public static String firstPrincipal(Subject subject) {
        Set<Principal> principals = subject.getPrincipals();
        synchronized (principals) {
            Iterator<Principal> iterator = principals.iterator();
            if (iterator.hasNext())
                return iterator.next().getName();
            else
                throw new KafkaException("Principal could not be determined from Subject, this may be a transient failure due to Kerberos re-login");
        }
    }
Returns the first Principal from Subject.
@throws KafkaException if there are no Principals in the Subject.
    During Kerberos re-login, principal is reset on Subject. An exception is
    thrown so that the connection is retried after any configured backoff.
clients/src/main/java/org/apache/kafka/common/security/authenticator/SaslClientAuthenticator.java