@Override
    public Optional<ErrorResponse> filter(DiscFilterRequest request) {
        try {
            Optional<AthenzPrincipal> certificatePrincipal = getClientCertificate(request)
                    .map(AthenzIdentities::from)
                    .map(AthenzPrincipal::new);
            if (certificatePrincipal.isEmpty()) {
                String errorMessage = "Unable to authenticate Athenz identity. " +
                                      "Either client certificate or principal token is required.";
                return createResponse(request, Response.Status.UNAUTHORIZED, errorMessage);
            }
            AthenzPrincipal principal = certificatePrincipal.get();
            request.setUserPrincipal(principal);
            request.setRemoteUser(principal.getName());
            request.setAttribute(RESULT_PRINCIPAL, principal);
            return Optional.empty();
        } catch (Exception e) {
            return createResponse(request, Response.Status.UNAUTHORIZED, e.getMessage());
        }
    }
Authenticates Athenz principal through TLS client authentication (Athenz identity certificate).
The TLS authentication is based on the following assumptions:
 - The underlying connector is configured with 'clientAuth' set to either WANT_AUTH or NEED_AUTH.
 - The trust store is configured with the Athenz CA certificates only.

@author bjorncs
jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/athenz/AthenzPrincipalFilter.java