class ZTSImpl implements KeyStore, ZTSHandler {

    void checkRoleTokenAuthorizedServiceRequest(final Principal principal,
            final String domainName, final String caller) {
        
        final String authorizedService = principal.getAuthorizedService();
        
        // if principal is not an authorized service token then
        // we have nothing to check for
        
        if (authorizedService == null || authorizedService.isEmpty()) {
            return;
        }
        
        // extract the domain from the authorized service and make
        // sure it matches to the requested domain value
        
        int idx = authorizedService.lastIndexOf('.');
        final String checkDomain = authorizedService.substring(0, idx);
        
        if (!domainName.equals(checkDomain)) {
            throw forbiddenError("Authorized service domain " + checkDomain +
                    " does not match request domain " + domainName, caller,
                    domainName, principal.getDomain());
        }
    }

    public  ZTSImpl();
    public  ZTSImpl(CloudStore implCloudStore, DataStore implDataStore);

}