@Test
public void testValidateGroupMemberPrincipals() {

    // invalid users are always rejected
    List<GroupMember> groupMembers = new ArrayList<>();
    groupMembers.add(new GroupMember().setMemberName("user").setPrincipalType(Principal.Type.SERVICE.getValue()));
    groupMembers.add(new GroupMember().setMemberName("user.john").setPrincipalType(Principal.Type.USER.getValue()));
    groupMembers.add(new GroupMember().setMemberName("user.jane").setPrincipalType(Principal.Type.USER.getValue()));
    groupMembers.add(new GroupMember().setMemberName("coretech.api").setPrincipalType(Principal.Type.SERVICE.getValue()));
    groupMembers.add(new GroupMember().setMemberName("coretech.backend").setPrincipalType(Principal.Type.SERVICE.getValue()));
    Group group = new Group().setGroupMembers(groupMembers);
    try {
        zms.validateGroupMemberPrincipals(group, null, "unittest");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), ResourceException.BAD_REQUEST);
    }
    // set our user authority
    Authority savedAuthority = zms.userAuthority;
    zms.userAuthority = new TestUserPrincipalAuthority();
    // include all valid principals
    groupMembers = new ArrayList<>();
    groupMembers.add(new GroupMember().setMemberName("user.joe").setPrincipalType(Principal.Type.USER.getValue()));
    groupMembers.add(new GroupMember().setMemberName("user.jane").setPrincipalType(Principal.Type.USER.getValue()));
    groupMembers.add(new GroupMember().setMemberName("sys.auth.zms").setPrincipalType(Principal.Type.SERVICE.getValue()));
    group.setGroupMembers(groupMembers);
    zms.validateGroupMemberPrincipals(group, null, "unittest");
    // add one more invalid user
    groupMembers.add(new GroupMember().setMemberName("user.john").setPrincipalType(Principal.Type.USER.getValue()));
    try {
        zms.validateGroupMemberPrincipals(group, null, "unittest");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), ResourceException.BAD_REQUEST);
    }
    zms.userAuthority = savedAuthority;
}