} catch (SmbException e) {
            // Expected
        }

        // Wait for lockout to expire
        Thread.sleep(2100); // Lockout is 2 seconds in test setup

        // Should be allowed again
        assertTrue(rateLimiter.checkAttempt(username, ip), "Should be allowed after lockout expiry");
    }

    @Test
    public void testSuccessResetsCounter() throws Exception {

        private final AtomicBoolean lockedOut = new AtomicBoolean(false);

        void recordFailure() {
            failedAttempts.incrementAndGet();
            lastAttempt = Instant.now();
        }

        void reset() {
            failedAttempts.set(0);
            lockedOut.set(false);
            lockoutExpiry = null;
        }

        void lockOut(Duration duration) {

        assertNull(result);
    }

    // Test logout method
    @Test
    public void test_logout_withValidUser() {
        // Setup
        FessUserBean user = FessUserBean.empty();
        String expectedUrl = "https://example.com/logout?user=testuser123";
        authenticator.setLogoutUrl(expectedUrl);

        // Execute
        String result = authenticator.logout(user);

        // Verify

        assertNotNull(response);
        assertEquals(expectedResponse, response);
    }

    // Test logout() method
    @Test
    public void test_logout_whenNotAvailable() {
        currentSsoType = Constants.NONE;
        FessUserBean user = FessUserBean.empty();
        assertNull(ssoManager.logout(user));
    }

    @Test
    public void test_logout_whenAvailableButNoAuthenticator() {

        @DisplayName("Should calculate size for various lock counts")
        @ValueSource(ints = { 0, 1, 2, 5, 10, 20, 50, 100 })
        void testSizeWithVariousLockCounts(int lockCount) {
            Smb2Lock[] locks = new Smb2Lock[lockCount];
            for (int i = 0; i < lockCount; i++) {
                locks[i] = new Smb2Lock(i * 100L, 100L, Smb2Lock.SMB2_LOCKFLAG_EXCLUSIVE_LOCK);
            }

        // Mock the stream directly
        SmbPipeOutputStream mockOut = mock(SmbPipeOutputStream.class);

        // Create spy and override getOutput
        SmbPipeHandleImpl spyHandle = spy(handle);
        doReturn(mockOut).when(spyHandle).getOutput();

        byte[] b = new byte[10];
        spyHandle.send(b, 2, 4);
        verify(mockOut).writeDirect(eq(b), eq(2), eq(4), eq(1));
    }

    @Test

        activityHelper.useEcsFormat = false;
        activityHelper.logout(OptionalThing.empty());
        assertEquals("action:LOGOUT\tuser:-\tpermissions:-", localLogMsg.get());

        activityHelper.logout(createUser("testuser", new String[0]));
        assertEquals("action:LOGOUT\tuser:testuser\tpermissions:-", localLogMsg.get());

        activityHelper.logout(createUser("testuser", new String[] { "111", "222" }));

 *
 * # Assertion Consumer Service URL
 * saml.sp.assertion_consumer_service.url=https://your-fess-server.example.com/sso/
 *
 * # Single Logout Service URL
 * saml.sp.single_logout_service.url=https://your-fess-server.example.com/sso/logout
 * </pre>
 *
 * <h2>Complete Configuration Example (Okta)</h2>
 * <pre>
 * sso.type=saml
 *
 * # IdP settings from Okta SAML setup instructions

            }
        });
        log(valueMap);
    }

    /**
     * Log the logout activity.
     * @param user The user.
     */
    public void logout(final OptionalThing<FessUserBean> user) {
        final Map<String, String> valueMap = new LinkedHashMap<>();
        valueMap.put("action", Action.LOGOUT.name());
        valueMap.put("user", user.map(FessUserBean::getUserId).orElse("-"));

     * for session management, so no specific logout URL is provided.
     *
     * @param user The user to logout
     * @return Always returns null as SPNEGO doesn't provide a logout URL
     */
    @Override
    public String logout(final FessUserBean user) {
        return null;
    }