@Override
    public Principal process(final Principal principal, final BaseClient client, final Credential credential,
                             final Service service) throws Throwable {
        val surrogateTrait = credential.getCredentialMetadata().getTrait(SurrogateCredentialTrait.class);
        if (surrogateTrait.isPresent()) {
            val surrogateUsername = surrogateTrait.get().getSurrogateUsername();
            if (surrogateAuthenticationService.canImpersonate(surrogateUsername, principal, Optional.ofNullable(service))) {
                return surrogatePrincipalBuilder.buildSurrogatePrincipal(credential, principal);
            }
        }
        return principal;
    }
This is {@link SurrogateDelegatedAuthenticationPreProcessor}.

@author Misagh Moayyed
@since 7.0.0
support/cas-server-support-surrogate-webflow/src/main/java/org/apereo/cas/web/flow/pac4j/SurrogateDelegatedAuthenticationPreProcessor.java