@Test
public void testValidateRoleMemberPrincipals() {

    zms.validateUserRoleMembers = false;
    zms.validateServiceRoleMembers = false;
    // if both are false then any invalid users are ok
    List<RoleMember> roleMembers = new ArrayList<>();
    roleMembers.add(new RoleMember().setMemberName("user").setPrincipalType(Principal.Type.SERVICE.getValue()));
    roleMembers.add(new RoleMember().setMemberName("user.john").setPrincipalType(Principal.Type.USER.getValue()));
    roleMembers.add(new RoleMember().setMemberName("user.jane").setPrincipalType(Principal.Type.USER.getValue()));
    roleMembers.add(new RoleMember().setMemberName("coretech.api").setPrincipalType(Principal.Type.SERVICE.getValue()));
    roleMembers.add(new RoleMember().setMemberName("coretech.backend").setPrincipalType(Principal.Type.SERVICE.getValue()));
    Role role = new Role().setRoleMembers(roleMembers);
    zms.validateRoleMemberPrincipals(role, null, false, "unittest");
    // enable user authority check
    zms.userAuthority = new TestUserPrincipalAuthority();
    zms.validateUserRoleMembers = true;
    // include all valid principals
    roleMembers = new ArrayList<>();
    roleMembers.add(new RoleMember().setMemberName("user.joe").setPrincipalType(Principal.Type.USER.getValue()));
    roleMembers.add(new RoleMember().setMemberName("user.jane").setPrincipalType(Principal.Type.USER.getValue()));
    role.setRoleMembers(roleMembers);
    zms.validateRoleMemberPrincipals(role, null, false, "unittest");
    // add one more invalid user
    roleMembers.add(new RoleMember().setMemberName("user.john").setPrincipalType(Principal.Type.USER.getValue()));
    try {
        zms.validateRoleMemberPrincipals(role, null, false, "unittest");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), ResourceException.BAD_REQUEST);
    }
    // do not allow any groups
    roleMembers = new ArrayList<>();
    roleMembers.add(new RoleMember().setMemberName("user.joe").setPrincipalType(Principal.Type.USER.getValue()));
    roleMembers.add(new RoleMember().setMemberName("user.jane").setPrincipalType(Principal.Type.USER.getValue()));
    roleMembers.add(new RoleMember().setMemberName("coretech:group.dev-team").setPrincipalType(Principal.Type.GROUP.getValue()));
    role.setRoleMembers(roleMembers);
    try {
        zms.validateRoleMemberPrincipals(role, null, true, "unittest");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), ResourceException.BAD_REQUEST);
    }
    // unknown types are always rejected
    roleMembers = new ArrayList<>();
    roleMembers.add(new RoleMember().setMemberName("unknown").setPrincipalType(Principal.Type.UNKNOWN.getValue()));
    role.setRoleMembers(roleMembers);
    try {
        zms.validateRoleMemberPrincipals(role, null, false, "unittest");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), ResourceException.BAD_REQUEST);
    }
}