protected AuthenticationInfo merge(AuthenticationInfo info, AuthenticationInfo aggregate) {
        if (aggregate != null && !isEmpty(aggregate.getPrincipals())) {
            return aggregate;
        }
        return info != null ? info : aggregate;
    }
Returns the specified {@code aggregate} instance if is non null and valid (that is, has principals and they are
not empty) immediately, or, if it is null or not valid, the {@code info} argument is returned instead.
<p/>
This logic ensures that the first valid info encountered is the one retained and all subsequent ones are ignored,
since this strategy mandates that only the info from the first successfully authenticated realm be used.
core/src/main/java/org/apache/shiro/authc/pam/FirstSuccessfulStrategy.java