code: void setUpSubject(final String securityName, final String accessId,
                        final String authMethod) throws LoginException {
          // Populate a temporary subject in response to a successful authentication.
          // We use a temporary Subject because if something goes wrong in this flow,
          // we are not updating the "live" Subject.
          try {
              AccessController.doPrivileged(new PrivilegedExceptionAction<Object>() {
                  @Override
                  public Object run() throws Exception {
                      temporarySubject = new Subject();
                      setWSPrincipal(temporarySubject, securityName, accessId, authMethod);
                      setCredentials(temporarySubject, securityName, null);
                      setOtherPrincipals(temporarySubject, securityName, accessId, authMethod, null);
                      // Commit the newly created elements into the original Subject
                      subject.getPrincipals().addAll(temporarySubject.getPrincipals());
                      subject.getPublicCredentials().addAll(temporarySubject.getPublicCredentials());
                      subject.getPrivateCredentials().addAll(temporarySubject.getPrivateCredentials());
  
                      return null;
                  }
  
              });
          } catch (PrivilegedActionException e) {
              throw new LoginException(e.getLocalizedMessage());
          }
      }
docs: Common Subject set up. Guarantees an atomic commit to the subject
  passed in via initialization.
  
  @throws LoginException