*
     * @param source
     *            the {@link SSPContext} to be wrapped
     * @param mech
     *            the mechanism is being used for this context.
     */
    SpnegoContext(final Configuration config, final SSPContext source, final ASN1ObjectIdentifier[] mech) {
        this.mechContext = source;
        this.mechs = mech;
        this.disableMic = !config.isEnforceSpnegoIntegrity() && config.isDisableSpnegoIntegrity();

        auth.setForceFallback(true);

        // Token advertising Kerberos mech (so foundKerberos == true), but forceFallback should still route to NTLM
        byte[] init = spnegoInitWithMechs(Kerb5Context.SUPPORTED_MECHS);

        // NtlmPasswordAuthenticator#createContext will inspect mechs and throw because NTLM is not advertised
        SmbUnsupportedOperationException ex =

    }

    @Test
    @DisplayName("getSupportedMechs returns expected array")
    void getSupportedMechs_happyPath() {
        ASN1ObjectIdentifier[] mechs = ctx.getSupportedMechs();
        assertNotNull(mechs);
        assertArrayEquals(Kerb5Context.SUPPORTED_MECHS, mechs);
    }

    @Test
    @DisplayName("getFlags with all false yields 0")
    void getFlags_allFalse() {

        ASN1ObjectIdentifier mech = ASN1ObjectIdentifier.getInstance(this.gssContext.getMech().getDER());
        for (KerberosTicket ticket : subject.getPrivateCredentials(KerberosTicket.class)) {
            MIEName client = new MIEName(mech, ticket.getClient().getName());
            MIEName server = new MIEName(mech, ticket.getServer().getName());

                    final ASN1ObjectIdentifier[] mechs = new ASN1ObjectIdentifier[sequence.size()];
                    for (int i = mechs.length - 1; i >= 0; i--) {
                        mechs[i] = (ASN1ObjectIdentifier) sequence.getObjectAt(i);
                    }
                    setMechanisms(mechs);
                    break;
                case 1:

            }
            if (tok.getMechanisms() != null) {
                Set<ASN1ObjectIdentifier> mechs = new HashSet<>(Arrays.asList(tok.getMechanisms()));
                boolean foundKerberos = false;
                for (ASN1ObjectIdentifier mech : Kerb5Context.SUPPORTED_MECHS) {
                    foundKerberos |= mechs.contains(mech);
                }

            assertTrue(ctx.isSupported(mech1), "mech1 supported");
            assertTrue(ctx.isPreferredMech(mech1), "first supported is preferred");
            assertArrayEquals(new ASN1ObjectIdentifier[] { mech1, mech2 }, ctx.getSupportedMechs(), "supported mechs");

            // MIC roundtrip: calculate then verify
            byte[] data = new byte[] { 10, 20, 30 };

    private static byte[] buildInitToken(ASN1ObjectIdentifier[] mechs, Integer flags, byte[] mechToken, byte[] mic, boolean micInTag4,
            String spnegoOidOverride, Integer outerTagNoOverride, ASN1TaggedObject extraField) throws IOException {

        ASN1EncodableVector fields = new ASN1EncodableVector();
        if (mechs != null) {
            ASN1EncodableVector v = new ASN1EncodableVector();

   *
   * <p><b>{@code Stream} equivalent:</b> {@code stream.filter(predicate).findFirst()}.
   */
  public final Optional<@NonNull E> firstMatch(Predicate<? super E> predicate) {
    // Unsafe, but we can't do much about it now.
    return Iterables.<@NonNull E>tryFind((Iterable<@NonNull E>) getDelegate(), predicate);
  }

  /**
   * Returns a fluent iterable that applies {@code function} to each element of this fluent

   *
   * <p><b>{@code Stream} equivalent:</b> {@code stream.filter(predicate).findFirst()}.
   */
  public final Optional<@NonNull E> firstMatch(Predicate<? super E> predicate) {
    // Unsafe, but we can't do much about it now.
    return Iterables.<@NonNull E>tryFind((Iterable<@NonNull E>) getDelegate(), predicate);
  }

  /**
   * Returns a fluent iterable that applies {@code function} to each element of this fluent