It would be useful if the JAAS policy file allowed keystore aliases to be used in grants, for example:
    grant principal "alias" { ... };
If the alias resolves to an X509Certificate, treat the above as equivalent to
    grant com.sun.security.auth.X500Principal "<SubjectDN>"