code: private void buildSubjectCredentials() throws LoginException {
      Subject subject = new Subject();
      /**
       * We are not getting the TGT from KDC here. The actual TGT is got from the
       * KDC using kinit or equivalent but we use the cached TGT in order to build
       * the LoginContext and populate the TGT inside the Subject using
       * Krb5LoginModule
       */
      LoginContext lc = new LoginContext("Krb5LoginContext", subject, null,
          (krbOptions != null) ? new KerberosLoginConfiguration(krbOptions) : new KerberosLoginConfiguration());
      lc.login();
      loginContext = lc;
    }
docs: This method checks the validity of the TGT in the cache and build the
  Subject inside the LoginContext using Krb5LoginModule and the TGT cached by
  the Kerberos client. It assumes that a valid TGT is already present in the
  kerberos client's cache.
  
  @throws LoginException