- `Token Claim Name` is `policy`
    - `Claim JSON Type` is `string`
  - Save

- Open <http://localhost:8080/auth/realms/{your-realm-name}/.well-known/openid-configuration> to verify OpenID discovery document, verify it has `authorization_endpoint` and `jwks_uri`

### Enable Keycloak Admin REST API support

            int expected = NegTokenInit.DELEGATION | NegTokenInit.INTEGRITY | NegTokenInit.CONFIDENTIALITY;
            assertEquals(expected, init.getContextFlags());

            // Verify each flag individually
            assertTrue(init.getContextFlag(NegTokenInit.DELEGATION));
            assertTrue(init.getContextFlag(NegTokenInit.INTEGRITY));

      // block for session establishment
      val sslSocketSession = sslSocket.session
      val unverifiedHandshake = sslSocketSession.handshake()

      // Verify that the socket's certificates are acceptable for the target host.
      if (!address.hostnameVerifier!!.verify(address.url.host, sslSocketSession)) {
        val peerCertificates = unverifiedHandshake.peerCertificates
        if (peerCertificates.isNotEmpty()) {

              <artifactId>maven-gpg-plugin</artifactId>
              <version>3.2.8</version>
              <executions>
                <execution>
                  <id>sign-artifacts</id>
                  <phase>verify</phase>
                  <goals>
                    <goal>sign</goal>
                  </goals>
                </execution>
              </executions>
            </plugin>
          </plugins>

		return
	}

	certificate := r.TLS.PeerCertificates[0]
	if !globalIAMSys.STSTLSConfig.InsecureSkipVerify { // Verify whether the client certificate has been issued by a trusted CA.
		_, err := certificate.Verify(x509.VerifyOptions{
			KeyUsages: []x509.ExtKeyUsage{
				x509.ExtKeyUsageClientAuth,
			},
			Intermediates: intermediates,
			Roots:         globalRootCAs,
		})

        final ExtractData result = filenameExtractor.getText(in, params);

        assertNotNull(result);
        assertEquals("filename.txt", result.getContent());
        // Verify stream was not consumed
        assertEquals(testData.length, in.available());
    }

    /**
     * Test extraction with empty string filename.
     */
    public void test_getText_withEmptyFilename() {

     * This test ensures that the constructor runs without errors and correctly initializes the object.
     * The wildcard parameter is stored but its filtering logic is handled server-side,
     * so we only verify its acceptance here.
     */
    @Test
    void testConstructor() {
        // The constructor should not throw any exceptions with valid inputs.
        new DosFileFilter("*.*", SmbFile.ATTR_ARCHIVE);

    val signedData = CertificateAdapters.tbsCertificate.toDer(tbsCertificate)

    return Signature.getInstance(tbsCertificate.signatureAlgorithmName).run {
      initVerify(issuer)
      update(signedData.toByteArray())
      verify(signatureValue.byteString.toByteArray())
    }
  }

  fun toX509Certificate(): X509Certificate {
    val data = CertificateAdapters.certificate.toDer(this)
    try {

    suite.addTestSuite(ImmutableTypeToInstanceMapTest.class);

    suite.addTest(
        MapTestSuiteBuilder.using(
                new TestTypeToInstanceMapGenerator() {
                  // Other tests will verify what real, warning-free usage looks like
                  // but here we have to do some serious fudging
                  @Override
                  @SuppressWarnings({"unchecked", "rawtypes"})

    }

    @Override
    protected Executor executor() {
      transitionStates.add(state());
      return directExecutor();
    }
  }

  // Functional tests using real thread. We only verify publicly visible state.
  // Interaction assertions are done by the single-threaded unit tests.

  private static class DefaultService extends AbstractIdleService {
    @Override