It would be helpful for the documentation for the
com.sun.security.auth.X500Principal class to explain how the principal name is
canonicalized. The constructor appears to modify the principal name to put a
single space between fields and use canonical values for field names.
Permission grants specify explicit principal names which need to match the
canonicalized name in the principal instance, so applications need to specify
names in the canonical format correctly.