assertFalse(auth.isGuest());
    }

    @ParameterizedTest
    @EnumSource(SubjectVariant.class)
    @DisplayName("getSubject: caches results and refresh resets cache")
    void testGetSubjectLoginFailuresCacheAndRefresh(SubjectVariant variant) throws Exception {
        JAASAuthenticator auth = buildAuthenticator(variant);

        // First call attempts a JAAS login; behavior depends on JAAS configuration