ghttp.VerifyFormKV("client_id", "ssh-oauth-client-id"),
				ghttp.VerifyFormKV("grant_type", "authorization_code"),
				ghttp.VerifyHeaderKV("authorization", "bearer client-bearer-token"),
				ghttp.RespondWith(http.StatusFound, "", http.Header{
					"Location": []string{"https://uaa.example.com/login?code=abc123"},
				}),
			))
		})

		It("forces the cli to refresh the access token used to acquire the access code", func() {
			_, err := credFactory.AuthorizationCode()
			Expect(err).NotTo(HaveOccurred())

			Expect(fakeCliConnection.CliCommandWithoutTerminalOutputCallCount()).To(Equal(1))
			Expect(fakeCliConnection.CliCommandWithoutTerminalOutputArgsForCall(0)).To(ConsistOf("oauth-token"))
			Expect(fakeCliConnection.AccessTokenCallCount()).To(Equal(1))
		})

		It("gets the access code from the token endpoint", func() {
			code, err := credFactory.AuthorizationCode()
			Expect(err).NotTo(HaveOccurred())

			Expect(fakeUAA.ReceivedRequests()).To(HaveLen(1))
			Expect(code).To(Equal("abc123"))
		})

		It("returns an error when the uaa certificate is not valid and certificate validation is enabled", func() {
			fakeCliConnection.IsSSLDisabledReturns(false, nil)

			_, err := credFactory.AuthorizationCode()
			Expect(err).To(HaveOccurred())