code: public Principal getCallerPrincipal(boolean useRealm, String realm, boolean web, boolean isJaspiEnabled) {
          Subject subject = subjectManager.getCallerSubject();
          if (subject == null) {
              return null;
          }
  
          SubjectHelper subjectHelper = new SubjectHelper();
          if (subjectHelper.isUnauthenticated(subject) && web) {
              return null;
          }
  
          if (isJaspiEnabled) {
              Principal principal = getPrincipalFromWSCredential(subjectHelper, subject);
              if (principal != null) {
                  return principal;
              }
          }
  
          String securityName = getSecurityNameFromWSCredential(subjectHelper, subject);
          if (securityName == null) {
              return null;
          }
  
          Principal jsonWebToken = MpJwtHelper.getJsonWebTokenPricipal(subject);
          if (jsonWebToken != null) {
              return jsonWebToken;
          }
  
          Set<WSPrincipal> principals = subject.getPrincipals(WSPrincipal.class);
          if (principals.size() > 1) {
              multiplePrincipalsError(principals);
          }
  
          WSPrincipal wsPrincipal = null;
          if (!principals.isEmpty()) {
              String principalName = createPrincipalName(useRealm, realm, securityName);
              wsPrincipal = principals.iterator().next();
              wsPrincipal = new WSPrincipal(principalName, wsPrincipal.getAccessId(), wsPrincipal.getAuthenticationMethod());
          }
          return wsPrincipal;
      }
docs: Returns a java.security.Principal object containing the name of the current authenticated user.
  If the user has not been authenticated, the method returns null.
  Look at the Subject on the thread only.
  We will extract, security name from WSCredential and the set of Principals, our WSPrincipal type. If a property has been set, then
  the realm is prepended to the security name.
  
  @param useRealm whether to prepend the security name with the realm name
  @param realm the realm name to prefix the security name with
  @param web call by the webRequest
  @param isJaspiEnabled TODO
  @return a java.security.Principal containing the name of the user making this request; null if the user has not been authenticated