@Override
    public Optional<AuthenticationResultBuilder> buildSurrogateAuthenticationResult(
        final AuthenticationResultBuilder authenticationResultBuilder,
        final Credential mutableCredential,
        final RegisteredService registeredService) throws Throwable {
        val initialAuthentication = authenticationResultBuilder.getInitialAuthentication();
        if (initialAuthentication.isPresent()) {
            val authentication = initialAuthentication.get();
            val principal = extractPrimaryPrincipal(authentication);

            val surrogateUsername = extractSurrogateUser(mutableCredential);
            if (!surrogateAuthenticationService.canImpersonate(surrogateUsername, principal, Optional.empty())) {
                throw new SurrogateAuthenticationException("Unable to authorize surrogate authentication request for " + surrogateUsername);
            }
            val surrogatePrincipal = buildSurrogatePrincipal(mutableCredential, principal, registeredService);
            val authenticationBuilder = DefaultAuthenticationBuilder.newInstance(authentication).setPrincipal(surrogatePrincipal);
            surrogateAuthenticationService.collectSurrogateAttributes(authenticationBuilder, surrogateUsername, principal.getId());
            return Optional.of(authenticationResultBuilder.collect(authenticationBuilder.build()));
        }
        return Optional.empty();
    }
This is {@link SurrogateAuthenticationPrincipalBuilder}.

@author Misagh Moayyed
@since 5.3.0
support/cas-server-support-surrogate-core/src/main/java/org/apereo/cas/authentication/DefaultSurrogateAuthenticationPrincipalBuilder.java