@Override
    protected String extractPrincipalId(final Credential credential, final Optional<Principal> currentPrincipal) {
        LOGGER.debug("Attempting to extract principal id for principal [{}]", currentPrincipal);
        if (!supports(credential)) {
            LOGGER.trace("Provided credential [{}] is not supported for surrogate authentication", credential);
            return super.extractPrincipalId(credential, currentPrincipal);
        }
        if (currentPrincipal.isEmpty()) {
            throw new IllegalArgumentException("Current principal resolved cannot be null");
        }
        val id = credential.getCredentialMetadata().getTrait(SurrogateCredentialTrait.class)
            .map(SurrogateCredentialTrait::getSurrogateUsername)
            .orElseThrow();
        LOGGER.debug("Resolving principal id for surrogate authentication as [{}]", id);
        return id;
    }
This is {@link SurrogatePrincipalResolver}.

@author Misagh Moayyed
@since 5.1.0
support/cas-server-support-surrogate-core/src/main/java/org/apereo/cas/authentication/SurrogatePrincipalResolver.java