}

            ASN1TaggedObject mechToken = ASN1Util.as(ASN1TaggedObject.class, stream.readObject());
            if (mechToken == null || mechToken.getTagClass() != BERTags.APPLICATION
                    || !(mechToken.getBaseObject() instanceof ASN1Sequence)) {
                throw new PACDecodingException("Malformed kerberos token");
            }

                this.apOptions = bitString.getBytes()[0];
                break;
            case 3:
                ASN1TaggedObject derTicket = ASN1Util.as(ASN1TaggedObject.class, tagged);
                if (derTicket.getTagClass() != BERTags.APPLICATION) {
                    throw new PACDecodingException("Malformed Kerberos Ticket");
                }
                try {

        try (ASN1InputStream is = new ASN1InputStream(token)) {
            final ASN1TaggedObject constructed = (ASN1TaggedObject) is.readObject();
            if (constructed == null || constructed.getTagClass() != BERTags.APPLICATION
                    || !(constructed.getBaseObject() instanceof ASN1Sequence)) {
                throw new IOException("Malformed SPNEGO token " + constructed);
            }

        ASN1TaggedObject derToken;
        try {
            derToken = ASN1Util.as(ASN1TaggedObject.class, stream);
            if (derToken.getTagClass() != BERTags.APPLICATION) {
                throw new PACDecodingException("Malformed kerberos ticket");
            }
            stream.close();
        } catch (IOException e) {

            assertTrue(obj instanceof ASN1TaggedObject, "Top-level should be tagged (APPLICATION)");
            ASN1TaggedObject top = (ASN1TaggedObject) obj;
            assertEquals(BERTags.APPLICATION, top.getTagClass(), "Top-level tag class should be APPLICATION");
            assertEquals(0, top.getTagNo(), "Top-level tag number should be 0");