@Override
    protected Optional<ClientCredential> buildClientCredential(final BaseClient client, final RequestContext requestContext, final Credentials credential) {
        val clientCredential = super.buildClientCredential(client, requestContext, credential);
        val passwordlessRequestResult = Optional.ofNullable(PasswordlessWebflowUtils.getPasswordlessAuthenticationRequest(requestContext, PasswordlessAuthenticationRequest.class));
        if (clientCredential.isPresent() && passwordlessRequestResult.isPresent()) {
            val passwordlessRequest = passwordlessRequestResult.get();
            if (passwordlessRequest.getProperties().containsKey(SurrogatePasswordlessAuthenticationRequestParser.PROPERTY_SURROGATE_USERNAME)) {
                val surrogateUsername = passwordlessRequest.getProperties().get(SurrogatePasswordlessAuthenticationRequestParser.PROPERTY_SURROGATE_USERNAME);
                clientCredential.get().getCredentialMetadata().addTrait(new SurrogateCredentialTrait(surrogateUsername));
                return clientCredential;
            }
        }
        return Optional.empty();
    }
This is {@link SurrogateDelegatedAuthenticationCredentialExtractor}.

@author Misagh Moayyed
@since 7.0.0
support/cas-server-support-surrogate-webflow/src/main/java/org/apereo/cas/web/flow/passwordless/SurrogateDelegatedAuthenticationCredentialExtractor.java