public Optional<String> extractUPNString(final Collection<List<?>> subjectAltNames) {
        for (val sanItem : subjectAltNames) {
            if (LOGGER.isTraceEnabled()) {
                if (sanItem.size() == 2) {
                    val name = sanItem.get(1);
                    val value = name instanceof String ? name : name instanceof final byte[] array ? getAltnameSequence(array) : name;
                    LOGGER.trace("Found subject alt name of type [{}] with value [{}]", sanItem.getFirst(), value);
                } else {
                    LOGGER.trace("SAN item of unexpected size found: [{}]", sanItem);
                }
            }
            val seq = getOtherNameTypeSAN(sanItem);
            val upnString = getUPNStringFromSequence(seq);
            if (StringUtils.isNotBlank(upnString)) {
                LOGGER.debug("Found user principal name in certificate: [{}]", upnString);
                return Optional.of(upnString);
            }
        }
        return Optional.empty();
    }
Return the first {@code X509UPNExtractorUtils.UPN_OBJECTID} found in the subject alternative names (SAN) extension field of the certificate.

@param subjectAltNames X509 certificate subject alt names
@return User principal name, or null if no SAN found matching UPN type.
support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/principal/X509UPNExtractorUtils.java