The java.net.Authenticator class supports Basic authentication only. If there is a requirement to support Negotiate authentication (Kerberos) with the java.net.http.HttpClient, an Authenticator cannot be used. The calling code must handle the 401 response and generate the required Authorizaiton headers.

However use of Authenticator is _required_ if a proxy server requiring authentication is in use with https:// URLs - the proxy authentication headers must be set on the CONNECT call to the proxy. Once an Authenticator has been set on HttpClient for use with a proxy, it becomes impossible for the calling code to handle Negotiate authentication.