verify(response, never()).setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        }
    }

    /**
     * Test the service method with NTLM authentication that fails.
     * Expects a 401 Unauthorized response.
     * @throws ServletException
     * @throws IOException
     * @throws CIFSException
     */
    @Test
    void testService_NtlmAuth_Failure() throws Exception {

     * Sets up the classpath, JVM options, and command line arguments
     * to launch the ThumbnailGenerator in a separate process.
     *
     * @throws JobProcessingException if the thumbnail generation process fails
     */
    protected void executeThumbnailGenerator() {
        final List<String> cmdList = new ArrayList<>();
        final String cpSeparator = SystemUtils.IS_OS_WINDOWS ? ";" : ":";

    }

    @Test
    void testConstructorWithDecryptionFailure() throws IOException, GeneralSecurityException {
        // Test when decryption fails
        byte[] token = createTestTicketBytes(new BigInteger(KerberosConstants.KERBEROS_VERSION), SERVER_REALM, SERVER_PRINCIPAL_NAME,
                ENCRYPTION_TYPE, ENCRYPTED_DATA, null);

    assertEquals(0, numCalls.get());
    reject.set(false);
    executor.execute(task);
    assertEquals(1, numCalls.get());
  }

  /*
   * Under Android, MyError propagates up and fails the test?
   *
   * TODO(b/218700094): Does this matter to prod users, or is it just a feature of our testing
   * environment? If the latter, maybe write a custom Executor that avoids failing the test when it

    assertThat(verifier.verify("a.bar.com", session)).isFalse()
  }

  /**
   * Ignored due to incompatibilities between Android and Java on how non-ASCII subject alt names
   * are parsed. Android fails to parse these, which means we fall back to the CN. The RI does parse
   * them, so the CN is unused.
   */
  @Test fun verifyNonAsciiSubjectAlt() {
    // Expecting actual:
    //  ["bar.com", "花子.co.jp"]

 *       Future} is "completed" even if it is cancelled while its underlying work continues on a
 *       thread, an RPC, etc. The {@code Future} is also "completed" if it fails "early" -- for
 *       example, if the deadline expires on a {@code Future} returned from {@link
 *       Futures#withTimeout} while the {@code Future} it wraps continues its underlying work. So

   * @return {@link InetAddress} representing the argument
   * @throws IllegalArgumentException if the argument is not a valid IP string literal or if the
   *     address has a scope ID that fails validation against the interfaces on the machine (as
   *     required by Java's {@link InetAddress})
   */
  @CanIgnoreReturnValue // TODO(b/219820829): consider removing

            verify(mockDigest).verify(buffer, 0, 100, 0, echoResponse);
        }

        @Test
        @DisplayName("Should fail signature verification when digest verification fails")
        void testVerifySignatureFailed() throws Exception {
            byte[] buffer = new byte[1024];
            echoResponse.setDigest(mockDigest);
            setStatus(echoResponse, NtStatus.NT_STATUS_SUCCESS);

        buf[i++] = (byte) '\0';
        advance(i - index);
    }

    /**
     * Decodes a string from NDR format.
     *
     * @return the decoded string
     * @throws NdrException if decoding fails
     */
    public String dec_ndr_string() throws NdrException {
        align(4);
        int i = index;
        String val = null;
        int len = Encdec.dec_uint32le(buf, i);
        i += 12;

/**
 * Returns true if new reads and writes should be attempted on this.
 *
 * Unfortunately Java's networking APIs don't offer a good health check, so we go on our own by
 * attempting to read with a short timeout. If the fails immediately we know the socket is
 * unhealthy.
 *
 * @param source the source used to read bytes from the socket.
 */
internal fun Socket.isHealthy(source: BufferedSource): Boolean =
  try {