if ( derToken.getTagClass() != BERTags.APPLICATION )
                throw new PACDecodingException("Malformed kerberos ticket");
            stream.close();
        }
        catch ( IOException e ) {
            throw new PACDecodingException("Malformed kerberos ticket", e);
        }

        ASN1Sequence sequence;
        try {
            sequence = ASN1Util.as(ASN1Sequence.class, derToken.getBaseObject());

        ASN1Sequence sequence;
        try {
            try ( ASN1InputStream stream = new ASN1InputStream(new ByteArrayInputStream(token)) ) {
                sequence = ASN1Util.as(ASN1Sequence.class, stream);
            }
        }
        catch ( IOException e ) {
            throw new PACDecodingException("Malformed kerberos ticket", e);
        }

                authSequence = ASN1Util.as(ASN1Sequence.class, stream);
            }
        }
        catch ( IOException e ) {
            throw new PACDecodingException("Malformed kerberos ticket", e);
        }

        this.authorizations = new ArrayList<>();
        Enumeration<?> authElements = authSequence.getObjects();
        while ( authElements.hasMoreElements() ) {

        Kerberos
            ap-req
                pvno: 5
                msg-type: krb-ap-req (14)
                Padding: 0
                ap-options: 20000000
                ticket
                    tkt-vno: 5
                    realm: W2K19SINGLE.SPRINGFIELD
                    sname
                        name-type: kRB5-NT-UNKNOWN (0)
                        sname-string: 2 items

                    throw new PACDecodingException("Malformed Kerberos Ticket");
                try {
                    this.ticket = new KerberosTicket(derTicket.getBaseObject().getEncoded(), this.apOptions, keys);
                } catch (IOException e) {
                    throw new PACDecodingException("Malformed Kerberos Ticket", e);
                }
                break;
            case 4: