@Override
        public KerberosTicketValidation run() throws Exception {
            var responseToken = new byte[0];
            GSSName gssName = null;
            var context = GSSManager.getInstance().createContext((GSSCredential) null);
            var first = true;
            while (!context.isEstablished()) {
                if (first) {
                    kerberosTicket = tweakJdkRegression(kerberosTicket);
                }
                responseToken = context.acceptSecContext(kerberosTicket, 0, kerberosTicket.length);
                gssName = context.getSrcName();
                if (gssName == null) {
                    throw new BadCredentialsException("GSSContext name of the context initiator is null");
                }
                first = false;
            }
            if (!holdOnToGSSContext) {
                context.dispose();
            }
            return new KerberosTicketValidation(gssName.toString(), servicePrincipal, responseToken, context);
        }
This class is needed, because the validation must run with previously generated JAAS subject
which belongs to the service principal and was loaded out of the keytab during startup.
pac4j-kerberos/src/main/java/org/pac4j/kerberos/credentials/authenticator/SunJaasKerberosTicketValidator.java