@Test
public void testPostRoleCertificateExtInvalidProxyUserRequest() throws IOException {

    Path path = Paths.get("src/test/resources/athenz_coretech_proxy_role_uri.csr");
    String csr = new String(Files.readAllBytes(path));
    // this csr is for coretech:role.readers and coretech:role.writers roles
    RoleCertificateRequest req = new RoleCertificateRequest()
            .setCsr(csr).setExpiryTime(3600L)
            .setProxyForPrincipal("user_domain.user1");
    SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true);
    store.processDomain(signedDomain, false);
    CloudStore cloudStore = new MockCloudStore();
    store.setCloudStore(cloudStore);
    zts.cloudStore = cloudStore;
    Principal principal = SimplePrincipal.create("user_domain", "proxy-user100",
            "v=U1;d=user_domain;n=proxy-user100;s=signature", 0, null);
    ResourceContext context = createResourceContext(principal);
    try {
        zts.postRoleCertificateRequestExt(context, req);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
    }
}