@Override
    public List<Credential> fromRequest(final HttpServletRequest request, final MultiValueMap<String, String> requestBody) throws Throwable {
        val credentials = super.fromRequest(request, requestBody);
        if (credentials.isEmpty()) {
            return credentials;
        }
        val credential = FunctionUtils.doUnchecked(() -> extractCredential(request, credentials));
        if (credential == null) {
            LOGGER.trace("Not a surrogate authentication attempt, returning parent class credentials");
            return credentials;
        }
        val surrogateAccounts = surrogateAuthenticationService.getImpersonationAccounts(credential.getId(), Optional.empty());
        val surrogateUsername = credential.getCredentialMetadata().getTrait(SurrogateCredentialTrait.class)
            .map(SurrogateCredentialTrait::getSurrogateUsername)
            .orElseThrow();
        if (!surrogateAccounts.contains(surrogateUsername)) {
            throw new SurrogateAuthenticationException(
                "Unable to authorize surrogate authentication request for " + surrogateUsername);
        }
        return CollectionUtils.wrapList(prepareCredential(request, credential));
    }
Header to be extracted from the request
that indicates the surrogate/substitute principal name.
support/cas-server-support-surrogate-core/src/main/java/org/apereo/cas/authentication/rest/SurrogateAuthenticationRestHttpRequestCredentialFactory.java