code: @Override
      public Account verify(Credential credential) {
          assertMechanism(AuthMechanism.CLIENT_CERT, AuthMechanism.KERBEROS);
  
          final AuthorizingCallbackHandler ach;
          final Principal user;
          if (credential instanceof X509CertificateCredential) {
              X509CertificateCredential certCred = (X509CertificateCredential) credential;
  
              ach = securityRealm.getAuthorizingCallbackHandler(AuthMechanism.CLIENT_CERT);
              user = certCred.getCertificate().getSubjectDN();
          } else if (credential instanceof GSSContextCredential) {
              GSSContextCredential gssCred = (GSSContextCredential) credential;
              try {
              user = new KerberosPrincipal(gssCred.getGssContext().getSrcName().toString());
              } catch (GSSException e) {
                  // By this point this should not be able to happen.
                  ROOT_LOGGER.debug("Unexpected authentication failure", e);
                  return null;
              }
              ach = securityRealm.getAuthorizingCallbackHandler(AuthMechanism.KERBEROS);
          } else {
              return null;
          }
  
          try {
              ach.handle(new Callback[] { new AuthorizeCallback(user.getName(), user.getName()) });
          } catch (IOException e) {
              ROOT_LOGGER.debug("Unexpected authentication failure", e);
              return null;
          } catch (UnsupportedCallbackException e) {
              ROOT_LOGGER.debug("Unexpected authentication failure", e);
              return null;
          }
  
          Collection<Principal> userCol = Collections.singleton(user);
          SubjectUserInfo supplemental;
          try {
              supplemental = ach.createSubjectUserInfo(userCol);
          } catch (IOException e) {
              return null;
          }
          addInetPrincipal(supplemental.getSubject().getPrincipals());
  
          return new RealmIdentityAccount(supplemental.getSubject(), user);
      }
docs: /*
  The final single method is used for Client Cert style authentication only.