'Ensure SAML generation fails when passing domain-scoped tokens.
The server should return a 403 Forbidden Action.'

def test_not_project_scoped_token(self):

    self.config_fixture.config(group='saml', idp_entity_id=self.ISSUER)
    token_id = self._fetch_domain_scoped_token()
    body = self._create_generate_saml_request(token_id, self.SERVICE_PROVDIER_ID)
    with mock.patch.object(keystone_idp, '_sign_assertion', return_value=self.signed_assertion):
        self.post(self.SAML_GENERATION_ROUTE, body=body, expected_status=http_client.FORBIDDEN)
