static HttpCookie getAuthCookie(CookieStore cookieStore, URI uri) {
    if (cookieStore == null) {
      return null;
    }
    boolean isSSL = uri.getScheme().equals("https");
    List<HttpCookie> cookies = cookieStore.getCookies();

    for (HttpCookie c : cookies) {
      // If this is a secured cookie and the current connection is non-secured,
      // then, skip this cookie. We need to skip this cookie because, the cookie
      // replay will not be transmitted to the server.
      if (c.getSecure() && !isSSL) {
        continue;
      }
      if (c.getName().equals(AuthenticatedURL.AUTH_COOKIE)) {
        return c;
      }
    }
    return null;
  }
This method always needs to be called within a doAs block so that the client's TGT credentials
can be read from the Subject.

@return Kerberos Challenge String.

@throws AuthenticationException on authentication errors.
druid-handler/src/java/org/apache/hadoop/hive/druid/security/DruidKerberosUtil.java