synchronized void rollCurrentKey() {
    if (!leaderElector.isMaster()) {
      LOG.info("Skipping rollCurrentKey() because not running as master.");
      return;
    }

    long now = EnvironmentEdgeManager.currentTime();
    AuthenticationKey prev = currentKey;
    AuthenticationKey newKey =
        new AuthenticationKey(
            ++idSeq,
            Long.MAX_VALUE, // don't allow to expire until it's replaced by a new key
            generateSecret());
    allKeys.put(newKey.getKeyId(), newKey);
    currentKey = newKey;
    zkWatcher.addKeyToZK(newKey);
    lastKeyUpdate = now;

    if (prev != null) {
      // make sure previous key is still stored
      prev.setExpiration(now + tokenMaxLifetime);
      allKeys.put(prev.getKeyId(), prev);
      zkWatcher.updateKeyInZK(prev);
    }
  }
 @Override
 protected byte[] createPassword(AuthenticationTokenIdentifier identifier) {
   long now = EnvironmentEdgeManager.currentTime();
   AuthenticationKey secretKey = currentKey;
   identifier.setKeyId(secretKey.getKeyId());
   identifier.setIssueDate(now);
   identifier.setExpirationDate(now + tokenMaxLifetime);
   identifier.setSequenceNumber(tokenSeq.getAndIncrement());
   return createPassword(identifier.getBytes(), secretKey.getKey());
 }
 @Override
 public boolean equals(Object obj) {
   if (obj == null || !(obj instanceof AuthenticationKey)) {
     return false;
   }
   AuthenticationKey other = (AuthenticationKey) obj;
   return id == other.getKeyId()
       && expirationDate == other.getExpiration()
       && (secret == null
           ? other.getKey() == null
           : other.getKey() != null
               && Bytes.equals(secret.getEncoded(), other.getKey().getEncoded()));
 }
  synchronized void removeExpiredKeys() {
    if (!leaderElector.isMaster()) {
      LOG.info("Skipping removeExpiredKeys() because not running as master.");
      return;
    }

    long now = EnvironmentEdgeManager.currentTime();
    Iterator<AuthenticationKey> iter = allKeys.values().iterator();
    while (iter.hasNext()) {
      AuthenticationKey key = iter.next();
      if (key.getExpiration() < now) {
        if (LOG.isDebugEnabled()) {
          LOG.debug("Removing expired key " + key.getKeyId());
        }
        iter.remove();
        zkWatcher.removeKeyFromZK(key);
      }
    }
  }
  public synchronized void addKey(AuthenticationKey key) throws IOException {
    // ignore zk changes when running as master
    if (leaderElector.isMaster()) {
      if (LOG.isDebugEnabled()) {
        LOG.debug("Running as master, ignoring new key " + key.getKeyId());
      }
      return;
    }

    if (LOG.isDebugEnabled()) {
      LOG.debug("Adding key " + key.getKeyId());
    }

    allKeys.put(key.getKeyId(), key);
    if (currentKey == null || key.getKeyId() > currentKey.getKeyId()) {
      currentKey = key;
    }
    // update current sequence
    if (key.getKeyId() > idSeq) {
      idSeq = key.getKeyId();
    }
  }