private AuthenticationResponse getLdapAuthenticationResponse(final UsernamePasswordCredential upc) throws PreventedException {
        try {
            LOGGER.debug("Attempting LDAP authentication for [{}]. Authenticator pre-configured attributes are [{}], "
                    + "additional requested attributes for this authentication request are [{}]", upc, authenticator.getReturnAttributes(),
                authenticatedEntryAttributes);
            var ldaptiveCred = new Credential(upc.getPassword());
            val request = new AuthenticationRequest(upc.getUsername(), ldaptiveCred, authenticatedEntryAttributes);
            request.setControls(new PasswordPolicyControl());
            return authenticator.authenticate(request);
        } catch (final LdapException e) {
            LOGGER.trace(e.getMessage(), e);
            throw new PreventedException(e);
        }
    }
Gets ldap principal identifier. If the principal id attribute is defined, it's retrieved.
If no attribute value is found, a warning is generated and the provided username is used instead.
If no attribute is defined, username is used instead.

@param username  the username
@param ldapEntry the ldap entry
@return the ldap principal identifier
@throws LoginException in case the principal id cannot be determined.
support/cas-server-support-ldap-core/src/main/java/org/apereo/cas/authentication/LdapAuthenticationHandler.java