}

            ASN1TaggedObject mechToken = ASN1Util.as(ASN1TaggedObject.class, stream.readObject());
            if (mechToken == null || mechToken.getTagClass() != BERTags.APPLICATION
                    || !(mechToken.getBaseObject() instanceof ASN1Sequence)) {
                throw new PACDecodingException("Malformed kerberos token");
            }

        try (ASN1InputStream is = new ASN1InputStream(token)) {
            final ASN1TaggedObject constructed = (ASN1TaggedObject) is.readObject();
            if (constructed == null || constructed.getTagClass() != BERTags.APPLICATION
                    || !(constructed.getBaseObject() instanceof ASN1Sequence)) {
                throw new IOException("Malformed SPNEGO token " + constructed);
            }

                this.apOptions = bitString.getBytes()[0];
                break;
            case 3:
                ASN1TaggedObject derTicket = ASN1Util.as(ASN1TaggedObject.class, tagged);
                if (derTicket.getTagClass() != BERTags.APPLICATION) {
                    throw new PACDecodingException("Malformed Kerberos Ticket");
                }
                try {

        ASN1TaggedObject derToken;
        try {
            derToken = ASN1Util.as(ASN1TaggedObject.class, stream);
            if (derToken.getTagClass() != BERTags.APPLICATION) {
                throw new PACDecodingException("Malformed kerberos ticket");
            }
            stream.close();
        } catch (IOException e) {