@Test
public void testAuthenticate() {

    InstanceZTSProvider provider = new InstanceZTSProvider();
    provider.initialize("provider", "com.yahoo.athenz.instance.provider.impl.InstanceZTSProvider", null, null);
    StringBuilder errMsg = new StringBuilder(256);
    KeyStore keystore = Mockito.mock(KeyStore.class);
    Mockito.when(keystore.getPublicKey("sports", "api", "v0")).thenReturn(servicePublicKeyStringK0);
    String token = "invalidtoken";
    assertNull(provider.authenticate(token, null, servicePublicKeyStringK0, errMsg));
    assertTrue(errMsg.toString().contains("Invalid token"));
    errMsg.setLength(0);
    token = "v=S1;d=domain;n=service;t=1234;e=1235;k=0;h=host1;i=1.2.3.4;b=svc1,svc2;s=signature;bk=0;bn=svc1;bs=signature";
    assertNull(provider.authenticate(token, null, servicePublicKeyStringK0, errMsg));
    assertTrue(errMsg.toString().contains("authorized service token"));
    PrincipalToken tokenToSign = new PrincipalToken.Builder("1", "sports", "api")
            .keyId("v0").salt("salt").issueTime(System.currentTimeMillis() / 1000)
            .expirationWindow(3600).build();
    tokenToSign.sign(servicePrivateKeyStringK0);
    errMsg.setLength(0);
    assertNotNull(provider.authenticate(tokenToSign.getSignedToken(), keystore, servicePublicKeyStringK0, errMsg));
    // test with mismatch public key
    assertNull(provider.authenticate(tokenToSign.getSignedToken(), keystore, "publicKey", errMsg));
    // create invalid signature
    errMsg.setLength(0);
    assertNull(provider.authenticate(tokenToSign.getSignedToken().replace(";s=", ";s=abc"),
            keystore, servicePublicKeyStringK0, errMsg));
    provider.close();
}