@VisibleForTesting
  String doKerberosAuth(HttpServletRequest request)
      throws HttpAuthenticationException {
    // Each http request must have an Authorization header
    // Check before trying to do kerberos authentication twice
    httpAuthService.getAuthHeader(request);

    // Try authenticating with the HTTP/_HOST principal
    if (httpUGI != null) {
      try {
        return httpUGI.doAs(new HttpKerberosServerAction(request, httpUGI));
      } catch (Exception e) {
        LOG.info("Failed to authenticate with HTTP/_HOST kerberos principal, " +
            "trying with hive/_HOST kerberos principal");
      }
    }
    // Now try with hive/_HOST principal
    try {
      return serviceUGI.doAs(new HttpKerberosServerAction(request, serviceUGI));
    } catch (Exception e) {
      LOG.error("Failed to authenticate with hive/_HOST kerberos principal");
      throw new HttpAuthenticationException(e);
    }
  }
Do the GSS-API kerberos authentication.
We already have a logged in subject in the form of serviceUGI,
which GSS-API will extract information from.
In case of a SPNego request we use the httpUGI,
for the authenticating service tickets.
@param request Request to act on
@return client principal name
@throws HttpAuthenticationException on error authenticating the user
service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpServlet.java