KerberosLoginProvider.isLoginPossible does accidental login with keytab

In KerberosLoginProvider.isLoginPossible there is a call to UserGroupInformation.getCurrentUser() before principal check (keytab usage). This triggers an accidental login with either kerberos credentials if available, or as the local OS user, based on security settings. This is not problematic most of the time since KerberosLoginProvider.doLogin overwrites the credentials with keytab. The problem hurts however when login fails for whatever reason. Such case the workload is just not starting.