docs: SubjectIdentity getSubjectIdentity(final String protocol, final String forHost) {
          KeytabService selectedService = null;
  
          final String hostName = forHost == null ? null : forHost.toLowerCase(Locale.ENGLISH);
          String name = protocol + "/" + hostName;
          selectedService = hostServiceMap.get(name);
          if (selectedService == null) {
              SECURITY_LOGGER.tracef("No mapping for name '%s' to KeytabService, attempting to use host only match.", name);
              selectedService = hostServiceMap.get(hostName);
              if (selectedService == null) {
                  SECURITY_LOGGER.tracef("No mapping for host '%s' to KeytabService, attempting to use default.", forHost);
                  selectedService = defaultService;
              }
          }
  
          if (selectedService != null) {
              if (SECURITY_LOGGER.isTraceEnabled()) {
                  SECURITY_LOGGER.tracef("Selected KeytabService with principal '%s' for host '%s'",
                          selectedService.getPrincipal(), forHost);
              }
              try {
                  return selectedService.createSubjectIdentity(false);
              } catch (LoginException e) {
                  SECURITY_LOGGER.keytabLoginFailed(selectedService.getPrincipal(), forHost, e);
                  /*
                   * Allow to continue and return null, i.e. we have an error preventing Kerberos authentication so log that but
                   * other mechanisms may be available leaving the server still accessible.
                   */
              }
          } else {
              SECURITY_LOGGER.tracef("No KeytabService available for host '%s' unable to return SubjectIdentity.", forHost);
          }
  
          return null;
      }