@Test
    void verifyRejectedAttributesMoreThanPrincipal() throws Throwable {
        val authz = new DefaultRegisteredServiceAccessStrategy();
        authz.setRejectedAttributes(getRejectedAttributes());
        authz.setRequiredAttributes(Map.of(CN, Set.of(CAS)));
        val request = RegisteredServiceAccessStrategyRequest.builder().applicationContext(applicationContext)
            .principalId(TEST).attributes(Map.of(CN, List.of(CAS))).build();
        assertFalse(authz.authorizeRequest(request));
    }
It is important that the non-matching attribute is not the first one, due to the
use of anyMatch and allMatch in the access strategy.
core/cas-server-core-services/src/test/java/org/apereo/cas/services/DefaultRegisteredServiceAccessStrategyTests.java