*
 * This class provides Single Sign-On (SSO) authentication using the SPNEGO protocol,
 * which is commonly used for Kerberos-based authentication in Windows environments.
 * It handles the negotiation between client and server to establish a secure
 * authentication context without requiring users to explicitly enter credentials.
 *
 * The authenticator supports various configuration options including delegation,

     * expires an encapsulating TransportException will be thrown from connect
     * and the transport will be in error.
     */

    /**
     * Establish the transport connection
     *
     * @throws Exception if the connection fails
     */
    protected abstract void doConnect() throws Exception;

    /*

</p>

<p>
If the effects of a goroutine must be observed by another goroutine,
use a synchronization mechanism such as a lock or channel
communication to establish a relative ordering.
</p>

<h3 id="chan">Channel communication</h3>

<p>
Channel communication is the main method of synchronization
between goroutines.  Each send on a particular channel

                throw new NbtException(NbtException.ERR_SSN_SRVC, 0);
            }
        } while ((calledName.name = address.nextCalledName()) != null);

        throw new IOException("Failed to establish session with " + address);
    }

    private void negotiate(int port, final ServerMessageBlock resp) throws IOException {
        /* We cannot use Transport.sendrecv() yet because

    would cause OkHttp to crash when they were included in a request.
 *  Fix: Release duplicated multiplexed connections. If we concurrently establish connections to an
    HTTP/2 server, close all but the first connection.
 *  Fix: Fail the HTTP/2 connection if first frame isn't `SETTINGS`.
 *  Fix: Forbid spaces in header names.

    /**
     * Whether to use SMB3 multi-channel support for improved performance and redundancy
     */
    protected boolean useMultiChannel;
    /**
     * Maximum number of SMB3 channels to establish per session
     */
    protected int maxChannels;
    /**
     * Channel binding policy: -1=not set, 0=disabled, 1=preferred, 2=required
     */

		return
	}

	if !globalIAMSys.STSTLSConfig.Enabled {
		writeSTSErrorResponse(ctx, w, ErrSTSNotInitialized, errors.New("STS API 'AssumeRoleWithCertificate' is disabled"))
		return
	}

	// We have to establish a TLS connection and the
	// client must provide exactly one client certificate.
	// Otherwise, we don't have a certificate to verify or
	// the policy lookup would ambiguous.
	if r.TLS == nil {

                throw new NbtException(NbtException.ERR_SSN_SRVC, 0);
            }
        } while ((calledName.name = this.address.nextCalledName(tc)) != null);

        throw new IOException("Failed to establish session with " + this.address);
    }

    private SmbNegotiation negotiate(int prt) throws IOException {
        /*
         * We cannot use Transport.sendrecv() yet because

            }
            SmbTreeImpl t = new SmbTreeImpl(this, share, service);
            t.acquire();
            this.trees.add(t);
            return t;
        }
    }

    /**
     * Establish a tree connection with the configured logon share
     *
     * @throws SmbException
     */
    @Override
    public void treeConnectLogon() throws SmbException {

      }

    /**
     * Sets the certificate pinner that constrains which certificates are trusted. By default HTTPS
     * connections rely on only the [SSL socket factory][sslSocketFactory] to establish trust.
     * Pinning certificates avoids the need to trust certificate authorities.
     */
    fun certificatePinner(certificatePinner: CertificatePinner) =
      apply {