https://issues.jboss.org/browse/SECURITY-772


org.jboss.security.negotiation.spnego.SPNEGOLoginModule

private class AcceptSecContext:

if (gssContext.isEstablished())
{
log.warn("Authentication was performed despite already being authenticated!");

// TODO - Refactor to only do this once.
setIdentity(new KerberosPrincipal(gssContext.getSrcName().toString()));

The last line should obey the "removeRealmFromPrincipal" flag similarly as a bit further down:

setIdentity(createIdentity(gssContext.getSrcName().toString()));