@Override
    protected Credential constructCredentialsFromRequest(final RequestContext context) {
        return FunctionUtils.doUnchecked(() -> {
            val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(context);
            val remoteUser = getRemotePrincipalId(request);
            if (StringUtils.isNotBlank(remoteUser)) {
                LOGGER.debug("User [{}] found in request", remoteUser);
                val attributes = principalAttributesExtractor.getAttributes(request);
                LOGGER.debug("Attributes [{}] found in request", attributes);
                return new PrincipalBearingCredential(principalFactory.createPrincipal(remoteUser, attributes));
            }
            LOGGER.debug("No user found in request");
            return null;
        });
    }
The principal factory used to construct the final principal.
support/cas-server-support-trusted/src/main/java/org/apereo/cas/adaptors/trusted/web/flow/BasePrincipalFromNonInteractiveCredentialsAction.java