protected void mergePrincipalAttributes(final Map<String, List<Object>> principalAttributes,
                                            final AttributeMerger merger,
                                            final Authentication authn) {
        val authenticatedPrincipal = authn.getPrincipal();
        LOGGER.debug("Evaluating authentication principal [{}] for inclusion in result", authenticatedPrincipal);

        principalAttributes.putAll(CoreAuthenticationUtils.mergeAttributes(principalAttributes, authenticatedPrincipal.getAttributes(), merger));
        LOGGER.debug("Collected principal attributes [{}] for inclusion in this result for principal [{}]",
            principalAttributes, authenticatedPrincipal.getId());
    }
Principal id is and must be enforced to be the same for all authentications.
Based on that restriction, it's safe to grab the first principal id in the chain
when composing the authentication chain for the caller.
core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/DefaultAuthenticationResultBuilder.java