class KerberosHttpClient {

    public String get(final String url, final String userId) {
	logger.info("Calling KerberosHttpClient {} {} {}", this.principal, this.keyTabLocation, url);
	Configuration config = new Configuration() {
	    @SuppressWarnings("serial")
	    @Override
	    public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
		Map<String, Object> options = new HashMap<>(9);
		options.put("useTicketCache", "false");
		options.put("useKeyTab", "true");
		options.put("keyTab", keyTabLocation);
		options.put("refreshKrb5Config", "true");
		options.put("principal", principal);
		options.put("storeKey", "true");
		options.put("doNotPrompt", "true");
		options.put("isInitiator", "true");
		options.put("debug", "true");
		return new AppConfigurationEntry[] {
			new AppConfigurationEntry("com.sun.security.auth.module.Krb5LoginModule",
				AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, options) };
	    }
	};
	Set<Principal> princ = new HashSet<>(1);
	princ.add(new KerberosPrincipal(userId));
	Subject sub = new Subject(false, princ, new HashSet<>(), new HashSet<>());

	LoginContext lc;
	try {
	    lc = new LoginContext("", sub, null, config);
	    lc.login();
	    Subject serviceSubject = lc.getSubject();
	    return Subject.doAs(serviceSubject, (PrivilegedAction<String>) () -> {
		CloseableHttpClient httpClient = buildSpengoHttpClient();
		HttpGet httpget = new HttpGet(url);
		return HttpUtils.getResponseContentString(httpget, httpClient);
	    });
	} catch (LoginException le) {
	    logger.error("Kerberos authentication failed ", le);
	}
	return null;
    }

    public  KerberosHttpClient(String principal, String keyTabLocation);
    public  KerberosHttpClient(String principal, String keyTabLocation, boolean isDebug);
    public  KerberosHttpClient(String principal, String keyTabLocation, String krb5Location, boolean isDebug);

}