docs: public ManagedConnection createManagedConnection(Subject subject, ConnectionRequestInfo cxRequestInfo)
                      throws ResourceException {
          boolean useKerb = false; // flag to indicate if kerberso is being used
          Object credential = null; 
          // cannot print the subject - causes a security violation 
          final boolean isAnyTraceOn = TraceComponent.isAnyTracingEnabled(); 
  
          if (isAnyTraceOn && tc.isEntryEnabled())
              Tr.entry(this, tc, "createManagedConnection", subject == null ? null : "subject", AdapterUtil.toString(cxRequestInfo));
  
  
          // User/password from the Subject will take first priority over any values specified in
          // the CRI, as required by the JCA spec.  If neither the Subject nor the CRI contain a
          // user/password, then the backend database is allowed to reject or accept the
          // connection request. 
  
          // If the Subject is not null but it is empty, then we should use the backend default user/pwd.
          // we should not use the one from CRI. 
  
          // If we don't have a CRI, then create a blank one. A non-null CRI is required later.
          // If we do have a CRI, the values in the CRI take first priority--unless they're null.
  
          WSConnectionRequestInfoImpl cri = cxRequestInfo == null ?
                          new WSConnectionRequestInfoImpl() :
                          (WSConnectionRequestInfoImpl) cxRequestInfo;
  
          String userName = null; 
          String password = null; 
  
          if (subject == null) // Check the Subject first, then the CRI values. 
          {
  
              password = cri.getPassword(); 
              userName = cri.getUserName(); 
  
              if (isAnyTraceOn && tc.isEventEnabled()) 
              {
                  if (userName == null) // Distinguish between option C/using DS defaults. 
                  {
                      //  For recovery, we need to be able to accept if there is no CRI or Subject.
                      //  In this case, we will use the username/password on the dataSource to get
                      //  the connection.
  
                      Tr.event(this, tc, "Using DataSource default user/password for authentication");
  
                      //Leave username and password as null here.  Then, in the code below, use
                      // the null value to determine how to get the JTA/Pooled Connection.  If
                      // we try to use null, null as the username/password, the AS/400 driver
                      // will have problems.
                  } else {
                      // Option C security
                      // We use the non-null user/password found in the CRI
  
                      Tr.event(this, tc, "Using ConnectionRequestInfo for authentication");
                  }
              }
          } else // Subject is available
          {
              // Option A and B security
  
              if (isAnyTraceOn && tc.isDebugEnabled())
                  Tr.debug(this, tc, "Subject found.  Will try to use either PasswordCredentials or GenericCredentials ");
  
              // Set default user/password that will be used     
              // if the subject has no credentials               
  
              userName = null; 
              password = null; 
  
              // If ThreadIdentitySupport for this JDBC provider        
              // is ALLOWED or REQUIRED, check if the Subject has a     
              // UTOKEN generic credential. If it does, the userid and  
              // password values will be forced to null so the datasource 
              // will default to use the userid associated with the     
              // current OS thread (i.e., the userid in the ACEE) as the
              // user that owns the connection. In this case, processing
              // checks for Basic Password Credential and for Kerberos  
              // will be skipped.                                       
  
              int threadIdentitySupport = helper.getThreadIdentitySupport();
              boolean subjectHasUtokenCred = false; 
  
              if (threadIdentitySupport != AbstractConnectionFactoryService.THREAD_IDENTITY_NOT_ALLOWED) 
              {
                  if (isAnyTraceOn && tc.isDebugEnabled())
                      Tr.debug(this, tc, "The JDBC Provider supports the use of Thread Identity for authentication."); 
  
                  // Setup to search credentials for UTOKEN Generic Credential 
  
                  // If Java 2 Security is enabled, wrap the call to getPrivateCredentials() in a
                  // doPrivileged() to prevent the calling classes from having to hold the
                  // permissions necessary to access the credentials
                  final Subject subj = subject; 
                  Set<GenericCredential> privateGenericCredentials = null; 
                  if (System.getSecurityManager() != null) 
                  {
                      privateGenericCredentials = AccessController.doPrivileged(
                                      new PrivilegedAction<Set<GenericCredential>>() { 
                                          public Set<GenericCredential> run() 
                                          { 
                                              return subj.getPrivateCredentials(GenericCredential.class); 
                                          } 
                                      }); 
                  } 
                  else 
                  {
                      privateGenericCredentials = subj.getPrivateCredentials(GenericCredential.class); 
  
                  }
  
                  final Iterator<GenericCredential> iterator = privateGenericCredentials.iterator(); 
  
                  PrivilegedAction<GenericCredential> iterationAction = new PrivilegedAction<GenericCredential>() {
                      public GenericCredential run() {
                          return iterator.next();
                      } 
                  }; 
  
                  // Search credentials for UTOKEN Generic Credential     
  
                  GenericCredential genericCredential = null; 
  
                  while (iterator.hasNext()) 
                  {
                      if (System.getSecurityManager() != null) // Java2 Sec? 
                      {
                          genericCredential = (GenericCredential) java.security.AccessController.doPrivileged(iterationAction); 
                      } 
                      else // Java 2 Security Not Enabled
                      {
                          genericCredential = (GenericCredential) iterator.next();
                      }
  
                      if (genericCredential.getMechType().equals("oid:1.3.18.0.2.30.1")) 
                      {
                          subjectHasUtokenCred = true;
                          break;
                      }
                  }
                  if (!subjectHasUtokenCred && threadIdentitySupport == AbstractConnectionFactoryService.THREAD_IDENTITY_REQUIRED) {
                      String message = "createManagedConnection() error: Jdbc Provider requires ThreadIdentitySupport, but no UTOKEN generic credential was found."; 
  
                      ResourceException resX = new DataStoreAdapterException("WS_INTERNAL_ERROR", null, getClass(), message);
  
                      throw resX;
                  }
              } // end if threadIdentitySupport equals "ALLOWED" or "REQUIRED"
  
              if (subjectHasUtokenCred) 
              {
                  // Force userName and password to null so the datasource
                  // will use the OS thread security the ConnectionManager
                  // established for the current thread.                  
  
                  userName = null; 
                  password = null; 
                  if (isAnyTraceOn && tc.isEventEnabled()) 
                      Tr.event(this, tc, "Using thread identity for authentication by the JDBC Provider's DataSource."); 
              } 
              else // Check for PasswordCredential or Kerbros GenericCredential // also check for IdentityPrincipal
              {
                  // This list of credentials may have
                  // [A] PasswordCredentials for this ManagedConnection instance, or
                  // [B] GenericCredentials for use with Kerberos support, or
                  // no credentials at all.
  
                  final Iterator<Object> iter = subject.getPrivateCredentials().iterator();
  
                  PrivilegedAction<Object> iterationAction = new PrivilegedAction<Object>() {
                      public Object run() {
                          return iter.next();
                      }
                  };
  
                  PasswordCredential pwcred;
  
                  while (iter.hasNext()) {
                      // For performance, perform doPrivileged only 
                      // if Java 2 security is enabled.             
                      if (System.getSecurityManager() != null) 
                      {
                          credential = AccessController.doPrivileged(iterationAction);
                      } 
                      else // Java 2 Secutity Not Enabled
                      {
                          credential = iter.next(); 
                      } 
  
                      if (credential instanceof PasswordCredential) {
                          //This is possibly Option A - only possibly because the PasswordCredential
                          // may not match the MC.  Then we have to keep looping.
                          pwcred = (PasswordCredential) credential;
                          if ((pwcred.getManagedConnectionFactory()).equals(this)) {
                              if (isAnyTraceOn && tc.isEventEnabled()) 
                                  Tr.event(this, tc, "Using PasswordCredentials for authentication");
                              userName = pwcred.getUserName();
  
                              // Allow for the possibility of a null password. 
                              char[] pwdChars = pwcred.getPassword();
  
                              password = pwdChars == null ? null : new String(pwdChars);
                              break;
                          }
                      } else if (credential instanceof GSSCredential) {
                          useKerb = true;
                          //This is option B
                          if (isAnyTraceOn && tc.isEventEnabled()) 
                              Tr.event(this, tc, "Using GenericCredentials for authentication");
                          break;
  
                      }
                  }
              } //end else Check for PasswordCredential or Kerbros GenericCredential
          } // end Subject is available
  
          WSRdbManagedConnectionImpl mc = null;
          ConnectionResults results = null; 
          try {
              results = getConnection(userName, password, subject, cri, useKerb, credential);
  
              mc = new WSRdbManagedConnectionImpl(this, results.pooledConnection, results.connection, subject, cri);
  
              if (useKerb)
                  mc.setKerberosConnection();
  
              if (isAnyTraceOn && tc.isEntryEnabled())
                  Tr.exit(this, tc, "createManagedConnection", mc); 
  
              return mc;
          } catch (ResourceException resX) {
              if (isAnyTraceOn && tc.isEntryEnabled())
                  Tr.exit(this, tc, "createManagedConnection", resX);
              throw resX;
          } finally {
              // Close connections if we failed to create the managed connection
              if (mc == null && results != null) {
                  if (results.connection != null)
                      try {
                          results.connection.close();
                      } catch (Throwable x) {}
                  if (results.pooledConnection != null)
                      try {
                          results.pooledConnection.close();
                      } catch (Throwable x) {}
              }
          }
      }