protected void insertPrincipalIdAsAttributeIfNeeded(final RegisteredServiceAttributeReleasePolicyContext context,
                                                        final Map<String, List<Object>> attributesToRelease) throws Throwable {
        if (StringUtils.isNotBlank(getPrincipalIdAttribute()) && !attributesToRelease.containsKey(getPrincipalIdAttribute())) {
            LOGGER.debug("Attempting to resolve the principal id for service [{}]", context.getRegisteredService().getServiceId());
            val usernameProvider = context.getRegisteredService().getUsernameAttributeProvider();
            if (usernameProvider != null) {
                val usernameContext = RegisteredServiceUsernameProviderContext.builder()
                    .service(context.getService())
                    .principal(context.getPrincipal())
                    .registeredService(context.getRegisteredService())
                    .releasingAttributes(attributesToRelease)
                    .applicationContext(context.getApplicationContext())
                    .build();
                val id = usernameProvider.resolveUsername(usernameContext);
                LOGGER.debug("Releasing resolved principal id [{}] as attribute [{}]", id, getPrincipalIdAttribute());
                attributesToRelease.put(getPrincipalIdAttribute(), CollectionUtils.wrapList(id));
            }
        }
    }
Post load, after having loaded the bean via JPA, etc.
core/cas-server-core-authentication-attributes/src/main/java/org/apereo/cas/services/AbstractRegisteredServiceAttributeReleasePolicy.java