@SuppressWarnings({"unchecked"})
    protected SubjectContext resolvePrincipals(SubjectContext context) {

        PrincipalCollection principals = context.resolvePrincipals();

        if (isEmpty(principals)) {
            LOGGER.trace("No identity (PrincipalCollection) found in the context.  Looking for a remembered identity.");

            principals = getRememberedIdentity(context);

            if (!isEmpty(principals)) {
                LOGGER.debug("Found remembered PrincipalCollection.  Adding to the context to be used "
                        + "for subject construction by the SubjectFactory.");

                context.setPrincipals(principals);

                // The following call was removed (commented out) in Shiro 1.2 because it uses the session as an
                // implementation strategy.  Session use for Shiro's own needs should be controlled in a single place
                // to be more manageable for end-users: there are a number of stateless (e.g. REST) applications that
                // use Shiro that need to ensure that sessions are only used when desirable.  If Shiro's internal
                // implementations used Subject sessions (setting attributes) whenever we wanted, it would be much
                // harder for end-users to control when/where that occurs.
                //
                // Because of this, the SubjectDAO was created as the single point of control, and session state logic
                // has been moved to the DefaultSubjectDAO implementation.

                // Removed in Shiro 1.2.  SHIRO-157 is still satisfied by the new DefaultSubjectDAO implementation
                // introduced in 1.2
                // Satisfies SHIRO-157:
                // bindPrincipalsToSession(principals, context);

            } else {
                LOGGER.trace("No remembered identity found.  Returning original context.");
            }
        }

        return context;
    }
Attempts to resolve an identity (a {@link PrincipalCollection}) for the context using heuristics.  This
implementation functions as follows:
<ol>
<li>Check the context to see if it can already {@link SubjectContext#resolvePrincipals resolve an identity}.  If
so, this method does nothing and returns the method argument unaltered.</li>
<li>Check for a RememberMe identity by calling {@link #getRememberedIdentity}.  If that method returns a
non-null value, place the remembered {@link PrincipalCollection} in the context.</li>
</ol>

@param context the subject context data that may provide (directly or indirectly through one of its values) a
               {@link PrincipalCollection} identity.
@return The Subject context to use to pass to a {@link SubjectFactory} for subject creation.
@since 1.0
core/src/main/java/org/apache/shiro/mgt/DefaultSecurityManager.java