The new com.sun.security.auth.module.KeyStoreLoginModule class supplies
principals of the wrong class. It should put principals of class
javax.security.auth.x500.X500Principal into the principal set of the subject.
Instead, it copies the subject principal from the X.509 certificate, which is
currently an instance of the sun.security.x509.X500Name class.