assertTrue(ex.getMessage().contains("Refreshing credentials is not supported"));
    }

    @Test
    @DisplayName("clone: copies all relevant fields")
    void clone_copiesFields() {
        Subject subj = new Subject();
        Kerb5Authenticator auth = new Kerb5Authenticator(subj, "DOM", "user", "pass");
        auth.setUser("alice");
        auth.setRealm("EXAMPLE.COM");