}
	if !sa.Credentials.IsServiceAccount() {
		return UserIdentity{}, nil, errNoSuchServiceAccount
	}

	var embeddedPolicy *policy.Policy

	pt, ptok := jwtClaims.Lookup(iamPolicyClaimNameSA())
	sp, spok := jwtClaims.Lookup(policy.SessionPolicyName)
	if ptok && spok && pt == embeddedPolicyType {
		policyBytes, err := base64.StdEncoding.DecodeString(sp)
		if err != nil {
			return UserIdentity{}, nil, err
		}

	nesting := 0
	var tokens []Token
	for {
		tok := in.Stack.Next()
		if tok == scanner.EOF || tok == '\n' {
			in.Error("unterminated arg list invoking macro:", macro.name)
		}
		if nesting == 0 && (tok == ')' || tok == ',') {
			return tokens, tok
		}
		if tok == '(' {
			nesting++
		}
		if tok == ')' {
			nesting--
		}
		tokens = append(tokens, Make(tok, in.Stack.Text()))
	}
}

			if tok == '\n' || tok == ';' || (nesting == 0 && (tok == ',' || tok == ':')) {
				if tok == ':' {
					// Remember this location so we can swap the operands below.
					if colon >= 0 {
						p.errorf("invalid ':' in operand")
						return word, cond, operands, true
					}
					colon = len(operands)
				}
				break
			}
			if tok == '(' || tok == '[' {
				nesting++
			}
			if tok == ')' || tok == ']' {

                if (minorVersion == null) {
                    fallback = true;
                }
            }
            if (idx < tok.length) {
                incrementalVersion = getNextIntegerToken(tok[idx++]);
                if (incrementalVersion == null) {
                    fallback = true;
                }
            }
            if (idx < tok.length) {
                qualifier = tok[idx++];

            StringBuilder tokBuf = new StringBuilder(10);
            String tok;
            boolean inQuote = false;
            boolean tokStarted = false;
            boolean exit = false;
            while ((st.hasMoreTokens()) && (!exit)) {
                tok = st.nextToken(tokenList);
                switch (tok) {
                    case "\"":
                        inQuote = !inQuote;

		result := int64(p.expr())
		if result != test.output {
			t.Errorf("%d: %q evaluated to %d; expected %d", i, test.input, result, test.output)
		}
		tok := p.next()
		if test.atEOF && tok.ScanToken != scanner.EOF {
			t.Errorf("%d: %q: at EOF got %s", i, test.input, tok)
		} else if !test.atEOF && tok.ScanToken == scanner.EOF {
			t.Errorf("%d: %q: expected not EOF but at EOF", i, test.input)
		}
	}
}

type badExprTest struct {

}

// drain returns a single string representing the processed input tokens.
func drain(input *Input) string {
	var buf strings.Builder
	for {
		tok := input.Next()
		if tok == scanner.EOF {
			return buf.String()
		}
		if tok == '#' {
			continue
		}
		if buf.Len() > 0 {
			buf.WriteByte('.')
		}
		buf.WriteString(input.Text())
	}
}

type badLexTest struct {

func Tokenize(str string) []Token {
	t := NewTokenizer("command line", strings.NewReader(str), nil)
	var tokens []Token
	for {
		tok := t.Next()
		if tok == scanner.EOF {
			break
		}
		tokens = append(tokens, Make(tok, t.Text()))
	}
	return tokens

            KerberosKey[] keys = kt.getKeys(new KerberosPrincipal("cifs/******@****.***FIELD", KerberosPrincipal.KRB_NT_PRINCIPAL));
            KerberosToken tok = new KerberosToken(krbToken, keys);

            KerberosEncData ed = tok.getTicket().getEncData();
            Assert.assertEquals(1, ed.getUserAuthorizations().size());

						var resultErrno, expectErrno uintptr
						if pathErr, ok := err.(*os.PathError); ok {
							if errno, pok := pathErr.Err.(syscall.Errno); pok {
								resultErrno = uintptr(errno)
							}
						}
						if pathErr, ok := testCase.expectedErr.(*os.PathError); ok {
							if errno, pok := pathErr.Err.(syscall.Errno); pok {
								expectErrno = uintptr(errno)
							}
						}