public static String getGSSTicket(String clientPrincipal, String clientPassword, String serviceName) throws Exception {
        var clientSubject = JaasKrbUtil.loginUsingPassword(clientPrincipal, clientPassword);

        var clientPrincipals = clientSubject.getPrincipals();
        assertFalse(clientPrincipals.isEmpty());

        // Get the TGT
        var privateCredentials = clientSubject.getPrivateCredentials(KerberosTicket.class);
        assertFalse(privateCredentials.isEmpty());
        var tgt = privateCredentials.iterator().next();
        assertNotNull(tgt);

        // Get the service ticket
        PrivilegedExceptionAction<byte[]> action =
            new KerberosClientExceptionAction(clientPrincipals.iterator().next(), serviceName);
        var ticketBytes = Subject.doAs(clientSubject, action);
        assertNotNull(ticketBytes);

        return new String(Base64.getEncoder().encode(ticketBytes), StandardCharsets.UTF_8);
    }
This class represents a PrivilegedExceptionAction implementation to obtain a service ticket from a Kerberos
Key Distribution Center.
pac4j-kerberos/src/test/java/org/pac4j/kerberos/client/direct/SpnegoServiceTicketHelper.java