@Override
	public String authenticate(UserManager userMgr, Subject subject, Callback[] callbacks)
			throws LoginException {

		// assume we are operating over a secure authenticated socket -
		// unfortunately, there appears no way to obtain PKI credentials
		// used when authenticating SSL connection with client

		GhidraPrincipal user = GhidraPrincipal.getGhidraPrincipal(subject);
		if (user == null) {
			throw new FailedLoginException("GhidraPrincipal required");
		}
		String username = user.getName();

		SignatureCallback sigCb = null;
		if (callbacks != null) {
			for (int i = 0; i < callbacks.length; i++) {
				if (callbacks[i] instanceof SignatureCallback) {
					sigCb = (SignatureCallback) callbacks[i];
					break;
				}
			}
		}
		if (sigCb == null) {
			throw new FailedLoginException("PKI Signature callback required");
		}

		try {

			byte[] token = sigCb.getToken();

			if (!TokenGenerator.isRecentToken(token, MAX_TOKEN_TIME)) {
				throw new FailedLoginException("Stale Signature callback");
			}

			boolean usingSelfSignedCert =
				ApplicationKeyManagerFactory.usingGeneratedSelfSignedCertificate();
			if (!ApplicationKeyManagerUtils.isMySignature(usingSelfSignedCert ? null : authorities,
				token, sigCb.getServerSignature())) {
				throw new FailedLoginException("Invalid Signature callback");
			}

			X509Certificate[] certChain = sigCb.getCertificateChain();
			if (certChain == null || certChain.length == 0) {
				throw new FailedLoginException("user certificate not provided");
			}

			ApplicationKeyManagerUtils.validateClient(certChain,
				ApplicationKeyManagerUtils.RSA_TYPE);

			byte[] sigBytes = sigCb.getSignature();
			if (sigBytes != null) {

				Signature sig = Signature.getInstance(certChain[0].getSigAlgName());
				sig.initVerify(certChain[0]);
				sig.update(token);
				if (!sig.verify(sigBytes)) {
					throw new FailedLoginException("Incorrect signature");
				}
			}

			String dnUsername =
				userMgr.getUserByDistinguishedName(certChain[0].getSubjectX500Principal());
			if (dnUsername != null) {
				return dnUsername;
			}

			if (userMgr.isValidUser(username)) {
				X500Principal x500User = userMgr.getDistinguishedName(username);
				if (x500User == null) {
					userMgr.logUnknownDN(username, certChain[0].getSubjectX500Principal());
					if (!anonymousAllowed) {
						throw new FailedLoginException("Distinguished name is unknown");
					}
					log.log(Level.WARN, "Know user's DN not found (" + username + ") ");
					username = UserManager.ANONYMOUS_USERNAME;
				}
				else { // if (!certChain[0].getSubjectX500Principal().equals(dn.asX500Principal())) {
					userMgr.logUnknownDN(username, certChain[0].getSubjectX500Principal());
					if (!anonymousAllowed) {
						throw new FailedLoginException(
							"Expected distinguished name: " + x500User.getName());
					}
					username = UserManager.ANONYMOUS_USERNAME;
				}
			}
			else {
				if (!anonymousAllowed) {
					throw new FailedLoginException("Unknown user: " + username);
				}
				username = UserManager.ANONYMOUS_USERNAME;
			}

			if (UserManager.ANONYMOUS_USERNAME.equals(username)) {
				RepositoryManager.log(null, null, "Anonymous access allowed for: " +
					certChain[0].getSubjectX500Principal().toString(), user.getName());
			}

		}
		catch (LoginException e) {
			throw e;
		}
		catch (Throwable t) {
			String msg = t.getMessage();
			if (msg == null) {
				msg = t.toString();
			}
			throw new FailedLoginException(msg);
		}
		return username;
	}
<code>PKIAuthenticationModule</code> performs client authentication through the 
use of a dual-signed token.
Ghidra/Features/GhidraServer/src/main/java/ghidra/server/security/PKIAuthenticationModule.java