@Test
public void testPostRoleCertificateProxyUserRequestAccessMismatch() throws IOException {

    Path path = Paths.get("src/test/resources/coretech_readers_proxy_role_uri.csr");
    String csr = new String(Files.readAllBytes(path));
    // this csr is for coretech:role.readers role
    RoleCertificateRequest req = new RoleCertificateRequest()
            .setCsr(csr).setExpiryTime(3600L)
            .setProxyForPrincipal("user_domain.user1");
    List<RoleMember> writers = new ArrayList<>();
    writers.add(new RoleMember().setMemberName("user_domain.user1"));
    List<RoleMember> readers = new ArrayList<>();
    readers.add(new RoleMember().setMemberName("user_domain.user4"));
    readers.add(new RoleMember().setMemberName("user_domain.proxy-user1"));
    SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", writers,
            readers, true);
    store.processDomain(signedDomain, false);
    CloudStore cloudStore = new MockCloudStore();
    store.setCloudStore(cloudStore);
    zts.cloudStore = cloudStore;
    Principal principal = SimplePrincipal.create("user_domain", "proxy-user1",
            "v=U1;d=user_domain;n=proxy-user1;s=signature", 0, null);
    ResourceContext context = createResourceContext(principal);
    try {
        zts.postRoleCertificateRequest(context, "coretech", "readers", req);
        fail();
    } catch (ResourceException ex) {
        assertTrue(ex.getMessage().contains("No access to any roles by User and Proxy Principals"));
    }
}