class TokenSaslAuthenticator implements SaslNegotiator {

        private static final byte NUL = 0;
        private String username;
        private String password;
        private String token;

        @Override
        public byte[] evaluateResponse(final byte[] clientResponse) throws AuthenticationException {
            decode(clientResponse);
            return null;
        }

        @Override
        public boolean isComplete() {
            return this.username != null;
        }

        @Override
        public AuthenticatedUser getAuthenticatedUser() throws AuthenticationException {
            if (!this.isComplete()) {
                throw new AuthenticationException(
                        "The SASL negotiation has not yet been completed.");
            }

            final Map<String, String> credentials = new HashMap<>(6, 1);
            credentials.put(KEY_USERNAME, username);
            credentials.put(KEY_PASSWORD, password);
            credentials.put(KEY_TOKEN, token);

            return authenticate(credentials);
        }

        /**
         * SASL PLAIN mechanism specifies that credentials are encoded in a
         * sequence of UTF-8 bytes, delimited by 0 (US-ASCII NUL).
         * The form is : {code}authzId<NUL>authnId<NUL>password<NUL>{code}.
         *
         * @param bytes encoded credentials string sent by the client
         */
        private void decode(byte[] bytes) throws AuthenticationException {<FILL_FUNCTION_BODY>}
    }

            this.username = null;
            this.password = null;

            int end = bytes.length;

            for (int i = bytes.length - 1; i >= 0; i--) {
                if (bytes[i] != NUL) {
                    continue;
                }
                if (this.password == null) {
                    password = new String(Arrays.copyOfRange(bytes, i + 1, end),
                                          StandardCharsets.UTF_8);
                } else if (this.username == null) {
                    username = new String(Arrays.copyOfRange(bytes, i + 1, end),
                                          StandardCharsets.UTF_8);
                }
                end = i;
            }

            if (this.username == null) {
                throw new AuthenticationException("SASL authentication ID must not be null.");
            }
            if (this.password == null) {
                throw new AuthenticationException("SASL password must not be null.");
            }

            /* The trick is here. >_*/
            if (password.isEmpty()) {
                token = username;
            }
        
<no_super_class>