@Test
public void testValidateClientId() {

    final DefaultOAuthJwtAccessTokenValidator validator = this.baseValidator;
    final OAuthJwtAccessToken mock = Mockito.spy(baseJwt);
    Mockito.doReturn(null).when(mock).getClientId();
    // null JWT client ID, null CN, invalid
    assertThrowable.accept(new ThrowingRunnable() {
        public void run() throws Throwable {
            validator.validateClientId(mock, null);
        }
    }, "NO mapping of authorized client IDs for certificate principal (null)");
    // null JWT client ID ONLY, no mapping
    assertThrowable.accept(new ThrowingRunnable() {
        public void run() throws Throwable {
            validator.validateClientId(mock, "no_mapping_1");
        }
    }, "NO mapping of authorized client IDs for certificate principal (no_mapping_1)");
    // null JWT client ID ONLY, mapped
    assertThrowable.accept(new ThrowingRunnable() {
        public void run() throws Throwable {
            validator.validateClientId(mock, "client_cert_common_name");
        }
    }, "client_id is not authorized for certificate principal (client_cert_common_name): got=null");
    Mockito.doReturn("jwt_client_id").when(mock).getClientId();
    // null expected client ID ONLY, no mapping
    assertThrowable.accept(new ThrowingRunnable() {
        public void run() throws Throwable {
            validator.validateClientId(mock, null);
        }
    }, "NO mapping of authorized client IDs for certificate principal (null)");
    // null expected client ID ONLY, mapped
    authorizedClientIds.put(null, new HashSet<>(Arrays.asList("null_1, null_2")));
    assertThrowable.accept(new ThrowingRunnable() {
        public void run() throws Throwable {
            validator.validateClientId(mock, null);
        }
    }, "client_id is not authorized for certificate principal (null): got=jwt_client_id");
    authorizedClientIds.remove(null);
    // not match, no mapping
    assertThrowable.accept(new ThrowingRunnable() {
        public void run() throws Throwable {
            validator.validateClientId(mock, "no_mapping_2");
        }
    }, "NO mapping of authorized client IDs for certificate principal (no_mapping_2)");
    // not match, mapped
    assertThrowable.accept(new ThrowingRunnable() {
        public void run() throws Throwable {
            validator.validateClientId(mock, "client_cert_common_name");
        }
    }, "client_id is not authorized for certificate principal (client_cert_common_name): got=jwt_client_id");
    // match, no mapping
    Mockito.doReturn("match.principal.1").when(mock).getClientId();
    assertThrowable.accept(new ThrowingRunnable() {
        public void run() throws Throwable {
            validator.validateClientId(mock, "match.principal.1");
        }
    }, "NO mapping of authorized client IDs for certificate principal (match.principal.1)");
    // match, mapped
    Mockito.doReturn("client_id_1").when(mock).getClientId();
    assertDoesNotThrow.accept(new ThrowingRunnable() {
        public void run() throws Throwable {
            validator.validateClientId(mock, "client_cert_common_name");
        }
    });
    // no mapping, case-insensitive, match, invalid
    Mockito.doReturn("match.principal.PPP").when(mock).getClientId();
    assertThrowable.accept(new ThrowingRunnable() {
        public void run() throws Throwable {
            validator.validateClientId(mock, "match.principal.ppp");
        }
    }, "NO mapping of authorized client IDs for certificate principal (match.principal.ppp)");
    // mapped, case-sensitive, match
    Mockito.doReturn("CLIENT_ID_2").when(mock).getClientId();
    assertDoesNotThrow.accept(new ThrowingRunnable() {
        public void run() throws Throwable {
            validator.validateClientId(mock, "client_cert_common_name");
        }
    });
    // mapped, case-sensitive, not match
    Mockito.doReturn("client_id_2").when(mock).getClientId();
    assertThrowable.accept(new ThrowingRunnable() {
        public void run() throws Throwable {
            validator.validateClientId(mock, "client_cert_common_name");
        }
    }, "client_id is not authorized for certificate principal (client_cert_common_name): got=client_id_2");
}