@Override
  public Authentication authenticate(Authentication authentication) throws AuthenticationException {

    if (authentication == null) {
      throw new BadCredentialsException("Missing credentials");
    } else if (authentication instanceof KerberosServiceRequestToken) {
      KerberosServiceRequestToken auth = (KerberosServiceRequestToken) authentication;
      byte[] token = auth.getToken();

      LOG.debug("Validating Kerberos token");
      KerberosTicketValidation ticketValidation = ticketValidator.validateTicket(token);
      LOG.debug("Kerberos token validated: {}", ticketValidation.username());

      Object requestDetails = authentication.getDetails();
      UserDetails userDetails;

      if (requestDetails instanceof TrustedProxyAuthenticationDetails) {
        TrustedProxyAuthenticationDetails trustedProxyAuthenticationDetails = (TrustedProxyAuthenticationDetails) requestDetails;
        String proxiedUserName = trustedProxyAuthenticationDetails.getDoAs();

        if (StringUtils.isNotEmpty(proxiedUserName)) {
          String localProxyUserName = authToLocalUserDetailsService.translatePrincipalName(ticketValidation.username());

          userDetails = new AmbariProxiedUserDetailsImpl(
              proxiedUserDetailsService.loadProxiedUser(proxiedUserName, localProxyUserName, trustedProxyAuthenticationDetails),
              new AmbariProxyUserKerberosDetailsImpl(ticketValidation.username(), localProxyUserName));
        } else {
          // This is not a trusted proxy request... handle normally
          userDetails = authToLocalUserDetailsService.loadUserByUsername(ticketValidation.username());
        }
      } else {
        // This is not a trusted proxy request... handle normally
        userDetails = authToLocalUserDetailsService.loadUserByUsername(ticketValidation.username());
      }

      KerberosServiceRequestToken responseAuth = new KerberosServiceRequestToken(userDetails, ticketValidation, userDetails.getAuthorities(), token);
      responseAuth.setDetails(requestDetails);
      return responseAuth;
    } else {
      throw new BadCredentialsException(String.format("Unexpected Authentication class: %s", authentication.getClass().getName()));
    }
  }
AmbariKerberosAuthenticationProvider is an {@link org.springframework.security.authentication.AuthenticationProvider}
implementation used to authenticate users using a Kerberos ticket.
<p>
In order for this provider to be usable, Kerberos authentication must be enabled. This may be done
using the <code>ambari-server setup-kerberos</code> CLI.
<p>
This implementation supports Trusted Proxy authentication.
ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariKerberosAuthenticationProvider.java