@Test
    public void testEmptyInitialResponse() throws Exception
    {
        // Setup test fixture.
        final String streamID = "example.org";

        when(session.getSessionData(SASLAuthentication.SASL_LAST_RESPONSE_WAS_PROVIDED_BUT_EMPTY)).thenReturn(true);
        when(session.getDefaultIdentity()).thenReturn(streamID);
        when(session.getConnection()).thenReturn(connection);
        saslAuthentication.when(() -> SASLAuthentication.verifyCertificates(any(), eq(streamID), anyBoolean())).thenReturn(true);

        final ExternalServerSaslServer server = new ExternalServerSaslServer(session);
        final byte[] input = new byte[]{};

        // Execute system under test.
        final byte[] response = server.evaluateResponse(input);

        // Verify results.
        assertNull(response); // This asserts for successful authentication, rather than 'not a challenge'.
    }
Verify that when an empty initial response is given, authentication continues (and succeeds, provided that the
provided TLS certificates are valid), without a challenge (for authzid) being returned.

The presence of an <em>empty</em> initial response is represented by a null value being provided as the response
to be evaluated, while the provided session defines this session attribute: {@link SASLAuthentication#SASL_LAST_RESPONSE_WAS_PROVIDED_BUT_EMPTY}
xmppserver/src/test/java/org/jivesoftware/openfire/sasl/ExternalServerSaslServerTest.java