code: private String buildAuthorizationHeader(String serverPrincipalName) throws LoginException
    {
      /*
       * Get the principal from the Subject's private credentials and populate the
       * client and server principal name for the GSS API
       */
      final String clientPrincipal = getClientPrincipalName();
      final CreateAuthorizationHeaderAction action = new CreateAuthorizationHeaderAction(clientPrincipal,
        serverPrincipalName);
  
      /*
       * Check if the TGT in the Subject's private credentials are valid. If
       * valid, then we use the TGT in the Subject's private credentials. If not,
       * we build the Subject's private credentials again from valid TGT in the
       * Kerberos client cache.
       */
      Set<Object> privateCreds = loginContext.getSubject().getPrivateCredentials();
      for (Object privateCred : privateCreds) {
        if (privateCred instanceof KerberosTicket) {
          String serverPrincipalTicketName = ((KerberosTicket) privateCred).getServer().getName();
          if ((serverPrincipalTicketName.startsWith("krbtgt"))
            && ((KerberosTicket) privateCred).getEndTime().compareTo(new Date()) == -1) {
            buildSubjectCredentials();
            break;
          }
        }
      }
  
      /*
       * Subject.doAs takes in the Subject context and the action to be run as
       * arguments. This method executes the action as the Subject given in the
       * argument. We do this in order to provide the Subject's context so that we
       * reuse the service ticket which will be populated in the Subject rather
       * than getting the service ticket from the KDC for each request. The GSS
       * API populates the service ticket in the Subject and reuses it
       * 
       */
      Subject.doAs(loginContext.getSubject(), action);
      return action.getNegotiateToken();
    }
docs: This method builds the Authorization header for Kerberos. It
  generates a request token based on the service ticket, client principal name and
  time-stamp
  
  @param serverPrincipalName
  the name registered with the KDC of the service for which we
  need to authenticate
  @return the HTTP Authorization header token