Credentials of a kerberos acceptor. A KerberosPrincipal object (kp) is the principal. It can be specified as the serverPrincipal argument in the getInstance() method, or uses only KerberosPrincipal in the subject. Otherwise, the creds object is unbound and kp is null. The class also encapsulates various secrets, which can be: 1. Some KerberosKeys (generated from password) 2. Some KeyTabs (for a typical service based on keytabs) 3. A TGT (for S4U2proxy extension or user2user) Note that some secrets can coexist. For example, a user2user service can use its keytab (or keys) if the client can successfully obtain a normal service ticket, or it can use the TGT (actually, the session key of the TGT) if the client can only acquire a service ticket of ENC-TKT-IN-SKEY style.