final int _domainss = _src.dec_ndr_long();
                final int _domainsi = _src.index;
                _src.advance(12 * _domainss);

                if (this.domains == null) {
                    if (_domainss < 0 || _domainss > 0xFFFF) {
                        throw new NdrException(NdrException.INVALID_CONFORMANCE);
                    }
                    this.domains = new LsarTrustInformation[_domainss];

                final int _domainss = _src.dec_ndr_long();
                final int _domainsi = _src.index;
                _src.advance(12 * _domainss);

                if (domains == null) {
                    if (_domainss < 0 || _domainss > 0xFFFF) {
                        throw new NdrException(NdrException.INVALID_CONFORMANCE);
                    }
                    domains = new LsarTrustInformation[_domainss];
                }

        if (DISABLED || auth.domain == "?") {
            return null;
        }

        if (_domains != null && System.currentTimeMillis() > _domains.expiration) {
            _domains = null;
        }
        if (_domains != null) {
            return _domains.map;
        }
        try {
            final UniAddress addr = UniAddress.getByName(auth.domain, true);

                || tf.getCredentials().getUserDomain().isEmpty()) {
            return null;
        }

        if (this._domains != null && System.currentTimeMillis() > this._domains.expiration) {
            this._domains = null;
        }
        if (this._domains != null) {
            return this._domains.map;
        }
        try {
            final String authDomain = tf.getCredentials().getUserDomain();

            }
            rpc.domains = new lsarpc.LsarRefDomainList();
            rpc.domains.count = 1;
            rpc.domains.max_count = 1;
            rpc.domains.domains = new lsarpc.LsarTrustInformation[1];
            rpc.domains.domains[0] = new lsarpc.LsarTrustInformation();
            rpc.domains.domains[0].name = new UnicodeString("", false);
            rpc.domains.domains[0].sid = new jcifs.dcerpc.rpc.sid_t();

* The encryption of the connection happens at the **TCP level**.
    * That's one layer **below HTTP**.
    * So, the **certificate and encryption** handling is done **before HTTP**.
* **TCP doesn't know about "domains"**. Only about IP addresses.
    * The information about the **specific domain** requested goes in the **HTTP data**.

    }

    @ParameterizedTest
    @MethodSource("domains")
    @DisplayName("getUserDomain handles null and empty")
    void getUserDomain_edges(String domain) {
        TestCredentials creds = new TestCredentials(domain, false, false, new Subject(), false);
        assertEquals(domain, creds.getUserDomain());
    }

    static Stream<String> domains() {
        return Stream.of(null, "", "SALES");
    }

    * Das ist eine Schicht **unter HTTP**.
    * Die Handhabung von **Zertifikaten und Verschlüsselung** erfolgt also **vor HTTP**.
* **TCP weiß nichts über „<abbr title="Domäne, Bereich, Wirkungsraum">Domains</abbr>“**. Nur über IP-Adressen.
    * Die Informationen über die angeforderte **spezifische Domain** befinden sich in den **HTTP-Daten**.

 *
 * <p>A discrete domain always represents the <i>entire</i> set of values of its type; it cannot
 * represent partial domains such as "prime integers" or "strings of length 5."
 *
 * <p>See the Guava User Guide section on <a href=
 * "https://github.com/google/guava/wiki/RangesExplained#discrete-domains">{@code
 * DiscreteDomain}</a>.
 *
 * @author Kevin Bourrillion
 * @since 10.0
 */

func getResource(path string, host string, domains []string) (string, error) {
	if len(domains) == 0 {
		return path, nil
	}

	// If virtual-host-style is enabled construct the "resource" properly.
	xhost, err := xnet.ParseHost(host)
	if err != nil {
		return "", err
	}

	for _, domain := range domains {
		if xhost.Name == minioReservedBucket+"."+domain {
			continue
		}