}

        try ( ASN1InputStream stream = new ASN1InputStream(content) ) {

            ASN1ObjectIdentifier kerberosOid = (ASN1ObjectIdentifier) stream.readObject();
            if ( !kerberosOid.getId().equals(KerberosConstants.KERBEROS_OID) )
                throw new PACDecodingException("Not a kerberos token");


            // yes, there really is non ASN.1/DER data inside the tagged object
            int read = 0;