public Map<String, Object> valuesWithPrefixOverride(String prefix) {
        Map<String, Object> result = new RecordingMap<>(values(), prefix, true);
        for (Map.Entry<String, ?> entry : originals.entrySet()) {
            if (entry.getKey().startsWith(prefix) && entry.getKey().length() > prefix.length()) {
                String keyWithNoPrefix = entry.getKey().substring(prefix.length());
                ConfigDef.ConfigKey configKey = definition.configKeys().get(keyWithNoPrefix);
                if (configKey != null)
                    result.put(keyWithNoPrefix, definition.parseValue(configKey, entry.getValue(), true));
                else {
                    String keyWithNoSecondaryPrefix = keyWithNoPrefix.substring(keyWithNoPrefix.indexOf('.') + 1);
                    configKey = definition.configKeys().get(keyWithNoSecondaryPrefix);
                    if (configKey != null)
                        result.put(keyWithNoPrefix, definition.parseValue(configKey, entry.getValue(), true));
                }
            }
        }
        return result;
    }
@Test
    public void testValuesWithPrefixOverride() {
        String prefix = "prefix.";
        Properties props = new Properties();
        props.put("sasl.mechanism", "PLAIN");
        props.put("prefix.sasl.mechanism", "GSSAPI");
        props.put("prefix.sasl.kerberos.kinit.cmd", "/usr/bin/kinit2");
        props.put("prefix.ssl.truststore.location", "my location");
        props.put("sasl.kerberos.service.name", "service name");
        props.put("ssl.keymanager.algorithm", "algorithm");
        TestSecurityConfig config = new TestSecurityConfig(props);
        Map<String, Object> valuesWithPrefixOverride = config.valuesWithPrefixOverride(prefix);

        // prefix overrides global
        assertTrue(config.unused().contains("prefix.sasl.mechanism"));
        assertTrue(config.unused().contains("sasl.mechanism"));
        assertEquals("GSSAPI", valuesWithPrefixOverride.get("sasl.mechanism"));
        assertFalse(config.unused().contains("sasl.mechanism"));
        assertFalse(config.unused().contains("prefix.sasl.mechanism"));

        // prefix overrides default
        assertTrue(config.unused().contains("prefix.sasl.kerberos.kinit.cmd"));
        assertFalse(config.unused().contains("sasl.kerberos.kinit.cmd"));
        assertEquals("/usr/bin/kinit2", valuesWithPrefixOverride.get("sasl.kerberos.kinit.cmd"));
        assertFalse(config.unused().contains("sasl.kerberos.kinit.cmd"));
        assertFalse(config.unused().contains("prefix.sasl.kerberos.kinit.cmd"));

        // prefix override with no default
        assertTrue(config.unused().contains("prefix.ssl.truststore.location"));
        assertFalse(config.unused().contains("ssl.truststore.location"));
        assertEquals("my location", valuesWithPrefixOverride.get("ssl.truststore.location"));
        assertFalse(config.unused().contains("ssl.truststore.location"));
        assertFalse(config.unused().contains("prefix.ssl.truststore.location"));

        // global overrides default
        assertTrue(config.unused().contains("ssl.keymanager.algorithm"));
        assertEquals("algorithm", valuesWithPrefixOverride.get("ssl.keymanager.algorithm"));
        assertFalse(config.unused().contains("ssl.keymanager.algorithm"));

        // global with no default
        assertTrue(config.unused().contains("sasl.kerberos.service.name"));
        assertEquals("service name", valuesWithPrefixOverride.get("sasl.kerberos.service.name"));
        assertFalse(config.unused().contains("sasl.kerberos.service.name"));

        // unset with default
        assertFalse(config.unused().contains("sasl.kerberos.min.time.before.relogin"));
        assertEquals(SaslConfigs.DEFAULT_KERBEROS_MIN_TIME_BEFORE_RELOGIN,
                valuesWithPrefixOverride.get("sasl.kerberos.min.time.before.relogin"));
        assertFalse(config.unused().contains("sasl.kerberos.min.time.before.relogin"));

        // unset with no default
        assertFalse(config.unused().contains("ssl.key.password"));
        assertNull(valuesWithPrefixOverride.get("ssl.key.password"));
        assertFalse(config.unused().contains("ssl.key.password"));
    }