@Test
public void testCheckRoleTokenAuthorizedServiceRequest() {

    
    // match authorized service - top level domain
    
    SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user",
            "doe", "v=U1,d=user;n=doe;s=sig", 0, new PrincipalAuthority());
    principal.setAuthorizedService("sports.api");
    zts.checkRoleTokenAuthorizedServiceRequest(principal, "sports", "caller");
    
    // match authorized service - subdomain
    
    principal.setAuthorizedService("sports.hockey.api");
    zts.checkRoleTokenAuthorizedServiceRequest(principal, "sports.hockey", "caller");
    
    // mismatch
    
    principal.setAuthorizedService("weather.api");
    try {
        zts.checkRoleTokenAuthorizedServiceRequest(principal, "sports", "caller");
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
}