@Test
public void testIsPrincipalRoleCertificateAccessValid() {

    SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("sports", "api",
            "creds", 0, new PrincipalAuthority());
    Set<String> roles = new HashSet<>();
    roles.add("readers");
    roles.add("writers");
    // without any roles we should return true
    assertTrue(zts.isPrincipalRoleCertificateAccessValid(principal, "domain1", roles));
    assertTrue(zts.isPrincipalRoleCertificateAccessValid(principal, "domain2", roles));
    // with empty roles we should have same behavior
    principal.setRoles(Collections.emptyList());
    assertTrue(zts.isPrincipalRoleCertificateAccessValid(principal, "domain1", roles));
    assertTrue(zts.isPrincipalRoleCertificateAccessValid(principal, "domain2", roles));
    // set the principal with roles not matching
    List<String> principalRoles = new ArrayList<>();
    principalRoles.add("domain1:role.admin");
    principalRoles.add("domain1:role.editor");
    principal.setRoles(principalRoles);
    // we should get failure for both
    assertFalse(zts.isPrincipalRoleCertificateAccessValid(principal, "domain1", roles));
    assertFalse(zts.isPrincipalRoleCertificateAccessValid(principal, "domain2", roles));
    // set principal roles to include one of the roles
    principalRoles.add("domain1:role.readers");
    // we should get failure still
    assertFalse(zts.isPrincipalRoleCertificateAccessValid(principal, "domain1", roles));
    assertFalse(zts.isPrincipalRoleCertificateAccessValid(principal, "domain2", roles));
    // now make sure it has both roles
    principalRoles.add("domain1:role.writers");
    // should get success with correct domain name and failure with domain2
    assertTrue(zts.isPrincipalRoleCertificateAccessValid(principal, "domain1", roles));
    assertFalse(zts.isPrincipalRoleCertificateAccessValid(principal, "domain2", roles));
}