@Test
public void testGetRoleTokenAuthorizedService() {

    SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true);
    signedDomain.domain.setApplicationId("application_id");
    store.processDomain(signedDomain, false);
    
    //success
    SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user_domain", "user",
            "v=U1;d=user_domain;n=user;s=signature", 0, null);
    principal.setApplicationId("coretech.api");
    ResourceContext context = createResourceContext(principal);
    
    RoleToken roleToken = zts.getRoleToken(context, "coretech", null, 600,
            1200, null);
    com.yahoo.athenz.auth.token.RoleToken token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken());
    assertEquals(token.getRoles().size(), 1);
    
    //success - no authorized service available
    token = new com.yahoo.athenz.auth.token.RoleToken(roleToken.getToken());
    assertEquals(token.getRoles().size(), 1);
    
    //failure - domain name and principal authorized service doesn't match
    principal = (SimplePrincipal) SimplePrincipal.create("user_domain", "user",
            "v=U1;d=user_domain;n=user;s=signature", 0, null);
    principal.setAuthorizedService("sports.hockey.api");
    context = createResourceContext(principal);
    
    try {
        zts.getRoleToken(context, "coretech", null, 600,
                1200, null);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
}