@Test public void ignoresMultipleSpiffeIds() throws Exception {

  CertificateFactory cf = CertificateFactory.getInstance("X.509");
  X509Certificate multipleSpiffeClientCert = (X509Certificate) cf.generateCertificate(
      new ByteArrayInputStream(multipleSpiffePem.getBytes(UTF_8)));
  Principal multipleSpiffePrincipal =
      new CertificatePrincipal(multipleSpiffeClientCert.getSubjectDN().toString(),
          new X509Certificate[] {multipleSpiffeClientCert});
  // Use only the (malformatted) SPIFFE IDs to retrieve a client (which should fail)
  when(clientAuthTypeConfig.useCommonName()).thenReturn(false);
  when(clientAuthTypeConfig.useSpiffeId()).thenReturn(true);
  assertThat(authenticator.authenticate(multipleSpiffePrincipal, false)).isEmpty();
  verifyNoInteractions(clientDAO);
}