container-common/src/main/java/com/streamsets/datacollector/security/SecurityContext.java
public synchronized void login() {
    if (subject != null) {
      throw new IllegalStateException(Utils.format("Service already login, Principal '{}'",
                                                   subject.getPrincipals()));
    }
    if (securityConfiguration.isKerberosEnabled()) {
      try {
        loginContext = createLoginContext();
        subject = loginContext.getSubject();
      } catch (Exception ex) {
        throw new RuntimeException(Utils.format("Could not get Kerberos credentials: {}", ex.toString()), ex);
      }
      if (renewalThread == null) {
        renewalThread = new Thread() {
          @Override
          public void run() {
            LOG.debug("Starting renewal thread");
            if (!SecurityContext.this.sleep(THIRTY_SECONDS_MS)) {
              LOG.info("Interrupted, exiting renewal thread");
              return;
            }
            while (true) {
              LOG.trace("Renewal check starts");
              try {
                KerberosTicket lastExpiringTGT = getNewestTGT();
                if (lastExpiringTGT == null) {
                  LOG.warn(
                      "Could not obtain kerberos ticket, it may have expired already or it was logged out, will wait" +
                      "30 secs to attempt a relogin"
                  );
                  LOG.trace("Ticket not found, sleeping 30 secs and trying to login");
                  if (!SecurityContext.this.sleep(THIRTY_SECONDS_MS)) {
                    LOG.info("Interrupted, exiting renewal thread");
                    return;
                  }
                } else {
                  long renewalTimeMs = calculateRenewalTime(lastExpiringTGT) - THIRTY_SECONDS_MS;
                  LOG.trace("Ticket found time to renewal '{}ms', sleeping that time", renewalTimeMs);
                  if (renewalTimeMs > 0) {
                    if (!SecurityContext.this.sleep(renewalTimeMs)) {
                      LOG.info("Interrupted, exiting renewal thread");
                      return;
                    }
                  }
                }
                LOG.debug("Triggering relogin");
                Set<KerberosTicket> oldTickets = getSubject().getPrivateCredentials(KerberosTicket.class);
                relogin(3);
                // Remove all old private credentials, since we only need the new one we just added
                getSubject().getPrivateCredentials().removeAll(oldTickets);
              } catch (Exception exception) {
                LOG.error("Stopping renewal thread because of exception: " + exception, exception);
                return;
              }
              catch (Throwable throwable) {
                LOG.error("Error in renewal thread: " + throwable, throwable);
                return;
              }
            }
          }
        };
        List<String> principals = new ArrayList<>();
        for (Principal p : subject.getPrincipals()) {
          principals.add(p.getName());
        }
        renewalThread.setName("Kerberos-Renewal-Thread-" + Joiner.on(",").join(principals));
        renewalThread.setContextClassLoader(Thread.currentThread().getContextClassLoader());
        renewalThread.setDaemon(true);
        renewalThread.start();
      }
    } else {
      subject = new Subject();
    }
    LOG.debug("Login. Kerberos enabled '{}', Principal '{}'", securityConfiguration.isKerberosEnabled(),
      subject.getPrincipals());
  }
public synchronized void login() {
    if (subject != null) {
      throw new IllegalStateException(Utils.format("Service already login, Principal '{}'",
                                                   subject.getPrincipals()));
    }
    if (securityConfiguration.isKerberosEnabled()) {
      try {
        loginContext = createLoginContext();
        subject = loginContext.getSubject();
      } catch (Exception ex) {
        throw new RuntimeException(Utils.format("Could not get Kerberos credentials: {}", ex.toString()), ex);
      }
      if (renewalThread == null) {
        renewalThread = new Thread() {
          @Override
          public void run() {
            LOG.debug("Starting renewal thread");
            if (!SecurityContext.this.sleep(THIRTY_SECONDS_MS)) {
              LOG.info("Interrupted, exiting renewal thread");
              return;
            }
            while (true) {
              LOG.trace("Renewal check starts");
              try {
                KerberosTicket lastExpiringTGT = getNewestTGT();
                if (lastExpiringTGT == null) {
                  LOG.warn(
                      "Could not obtain kerberos ticket, it may have expired already or it was logged out, will wait" +
                      "30 secs to attempt a relogin"
                  );
                  LOG.trace("Ticket not found, sleeping 30 secs and trying to login");
                  if (!SecurityContext.this.sleep(THIRTY_SECONDS_MS)) {
                    LOG.info("Interrupted, exiting renewal thread");
                    return;
                  }
                } else {
                  long renewalTimeMs = calculateRenewalTime(lastExpiringTGT) - THIRTY_SECONDS_MS;
                  LOG.trace("Ticket found time to renewal '{}ms', sleeping that time", renewalTimeMs);
                  if (renewalTimeMs > 0) {
                    if (!SecurityContext.this.sleep(renewalTimeMs)) {
                      LOG.info("Interrupted, exiting renewal thread");
                      return;
                    }
                  }
                }
                LOG.debug("Triggering relogin");
                Set<KerberosTicket> oldTickets = getSubject().getPrivateCredentials(KerberosTicket.class);
                relogin(3);
                // Remove all old private credentials, since we only need the new one we just added
                getSubject().getPrivateCredentials().removeAll(oldTickets);
              } catch (Exception exception) {
                LOG.error("Stopping renewal thread because of exception: " + exception, exception);
                return;
              }
              catch (Throwable throwable) {
                LOG.error("Error in renewal thread: " + throwable, throwable);
                return;
              }
            }
          }
        };
        List<String> principals = new ArrayList<>();
        for (Principal p : subject.getPrincipals()) {
          principals.add(p.getName());
        }
        renewalThread.setName("Kerberos-Renewal-Thread-" + Joiner.on(",").join(principals));
        renewalThread.setContextClassLoader(Thread.currentThread().getContextClassLoader());
        renewalThread.setDaemon(true);
        renewalThread.start();
      }
    } else {
      subject = new Subject();
    }
    LOG.debug("Login. Kerberos enabled '{}', Principal '{}'", securityConfiguration.isKerberosEnabled(),
      subject.getPrincipals());
  }
Logs in. If Kerberos is enabled it logs in against the KDC, otherwise is a NOP.