@Override
        protected SaslClientAuthenticator buildClientAuthenticator(Map<String, ?> configs,
                AuthenticateCallbackHandler callbackHandler, String id, String serverHost, String servicePrincipal,
                TransportLayer transportLayer, Subject subject) {
            if (++numInvocations == 1)
                return new SaslClientAuthenticator(configs, callbackHandler, id, subject, servicePrincipal, serverHost,
                        "DIGEST-MD5", true, transportLayer, time, new LogContext());
            else
                return new SaslClientAuthenticator(configs, callbackHandler, id, subject, servicePrincipal, serverHost,
                        "PLAIN", true, transportLayer, time, new LogContext()) {
                    @Override
                    protected SaslHandshakeRequest createSaslHandshakeRequest(short version) {
                        return new SaslHandshakeRequest.Builder(
                                new SaslHandshakeRequestData().setMechanism("PLAIN")).build(version);
                    }
                };
        }
Tests that Kafka ApiVersionsRequests are handled by the SASL server authenticator
prior to SASL handshake flow and that subsequent authentication succeeds
when transport layer is PLAINTEXT/SSL. This test uses a non-SASL client that simulates
SASL authentication after ApiVersionsRequest.
<p>
Test sequence (using <tt>securityProtocol=PLAINTEXT</tt> as an example):
<ol>
  <li>Starts a SASL_PLAINTEXT test server that simply echoes back client requests after authentication.</li>
  <li>A (non-SASL) PLAINTEXT test client connects to the SASL server port. Client is now unauthenticated.<./li>
  <li>The unauthenticated non-SASL client sends an ApiVersionsRequest and validates the response.
      A valid response indicates that {@link SaslServerAuthenticator} of the test server responded to
      the ApiVersionsRequest even though the client is not yet authenticated.</li>
  <li>The unauthenticated non-SASL client sends a SaslHandshakeRequest and validates the response. A valid response
      indicates that {@link SaslServerAuthenticator} of the test server responded to the SaslHandshakeRequest
      after processing ApiVersionsRequest.</li>
  <li>The unauthenticated non-SASL client sends the SASL/PLAIN packet containing username/password to authenticate
      itself. The client is now authenticated by the server. At this point this test client is at the
      same state as a regular SASL_PLAINTEXT client that is <tt>ready</tt>.</li>
  <li>The authenticated client sends random data to the server and checks that the data is echoed
      back by the test server (ie, not Kafka request-response) to ensure that the client now
      behaves exactly as a regular SASL_PLAINTEXT client that has completed authentication.</li>
</ol>
clients/src/test/java/org/apache/kafka/common/security/authenticator/SaslAuthenticatorTest.java