code: @Override
      protected Principal getPrincipal(String username) {
          Principal principal;
  
          // force lookup of user info
          if (username.startsWith("*")) {
              principal = readPrincipal(username.substring(1));
              if (principal != null) {
                  synchronized (principals) {
                      principals.put(username.substring(1), principal);
                  }
              }
          }
  
          synchronized (principals) {
              principal = (Principal) principals.get(username);
          }
          if (principal == null) {
              principal = readPrincipal(username);
              if (principal != null) {
                  synchronized (principals) {
                      principals.put(username, principal);
                  }
              }
          }
          return principal;
      }
docs: Return the Principal associated with the given user name. If the user
  name starts with an asterisk (*), the credentials are refreshed without
  having to restart Tomcat.