docs: @Override
      public Object beforeGettingConnection(Subject subject, ConnectionRequestInfo reqInfo) throws ResourceException {
          if (tc.isEntryEnabled())
              Tr.entry(this, tc, "beforeGettingConnection", getSubjectString(subject), reqInfo);
  
          Object retObject = null;
          final Subject subj = subject;
  
          // If Security is enabled, continue. Otherwise exit immediately
          // with a null object.
  
          if (ThreadIdentityManager.isThreadIdentityEnabled()) {
  
              // Check if the current resource adapter MCF configuration
              // supports using ThreadIdentity. If so, continue processing.
              // Otherwise get out.
  
              if ((m_ThreadIdentitySupport != AbstractConnectionFactoryService.THREAD_IDENTITY_NOT_ALLOWED)) {
  
                  if (subj != null) {
                      // resauth = CONTAINER
  
                      // Check if UTOKEN Generic Credential was found. If so,
                      // the subject being processed represents the user identity
                      // currently associated with the thread we are running under
                      // (i.e., was established by finalizeSubject()). In this case,
                      // if SyncToThread is enabled for the server and this resource
                      // adapter (e.g., DB2 or IMS DL/I) indicates it needs the user
                      // identity associated with the thread actually pushed to the
                      // OS thread, then push the user identity to the OS thread.
                      // Under z/OS, this will create an ACEE for the user identity
                      // on the z/OS Thread. Connectors like the DB2 390 Local JDBC
                      // Provider and the IMS DL/I Connector in the case of a
                      // getConnection() request without any userid/password base
                      // the connection owner on the user represented by the
                      // user identity of the current z/OS thread.
                      //
                      //
                      // It should be noted that if SyncToThread is not enabled
                      // for the server, we cannot push the user identity to the
                      // OS thread. In this case, the WAS z/OS server will not
                      // have a security ACEE at all. In this situation,
                      // Connectors like the DB2 390 Local JDBC Provider and the IMS
                      // DL/I Connector will end up using the Server identity as
                      // user associated with the connection. Even though server
                      // identity will be used, the Subject used by
                      // Connection Management will be left set to the
                      // user identity associated with the current
                      // thread (e.g., RunAs Caller or Role user) and
                      // connection pooling will be based on this
                      // subject as opposed to using the Server identity.
  
                      if (doesSubjectContainUTOKEN(subj)) {
  
                          // We are using the user identity associated with the thread.
                          // The Subject contains a UTOKEN credential representing that
                          // user identity.
  
                          if (m_ThreadSecurity) {
  
                              // Connector requires that user identity be pushed to
                              // OS Thread.
  
                              if (ThreadIdentityManager.isJ2CThreadIdentityEnabled()) {
  
                                  // J2C SyncToThread is enabled for Server.
                                  // Push Subject to thread
  
                                  retObject = setJ2CThreadIdentity(subj);
  
                                  if (tc.isDebugEnabled()) {
                                      Tr.debug(tc, "beforeGettingConnection() pushed the user identity associated with the thread to the OS Thread:  ",
                                               new Object[] { getSubjectString(subj) });
                                  }
  
                              } else {
  
                                  // J2C SyncToThread not enabled for Server.
                                  // The adapter Will run with server identity
                                  // since we are not able to push the Subject's
                                  // user identity to the current OS thread as an ACEE.
  
                                  if (tc.isDebugEnabled()) {
                                      Tr.debug(
                                               tc,
                                               "beforeGettingConnection() could not push user identity associated with the thread to the OS Thread  because server was not enabled for SyncToThread.");
                                  }
  
                                  // Now we may need to synch server ID to thread.
                                  // We found a UTOKEN credential on the Subject,
                                  // which indicates that no container-managed alias was
                                  // specified, (in which case finalizeSubject would not
                                  // have gone through the process of getting a Subject with
                                  // UTOKEN credential).  So if (Connection Mgmt) SyncToThread is
                                  // not enabled but Application SynchToThread is enabled, we
                                  // would end up using the RunAs anyway, from the Application Synch,
                                  // even though (Connection Mgmt) SyncToThread was disabled.
                                  //
                                  // We wish to control the id used to get a connection within Connection
                                  // Mgmt code alone and to isolate the behavior from any settings not
                                  // related to Connection Mgmt.  If no Application Synch were done,
                                  // a Thread Security-enabled connector would use server id to get a
                                  // connection (when no container alias was specified and when no Connection Mgmt
                                  // synch was done).  So we add this code to ensure that the server id
                                  // is also used to get a connection if an Application Synch has
                                  // been performed (and no container alias was specified and when no Connection Mgmt
                                  // synch was done)
                                  //
                                  // This is only worth doing if the Appliation Synch has been enabled.  Though we
                                  // won't determine if the Application Synch has actually been done.
  
                                  if (ThreadIdentityManager.isAppThreadIdentityEnabled()) {
  
                                      if (tc.isDebugEnabled()) {
                                          Tr.debug(tc, "beforeGettingConnection() pushing server identity to the OS Thread because Application SyncToThread is enabled.");
                                      }
  
                                      // get Server subject and push it to the current OS thread
                                      retObject = ThreadIdentityManager.runAsServer();
                                  }
                              }
  
                          } else {
                              // OS ThreadSecurity is not enabled
                              // The adapter will use the user identity
                              // from the Subject that is associated with the
                              // current thread (i.e., the subject that is
                              // passed to the adapter).
                          }
  
                      } else {
                          // Subject doesn't have a UTOKEN GenericCredential.
                          // Check if we have an unexpected error situation.
                          checkForUTOKENNotFoundError(subj);
                      }
  
                  } else {
                      // resauth = APPLICATION
  
                      // When resauth is Application and the current
                      // connector is one that supports using ThreadSecurity (i.e,
                      // associates the user identity from the OS Thread with the
                      // connection when getConnection() is done without
                      // a userid/password), check if the server is enabed to perform
                      // SynctoThread. If so, get the Server identity and push
                      // the Server identity to the current OS Thread.
                      //
                      // The reason for this is to ensure consistency in terms of
                      // the default user identity used by the connector.
                      // Whenever a connector that supports ThreadSecurity defaults,
                      // we want to ensure the default is Server identity. For
                      // example, in the case of resauth=Container, if we try
                      // to push the current user identity asscoiated with the
                      // thread to the OS thread, but the server is not enabled
                      // to perform SyncToThread, we cannot push the user identity
                      // to the thread. Thus, in this case, the connector
                      // will default to using the Server identity as the owner of
                      // the connection that is allocated. Similarly, when
                      // resauth=Application and the getConnection() request is
                      // issued without a userid/password, we want to ensure that
                      // the connector defaults to using Server Identity. Thus,
                      // to make this happen, we push the Server identity to the
                      // current OS thread whenever resauth=Application and the
                      // connector supports ThreadSecurity. If it so happens
                      // that the application ends up issuing getConnection() with
                      // a userid/password, the fact that we have pushed the
                      // Server identity to the OS thread will not impact processing.
                      // Later, during afterGettingConnection() processing, the
                      // OS Thread Identity will then be returned to what it was.
  
                      if (m_ThreadSecurity && ThreadIdentityManager.isThreadIdentityEnabled()) {
                          // Get Server subject and push it to the current OS thread
                          retObject = ThreadIdentityManager.runAsServer();
                      }
                  }
              }
  
          } else {
              // Security not enabled
              if (tc.isDebugEnabled()) {
                  Tr.debug(tc, "beforeGettingConnection() processing skipped. Security not enabled.");
              }
  
              // NOTE: In the case where Security is not enabled, if
              // no Container-managed alias was specified and the
              // connector ALLOWS or REQUIRES ThreadIdentitySupport,
              // any connection obtained will be associated with
              // server identity.
          }
  
          if (tc.isEntryEnabled())
              Tr.exit(this, tc, "beforeGettingConnection", retObject);
          return retObject;
      }