code: @Override
      public LoginCredential getLoginCredential() {
          return LaRequestUtil
                  .getOptionalRequest()
                  .map(request -> {
                      final HttpServletResponse response = LaResponseUtil.getResponse();
                      final SpnegoHttpServletResponse spnegoResponse = new SpnegoHttpServletResponse(response);
  
                      // client/caller principal
                      final SpnegoPrincipal principal;
                      try {
                          principal = getAuthenticator().authenticate(request, spnegoResponse);
                      } catch (final Exception e) {
                          final String msg = "HTTP Authorization Header=" + request.getHeader(Constants.AUTHZ_HEADER);
                          if (logger.isDebugEnabled()) {
                              logger.debug(msg);
                          }
                          throw new SsoLoginException(msg, e);
                      }
  
                      // context/auth loop not yet complete
                      if (spnegoResponse.isStatusSet()) {
                          return new ActionResponseCredential(() -> {
                              throw new RequestLoggingFilter.RequestClientErrorException("Your request is not authorized.",
                                      "401 Unauthorized", HttpServletResponse.SC_UNAUTHORIZED);
                          });
                      }
  
                      // assert
                      if (null == principal) {
                          final String msg = "Principal was null.";
                          if (logger.isDebugEnabled()) {
                              logger.debug(msg);
                          }
                          throw new SsoLoginException(msg);
                      }
  
                      if (logger.isDebugEnabled()) {
                          logger.debug("principal=" + principal);
                      }
  
                      final String[] username = principal.getName().split("@", 2);
                      return new SpnegoCredential(username[0]);
                  }).orElseGet(() -> null);
  
      }
docs: /* (non-Javadoc)
  @see org.codelibs.fess.sso.spnego.SsoAuthenticator#getLoginCredential()