def groupfinder(userid, request):
    """Fetch principals from permission backend for the specified `userid`.

    This is plugged by default using the ``multiauth.groupfinder`` setting.
    """
    backend = getattr(request.registry, 'permission', None)
    if not backend:
        return []
    if request.prefixed_userid:
        userid = request.prefixed_userid
    reify_key = userid + '_principals'
    if reify_key not in request.bound_data:
        principals = backend.user_principals(userid)
        request.bound_data[reify_key] = principals
    return request.bound_data[reify_key]
