencyLevel;
+    }
+
+    @Override
+    public void setConsistencyLevel(ConsistencyLevel consistencyLevel) {
+        this.consistencyLevel = consistencyLevel;
+    }
+
    public void setContext(String context) {
        delegate.setClassLoaderContext(context);
    }
@@ -1,7 +1,6 @@
 package timely.auth.util;

 import java.nio.charset.Charset;
-import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.HashSet;
@@ -11,7 +10,6 @@ import java.util.Set;
 import java.util.stream.Collectors;

 import com.google.common.base.Splitter;
-import com.google.common.collect.Iterables;
 import com.google.common.collect.Lists;
 import com.google.common.collect.Sets;
 import org.apache.accumulo.core.security.Authorizations;
@@ -38,8 +36,8 @@ public class AuthorizationsUtil {
    }

    public static List<String> splitAuths(String requestedAuths) {
-        return Arrays.asList(Iterables.toArray(Splitter.on(',').omitEmptyStrings().trimResults().split(requestedAuths),
-                String.class));
+        return Splitter.on(',').omitEmptyStrings().trimResults().splitToStream(requestedAuths)
+                .collect(Collectors.toList());
    }

    public static Set<Authorizations> buildAuthorizations(Collection<? extends Collection<String>> userAuths) {
@@ -4,10 +4,10 @@ import java.util.Collection;
 import java.util.Iterator;
 import java.util.concurrent.TimeUnit;

+import org.apache.accumulo.core.client.AccumuloClient;
 import org.apache.accumulo.core.client.BatchDeleter;
 import org.apache.accumulo.core.client.BatchScanner;
 import org.apache.accumulo.core.client.BatchWriterConfig;
-import org.apache.accumulo.core.client.Connector;
 import org.apache.accumulo.core.client.IteratorSetting;
 import org.apache.accumulo.core.client.Scanner;
 import org.apache.accumulo.core.client.ScannerBase;
@@ -23,29 +23,29 @@ public class ScannerHelper {

    private static final Logger logger = LoggerFactory.getLogger(ScannerHelper.class);

-    public static Scanner createScanner(Connector connector, String tableName,
+    public static Scanner createScanner(AccumuloClient accumuloClient, String tableName,
            Collection<Authorizations> authorizations) throws TableNotFoundException {
        if (authorizations == null || authorizations.isEmpty())
            throw new IllegalArgumentException("Authorizations must not be empty.");

        Iterator<Authorizations> iter = AuthorizationsMinimizer.minimize(authorizations).iterator();
-        Scanner scanner = connector.createScanner(tableName, iter.next());
+        Scanner scanner = accumuloClient.createScanner(tableName, iter.next());
        addVisibilityFilters(iter, scanner);
        return scanner;
    }

-    public static BatchScanner createBatchScanner(Connector connector, String tableName,
+    public static BatchScanner createBatchScanner(AccumuloClient accumuloClient, String tableName,
            Collection<Authorizations> authorizations, int numQueryThreads) throws TableNotFoundException {
        if (authorizations == null || authorizations.isEmpty())
            throw new IllegalArgumentException("Authorizations must not be empty.");

        Iterator<Authorizations> iter = AuthorizationsMinimizer.minimize(authorizations).iterator();
-        BatchScanner batchScanner = connector.createBatchScanner(tableName, iter.next(), numQueryThreads);
+        BatchScanner batchScanner = accumuloClient.createBatchScanner(tableName, iter.next(), numQueryThreads);
        addVisibilityFilters(iter, batchScanner);
        return batchScanner;
    }

-    public static BatchDeleter createBatchDeleter(Connector connector, String tableName,
+    public static BatchDeleter createBatchDeleter(AccumuloClient accumuloClient, String tableName,
            Collection<Authorizations> authorizations, int numQueryThreads, long maxMemory, long maxLatency,
            int maxWriteThreads) throws TableNotFoundException {
        if (authorizations == null || authorizations.isEmpty())
@@ -54,7 +54,7 @@ public class ScannerHelper {
        Iterator<Authorizations> iter = AuthorizationsMinimizer.minimize(authorizations).iterator();
        BatchWriterConfig bwCfg = new BatchWriterConfig().setMaxLatency(maxLatency, TimeUnit.MILLISECONDS)
                .setMaxMemory(maxMemory).setMaxWriteThreads(maxWriteThreads);
-        BatchDeleter batchDeleter = connector.createBatchDeleter(tableName, iter.next(), numQueryThreads, bwCfg);
+        BatchDeleter batchDeleter = accumuloClient.createBatchDeleter(tableName, iter.next(), numQueryThreads, bwCfg);
        addVisibilityFilters(iter, batchDeleter);
        return batchDeleter;
    }
@@ -0,0 +1,504 @@
+package timely.auth.util;
+
+import java.io.IOException;
+import java.net.Socket;
+import java.net.URL;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.Principal;
+import java.security.PrivateKey;
+import java.security.Provider;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+import java.util.Enumeration;
+
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.KeyManagerFactorySpi;
+import javax.net.ssl.ManagerFactoryParameters;
+import javax.net.ssl.SSLEngine;
+import javax.net.ssl.SSLParameters;
+import javax.net.ssl.SSLSocket;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.TrustManagerFactorySpi;
+import javax.net.ssl.X509ExtendedKeyManager;
+import javax.net.ssl.X509ExtendedTrustManager;
+import javax.net.ssl.X509TrustManager;
+
+import com.google.common.base.Preconditions;
+import io.netty.handler.ssl.SslContext;
+import io.netty.handler.ssl.SslContextBuilder;
+import io.netty.handler.ssl.SslProvider;
+import io.netty.util.concurrent.FastThreadLocal;
+import org.springframework.util.ResourceUtils;
+import timely.configuration.ServerSsl;
+import timely.configuration.Ssl;
+
+public class SslHelper {
+
+    public static SslContext getSslContext(Ssl ssl) throws Exception {
+        return getSslContextBuilder(ssl).build();
+    }
+
+    public static SslContextBuilder getSslContextBuilder(Ssl ssl) throws Exception {
+        KeyManagerFactory keyManagerFactory = getKeyManagerFactory(ssl);
+        SslContextBuilder builder = ssl instanceof ServerSsl ? SslContextBuilder.forServer(keyManagerFactory)
+                : SslContextBuilder.forClient().keyManager(keyManagerFactory);
+        boolean useOpenSSL = ssl.isUseOpenssl();
+        if (useOpenSSL) {
+            builder.sslProvider(SslProvider.OPENSSL);
+        } else {
+            builder.sslProvider(SslProvider.JDK);
+        }
+        if (ssl.getTrustStoreFile() != null) {
+            builder.trustManager(getTrustManagerFactory(ssl));
+        }
+        if (ssl.getCiphers() != null)
+            builder.ciphers(Arrays.asList(ssl.getCiphers()));
+        if (ssl.getEnabledProtocols() != null)
+            builder.protocols(ssl.getEnabledProtocols());
+        return builder;
+    }
+
+    public static KeyManager[] getKeyManagers(Ssl ssl) {
+        return getKeyManagerFactory(ssl).getKeyManagers();
+    }
+
+    public static KeyManagerFactory getKeyManagerFactory(Ssl ssl) {
+        try {
+            KeyStore keyStore = getKeyStore(ssl);
+
+            // Get key manager to provide client credentials.
+            KeyManagerFactory keyManagerFactory = KeyManagerFactory
+                    .getInstance(KeyManagerFactory.getDefaultAlgorithm());
+            char[] keyStorePassword = ssl.getKeyStorePassword() == null ? null
+                    : ssl.getKeyStorePassword().toCharArray();
+            keyManagerFactory.init(keyStore, keyStorePassword);
+            if (ssl.getKeyAlias() != null)
+                return new KeyAliasKeyManagerFactory(keyManagerFactory, ssl.getKeyAlias());
+            else
+                return keyManagerFactory;
+        } catch (Exception e) {
+            throw new IllegalStateException(e);
+        }
+    }
+
+    public static KeyStore getKeyStore(Ssl ssl)
+            throws KeyStoreException, IOException, CertificateException, NoSuchAlgorithmException {
+        String keyStoreType = ssl.getKeyStoreType();
+        if (keyStoreType == null) {
+            keyStoreType = "PKCS12";
+        }
+        KeyStore keyStore = KeyStore.getInstance(keyStoreType);
+        URL url = ResourceUtils.getURL(ssl.getKeyStoreFile());
+        char[] keyStorePassword = ssl.getKeyStorePassword() == null ? null : ssl.getKeyStorePassword().toCharArray();
+        keyStore.load(url.openStream(), keyStorePassword);
+        return keyStore;
+    }
+
+    public static TrustManager[] getTrustManagers(Ssl ssl) {
+        TrustManagerFactory tmf = getTrustManagerFactory(ssl);
+        return tmf.getTrustManagers();
+    }
+
+    public static TrustManagerFactory getTrustManagerFactory(Ssl ssl) {
+        try {
+            KeyStore trustStore = getTrustStore(ssl);
+            KeyStore keyStore = getKeyStore(ssl);
+
+            X509Certificate trustedCertificate = getTrustedCertificate(ssl.getKeyAlias(), keyStore);
+
+            TrustManagerFactory trustManagerFactory = new TimelyTrustMangerFactory(
+                    TrustManagerFactory.getDefaultAlgorithm(), trustedCertificate);
+            trustManagerFactory.init(trustStore);
+            return trustManagerFactory;
+        } catch (Exception e) {
+            throw new IllegalStateException(e);
+        }
+    }
+
+    public static KeyStore getTrustStore(Ssl ssl)
+            throws KeyStoreException, IOException, CertificateException, NoSuchAlgorithmException {
+        String trustStoreType = ssl.getTrustStoreType();
+        if (trustStoreType == null) {
+            trustStoreType = "JKS";
+        }
+        String trustStoreURL = ssl.getTrustStoreFile();
+        if (trustStoreURL == null) {
+            return null;
+        }
+        KeyStore trustStore = KeyStore.getInstance(trustStoreType);
+        URL url = ResourceUtils.getURL(trustStoreURL);
+        char[] trustStorePassword = ssl.getTrustStorePassword() == null ? null
+                : ssl.getTrustStorePassword().toCharArray();
+        trustStore.load(url.openStream(), trustStorePassword);
+        return trustStore;
+    }
+
+    public static X509Certificate getTrustedCertificate(String alias, KeyStore keyStore) throws KeyStoreException {
+        Certificate trustCandidate = null;
+        X509Certificate trustedCertificate = null;
+        if (alias != null) {
+            trustCandidate = keyStore.getCertificate(alias);
+        } else {
+            Enumeration<String> aliases = keyStore.aliases();
+            if (aliases.hasMoreElements()) {
+                trustCandidate = keyStore.getCertificate(aliases.nextElement());
+            }
+        }
+        if (trustCandidate instanceof X509Certificate) {
+            trustedCertificate = (X509Certificate) trustCandidate;
+        }
+        return trustedCertificate;
+    }
+
+    /**
+     * A custom {@link TrustManagerFactory} that wraps any returned
+     * {@link TrustManager}s in order to apply custom behavior for trusting a remote
+     * server.
+     */
+    private static class TimelyTrustMangerFactory extends TrustManagerFactory {
+
+        private static final Provider PROVIDER = new Provider("", 0.0, "") {
+
+            private static final long serialVersionUID = -2680540247105807895L;
+        };
+        private static final FastThreadLocal<TimelyTrustManagerSpi> CURRENT_SPI = new FastThreadLocal<>() {
+
+            @Override
+            protected TimelyTrustManagerSpi initialValue() {
+                return new TimelyTrustManagerSpi();
+            }
+        };
+
+        public TimelyTrustMangerFactory(String algorithm, X509Certificate trustedCertificate)
+                throws NoSuchAlgorithmException {
+            super(CURRENT_SPI.get(), PROVIDER, algorithm);
+            CURRENT_SPI.get().init(TrustManagerFactory.getInstance(algorithm), trustedCertificate);
+            CURRENT_SPI.remove();
+
+            Preconditions.checkNotNull(algorithm);
+        }
+    }
+
+    /**
+     * The {@link TrustManagerFactorySpi} that is used by
+     * {@link TimelyTrustMangerFactory} in order to wrap any returned
+     * {@link TrustManager}s with a {@link TimelyTrustManager}.
+     */
+    private static class TimelyTrustManagerSpi extends TrustManagerFactorySpi {
+
+        private TrustManagerFactory delegate;
+        private X509Certificate trustedCertificate;
+        private volatile TrustManager[] trustManagers;
+
+        public void init(TrustManagerFactory delegate, X509Certificate trustedCertificate) {
+            this.delegate = delegate;
+            this.trustedCertificate = trustedCertificate;
+        }
+
+        @Override
+        protected void engineInit(KeyStore keyStore) throws KeyStoreException {
+            delegate.init(keyStore);
+        }
+
+        @Override
+        protected void engineInit(ManagerFactoryParameters managerFactoryParameters)
+                throws InvalidAlgorithmParameterException {
+            delegate.init(managerFactoryParameters);
+        }
+
+        @Override
+        protected TrustManager[] engineGetTrustManagers() {
+            TrustManager[] trustManagers = this.trustManagers;
+            if (trustManagers == null) {
+                trustManagers = delegate.getTrustManagers();
+                for (int i = 0; i < trustManagers.length; i++) {
+                    final TrustManager tm = trustManagers[i];
+                    if (tm instanceof X509TrustManager) {
+                        trustManagers[i] = new TimelyTrustManager((X509TrustManager) tm, trustedCertificate);
+                    } else {
+                        trustManagers[i] = tm;
+                    }
+                }
+                this.trustManagers = trustManagers;
+            }
+            return trustManagers.clone();
+        }
+    }
+
+    /**
+     * An extension of {@link X509ExtendedTrustManager} that applies custom trust
+     * behavior for use with microservices. It is expected that these services will
+     * run on a cluster where DNS might be used for service discovery. However, the
+     * server certificate used by the microservices will not have the DNS names as
+     * Subject Alternative Name values, so normal trust for the certificate would
+     * fail. This trust manager trusts the remote server regardless of the host name
+     * used to access it, so long as the presented certificate is the one we expect.
+     * Otherwise, it falls back to the normal trust behavior.
+     */
+    private static class TimelyTrustManager extends X509ExtendedTrustManager {
+
+        private X509Certificate trustedCertificate;
+        private X509TrustManager delegate;
+        private X509ExtendedTrustManager extendedDelegate;
+
+        public TimelyTrustManager(X509TrustManager delegate, X509Certificate trustedCertificate) {
+            this.trustedCertificate = trustedCertificate;
+            this.delegate = delegate;
+            if (delegate instanceof X509ExtendedTrustManager) {
+                extendedDelegate = (X509ExtendedTrustManager) delegate;
+            }
+        }
+
+        @Override
+        public X509Certificate[] getAcceptedIssuers() {
+            return delegate.getAcceptedIssuers();
+        }
+
+        @Override
+        public void checkClientTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {
+            delegate.checkClientTrusted(x509Certificates, s);
+        }
+
+        @Override
+        public void checkServerTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {
+            delegate.checkServerTrusted(x509Certificates, s);
+        }
+
+        @Override
+        public void checkClientTrusted(X509Certificate[] x509Certificates, String s, Socket socket)
+                throws CertificateException {
+            Preconditions.checkNotNull(extendedDelegate, "Not wrapping an X509ExtendedTrustManager");
+            boolean certChainTrusted = certChainTrusted(x509Certificates);
+            if ((socket instanceof SSLSocket) && socket.isConnected() && certChainTrusted) {
+                SSLSocket sslSocket = (SSLSocket) socket;
+                SSLParameters origParameters = sslSocket.getSSLParameters();
+                String curIdentityAlgorithm = origParameters.getEndpointIdentificationAlgorithm();
+                try {
+                    // Setting the identification algorithm to empty will prevent the hostname
+                    // verification.
+                    SSLParameters overrideParameters = sslSocket.getSSLParameters();
+                    overrideParameters.setEndpointIdentificationAlgorithm("");
+                    sslSocket.setSSLParameters(overrideParameters);
+
+                    extendedDelegate.checkClientTrusted(x509Certificates, s, socket);
+                } finally {
+                    origParameters.setEndpointIdentificationAlgorithm(curIdentityAlgorithm);
+                    sslSocket.setSSLParameters(origParameters);
+                }
+            } else {
+                extendedDelegate.checkClientTrusted(x509Certificates, s, socket);
+            }
+        }
+
+        @Override
+        public void checkServerTrusted(X509Certificate[] x509Certificates, String s, Socket socket)
+                throws CertificateException {
+            Preconditions.checkNotNull(extendedDelegate, "Not wrapping an X509ExtendedTrustManager");
+            boolean certChainTrusted = certChainTrusted(x509Certificates);
+            if ((socket instanceof SSLSocket) && socket.isConnected() && certChainTrusted) {
+                SSLSocket sslSocket = (SSLSocket) socket;
+                SSLParameters origParameters = sslSocket.getSSLParameters();
+                String curIdentityAlgorithm = origParameters.getEndpointIdentificationAlgorithm();
+                try {
+                    // Setting the identification algorithm to empty will prevent the hostname
+                    // verification.
+                    SSLParameters overrideParameters = sslSocket.getSSLParameters();
+                    overrideParameters.setEndpointIdentificationAlgorithm("");
+                    sslSocket.setSSLParameters(overrideParameters);
+                    extendedDelegate.checkServerTrusted(x509Certificates, s, socket);
+                } finally {
+                    origParameters.setEndpointIdentificationAlgorithm(curIdentityAlgorithm);
+                    sslSocket.setSSLParameters(origParameters);
+                }
+            } else {
+                extendedDelegate.checkServerTrusted(x509Certificates, s, socket);
+            }
+        }
+
+        @Override
+        public void checkClientTrusted(X509Certificate[] x509Certificates, String s, SSLEngine sslEngine)
+                throws CertificateException {
+            Preconditions.checkNotNull(extendedDelegate, "Not wrapping an X509ExtendedTrustManager");
+            boolean certChainTrusted = certChainTrusted(x509Certificates);
+            SSLParameters origParameters = sslEngine.getSSLParameters();
+            String curIdentityAlgorithm = origParameters.getEndpointIdentificationAlgorithm();
+            try {
+                // Setting the identification algorithm to empty will prevent the hostname
+                // verification.
+                if (certChainTrusted) {
+                    SSLParameters overrideParameters = sslEngine.getSSLParameters();
+                    overrideParameters.setEndpointIdentificationAlgorithm("");
+                    sslEngine.setSSLParameters(overrideParameters);
+                }
+
+                extendedDelegate.checkClientTrusted(x509Certificates, s, sslEngine);
+            } finally {
+                origParameters.setEndpointIdentificationAlgorithm(curIdentityAlgorithm);
+                sslEngine.setSSLParameters(origParameters);
+            }
+        }
+
+        @Override
+        public void checkServerTrusted(X509Certificate[] x509Certificates, String s, SSLEngine sslEngine)
+                throws CertificateException {
+            Preconditions.checkNotNull(extendedDelegate, "Not wrapping an X509ExtendedTrustManager");
+            boolean certChainTrusted = certChainTrusted(x509Certificates);
+            SSLParameters origParameters = sslEngine.getSSLParameters();
+            String curIdentityAlgorithm = origParameters.getEndpointIdentificationAlgorithm();
+            try {
+                // Setting the identification algorithm to empty will prevent the hostname
+                // verification.
+                if (certChainTrusted) {
+                    SSLParameters overrideParameters = sslEngine.getSSLParameters();
+                    overrideParameters.setEndpointIdentificationAlgorithm("");
+                    sslEngine.setSSLParameters(overrideParameters);
+                }
+                extendedDelegate.checkServerTrusted(x509Certificates, s, sslEngine);
+            } finally {
+                origParameters.setEndpointIdentificationAlgorithm(curIdentityAlgorithm);
+                sslEngine.setSSLParameters(origParameters);
+            }
+        }
+
+        private boolean certChainTrusted(X509Certificate[] x509Certificates) {
+            // If there was no peer certificate available or none matched the trusted
+            // certificate, then return
+            // immediately so that we use the default trust verification instead of our
+            // custom verification.
+            boolean peerCertIsTrusted = false;
+            if (x509Certificates != null && trustedCertificate != null) {
+                for (X509Certificate cert : x509Certificates) {
+                    if (cert.getSubjectDN().equals(trustedCertificate.getSubjectDN())
+                            && cert.getIssuerDN().equals(trustedCertificate.getIssuerDN())) {
+                        peerCertIsTrusted = true;
+                        break;
+                    }
+                }
+            }
+            return peerCertIsTrusted;
+        }
+    }
+
+    private static class KeyAliasKeyManagerFactory extends KeyManagerFactory {
+
+        private static final Provider PROVIDER = new Provider("", 0.0, "") {
+
+            private static final long serialVersionUID = -2680540247105807895L;
+        };
+        private static final FastThreadLocal<KeyAliasKeyManagerSpi> CURRENT_SPI = new FastThreadLocal<KeyAliasKeyManagerSpi>() {
+
+            @Override
+            protected KeyAliasKeyManagerSpi initialValue() {
+                return new KeyAliasKeyManagerSpi();
+            }
+        };
+
+        public KeyAliasKeyManagerFactory(KeyManagerFactory delegate, String alias) {
+
+            super(CURRENT_SPI.get(), PROVIDER, delegate.getAlgorithm());
+            CURRENT_SPI.get().init(delegate, alias);
+            CURRENT_SPI.remove();
+        }
+    }
+
+    private static class KeyAliasKeyManagerSpi extends KeyManagerFactorySpi {
+
+        private KeyManagerFactory delegate;
+        private String alias;
+        private volatile KeyManager[] keyManagers;
+
+        public void init(KeyManagerFactory delegate, String alias) {
+            this.delegate = delegate;
+            this.alias = alias;
+        }
+
+        @Override
+        protected void engineInit(KeyStore keyStore, char[] chars)
+                throws KeyStoreException, NoSuchAlgorithmException, UnrecoverableKeyException {
+            delegate.init(keyStore, chars);
+        }
+
+        @Override
+        protected void engineInit(ManagerFactoryParameters managerFactoryParameters)
+                throws InvalidAlgorithmParameterException {
+            delegate.init(managerFactoryParameters);
+        }
+
+        @Override
+        protected KeyManager[] engineGetKeyManagers() {
+            KeyManager[] keyManagers = this.keyManagers;
+            if (keyManagers == null) {
+                keyManagers = delegate.getKeyManagers();
+                for (int i = 0; i < keyManagers.length; i++) {
+                    final KeyManager km = keyManagers[i];
+                    if (km instanceof X509ExtendedKeyManager) {
+                        keyManagers[i] = new KeyAliasKeyManager((X509ExtendedKeyManager) km, alias);
+                    } else {
+                        keyManagers[i] = km;
+                    }
+                }
+                this.keyManagers = keyManagers;
+            }
+            return keyManagers.clone();
+        }
+    }
+
+    private static class KeyAliasKeyManager extends X509ExtendedKeyManager {
+
+        private final X509ExtendedKeyManager delegate;
+        private final String alias;
+
+        public KeyAliasKeyManager(X509ExtendedKeyManager delegate, String alias) {
+            this.delegate = delegate;
+            this.alias = alias;
+        }
+
+        @Override
+        public String chooseEngineClientAlias(String[] strings, Principal[] principals, SSLEngine sslEngine) {
+            return delegate.chooseEngineClientAlias(strings, principals, sslEngine);
+        }
+
+        @Override
+        public String chooseEngineServerAlias(String s, Principal[] principals, SSLEngine sslEngine) {
+            return (alias != null) ? alias : delegate.chooseEngineServerAlias(s, principals, sslEngine);
+        }
+
+        @Override
+        public String[] getClientAliases(String s, Principal[] principals) {
+            return delegate.getClientAliases(s, principals);
+        }
+
+        @Override
+        public String chooseClientAlias(String[] strings, Principal[] principals, Socket socket) {
+            return delegate.chooseClientAlias(strings, principals, socket);
+        }
+
+        @Override
+        public String[] getServerAliases(String s, Principal[] principals) {
+            return delegate.getServerAliases(s, principals);
+        }
+
+        @Override
+        public String chooseServerAlias(String s, Principal[] principals, Socket socket) {
+            return delegate.chooseServerAlias(s, principals, socket);
+        }
+
+        @Override
+        public X509Certificate[] getCertificateChain(String s) {
+            return delegate.getCertificateChain(s);
+        }
+
+        @Override
+        public PrivateKey getPrivateKey(String s) {
+            return delegate.getPrivateKey(s);
+        }
+    }
+}
@@ -0,0 +1,41 @@
+package timely.configuration;
+
+public class AuthorizationProperties {
+
+    private boolean enabled = false;
+    private String authorizationUrl;
+    private String publicCertificateFile;
+    private String publicCertificateType;
+
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public String getAuthorizationUrl() {
+        return authorizationUrl;
+    }
+
+    public void setAuthorizationUrl(String authorizationUrl) {
+        this.authorizationUrl = authorizationUrl;
+    }
+
+    public String getPublicCertificateFile() {
+        return publicCertificateFile;
+    }
+
+    public void setPublicCertificateFile(String publicCertificateFile) {
+        this.publicCertificateFile = publicCertificateFile;
+    }
+
+    public String getPublicCertificateType() {
+        return publicCertificateType;
+    }
+
+    public void setPublicCertificateType(String publicCertificateType) {
+        this.publicCertificateType = publicCertificateType;
+    }
+}
@@ -0,0 +1,113 @@
+package timely.configuration;
+
+public class ClientSsl implements Ssl {
+
+    private String[] ciphers;
+    private String[] enabledProtocols;
+    private String keyStoreFile;
+    private String keyStoreType;
+    private String keyStorePassword;
+    private String keyAlias;
+    private String trustStoreFile;
+    private String trustStoreType;
+    private String trustStorePassword;
+    private boolean useClientCert = true;
+    private boolean hostVerificationEnabled = true;
+    private boolean useOpenssl = true;
+
+    public String[] getCiphers() {
+        return ciphers;
+    }
+
+    public void setCiphers(String[] ciphers) {
+        this.ciphers = ciphers;
+    }
+
+    public String[] getEnabledProtocols() {
+        return enabledProtocols;
+    }
+
+    public void setEnabledProtocols(String[] enabledProtocols) {
+        this.enabledProtocols = enabledProtocols;
+    }
+
+    public String getKeyStoreFile() {
+        return keyStoreFile;
+    }
+
+    public void setKeyStoreFile(String keyStoreFile) {
+        this.keyStoreFile = keyStoreFile;
+    }
+
+    public String getKeyStoreType() {
+        return keyStoreType;
+    }
+
+    public void setKeyStoreType(String keyStoreType) {
+        this.keyStoreType = keyStoreType;
+    }
+
+    public String getKeyStorePassword() {
+        return keyStorePassword;
+    }
+
+    public void setKeyStorePassword(String keyStorePassword) {
+        this.keyStorePassword = keyStorePassword;
+    }
+
+    public String getKeyAlias() {
+        return keyAlias;
+    }
+
+    public void setKeyAlias(String keyAlias) {
+        this.keyAlias = keyAlias;
+    }
+
+    public String getTrustStoreFile() {
+        return trustStoreFile;
+    }
+
+    public void setTrustStoreFile(String trustStoreFile) {
+        this.trustStoreFile = trustStoreFile;
+    }
+
+    public String getTrustStoreType() {
+        return trustStoreType;
+    }
+
+    public void setTrustStoreType(String trustStoreType) {
+        this.trustStoreType = trustStoreType;
+    }
+
+    public String getTrustStorePassword() {
+        return trustStorePassword;
+    }
+
+    public void setTrustStorePassword(String trustStorePassword) {
+        this.trustStorePassword = trustStorePassword;
+    }
+
+    public void setUseClientCert(boolean useClientCert) {
+        this.useClientCert = useClientCert;
+    }
+
+    public boolean isUseClientCert() {
+        return useClientCert;
+    }
+
+    public void setHostVerificationEnabled(boolean hostVerificationEnabled) {
+        this.hostVerificationEnabled = hostVerificationEnabled;
+    }
+
+    public boolean isHostVerificationEnabled() {
+        return hostVerificationEnabled;
+    }
+
+    public boolean isUseOpenssl() {
+        return useOpenssl;
+    }
+
+    public void setUseOpenssl(boolean useOpenssl) {
+        this.useOpenssl = useOpenssl;
+    }
+}
@@ -3,6 +3,7 @@ package timely.configuration;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
+import java.util.Map;

 import javax.validation.Valid;

@@ -18,7 +19,7 @@ public class Configuration {

    private String metricsTable = "timely.metrics";
    private String metaTable = "timely.meta";
-    private HashMap<String, Integer> metricAgeOffDays = new HashMap<>();
+    private Map<String, Integer> metricAgeOffDays = new HashMap<>();
    private List<String> metricsReportIgnoredTags = new ArrayList<>();
    private String instance = null;
    private String defaultVisibility = null;
@@ -82,11 +83,11 @@ public class Configuration {
        this.defaultVisibility = defaultVisibility;
    }

-    public HashMap<String, Integer> getMetricAgeOffDays() {
+    public Map<String, Integer> getMetricAgeOffDays() {
        return metricAgeOffDays;
    }

-    public void setMetricAgeOffDays(HashMap<String, Integer> metricAgeOffDays) {
+    public void setMetricAgeOffDays(Map<String, Integer> metricAgeOffDays) {
        this.metricAgeOffDays = metricAgeOffDays;
    }

@@ -0,0 +1,32 @@
+package timely.configuration;
+
+public class JwtSsl {
+
+    private String keyStoreType;
+    private String keyStoreFile;
+    private String keyStorePassword;
+
+    public String getKeyStoreType() {
+        return keyStoreType;
+    }
+
+    public void setKeyStoreType(String keyStoreType) {
+        this.keyStoreType = keyStoreType;
+    }
+
+    public String getKeyStoreFile() {
+        return keyStoreFile;
+    }
+
+    public void setKeyStoreFile(String keyStoreFile) {
+        this.keyStoreFile = keyStoreFile;
+    }
+
+    public String getKeyStorePassword() {
+        return keyStorePassword;
+    }
+
+    public void setKeyStorePassword(String keyStorePassword) {
+        this.keyStorePassword = keyStorePassword;
+    }
+}
@@ -11,10 +11,8 @@ public class Security {
    private int sessionMaxAge = 86400;
    private int cacheExpirationMinutes = 60;
    private int cacheRefreshMinutes = 5;
-    private String jwtCheckKeyStore;
-    private String jwtCheckKeyType;
-    private String jwtCheckKeyPassword;
-
+    @NestedConfigurationProperty
+    private JwtSsl jwtSsl = new JwtSsl();
    @Valid
    @NestedConfigurationProperty
    private ServerSsl serverSsl = new ServerSsl();
@@ -63,27 +61,7 @@ public class Security {
        return serverSsl;
    }

-    public String getJwtCheckKeyStore() {
-        return jwtCheckKeyStore;
-    }
-
-    public void setJwtCheckKeyStore(String jwtCheckKeyStore) {
-        this.jwtCheckKeyStore = jwtCheckKeyStore;
-    }
-
-    public String getJwtCheckKeyType() {
-        return jwtCheckKeyType;
-    }
-
-    public void setJwtCheckKeyType(String jwtCheckKeyType) {
-        this.jwtCheckKeyType = jwtCheckKeyType;
-    }
-
-    public String getJwtCheckKeyPassword() {
-        return jwtCheckKeyPassword;
-    }
-
-    public void setJwtCheckKeyPassword(String jwtCheckKeyPassword) {
-        this.jwtCheckKeyPassword = jwtCheckKeyPassword;
+    public JwtSsl getJwtSsl() {
+        return jwtSsl;
    }
 }
@@ -2,47 +2,82 @@ package timely.configuration;

 import java.util.List;

-import com.google.common.collect.Lists;
 import timely.validator.NotEmptyIfFieldSet;

@NotEmptyIfFieldSet.List({
-        @NotEmptyIfFieldSet(fieldName = "useGeneratedKeypair", fieldValue = "false", notNullFieldName = "certificateFile", message = "must be set if timely.security.ssl.use-generated-keypair is false"),
-        @NotEmptyIfFieldSet(fieldName = "useGeneratedKeypair", fieldValue = "false", notNullFieldName = "keyFile", message = "must be set if timely.security.ssl.use-generated-keypair is false") })
+        @NotEmptyIfFieldSet(fieldName = "useGeneratedKeypair", fieldValue = "false", notNullFieldName = "keyStoreFile", message = "must be set if timely.security.ssl.use-generated-keypair is false") })

-public class ServerSsl {
+public class ServerSsl implements Ssl {

-    private String certificateFile;
-    private String keyFile;
-    private String keyPassword;
-    private String trustStoreFile;
-    private boolean useGeneratedKeypair = false;
-    private boolean useOpenssl = true;
-    private List<String> useCiphers = Lists.newArrayList("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+    private String[] ciphers = new String[] { "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
            "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA",
-            "SSL_RSA_WITH_3DES_EDE_CBC_SHA");
+            "SSL_RSA_WITH_3DES_EDE_CBC_SHA" };
+    private String[] enabledProtocols;
+    private String keyStoreType;
+    private String keyStoreFile;
+    private String keyStorePassword;
+    private String keyAlias;
+    private String trustStoreType;
+    private String trustStoreFile;
+    private String trustStorePassword;
+    private boolean useGeneratedKeypair = false;
+    private boolean ignoreSslHandshakeErrors = false;
+    private boolean useOpenssl = true;

-    public String getCertificateFile() {
-        return certificateFile;
+    public String[] getCiphers() {
+        return ciphers;
    }

-    public void setCertificateFile(String certificateFile) {
-        this.certificateFile = certificateFile;
+    public void setCiphers(String[] ciphers) {
+        this.ciphers = ciphers;
    }

-    public String getKeyFile() {
-        return keyFile;
+    public String[] getEnabledProtocols() {
+        return enabledProtocols;
    }

-    public void setKeyFile(String keyFile) {
-        this.keyFile = keyFile;
+    public void setEnabledProtocols(String[] enabledProtocols) {
+        this.enabledProtocols = enabledProtocols;
    }

-    public String getKeyPassword() {
-        return keyPassword;
+    public String getKeyStoreType() {
+        return keyStoreType;
    }

-    public void setKeyPassword(String keyPassword) {
-        this.keyPassword = keyPassword;
+    public void setKeyStoreType(String keyStoreType) {
+        this.keyStoreType = keyStoreType;
+    }
+
+    public String getKeyStoreFile() {
+        return keyStoreFile;
+    }
+
+    public void setKeyStoreFile(String keyStoreFile) {
+        this.keyStoreFile = keyStoreFile;
+    }
+
+    public String getKeyStorePassword() {
+        return keyStorePassword;
+    }
+
+    public void setKeyStorePassword(String keyStorePassword) {
+        this.keyStorePassword = keyStorePassword;
+    }
+
+    public String getKeyAlias() {
+        return keyAlias;
+    }
+
+    public void setKeyAlias(String keyAlias) {
+        this.keyAlias = keyAlias;
+    }
+
+    public String getTrustStoreType() {
+        return trustStoreType;
+    }
+
+    public void setTrustStoreType(String trustStoreType) {
+        this.trustStoreType = trustStoreType;
    }

    public String getTrustStoreFile() {
@@ -53,6 +88,14 @@ public class ServerSsl {
        this.trustStoreFile = trustStoreFile;
    }

+    public String getTrustStorePassword() {
+        return trustStorePassword;
+    }
+
+    public void setTrustStorePassword(String trustStorePassword) {
+        this.trustStorePassword = trustStorePassword;
+    }
+
    public boolean isUseGeneratedKeypair() {
        return useGeneratedKeypair;
    }
@@ -61,6 +104,14 @@ public class ServerSsl {
        this.useGeneratedKeypair = useGeneratedKeypair;
    }

+    public boolean isIgnoreSslHandshakeErrors() {
+        return ignoreSslHandshakeErrors;
+    }
+
+    public void setIgnoreSslHandshakeErrors(boolean ignoreSslHandshakeErrors) {
+        this.ignoreSslHandshakeErrors = ignoreSslHandshakeErrors;
+    }
+
    public boolean isUseOpenssl() {
        return useOpenssl;
    }
@@ -68,12 +119,4 @@ public class ServerSsl {
    public void setUseOpenssl(boolean useOpenssl) {
        this.useOpenssl = useOpenssl;
    }
-
-    public List<String> getUseCiphers() {
-        return useCiphers;
-    }
-
-    public void setUseCiphers(List<String> useCiphers) {
-        this.useCiphers = useCiphers;
-    }
 }
@@ -0,0 +1,45 @@
+package timely.configuration;
+
+public interface Ssl {
+
+    String getKeyStoreType();
+
+    void setKeyStoreType(String keyStoreType);
+
+    String getKeyStoreFile();
+
+    void setKeyStoreFile(String keyStoreFile);
+
+    String getKeyStorePassword();
+
+    void setKeyStorePassword(String keyStorePassword);
+
+    String getKeyAlias();
+
+    void setKeyAlias(String keyAlias);
+
+    String getTrustStoreType();
+
+    void setTrustStoreType(String trustStoreType);
+
+    String getTrustStoreFile();
+
+    void setTrustStoreFile(String trustStoreFile);
+
+    String getTrustStorePassword();
+
+    void setTrustStorePassword(String trustStorePassword);
+
+    String[] getCiphers();
+
+    void setCiphers(String[] ciphers);
+
+    String[] getEnabledProtocols();
+
+    void setEnabledProtocols(String[] enabledProtocols);
+
+    boolean isUseOpenssl();
+
+    void setUseOpenssl(boolean useOpenssl);
+
+}
@@ -22,7 +22,7 @@ public class TcpDecoder extends ByteToMessageDecoder {
    protected void decode(ChannelHandlerContext ctx, ByteBuf in, List<Object> out) throws Exception {

        ByteBuf buf = in.readBytes(in.readableBytes());
-        String input = "";
+        String input = null;
        try {
            if (buf == Unpooled.EMPTY_BUFFER) {
                return;
@@ -22,11 +22,11 @@ public class UdpDecoder extends ByteToMessageDecoder {
    protected void decode(ChannelHandlerContext ctx, ByteBuf in, List<Object> out) throws Exception {

        ByteBuf buf = in.readBytes(in.readableBytes());
+        String input = null;
        try {
            if (buf == Unpooled.EMPTY_BUFFER) {
                return;
            }
-            final String input;
            if (buf.hasArray()) {
                input = new String(buf.array(), UTF_8);
            } else {
@@ -58,6 +58,8 @@ public class UdpDecoder extends ByteToMessageDecoder {
            tcp.parse(input);
            out.add(tcp);
            LOG.trace("Converted {} to {}", input, tcp);
+        } catch (Exception e) {
+            LOG.error("{} parsing line:[{}]", e.getMessage(), input);
        } finally {
            buf.release();
        }
@@ -14,7 +14,7 @@ public interface Aggregator {
    /**
     * Given the current value, and the current count, incorporate the new value
     * into current and return the result.
-     * 
+     *
     * @param current
     *            last returned value from aggregate, or zero
     * @param count
@@ -28,7 +28,7 @@ public interface Aggregator {
    /**
     * Compute the final value given the aggregated amount and the number of items
     * in the aggregate.
-     * 
+     *
     * @param current
     *            the last value returned from aggregate
     * @param count
@@ -1,6 +1,6 @@
 package timely.sample.iterators;

-import static org.apache.accumulo.core.conf.AccumuloConfiguration.getTimeInMillis;
+import static org.apache.accumulo.core.conf.ConfigurationTypeHelper.getTimeInMillis;

 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
@@ -80,7 +80,7 @@ public class DownsampleIterator extends WrappingIterator {
    @Override
    public boolean hasTop() {

-        if (super.hasTop()) {
+        if (last == null && super.hasTop()) {
            while (super.hasTop()) {
                Key topKey = super.getTopKey();
                Value topValue = super.getTopValue();
@@ -89,12 +89,12 @@ public class DownsampleIterator extends WrappingIterator {
                    long timestamp = metric.getValue().getTimestamp();
                    if (memoryEstimator.shouldReturnBasedOnMemoryUsage(timestamp, value)) {
                        LOG.trace("returning current values - memory usage > " + memoryEstimator.maxDownsampleMemory
-                                + " for metric=" + metric.toString());
+                                + " for metric=" + metric);
                        break;
                    }
                    last = topKey;

-                    Set<Tag> tags = new HashSet<Tag>(metric.getTags());
+                    Set<Tag> tags = new HashSet<>(metric.getTags());
                    Downsample sample = value.get(tags);
                    if (sample == null) {
                        try {
@@ -113,10 +113,8 @@ public class DownsampleIterator extends WrappingIterator {
                    throw new RuntimeException("Downstream next() failed", e);
                }
            }
-            return last != null;
-        } else {
-            return false;
        }
+        return last != null;
    }

    @Override
@@ -1,12 +1,14 @@
 package timely.store;

+import org.apache.accumulo.core.client.AccumuloClient;
 import timely.api.response.TimelyException;
 import timely.configuration.Configuration;

 public class DataStoreFactory {

-    public static DataStore create(Configuration conf, int numWriteThreads) throws TimelyException {
+    public static DataStore create(Configuration conf, AccumuloClient accumuloClient, int numWriteThreads)
+            throws TimelyException {

-        return new DataStoreImpl(conf, numWriteThreads);
+        return new DataStoreImpl(conf, accumuloClient, numWriteThreads);
    }
 }
@@ -1,11 +1,11 @@
 package timely.store;

-import static org.apache.accumulo.core.conf.AccumuloConfiguration.getMemoryInBytes;
-import static org.apache.accumulo.core.conf.AccumuloConfiguration.getTimeInMillis;
+import static org.apache.accumulo.core.conf.ConfigurationTypeHelper.getMemoryAsBytes;
+import static org.apache.accumulo.core.conf.ConfigurationTypeHelper.getTimeInMillis;
 import static timely.adapter.accumulo.MetricAdapter.VISIBILITY_TAG;

 import java.io.IOException;
-import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
@@ -33,12 +33,10 @@ import java.util.regex.Matcher;
 import java.util.regex.Pattern;

 import io.netty.handler.codec.http.HttpResponseStatus;
+import org.apache.accumulo.core.client.AccumuloClient;
 import org.apache.accumulo.core.client.BatchScanner;
 import org.apache.accumulo.core.client.BatchWriter;
 import org.apache.accumulo.core.client.BatchWriterConfig;
-import org.apache.accumulo.core.client.ClientConfiguration;
-import org.apache.accumulo.core.client.Connector;
-import org.apache.accumulo.core.client.Instance;
 import org.apache.accumulo.core.client.IteratorSetting;
 import org.apache.accumulo.core.client.MutationsRejectedException;
 import org.apache.accumulo.core.client.NamespaceExistsException;
@@ -46,8 +44,6 @@ import org.apache.accumulo.core.client.Scanner;
 import org.apache.accumulo.core.client.ScannerBase;
 import org.apache.accumulo.core.client.TableExistsException;
 import org.apache.accumulo.core.client.TableNotFoundException;
-import org.apache.accumulo.core.client.ZooKeeperInstance;
-import org.apache.accumulo.core.client.security.tokens.PasswordToken;
 import org.apache.accumulo.core.data.Key;
 import org.apache.accumulo.core.data.Mutation;
 import org.apache.accumulo.core.data.PartialKey;
@@ -120,14 +116,14 @@ public class DataStoreImpl implements DataStore {

    }

-    private final Connector connector;
-    private MetaCache metaCache = null;
+    private final AccumuloClient accumuloClient;
+    private final MetaCache metaCache;
    private final AtomicLong lastCountTime = new AtomicLong(System.currentTimeMillis());
    private final AtomicReference<SortedMap<MetricTagK, Integer>> metaCounts = new AtomicReference<>(new TreeMap<>());
    private final String metricsTable;
    private final String metaTable;
    private final InternalMetrics internalMetrics;
-    private ScheduledExecutorService executorService = Executors.newScheduledThreadPool(1);
+    private final ScheduledExecutorService executorService = Executors.newScheduledThreadPool(1);
    private final int scannerThreads;
    private final long maxDownsampleMemory;
    private final BatchWriterConfig bwConfig;
@@ -140,21 +136,15 @@ public class DataStoreImpl implements DataStore {
    private DataStoreCache cache = null;
    private final String defaultVisibility;

-    public DataStoreImpl(Configuration conf, int numWriteThreads) throws TimelyException {
+    public DataStoreImpl(Configuration conf, AccumuloClient accumuloClient, int numWriteThreads)
+            throws TimelyException {

        try {
-            final Map<String, String> properties = new HashMap<>();
+            this.accumuloClient = accumuloClient;
            Accumulo accumuloConf = conf.getAccumulo();
-            properties.put("instance.name", accumuloConf.getInstanceName());
-            properties.put("instance.zookeeper.host", accumuloConf.getZookeepers());
-            properties.put("instance.zookeeper.timeout", accumuloConf.getZookeeperTimeout());
-            final ClientConfiguration aconf = ClientConfiguration.fromMap(properties);
-            final Instance instance = new ZooKeeperInstance(aconf);
-            connector = instance.getConnector(accumuloConf.getUsername(),
-                    new PasswordToken(accumuloConf.getPassword()));
            bwConfig = new BatchWriterConfig();
            bwConfig.setMaxLatency(getTimeInMillis(accumuloConf.getWrite().getLatency()), TimeUnit.MILLISECONDS);
-            bwConfig.setMaxMemory(getMemoryInBytes(accumuloConf.getWrite().getBufferSize()) / numWriteThreads);
+            bwConfig.setMaxMemory(getMemoryAsBytes(accumuloConf.getWrite().getBufferSize()) / numWriteThreads);
            bwConfig.setMaxWriteThreads(accumuloConf.getWrite().getThreads());
            scannerThreads = accumuloConf.getScan().getThreads();
            maxDownsampleMemory = accumuloConf.getScan().getMaxDownsampleMemory();
@@ -165,19 +155,19 @@ public class DataStoreImpl implements DataStore {
                try {
                    // validate visibility
                    vis = new ColumnVisibility(defaultVisibility);
-                    LOG.info("Using defaultVisibility: {}", vis.toString());
+                    LOG.info("Using defaultVisibility: {}", vis);
                } catch (RuntimeException e) {
                    LOG.error("Error validating defaultVisibility " + defaultVisibility + " " + e.getMessage(), e);
                    throw e;
                }

                try {
-                    String whoami = connector.whoami();
-                    Authorizations auths = connector.securityOperations().getUserAuthorizations(whoami);
+                    String whoami = accumuloClient.whoami();
+                    Authorizations auths = accumuloClient.securityOperations().getUserAuthorizations(whoami);
                    VisibilityEvaluator eval = new VisibilityEvaluator(auths);
                    if (!eval.evaluate(vis)) {
-                        throw new IllegalArgumentException("Accumulo user " + whoami + " with authorization "
-                                + auths.toString() + " can not see data with defaultVisibility " + vis.toString());
+                        throw new IllegalArgumentException("Accumulo user " + whoami + " with authorization " + auths
+                                + " can not see data with defaultVisibility " + vis);
                    }
                } catch (RuntimeException e) {
                    LOG.error(e.getMessage(), e);
@@ -189,10 +179,10 @@ public class DataStoreImpl implements DataStore {
            if (metricsTable.contains(".")) {
                final String[] parts = metricsTable.split("\\.", 2);
                final String namespace = parts[0];
-                if (!connector.namespaceOperations().exists(namespace)) {
+                if (!accumuloClient.namespaceOperations().exists(namespace)) {
                    try {
                        LOG.info("Creating namespace " + namespace);
-                        connector.namespaceOperations().create(namespace);
+                        accumuloClient.namespaceOperations().create(namespace);
                    } catch (final NamespaceExistsException ex) {
                        // don't care
                    }
@@ -201,11 +191,11 @@ public class DataStoreImpl implements DataStore {
            ageOffSettings = getAgeOff(conf);
            defaultAgeOffMilliSec = this.getAgeOffForMetric(MetricAgeOffIterator.DEFAULT_AGEOFF_KEY);

-            final Map<String, String> tableIdMap = connector.tableOperations().tableIdMap();
+            final Map<String, String> tableIdMap = accumuloClient.tableOperations().tableIdMap();
            if (!tableIdMap.containsKey(metricsTable)) {
                try {
                    LOG.info("Creating table " + metricsTable);
-                    connector.tableOperations().create(metricsTable);
+                    accumuloClient.tableOperations().create(metricsTable);
                } catch (final TableExistsException ex) {
                    // don't care
                }
@@ -215,7 +205,7 @@ public class DataStoreImpl implements DataStore {
            if (!tableIdMap.containsKey(metaTable)) {
                try {
                    LOG.info("Creating table " + metaTable);
-                    connector.tableOperations().create(metaTable);
+                    accumuloClient.tableOperations().create(metaTable);
                } catch (final TableExistsException ex) {
                    // don't care
                }
@@ -237,36 +227,28 @@ public class DataStoreImpl implements DataStore {
    public void applyAgeOffSettings() {

        // remove iterator and related settings (ageoffs) to ensure current values used
-        if (iteratorOperation((c, t) -> {
-            this.removeAgeOffIterators(c, t);
-        }, connector, metricsTable, 5)) {
+        if (iteratorOperation(this::removeAgeOffIterators, accumuloClient, metricsTable, 5)) {
            LOG.info("Remove ageoff for " + metricsTable + " completed");
        } else {
            LOG.error("Remove ageoff for " + metricsTable + " failed");
        }

        // add iterator and related settings (ageoffs) to ensure current values used
-        if (iteratorOperation((c, t) -> {
-            this.applyMetricAgeOffIterator(c, t);
-        }, connector, metricsTable, 5)) {
+        if (iteratorOperation(this::applyMetricAgeOffIterator, accumuloClient, metricsTable, 5)) {
            LOG.info("Apply ageoff for " + metricsTable + " completed");
        } else {
            LOG.error("Apply ageoff for " + metricsTable + " failed");
        }

        // remove iterator and related settings (ageoffs) to ensure current values used
-        if (iteratorOperation((c, t) -> {
-            this.removeAgeOffIterators(c, t);
-        }, connector, metaTable, 5)) {
+        if (iteratorOperation(this::removeAgeOffIterators, accumuloClient, metaTable, 5)) {
            LOG.info("Remove ageoff for " + metaTable + " completed");
        } else {
            LOG.error("Remove ageoff for " + metaTable + " failed");
        }

        // add iterator and related settings (ageoffs) to ensure current values used
-        if (iteratorOperation((c, t) -> {
-            this.applyMetaAgeOffIterator(c, t);
-        }, connector, metaTable, 5)) {
+        if (iteratorOperation(this::applyMetaAgeOffIterator, accumuloClient, metaTable, 5)) {
            LOG.info("Apply ageoff for " + metaTable + " completed");
        } else {
            LOG.error("Apply ageoff for " + metaTable + " failed");
@@ -292,15 +274,16 @@ public class DataStoreImpl implements DataStore {

    public interface RetryableIteratorOperation {

-        void execute(Connector con, String tableName) throws Exception;
+        void execute(AccumuloClient accumuloClient, String tableName) throws Exception;
    }

-    private boolean iteratorOperation(RetryableIteratorOperation op, Connector connector, String table, int retries) {
+    private boolean iteratorOperation(RetryableIteratorOperation op, AccumuloClient accumuloClient, String table,
+            int retries) {
        boolean success = false;
        int attempt = 1;
        while (!success && attempt++ <= retries) {
            try {
-                op.execute(connector, table);
+                op.execute(accumuloClient, table);
                success = true;
            } catch (Exception e) {
                Throwable cause = e.getCause();
@@ -319,25 +302,25 @@ public class DataStoreImpl implements DataStore {
        return success;
    }

-    private void removeAgeOffIterators(Connector connector, String tableName) throws Exception {
-        Map<String, EnumSet<IteratorScope>> iters = connector.tableOperations().listIterators(tableName);
+    private void removeAgeOffIterators(AccumuloClient accumuloClient, String tableName) throws Exception {
+        Map<String, EnumSet<IteratorScope>> iters = accumuloClient.tableOperations().listIterators(tableName);
        for (String name : iters.keySet()) {
            if (name.startsWith("ageoff")) {
-                connector.tableOperations().removeIterator(tableName, name, AGEOFF_SCOPES);
+                accumuloClient.tableOperations().removeIterator(tableName, name, AGEOFF_SCOPES);
            }
        }
    }

-    private void applyMetricAgeOffIterator(Connector connector, String tableName) throws Exception {
+    private void applyMetricAgeOffIterator(AccumuloClient accumuloClient, String tableName) throws Exception {
        IteratorSetting ageOffIteratorSettings = new IteratorSetting(100, "ageoffmetrics", MetricAgeOffIterator.class,
                this.ageOffSettings);
-        connector.tableOperations().attachIterator(tableName, ageOffIteratorSettings, AGEOFF_SCOPES);
+        accumuloClient.tableOperations().attachIterator(tableName, ageOffIteratorSettings, AGEOFF_SCOPES);
    }

-    private void applyMetaAgeOffIterator(Connector connector, String tableName) throws Exception {
+    private void applyMetaAgeOffIterator(AccumuloClient accumuloClient, String tableName) throws Exception {
        IteratorSetting ageOffIteratorSettings = new IteratorSetting(100, "ageoffmeta", MetaAgeOffIterator.class,
                this.ageOffSettings);
-        connector.tableOperations().attachIterator(tableName, ageOffIteratorSettings, AGEOFF_SCOPES);
+        accumuloClient.tableOperations().attachIterator(tableName, ageOffIteratorSettings, AGEOFF_SCOPES);
    }

    private Map<String, String> getAgeOff(Configuration conf) {
@@ -375,7 +358,7 @@ public class DataStoreImpl implements DataStore {

        if (null == metaWriter.get()) {
            try {
-                BatchWriter w = connector.createBatchWriter(metaTable, bwConfig);
+                BatchWriter w = accumuloClient.createBatchWriter(metaTable, bwConfig);
                metaWriter.set(w);
                writers.add(w);
            } catch (TableNotFoundException e) {
@@ -385,7 +368,7 @@ public class DataStoreImpl implements DataStore {
        }
        if (null == batchWriter.get()) {
            try {
-                BatchWriter w = connector.createBatchWriter(metricsTable, bwConfig);
+                BatchWriter w = accumuloClient.createBatchWriter(metricsTable, bwConfig);
                batchWriter.set(w);
                writers.add(w);
            } catch (TableNotFoundException e) {
@@ -400,18 +383,14 @@ public class DataStoreImpl implements DataStore {
            toCache.add(new Meta(metric.getName(), tag.getKey(), tag.getValue()));
        }
        if (!toCache.isEmpty()) {
-            final Set<Mutation> muts = new TreeSet<>(new Comparator<Mutation>() {
-
-                @Override
-                public int compare(Mutation o1, Mutation o2) {
-                    if (o1.equals(o2)) {
-                        return 0;
+            final Set<Mutation> muts = new TreeSet<>((o1, o2) -> {
+                if (o1.equals(o2)) {
+                    return 0;
+                } else {
+                    if (o1.hashCode() < o2.hashCode()) {
+                        return -1;
                    } else {
-                        if (o1.hashCode() < o2.hashCode()) {
-                            return -1;
-                        } else {
-                            return 1;
-                        }
+                        return 1;
                    }
                }
            });
@@ -432,7 +411,7 @@ public class DataStoreImpl implements DataStore {
                    } catch (MutationsRejectedException e1) {
                        LOG.error("Error closing meta writer", e1);
                    }
-                    final BatchWriter w = connector.createBatchWriter(metaTable, bwConfig);
+                    final BatchWriter w = accumuloClient.createBatchWriter(metaTable, bwConfig);
                    metaWriter.set(w);
                    writers.add(w);
                } catch (TableNotFoundException e1) {
@@ -455,7 +434,7 @@ public class DataStoreImpl implements DataStore {
                } catch (MutationsRejectedException e1) {
                    LOG.error("Error closing metric writer", e1);
                }
-                final BatchWriter w = connector.createBatchWriter(metricsTable, bwConfig);
+                final BatchWriter w = accumuloClient.createBatchWriter(metricsTable, bwConfig);
                batchWriter.set(w);
                writers.add(w);
            } catch (TableNotFoundException e1) {
@@ -485,48 +464,53 @@ public class DataStoreImpl implements DataStore {
        SuggestResponse result = new SuggestResponse();
        try {
            Optional<String> metricOpt = request.getMetric();
-            if (request.getType().equals("metrics")) {
-                Set<String> metrics = new TreeSet<>();
-                String query = metricOpt.isPresent() ? metricOpt.get() : null;
-                for (Meta m : metaCache) {
-                    if (query == null || m.getMetric().contains(query)) {
-                        metrics.add(m.getMetric());
-                        if (request.getMax() >= 0 && metrics.size() >= request.getMax()) {
-                            break;
-                        }
-                    }
-                }
-                result.setSuggestions(new ArrayList<>(metrics));
-            } else if (request.getType().equals("tagk")) {
-                Set<String> tagKeys = new TreeSet<>();
-                if (metricOpt.isPresent()) {
-                    String metric = metricOpt.get();
+            switch (request.getType()) {
+                case "metrics":
+                    Set<String> metrics = new TreeSet<>();
+                    String query = metricOpt.orElse(null);
                    for (Meta m : metaCache) {
-                        if (m.getMetric().equals(metric)) {
-                            tagKeys.add(m.getTagKey());
-                            if (request.getMax() >= 0 && tagKeys.size() >= request.getMax()) {
+                        if (query == null || m.getMetric().contains(query)) {
+                            metrics.add(m.getMetric());
+                            if (request.getMax() >= 0 && metrics.size() >= request.getMax()) {
                                break;
                            }
                        }
                    }
-                }
-                result.setSuggestions(new ArrayList<>(tagKeys));
-            } else if (request.getType().equals("tagv")) {
-                Set<String> tagValues = new TreeSet<>();
-                Optional<String> tagKeyOpt = request.getTag();
-                if (metricOpt.isPresent() && tagKeyOpt.isPresent()) {
-                    String metric = metricOpt.get();
-                    String tagKey = tagKeyOpt.get();
-                    for (Meta m : metaCache) {
-                        if (m.getMetric().equals(metric) && m.getTagKey().equals(tagKey)) {
-                            tagValues.add(m.getTagValue());
-                            if (request.getMax() >= 0 && tagValues.size() >= request.getMax()) {
-                                break;
+                    result.setSuggestions(new ArrayList<>(metrics));
+                    break;
+                case "tagk":
+                    Set<String> tagKeys = new TreeSet<>();
+                    if (metricOpt.isPresent()) {
+                        String metric = metricOpt.get();
+                        for (Meta m : metaCache) {
+                            if (m.getMetric().equals(metric)) {
+                                tagKeys.add(m.getTagKey());
+                                if (request.getMax() >= 0 && tagKeys.size() >= request.getMax()) {
+                                    break;
+                                }
                            }
                        }
                    }
-                }
-                result.setSuggestions(new ArrayList<>(tagValues));
+                    result.setSuggestions(new ArrayList<>(tagKeys));
+                    break;
+                case "tagv":
+                    Set<String> tagValues = new TreeSet<>();
+                    Optional<String> tagKeyOpt = request.getTag();
+                    if (metricOpt.isPresent() && tagKeyOpt.isPresent()) {
+                        String metric = metricOpt.get();
+                        String tagKey = tagKeyOpt.get();
+                        for (Meta m : metaCache) {
+                            if (m.getMetric().equals(metric) && m.getTagKey().equals(tagKey)) {
+                                tagValues.add(m.getTagValue());
+                                if (request.getMax() >= 0 && tagValues.size() >= request.getMax()) {
+                                    break;
+                                }
+                            }
+                        }
+                    }
+                    result.setSuggestions(new ArrayList<>(tagValues));
+                    break;
+                default:
            }
        } catch (Exception ex) {
            LOG.error("Error during suggest: " + ex.getMessage(), ex);
@@ -549,12 +533,9 @@ public class DataStoreImpl implements DataStore {
        result.setTags(tags);
        result.setLimit(msg.getLimit());
        Map<String, Pattern> tagPatterns = new HashMap<>();
-        tags.forEach((k, v) -> {
-            tagPatterns.put(k, Pattern.compile(v));
-        });
+        tags.forEach((k, v) -> tagPatterns.put(k, Pattern.compile(v)));
        try {
-            final Scanner scanner = connector.createScanner(metaTable, Authorizations.EMPTY);
-            try {
+            try (Scanner scanner = accumuloClient.createScanner(metaTable, Authorizations.EMPTY)) {
                List<Result> resultField = new ArrayList<>();
                Key start = new Key(Meta.VALUE_PREFIX + msg.getQuery());
                Key end = start.followingKey(PartialKey.ROW);
@@ -576,10 +557,6 @@ public class DataStoreImpl implements DataStore {
                result.setResults(resultField);
                result.setTotalResults(total);
                result.setTime((int) (System.currentTimeMillis() - startMillis));
-            } finally {
-                if (scanner != null) {
-                    scanner.close();
-                }
            }
        } catch (Exception ex) {
            LOG.error("Error during lookup: " + ex.getMessage(), ex);
@@ -629,12 +606,9 @@ public class DataStoreImpl implements DataStore {
                            z += c.size();
                        }
                        long totalRequestedTime = requestedEndTs - requestedStartTs;
-                        long percentServedFromCache = 0;
+                        long percentServedFromCache;
                        if (!cachedMetrics.isEmpty() && oldestCacheTimestamp != Long.MAX_VALUE) {
-                            if (requestedStartTs < oldestCacheTimestamp && requestedEndTs < oldestCacheTimestamp) {
-                                percentServedFromCache = 0;
-                            } else if (requestedStartTs >= oldestCacheTimestamp
-                                    && requestedEndTs >= oldestCacheTimestamp) {
+                            if (requestedStartTs >= oldestCacheTimestamp) {
                                percentServedFromCache = 100;
                            } else {
                                long timeAnsweredFromCache = requestedEndTs - oldestCacheTimestamp;
@@ -647,7 +621,7 @@ public class DataStoreImpl implements DataStore {
                            LOG.debug(
                                    "Cache query for [{}] time:{} duration (min):{} metrics:{} results:{} percentFromCache:{}",
                                    msg.getUserName(), (System.currentTimeMillis() - now),
-                                    ((requestedEndTs - requestedStartTs) / (1000 * 60)), metricList.toString(), z,
+                                    ((requestedEndTs - requestedStartTs) / (1000 * 60)), metricList, z,
                                    percentServedFromCache);
                            allSeries.putAll(cachedMetrics);
                        }
@@ -678,7 +652,7 @@ public class DataStoreImpl implements DataStore {
                        BatchScanner scanner = null;
                        try {
                            Collection<Authorizations> authorizations = getSessionAuthorizations(msg);
-                            scanner = ScannerHelper.createBatchScanner(connector, metricsTable, authorizations,
+                            scanner = ScannerHelper.createBatchScanner(accumuloClient, metricsTable, authorizations,
                                    scannerThreads);
                            List<String> tagOrder = prioritizeTags(query.getMetric(), query.getTags());
                            Map<String, String> orderedTags = orderTags(tagOrder, query.getTags());
@@ -686,7 +660,7 @@ public class DataStoreImpl implements DataStore {
                            List<Range> ranges = getQueryRanges(metric, startOfFirstPeriod, endOfLastPeriod,
                                    colFamValues);
                            scanner.setRanges(ranges);
-                            setQueryColumns(scanner, metric, orderedTags, colFamValues);
+                            setQueryColumns(scanner, orderedTags, colFamValues);

                            if (query.isRate()) {
                                LOG.trace("Adding rate iterator");
@@ -730,7 +704,7 @@ public class DataStoreImpl implements DataStore {
                                for (Entry<Set<Tag>, Aggregation> entry : samples.entrySet()) {
                                    Set<Tag> key = new HashSet<>();
                                    for (Tag tag : entry.getKey()) {
-                                        if (query.getTags().keySet().contains(tag.getKey())) {
+                                        if (query.getTags().containsKey(tag.getKey())) {
                                            key.add(tag);
                                        }
                                    }
@@ -756,8 +730,8 @@ public class DataStoreImpl implements DataStore {
                }
            }
            LOG.debug("Query for [{}] time:{} duration:{} metrics:{} results:{}", msg.getUserName(),
-                    (System.currentTimeMillis() - now), ((requestedEndTs - requestedStartTs) / (1000 * 60)),
-                    metricList.toString(), numResults);
+                    (System.currentTimeMillis() - now), ((requestedEndTs - requestedStartTs) / (1000 * 60)), metricList,
+                    numResults);
            internalMetrics.addQueryResponse(result.size(), (System.currentTimeMillis() - now));
            return result;
        } catch (ClassNotFoundException | IOException | TableNotFoundException ex) {
@@ -771,9 +745,9 @@ public class DataStoreImpl implements DataStore {
        Map<String, String> order = new LinkedHashMap<>(tags.size());
        tagOrder.forEach(t -> order.put(t, tags.get(t)));
        if (tagOrder.size() > tags.size()) {
-            tags.entrySet().forEach(k -> {
-                if (!tagOrder.contains(k.getKey())) {
-                    order.put(k.getKey(), k.getValue());
+            tags.forEach((key, value) -> {
+                if (!tagOrder.contains(key)) {
+                    order.put(key, value);
                }
            });
        }
@@ -816,14 +790,7 @@ public class DataStoreImpl implements DataStore {
            }
        }
        List<String> result = new ArrayList<>(tags.keySet());
-        Collections.sort(result, new Comparator<String>() {
-
-            @Override
-            public int compare(String o1, String o2) {
-                // greater count lowers priority
-                return priority.get(o1).intValue() - priority.get(o2).intValue();
-            }
-        });
+        result.sort(Comparator.comparingInt(priority::get));
        LOG.trace("Tag priority {}", result);
        return result;
    }
@@ -856,7 +823,7 @@ public class DataStoreImpl implements DataStore {
        try {
            Map<String, String> tags = (requestedTags == null) ? new LinkedHashMap<>() : requestedTags;
            LOG.trace("Looking for requested tags: {}", tags);
-            meta = connector.createScanner(metaTable, Authorizations.EMPTY);
+            meta = accumuloClient.createScanner(metaTable, Authorizations.EMPTY);
            Text start = new Text(Meta.VALUE_PREFIX + metric);
            Text end = new Text(Meta.VALUE_PREFIX + metric + "\\x0000");
            end.append(new byte[] { (byte) 0xff }, 0, 1);
@@ -899,10 +866,7 @@ public class DataStoreImpl implements DataStore {
                        tagValue = metaEntry.getKey().getColumnQualifier();
                        LOG.trace("Found tag entry {}={}", tagName, tagValue);

-                        if (ONLY_RETURN_FIRST_TAG && !tagName.equals(firstTag)) {
-                            return false;
-                        }
-                        return true;
+                        return !ONLY_RETURN_FIRST_TAG || tagName.equals(firstTag);
                    }
                    return false;
                }
@@ -925,7 +889,7 @@ public class DataStoreImpl implements DataStore {
        }
    }

-    private void setQueryColumns(ScannerBase scanner, String metric, Map<String, String> tags, Set<Tag> colFamValues)
+    private void setQueryColumns(ScannerBase scanner, Map<String, String> tags, Set<Tag> colFamValues)
            throws TimelyException {

        if (colFamValues.size() == 0) {
@@ -945,7 +909,7 @@ public class DataStoreImpl implements DataStore {
        if (tagIter.hasNext()) {
            tagIter.next();
        }
-        Entry<String, String> tag = null;
+        Entry<String, String> tag;
        while (tagIter.hasNext()) {
            tag = tagIter.next();
            LOG.trace("Adding regex filter for tag {}", tag);
@@ -1022,14 +986,13 @@ public class DataStoreImpl implements DataStore {
                            : beginRangeRounded;
                    for (Tag t : colFamValues) {
                        final byte[] start_row = MetricAdapter.encodeRowKey(metric, beginRangeRounded);
-                        Key startKey = new Key(new Text(start_row),
-                                new Text(t.join().getBytes(Charset.forName("UTF-8"))),
+                        Key startKey = new Key(new Text(start_row), new Text(t.join().getBytes(StandardCharsets.UTF_8)),
                                new Text(MetricAdapter.encodeColQual(beginRangeTimestamp, "")), new Text(new byte[0]),
                                beginRangeTimestamp);
                        LOG.trace("Start key for metric {} and time {} is {}", metric, beginRangeTimestamp,
                                startKey.toStringNoTime());
                        final byte[] end_row = MetricAdapter.encodeRowKey(metric, beginRangeRounded);
-                        Key endKey = new Key(new Text(end_row), new Text(t.join().getBytes(Charset.forName("UTF-8"))),
+                        Key endKey = new Key(new Text(end_row), new Text(t.join().getBytes(StandardCharsets.UTF_8)),
                                new Text(MetricAdapter.encodeColQual(endRangeTimestamp, "")), new Text(new byte[0]),
                                endRangeTimestamp);
                        LOG.trace("End key for metric {} and time {} is {}", metric, beginRangeTimestamp,
@@ -1075,14 +1038,14 @@ public class DataStoreImpl implements DataStore {
            }
            Collection<Authorizations> auths = getSessionAuthorizations(request);
            LOG.debug("Creating metric scanner for [{}] with auths: {}", request.getUserName(), auths);
-            Scanner s = ScannerHelper.createScanner(connector, this.metricsTable, auths);
+            Scanner s = ScannerHelper.createScanner(accumuloClient, this.metricsTable, auths);
            if (tags == null) {
                tags = new LinkedHashMap<>();
            }
            List<String> tagOrder = prioritizeTags(metric, tags);
            Map<String, String> orderedTags = orderTags(tagOrder, tags);
            Set<Tag> colFamValues = getColumnFamilies(metric, orderedTags);
-            setQueryColumns(s, metric, orderedTags, colFamValues);
+            setQueryColumns(s, orderedTags, colFamValues);
            s.setBatchSize(scannerBatchSize);
            s.setReadaheadThreshold(scannerReadAhead);
            return s;
@@ -1112,5 +1075,8 @@ public class DataStoreImpl implements DataStore {
                LOG.warn("Error shutting down batchwriter: ", ex.getMessage());
            }
        });
+        if (accumuloClient != null) {
+            accumuloClient.close();
+        }
    }
 }
@@ -4,6 +4,7 @@ import java.util.Collection;
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.Map;
+import java.util.Properties;
 import java.util.Set;
 import java.util.TreeSet;
 import java.util.concurrent.Executors;
@@ -12,15 +13,9 @@ import java.util.concurrent.TimeUnit;

 import com.github.benmanes.caffeine.cache.Cache;
 import com.github.benmanes.caffeine.cache.Caffeine;
-import org.apache.accumulo.core.client.AccumuloException;
-import org.apache.accumulo.core.client.AccumuloSecurityException;
-import org.apache.accumulo.core.client.ClientConfiguration;
-import org.apache.accumulo.core.client.Connector;
-import org.apache.accumulo.core.client.Instance;
+import org.apache.accumulo.core.client.AccumuloClient;
 import org.apache.accumulo.core.client.Scanner;
-import org.apache.accumulo.core.client.TableNotFoundException;
-import org.apache.accumulo.core.client.ZooKeeperInstance;
-import org.apache.accumulo.core.client.security.tokens.PasswordToken;
+import org.apache.accumulo.core.conf.ClientProperty;
 import org.apache.accumulo.core.data.Key;
 import org.apache.accumulo.core.data.Range;
 import org.apache.accumulo.core.data.Value;
@@ -53,20 +48,22 @@ public class MetaCacheImpl implements MetaCache {

    private void refreshCache(long expirationMinutes) {
        long oldestTimestamp = System.currentTimeMillis() - (expirationMinutes * 60 * 1000);
-        Map<String, String> properties = new HashMap<>();
-        Accumulo accumuloConf = configuration.getAccumulo();
-        properties.put("instance.name", accumuloConf.getInstanceName());
-        properties.put("instance.zookeeper.host", accumuloConf.getZookeepers());
-        final ClientConfiguration aConf = ClientConfiguration.fromMap(properties);
        String metaTable = configuration.getMetaTable();
        Map<String, Map<String, Long>> metricMap = new HashMap<>();
        Scanner scanner = null;
        try {
            Map<Meta, Object> newCache = new HashMap<>();
-            final Instance instance = new ZooKeeperInstance(aConf);
-            Connector connector = instance.getConnector(accumuloConf.getUsername(),
-                    new PasswordToken(accumuloConf.getPassword()));
-            scanner = connector.createScanner(metaTable, Authorizations.EMPTY);
+            final Properties properties = new Properties();
+            Accumulo accumuloConf = configuration.getAccumulo();
+            properties.put(ClientProperty.INSTANCE_NAME.getKey(), accumuloConf.getInstanceName());
+            properties.put(ClientProperty.INSTANCE_ZOOKEEPERS.getKey(), accumuloConf.getZookeepers());
+            properties.put(ClientProperty.INSTANCE_ZOOKEEPERS_TIMEOUT.getKey(), accumuloConf.getZookeeperTimeout());
+            properties.put(ClientProperty.AUTH_PRINCIPAL.getKey(), accumuloConf.getUsername());
+            properties.put(ClientProperty.AUTH_TOKEN.getKey(), accumuloConf.getPassword());
+            properties.put(ClientProperty.AUTH_TYPE.getKey(), "password");
+            AccumuloClient accumuloClient = org.apache.accumulo.core.client.Accumulo.newClient().from(properties)
+                    .build();
+            scanner = accumuloClient.createScanner(metaTable, Authorizations.EMPTY);
            LOG.debug("Begin scanning " + metaTable);
            Key metricPrefixBeginKey = new Key(Meta.METRIC_PREFIX);
            int firstChar = Meta.METRIC_PREFIX.charAt(0);
@@ -112,7 +109,7 @@ public class MetaCacheImpl implements MetaCache {
                cache.putAll(newCache);
            }
            LOG.debug("Finished scanning " + metaTable);
-        } catch (AccumuloException | AccumuloSecurityException | TableNotFoundException e) {
+        } catch (Exception e) {
            LOG.error(e.getMessage(), e);
        } finally {
            if (scanner != null) {
@@ -142,8 +142,8 @@ public class MetricAgeOffIterator extends WrappingIterator implements OptionDesc
            Pair<String, Long> start = MetricAdapter.decodeRowKey(startKey);
            byte[] newStartRow = MetricAdapter.encodeRowKey(start.getFirst(), timeTarget);
            // @formatter:off
-            Key newStartKey = new Key(newStartRow, 
-                    null != startKey.getColumnFamily() ? startKey.getColumnFamilyData().getBackingArray() : null, 
+            Key newStartKey = new Key(newStartRow,
+                    null != startKey.getColumnFamily() ? startKey.getColumnFamilyData().getBackingArray() : null,
                    null != startKey.getColumnQualifier() ? startKey.getColumnQualifierData().getBackingArray() : null,
                    null != startKey.getColumnVisibility() ? startKey.getColumnVisibility().getBytes() : null,
                    timeTarget, startKey.isDeleted());
@@ -207,18 +207,14 @@ public class DataStoreCache {
        testIPRWLock(curatorFramework, nonCachedMetricsIPRWLock, NON_CACHED_METRICS_LOCK_PATH);
        nonCachedMetricsIP = new DistributedAtomicValue(curatorFramework, NON_CACHED_METRICS, new RetryForever(1000));
        try {
-            nonCachedMetricsIP.initialize(SerializationUtils.serialize(new TreeSet<>()));
+            nonCachedMetricsIP.forceSet(SerializationUtils.serialize(new TreeSet<>()));
        } catch (Exception e) {
            LOG.error(e.getMessage(), e);
        }
-        TreeCacheListener nonCachedMetricsListener = new TreeCacheListener() {
-
-            @Override
-            public void childEvent(CuratorFramework curatorFramework, TreeCacheEvent event) throws Exception {
-                if (event.getType().equals(TreeCacheEvent.Type.NODE_UPDATED)) {
-                    LOG.info("Handling nonCachedMetricsIP event {}", event.getType().toString());
-                    readNonCachedMetricsIP();
-                }
+        TreeCacheListener nonCachedMetricsListener = (cf, event) -> {
+            if (event.getType().equals(TreeCacheEvent.Type.NODE_UPDATED)) {
+                LOG.info("Handling nonCachedMetricsIP event {}", event.getType().toString());
+                readNonCachedMetricsIP();
            }
        };

@@ -231,30 +227,32 @@ public class DataStoreCache {
    }

    private void readNonCachedMetricsIP() {
-        try {
-            nonCachedMetricsIPRWLock.readLock().acquire();
-            byte[] nonCachedMetricsUpdateBytes = nonCachedMetricsIP.get().postValue();
-            Set<String> nonCachedMetricsUpdate;
-            if (nonCachedMetricsUpdateBytes == null) {
-                nonCachedMetricsUpdate = new TreeSet<>();
-            } else {
-                nonCachedMetricsUpdate = SerializationUtils.deserialize(nonCachedMetricsIP.get().postValue());
-            }
-
-            if (nonCachedMetrics.containsAll(nonCachedMetricsUpdate)) {
-                LOG.info("local nonCachedMetrics already contains {}", nonCachedMetricsUpdate);
-            } else {
-                nonCachedMetricsUpdate.removeAll(nonCachedMetrics);
-                LOG.info("Adding {} to local nonCachedMetrics", nonCachedMetricsUpdate);
-                nonCachedMetrics.addAll(nonCachedMetricsUpdate);
-            }
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-        } finally {
+        if (nonCachedMetricsIPRWLock != null) {
            try {
-                nonCachedMetricsIPRWLock.readLock().release();
+                nonCachedMetricsIPRWLock.readLock().acquire();
+                byte[] nonCachedMetricsUpdateBytes = nonCachedMetricsIP.get().postValue();
+                Set<String> nonCachedMetricsUpdate;
+                if (nonCachedMetricsUpdateBytes == null) {
+                    nonCachedMetricsUpdate = new TreeSet<>();
+                } else {
+                    nonCachedMetricsUpdate = SerializationUtils.deserialize(nonCachedMetricsIP.get().postValue());
+                }
+
+                if (nonCachedMetrics.containsAll(nonCachedMetricsUpdate)) {
+                    LOG.info("local nonCachedMetrics already contains {}", nonCachedMetricsUpdate);
+                } else {
+                    nonCachedMetricsUpdate.removeAll(nonCachedMetrics);
+                    LOG.info("Adding {} to local nonCachedMetrics", nonCachedMetricsUpdate);
+                    nonCachedMetrics.addAll(nonCachedMetricsUpdate);
+                }
            } catch (Exception e) {
-                LOG.error(e.getMessage());
+                LOG.error(e.getMessage(), e);
+            } finally {
+                try {
+                    nonCachedMetricsIPRWLock.readLock().release();
+                } catch (Exception e) {
+                    LOG.error(e.getMessage());
+                }
            }
        }
    }
@@ -5,9 +5,9 @@ import java.util.List;
 import java.util.Map;

 import org.apache.accumulo.core.security.ColumnVisibility;
-import org.apache.commons.lang.builder.CompareToBuilder;
-import org.apache.commons.lang.builder.EqualsBuilder;
-import org.apache.commons.lang.builder.HashCodeBuilder;
+import org.apache.commons.lang3.builder.CompareToBuilder;
+import org.apache.commons.lang3.builder.EqualsBuilder;
+import org.apache.commons.lang3.builder.HashCodeBuilder;
 import timely.model.Tag;

 public class TaggedMetric implements Comparable<TaggedMetric> {
@@ -15,7 +15,7 @@ public class VisibilityFilter {
    protected LRUMap cache;

    private static final Logger log = LoggerFactory
-            .getLogger(org.apache.accumulo.core.iterators.system.VisibilityFilter.class);
+            .getLogger(org.apache.accumulo.core.iteratorsImpl.system.VisibilityFilter.class);

    public VisibilityFilter(Authorizations authorizations) {
        this.ve = new VisibilityEvaluator(authorizations);
@@ -7,13 +7,13 @@ import java.util.OptionalLong;

 import org.apache.accumulo.core.conf.Property;
 import org.apache.accumulo.core.data.TabletId;
-import org.apache.accumulo.server.fs.FileRef;
+import org.apache.accumulo.core.metadata.StoredTabletFile;
 import org.apache.accumulo.tserver.compaction.CompactionPlan;
 import org.apache.accumulo.tserver.compaction.CompactionStrategy;
 import org.apache.accumulo.tserver.compaction.MajorCompactionRequest;
 import org.apache.commons.collections4.trie.PatriciaTrie;
-import org.apache.commons.configuration.Configuration;
-import org.apache.commons.configuration.MapConfiguration;
+import org.apache.commons.configuration2.Configuration;
+import org.apache.commons.configuration2.MapConfiguration;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import timely.store.MetricAgeOffIterator;
@@ -108,8 +108,8 @@ public class MetricCompactionStrategy extends CompactionStrategy {
        CompactionPlan plan = null;
        if (shouldCompact(request)) {
            plan = new CompactionPlan();
-            for (FileRef ref : request.getFiles().keySet()) {
-                plan.inputFiles.add(ref);
+            for (StoredTabletFile f : request.getFiles().keySet()) {
+                plan.inputFiles.add(f);
            }

            if (LOG.isDebugEnabled()) {
@@ -11,7 +11,7 @@ import java.util.StringJoiner;
 import org.apache.accumulo.core.client.lexicoder.Lexicoder;
 import org.apache.accumulo.core.client.lexicoder.LongLexicoder;
 import org.apache.accumulo.core.client.lexicoder.StringLexicoder;
-import org.apache.accumulo.core.client.lexicoder.impl.ByteUtils;
+import org.apache.accumulo.core.clientImpl.lexicoder.ByteUtils;
 import org.apache.accumulo.core.data.TabletId;
 import org.apache.commons.codec.binary.Hex;
 import org.apache.commons.lang3.ArrayUtils;
@@ -139,10 +139,11 @@ public class TieredCompactionStrategy extends CompactionStrategy {
                    String tableContext = tableProperties.get(Property.TABLE_CLASSPATH.getKey());
                    Class<? extends CompactionStrategy> clazz;
                    if (null != tableContext && !tableContext.equals("")) {
-                        clazz = AccumuloVFSClassLoader.getContextManager().loadClass(tableContext, clazzName,
-                                CompactionStrategy.class);
+                        clazz = AccumuloVFSClassLoader.getContextClassLoader(tableContext).loadClass(clazzName)
+                                .asSubclass(CompactionStrategy.class);
                    } else {
-                        clazz = AccumuloVFSClassLoader.loadClass(clazzName, CompactionStrategy.class);
+                        clazz = AccumuloVFSClassLoader.getClassLoader().loadClass(clazzName)
+                                .asSubclass(CompactionStrategy.class);
                    }
                    strategy = clazz.newInstance();
                    strategy.init(options());
@@ -1,13 +1,10 @@
 package timely.store.compaction.util;

-import java.util.HashMap;
+import java.util.Properties;
 import java.util.concurrent.TimeUnit;

-import org.apache.accumulo.core.client.ClientConfiguration;
-import org.apache.accumulo.core.client.Connector;
-import org.apache.accumulo.core.client.Instance;
-import org.apache.accumulo.core.client.ZooKeeperInstance;
-import org.apache.accumulo.core.client.security.tokens.PasswordToken;
+import org.apache.accumulo.core.client.AccumuloClient;
+import org.apache.accumulo.core.conf.ClientProperty;
 import org.springframework.boot.Banner;
 import org.springframework.boot.WebApplicationType;
 import org.springframework.boot.builder.SpringApplicationBuilder;
@@ -22,19 +19,22 @@ public class TabletMetadataConsole {
        try (ConfigurableApplicationContext ctx = new SpringApplicationBuilder(SpringBootstrap.class)
                .bannerMode(Banner.Mode.OFF).web(WebApplicationType.NONE).run(args)) {
            Configuration conf = ctx.getBean(Configuration.class);
-            HashMap<String, String> apacheConf = new HashMap<>();
+
+            final Properties properties = new Properties();
            Accumulo accumuloConf = conf.getAccumulo();
-            apacheConf.put("instance.name", accumuloConf.getInstanceName());
-            apacheConf.put("instance.zookeeper.host", accumuloConf.getZookeepers());
-            ClientConfiguration aconf = ClientConfiguration.fromMap(apacheConf);
-            Instance instance = new ZooKeeperInstance(aconf);
-            Connector con = instance.getConnector(accumuloConf.getUsername(),
-                    new PasswordToken(accumuloConf.getPassword()));
+            properties.put(ClientProperty.INSTANCE_NAME.getKey(), accumuloConf.getInstanceName());
+            properties.put(ClientProperty.INSTANCE_ZOOKEEPERS.getKey(), accumuloConf.getZookeepers());
+            properties.put(ClientProperty.INSTANCE_ZOOKEEPERS_TIMEOUT.getKey(), accumuloConf.getZookeeperTimeout());
+            properties.put(ClientProperty.AUTH_PRINCIPAL.getKey(), accumuloConf.getUsername());
+            properties.put(ClientProperty.AUTH_TOKEN.getKey(), accumuloConf.getPassword());
+            properties.put(ClientProperty.AUTH_TYPE.getKey(), "password");
+            try (AccumuloClient accumuloClient = org.apache.accumulo.core.client.Accumulo.newClient().from(properties)
+                    .build()) {
+                TabletMetadataQuery query = new TabletMetadataQuery(accumuloClient, conf.getMetricsTable());
+                TabletMetadataView view = query.run();

-            TabletMetadataQuery query = new TabletMetadataQuery(con, conf.getMetricsTable());
-            TabletMetadataView view = query.run();
-
-            System.out.println(view.toText(TimeUnit.DAYS));
+                System.out.println(view.toText(TimeUnit.DAYS));
+            }
        }
    }
 }
@@ -2,9 +2,9 @@ package timely.store.compaction.util;

 import java.util.Map;

+import org.apache.accumulo.core.client.AccumuloClient;
 import org.apache.accumulo.core.client.AccumuloException;
 import org.apache.accumulo.core.client.AccumuloSecurityException;
-import org.apache.accumulo.core.client.Connector;
 import org.apache.accumulo.core.client.Scanner;
 import org.apache.accumulo.core.client.TableNotFoundException;
 import org.apache.accumulo.core.data.Key;
@@ -14,25 +14,24 @@ import org.apache.accumulo.core.metadata.MetadataTable;

 public class TabletMetadataQuery {

-    private final Connector connector;
+    private final AccumuloClient accumuloClient;
    private final String tableName;

-    public TabletMetadataQuery(Connector connector, String tableName) {
-        this.connector = connector;
+    public TabletMetadataQuery(AccumuloClient accumuloClient, String tableName) {
+        this.accumuloClient = accumuloClient;
        this.tableName = tableName;
    }

    public TabletMetadataView run() throws AccumuloException, AccumuloSecurityException, TableNotFoundException {
        TabletMetadataView view = new TabletMetadataView();
-        Map<String, String> tableMap = connector.tableOperations().tableIdMap();
+        Map<String, String> tableMap = accumuloClient.tableOperations().tableIdMap();
        String tableId = tableMap.get(tableName);
        if (null == tableId) {
            throw new IllegalStateException("Unable to find " + MetadataTable.NAME);
        }

-        try (Scanner s = connector.createScanner(MetadataTable.NAME,
-                connector.securityOperations().getUserAuthorizations(connector.whoami()))) {
-            // s.setRange(new Range(tableId, true, tableId, true));
+        try (Scanner s = accumuloClient.createScanner(MetadataTable.NAME,
+                accumuloClient.securityOperations().getUserAuthorizations(accumuloClient.whoami()))) {
            s.setRange(Range.prefix(tableId));
            for (Map.Entry<Key, Value> e : s) {
                view.addEntry(e);
@@ -6,7 +6,6 @@ import java.util.concurrent.TimeUnit;

 import org.apache.accumulo.core.data.Key;
 import org.apache.accumulo.core.data.Value;
-import org.apache.accumulo.core.data.impl.KeyExtent;
 import org.apache.accumulo.core.metadata.schema.MetadataSchema;
 import org.apache.commons.io.FileUtils;
 import org.apache.commons.math3.stat.descriptive.StatisticalSummary;
@@ -29,14 +28,14 @@ public class TabletMetadataView {
    }

    public void addEntry(Map.Entry<Key, Value> entry) {
-        KeyExtent ke = new KeyExtent(entry.getKey().getRow(), (Text) null);
-        if (ke.getEndRow() == null) {
+        Text endRow = MetadataSchema.TabletsSection.decodeRow(entry.getKey().getRow()).getSecond();
+        if (endRow == null) {
            return;
        }

        Text cf = entry.getKey().getColumnFamily();
        Text cq = entry.getKey().getColumnQualifier();
-        MetadataAccumulator.Entry candidate = accumulator.checkEntryState(ke.getEndRow());
+        MetadataAccumulator.Entry candidate = accumulator.checkEntryState(endRow);

        if (cf.equals(MetadataSchema.TabletsSection.DataFileColumnFamily.NAME)) {
            String val = entry.getValue().toString();
@@ -55,8 +54,8 @@ public class TabletMetadataView {
            }
        } else if (cf.equals(MetadataSchema.TabletsSection.TabletColumnFamily.PREV_ROW_COLUMN.getColumnFamily())
                && cq.equals(MetadataSchema.TabletsSection.TabletColumnFamily.PREV_ROW_COLUMN.getColumnQualifier())) {
-            ke = new KeyExtent(entry.getKey().getRow(), entry.getValue());
-            candidate.setTablePrev(ke.getPrevEndRow());
+            Text prevEndRow = MetadataSchema.TabletsSection.TabletColumnFamily.decodePrevEndRow(entry.getValue());
+            candidate.setTablePrev(prevEndRow);
        }
    }

@@ -220,13 +220,11 @@ public class MetricScanner extends Thread implements UncaughtExceptionHandler {
                } else if (rangeItr.hasNext()) {
                    // set next range on the scanner
                    Range r = rangeItr.next();
-                    this.scanner.close();
                    this.scanner.setRange(r);
                    this.iter = scanner.iterator();
                } else if (this.endTime == 0) {
                    flush();
                    long endTimeStamp = (System.currentTimeMillis() - (lag * 1000));
-                    this.scanner.close();
                    if (null == m) {
                        LOG.debug("[{}] No results found, waiting {}ms to retry with new end time {}. [{}]",
                                subscriptionId, delay, endTimeStamp);
@@ -1,15 +1,11 @@
 package timely.util;

-import java.util.HashMap;
-import java.util.Map;
 import java.util.Map.Entry;
+import java.util.Properties;

-import org.apache.accumulo.core.client.ClientConfiguration;
-import org.apache.accumulo.core.client.Connector;
-import org.apache.accumulo.core.client.Instance;
+import org.apache.accumulo.core.client.AccumuloClient;
 import org.apache.accumulo.core.client.Scanner;
-import org.apache.accumulo.core.client.ZooKeeperInstance;
-import org.apache.accumulo.core.client.security.tokens.PasswordToken;
+import org.apache.accumulo.core.conf.ClientProperty;
 import org.apache.accumulo.core.data.Key;
 import org.apache.accumulo.core.data.Range;
 import org.apache.accumulo.core.data.Value;
@@ -30,23 +26,23 @@ public class GetMetricTableSplitPoints {
                .bannerMode(Mode.OFF).web(WebApplicationType.NONE).run(args)) {
            Configuration conf = ctx.getBean(Configuration.class);

-            final Map<String, String> properties = new HashMap<>();
+            final Properties properties = new Properties();
            Accumulo accumuloConf = conf.getAccumulo();
-            properties.put("instance.name", accumuloConf.getInstanceName());
-            properties.put("instance.zookeeper.host", accumuloConf.getZookeepers());
-            final ClientConfiguration aconf = ClientConfiguration.fromMap(properties);
-            final Instance instance = new ZooKeeperInstance(aconf);
-            Connector con = instance.getConnector(accumuloConf.getUsername(),
-                    new PasswordToken(accumuloConf.getPassword()));
-            Scanner s = con.createScanner(conf.getMetaTable(),
-                    con.securityOperations().getUserAuthorizations(con.whoami()));
-            try {
+            properties.put(ClientProperty.INSTANCE_NAME.getKey(), accumuloConf.getInstanceName());
+            properties.put(ClientProperty.INSTANCE_ZOOKEEPERS.getKey(), accumuloConf.getZookeepers());
+            properties.put(ClientProperty.INSTANCE_ZOOKEEPERS_TIMEOUT.getKey(), accumuloConf.getZookeeperTimeout());
+            properties.put(ClientProperty.AUTH_PRINCIPAL.getKey(), accumuloConf.getUsername());
+            properties.put(ClientProperty.AUTH_TOKEN.getKey(), accumuloConf.getPassword());
+            properties.put(ClientProperty.AUTH_TYPE.getKey(), "password");
+            try (AccumuloClient accumuloClient = org.apache.accumulo.core.client.Accumulo.newClient().from(properties)
+                    .build();
+                    Scanner s = accumuloClient.createScanner(conf.getMetaTable(),
+                            accumuloClient.securityOperations().getUserAuthorizations(accumuloClient.whoami()))) {
+
                s.setRange(new Range(Meta.METRIC_PREFIX, true, Meta.TAG_PREFIX, false));
                for (Entry<Key, Value> e : s) {
                    System.out.println(e.getKey().getRow().toString().substring(Meta.METRIC_PREFIX.length()));
                }
-            } finally {
-                s.close();
            }
        }
    }
@@ -102,8 +102,8 @@ public class ConfigurationTest {
                "timely.accumulo.username:root",
                "timely.accumulo.password:secret",
                "timely.http.host:localhost",
-                "timely.security.serverSsl.certificate-file:/tmp/foo",
-                "timely.security.serverSsl.key-file:/tmp/bar").applyTo(this.context);
+                "timely.security.serverSsl.key-store-file:/tmp/foo",
+                "timely.security.serverSsl.key-store-password:password").applyTo(this.context);
        // @formatter:on
        context.refresh();
    }
@@ -11,6 +11,7 @@ import io.netty.handler.codec.http.HttpObjectAggregator;
 import io.netty.handler.codec.http.HttpRequestDecoder;
 import io.netty.handler.logging.LoggingHandler;
 import io.netty.handler.ssl.SslContext;
+import org.apache.accumulo.core.client.AccumuloClient;
 import timely.configuration.Configuration;
 import timely.netty.http.NonSslRedirectHandler;
 import timely.netty.tcp.MetricsBufferDecoder;
@@ -25,8 +26,8 @@ public class TestServer extends Server {
    private final TestCaptureRequestHandler httpRequests = new TestCaptureRequestHandler();
    private final TestCaptureRequestHandler udpRequests = new TestCaptureRequestHandler();

-    public TestServer(Configuration conf) throws Exception {
-        super(conf, 1);
+    public TestServer(Configuration conf, AccumuloClient accumuloClient) {
+        super(conf, accumuloClient, 1);
    }

    @Override
@@ -31,7 +31,7 @@ public class MetricAdapterTest {
    }

    @Test
-    public void testToMutation() throws Exception {
+    public void testToMutation() {
        long ts = System.currentTimeMillis();
        List<Tag> tags = new ArrayList<>();
        tags.add(new Tag("tag1", "value1"));
@@ -72,7 +72,7 @@ public class MetricAdapterTest {
    }

    @Test
-    public void testToMutationWithViz() throws Exception {
+    public void testToMutationWithViz() {
        long ts = System.currentTimeMillis();
        List<Tag> tags = new ArrayList<>();
        tags.add(new Tag("tag1", "value1"));
@@ -1,12 +1,14 @@
 package timely.api.response.timeseries;

 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;

 import org.junit.Assert;
 import org.junit.Test;
 import timely.api.request.timeseries.SearchLookupRequest;
 import timely.api.response.timeseries.SearchLookupResponse.Result;
+import timely.model.Tag;
 import timely.util.JsonUtil;

 public class SearchLookupResponseTest {
@@ -42,14 +44,11 @@ public class SearchLookupResponseTest {
    }

    @Test
-    public void testMetricRequest() {
-        try {
-            String r = "{\"operation\":\"lookup\", \"metric\":\"testmetric\", \"tags\":[{\"host\":\".*\"}]}";
-            SearchLookupRequest req = JsonUtil.getObjectMapper().readValue(r, SearchLookupRequest.class);
-            System.out.println(req);
-        } catch (Exception e) {
-            e.printStackTrace();
-        }
+    public void testMetricRequest() throws Exception {
+        String r = "{\"operation\":\"lookup\", \"metric\":\"testmetric\", \"tags\":[{\"host\":\".*\"}]}";
+        SearchLookupRequest req = JsonUtil.getObjectMapper().readValue(r, SearchLookupRequest.class);
+        Assert.assertEquals("testmetric", req.getQuery());
+        Assert.assertEquals(Collections.singletonList(new Tag("host", ".*")), req.getTags());
    }

 }
@@ -10,16 +10,16 @@ import org.springframework.beans.BeansException;
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.support.ClassPathXmlApplicationContext;

-public class UserDetailsServiceTest {
+public class FileUserDetailsServiceTest {

    private static ApplicationContext springContext = null;
-    private static UserDetailsService userDetailsService = null;
+    private static FileUserDetailsService fileUserDetailsService = null;

    @BeforeClass
    public static void setupClass() {
        try {
            springContext = new ClassPathXmlApplicationContext("security.xml");
-            userDetailsService = (UserDetailsService) springContext.getBean("timelyUserDetailsService");
+            fileUserDetailsService = (FileUserDetailsService) springContext.getBean("timelyUserDetailsService");
        } catch (BeansException e) {
            throw new ServiceConfigurationError("Error initializing from spring: " + e.getMessage(), e.getRootCause());
        }
@@ -27,7 +27,7 @@ public class UserDetailsServiceTest {

    @Test
    public void testAuths() {
-        TimelyUser u = userDetailsService.getUsers().get("CN=example.com");
+        TimelyUser u = fileUserDetailsService.getUsers().get("CN=example.com");
        Assert.assertNotNull("TimelyUser not found", u);
        Assert.assertEquals("3 auths expected", 3, u.getAuths().size());
        Assert.assertTrue("Unexpected auths found " + u.getAuths(),
@@ -36,7 +36,7 @@ public class UserDetailsServiceTest {

    @Test
    public void testRoles() {
-        TimelyUser u = userDetailsService.getUsers().get("CN=example.com");
+        TimelyUser u = fileUserDetailsService.getUsers().get("CN=example.com");
        Assert.assertNotNull("TimelyUser not found", u);
        Assert.assertEquals("3 roles expected", 3, u.getRoles().size());
        Assert.assertTrue("Unexpected roles found " + u.getRoles(),
@@ -66,7 +66,7 @@ public class BasicAuthLoginRequestHandlerTest {
        Configuration config = TestConfiguration.createMinimalConfigurationForTest();

        // @formatter:off
-        String form = 
+        String form =
        "{\n" +
        "    \"username\": \"test\",\n" +
        "    \"password\": \"test1\"\n" +
@@ -105,7 +105,7 @@ public class BasicAuthLoginRequestHandlerTest {
        Configuration config = TestConfiguration.createMinimalConfigurationForTest();

        // @formatter:off
-        String form = 
+        String form =
        "{\n" +
        "    \"username\": \"test\",\n" +
        "    \"password\": \"test2\"\n" +
@@ -10,12 +10,10 @@ import java.util.Map.Entry;
 import org.apache.accumulo.core.client.IteratorSetting;
 import org.apache.accumulo.core.data.*;
 import org.apache.accumulo.core.iterators.SortedKeyValueIterator;
-import org.apache.accumulo.core.iterators.SortedMapIterator;
+import org.apache.accumulo.core.iteratorsImpl.system.SortedMapIterator;
 import org.junit.Before;
 import org.junit.Test;
 import timely.adapter.accumulo.MetricAdapter;
-import timely.auth.VisibilityCache;
-import timely.configuration.Configuration;
 import timely.model.Metric;
 import timely.model.Tag;
 import timely.sample.Aggregation;
@@ -28,11 +26,6 @@ public class AggregationIteratorTest {
    final private SortedMap<Key, Value> testData1 = new TreeMap<>();
    final private SortedMap<Key, Value> testData2 = new TreeMap<>();

-    @Before
-    public void before() {
-        VisibilityCache.init(new Configuration());
-    }
-
    @Before
    public void createTestData() throws Exception {
        createTestData1();
@@ -149,5 +142,4 @@ public class AggregationIteratorTest {
        Map<Set<Tag>, Aggregation> samples = AggregationIterator.decodeValue(iter.getTopValue());
        return samples;
    }
-
 }
Author	SHA1	Message	Date
Bill Oley	f3275c6a34	Release version 2.0.1	2024-01-26 13:10:20 -05:00
Bill Oley	7486b6b761	Add RemoteUserDetailsService, fix MiniAccumulo test, simplify SSL configuration and allow more types of SSL keyStores and trustStores	2024-01-26 13:07:26 -05:00
Bill Oley	b1a968590c	Bump version to 2.0.1-SNAPSHOT	2024-01-17 10:42:09 -05:00
Bill Oley	8f86b20c02	Release version 2.0.0	2024-01-17 10:42:09 -05:00
Bill Oley	a3620a3f24	Fixes for intermittent test failures, version to 2.0.0-SNAPSHOT	2024-01-17 10:42:09 -05:00
Bill Oley	9c99e74958	Use InMemoryAccumulo instead of MiniAccumulo, test fixes	2024-01-17 10:42:09 -05:00
Bill Oley	91ec36e819	Changes to support accumulo2	2024-01-17 10:42:08 -05:00
Bill Oley	9ad1b18b74	Delete grafana-auth module	2024-01-17 10:42:08 -05:00
Bill Oley	82c45d4dd4	Bump version to 1.3.7-SNAPSHOT	2023-10-13 10:28:19 -04:00
Bill Oley	a0e47d0b48	Release version 1.3.6	2023-10-13 10:25:43 -04:00
dependabot[bot]	d3dc324d84	Bump golang.org/x/net from 0.7.0 to 0.17.0 in /grafana/timely-app (#246 ) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.7.0 to 0.17.0. - [Commits](https://github.com/golang/net/compare/v0.7.0...v0.17.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-13 10:18:12 -04:00
Bill Oley	4871b3a4a9	Update dependencies, protect against NPE in AuthCache, AuthorizationsUtil	2023-10-13 10:02:33 -04:00
dependabot[bot]	8d5d5eeca8	Bump terser from 4.8.0 to 4.8.1 in /grafana/timely-app (#235 ) Bumps [terser](https://github.com/terser/terser) from 4.8.0 to 4.8.1. - [Release notes](https://github.com/terser/terser/releases) - [Changelog](https://github.com/terser/terser/blob/master/CHANGELOG.md) - [Commits](https://github.com/terser/terser/commits) --- updated-dependencies: - dependency-name: terser dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-11 14:26:51 -04:00
dependabot[bot]	a006a44372	Bump decode-uri-component from 0.2.0 to 0.2.2 in /grafana/timely-app (#240 ) Bumps [decode-uri-component](https://github.com/SamVerschueren/decode-uri-component) from 0.2.0 to 0.2.2. - [Release notes](https://github.com/SamVerschueren/decode-uri-component/releases) - [Commits](https://github.com/SamVerschueren/decode-uri-component/compare/v0.2.0...v0.2.2) --- updated-dependencies: - dependency-name: decode-uri-component dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-11 14:26:07 -04:00
dependabot[bot]	6cfcdc1030	Bump golang.org/x/net in /grafana/timely-app (#241 ) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.0.0-20210614182718-04defd469f4e to 0.7.0. - [Release notes](https://github.com/golang/net/releases) - [Commits](https://github.com/golang/net/commits/v0.7.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-11 14:25:46 -04:00
dependabot[bot]	4eb7ceff8c	Bump semver from 5.7.1 to 5.7.2 in /grafana/timely-app (#244 ) Bumps [semver](https://github.com/npm/node-semver) from 5.7.1 to 5.7.2. - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/v5.7.2/CHANGELOG.md) - [Commits](https://github.com/npm/node-semver/compare/v5.7.1...v5.7.2) --- updated-dependencies: - dependency-name: semver dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-11 14:25:13 -04:00
dependabot[bot]	6ad8da2b99	Bump word-wrap from 1.2.3 to 1.2.4 in /grafana/timely-app (#245 ) Bumps [word-wrap](https://github.com/jonschlinkert/word-wrap) from 1.2.3 to 1.2.4. - [Release notes](https://github.com/jonschlinkert/word-wrap/releases) - [Commits](https://github.com/jonschlinkert/word-wrap/compare/1.2.3...1.2.4) --- updated-dependencies: - dependency-name: word-wrap dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-10-11 14:24:12 -04:00
dependabot[bot]	7f56a36906	Bump guava from 29.0-jre to 32.0.0-jre (#243 ) Bumps [guava](https://github.com/google/guava) from 29.0-jre to 32.0.0-jre. - [Release notes](https://github.com/google/guava/releases) - [Commits](https://github.com/google/guava/commits) --- updated-dependencies: - dependency-name: com.google.guava:guava dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-06-15 12:53:29 -04:00
Christopher Tubbs	1443fdceb9	Bump formatter and impsort plugins for newer Maven	2023-06-07 11:01:29 -04:00
Christopher Tubbs	3cff14eb03	Bump NPM/Yarn deps * This avoids warnings about CVEs from GitHub in the referenced dependencies * This required relaxing the node version constraint, since I didn't have version 12, only 16	2022-04-11 15:49:13 -04:00
dependabot[bot]	8fa5b56e62	Bump hadoop-common from 2.7.7 to 2.10.1 (#230 ) Bumps hadoop-common from 2.7.7 to 2.10.1. --- updated-dependencies: - dependency-name: org.apache.hadoop:hadoop-common dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2022-04-11 14:22:59 -04:00
dependabot[bot]	b2f2cef834	Bump follow-redirects from 1.14.1 to 1.14.8 in /grafana/timely-app (#232 ) Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.14.1 to 1.14.8. - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.14.1...v1.14.8) --- updated-dependencies: - dependency-name: follow-redirects dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2022-04-11 14:22:18 -04:00
dependabot[bot]	c6a2988083	Bump accumulo-core from 1.9.3 to 1.10.1 (#231 ) Bumps [accumulo-core](https://github.com/apache/accumulo) from 1.9.3 to 1.10.1. - [Release notes](https://github.com/apache/accumulo/releases) - [Commits](https://github.com/apache/accumulo/compare/rel/1.9.3...rel/1.10.1) --- updated-dependencies: - dependency-name: org.apache.accumulo:accumulo-core dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2022-04-11 14:21:50 -04:00
Bill Oley	d54817cc9a	Bump version to 1.3.6-SNAPSHOT	2022-01-07 14:43:04 -05:00