@Override
    public byte[] unwrap(byte[] incoming, int offset, int len) {
        if (!complete)
            throw new IllegalStateException("Authentication exchange has not completed");
        return Arrays.copyOfRange(incoming, offset, offset + len);
    }
@throws SaslAuthenticationException if username/password combination is invalid or if the requested
        authorization id is not the same as username.
<p>
<b>Note:</b> This method may throw {@link SaslAuthenticationException} to provide custom error messages
to clients. But care should be taken to avoid including any information in the exception message that
should not be leaked to unauthenticated clients. It may be safer to throw {@link SaslException} in
some cases so that a standard error message is returned to clients.
</p>
clients/src/main/java/org/apache/kafka/common/security/plain/internals/PlainSaslServer.java