@Override
    public final String resolveUsername(final RegisteredServiceUsernameProviderContext context) throws Throwable {
        RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(context.getService(), context.getRegisteredService());
            
        val resolvedUsername = resolveUsernameInternal(context);
        if (canonicalizationMode == null) {
            canonicalizationMode = "NONE";
        }
        val removedUsername = removePatternFromUsernameIfNecessary(resolvedUsername);
        val finalUsername = scopeUsernameIfNecessary(removedUsername);
        val uid = CaseCanonicalizationMode.valueOf(canonicalizationMode).canonicalize(finalUsername.trim(), Locale.getDefault());
        LOGGER.debug("Resolved username for [{}] is [{}]", context.getService(), uid);
        if (!this.encryptUsername) {
            return uid;
        }
        val encryptedId = encryptResolvedUsername(context, uid);
        if (StringUtils.isBlank(encryptedId)) {
            throw new IllegalArgumentException("Could not encrypt username " + uid + " for service " + context.getService());
        }
        return encryptedId;
    }
This is {@link BaseRegisteredServiceUsernameAttributeProvider}.

@author Misagh Moayyed
@since 5.1.0
core/cas-server-core-services-api/src/main/java/org/apereo/cas/services/BaseRegisteredServiceUsernameAttributeProvider.java