private void negotiate(HttpUriRequest method, String uri)
    throws IOException, GeneralSecurityException {
    try {
      AuthenticatedURL.Token token = new AuthenticatedURL.Token();
      if (authenticator == null) {
        authenticator = new KerberosAuthenticator();
        if (trustStore.isPresent()) {
          // The authenticator does not use Apache HttpClient, so we need to
          // configure it separately to use the specified trustStore
          Configuration sslConf = setupTrustStoreForHadoop(trustStore.get());
          SSLFactory sslFactory = new SSLFactory(Mode.CLIENT, sslConf);
          sslFactory.init();
          authenticator.setConnectionConfigurator(sslFactory);
        }
      }
      URL url = new URL(uri);
      authenticator.authenticate(url, token);
      if (sticky) {
        BasicClientCookie authCookie = new BasicClientCookie("hadoop.auth", token.toString());
        // Hadoop eats the domain even if set by server
        authCookie.setDomain(url.getHost());
        stickyContext.getCookieStore().addCookie(authCookie);
      } else {
        // session cookie is NOT set for backwards compatibility for non-sticky mode
        // Inject the obtained negotiated token in the method cookie
        // This is only done for this single request, the next one will trigger a new SPENGO
        // handshake
        injectToken(method, token);
      }
    } catch (AuthenticationException e) {
      LOG.error("Failed to negotiate with the server.", e);
      throw new IOException(e);
    }
  }
Initiate client side Kerberos negotiation with the server.
@param method method to inject the authentication token into.
@param uri    the String to parse as a URL.
@throws IOException if unknown protocol is found.
hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/client/Client.java