@Test
public void testGetAccessExt() {

    final String testDomainName = "AccessDomExt1";
    
    TopLevelDomain dom1 = createTopLevelDomainObject(testDomainName,
            "Test Domain1", "testOrg", adminUser);
    zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1);
    Role role1 = createRoleObject(testDomainName, "Role1", null, "user.user1",
            "user.user3");
    zms.putRole(mockDomRsrcCtx, testDomainName, "Role1", auditRef, role1);
    Role role2 = createRoleObject(testDomainName, "Role2", null, "user.user2",
            "user.user3");
    zms.putRole(mockDomRsrcCtx, testDomainName, "Role2", auditRef, role2);
    Policy policy1 = createPolicyObject(testDomainName, "Policy1", "Role1",
            "UPDATE", testDomainName + ":resource1/resource2", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, testDomainName, "Policy1", auditRef, policy1);
    Policy policy2 = createPolicyObject(testDomainName, "Policy2", "Role2",
            "CREATE", testDomainName + ":resource2(resource3)", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, testDomainName, "Policy2", auditRef, policy2);
    Policy policy3 = createPolicyObject(testDomainName, "Policy3", "Role2",
            "*", testDomainName + ":resource3/*", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, testDomainName, "Policy3", auditRef, policy3);
    Policy policy4 = createPolicyObject(testDomainName, "Policy4", "Role1",
            "READ", testDomainName + ":resource4[*]/data1", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, testDomainName, "Policy4", auditRef, policy4);
    Policy policy5 = createPolicyObject(testDomainName, "Policy5", "Role2",
            "access", testDomainName + ":https://*.athenz.com/*", AssertionEffect.ALLOW);
    zms.putPolicy(mockDomRsrcCtx, testDomainName, "Policy5", auditRef, policy5);
    
    // user1 and user3 have access to UPDATE/resource1
    Authority principalAuthority = new com.yahoo.athenz.common.server.debug.DebugPrincipalAuthority();
    Principal principal1 = principalAuthority.authenticate("v=U1;d=user;n=user1;s=signature",
            "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx1 = createResourceContext(principal1);
    Principal principal2 = principalAuthority.authenticate("v=U1;d=user;n=user2;s=signature",
            "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx2 = createResourceContext(principal2);
    Principal principal3 = principalAuthority.authenticate("v=U1;d=user;n=user3;s=signature",
            "10.11.12.13", "GET", null);
    ResourceContext rsrcCtx3 = createResourceContext(principal3);
    // user1 and user3 have update access to resource1/resource2
    
    Access access = zms.getAccessExt(rsrcCtx1, "UPDATE", testDomainName + ":resource1/resource2",
            testDomainName, null);
    assertTrue(access.getGranted());
    access = zms.getAccessExt(rsrcCtx1, "UPDATE", testDomainName + ":resource1/resource3",
            testDomainName, null);
    assertFalse(access.getGranted());
    
    access = zms.getAccessExt(rsrcCtx2, "UPDATE", testDomainName + ":resource1/resource2",
            testDomainName, null);
    assertFalse(access.getGranted());
    access = zms.getAccessExt(rsrcCtx3, "UPDATE", testDomainName + ":resource1/resource2",
            testDomainName, null);
    assertTrue(access.getGranted());
    // all three have no access to CREATE action on resource1/resource2
    access = zms.getAccessExt(rsrcCtx1, "CREATE", testDomainName + ":resource1/resource2",
            testDomainName, null);
    assertFalse(access.getGranted());
    access = zms.getAccessExt(rsrcCtx2, "CREATE", testDomainName + ":resource1/resource2",
            testDomainName, null);
    assertFalse(access.getGranted());
    access = zms.getAccessExt(rsrcCtx3, "CREATE", testDomainName + ":resource1/resource2",
            testDomainName, null);
    assertFalse(access.getGranted());
    // user2 and user3 have create access to resource2(resource3)
    
    access = zms.getAccessExt(rsrcCtx1, "CREATE", testDomainName + ":resource2(resource3)",
            testDomainName, null);
    assertFalse(access.getGranted());
    access = zms.getAccessExt(rsrcCtx2, "CREATE", testDomainName + ":resource2(resource3)",
            testDomainName, null);
    assertTrue(access.getGranted());
    access = zms.getAccessExt(rsrcCtx3, "CREATE", testDomainName + ":resource2(resource3)",
            testDomainName, null);
    assertTrue(access.getGranted());
    // user2 and user3 have access to CREATE(*)/resource3/*
    access = zms.getAccessExt(rsrcCtx1, "CREATE", testDomainName + ":resource3",
            testDomainName, null);
    assertFalse(access.getGranted());
    access = zms.getAccessExt(rsrcCtx2, "CREATE", testDomainName + ":resource3/test1",
            testDomainName, null);
    assertTrue(access.getGranted());
    access = zms.getAccessExt(rsrcCtx3, "CREATE", testDomainName + ":resource3/anothertest",
            testDomainName, null);
    assertTrue(access.getGranted());
    // user2 and user3 have access to UPDATE(*)/resource3/*
    access = zms.getAccessExt(rsrcCtx1, "UPDATE", testDomainName + ":resource3",
            testDomainName, null);
    assertFalse(access.getGranted());
    access = zms.getAccessExt(rsrcCtx2, "UPDATE", testDomainName + ":resource3/(another value)",
            testDomainName, null);
    assertTrue(access.getGranted());
    access = zms.getAccessExt(rsrcCtx3, "UPDATE", testDomainName + ":resource3/a",
            testDomainName, null);
    assertTrue(access.getGranted());
    // user1 and user3 have access to READ/resource6[*]/data1
    access = zms.getAccessExt(rsrcCtx1, "read", testDomainName + ":resource4[test1]/data1",
            testDomainName, null);
    assertTrue(access.getGranted());
    access = zms.getAccessExt(rsrcCtx2, "read", testDomainName + ":resource4[test1]/data1",
            testDomainName, null);
    assertFalse(access.getGranted());
    access = zms.getAccessExt(rsrcCtx3, "read", testDomainName + ":resource4[test another]/data1",
            testDomainName, null);
    assertTrue(access.getGranted());
    // user2 and user3 have access to access/https://*.athenz.com/*
    access = zms.getAccessExt(rsrcCtx1, "access", testDomainName + ":https://web.athenz.com/data",
            testDomainName, null);
    assertFalse(access.getGranted());
    access = zms.getAccessExt(rsrcCtx2, "access", testDomainName + ":https://web.athenz.com/data",
            testDomainName, null);
    assertTrue(access.getGranted());
    access = zms.getAccessExt(rsrcCtx2, "access", testDomainName + ":https://web.athenz.org/data",
            testDomainName, null);
    assertFalse(access.getGranted());
    
    access = zms.getAccessExt(rsrcCtx3, "access", testDomainName + ":https://web-store.athenz.com/data/path",
            testDomainName, null);
    assertTrue(access.getGranted());
    
    zms.deleteTopLevelDomain(mockDomRsrcCtx, testDomainName, auditRef);
}