rpcSid.sub_authority = new int[] { 32, 544 };

        SID sid = new SID(rpcSid, SID.SID_TYPE_WKN_GRP, "BUILTIN", "Administrators", false);
        assertEquals(SID.SID_TYPE_WKN_GRP, sid.getType());
        assertEquals("BUILTIN", sid.getDomainName());
        assertEquals("Administrators", sid.getAccountName());
        assertEquals(adminSidString, sid.toString());
    }

    /**

        assertEquals("******@****.***", permissionHelper.encode("{user}******@****.***"));
        assertEquals("2group/subgroup", permissionHelper.encode("{group}group/subgroup"));
        assertEquals("RAdministrators", permissionHelper.encode("{role}Administrators"));
        assertEquals("D1user with spaces", permissionHelper.encode("(deny){user}user with spaces"));

            byte[] ident = new byte[] { 0, 0, 0, 0, 0, 5 };
            // Well-known group
            SID wkn = new SID(buildSidT((byte) 1, ident, 32), jcifs.SID.SID_TYPE_WKN_GRP, "BUILTIN", "Administrators", false);
            assertEquals("Administrators", wkn.toDisplayString());

            // BUILTIN with unknown type -> falls back to numeric toString

        ace.allow = false;
        ace.access = 0x001F01FF;
        ace.flags = ACE.FLAGS_INHERITED | ACE.FLAGS_OBJECT_INHERIT | ACE.FLAGS_CONTAINER_INHERIT;
        ace.sid = new SID("S-1-5-32-544"); // Administrators

        String result = ace.toString();

        assertTrue(result.startsWith("Deny  "));
        // Hexdump.toHexString produces uppercase hex
        assertTrue(result.toLowerCase().contains("0x001f01ff"));

 * {@code S-1-5-21-1496946806-2192648263-3843101252-1029} but they may
 * also be resolved to yield the name of the associated Windows account
 * such as {@code Administrators} or {@code MYDOM\alice}.
 * <p>
 * Consider the following output of {@code examples/SidLookup.java}:
 *
 * <pre>
 *        toString: S-1-5-21-4133388617-793952518-2001621813-512
 * toDisplayString: WNET\Domain Admins

            assertFalse((aliceDirectACE & ACE.FILE_WRITE_DATA) != 0, "Alice's direct ACE should not allow FILE_WRITE_DATA");

            // Inherited ACE: Allow Administrators 0x001F01FF
            int adminInheritedACE = 0x001F01FF;
            assertTrue((adminInheritedACE & ACE.FILE_READ_DATA) != 0, "Admin inherited ACE should allow FILE_READ_DATA");

 * {@code S-1-5-21-1496946806-2192648263-3843101252-1029} but they may
 * also be resolved to yield the name of the associated Windows account
 * such as {@code Administrators} or {@code MYDOM\alice}.
 * <p>
 * Consider the following output of {@code examples/SidLookup.java}:
 * <pre>
 *        toString: S-1-5-21-4133388617-793952518-2001621813-512
 * toDisplayString: WNET\Domain Admins

        assertEquals("logged_in", roleQueryHelper.cookieNameMap.get("session"));

        roleQueryHelper.addCookieNameMapping("admin", "administrator");
        assertEquals(2, roleQueryHelper.cookieNameMap.size());
        assertEquals("administrator", roleQueryHelper.cookieNameMap.get("admin"));
    }

    public void test_addRoleFromCookieMapping() {

=== ":material-language-kotlin: Kotlin"
    ```kotlin
      private val client = OkHttpClient.Builder()
          .certificatePinner(
              CertificatePinner.Builder()

 * pinning certificates, you take on additional operational complexity and limit your ability to
 * migrate between certificate authorities. Do not use certificate pinning without the blessing of
 * your server's TLS administrator!
 *
 * ### Note about self-signed certificates
 *
 * [CertificatePinner] can not be used to pin self-signed certificate if such certificate is not
 * accepted by [javax.net.ssl.TrustManager].
 *