@Test
public void testGetRoleTokenWithRoleAuthority() {

    SignedDomain signedDomain = createSignedDomain("coretech", "weather", "storage", true);
    store.processDomain(signedDomain, false);
    SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("user_domain", "user",
            "v=U1;d=user_domain;n=user;s=signature", 0, new CertificateAuthority());
    ResourceContext context = createResourceContext(principal);
    // for the first principal we're not going to match - not including
    // the writers role so that it would fail
    List<String> principalRoles = new ArrayList<>();
    principalRoles.add("coretech:role.readers");
    principal.setRoles(principalRoles);
    try {
        zts.getRoleToken(context, "coretech", null, 600, 1200, null);
        fail();
    } catch (ResourceException ex) {
        assertEquals(403, ex.getCode());
    }
    // now include the role and verify valid response
    principalRoles.add("coretech:role.writers");
    RoleToken roleToken = zts.getRoleToken(context, "coretech", null, 600, 1200, null);
    assertNotNull(roleToken);
}