       helpers.spyOn(creds.webIdentityCredentials, 'refresh').andCallFake(->)
       creds.refresh (err) -> expect(err.message).to.equal('INVALID SERVICE')
       expect(creds.cacheId.calls.length).to.equal(0)
-      expect(creds.getStorage('id')).to.exist
-
-    it 'clears cache if getCredentialsForIdentity fails', ->
+      expect(creds.getStorage('id')).to.equal('MYID')
+
+    it 'does not clear cache if getCredentialsForIdentity fails for authorized user', ->
       delete creds.cognito.config.params.RoleArn
       creds.setStorage('id', 'MYID')
       helpers.mockResponses [

      ]
      creds.refresh (err) -> expect(err.message).to.equal('INVALID SERVICE')
      expect(creds.cacheId.calls.length).to.equal(0)
      expect(creds.getStorage('id')).to.exist

    it 'does try to load creds second time if service request failed', ->
      reqs = helpers.mockResponses [

    
    it 'should call clearCachedId if user is not authorized', ->
      clearCache = helpers.spyOn(creds,'clearCachedId')
      idErr = {code: 'NotAuthorizedException'}
      creds.clearIdOnNotAuthorized(idErr)
      expect(clearCache.calls.length).to.equal(1)
      
    it 'should not call clearCachedId if user is authorized', ->
      clearCache = helpers.spyOn(creds,'clearCachedId')
      idErr = {code: 'TEST'}
      creds.clearIdOnNotAuthorized(idErr)
      expect(clearCache.calls.length).to.equal(0)

  describe 'createClients', ->
    beforeEach -> setupCreds()
