@Test
public void shouldFailIfNoPermissionGettingProject() throws IOException {

  doThrow(PERMISSION_DENIED).when(projectsGetAncestry).execute();
  idTokenPayload.setEmail("foo@barfoo.iam.gserviceaccount.com");
  assertThat(validator.authenticate("token"), is(nullValue()));
  verifyZeroInteractions(iam);
  verify(projectsGetAncestry).execute();
}