@Test public void doesNotCreateDbRecordForNewClient_whenNotConfigured() {

  ApiDate now = ApiDate.now();
  Client newClient =
      new Client(2345L, "new-client", "desc", null, now, "automatic", now, "automatic",
          null, null, true, false
      );
  // lookup doesn't find client
  when(clientDAO.getClientByName("new-client")).thenReturn(Optional.empty());
  // a new DB record should not be created, but mock the DAO to create a client if called
  when(clientDAO.createClient(eq("new-client"), eq("automatic"), any(), any())).thenReturn(2345L);
  when(clientDAO.getClientById(2345L)).thenReturn(Optional.of(newClient));
  assertThat(authenticator.authenticate(SimplePrincipal.of("CN=new-client"), false)).isEmpty();
  // the authenticator should not have tried to create the new client
  verify(clientDAO, never()).createClient(anyString(), anyString(), anyString(), any());
}