web/src/main/java/org/springframework/security/web/jaasapi/JaasApiIntegrationFilter.java
public final void doFilter(final ServletRequest request,
			final ServletResponse response, final FilterChain chain)
			throws ServletException, IOException {

		Subject subject = obtainSubject(request);
		if (subject == null && createEmptySubject) {
			if (logger.isDebugEnabled()) {
				logger.debug("Subject returned was null and createEmtpySubject is true; creating new empty subject to run as.");
			}
			subject = new Subject();
		}
		if (subject == null) {
			if (logger.isDebugEnabled()) {
				logger.debug("Subject is null continue running with no Subject.");
			}
			chain.doFilter(request, response);
			return;
		}
		final PrivilegedExceptionAction<Object> continueChain = new PrivilegedExceptionAction<Object>() {
			public Object run() throws IOException, ServletException {
				chain.doFilter(request, response);
				return null;
			}
		};

		if (logger.isDebugEnabled()) {
			logger.debug("Running as Subject " + subject);
		}
		try {
			Subject.doAs(subject, continueChain);
		}
		catch (PrivilegedActionException e) {
			throw new ServletException(e.getMessage(), e);
		}
	}
public final void doFilter(final ServletRequest request,
			final ServletResponse response, final FilterChain chain)
			throws ServletException, IOException {

		Subject subject = obtainSubject(request);
		if (subject == null && createEmptySubject) {
			if (logger.isDebugEnabled()) {
				logger.debug("Subject returned was null and createEmtpySubject is true; creating new empty subject to run as.");
			}
			subject = new Subject();
		}
		if (subject == null) {
			if (logger.isDebugEnabled()) {
				logger.debug("Subject is null continue running with no Subject.");
			}
			chain.doFilter(request, response);
			return;
		}
		final PrivilegedExceptionAction<Object> continueChain = new PrivilegedExceptionAction<Object>() {
			public Object run() throws IOException, ServletException {
				chain.doFilter(request, response);
				return null;
			}
		};

		if (logger.isDebugEnabled()) {
			logger.debug("Running as Subject " + subject);
		}
		try {
			Subject.doAs(subject, continueChain);
		}
		catch (PrivilegedActionException e) {
			throw new ServletException(e.getMessage(), e);
		}
	}
<p>
Attempts to obtain and run as a JAAS <code>Subject</code> using
{@link #obtainSubject(ServletRequest)}.
</p>

<p>
If the <code>Subject</code> is <code>null</code> and <tt>createEmptySubject</tt> is
<code>true</code>, an empty, writeable <code>Subject</code> is used. This allows
for the <code>Subject</code> to be populated at the time of login. If the
<code>Subject</code> is <code>null</code>, the <code>FilterChain</code> continues
with no additional processing. If the <code>Subject</code> is not <code>null</code>
, the <code>FilterChain</code> is ran with
{@link Subject#doAs(Subject, PrivilegedExceptionAction)} in conjunction with the
<code>Subject</code> obtained.
</p>