@Override
    public Principal buildSurrogatePrincipal(final Credential credential, final Principal primaryPrincipal,
                                             final RegisteredService registeredService) throws Throwable {

        val surrogate = extractSurrogateUser(credential);
        val activeAttributeRepositoryIdentifiers = PrincipalResolverUtils.buildActiveAttributeRepositoryIds(casProperties.getPersonDirectory());
        val query = AttributeRepositoryQuery.builder()
            .principal(primaryPrincipal)
            .activeRepositoryIds(activeAttributeRepositoryIdentifiers)
            .registeredService(registeredService)
            .tenant(credential.getTenant())
            .build();

        val repositoryIds = attributeRepositoryResolver.resolve(query);
        val attributes = PrincipalAttributeRepositoryFetcher
            .builder()
            .attributeRepository(attributeRepository)
            .principalId(surrogate)
            .activeAttributeRepositoryIdentifiers(repositoryIds)
            .currentPrincipal(primaryPrincipal)
            .build()
            .retrieve();

        val surrogatePrincipal = principalFactory.createPrincipal(surrogate, attributes);
        LOGGER.debug("Built surrogate principal [{}] with primary principal [{}]", surrogatePrincipal, primaryPrincipal);
        return new SurrogatePrincipal(primaryPrincipal, surrogatePrincipal);
    }
This is {@link SurrogateAuthenticationPrincipalBuilder}.

@author Misagh Moayyed
@since 5.3.0
support/cas-server-support-surrogate-core/src/main/java/org/apereo/cas/authentication/DefaultSurrogateAuthenticationPrincipalBuilder.java