code: @Sensitive
      public static byte[] decodeLTPAToken(Codec codec, @Sensitive byte[] token_arr) throws SASException {
          byte[] ltpaTokenBytes = null;
  
          try {
              byte[] data = readGSSTokenData(LTPAMech.LTPA_OID.substring(4), token_arr);
              if (data != null) {
                  // Check if it is double-encoded WAS classic token and get the encoded ltpa token bytes
                  if (isGSSToken(LTPAMech.LTPA_OID.substring(4), data)) {
                      data = readGSSTokenData(LTPAMech.LTPA_OID.substring(4), data);
                  }
  
                  Any any = codec.decode_value(data, org.omg.Security.OpaqueHelper.type());
                  ltpaTokenBytes = org.omg.Security.OpaqueHelper.extract(any);
              }
          } catch (Exception ex) {
              // TODO: Modify SASException to take a message?
              throw new SASException(2, ex);
          }
          if (ltpaTokenBytes == null || ltpaTokenBytes.length == 0) {
              throw new SASException(2);
          }
          return ltpaTokenBytes;
      }
docs: WAS classic encodes the GSSToken containing the encoded LTPA token inside another GSSToken.
  This code detects if there is another GSSToken inside the GSSToken,
  obtains the internal LTPA token bytes, and decodes them.
  
  @param codec The codec to do the encoding of the Any.
  @param token_arr the bytes of the GSS token to decode.
  
  @return the LTPA token bytes.