protected MutableCredential extractCredential(final HttpServletRequest request,
                                                  final List<Credential> credentials) {
        val credential = (MutableCredential) credentials.getFirst();
        if (credential != null) {
            var surrogateUsername = request.getHeader(REQUEST_HEADER_SURROGATE_PRINCIPAL);
            if (StringUtils.isNotBlank(surrogateUsername)) {
                LOGGER.debug("Request surrogate principal [{}]", surrogateUsername);
                credential.getCredentialMetadata().addTrait(new SurrogateCredentialTrait(surrogateUsername));
                return credential;
            }

            val username = credential.getId();
            val separator = properties.getCore().getSeparator();
            if (username.contains(separator)) {
                surrogateUsername = username.substring(0, username.indexOf(separator));
                val realUsername = username.substring(username.indexOf(separator) + separator.length());
                credential.setId(realUsername);
                credential.getCredentialMetadata().addTrait(new SurrogateCredentialTrait(surrogateUsername));
                return credential;
            }
        }
        return null;
    }
Header to be extracted from the request
that indicates the surrogate/substitute principal name.
support/cas-server-support-surrogate-core/src/main/java/org/apereo/cas/authentication/rest/SurrogateAuthenticationRestHttpRequestCredentialFactory.java