code: @Override
      public IdentityToken encodeIdentityToken(Codec codec) {
          IdentityToken token = null;
  
          SubjectManager subjectManager = new SubjectManager();
          Subject subject = subjectManager.getInvocationSubject();
          if (subject == null) {
              subject = subjectManager.getCallerSubject();
          }
  
          Set<WSPrincipal> principals = subject.getPrincipals(WSPrincipal.class);
          Principal principal = (principals.isEmpty()) ? null : principals.iterator().next();
  
          // There must be a WSPrincipal in the subject, but check for null to satisfy findbugs
          if (principal != null) {
  
              Any any = ORB.init().create_any();
  
              //TODO consider including a domain in this scoped-username
              String principalName = principal.getName();
              GSS_NT_ExportedNameHelper.insert(any, Util.encodeGSSExportName(oid, principalName));
  
              byte[] encoding = null;
              try {
                  encoding = codec.encode_value(any);
              } catch (InvalidTypeForEncoding itfe) {
                  throw new IllegalStateException("Unable to encode principal name '" + principalName + "' " + itfe, itfe);
              }
  
              token = new IdentityToken();
              token.principal_name(encoding);
          } else {
              token = new IdentityToken();
              token.anonymous(true);
          }
  
          return token;
      }
docs: TODO should also use login domains?
  
  @return IdentityToken