}

    /**
     * Generates a Type 1 NTLM message.
     *
     * @param domain the domain name
     * @param workstation the workstation name
     * @return the Base64-encoded Type 1 message
     * @throws NTLMEngineException if an NTLM engine error occurs
     */
    @Override
    public String generateType1Msg(final String domain, final String workstation) throws NTLMEngineException {

                final Map<String, String> map = ParameterUtil.parse(fileAuth.getParameters());
                final String domain = map.get("domain");
                smbAuth.setDomain(domain == null ? StringUtil.EMPTY : domain);
                smbAuth.setServer(fileAuth.getHostname());
                smbAuth.setPort(fileAuth.getPort() == null ? -1 : fileAuth.getPort());

     * Retrieves an NTLM challenge from a domain controller for the configured domain.
     *
     * @return the NTLM challenge from the domain controller
     * @throws SmbException if an SMB error occurs
     * @throws UnknownHostException if the domain controller cannot be resolved
     */
    public static NtlmChallenge getChallengeForDomain() throws SmbException, UnknownHostException {
        if (DOMAIN == null) {

     * <p>
     * Specifically, if the SID has
     * been resolved and it is not a domain SID or builtin account,
     * the full DOMAIN\name form of the account will be
     * returned (e.g. MYDOM\alice or MYDOM\Domain Users).
     * If the SID has been resolved but it is is a domain SID,
     * only the domain name will be returned (e.g. MYDOM).
     * If the SID has been resolved but it is a builtin account,

/**
 * Handle for Security Account Manager (SAM) domain operations.
 * This class represents an open handle to a SAM domain and provides
 * operations for managing domain users, groups, and aliases.
 */
public class SamrDomainHandle extends rpc.policy_handle implements AutoCloseable {

    private final DcerpcHandle handle;
    private boolean opened;

    /**
     * Creates a new SAM domain handle.
     *

        serverData.encryptionKeyLength = 8;
        response.byteCount = 15; // 8 bytes key + 6 bytes "DOMAIN" + 1 null terminator

        // Prepare byte array
        byte[] encryptionKey = "12345678".getBytes();
        byte[] domainNameBytes = "DOMAIN".getBytes(ServerMessageBlock.OEM_ENCODING);
        ByteBuffer buffer = ByteBuffer.allocate(response.byteCount);
        buffer.put(encryptionKey);

     * @param domain
     *            domain for NTLM fallback
     * @param username
     *            user for NTLM fallback
     * @param password
     *            password for NTLM fallback
     */
    public Kerb5Authenticator(Subject subject, String domain, String username, String password) {
        super(domain, username, password);
        this.canFallback = true;

        // Add dummy NT response (24 zeros at offset 88)
        for (int i = 0; i < 24; i++) {
            message[88 + i] = 0;
        }

        // Add Domain "DOMAIN" in Unicode at offset 112
        String domain = "DOMAIN";
        byte[] domainBytes = domain.getBytes();
        for (int i = 0; i < domainBytes.length; i++) {
            message[112 + i * 2] = domainBytes[i];
            message[112 + i * 2 + 1] = 0;

        String password = "testpassword";
        String domain = "TESTDOMAIN";
        String username = "testuser";
        String workstation = "TESTWS";
        int flags = NtlmFlags.NTLMSSP_NEGOTIATE_UNICODE | NtlmFlags.NTLMSSP_NEGOTIATE_NTLM;

        // When
        Type3Message type3 = new Type3Message(createMockContext(), type2, null, password, domain, username, workstation, flags);

        // Then

        assertEquals("secret", new String(pc.getPassword()));
    }

    @Test
    @DisplayName("handle: empty user/domain edge yields '@' and null password")
    void testHandleWithEmptyUserAndDomainEdge() throws Exception {
        // Default constructor results in empty strings for user and domain, null for password
        JAASAuthenticator auth = new JAASAuthenticator();
        NameCallback nc = new NameCallback("user:");