diff --git a/tests/mgmt/command-validator.cpp b/tests/mgmt/command-validator.cpp
new file mode 100644
index 0000000..7a6d39d
--- /dev/null
+++ b/tests/mgmt/command-validator.cpp
@@ -0,0 +1,585 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (C) 2014 Named Data Networking Project
+ * See COPYING for copyright and distribution information.
+ */
+
+#include "mgmt/command-validator.hpp"
+#include "mgmt/config-file.hpp"
+
+#include "tests/test-common.hpp"
+
+#include <boost/test/unit_test.hpp>
+#include <ndn-cpp-dev/util/command-interest-generator.hpp>
+#include <ndn-cpp-dev/util/io.hpp>
+#include <boost/filesystem.hpp>
+
+namespace nfd {
+
+namespace tests {
+
+NFD_LOG_INIT("CommandValidatorTest");
+
+BOOST_FIXTURE_TEST_SUITE(MgmtCommandValidator, BaseFixture)
+
+// authorizations
+// {
+//   ; an authorize section grants privileges to a key
+//   authorize
+//   {
+//     keyfile "tests/mgmt/key1.pub" ; public key file
+//     privileges ; set of privileges granted to this public key
+//     {
+//       fib
+//       stats
+//     }
+//   }
+
+//   authorize
+//   {
+//     keyfile "tests/mgmt/key2.pub" ; public key file
+//     privileges ; set of privileges granted to this public key
+//     {
+//       faces
+//     }
+//   }
+// }
+
+const std::string CONFIG =
+"authorizations\n"
+"{\n"
+"  authorize\n"
+"  {\n"
+"    keyfile \"tests/mgmt/key1.pub\"\n"
+"    privileges\n"
+"    {\n"
+"      fib\n"
+"      stats\n"
+"    }\n"
+"  }\n"
+"  authorize\n"
+"  {\n"
+"    keyfile \"tests/mgmt/key2.pub\"\n"
+"    privileges\n"
+"    {\n"
+"      faces\n"
+"    }\n"
+"  }\n"
+  "}\n";
+
+class CommandValidatorTester
+{
+public:
+
+  CommandValidatorTester()
+    : m_validated(false),
+      m_validationFailed(false)
+  {
+
+  }
+
+  void
+  generateIdentity(const Name& prefix)
+  {
+    m_identityName = prefix;
+    m_identityName.append(boost::lexical_cast<std::string>(ndn::time::now()));
+
+    const Name certName = m_keys.createIdentity(m_identityName);
+
+    m_certificate = m_keys.getCertificate(certName);
+  }
+
+  void
+  saveIdentityToFile(const char* filename)
+  {
+    std::ofstream out;
+    out.open(filename);
+
+    BOOST_REQUIRE(out.is_open());
+    BOOST_REQUIRE(static_cast<bool>(m_certificate));
+
+    ndn::io::save<ndn::IdentityCertificate>(*m_certificate, out);
+
+    out.close();
+  }
+
+  const Name&
+  getIdentityName() const
+  {
+    BOOST_REQUIRE_NE(m_identityName, Name());
+    return m_identityName;
+  }
+
+  const Name&
+  getPublicKeyName() const
+  {
+    BOOST_REQUIRE(static_cast<bool>(m_certificate));
+    return m_certificate->getPublicKeyName();
+  }
+
+  void
+  onValidated(const shared_ptr<const Interest>& interest)
+  {
+    // NFD_LOG_DEBUG("validated command");
+    m_validated = true;
+  }
+
+  void
+  onValidationFailed(const shared_ptr<const Interest>& interest, const std::string& info)
+  {
+    NFD_LOG_DEBUG("validation failed: " << info);
+    m_validationFailed = true;
+  }
+
+  bool
+  commandValidated() const
+  {
+    return m_validated;
+  }
+
+  bool
+  commandValidationFailed() const
+  {
+    return m_validationFailed;
+  }
+
+  void
+  resetValidation()
+  {
+    m_validated = false;
+    m_validationFailed = false;
+  }
+
+  ~CommandValidatorTester()
+  {
+    m_keys.deleteIdentity(m_identityName);
+  }
+
+private:
+  bool m_validated;
+  bool m_validationFailed;
+
+  ndn::KeyChain m_keys;
+  Name m_identityName;
+  shared_ptr<ndn::IdentityCertificate> m_certificate;
+};
+
+class TwoValidatorFixture : public BaseFixture
+{
+public:
+  TwoValidatorFixture()
+  {
+    m_tester1.generateIdentity("/test/CommandValidator/TwoKeys/id1");
+    m_tester1.saveIdentityToFile("tests/mgmt/key1.pub");
+
+    m_tester2.generateIdentity("/test/CommandValidator/TwoKeys/id2");
+    m_tester2.saveIdentityToFile("tests/mgmt/key2.pub");
+  }
+
+  ~TwoValidatorFixture()
+  {
+    boost::system::error_code error;
+    boost::filesystem::remove("tests/mgmt/key1.pub", error);
+    boost::filesystem::remove("tests/mgmt/key2.pub", error);
+  }
+
+protected:
+  CommandValidatorTester m_tester1;
+  CommandValidatorTester m_tester2;
+};
+
+BOOST_FIXTURE_TEST_CASE(TwoKeys, TwoValidatorFixture)
+{
+  shared_ptr<Interest> fibCommand = make_shared<Interest>("/localhost/nfd/fib/insert");
+  shared_ptr<Interest> statsCommand = make_shared<Interest>("/localhost/nfd/stats/dosomething");
+  shared_ptr<Interest> facesCommand = make_shared<Interest>("/localhost/nfd/faces/create");
+
+  ndn::CommandInterestGenerator generator;
+  generator.generateWithIdentity(*fibCommand, m_tester1.getIdentityName());
+  generator.generateWithIdentity(*statsCommand, m_tester1.getIdentityName());
+  generator.generateWithIdentity(*facesCommand, m_tester2.getIdentityName());
+
+  ConfigFile config;
+  CommandValidator validator;
+  validator.addSupportedPrivilege("faces");
+  validator.addSupportedPrivilege("fib");
+  validator.addSupportedPrivilege("stats");
+
+  config.addSectionHandler("authorizations",
+                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
+  config.parse(CONFIG, false);
+
+  validator.validate(*fibCommand,
+                     bind(&CommandValidatorTester::onValidated, boost::ref(m_tester1), _1),
+                     bind(&CommandValidatorTester::onValidationFailed, boost::ref(m_tester1), _1, _2));
+
+  BOOST_REQUIRE(m_tester1.commandValidated());
+  m_tester1.resetValidation();
+
+  validator.validate(*statsCommand,
+                     bind(&CommandValidatorTester::onValidated, boost::ref(m_tester1), _1),
+                     bind(&CommandValidatorTester::onValidationFailed, boost::ref(m_tester1), _1, _2));
+
+  BOOST_REQUIRE(m_tester1.commandValidated());
+
+  validator.validate(*facesCommand,
+                     bind(&CommandValidatorTester::onValidated, boost::ref(m_tester2), _1),
+                     bind(&CommandValidatorTester::onValidationFailed, boost::ref(m_tester2), _1, _2));
+
+  BOOST_REQUIRE(m_tester2.commandValidated());
+  m_tester2.resetValidation();
+
+  // use key2 for fib command (authorized for key1 only)
+  shared_ptr<Interest> unauthorizedFibCommand = make_shared<Interest>("/localhost/nfd/fib/insert");
+  generator.generateWithIdentity(*unauthorizedFibCommand, m_tester2.getIdentityName());
+
+  validator.validate(*unauthorizedFibCommand,
+                     bind(&CommandValidatorTester::onValidated, boost::ref(m_tester2), _1),
+                     bind(&CommandValidatorTester::onValidationFailed, boost::ref(m_tester2), _1, _2));
+
+  BOOST_REQUIRE(m_tester2.commandValidationFailed());
+}
+
+BOOST_FIXTURE_TEST_CASE(TwoKeysDryRun, TwoValidatorFixture)
+{
+  CommandValidatorTester tester1;
+  tester1.generateIdentity("/test/CommandValidator/TwoKeys/id1");
+  tester1.saveIdentityToFile("tests/mgmt/key1.pub");
+
+  CommandValidatorTester tester2;
+  tester2.generateIdentity("/test/CommandValidator/TwoKeys/id2");
+  tester2.saveIdentityToFile("tests/mgmt/key2.pub");
+
+  shared_ptr<Interest> fibCommand = make_shared<Interest>("/localhost/nfd/fib/insert");
+  shared_ptr<Interest> statsCommand = make_shared<Interest>("/localhost/nfd/stats/dosomething");
+  shared_ptr<Interest> facesCommand = make_shared<Interest>("/localhost/nfd/faces/create");
+
+  ndn::CommandInterestGenerator generator;
+  generator.generateWithIdentity(*fibCommand, m_tester1.getIdentityName());
+  generator.generateWithIdentity(*statsCommand, m_tester1.getIdentityName());
+  generator.generateWithIdentity(*facesCommand, m_tester2.getIdentityName());
+
+  ConfigFile config;
+  CommandValidator validator;
+  validator.addSupportedPrivilege("faces");
+  validator.addSupportedPrivilege("fib");
+  validator.addSupportedPrivilege("stats");
+
+  config.addSectionHandler("authorizations",
+                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
+  config.parse(CONFIG, true);
+
+  validator.validate(*fibCommand,
+                     bind(&CommandValidatorTester::onValidated, boost::ref(m_tester1), _1),
+                     bind(&CommandValidatorTester::onValidationFailed, boost::ref(m_tester1), _1, _2));
+
+  BOOST_REQUIRE(m_tester1.commandValidationFailed());
+  m_tester1.resetValidation();
+
+  validator.validate(*statsCommand,
+                     bind(&CommandValidatorTester::onValidated, boost::ref(m_tester1), _1),
+                     bind(&CommandValidatorTester::onValidationFailed, boost::ref(m_tester1), _1, _2));
+
+  BOOST_REQUIRE(m_tester1.commandValidationFailed());
+
+  validator.validate(*facesCommand,
+                     bind(&CommandValidatorTester::onValidated, boost::ref(m_tester2), _1),
+                     bind(&CommandValidatorTester::onValidationFailed, boost::ref(m_tester2), _1, _2));
+
+  BOOST_REQUIRE(m_tester2.commandValidationFailed());
+  m_tester2.resetValidation();
+
+  // use key2 for fib command (authorized for key1 only)
+  shared_ptr<Interest> unauthorizedFibCommand = make_shared<Interest>("/localhost/nfd/fib/insert");
+  generator.generateWithIdentity(*unauthorizedFibCommand, m_tester2.getIdentityName());
+
+  validator.validate(*unauthorizedFibCommand,
+                     bind(&CommandValidatorTester::onValidated, boost::ref(m_tester2), _1),
+                     bind(&CommandValidatorTester::onValidationFailed, boost::ref(m_tester2), _1, _2));
+
+  BOOST_REQUIRE(m_tester2.commandValidationFailed());
+}
+
+BOOST_AUTO_TEST_CASE(NoAuthorizeSections)
+{
+  const std::string NO_AUTHORIZE_CONFIG =
+    "authorizations\n"
+    "{\n"
+    "}\n";
+
+  ConfigFile config;
+  CommandValidator validator;
+
+  config.addSectionHandler("authorizations",
+                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
+  BOOST_CHECK_THROW(config.parse(NO_AUTHORIZE_CONFIG, false), ConfigFile::Error);
+}
+
+BOOST_AUTO_TEST_CASE(NoPrivilegesSections)
+{
+  const std::string NO_PRIVILEGES_CONFIG =
+    "authorizations\n"
+    "{\n"
+    "  authorize\n"
+    "  {\n"
+    "    keyfile \"tests/mgmt/key1.pub\"\n"
+    "  }\n"
+    "}\n";
+
+  ConfigFile config;
+  CommandValidator validator;
+
+  config.addSectionHandler("authorizations",
+                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
+  BOOST_CHECK_THROW(config.parse(NO_PRIVILEGES_CONFIG, false), ConfigFile::Error);
+}
+
+BOOST_AUTO_TEST_CASE(InvalidKeyFile)
+{
+  const std::string INVALID_KEY_CONFIG =
+    "authorizations\n"
+    "{\n"
+    "  authorize\n"
+    "  {\n"
+    "    keyfile \"tests/mgmt/notakeyfile.pub\"\n"
+    "    privileges\n"
+    "    {\n"
+    "      fib\n"
+    "      stats\n"
+    "    }\n"
+    "  }\n"
+    "}\n";
+
+  ConfigFile config;
+  CommandValidator validator;
+
+  config.addSectionHandler("authorizations",
+                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
+  BOOST_CHECK_THROW(config.parse(INVALID_KEY_CONFIG, false), ConfigFile::Error);
+}
+
+BOOST_AUTO_TEST_CASE(NoKeyFile)
+{
+  const std::string NO_KEY_CONFIG =
+    "authorizations\n"
+    "{\n"
+    "  authorize\n"
+    "  {\n"
+    "    privileges\n"
+    "    {\n"
+    "      fib\n"
+    "      stats\n"
+    "    }\n"
+    "  }\n"
+    "}\n";
+
+
+  ConfigFile config;
+  CommandValidator validator;
+
+  config.addSectionHandler("authorizations",
+                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
+  BOOST_CHECK_THROW(config.parse(NO_KEY_CONFIG, false), ConfigFile::Error);
+}
+
+BOOST_AUTO_TEST_CASE(MalformedKey)
+{
+    const std::string MALFORMED_KEY_CONFIG =
+    "authorizations\n"
+    "{\n"
+    "  authorize\n"
+    "  {\n"
+    "    keyfile \"tests/mgmt/malformedkey.pub\"\n"
+    "    privileges\n"
+    "    {\n"
+    "      fib\n"
+    "      stats\n"
+    "    }\n"
+    "  }\n"
+    "}\n";
+
+
+  ConfigFile config;
+  CommandValidator validator;
+
+  config.addSectionHandler("authorizations",
+                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
+  BOOST_CHECK_THROW(config.parse(MALFORMED_KEY_CONFIG, false), ConfigFile::Error);
+}
+
+bool
+validateErrorMessage(const std::string& expectedMessage, const ConfigFile::Error& error)
+{
+  bool gotExpected = error.what() == expectedMessage;
+  if (!gotExpected)
+    {
+      NFD_LOG_WARN("\ncaught exception: " << error.what()
+                    << "\n\nexpected exception: " << expectedMessage);
+    }
+  return gotExpected;
+}
+
+BOOST_AUTO_TEST_CASE(NoAuthorizeSectionsDryRun)
+{
+  const std::string NO_AUTHORIZE_CONFIG =
+    "authorizations\n"
+    "{\n"
+    "}\n";
+
+  ConfigFile config;
+  CommandValidator validator;
+
+  config.addSectionHandler("authorizations",
+                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
+  BOOST_CHECK_EXCEPTION(config.parse(NO_AUTHORIZE_CONFIG, true),
+                        ConfigFile::Error,
+                        bind(&validateErrorMessage,
+                             "No authorize sections found", _1));
+}
+
+BOOST_FIXTURE_TEST_CASE(NoPrivilegesSectionsDryRun, TwoValidatorFixture)
+{
+  const std::string NO_PRIVILEGES_CONFIG =
+    "authorizations\n"
+    "{\n"
+    "  authorize\n"
+    "  {\n"
+    "    keyfile \"tests/mgmt/key1.pub\"\n"
+    "  }\n"
+    "  authorize\n"
+    "  {\n"
+    "    keyfile \"tests/mgmt/key2.pub\"\n"
+    "  }\n"
+    "}\n";
+
+  // CommandValidatorTester tester1;
+  // tester1.generateIdentity("/tests/CommandValidator/TwoKeys/id1");
+  // tester1.saveIdentityToFile("tests/mgmt/key1.pub");
+
+  // CommandValidatorTester tester2;
+  // tester2.generateIdentity("/tests/CommandValidator/TwoKeys/id2");
+  // tester2.saveIdentityToFile("tests/mgmt/key2.pub");
+
+  ConfigFile config;
+  CommandValidator validator;
+
+  config.addSectionHandler("authorizations",
+                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
+
+  std::stringstream expectedError;
+  expectedError << "No privileges section found for key file tests/mgmt/key1.pub "
+                << "(" << m_tester1.getPublicKeyName().toUri() << ")\n"
+                << "No privileges section found for key file tests/mgmt/key2.pub "
+                << "(" << m_tester2.getPublicKeyName().toUri() << ")";
+
+  BOOST_CHECK_EXCEPTION(config.parse(NO_PRIVILEGES_CONFIG, true),
+                        ConfigFile::Error,
+                        bind(&validateErrorMessage, expectedError.str(), _1));
+}
+
+BOOST_AUTO_TEST_CASE(InvalidKeyFileDryRun)
+{
+  const std::string INVALID_KEY_CONFIG =
+    "authorizations\n"
+    "{\n"
+    "  authorize\n"
+    "  {\n"
+    "    keyfile \"tests/mgmt/notakeyfile.pub\"\n"
+    "    privileges\n"
+    "    {\n"
+    "      fib\n"
+    "      stats\n"
+    "    }\n"
+    "  }\n"
+    "  authorize\n"
+    "  {\n"
+    "    keyfile \"tests/mgmt/stillnotakeyfile.pub\"\n"
+    "    privileges\n"
+    "    {\n"
+    "    }\n"
+    "  }\n"
+    "}\n";
+
+  ConfigFile config;
+  CommandValidator validator;
+
+  config.addSectionHandler("authorizations",
+                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
+
+  BOOST_CHECK_EXCEPTION(config.parse(INVALID_KEY_CONFIG, true),
+                        ConfigFile::Error,
+                        bind(&validateErrorMessage,
+                             "Unable to open key file tests/mgmt/notakeyfile.pub\n"
+                             "Unable to open key file tests/mgmt/stillnotakeyfile.pub", _1));
+}
+
+BOOST_AUTO_TEST_CASE(NoKeyFileDryRun)
+{
+  const std::string NO_KEY_CONFIG =
+    "authorizations\n"
+    "{\n"
+    "  authorize\n"
+    "  {\n"
+    "    privileges\n"
+    "    {\n"
+    "      fib\n"
+    "      stats\n"
+    "    }\n"
+    "  }\n"
+    "  authorize\n"
+    "  {\n"
+    "  }\n"
+    "}\n";
+
+
+  ConfigFile config;
+  CommandValidator validator;
+
+  config.addSectionHandler("authorizations",
+                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
+  BOOST_CHECK_EXCEPTION(config.parse(NO_KEY_CONFIG, true),
+                        ConfigFile::Error,
+                        bind(&validateErrorMessage,
+                             "No keyfile specified\n"
+                             "No keyfile specified", _1));
+}
+
+BOOST_AUTO_TEST_CASE(MalformedKeyDryRun)
+{
+    const std::string MALFORMED_KEY_CONFIG =
+    "authorizations\n"
+    "{\n"
+    "  authorize\n"
+    "  {\n"
+    "    keyfile \"tests/mgmt/malformedkey.pub\"\n"
+    "    privileges\n"
+    "    {\n"
+    "      fib\n"
+    "      stats\n"
+    "    }\n"
+    "  }\n"
+    "  authorize\n"
+    "  {\n"
+    "    keyfile \"tests/mgmt/malformedkey.pub\"\n"
+    "  }\n"
+    "}\n";
+
+
+  ConfigFile config;
+  CommandValidator validator;
+
+  config.addSectionHandler("authorizations",
+                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
+  BOOST_CHECK_EXCEPTION(config.parse(MALFORMED_KEY_CONFIG, true),
+                        ConfigFile::Error,
+                        bind(&validateErrorMessage,
+                             "Malformed key file tests/mgmt/malformedkey.pub\n"
+                             "Malformed key file tests/mgmt/malformedkey.pub", _1));
+}
+
+BOOST_AUTO_TEST_SUITE_END()
+
+} // namespace tests
+
+} // namespace nfd
+
diff --git a/tests/mgmt/face-manager.cpp b/tests/mgmt/face-manager.cpp
index 92dc680..9937632 100644
--- a/tests/mgmt/face-manager.cpp
+++ b/tests/mgmt/face-manager.cpp
@@ -13,6 +13,7 @@
 
 #include "common.hpp"
 #include "tests/test-common.hpp"
+#include "validation-common.hpp"
 
 namespace nfd {
 namespace tests {
@@ -274,6 +275,13 @@
     return m_manager;
   }
 
+  void
+  addInterestRule(const std::string& regex,
+                  ndn::IdentityCertificate& certificate)
+  {
+    m_manager.addInterestRule(regex, certificate);
+  }
+
   bool
   didFaceTableAddFire() const
   {
@@ -669,9 +677,85 @@
   BOOST_REQUIRE(didCallbackFire());
 }
 
-/// \todo add tests for unsigned and unauthorized commands
+BOOST_AUTO_TEST_CASE(UnsignedCommand)
+{
+  ndn::nfd::FaceManagementOptions options;
+  options.setUri("tcp://127.0.0.1");
 
-BOOST_AUTO_TEST_CASE(UnsupportedVerb)
+  Block encodedOptions(options.wireEncode());
+
+  Name commandName("/localhost/nfd/faces");
+  commandName.append("create");
+  commandName.append(encodedOptions);
+
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+
+  getFace()->onReceiveData +=
+    bind(&FaceManagerFixture::validateControlResponse, this, _1,
+         command->getName(), 401, "Signature required");
+
+  getManager().onFaceRequest(*command);
+
+  BOOST_REQUIRE(didCallbackFire());
+}
+
+BOOST_FIXTURE_TEST_CASE(UnauthorizedCommand, UnauthorizedCommandFixture<FaceManagerFixture>)
+{
+  ndn::nfd::FaceManagementOptions options;
+  options.setUri("tcp://127.0.0.1");
+
+  Block encodedOptions(options.wireEncode());
+
+  Name commandName("/localhost/nfd/faces");
+  commandName.append("create");
+  commandName.append(encodedOptions);
+
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
+
+  getFace()->onReceiveData +=
+    bind(&FaceManagerFixture::validateControlResponse, this, _1,
+         command->getName(), 403, "Unauthorized command");
+
+  getManager().onFaceRequest(*command);
+
+  BOOST_REQUIRE(didCallbackFire());
+}
+
+template <typename T> class AuthorizedCommandFixture : public CommandFixture<T>
+{
+public:
+  AuthorizedCommandFixture()
+  {
+    const std::string regex = "^<localhost><nfd><faces>";
+    T::addInterestRule(regex, *CommandFixture<T>::m_certificate);
+  }
+
+  virtual
+  ~AuthorizedCommandFixture()
+  {
+
+  }
+};
+
+// template <> class AuthorizedCommandFixture<FaceManagerFixture> :
+//     public CommandFixture<FaceManagerFixture>
+// {
+// public:
+//   AuthorizedCommandFixture()
+//   {
+//     const std::string regex = "^<localhost><nfd><faces>";
+//     FaceManagerFixture::ManagerBase::addInterestRule(regex, *CommandFixture<FaceManagerFixture>::m_certificate);
+//   }
+
+//   virtual
+//   ~AuthorizedCommandFixture()
+//   {
+
+//   }
+// };
+
+BOOST_FIXTURE_TEST_CASE(UnsupportedCommand, AuthorizedCommandFixture<FaceManagerFixture>)
 {
   ndn::nfd::FaceManagementOptions options;
 
@@ -682,6 +766,7 @@
   commandName.append(encodedOptions);
 
   shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
 
   getFace()->onReceiveData +=
     bind(&FaceManagerFixture::validateControlResponse, this, _1,
@@ -743,13 +828,15 @@
   bool m_destroyFaceFired;
 };
 
-BOOST_FIXTURE_TEST_CASE(ValidatedFaceRequestBadOptionParse, ValidatedFaceRequestFixture)
+BOOST_FIXTURE_TEST_CASE(ValidatedFaceRequestBadOptionParse,
+                        AuthorizedCommandFixture<ValidatedFaceRequestFixture>)
 {
   Name commandName("/localhost/nfd/faces");
   commandName.append("create");
   commandName.append("NotReallyOptions");
 
   shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
 
   getFace()->onReceiveData +=
     bind(&ValidatedFaceRequestFixture::validateControlResponse, this, _1,
@@ -760,7 +847,8 @@
   BOOST_REQUIRE(didCallbackFire());
 }
 
-BOOST_FIXTURE_TEST_CASE(ValidatedFaceRequestCreateFace, ValidatedFaceRequestFixture)
+BOOST_FIXTURE_TEST_CASE(ValidatedFaceRequestCreateFace,
+                        AuthorizedCommandFixture<ValidatedFaceRequestFixture>)
 {
   ndn::nfd::FaceManagementOptions options;
   options.setUri("tcp://127.0.0.1");
@@ -772,12 +860,14 @@
   commandName.append(encodedOptions);
 
   shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
 
   onValidatedFaceRequest(command);
   BOOST_CHECK(didCreateFaceFire());
 }
 
-BOOST_FIXTURE_TEST_CASE(ValidatedFaceRequestDestroyFace, ValidatedFaceRequestFixture)
+BOOST_FIXTURE_TEST_CASE(ValidatedFaceRequestDestroyFace,
+                        AuthorizedCommandFixture<ValidatedFaceRequestFixture>)
 {
   ndn::nfd::FaceManagementOptions options;
   options.setUri("tcp://127.0.0.1");
@@ -789,6 +879,7 @@
   commandName.append(encodedOptions);
 
   shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
 
   onValidatedFaceRequest(command);
   BOOST_CHECK(didDestroyFaceFire());
@@ -812,7 +903,7 @@
   }
 };
 
-BOOST_FIXTURE_TEST_CASE(CreateFaceBadUri, FaceFixture)
+BOOST_FIXTURE_TEST_CASE(CreateFaceBadUri, AuthorizedCommandFixture<FaceFixture>)
 {
   ndn::nfd::FaceManagementOptions options;
   options.setUri("tcp:/127.0.0.1");
@@ -823,16 +914,19 @@
   commandName.append("create");
   commandName.append(encodedOptions);
 
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
+
   getFace()->onReceiveData +=
     bind(&FaceFixture::validateControlResponse, this, _1,
-         commandName, 400, "Malformed command");
+         command->getName(), 400, "Malformed command");
 
-  createFace(commandName, options);
+  createFace(command->getName(), options);
 
   BOOST_REQUIRE(didCallbackFire());
 }
 
-BOOST_FIXTURE_TEST_CASE(CreateFaceUnknownScheme, FaceFixture)
+BOOST_FIXTURE_TEST_CASE(CreateFaceUnknownScheme, AuthorizedCommandFixture<FaceFixture>)
 {
   ndn::nfd::FaceManagementOptions options;
   // this will be an unsupported protocol because no factories have been
@@ -845,16 +939,19 @@
   commandName.append("create");
   commandName.append(encodedOptions);
 
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
+
   getFace()->onReceiveData +=
     bind(&FaceFixture::validateControlResponse, this, _1,
-         commandName, 501, "Unsupported protocol");
+         command->getName(), 501, "Unsupported protocol");
 
-  createFace(commandName, options);
+  createFace(command->getName(), options);
 
   BOOST_REQUIRE(didCallbackFire());
 }
 
-BOOST_FIXTURE_TEST_CASE(OnCreated, FaceFixture)
+BOOST_FIXTURE_TEST_CASE(OnCreated, AuthorizedCommandFixture<FaceFixture>)
 {
   ndn::nfd::FaceManagementOptions options;
   options.setUri("tcp://127.0.0.1");
@@ -865,6 +962,9 @@
   commandName.append("create");
   commandName.append(encodedOptions);
 
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
+
   ndn::nfd::FaceManagementOptions resultOptions;
   resultOptions.setUri("tcp://127.0.0.1");
   resultOptions.setFaceId(-1);
@@ -873,17 +973,17 @@
 
   getFace()->onReceiveData +=
     bind(&FaceFixture::validateControlResponse, this, _1,
-         commandName, 200, "Success", encodedResultOptions);
+         command->getName(), 200, "Success", encodedResultOptions);
 
-  onCreated(commandName, options, make_shared<DummyFace>());
+  onCreated(command->getName(), options, make_shared<DummyFace>());
 
   BOOST_REQUIRE(didCallbackFire());
   BOOST_CHECK(TestFaceTableFixture::m_faceTable.didAddFire());
 }
 
-BOOST_FIXTURE_TEST_CASE(OnConnectFailed, FaceFixture)
+BOOST_FIXTURE_TEST_CASE(OnConnectFailed, AuthorizedCommandFixture<FaceFixture>)
 {
-    ndn::nfd::FaceManagementOptions options;
+  ndn::nfd::FaceManagementOptions options;
   options.setUri("tcp://127.0.0.1");
 
   Block encodedOptions(options.wireEncode());
@@ -892,18 +992,21 @@
   commandName.append("create");
   commandName.append(encodedOptions);
 
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
+
   getFace()->onReceiveData +=
     bind(&FaceFixture::validateControlResponse, this, _1,
-         commandName, 400, "Failed to create face");
+         command->getName(), 400, "Failed to create face");
 
-  onConnectFailed(commandName, "unit-test-reason");
+  onConnectFailed(command->getName(), "unit-test-reason");
 
   BOOST_REQUIRE(didCallbackFire());
   BOOST_CHECK_EQUAL(TestFaceTableFixture::m_faceTable.didAddFire(), false);
 }
 
 
-BOOST_FIXTURE_TEST_CASE(DestroyFace, FaceFixture)
+BOOST_FIXTURE_TEST_CASE(DestroyFace, AuthorizedCommandFixture<FaceFixture>)
 {
   ndn::nfd::FaceManagementOptions options;
   options.setUri("tcp://127.0.0.1");
@@ -914,11 +1017,14 @@
   commandName.append("destroy");
   commandName.append(encodedOptions);
 
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
+
   getFace()->onReceiveData +=
     bind(&FaceFixture::validateControlResponse, this, _1,
-         commandName, 200, "Success");
+         command->getName(), 200, "Success");
 
-  destroyFace(commandName, options);
+  destroyFace(command->getName(), options);
 
   BOOST_REQUIRE(didCallbackFire());
   BOOST_CHECK(TestFaceTableFixture::m_faceTable.didRemoveFire());
diff --git a/tests/mgmt/fib-manager.cpp b/tests/mgmt/fib-manager.cpp
index 9905f8a..e6748be 100644
--- a/tests/mgmt/fib-manager.cpp
+++ b/tests/mgmt/fib-manager.cpp
@@ -11,6 +11,7 @@
 #include "mgmt/internal-face.hpp"
 #include "tests/face/dummy-face.hpp"
 
+#include "validation-common.hpp"
 #include "tests/test-common.hpp"
 
 namespace nfd {
@@ -22,10 +23,9 @@
 {
 public:
 
-  FibManagerFixture()
-    : m_callbackFired(false)
+  virtual
+  ~FibManagerFixture()
   {
-
   }
 
   shared_ptr<Face>
@@ -57,10 +57,10 @@
 
     control.wireDecode(controlRaw);
 
-    NFD_LOG_DEBUG("received control response"
-                  << " Name: " << response.getName()
-                  << " code: " << control.getCode()
-                  << " text: " << control.getText());
+    // NFD_LOG_DEBUG("received control response"
+    //               << " Name: " << response.getName()
+    //               << " code: " << control.getCode()
+    //               << " text: " << control.getText());
 
     BOOST_CHECK_EQUAL(response.getName(), expectedName);
     BOOST_CHECK_EQUAL(control.getCode(), expectedCode);
@@ -114,12 +114,70 @@
     m_callbackFired = false;
   }
 
+  shared_ptr<InternalFace>
+  getInternalFace()
+  {
+    return m_face;
+  }
+
+  FibManager&
+  getFibManager()
+  {
+    return m_manager;
+  }
+
+  Fib&
+  getFib()
+  {
+    return m_fib;
+  }
+
+  void
+  addInterestRule(const std::string& regex,
+                  ndn::IdentityCertificate& certificate)
+  {
+    m_manager.addInterestRule(regex, certificate);
+  }
+
+protected:
+    FibManagerFixture()
+    : m_face(make_shared<InternalFace>())
+    , m_nameTree(1024)
+    , m_fib(m_nameTree)
+    , m_manager(boost::ref(m_fib),
+                bind(&FibManagerFixture::getFace, this, _1),
+                m_face)
+    , m_callbackFired(false)
+  {
+  }
+
 private:
+  shared_ptr<InternalFace> m_face;
+  NameTree m_nameTree;
+  Fib m_fib;
+  FibManager m_manager;
+
   std::vector<shared_ptr<Face> > m_faces;
   bool m_callbackFired;
 };
 
-BOOST_FIXTURE_TEST_SUITE(MgmtFibManager, FibManagerFixture)
+template <typename T> class AuthorizedCommandFixture:
+    public CommandFixture<T>
+{
+public:
+  AuthorizedCommandFixture()
+  {
+    const std::string regex = "^<localhost><nfd><fib>";
+    T::addInterestRule(regex, *CommandFixture<T>::m_certificate);
+  }
+
+  virtual
+  ~AuthorizedCommandFixture()
+  {
+  }
+};
+
+BOOST_FIXTURE_TEST_SUITE(MgmtFibManager, AuthorizedCommandFixture<FibManagerFixture>)
 
 bool
 foundNextHop(FaceId id, uint32_t cost, const fib::NextHop& next)
@@ -165,12 +223,7 @@
 
 BOOST_AUTO_TEST_CASE(TestFireInterestFilter)
 {
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-  NameTree nameTree(1024);
-  Fib fib(nameTree);
-  FibManager manager(fib,
-                     bind(&FibManagerFixture::getFace, this, _1),
-                     face);
+  shared_ptr<InternalFace> face = getInternalFace();
 
   Interest command("/localhost/nfd/fib");
 
@@ -185,12 +238,7 @@
 
 BOOST_AUTO_TEST_CASE(MalformedCommmand)
 {
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-  NameTree nameTree(1024);
-  Fib fib(nameTree);
-  FibManager manager(fib,
-                     bind(&FibManagerFixture::getFace, this, _1),
-                          face);
+  shared_ptr<InternalFace> face = getInternalFace();
 
   BOOST_REQUIRE(didCallbackFire() == false);
 
@@ -200,19 +248,14 @@
     bind(&FibManagerFixture::validateControlResponse, this, _1,
          command.getName(), 400, "Malformed command");
 
-  manager.onFibRequest(command);
+  getFibManager().onFibRequest(command);
 
   BOOST_REQUIRE(didCallbackFire());
 }
 
 BOOST_AUTO_TEST_CASE(UnsupportedVerb)
 {
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-  NameTree nameTree(1024);
-  Fib fib(nameTree);
-  FibManager manager(fib,
-                     bind(&FibManagerFixture::getFace, this, _1),
-                          face);
+  shared_ptr<InternalFace> face = getInternalFace();
 
   FibManagementOptions options;
   options.setName("/hello");
@@ -225,12 +268,14 @@
   commandName.append("unsupported");
   commandName.append(encodedOptions);
 
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
+
   face->onReceiveData +=
     bind(&FibManagerFixture::validateControlResponse, this, _1,
-         commandName, 501, "Unsupported command");
+         command->getName(), 501, "Unsupported command");
 
-  Interest command(commandName);
-  manager.onFibRequest(command);
+  getFibManager().onFibRequest(*command);
 
   BOOST_REQUIRE(didCallbackFire());
 }
@@ -239,12 +284,7 @@
 {
   addFace(make_shared<DummyFace>());
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-  NameTree nameTree(1024);
-  Fib fib(nameTree);
-  FibManager manager(fib,
-                     bind(&FibManagerFixture::getFace, this, _1),
-                     face);
+  shared_ptr<InternalFace> face = getInternalFace();
 
   FibManagementOptions options;
   options.setName("/hello");
@@ -257,29 +297,24 @@
   commandName.append("add-nexthop");
   commandName.append(encodedOptions);
 
-  face->onReceiveData +=
-    bind(&FibManagerFixture::validateControlResponse, this, _1,
-         commandName, 404, "Prefix not found");
-  /// \todo enable once sig checking implemented
-    // bind(&FibManagerFixture::validateControlResponse, this, _1, 401, "Signature required");
-
   Interest command(commandName);
-  manager.onFibRequest(command);
+
+  face->onReceiveData +=
+    bind(&FibManagerFixture::validateControlResponse,
+         this, _1, command.getName(), 401, "Signature required");
+
+
+  getFibManager().onFibRequest(command);
 
   BOOST_REQUIRE(didCallbackFire());
-  BOOST_REQUIRE(!addedNextHopWithCost(fib, "/hello", 0, 101));
+  BOOST_REQUIRE(!addedNextHopWithCost(getFib(), "/hello", 0, 101));
 }
 
-BOOST_AUTO_TEST_CASE(UnauthorizedCommand)
+BOOST_FIXTURE_TEST_CASE(UnauthorizedCommand, UnauthorizedCommandFixture<FibManagerFixture>)
 {
   addFace(make_shared<DummyFace>());
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-  NameTree nameTree(1024);
-  Fib fib(nameTree);
-  FibManager manager(fib,
-                     bind(&FibManagerFixture::getFace, this, _1),
-                     face);
+  shared_ptr<InternalFace> face = getInternalFace();
 
   FibManagementOptions options;
   options.setName("/hello");
@@ -292,40 +327,37 @@
   commandName.append("add-nexthop");
   commandName.append(encodedOptions);
 
-  face->onReceiveData +=
-    bind(&FibManagerFixture::validateControlResponse, this, _1,
-         commandName, 404, "Prefix not found");
-  /// \todo enable once sig checking implemented
-    // bind(&FibManagerFixture::validateControlResponse, this, _1, 403, "Unauthorized command");
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
 
-  Interest command(commandName);
-  manager.onFibRequest(command);
+  face->onReceiveData +=
+    bind(&FibManagerFixture::validateControlResponse,
+         this, _1, command->getName(), 403, "Unauthorized command");
+
+  getFibManager().onFibRequest(*command);
 
   BOOST_REQUIRE(didCallbackFire());
-  BOOST_REQUIRE(!addedNextHopWithCost(fib, "/hello", 0, 101));
+  BOOST_REQUIRE(!addedNextHopWithCost(getFib(), "/hello", 0, 101));
 }
 
 BOOST_AUTO_TEST_CASE(BadOptionParse)
 {
   addFace(make_shared<DummyFace>());
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-  NameTree nameTree(1024);
-  Fib fib(nameTree);
-  FibManager manager(fib,
-                     bind(&FibManagerFixture::getFace, this, _1),
-                     face);
+  shared_ptr<InternalFace> face = getInternalFace();
 
   Name commandName("/localhost/nfd/fib");
   commandName.append("add-nexthop");
   commandName.append("NotReallyOptions");
 
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
+
   face->onReceiveData +=
     bind(&FibManagerFixture::validateControlResponse, this, _1,
-         commandName, 400, "Malformed command");
+         command->getName(), 400, "Malformed command");
 
-  Interest command(commandName);
-  manager.onFibRequest(command);
+  getFibManager().onFibRequest(*command);
 
   BOOST_REQUIRE(didCallbackFire());
 }
@@ -334,12 +366,7 @@
 {
   addFace(make_shared<DummyFace>());
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-  NameTree nameTree(1024);
-  Fib fib(nameTree);
-  FibManager manager(fib,
-                     bind(&FibManagerFixture::getFace, this, _1),
-                     face);
+  shared_ptr<InternalFace> face = getInternalFace();
 
   FibManagementOptions options;
   options.setName("/hello");
@@ -352,27 +379,24 @@
   commandName.append("add-nexthop");
   commandName.append(encodedOptions);
 
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
+
   face->onReceiveData +=
     bind(&FibManagerFixture::validateControlResponse, this, _1,
-         commandName, 404, "Face not found");
+         command->getName(), 404, "Face not found");
 
-  Interest command(commandName);
-  manager.onFibRequest(command);
+  getFibManager().onFibRequest(*command);
 
   BOOST_REQUIRE(didCallbackFire());
-  BOOST_REQUIRE(addedNextHopWithCost(fib, "/hello", 0, 101) == false);
+  BOOST_REQUIRE(addedNextHopWithCost(getFib(), "/hello", 0, 101) == false);
 }
 
 BOOST_AUTO_TEST_CASE(TestImplicitFaceId)
 {
   addFace(make_shared<DummyFace>());
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-  NameTree nameTree(1024);
-  Fib fib(nameTree);
-  FibManager manager(fib,
-                     bind(&FibManagerFixture::getFace, this, _1),
-                          face);
+  shared_ptr<InternalFace> face = getInternalFace();
 
   FibManagementOptions options;
   options.setName("/hello");
@@ -392,30 +416,27 @@
 
   Block encodedExpectedOptions(expectedOptions.wireEncode());
 
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  command->setIncomingFaceId(1);
+  generateCommand(*command);
+
   face->onReceiveData +=
     bind(&FibManagerFixture::validateControlResponse, this, _1,
-         commandName, 200, "Success", encodedExpectedOptions);
+         command->getName(), 200, "Success", encodedExpectedOptions);
 
-  fib.insert("/hello");
+  getFib().insert("/hello");
 
-  Interest command(commandName);
-  command.setIncomingFaceId(1);
-  manager.onFibRequest(command);
+  getFibManager().onFibRequest(*command);
 
   BOOST_REQUIRE(didCallbackFire());
-  BOOST_REQUIRE(addedNextHopWithFace(fib, "/hello", 0, 101, getFace(1)));
+  BOOST_REQUIRE(addedNextHopWithFace(getFib(), "/hello", 0, 101, getFace(1)));
 }
 
 BOOST_AUTO_TEST_CASE(AddNextHopVerbInitialAdd)
 {
   addFace(make_shared<DummyFace>());
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-  NameTree nameTree(1024);
-  Fib fib(nameTree);
-  FibManager manager(fib,
-                     bind(&FibManagerFixture::getFace, this, _1),
-                          face);
+  shared_ptr<InternalFace> face = getInternalFace();
 
   FibManagementOptions options;
   options.setName("/hello");
@@ -428,31 +449,27 @@
   commandName.append("add-nexthop");
   commandName.append(encodedOptions);
 
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
+
   face->onReceiveData +=
     bind(&FibManagerFixture::validateControlResponse, this, _1,
-         commandName, 200, "Success", encodedOptions);
+         command->getName(), 200, "Success", encodedOptions);
 
-  fib.insert("/hello");
+  getFib().insert("/hello");
 
-  Interest command(commandName);
-  manager.onFibRequest(command);
+  getFibManager().onFibRequest(*command);
 
   BOOST_REQUIRE(didCallbackFire());
-  BOOST_REQUIRE(addedNextHopWithCost(fib, "/hello", 0, 101));
+  BOOST_REQUIRE(addedNextHopWithCost(getFib(), "/hello", 0, 101));
 }
 
 BOOST_AUTO_TEST_CASE(AddNextHopVerbAddToExisting)
 {
   addFace(make_shared<DummyFace>());
+  shared_ptr<InternalFace> face = getInternalFace();
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-  NameTree nameTree(1024);
-  Fib fib(nameTree);
-  FibManager manager(fib,
-                     bind(&FibManagerFixture::getFace, this, _1),
-                          face);
-
-  fib.insert("/hello");
+  getFib().insert("/hello");
 
   for (int i = 1; i <= 2; i++)
     {
@@ -468,16 +485,18 @@
       commandName.append("add-nexthop");
       commandName.append(encodedOptions);
 
+      shared_ptr<Interest> command(make_shared<Interest>(commandName));
+      generateCommand(*command);
+
       face->onReceiveData +=
         bind(&FibManagerFixture::validateControlResponse, this, _1,
-             commandName, 200, "Success", encodedOptions);
+             command->getName(), 200, "Success", encodedOptions);
 
-      Interest command(commandName);
-      manager.onFibRequest(command);
+      getFibManager().onFibRequest(*command);
       BOOST_REQUIRE(didCallbackFire());
       resetCallbackFired();
 
-      shared_ptr<fib::Entry> entry = fib.findExactMatch("/hello");
+      shared_ptr<fib::Entry> entry = getFib().findExactMatch("/hello");
 
       if (static_cast<bool>(entry))
         {
@@ -499,16 +518,9 @@
 BOOST_AUTO_TEST_CASE(AddNextHopVerbUpdateFaceCost)
 {
   addFace(make_shared<DummyFace>());
+  shared_ptr<InternalFace> face = getInternalFace();
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-  NameTree nameTree(1024);
-  Fib fib(nameTree);
-  FibManager manager(fib,
-                     bind(&FibManagerFixture::getFace,
-                          this, _1),
-                          face);
-
-  fib.insert("/hello");
+  getFib().insert("/hello");
 
   FibManagementOptions options;
   options.setName("/hello");
@@ -523,12 +535,14 @@
     commandName.append("add-nexthop");
     commandName.append(encodedOptions);
 
+    shared_ptr<Interest> command(make_shared<Interest>(commandName));
+    generateCommand(*command);
+
     face->onReceiveData +=
       bind(&FibManagerFixture::validateControlResponse, this, _1,
-           commandName, 200, "Success", encodedOptions);
+           command->getName(), 200, "Success", encodedOptions);
 
-    Interest command(commandName);
-    manager.onFibRequest(command);
+    getFibManager().onFibRequest(*command);
 
     BOOST_REQUIRE(didCallbackFire());
   }
@@ -545,17 +559,19 @@
     commandName.append("add-nexthop");
     commandName.append(encodedOptions);
 
+    shared_ptr<Interest> command(make_shared<Interest>(commandName));
+    generateCommand(*command);
+
     face->onReceiveData +=
       bind(&FibManagerFixture::validateControlResponse, this, _1,
-           commandName, 200, "Success", encodedOptions);
+           command->getName(), 200, "Success", encodedOptions);
 
-    Interest command(commandName);
-    manager.onFibRequest(command);
+    getFibManager().onFibRequest(*command);
 
     BOOST_REQUIRE(didCallbackFire());
   }
 
-  shared_ptr<fib::Entry> entry = fib.findExactMatch("/hello");
+  shared_ptr<fib::Entry> entry = getFib().findExactMatch("/hello");
 
   // Add faces with cost == FaceID for the name /hello
   // This test assumes:
@@ -576,12 +592,7 @@
 
 BOOST_AUTO_TEST_CASE(Insert)
 {
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-  NameTree nameTree(1024);
-  Fib fib(nameTree);
-  FibManager manager(fib,
-                     bind(&FibManagerFixture::getFace, this, _1),
-                     face);
+  shared_ptr<InternalFace> face = getInternalFace();
 
   {
     FibManagementOptions options;
@@ -593,17 +604,19 @@
     commandName.append("insert");
     commandName.append(encodedOptions);
 
+    shared_ptr<Interest> command(make_shared<Interest>(commandName));
+    generateCommand(*command);
+
     face->onReceiveData +=
       bind(&FibManagerFixture::validateControlResponse, this, _1,
-           commandName, 200, "Success", encodedOptions);
+           command->getName(), 200, "Success", encodedOptions);
 
-    Interest command(commandName);
-    manager.onFibRequest(command);
+    getFibManager().onFibRequest(*command);
   }
 
   BOOST_REQUIRE(didCallbackFire());
 
-  shared_ptr<fib::Entry> entry = fib.findExactMatch("/hello");
+  shared_ptr<fib::Entry> entry = getFib().findExactMatch("/hello");
   if (static_cast<bool>(entry))
     {
       const fib::NextHopList& hops = entry->getNextHops();
@@ -611,6 +624,7 @@
     }
 
   resetCallbackFired();
+  face->onReceiveData.clear();
 
   {
     FibManagementOptions options;
@@ -622,17 +636,19 @@
     commandName.append("insert");
     commandName.append(encodedOptions);
 
+    shared_ptr<Interest> command(make_shared<Interest>(commandName));
+    generateCommand(*command);
+
     face->onReceiveData +=
       bind(&FibManagerFixture::validateControlResponse, this, _1,
-           commandName, 200, "Success", encodedOptions);
+           command->getName(), 200, "Success", encodedOptions);
 
-    Interest command(commandName);
-    manager.onFibRequest(command);
+    getFibManager().onFibRequest(*command);
   }
 
   BOOST_REQUIRE(didCallbackFire());
 
-  entry = fib.findExactMatch("/hello");
+  entry = getFib().findExactMatch("/hello");
   if (static_cast<bool>(entry))
     {
       const fib::NextHopList& hops = entry->getNextHops();
@@ -642,7 +658,7 @@
 }
 
 void
-testRemove(FibManagerFixture* fixture,
+testRemove(CommandFixture<FibManagerFixture>* fixture,
            FibManager& manager,
            Fib& fib,
            shared_ptr<Face> face,
@@ -657,12 +673,14 @@
   commandName.append("delete");
   commandName.append(encodedOptions);
 
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  fixture->generateCommand(*command);
+
   face->onReceiveData +=
     bind(&FibManagerFixture::validateControlResponse, fixture, _1,
-         commandName, 200, "Success", encodedOptions);
+         command->getName(), 200, "Success", encodedOptions);
 
-  Interest command(commandName);
-  manager.onFibRequest(command);
+  manager.onFibRequest(*command);
 
   BOOST_REQUIRE(fixture->didCallbackFire());
 
@@ -675,12 +693,9 @@
 
 BOOST_AUTO_TEST_CASE(Delete)
 {
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-  NameTree nameTree(1024);
-  Fib fib(nameTree);
-  FibManager manager(fib,
-                     bind(&FibManagerFixture::getFace, this, _1),
-                     face);
+  shared_ptr<InternalFace> face = getInternalFace();
+  FibManager& manager = getFibManager();
+  Fib& fib = getFib();
 
   fib.insert("/a");
   fib.insert("/a/b");
@@ -730,7 +745,7 @@
 }
 
 void
-testRemoveNextHop(FibManagerFixture* fixture,
+testRemoveNextHop(CommandFixture<FibManagerFixture>* fixture,
                   FibManager& manager,
                   Fib& fib,
                   shared_ptr<Face> face,
@@ -747,12 +762,14 @@
   commandName.append("remove-nexthop");
   commandName.append(encodedOptions);
 
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  fixture->generateCommand(*command);
+
   face->onReceiveData +=
     bind(&FibManagerFixture::validateControlResponse, fixture, _1,
-         commandName, 200, "Success", encodedOptions);
+         command->getName(), 200, "Success", encodedOptions);
 
-  Interest command(commandName);
-  manager.onFibRequest(command);
+  manager.onFibRequest(*command);
 
   BOOST_REQUIRE(fixture->didCallbackFire());
 
@@ -770,12 +787,9 @@
   addFace(face2);
   addFace(face3);
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-  NameTree nameTree(1024);
-  Fib fib(nameTree);
-  FibManager manager(fib,
-                     bind(&FibManagerFixture::getFace, this, _1),
-                          face);
+  shared_ptr<InternalFace> face = getInternalFace();
+  FibManager& manager = getFibManager();
+  Fib& fib = getFib();
 
   shared_ptr<fib::Entry> entry = fib.insert("/hello").first;
 
@@ -792,7 +806,7 @@
   testRemoveNextHop(this, manager, fib, face, "/hello", 1);
   BOOST_REQUIRE(removedNextHopWithCost(fib, "/hello", 1, 101));
 
-  if (!static_cast<bool>(fib.findExactMatch("/hello")))
+  if (!static_cast<bool>(getFib().findExactMatch("/hello")))
     {
       BOOST_FAIL("removed entry after removing all next hops");
     }
@@ -801,12 +815,7 @@
 
 BOOST_AUTO_TEST_CASE(RemoveNoFace)
 {
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-  NameTree nameTree(1024);
-  Fib fib(nameTree);
-  FibManager manager(fib,
-                     bind(&FibManagerFixture::getFace, this, _1),
-                          face);
+  shared_ptr<InternalFace> face = getInternalFace();
 
   FibManagementOptions options;
   options.setName("/hello");
@@ -818,12 +827,14 @@
   commandName.append("remove-nexthop");
   commandName.append(encodedOptions);
 
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
+
   face->onReceiveData +=
     bind(&FibManagerFixture::validateControlResponse, this, _1,
-         commandName, 404, "Face not found");
+         command->getName(), 404, "Face not found");
 
-  Interest command(commandName);
-  manager.onFibRequest(command);
+  getFibManager().onFibRequest(*command);
 
   BOOST_REQUIRE(didCallbackFire());
 }
@@ -832,12 +843,7 @@
 {
   addFace(make_shared<DummyFace>());
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-  NameTree nameTree(1024);
-  Fib fib(nameTree);
-  FibManager manager(fib,
-                     bind(&FibManagerFixture::getFace, this, _1),
-                     face);
+  shared_ptr<InternalFace> face = getInternalFace();
 
   FibManagementOptions options;
   options.setName("/hello");
@@ -849,12 +855,14 @@
   commandName.append("remove-nexthop");
   commandName.append(encodedOptions);
 
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
+
   face->onReceiveData +=
     bind(&FibManagerFixture::validateControlResponse, this, _1,
-         commandName, 404, "Prefix not found");
+         command->getName(), 404, "Prefix not found");
 
-  Interest command(commandName);
-  manager.onFibRequest(command);
+  getFibManager().onFibRequest(*command);
 
   BOOST_REQUIRE(didCallbackFire());
 }
diff --git a/tests/mgmt/local-control-header-manager.cpp b/tests/mgmt/local-control-header-manager.cpp
index 43a649d..168f43f 100644
--- a/tests/mgmt/local-control-header-manager.cpp
+++ b/tests/mgmt/local-control-header-manager.cpp
@@ -9,6 +9,7 @@
 #include "tests/face/dummy-face.hpp"
 
 #include "tests/test-common.hpp"
+#include "validation-common.hpp"
 
 namespace nfd {
 namespace tests {
@@ -19,12 +20,6 @@
 {
 public:
 
-  LocalControlHeaderManagerFixture()
-    : m_callbackFired(false)
-  {
-
-  }
-
   shared_ptr<Face>
   getFace(FaceId id)
   {
@@ -42,6 +37,25 @@
     m_faces.push_back(face);
   }
 
+  shared_ptr<InternalFace>
+  getInternalFace()
+  {
+    return m_face;
+  }
+
+  LocalControlHeaderManager&
+  getManager()
+  {
+    return m_manager;
+  }
+
+  void
+  addInterestRule(const std::string& regex,
+                  ndn::IdentityCertificate& certificate)
+  {
+    m_manager.addInterestRule(regex, certificate);
+  }
+
   void
   validateControlResponse(const Data& response,
                           const Name& expectedName,
@@ -82,49 +96,76 @@
     m_callbackFired = false;
   }
 
+protected:
+  LocalControlHeaderManagerFixture()
+    : m_face(make_shared<InternalFace>()),
+      m_manager(bind(&LocalControlHeaderManagerFixture::getFace, this, _1),
+                m_face),
+      m_callbackFired(false)
+  {
+  }
+
 private:
+  shared_ptr<InternalFace> m_face;
+  LocalControlHeaderManager m_manager;
   std::vector<shared_ptr<Face> > m_faces;
   bool m_callbackFired;
 };
 
-BOOST_FIXTURE_TEST_SUITE(MgmtLocalControlHeaderManager, LocalControlHeaderManagerFixture)
+template <typename T> class AuthorizedCommandFixture:
+    public CommandFixture<T>
+{
+public:
+  AuthorizedCommandFixture()
+  {
+    const std::string regex = "^<localhost><nfd><control-header>";
+    T::addInterestRule(regex, *CommandFixture<T>::m_certificate);
+  }
+
+  virtual
+  ~AuthorizedCommandFixture()
+  {
+  }
+};
+
+BOOST_FIXTURE_TEST_SUITE(MgmtLocalControlHeaderManager,
+                         AuthorizedCommandFixture<LocalControlHeaderManagerFixture>)
 
 BOOST_AUTO_TEST_CASE(InFaceId)
 {
   shared_ptr<LocalFace> dummy = make_shared<DummyLocalFace>();
   addFace(dummy);
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-
-  LocalControlHeaderManager manager(bind(&LocalControlHeaderManagerFixture::getFace, this, _1),
-                                        face);
-
   Name enable("/localhost/nfd/control-header/in-faceid/enable");
+  shared_ptr<Interest> enableCommand(make_shared<Interest>(enable));
+  enableCommand->setIncomingFaceId(1);
 
-  face->onReceiveData +=
+  generateCommand(*enableCommand);
+
+  getInternalFace()->onReceiveData +=
     bind(&LocalControlHeaderManagerFixture::validateControlResponse, this, _1,
-         enable, 200, "Success");
+         enableCommand->getName(), 200, "Success");
 
-  Interest enableCommand(enable);
-  enableCommand.setIncomingFaceId(1);
-  manager.onLocalControlHeaderRequest(enableCommand);
+  getManager().onLocalControlHeaderRequest(*enableCommand);
 
   BOOST_REQUIRE(didCallbackFire());
   BOOST_REQUIRE(dummy->isLocalControlHeaderEnabled(LOCAL_CONTROL_HEADER_FEATURE_IN_FACEID));
   BOOST_CHECK(!dummy->isLocalControlHeaderEnabled(LOCAL_CONTROL_HEADER_FEATURE_NEXTHOP_FACEID));
 
-  face->onReceiveData.clear();
+  getInternalFace()->onReceiveData.clear();
   resetCallbackFired();
 
   Name disable("/localhost/nfd/control-header/in-faceid/disable");
+  shared_ptr<Interest> disableCommand(make_shared<Interest>(disable));
+  disableCommand->setIncomingFaceId(1);
 
-  face->onReceiveData +=
+  generateCommand(*disableCommand);
+
+  getInternalFace()->onReceiveData +=
     bind(&LocalControlHeaderManagerFixture::validateControlResponse, this, _1,
-         disable, 200, "Success");
+         disableCommand->getName(), 200, "Success");
 
-  Interest disableCommand(disable);
-  disableCommand.setIncomingFaceId(1);
-  manager.onLocalControlHeaderRequest(disableCommand);
+  getManager().onLocalControlHeaderRequest(*disableCommand);
 
   BOOST_REQUIRE(didCallbackFire());
   BOOST_REQUIRE(!dummy->isLocalControlHeaderEnabled(LOCAL_CONTROL_HEADER_FEATURE_IN_FACEID));
@@ -136,38 +177,36 @@
   shared_ptr<LocalFace> dummy = make_shared<DummyLocalFace>();
   addFace(dummy);
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-
-  LocalControlHeaderManager manager(bind(&LocalControlHeaderManagerFixture::getFace, this, _1),
-                                        face);
-
   Name enable("/localhost/nfd/control-header/nexthop-faceid/enable");
 
-  face->onReceiveData +=
-    bind(&LocalControlHeaderManagerFixture::validateControlResponse, this, _1,
-         enable, 200, "Success");
+  shared_ptr<Interest> enableCommand(make_shared<Interest>(enable));
+  enableCommand->setIncomingFaceId(1);
+  generateCommand(*enableCommand);
 
-  Interest enableCommand(enable);
-  enableCommand.setIncomingFaceId(1);
-  manager.onLocalControlHeaderRequest(enableCommand);
+  getInternalFace()->onReceiveData +=
+    bind(&LocalControlHeaderManagerFixture::validateControlResponse, this, _1,
+         enableCommand->getName(), 200, "Success");
+
+  getManager().onLocalControlHeaderRequest(*enableCommand);
 
   BOOST_REQUIRE(didCallbackFire());
   BOOST_REQUIRE(dummy->isLocalControlHeaderEnabled(LOCAL_CONTROL_HEADER_FEATURE_NEXTHOP_FACEID));
   BOOST_CHECK(!dummy->isLocalControlHeaderEnabled(LOCAL_CONTROL_HEADER_FEATURE_IN_FACEID));
 
-
-  face->onReceiveData.clear();
+  getInternalFace()->onReceiveData.clear();
   resetCallbackFired();
 
   Name disable("/localhost/nfd/control-header/nexthop-faceid/disable");
+  shared_ptr<Interest> disableCommand(make_shared<Interest>(disable));
+  disableCommand->setIncomingFaceId(1);
 
-  face->onReceiveData +=
+  generateCommand(*disableCommand);
+
+  getInternalFace()->onReceiveData +=
     bind(&LocalControlHeaderManagerFixture::validateControlResponse, this, _1,
-         disable, 200, "Success");
+         disableCommand->getName(), 200, "Success");
 
-  Interest disableCommand(disable);
-  disableCommand.setIncomingFaceId(1);
-  manager.onLocalControlHeaderRequest(disableCommand);
+  getManager().onLocalControlHeaderRequest(*disableCommand);
 
   BOOST_REQUIRE(didCallbackFire());
   BOOST_REQUIRE(!dummy->isLocalControlHeaderEnabled(LOCAL_CONTROL_HEADER_FEATURE_NEXTHOP_FACEID));
@@ -179,20 +218,15 @@
   shared_ptr<LocalFace> dummy = make_shared<DummyLocalFace>();
   addFace(dummy);
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-
-  LocalControlHeaderManager manager(bind(&LocalControlHeaderManagerFixture::getFace, this, _1),
-                                        face);
-
   Name commandName("/localhost/nfd/control-header");
+  Interest command(commandName);
+  command.setIncomingFaceId(1);
 
-  face->onReceiveData +=
+  getInternalFace()->onReceiveData +=
     bind(&LocalControlHeaderManagerFixture::validateControlResponse, this, _1,
          commandName, 400, "Malformed command");
 
-  Interest command(commandName);
-  command.setIncomingFaceId(1);
-  manager.onLocalControlHeaderRequest(command);
+  getManager().onLocalControlHeaderRequest(command);
 
   BOOST_REQUIRE(didCallbackFire());
   BOOST_CHECK(!dummy->isLocalControlHeaderEnabled(LOCAL_CONTROL_HEADER_FEATURE_IN_FACEID));
@@ -204,20 +238,15 @@
   shared_ptr<LocalFace> dummy = make_shared<DummyLocalFace>();
   addFace(dummy);
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-
-  LocalControlHeaderManager manager(bind(&LocalControlHeaderManagerFixture::getFace, this, _1),
-                                        face);
-
   Name commandName("/localhost/nfd/control-header/in-faceid");
 
-  face->onReceiveData +=
+  getInternalFace()->onReceiveData +=
     bind(&LocalControlHeaderManagerFixture::validateControlResponse, this, _1,
          commandName, 400, "Malformed command");
 
   Interest command(commandName);
   command.setIncomingFaceId(1);
-  manager.onLocalControlHeaderRequest(command);
+  getManager().onLocalControlHeaderRequest(command);
 
   BOOST_REQUIRE(didCallbackFire());
   BOOST_CHECK(!dummy->isLocalControlHeaderEnabled(LOCAL_CONTROL_HEADER_FEATURE_IN_FACEID));
@@ -229,20 +258,17 @@
   shared_ptr<LocalFace> dummy = make_shared<DummyLocalFace>();
   addFace(dummy);
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-
-  LocalControlHeaderManager manager(bind(&LocalControlHeaderManagerFixture::getFace, this, _1),
-                                        face);
-
   Name commandName("/localhost/nfd/control-header/madeup/moremadeup");
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  command->setIncomingFaceId(1);
 
-  face->onReceiveData +=
+  generateCommand(*command);
+
+  getInternalFace()->onReceiveData +=
     bind(&LocalControlHeaderManagerFixture::validateControlResponse, this, _1,
-         commandName, 501, "Unsupported");
+         command->getName(), 501, "Unsupported");
 
-  Interest command(commandName);
-  command.setIncomingFaceId(1);
-  manager.onLocalControlHeaderRequest(command);
+  getManager().onLocalControlHeaderRequest(*command);
 
   BOOST_REQUIRE(didCallbackFire());
   BOOST_CHECK(!dummy->isLocalControlHeaderEnabled(LOCAL_CONTROL_HEADER_FEATURE_IN_FACEID));
@@ -254,20 +280,18 @@
   shared_ptr<LocalFace> dummy = make_shared<DummyLocalFace>();
   addFace(dummy);
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-
-  LocalControlHeaderManager manager(bind(&LocalControlHeaderManagerFixture::getFace, this, _1),
-                                        face);
-
   Name commandName("/localhost/nfd/control-header/in-faceid/madeup");
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  command->setIncomingFaceId(1);
 
-  face->onReceiveData +=
+
+  generateCommand(*command);
+
+  getInternalFace()->onReceiveData +=
     bind(&LocalControlHeaderManagerFixture::validateControlResponse, this, _1,
-         commandName, 501, "Unsupported");
+         command->getName(), 501, "Unsupported");
 
-  Interest command(commandName);
-  command.setIncomingFaceId(1);
-  manager.onLocalControlHeaderRequest(command);
+  getManager().onLocalControlHeaderRequest(*command);
 
   BOOST_REQUIRE(didCallbackFire());
   BOOST_CHECK(!dummy->isLocalControlHeaderEnabled(LOCAL_CONTROL_HEADER_FEATURE_IN_FACEID));
@@ -279,26 +303,45 @@
   shared_ptr<LocalFace> dummy = make_shared<DummyLocalFace>();
   addFace(dummy);
 
-  shared_ptr<InternalFace> face(make_shared<InternalFace>());
-
-  LocalControlHeaderManager manager(bind(&LocalControlHeaderManagerFixture::getFace, this, _1),
-                                        face);
-
   Name commandName("/localhost/nfd/control-header/nexthop-faceid/madeup");
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  command->setIncomingFaceId(1);
 
-  face->onReceiveData +=
+  generateCommand(*command);
+
+  getInternalFace()->onReceiveData +=
     bind(&LocalControlHeaderManagerFixture::validateControlResponse, this, _1,
-         commandName, 501, "Unsupported");
+         command->getName(), 501, "Unsupported");
 
-  Interest command(commandName);
-  command.setIncomingFaceId(1);
-  manager.onLocalControlHeaderRequest(command);
+  getManager().onLocalControlHeaderRequest(*command);
 
   BOOST_REQUIRE(didCallbackFire());
   BOOST_CHECK(!dummy->isLocalControlHeaderEnabled(LOCAL_CONTROL_HEADER_FEATURE_IN_FACEID));
   BOOST_CHECK(!dummy->isLocalControlHeaderEnabled(LOCAL_CONTROL_HEADER_FEATURE_NEXTHOP_FACEID));
 }
 
+BOOST_FIXTURE_TEST_CASE(UnauthorizedCommand,
+                        UnauthorizedCommandFixture<LocalControlHeaderManagerFixture>)
+{
+  shared_ptr<LocalFace> dummy = make_shared<DummyLocalFace>();
+  addFace(dummy);
+
+  Name enable("/localhost/nfd/control-header/in-faceid/enable");
+  shared_ptr<Interest> enableCommand(make_shared<Interest>(enable));
+  enableCommand->setIncomingFaceId(1);
+
+  generateCommand(*enableCommand);
+
+  getInternalFace()->onReceiveData +=
+    bind(&LocalControlHeaderManagerFixture::validateControlResponse, this, _1,
+         enableCommand->getName(), 403, "Unauthorized command");
+
+  getManager().onLocalControlHeaderRequest(*enableCommand);
+
+  BOOST_REQUIRE(didCallbackFire());
+  BOOST_REQUIRE(!dummy->isLocalControlHeaderEnabled(LOCAL_CONTROL_HEADER_FEATURE_IN_FACEID));
+}
+
 BOOST_AUTO_TEST_SUITE_END()
 
 } // namespace tests
diff --git a/tests/mgmt/malformedkey.pub b/tests/mgmt/malformedkey.pub
new file mode 100644
index 0000000..38b2fbb
--- /dev/null
+++ b/tests/mgmt/malformedkey.pub
@@ -0,0 +1 @@
+definitely not a key
\ No newline at end of file
diff --git a/tests/mgmt/manager-base.cpp b/tests/mgmt/manager-base.cpp
index f6ddcb7..fb10973 100644
--- a/tests/mgmt/manager-base.cpp
+++ b/tests/mgmt/manager-base.cpp
@@ -20,7 +20,7 @@
 public:
 
   ManagerBaseTest()
-    : ManagerBase(make_shared<InternalFace>()),
+    : ManagerBase(make_shared<InternalFace>(), "TEST-PRIVILEGE"),
       m_callbackFired(false)
   {
 
diff --git a/tests/mgmt/strategy-choice-manager.cpp b/tests/mgmt/strategy-choice-manager.cpp
index e2285c2..dd3291b 100644
--- a/tests/mgmt/strategy-choice-manager.cpp
+++ b/tests/mgmt/strategy-choice-manager.cpp
@@ -15,6 +15,7 @@
 
 
 #include "tests/test-common.hpp"
+#include "validation-common.hpp"
 
 namespace nfd {
 namespace tests {
@@ -90,6 +91,12 @@
 
   }
 
+  virtual
+  ~StrategyChoiceManagerFixture()
+  {
+
+  }
+
   void
   validateControlResponseCommon(const Data& response,
                                 const Name& expectedName,
@@ -177,6 +184,13 @@
     return m_strategyChoice;
   }
 
+  void
+  addInterestRule(const std::string& regex,
+                  ndn::IdentityCertificate& certificate)
+  {
+    m_manager.addInterestRule(regex, certificate);
+  }
+
 protected:
   Forwarder m_forwarder;
   NameTree m_nameTree;
@@ -203,9 +217,26 @@
   }
 };
 
-BOOST_FIXTURE_TEST_SUITE(MgmtStrategyChoiceManager, AllStrategiesFixture)
+template <typename T> class AuthorizedCommandFixture : public CommandFixture<T>
+{
+public:
+  AuthorizedCommandFixture()
+  {
+    const std::string regex = "^<localhost><nfd><strategy-choice>";
+    T::addInterestRule(regex, *CommandFixture<T>::m_certificate);
+  }
 
-BOOST_AUTO_TEST_CASE(TestFireInterestFilter)
+  virtual
+  ~AuthorizedCommandFixture()
+  {
+
+  }
+};
+
+BOOST_FIXTURE_TEST_SUITE(MgmtStrategyChoiceManager,
+                         AuthorizedCommandFixture<AllStrategiesFixture>)
+
+BOOST_FIXTURE_TEST_CASE(TestFireInterestFilter, AllStrategiesFixture)
 {
   shared_ptr<Interest> command(make_shared<Interest>("/localhost/nfd/strategy-choice"));
 
@@ -218,7 +249,7 @@
   BOOST_REQUIRE(didCallbackFire());
 }
 
-BOOST_AUTO_TEST_CASE(MalformedCommmand)
+BOOST_FIXTURE_TEST_CASE(MalformedCommmand, AllStrategiesFixture)
 {
   shared_ptr<Interest> command(make_shared<Interest>("/localhost/nfd/strategy-choice"));
 
@@ -231,6 +262,54 @@
   BOOST_REQUIRE(didCallbackFire());
 }
 
+BOOST_FIXTURE_TEST_CASE(UnsignedCommand, AllStrategiesFixture)
+{
+  ndn::nfd::FibManagementOptions options;
+  options.setName("/test");
+  options.setStrategy("/localhost/nfd/strategy/best-route");
+
+  Block encodedOptions(options.wireEncode());
+
+  Name commandName("/localhost/nfd/strategy-choice");
+  commandName.append("set");
+  commandName.append(encodedOptions);
+
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+
+  getFace()->onReceiveData +=
+    bind(&StrategyChoiceManagerFixture::validateControlResponse, this, _1,
+         command->getName(), 401, "Signature required");
+
+  getManager().onStrategyChoiceRequest(*command);
+
+  BOOST_REQUIRE(didCallbackFire());
+}
+
+BOOST_FIXTURE_TEST_CASE(UnauthorizedCommand,
+                        UnauthorizedCommandFixture<StrategyChoiceManagerFixture>)
+{
+  ndn::nfd::FibManagementOptions options;
+  options.setName("/test");
+  options.setStrategy("/localhost/nfd/strategy/best-route");
+
+  Block encodedOptions(options.wireEncode());
+
+  Name commandName("/localhost/nfd/strategy-choice");
+  commandName.append("set");
+  commandName.append(encodedOptions);
+
+  shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
+
+  getFace()->onReceiveData +=
+    bind(&StrategyChoiceManagerFixture::validateControlResponse, this, _1,
+         command->getName(), 403, "Unauthorized command");
+
+  getManager().onStrategyChoiceRequest(*command);
+
+  BOOST_REQUIRE(didCallbackFire());
+}
+
 BOOST_AUTO_TEST_CASE(UnsupportedVerb)
 {
   ndn::nfd::FibManagementOptions options;
@@ -243,6 +322,7 @@
   commandName.append(encodedOptions);
 
   shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
 
   getFace()->onReceiveData +=
     bind(&StrategyChoiceManagerFixture::validateControlResponse, this, _1,
@@ -260,6 +340,7 @@
   commandName.append("NotReallyOptions");
 
   shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
 
   getFace()->onReceiveData +=
     bind(&StrategyChoiceManagerFixture::validateControlResponse, this, _1,
@@ -311,6 +392,7 @@
   commandName.append(encodedOptions);
 
   shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
 
   getFace()->onReceiveData +=
     bind(&StrategyChoiceManagerFixture::validateControlResponse, this, _1,
@@ -355,6 +437,7 @@
 //   commandName.append(encodedOptions);
 
 //   shared_ptr<Interest> command(make_shared<Interest>(commandName));
+//   generateCommand(*command);
 
 //   getFace()->onReceiveData +=
 //     bind(&StrategyChoiceManagerFixture::validateControlResponse, this, _1,
@@ -383,6 +466,7 @@
   commandName.append(encodedOptions);
 
   shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
 
   getFace()->onReceiveData +=
     bind(&StrategyChoiceManagerFixture::validateControlResponse, this, _1,
@@ -408,6 +492,7 @@
   commandName.append(encodedOptions);
 
   shared_ptr<Interest> command(make_shared<Interest>(commandName));
+  generateCommand(*command);
 
   getFace()->onReceiveData +=
     bind(&StrategyChoiceManagerFixture::validateControlResponse, this, _1,
diff --git a/tests/mgmt/validation-common.hpp b/tests/mgmt/validation-common.hpp
new file mode 100644
index 0000000..8e16103
--- /dev/null
+++ b/tests/mgmt/validation-common.hpp
@@ -0,0 +1,88 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (C) 2014 Named Data Networking Project
+ * See COPYING for copyright and distribution information.
+ */
+
+#ifndef VALIDATION_COMMON_HPP
+#define VALIDATION_COMMON_HPP
+
+#include <ndn-cpp-dev/util/command-interest-generator.hpp>
+
+namespace nfd {
+namespace tests {
+
+// class ValidatedManagementFixture
+// {
+// public:
+//   ValidatedManagementFixture()
+//     : m_validator(make_shared<ndn::CommandInterestValidator>())
+//   {
+//   }
+
+//   virtual
+//   ~ValidatedManagementFixture()
+//   {
+//   }
+
+// protected:
+//   shared_ptr<ndn::CommandInterestValidator> m_validator;
+// };
+
+
+template<typename T>
+class CommandFixture : public T
+{
+public:
+  virtual
+  ~CommandFixture()
+  {
+    m_keys.deleteIdentity(m_identityName);
+
+  }
+
+  void
+  generateCommand(Interest& interest)
+  {
+    m_generator.generateWithIdentity(interest, m_identityName);
+  }
+
+  const Name&
+  getIdentityName() const
+  {
+    return m_identityName;
+  }
+
+protected:
+  CommandFixture()
+    : m_identityName("/unit-test/CommandFixture/id"),
+      m_certificate(m_keys.getCertificate(m_keys.createIdentity(m_identityName)))
+  {
+
+  }
+
+protected:
+  ndn::KeyChain m_keys;
+  const Name m_identityName;
+  shared_ptr<ndn::IdentityCertificate> m_certificate;
+  ndn::CommandInterestGenerator m_generator;
+};
+
+template <typename T>
+class UnauthorizedCommandFixture : public CommandFixture<T>
+{
+public:
+  UnauthorizedCommandFixture()
+  {
+  }
+
+  virtual
+  ~UnauthorizedCommandFixture()
+  {
+  }
+};
+
+} //namespace tests
+} // namespace nfd
+
+#endif // VALIDATION_COMMON_HPP