code: public void ensureMutualAuth(String returnChallenge) throws AuthenticationException {
          try {
              processChallenge(returnChallenge);
          } catch (MalformedChallengeException mce) {
              throw new AuthenticationException("Received invalid response header for mutual authentication", mce);
          }
          try {
              String token = getNegotiateToken();
              if (!spnegoNegotiator.established() || token != null) {
                  throw new AuthenticationException("Could not complete SPNEGO Authentication, Mutual Authentication Failed");
              }
          } catch (GSSException gsse) {
              throw new AuthenticationException("Could not complete SPNEGO Authentication", gsse);
          }
      }
docs: Authenticating requests with SPNEGO means that a request will execute before the client is sure that the
  server is mutually authenticated. This means that, at best, if mutual auth is requested, the client cannot
  trust that the server is giving accurate information, or in the case that the client has already sent data,
  further communication with the server should not happen.
  @param returnChallenge The Negotiate challenge from the response headers of a successful executed request
  @throws AuthenticationException If the response header does not allow for mutual authentication to be established.