private String getPrincipalProperty(Object principal, String property) throws JspTagException {
        String strValue = null;

        try {
            BeanInfo bi = Introspector.getBeanInfo(principal.getClass());

            // Loop through the properties to get the string value of the specified property
            boolean foundProperty = false;
            for (PropertyDescriptor pd : bi.getPropertyDescriptors()) {
                if (pd.getName().equals(property)) {
                    Object value = pd.getReadMethod().invoke(principal, (Object[]) null);
                    strValue = String.valueOf(value);
                    foundProperty = true;
                    break;
                }
            }

            if (!foundProperty) {
                final String message = "Property [" + property + "] not found in principal of type ["
                        + principal.getClass().getName() + "]";
                if (LOGGER.isErrorEnabled()) {
                    LOGGER.error(message);
                }
                throw new JspTagException(message);
            }

        } catch (Exception e) {
            final String message = "Error reading property [" + property + "] from principal of type ["
                    + principal.getClass().getName() + "]";
            if (LOGGER.isErrorEnabled()) {
                LOGGER.error(message, e);
            }
            throw new JspTagException(message, e);
        }

        return strValue;
    }
The default value that should be displayed if the user is not authenticated, or no principal is found.
web/src/main/java/org/apache/shiro/web/tags/PrincipalTag.java