Kerb5Authenticator auth = new Kerb5Authenticator((Subject) null);

        // Build a token with an arbitrary non-kerberos mechanism OID
        ASN1ObjectIdentifier unsupported = new ASN1ObjectIdentifier("1.2.3.4.5");
        byte[] init = spnegoInitWithMechs(unsupported);

        // Host is a FQDN to pass the short-name check
        SmbUnsupportedOperationException ex =

    private boolean canFallback = false;
    /** Flag to force fallback authentication */
    private boolean forceFallback;

    static {
        PREFERRED_MECHS.add(new ASN1ObjectIdentifier("1.2.840.113554.1.2.2"));
        PREFERRED_MECHS.add(new ASN1ObjectIdentifier("1.2.840.48018.1.2.2"));
    }

    /**
     * Construct a <code>Kerb5Authenticator</code> object with <code>Subject</code>

     * @see jcifs.smb.SSPContext#isSupported(org.bouncycastle.asn1.ASN1ObjectIdentifier)
     */
    @Override
    public boolean isSupported(final ASN1ObjectIdentifier mechanism) {
        return NTLMSSP_OID.equals(mechanism);
    }

    /**
     * {@inheritDoc}
     *
     * @see jcifs.smb.SSPContext#isPreferredMech(org.bouncycastle.asn1.ASN1ObjectIdentifier)
     */
    @Override

class NegTokenTargTest {

    @Test
    @DisplayName("happy path – full token round‑trip")
    void testRoundTripFull() throws IOException {
        // Arrange – create a fully populated token
        ASN1ObjectIdentifier mech = new ASN1ObjectIdentifier("1.2.840.113554.1.2.2");
        byte[] tokenArray = new byte[] { 1, 2, 3 };
        byte[] mic = new byte[] { 9, 9, 9 };

     */
    boolean isSupported(ASN1ObjectIdentifier mechanism);

    /**
     * Checks whether the specified mechanism is the preferred mechanism.
     * @param selectedMech the selected mechanism OID
     * @return whether the specified mechanism is preferred
     */
    boolean isPreferredMech(ASN1ObjectIdentifier selectedMech);

    /**
     * Gets the negotiated context flags.

            throw new PACDecodingException("Malformed kerberos token", e);
        }

        try (ASN1InputStream stream = new ASN1InputStream(content)) {

            ASN1ObjectIdentifier kerberosOid = (ASN1ObjectIdentifier) stream.readObject();
            if (!kerberosOid.getId().equals(KerberosConstants.KERBEROS_OID)) {
                throw new PACDecodingException("Not a kerberos token");
            }

        f.setAccessible(true);
        f.set(target, value);
    }

    static ASN1ObjectIdentifier[] supportedMechs() {
        return Kerb5Context.SUPPORTED_MECHS;
    }

    @ParameterizedTest
    @MethodSource("supportedMechs")
    @DisplayName("isSupported returns true for supported OIDs")
    void isSupported_supportedOids(ASN1ObjectIdentifier oid) {
        assertTrue(ctx.isSupported(oid));

import java.util.Arrays;
import java.util.HashSet;
import java.util.Map;
import java.util.Objects;
import java.util.Set;

import javax.security.auth.Subject;

import org.bouncycastle.asn1.ASN1ObjectIdentifier;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import jcifs.CIFSContext;
import jcifs.CIFSException;
import jcifs.Credentials;
import jcifs.RuntimeCIFSException;