code: private void checkCertForClientUsage(X509Certificate clientCert) {
          try {
              // We required that the extended key usage must be present if we are using
              // client cert authentication
              if (extendedClientCheck &&
                  (clientCert.getExtendedKeyUsage() == null ||
                   !clientCert.getExtendedKeyUsage().contains(CLIENTAUTH_OID))) {
                  throw new SecurityException("No extended key usage available");
              }
          } catch (CertificateParsingException e) {
              throw new SecurityException("Can't parse client cert");
          }
      }
docs: If an empty list as allowedPrincipals is given, no one is allowed to access