@Override
	public String authenticate(UserManager userMgr, Subject subject, Callback[] ghidra_callbacks)
			throws LoginException {

		GhidraPrincipal principal = GhidraPrincipal.getGhidraPrincipal(subject);

		AtomicReference<String> userName = new AtomicReference<>();

		NameCallback srcNcb =
			AuthenticationModule.getFirstCallbackOfType(NameCallback.class, ghidra_callbacks);

		PasswordCallback srcPcb =
			AuthenticationModule.getFirstCallbackOfType(PasswordCallback.class, ghidra_callbacks);

		try {
			LoginContext lc = new LoginContext("", null, (loginmodule_callbacks) -> {
				// The Krb5LoginModule tends to call this callback handler multiple times.
				// Once for name, and then again for password.

				String tmpName = (allowUserToSpecifyName && srcNcb != null) ? srcNcb.getName()
						: principal.getName();
				if (stripDomainFromUsername && tmpName.contains("\\")) {
					tmpName = tmpName.replaceFirst("^.*\\\\", "");
				}

				if (tmpName == null || srcPcb == null || tmpName.isBlank()) {
					throw new IOException("Missing username or password values");
				}

				NameCallback destNcb = AuthenticationModule
						.getFirstCallbackOfType(NameCallback.class, loginmodule_callbacks);
				PasswordCallback destPcb = AuthenticationModule
						.getFirstCallbackOfType(PasswordCallback.class, loginmodule_callbacks);

				if (destNcb != null) {
					destNcb.setName(tmpName);
				}

				if (destPcb != null) {
					destPcb.setPassword(srcPcb.getPassword());
				}

				userName.set(tmpName);
			}, new JAASConfiguration("com.sun.security.auth.module.Krb5LoginModule"));

			try {
				lc.login();
			}
			catch (LoginException e) {
				// Convert plain LoginExceptions to FailedLoginExceptions to enable
				// the client to retry the login if desired.
				if (e instanceof FailedLoginException) {
					throw e;
				}
				throw new FailedLoginException(e.getMessage());
			}
		}
		finally {
			if (srcPcb != null) {
				srcPcb.clearPassword();
			}
		}

		return userName.get();
	}
Creates a new {@link Krb5ActiveDirectoryAuthenticationModule} instance.

@param domainName the Active Directory domain name (ie. "yourdomain.tld")
@param allowUserToSpecifyName flag, if true will include a {@link NameCallback} in the
{@link #getAuthenticationCallbacks()} list, which allows the user to specify a different
name than their {@link GhidraPrincipal}.
@throws IllegalArgumentException if domainName is null or blank, or if the Microsoft
Active Directory domain controller can not be looked-up in DNS.
Ghidra/Features/GhidraServer/src/main/java/ghidra/server/security/Krb5ActiveDirectoryAuthenticationModule.java