@Test
public void testUnauthorized() {

    ServiceAccountProvider provider = new ServiceAccountProvider();
    KerberosUserMapper mapper = new KerberosUserMapper();
    try {
        provider.getAccessToken(mapper.map("bob@EXAMPLE.COM"), SCOPES);
        fail("StatusRuntimeException not thrown");
    } catch (StatusRuntimeException e) {
        assertEquals(Status.PERMISSION_DENIED.getCode(), e.getStatus().getCode());
    }
}