code: private Pair<Request, HttpMessageSecurity> buildAuthenticatedRequest(Request originalRequest,
              Map<String, String> challengeMap) throws IOException {
  
          Boolean supportsPop = supportsMessageProtection(originalRequest.url().toString(), challengeMap);
  
          // if the service supports pop and a clientEncryptionKey has not been generated yet, generate
          // the key that will be used for encryption on this and all subsequent protected requests
          if (supportsPop && this.clientEncryptionKey == null) {
              try {
                  final KeyPairGenerator generator = KeyPairGenerator.getInstance(CLIENT_ENCRYPTION_KEY_TYPE);
  
                  generator.initialize(CLIENT_ENCRYPTION_KEY_SIZE);
                  
                  this.clientEncryptionKey = JsonWebKey.fromRSA(generator.generateKeyPair()).withKid(UUID.randomUUID().toString());   
                  
              } catch (NoSuchAlgorithmException e) {
                  throw new RuntimeException(e);
              }
          }
  
          AuthenticationResult authResult = getAuthenticationCredentials(supportsPop, challengeMap);
  
          if (authResult == null) {
              return null;
          }
  
          HttpMessageSecurity httpMessageSecurity = new HttpMessageSecurity(authResult.getAuthToken(),
                  supportsPop ? authResult.getPopKey() : "",
                  supportsPop ? challengeMap.get("x-ms-message-encryption-key") : "",
                  supportsPop ? challengeMap.get("x-ms-message-signing-key") : "",
                  this.clientEncryptionKey);
  
          Request request = httpMessageSecurity.protectRequest(originalRequest);
          return Pair.of(request, httpMessageSecurity);
      }
docs: Builds request with authenticated header. Protects request body if supported.
  
  @param originalRequest
  unprotected request without auth token.
  @param challengeMap
  the challenge map.
  @return Pair of protected request and HttpMessageSecurity used for
  encryption.