authenticator = authenticators.NewDiegoProxyAuthenticator(logger, receptorClient, receptorCreds)

		metadata = &fake_ssh.FakeConnMetadata{}
	})

	Describe("Authenticate", func() {
		var (
			permissions *ssh.Permissions
			password    []byte
			authErr     error
		)

		BeforeEach(func() {
			ipAddr, err := net.ResolveIPAddr("ip", "1.1.1.1")
			Expect(err).NotTo(HaveOccurred())
			metadata.RemoteAddrReturns(ipAddr)

			permissions = nil
			password = []byte{}
		})

		JustBeforeEach(func() {
			permissions, authErr = authenticator.Authenticate(metadata, password)
		})

		Context("when a client attempts to authenticate with a user and password", func() {
			Context("when the user name starts with 'diego:'", func() {
				BeforeEach(func() {
					metadata.UserReturns("diego:some-guid/0")
					password = []byte("receptor-user:receptor-password")
				})