@Test
public void testValidateGroupMemberPrincipal() {

    Authority savedAuthority = zms.userAuthority;
    zms.userAuthority = new TestUserPrincipalAuthority();
    // wildcards are always rejected
    try {
        zms.validateGroupMemberPrincipal("athenz.api*", Principal.Type.SERVICE.getValue(), null, "unittest");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), ResourceException.BAD_REQUEST);
    }
    try {
        zms.validateGroupMemberPrincipal("athenz.api*", Principal.Type.SERVICE.getValue(), null, "unittest");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), ResourceException.BAD_REQUEST);
    }
    try {
        zms.validateGroupMemberPrincipal("*", Principal.Type.SERVICE.getValue(), null, "unittest");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), ResourceException.BAD_REQUEST);
    }
    // should get back invalid request since service does not exist
    try {
        zms.validateGroupMemberPrincipal("coretech.api", Principal.Type.SERVICE.getValue(), "employee", "unittest");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), ResourceException.BAD_REQUEST);
    }
    // invalid service request error
    try {
        zms.validateGroupMemberPrincipal("coretech", Principal.Type.SERVICE.getValue(), null, "unittest");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), ResourceException.BAD_REQUEST);
    }
    TopLevelDomain dom1 = createTopLevelDomainObject("coretech", "Test Domain1", "testorg", adminUser);
    zms.postTopLevelDomain(mockDomRsrcCtx, auditRef, dom1);
    ServiceIdentity service1 = createServiceObject("coretech",
            "api", "http://localhost", "/usr/bin/java", "root",
            "users", "host1");
    zms.putServiceIdentity(mockDomRsrcCtx, "coretech", "api", auditRef, service1);
    // known service - no exception
    zms.validateGroupMemberPrincipal("coretech.api", Principal.Type.SERVICE.getValue(), null,  "unittest");
    // unknown service - exception
    try {
        zms.validateGroupMemberPrincipal("coretech.backend", Principal.Type.SERVICE.getValue(), null, "unittest");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), ResourceException.BAD_REQUEST);
    }
    // known user principals are accepted
    zms.validateGroupMemberPrincipal("user.joe", Principal.Type.USER.getValue(), null, "unittest");
    zms.validateGroupMemberPrincipal("user.jane", Principal.Type.USER.getValue(), null, "unittest");
    // unknown users are rejected
    try {
        zms.validateGroupMemberPrincipal("user.john", Principal.Type.USER.getValue(), null, "unittest");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), ResourceException.BAD_REQUEST);
    }
    // groups and unknown types are rejected
    try {
        zms.validateGroupMemberPrincipal("user", Principal.Type.UNKNOWN.getValue(), null, "unittest");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), ResourceException.BAD_REQUEST);
    }
    Group group = createGroupObject("coretech", "dev-team", "user.joe", "user.jane");
    zms.putGroup(mockDomRsrcCtx, "coretech", "dev-team", auditRef, group);
    try {
        zms.validateGroupMemberPrincipal("coretech:group.dev-team", Principal.Type.GROUP.getValue(), null, "unittest");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), ResourceException.BAD_REQUEST);
    }
    // reset our setting
    zms.userAuthority = savedAuthority;
    zms.deleteTopLevelDomain(mockDomRsrcCtx, "coretech", auditRef);
}