@Test
public void testIsAllowedPutMembershipWithoutApproval() {

    TopLevelDomain dom1 = createTopLevelDomainObject("testdomain1","Role Test Domain1", "testOrg", "user.user1");
    zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1);
    Role role1 = createRoleObject("testdomain1", "testrole1", null,"user.john", "user.jane");
    zms.putRole(mockDomRsrcCtx, "testdomain1", "testrole1", auditRef, role1);
    AthenzDomain domain = zms.getAthenzDomain("testdomain1", false);
    Role role = zms.getRoleFromDomain("testrole1", domain);
    assertTrue(zms.isAllowedPutMembershipWithoutApproval(mockDomRestRsrcCtx.principal(), domain, role));//admin allowed
    Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority();
    String unsignedCreds = "v=U1;d=user;n=john";
    final Principal rsrcPrince = SimplePrincipal.create("user", "john", unsignedCreds + ";s=signature",0, principalAuthority);
    assertNotNull(rsrcPrince);
    ((SimplePrincipal) rsrcPrince).setUnsignedCreds(unsignedCreds);
    assertFalse(zms.isAllowedPutMembershipWithoutApproval(rsrcPrince, domain, role));//other user not allowed
    DomainMeta meta = createDomainMetaObject("Domain Meta for Role Meta test", "testOrg",
            true, true, "12345", 1001);
    zms.putDomainMeta(mockDomRsrcCtx, "testdomain1", auditRef, meta);
    zms.putDomainSystemMeta(mockDomRsrcCtx, "testdomain1", "auditenabled", auditRef, meta);
    Role role2 = createRoleObject("testdomain1", "testrole2", null,"user.john", "user.jane");
    zms.putRole(mockDomRsrcCtx, "testdomain1", "testrole2", auditRef, role2);
    RoleSystemMeta rsm = createRoleSystemMetaObject(true);
    zms.putRoleSystemMeta(mockDomRsrcCtx, "testdomain1", "testrole2", "auditenabled", auditRef, rsm);
    Authority principalAuthority1 = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority();
    String unsignedCreds1 = "v=U1;d=user;n=user1";
    final Principal adminPrinc = SimplePrincipal.create("user", "user1", unsignedCreds + ";s=signature",0, principalAuthority1);
    assertNotNull(adminPrinc);
    ((SimplePrincipal) adminPrinc).setUnsignedCreds(unsignedCreds1);
    domain = zms.getAthenzDomain("testdomain1", false);
    role = zms.getRoleFromDomain("testrole2", domain);
    assertFalse(zms.isAllowedPutMembershipWithoutApproval(adminPrinc, domain, role));//admin not allowed on audit enabled role
    zms.deleteTopLevelDomain(mockDomRsrcCtx, "testdomain1", auditRef);
}