assertEquals("REALM.TEST", auth.getUserDomain());
        }

        @Test
        @DisplayName("getUserDomain: falls back to super domain when no realm/subject")
        void getUserDomain_fallbackToSuper() {
            Kerb5Authenticator auth = new Kerb5Authenticator(null, "DOM", "u", "p");
            // No explicit realm or subject -> returns super.getUserDomain()