A unitest for access control

[yuyiguo]

As we discussed that we will have int/global & dev/global have the same roles as prod/global so we can test it before going to production. So far we did not have a negative test on this. Could you add a test? which account can be used for testing?

[giffels]

That is really difficult, since my cert is associated with the DBS:Admin role, therefore everything is working for me. Probably for the long-term we have follow the way the PhEDEx people are doing this. They have a set of self-signed certs with different roles. Of course that will only works on dev vms and needs some tweaking here, to accept self-signed certs.