try (ASN1InputStream is = new ASN1InputStream(token)) {
            final ASN1TaggedObject constructed = (ASN1TaggedObject) is.readObject();
            if (constructed == null || constructed.getTagClass() != BERTags.APPLICATION
                    || !(constructed.getBaseObject() instanceof ASN1Sequence)) {
                throw new IOException("Malformed SPNEGO token " + constructed);
            }

        ASN1TaggedObject derToken;
        try {
            derToken = ASN1Util.as(ASN1TaggedObject.class, stream);
            if (derToken.getTagClass() != BERTags.APPLICATION) {
                throw new PACDecodingException("Malformed kerberos ticket");
            }
            stream.close();
        } catch (IOException e) {

            assertTrue(obj instanceof ASN1TaggedObject, "Top-level should be tagged (APPLICATION)");
            ASN1TaggedObject top = (ASN1TaggedObject) obj;
            assertEquals(BERTags.APPLICATION, top.getTagClass(), "Top-level tag class should be APPLICATION");
            assertEquals(0, top.getTagNo(), "Top-level tag number should be 0");