@Test
public void testPostAccessTokenRequestRoleAuthority() {

    System.setProperty(FilePrivateKeyStore.ATHENZ_PROP_PRIVATE_KEY, "src/test/resources/unit_test_zts_at_private.pem");
    CloudStore cloudStore = new CloudStore();
    cloudStore.setHttpClient(null);
    ZTSImpl ztsImpl = new ZTSImpl(cloudStore, store);
    // set back to our zts rsa private key
    System.setProperty(FilePrivateKeyStore.ATHENZ_PROP_PRIVATE_KEY, "src/test/resources/unit_test_zts_private.pem");
    SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true);
    store.processDomain(signedDomain, false);
    SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user_domain", "user1",
            "v=U1;d=user_domain;n=user1;s=signature", 0, new CertificateAuthority());
    ResourceContext context = createResourceContext(principal);
    List<String> principalRoles = new ArrayList<>();
    principalRoles.add("coretech:role.readers");
    principal.setRoles(principalRoles);
    // initially we only have a single role so our request
    // is going to be rejected
    try {
        ztsImpl.postAccessTokenRequest(context, "grant_type=client_credentials&scope=coretech:domain");
        fail();
    } catch (ResourceException ex) {
        assertEquals(403, ex.getCode());
    }
    // now add the second role as well
    principalRoles.add("coretech:role.writers");
    AccessTokenResponse resp = ztsImpl.postAccessTokenRequest(context,
            "grant_type=client_credentials&scope=coretech:domain&expires_in=100");
    assertNotNull(resp);
    assertEquals("coretech:role.readers coretech:role.writers", resp.getScope());
}