code: @FFDCIgnore(AuthenticationException.class)
      @Override
      public Subject check(EstablishContext msg, Codec codec) throws SASException {
          Subject authenticationLayerSubject = null;
  
          if (msg != null && msg.client_authentication_token != null && msg.client_authentication_token.length > 0) {
              byte[] decodedTokenBytes = Util.decodeLTPAToken(codec, msg.client_authentication_token);
              // TODO: Determine if target name validation is needed and how to do it.
              try {
                  authenticationLayerSubject = authenticator.authenticate(decodedTokenBytes);
              } catch (AuthenticationException e) {
                  // An exception must be thrown on authentication failure per CSIv2 spec regardless that the mechanism is required or not.
                  throw new SASInvalidEvidenceException(e.getMessage(), SecurityMinorCodes.AUTHENTICATION_FAILED);
              }
          } else {
              if (required) {
                  // TODO: Get translated message.
                  throw new SASInvalidEvidenceException("Client authentication is required at the server, but there was no client authentication token sent by the client.", SecurityMinorCodes.AUTHENTICATION_FAILED);
              }
          }
  
          return authenticationLayerSubject;
      }
docs: {@inheritDoc}