* it is supplied by the user at runtime.
     *
     * @return the password
     * @deprecated Use getPasswordAsCharArray() for better security
     */
    @Deprecated
    public String getPassword() {
        checkNotClosed();
        log.warn("getPassword() is deprecated and insecure. Use getPasswordAsCharArray() instead.");
        return this.password != null ? new String(this.password) : null;
    }

    /**

        // Spy to override getPasswordAsCharArray() to return null
        JAASAuthenticator spyAuth = spy(new JAASAuthenticator("DOM", "user", null));
        when(spyAuth.getPasswordAsCharArray()).thenReturn(null);

        PasswordCallback pc = new PasswordCallback("pass:", false);
        spyAuth.handle(new Callback[] { pc });

        // Since getPasswordAsCharArray() returned null, handler should not set a password

        String passwordString = null;
        if (this.auth.isGuest()) {
            passwordString = this.transportContext.getConfig().getGuestPassword();
        } else {
            char[] passwordChars = this.auth.getPasswordAsCharArray();
            if (passwordChars != null) {
                passwordString = new String(passwordChars);
                // Securely wipe the char array immediately after use