*
     * @param source
     *            the {@link SSPContext} to be wrapped
     * @param mech
     *            the mechanism is being used for this context.
     */
    SpnegoContext(final Configuration config, final SSPContext source, final ASN1ObjectIdentifier[] mech) {
        this.mechContext = source;
        this.mechs = mech;
        this.disableMic = !config.isEnforceSpnegoIntegrity() && config.isDisableSpnegoIntegrity();

        // Arrange – create a fully populated token
        ASN1ObjectIdentifier mech = new ASN1ObjectIdentifier("1.2.840.113554.1.2.2");
        byte[] tokenArray = new byte[] { 1, 2, 3 };
        byte[] mic = new byte[] { 9, 9, 9 };
        NegTokenTarg original = new NegTokenTarg(NegTokenTarg.ACCEPT_COMPLETED, mech, tokenArray, mic);

        // Act – serialise and parse back
        byte[] bytes = original.toByteArray();

    void testIsPreferredMechDelegates() {
        SpnegoContext ctx = newContext();
        ASN1ObjectIdentifier mech = new ASN1ObjectIdentifier("1.2.840.113554.1.2.2");
        when(this.mechContext.isPreferredMech(mech)).thenReturn(true);
        assertTrue(ctx.isPreferredMech(mech));
        verify(this.mechContext, times(1)).isPreferredMech(mech);
    }

    @Test
    @DisplayName("getFlags delegates to underlying mechanism context")

                fields.add(new DERTaggedObject(true, 0, new ASN1Enumerated(res)));
            }
            final ASN1ObjectIdentifier mech = getMechanism();
            if (mech != null) {
                fields.add(new DERTaggedObject(true, 1, mech));
            }
            final byte[] mechanismToken = getMechanismToken();
            if (mechanismToken != null) {

        auth.setForceFallback(true);

        // Token advertising Kerberos mech (so foundKerberos == true), but forceFallback should still route to NTLM
        byte[] init = spnegoInitWithMechs(Kerb5Context.SUPPORTED_MECHS);

        // NtlmPasswordAuthenticator#createContext will inspect mechs and throw because NTLM is not advertised
        SmbUnsupportedOperationException ex =

    }

    @Test
    @DisplayName("getSupportedMechs returns expected array")
    void getSupportedMechs_happyPath() {
        ASN1ObjectIdentifier[] mechs = ctx.getSupportedMechs();
        assertNotNull(mechs);
        assertArrayEquals(Kerb5Context.SUPPORTED_MECHS, mechs);
    }

    @Test
    @DisplayName("getFlags with all false yields 0")
    void getFlags_allFalse() {

        ASN1ObjectIdentifier mech = ASN1ObjectIdentifier.getInstance(this.gssContext.getMech().getDER());
        for (KerberosTicket ticket : subject.getPrivateCredentials(KerberosTicket.class)) {
            MIEName client = new MIEName(mech, ticket.getClient().getName());
            MIEName server = new MIEName(mech, ticket.getServer().getName());

                    final ASN1ObjectIdentifier[] mechs = new ASN1ObjectIdentifier[sequence.size()];
                    for (int i = mechs.length - 1; i >= 0; i--) {
                        mechs[i] = (ASN1ObjectIdentifier) sequence.getObjectAt(i);
                    }
                    setMechanisms(mechs);
                    break;
                case 1:

            }
            if (tok.getMechanisms() != null) {
                Set<ASN1ObjectIdentifier> mechs = new HashSet<>(Arrays.asList(tok.getMechanisms()));
                boolean foundKerberos = false;
                for (ASN1ObjectIdentifier mech : Kerb5Context.SUPPORTED_MECHS) {
                    foundKerberos |= mechs.contains(mech);
                }

            assertTrue(ctx.isSupported(mech1), "mech1 supported");
            assertTrue(ctx.isPreferredMech(mech1), "first supported is preferred");
            assertArrayEquals(new ASN1ObjectIdentifier[] { mech1, mech2 }, ctx.getSupportedMechs(), "supported mechs");

            // MIC roundtrip: calculate then verify
            byte[] data = new byte[] { 10, 20, 30 };