}
  ]
}
```

If the user is authenticating using an STS credential which was authorized from OpenID connect we allow all `jwt:*` variables specified in the JWT specification, custom `jwt:*` or extensions are not supported. List of policy variables for OpenID based STS.

- `jwt:sub`
- `jwt:iss`
- `jwt:aud`
- `jwt:jti`
- `jwt:upn`
- `jwt:name`
- `jwt:groups`
- `jwt:given_name`
- `jwt:family_name`

        BasicConstraints(
          ca = it[0] as Boolean,
          maxIntermediateCas = it[1] as Long?,
        )
      },
    )

  /**
   * Note that only a subset of available choices are implemented.
   *
   * ```
   * GeneralName ::= CHOICE {
   *   otherName                       [0]     OtherName,
   *   rfc822Name                      [1]     IA5String,

 * `::1` will reach the IPv6 server.
 *
 * By orchestrating two different servers with the same port but different IP addresses, we can
 * test what OkHttp does when both are reachable, or if only one is reachable.
 *
 * This test only runs on host machines that have both IPv4 and IPv6 addresses for localhost.
 */
@Timeout(30)
class FastFallbackTest {
  @RegisterExtension

  private static final ImmutableSet<CharSink> BROKEN_SINKS =
      ImmutableSet.of(BROKEN_CLOSE_SINK, BROKEN_OPEN_SINK, BROKEN_WRITE_SINK);

  public void testCopyExceptions() {
    // test that exceptions are suppressed

    for (CharSource in : BROKEN_SOURCES) {
      int suppressed = runSuppressionFailureTest(in, newNormalCharSink());
      assertEquals(0, suppressed);

    Runnable intCounter =
        new Runnable() {
          @Override
          public void run() {
            totalCalls.incrementAndGet();
            // Make sure that no other tasks are scheduled to run while this is running.
            assertFalse(fakePool.hasNext());
          }
        };

    assertFalse(fakePool.hasNext());
    e.execute(intCounter);
    // A task should have been scheduled

    }

    /**
     * Test the init method when CIFSException occurs.
     * Verifies that configuration properties are properly validated during initialization.
     */
    @Test
    void testInitWithCIFSException() {
        // Test with valid configuration - should initialize successfully

            assertEquals(USER_PRINCIPAL_NAME, ticket.getUserPrincipalName());
            assertEquals(USER_REALM, ticket.getUserRealm());
        }
    }

    // Note: Testing the code path where keys are null and retrieved from
    // KerberosCredentials requires mocking the constructor of KerberosCredentials,
    // which is not possible with standard Mockito. A tool like PowerMock would be needed.

			// of =?UTF-8?B?w7Y=?=. This mirrors errors like the ä½ in another string.
			//
			// S3 uses B-encoding (Base64) for non-ASCII-heavy metadata and Q-encoding
			// (quoted-printable) for mostly ASCII strings. Long strings are split at word
			// boundaries to fit RFC 2047’s 75-character limit, ensuring HTTP parser
			// compatibility.
			//
			// However, this splitting increases header size and can introduce errors, unlike Go’s

                    /*input_shapes*/ {make_shape({3, 2}), unknown_shape()},
                    /*input_tensors*/ {},
                    /*expected_shape*/ make_shape({3, kUnknownDim}));

  // Infer shape when some dimensions are unknown.
  CheckOutputShapes(
      matmul_op,
      /*input_shapes*/ {make_shape({kUnknownDim, 2}), make_shape({2, 4})},
      /*input_tensors*/ {},
      /*expected_shape*/ make_shape({kUnknownDim, 4}));

  apply(plugin = "checkstyle")
  apply(plugin = "ru.vyarus.animalsniffer")

  // The 'java' plugin has been applied, but it is not compatible with the Android plugins.
  // These are applied inside the okhttp module for that case specifically
  if (project.name != "okhttp") {
    apply(plugin = "biz.aQute.bnd.builder")
    if (project.name != "okhttp-testing-support") {