Source:
public Result authenticate(Request request, ContentResponse response, HeaderInfo headerInfo, Attributes attributes) { URI normalizedUri = UriUtil.normalizedUri(request.getURI()); return new Result() { @Override public URI getURI() { return normalizedUri; } @Override public void apply(Request request) { String servicePrincipal = makeServicePrincipal(remoteServiceName, normalizedUri.getHost()); LoginContext loginContext = getLoginContext(); Subject subject = loginContext.getSubject(); Principal clientPrincipal = subject.getPrincipals().iterator().next(); GSSCredential clientCredential = doAs(subject, () -> GSS_MANAGER.createCredential( GSS_MANAGER.createName(clientPrincipal.getName(), GSSName.NT_USER_NAME), GSSCredential.DEFAULT_LIFETIME, KERBEROS_OID, GSSCredential.INITIATE_ONLY)); GSSContext context = doAs(loginContext.getSubject(), () -> { GSSContext result = GSS_MANAGER.createContext( GSS_MANAGER.createName(servicePrincipal, GSSName.NT_HOSTBASED_SERVICE), SPNEGO_OID, clientCredential, INDEFINITE_LIFETIME); result.requestMutualAuth(true); result.requestConf(true); result.requestInteg(true); result.requestCredDeleg(false); return result; }); try { byte[] token = context.initSecContext(new byte[0], 0, 0); if (token != null) { request.header(headerInfo.getHeader(), format("%s %s", NEGOTIATE, Base64.getEncoder().encodeToString(token))); } else { throw new RuntimeException(format("No token generated from GSS context for %s", request.getURI())); } } catch (GSSException e) { throw new RuntimeException(format("Failed to establish GSSContext for request %s", request.getURI()), e); } finally { try { context.dispose(); } catch (GSSException e) { } } } }; }

Target:
public Result authenticate(Request request, ContentResponse response, HeaderInfo headerInfo, Attributes attributes) { URI normalizedUri = UriUtil.normalizedUri(request.getURI()); return new Result() { @Override public URI getURI() { return normalizedUri; } @Override public void apply(Request request) { GSSContext context = null; try { CredentialHolder updatedCredentialHolder = getUpdatedCredentialHolder(); String servicePrincipal = makeServicePrincipal(remoteServiceName, normalizedUri.getHost()); context = doAs(updatedCredentialHolder.getLoginContext().getSubject(), () -> { GSSContext result = GSS_MANAGER.createContext( GSS_MANAGER.createName(servicePrincipal, GSSName.NT_HOSTBASED_SERVICE), SPNEGO_OID, updatedCredentialHolder.getGssCredential(), INDEFINITE_LIFETIME); result.requestMutualAuth(true); result.requestConf(true); result.requestInteg(true); result.requestCredDeleg(false); return result; }); byte[] token = context.initSecContext(new byte[0], 0, 0); if (token != null) { request.header(headerInfo.getHeader(), format("%s %s", NEGOTIATE, Base64.getEncoder().encodeToString(token))); } else { throw new RuntimeException(format("No token generated from GSS context for %s", request.getURI())); } } catch (GSSException e) { throw new RuntimeException(format("Failed to establish GSSContext for request %s", request.getURI()), e); } catch (LoginException e) { throw new RuntimeException(format("Failed to establish LoginContext for request %s", request.getURI()), e); } finally { try { if (context != null) { context.dispose(); } } catch (GSSException e) { } } } }; }