protected Principal createPrincipal(final String username, final LdapEntry ldapEntry) throws Throwable {
        LOGGER.debug("Creating LDAP principal for [{}] based on [{}] and attributes [{}]", username, ldapEntry.getDn(),
            ldapEntry.getAttributeNames());
        val id = getLdapPrincipalIdentifier(username, ldapEntry);
        LOGGER.debug("LDAP principal identifier created is [{}]", id);
        val attributeMap = collectAttributesForLdapEntry(ldapEntry, id);
        LOGGER.debug("Created LDAP principal for id [{}] and [{}] attributes", id, attributeMap.size());
        return principalFactory.createPrincipal(id, attributeMap);
    }
Creates a CAS principal with attributes if the LDAP entry contains principal attributes.

@param username  Username that was successfully authenticated which is used for principal ID when principal id is not specified.
@param ldapEntry LDAP entry that may contain principal attributes.
@return Principal if the LDAP entry contains at least a principal ID attribute value, null otherwise.
@throws LoginException On security policy errors related to principal creation.
support/cas-server-support-ldap-core/src/main/java/org/apereo/cas/authentication/LdapAuthenticationHandler.java