@Override
    public String getPrincipalIdFrom(final JoinPoint auditTarget, final Authentication authentication,
                                     final Object returnValue, final Exception exception) {
        if (authentication == null) {
            return Credential.UNKNOWN_ID;
        }
        if (supports(auditTarget, authentication, returnValue, exception)) {
            val attributes = authentication.getAttributes();
            val surrogateUser = attributes.get(SurrogateAuthenticationService.AUTHENTICATION_ATTR_SURROGATE_USER).getFirst().toString();
            val principalId = attributes.get(SurrogateAuthenticationService.AUTHENTICATION_ATTR_SURROGATE_PRINCIPAL).getFirst().toString();
            return String.format("(Primary User: [%s], Surrogate User: [%s])", principalId, surrogateUser);
        }
        return super.getPrincipalIdFrom(auditTarget, authentication, returnValue, exception);
    }
This is {@link SurrogateAuditPrincipalIdProvider}.

@author Misagh Moayyed
@since 5.1.0
support/cas-server-support-surrogate-core/src/main/java/org/apereo/cas/authentication/audit/SurrogateAuditPrincipalIdProvider.java