protected Map<String, List<Object>> collectAttributesForLdapEntry(final LdapEntry ldapEntry, final String username) {
        val attributeMap = new HashMap<String, List<Object>>(this.principalAttributeMap.size());
        LOGGER.debug("The following attributes are requested to be retrieved and mapped: [{}]", attributeMap.keySet());
        principalAttributeMap
            .entrySet()
            .stream()
            .filter(entry -> !StringUtils.equalsIgnoreCase(entry.getKey(), "*") && !StringUtils.equalsIgnoreCase(entry.getKey(), "+"))
            .forEach(entry -> {
                val attributeNames = CollectionUtils.toCollection(entry.getValue(), ArrayList.class);
                if (attributeNames.size() == 1 && attributeNames.stream().allMatch(name -> !name.toString().isEmpty() && name.toString().charAt(name.toString().length() - 1) == ';')) {
                    val attrs = ldapEntry.getAttributes()
                        .stream()
                        .filter(attr -> attr.getName().startsWith(entry.getKey().concat(";"))).toList();
                    attrs.forEach(attr -> attributeMap.putAll(collectAttributeValueForEntry(ldapEntry, attr.getName(), List.of())));
                } else {
                    attributeMap.putAll(collectAttributeValueForEntry(ldapEntry, entry.getKey(), attributeNames));
                }
            });
        if (this.collectDnAttribute) {
            LOGGER.debug("Recording principal DN attribute as [{}]", this.principalDnAttributeName);
            attributeMap.put(this.principalDnAttributeName, CollectionUtils.wrapList(ldapEntry.getDn()));
        }
        return attributeMap;
    }
Creates a CAS principal with attributes if the LDAP entry contains principal attributes.

@param username  Username that was successfully authenticated which is used for principal ID when principal id is not specified.
@param ldapEntry LDAP entry that may contain principal attributes.
@return Principal if the LDAP entry contains at least a principal ID attribute value, null otherwise.
@throws LoginException On security policy errors related to principal creation.
support/cas-server-support-ldap-core/src/main/java/org/apereo/cas/authentication/LdapAuthenticationHandler.java