@Test
public void testPostRoleCertificateRequestAuthorizedPrincipal() {

    RoleCertificateRequest req = new RoleCertificateRequest()
            .setCsr(ROLE_CERT_DB_REQUEST).setExpiryTime(3600L);
    SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true);
    store.processDomain(signedDomain, false);
    SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user_domain", "user1",
            "v=U1;d=user_domain;n=user;s=signature", 0, null);
    principal.setAuthorizedService("athenz.api");
    ResourceContext context = createResourceContext(principal);
    // this time we're passing an invalid role name
    try {
        zts.postRoleCertificateRequest(context, "coretech", "readers", req);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
        assertTrue(ex.getMessage().contains("Authorized Service Principals not allowed"));
    }
}