diff --git a/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/KerberosAuthenticationManager.java b/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/KerberosAuthenticationManager.java
index 69a9776..b1f13f5 100644
--- a/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/KerberosAuthenticationManager.java
+++ b/broker-core/src/main/java/org/apache/qpid/server/security/auth/manager/KerberosAuthenticationManager.java
@@ -115,13 +115,20 @@
     {
         super.validateOnCreate();
         validate(this);
+
+        if (_container.getChildren(AuthenticationProvider.class)
+                .stream()
+                .anyMatch(p -> p instanceof KerberosAuthenticationManager && p != this))
+        {
+            throw new IllegalConfigurationException("Another Kerberos authentication provider already exists."
+                    + " Only one Kerberos authentication provider can be created.");
+        }
     }
 
     @Override
     protected void validateChange(final ConfiguredObject<?> proxyForValidation, final Set<String> changedAttributes)
     {
         super.validateChange(proxyForValidation, changedAttributes);
-        validate(proxyForValidation);
     }
 
     private void validate(final ConfiguredObject<?> authenticationProvider)
@@ -132,14 +139,5 @@
             throw new IllegalConfigurationException(String.format(
                     "A path to non-existing file is specified in JVM system property '%s'", JAAS_CONFIG_PROPERTY));
         }
-
-        if (_container.getChildren(AuthenticationProvider.class)
-                      .stream()
-                      .anyMatch(p -> p instanceof KerberosAuthenticationManager
-                                     && p != authenticationProvider))
-        {
-            throw new IllegalConfigurationException("Another Kerberos authentication provider already exists."
-                                                    + " Only one Kerberos authentication provider can be created.");
-        }
     }
 }
diff --git a/broker-core/src/test/java/org/apache/qpid/server/security/auth/manager/KerberosAuthenticationManagerTest.java b/broker-core/src/test/java/org/apache/qpid/server/security/auth/manager/KerberosAuthenticationManagerTest.java
index 9211710..a2a2aaa 100644
--- a/broker-core/src/test/java/org/apache/qpid/server/security/auth/manager/KerberosAuthenticationManagerTest.java
+++ b/broker-core/src/test/java/org/apache/qpid/server/security/auth/manager/KerberosAuthenticationManagerTest.java
@@ -30,11 +30,13 @@
 import static org.apache.qpid.server.test.KerberosUtilities.SERVICE_PRINCIPAL_NAME;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
 import java.io.File;
+import java.security.Principal;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
 import java.util.Base64;
@@ -48,6 +50,7 @@
 import javax.security.sasl.Sasl;
 import javax.security.sasl.SaslClient;
 
+import org.apache.qpid.server.security.TokenCarryingPrincipal;
 import org.junit.Before;
 import org.junit.BeforeClass;
 import org.junit.ClassRule;
@@ -68,7 +71,8 @@
 
 public class KerberosAuthenticationManagerTest extends UnitTestBase
 {
-
+    private static final String ANOTHER_SERVICE = "foo/" + HOST_NAME;
+    private static final String ANOTHER_SERVICE_FULL_NAME = ANOTHER_SERVICE + "@" + REALM;
     private static final KerberosUtilities UTILS = new KerberosUtilities();
 
     @ClassRule
@@ -81,30 +85,27 @@
     public static final SystemPropertySetter SYSTEM_PROPERTY_SETTER = new SystemPropertySetter();
 
     private static File _clientKeyTabFile;
+    private static String _config;
 
     private KerberosAuthenticationManager _kerberosAuthenticationProvider;
     private Broker<?> _broker;
+    private SpnegoAuthenticator _spnegoAuthenticator;
 
     @BeforeClass
     public static void createKeyTabs() throws Exception
     {
-        UTILS.prepareConfiguration(HOST_NAME, SYSTEM_PROPERTY_SETTER);
+        KDC.createPrincipal("another.keytab", ANOTHER_SERVICE_FULL_NAME);
+        _config = UTILS.prepareConfiguration(HOST_NAME, SYSTEM_PROPERTY_SETTER);
         _clientKeyTabFile = UTILS.prepareKeyTabs(KDC);
     }
 
     @Before
     public void setUp() throws Exception
     {
-        Map<String, String> context = Collections.singletonMap(KerberosAuthenticationManager.GSSAPI_SPNEGO_CONFIG,
-                                                               ACCEPT_SCOPE);
-        final Map<String, Object> attributes = new HashMap<>();
-        attributes.put(AuthenticationProvider.NAME, getTestName());
-        attributes.put(AuthenticationProvider.CONTEXT, context);
+        SYSTEM_PROPERTY_SETTER.setSystemProperty(LOGIN_CONFIG, _config);
         _broker = BrokerTestHelper.createBrokerMock();
-        _kerberosAuthenticationProvider = new KerberosAuthenticationManager(attributes, _broker);
-        _kerberosAuthenticationProvider.create();
-        when(_broker.getChildren(AuthenticationProvider.class))
-                .thenReturn(Collections.singleton(_kerberosAuthenticationProvider));
+        _kerberosAuthenticationProvider = createKerberosAuthenticationProvider(ACCEPT_SCOPE);
+        _spnegoAuthenticator = new SpnegoAuthenticator(_kerberosAuthenticationProvider);
     }
 
     @Test
@@ -181,6 +182,105 @@
         assertEquals(AuthenticationResult.AuthenticationStatus.SUCCESS, result.getStatus());
     }
 
+    @Test
+    public void testAuthenticate() throws Exception
+    {
+        final String token = Base64.getEncoder().encodeToString(buildToken(SERVICE_PRINCIPAL_NAME));
+        final String authenticationHeader = SpnegoAuthenticator.NEGOTIATE_PREFIX + token;
+
+        final AuthenticationResult result = _spnegoAuthenticator.authenticate(authenticationHeader);
+
+        assertNotNull(result);
+        assertEquals(AuthenticationResult.AuthenticationStatus.SUCCESS, result.getStatus());
+        final Principal principal = result.getMainPrincipal();
+        assertTrue(principal instanceof TokenCarryingPrincipal);
+        assertEquals(KerberosUtilities.CLIENT_PRINCIPAL_FULL_NAME, principal.getName());
+
+        final Map<String, String> tokens = ((TokenCarryingPrincipal)principal).getTokens();
+        assertNotNull(tokens);
+        assertTrue(tokens.containsKey(SpnegoAuthenticator.RESPONSE_AUTH_HEADER_NAME));
+    }
+
+    @Test
+    public void testAuthenticateNoAuthenticationHeader()
+    {
+        final AuthenticationResult result = _spnegoAuthenticator.authenticate((String) null);
+        assertNotNull(result);
+        assertEquals(AuthenticationResult.AuthenticationStatus.ERROR, result.getStatus());
+    }
+
+    @Test
+    public void testAuthenticateNoNegotiatePrefix() throws Exception
+    {
+        final String token = Base64.getEncoder().encodeToString(buildToken(SERVICE_PRINCIPAL_NAME));
+        final AuthenticationResult result = _spnegoAuthenticator.authenticate(token);
+        assertNotNull(result);
+        assertEquals(AuthenticationResult.AuthenticationStatus.ERROR, result.getStatus());
+    }
+
+    @Test
+    public void testAuthenticateEmptyToken()
+    {
+        final AuthenticationResult result =
+                _spnegoAuthenticator.authenticate(SpnegoAuthenticator.NEGOTIATE_PREFIX + "");
+        assertNotNull(result);
+        assertEquals(AuthenticationResult.AuthenticationStatus.ERROR, result.getStatus());
+    }
+
+    @Test
+    public void testAuthenticateInvalidToken()
+    {
+        final AuthenticationResult result =
+                _spnegoAuthenticator.authenticate(SpnegoAuthenticator.NEGOTIATE_PREFIX + "Zm9v");
+        assertNotNull(result);
+        assertEquals(AuthenticationResult.AuthenticationStatus.ERROR, result.getStatus());
+    }
+
+    @Test
+    public void testAuthenticateWrongConfigName() throws Exception
+    {
+        _kerberosAuthenticationProvider.delete();
+
+        _kerberosAuthenticationProvider = createKerberosAuthenticationProvider("foo");
+        _spnegoAuthenticator = new SpnegoAuthenticator(_kerberosAuthenticationProvider);
+
+        final String token = Base64.getEncoder().encodeToString(buildToken(SERVICE_PRINCIPAL_NAME));
+        final String authenticationHeader = SpnegoAuthenticator.NEGOTIATE_PREFIX + token;
+
+        final AuthenticationResult result = _spnegoAuthenticator.authenticate(authenticationHeader);
+        assertNotNull(result);
+        assertEquals(AuthenticationResult.AuthenticationStatus.ERROR, result.getStatus());
+    }
+
+    @Test
+    public void testAuthenticateWrongServer() throws Exception
+    {
+        final String token = Base64.getEncoder().encodeToString(buildToken(ANOTHER_SERVICE));
+        final String authenticationHeader = SpnegoAuthenticator.NEGOTIATE_PREFIX + token;
+
+        final AuthenticationResult result = _spnegoAuthenticator.authenticate(authenticationHeader);
+        assertNotNull(result);
+        assertEquals(AuthenticationResult.AuthenticationStatus.ERROR, result.getStatus());
+    }
+
+    private KerberosAuthenticationManager createKerberosAuthenticationProvider(String acceptScope)
+    {
+        when(_broker.getChildren(AuthenticationProvider.class)).thenReturn(Collections.emptyList());
+        final Map<String, String> context = Collections.singletonMap(KerberosAuthenticationManager.GSSAPI_SPNEGO_CONFIG, acceptScope);
+        final Map<String, Object> attributes = new HashMap<>();
+        attributes.put(AuthenticationProvider.NAME, getTestName());
+        attributes.put(AuthenticationProvider.CONTEXT, context);
+        KerberosAuthenticationManager kerberosAuthenticationProvider = new KerberosAuthenticationManager(attributes, _broker);
+        kerberosAuthenticationProvider.create();
+        when(_broker.getChildren(AuthenticationProvider.class)).thenReturn(Collections.singleton(kerberosAuthenticationProvider));
+        return kerberosAuthenticationProvider;
+    }
+
+    private byte[] buildToken(final String anotherService) throws Exception
+    {
+        return UTILS.buildToken(KerberosUtilities.CLIENT_PRINCIPAL_NAME, _clientKeyTabFile, anotherService);
+    }
+
     private AuthenticationResult authenticate(final SaslNegotiator negotiator) throws Exception
     {
         final LoginContext lc = UTILS.createKerberosKeyTabLoginContext(getTestName(),
diff --git a/broker-core/src/test/java/org/apache/qpid/server/security/auth/manager/SpnegoAuthenticatorTest.java b/broker-core/src/test/java/org/apache/qpid/server/security/auth/manager/SpnegoAuthenticatorTest.java
deleted file mode 100644
index bbd65a4..0000000
--- a/broker-core/src/test/java/org/apache/qpid/server/security/auth/manager/SpnegoAuthenticatorTest.java
+++ /dev/null
@@ -1,164 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.qpid.server.security.auth.manager;
-
-import static org.apache.qpid.server.test.KerberosUtilities.ACCEPT_SCOPE;
-import static org.apache.qpid.server.test.KerberosUtilities.HOST_NAME;
-import static org.apache.qpid.server.test.KerberosUtilities.REALM;
-import static org.apache.qpid.server.test.KerberosUtilities.SERVICE_PRINCIPAL_NAME;
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-
-import java.io.File;
-import java.security.Principal;
-import java.util.Base64;
-import java.util.Map;
-
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.ClassRule;
-import org.junit.Test;
-
-import org.apache.qpid.server.security.TokenCarryingPrincipal;
-import org.apache.qpid.server.security.auth.AuthenticationResult;
-import org.apache.qpid.server.test.EmbeddedKdcResource;
-import org.apache.qpid.server.test.KerberosUtilities;
-import org.apache.qpid.test.utils.SystemPropertySetter;
-import org.apache.qpid.test.utils.UnitTestBase;
-
-public class SpnegoAuthenticatorTest extends UnitTestBase
-{
-    private static final String ANOTHER_SERVICE = "foo/" + HOST_NAME;
-    private static final String ANOTHER_SERVICE_FULL_NAME = ANOTHER_SERVICE + "@" + REALM;
-    private static final KerberosUtilities UTILS = new KerberosUtilities();
-
-    @ClassRule
-    public static final EmbeddedKdcResource KDC = new EmbeddedKdcResource(HOST_NAME, 0, "QpidTestKerberosServer", REALM);
-
-    @ClassRule
-    public static final SystemPropertySetter SYSTEM_PROPERTY_SETTER = new SystemPropertySetter();
-    private static File _clientKeyTab;
-
-    private SpnegoAuthenticator _spnegoAuthenticator;
-    private KerberosAuthenticationManager _kerberosAuthenticationManager;
-
-    @BeforeClass
-    public static void createKeyTabs() throws Exception
-    {
-        KDC.createPrincipal("another.keytab", ANOTHER_SERVICE_FULL_NAME);
-        UTILS.prepareConfiguration(HOST_NAME, SYSTEM_PROPERTY_SETTER);
-        _clientKeyTab = UTILS.prepareKeyTabs(KDC);
-    }
-
-    @Before
-    public void setUp()
-    {
-        _kerberosAuthenticationManager = mock(KerberosAuthenticationManager.class);
-        when(_kerberosAuthenticationManager.getSpnegoLoginConfigScope()).thenReturn(ACCEPT_SCOPE);
-        when(_kerberosAuthenticationManager.isStripRealmFromPrincipalName()).thenReturn(true);
-
-        _spnegoAuthenticator = new SpnegoAuthenticator(_kerberosAuthenticationManager);
-    }
-
-    @Test
-    public void testAuthenticate() throws Exception
-    {
-        final String token = Base64.getEncoder().encodeToString(buildToken(SERVICE_PRINCIPAL_NAME));
-        final String authenticationHeader = SpnegoAuthenticator.NEGOTIATE_PREFIX + token;
-
-        final AuthenticationResult result = _spnegoAuthenticator.authenticate(authenticationHeader);
-
-        assertNotNull(result);
-        assertEquals(AuthenticationResult.AuthenticationStatus.SUCCESS, result.getStatus());
-        final Principal principal = result.getMainPrincipal();
-        assertTrue(principal instanceof TokenCarryingPrincipal);
-        assertEquals(KerberosUtilities.CLIENT_PRINCIPAL_NAME, principal.getName());
-
-        final Map<String, String> tokens = ((TokenCarryingPrincipal)principal).getTokens();
-        assertNotNull(tokens);
-        assertTrue(tokens.containsKey(SpnegoAuthenticator.RESPONSE_AUTH_HEADER_NAME));
-    }
-
-    @Test
-    public void testAuthenticateNoAuthenticationHeader()
-    {
-        final AuthenticationResult result = _spnegoAuthenticator.authenticate((String) null);
-        assertNotNull(result);
-        assertEquals(AuthenticationResult.AuthenticationStatus.ERROR, result.getStatus());
-    }
-
-    @Test
-    public void testAuthenticateNoNegotiatePrefix() throws Exception
-    {
-        final String token = Base64.getEncoder().encodeToString(buildToken(SERVICE_PRINCIPAL_NAME));
-        final AuthenticationResult result = _spnegoAuthenticator.authenticate(token);
-        assertNotNull(result);
-        assertEquals(AuthenticationResult.AuthenticationStatus.ERROR, result.getStatus());
-    }
-
-    @Test
-    public void testAuthenticateEmptyToken()
-    {
-        final AuthenticationResult result =
-                _spnegoAuthenticator.authenticate(SpnegoAuthenticator.NEGOTIATE_PREFIX + "");
-        assertNotNull(result);
-        assertEquals(AuthenticationResult.AuthenticationStatus.ERROR, result.getStatus());
-    }
-
-    @Test
-    public void testAuthenticateInvalidToken()
-    {
-        final AuthenticationResult result =
-                _spnegoAuthenticator.authenticate(SpnegoAuthenticator.NEGOTIATE_PREFIX + "Zm9v");
-        assertNotNull(result);
-        assertEquals(AuthenticationResult.AuthenticationStatus.ERROR, result.getStatus());
-    }
-
-    @Test
-    public void testAuthenticateWrongConfigName() throws Exception
-    {
-        when(_kerberosAuthenticationManager.getSpnegoLoginConfigScope()).thenReturn("foo");
-        final String token = Base64.getEncoder().encodeToString(buildToken(SERVICE_PRINCIPAL_NAME));
-        final String authenticationHeader = SpnegoAuthenticator.NEGOTIATE_PREFIX + token;
-
-        final AuthenticationResult result = _spnegoAuthenticator.authenticate(authenticationHeader);
-        assertNotNull(result);
-        assertEquals(AuthenticationResult.AuthenticationStatus.ERROR, result.getStatus());
-    }
-
-    @Test
-    public void testAuthenticateWrongServer() throws Exception
-    {
-        final String token = Base64.getEncoder().encodeToString(buildToken(ANOTHER_SERVICE));
-        final String authenticationHeader = SpnegoAuthenticator.NEGOTIATE_PREFIX + token;
-
-        final AuthenticationResult result = _spnegoAuthenticator.authenticate(authenticationHeader);
-        assertNotNull(result);
-        assertEquals(AuthenticationResult.AuthenticationStatus.ERROR, result.getStatus());
-    }
-
-    private byte[] buildToken(final String anotherService) throws Exception
-    {
-        return UTILS.buildToken(KerberosUtilities.CLIENT_PRINCIPAL_NAME, _clientKeyTab, anotherService);
-    }
-}
diff --git a/broker-core/src/test/java/org/apache/qpid/server/test/KerberosUtilities.java b/broker-core/src/test/java/org/apache/qpid/server/test/KerberosUtilities.java
index 13c3acc..f1c62bf 100644
--- a/broker-core/src/test/java/org/apache/qpid/server/test/KerberosUtilities.java
+++ b/broker-core/src/test/java/org/apache/qpid/server/test/KerberosUtilities.java
@@ -95,13 +95,14 @@
         return clientKeyTabFile;
     }
 
-    public void prepareConfiguration(final String hostName, final SystemPropertySetter systemPropertySetter)
+    public String prepareConfiguration(final String hostName, final SystemPropertySetter systemPropertySetter)
             throws IOException
     {
         final Path loginConfig = transformLoginConfig(hostName);
-        systemPropertySetter.setSystemProperty(LOGIN_CONFIG,
-                                               URLDecoder.decode(loginConfig.toFile().getAbsolutePath(), UTF_8.name()));
+        final String configLocation = URLDecoder.decode(loginConfig.toFile().getAbsolutePath(), UTF_8.name());
+        systemPropertySetter.setSystemProperty(LOGIN_CONFIG, configLocation);
         systemPropertySetter.setSystemProperty(USE_SUBJECT_CREDS_ONLY, "false");
+        return configLocation;
     }
 
     public byte[] buildToken(String clientPrincipalName, File clientKeyTabFile, String targetServerPrincipalName)