docs: protected String determinePrincipalIdFrom(final UserProfile profile, final BaseClient client) {
          var id = profile.getId();
          val properties = client != null ? client.getCustomProperties() : new HashMap<>();
          if (client != null && properties.containsKey(ClientCustomPropertyConstants.CLIENT_CUSTOM_PROPERTY_PRINCIPAL_ATTRIBUTE_ID)) {
              val attrObject = properties.get(ClientCustomPropertyConstants.CLIENT_CUSTOM_PROPERTY_PRINCIPAL_ATTRIBUTE_ID);
              if (attrObject != null) {
                  val principalAttribute = attrObject.toString();
                  if (profile.containsAttribute(principalAttribute)) {
                      val firstAttribute = CollectionUtils.firstElement(profile.getAttribute(principalAttribute));
                      if (firstAttribute.isPresent()) {
                          id = firstAttribute.get().toString();
                          id = typePrincipalId(id, profile);
                      }
                      LOGGER.debug("Delegated authentication indicates usage of client principal attribute [{}] for the identifier [{}]", principalAttribute, id);
                  } else {
                      LOGGER.warn("Delegated authentication cannot find attribute [{}] to use as principal id", principalAttribute);
                  }
              } else {
                  LOGGER.warn("No custom principal attribute was provided by the client [{}]. Using the default id [{}]", client, id);
              }
          } else if (StringUtils.isNotBlank(principalAttributeId)) {
              if (profile.containsAttribute(principalAttributeId)) {
                  val firstAttribute = CollectionUtils.firstElement(profile.getAttribute(principalAttributeId));
                  if (firstAttribute.isPresent()) {
                      id = firstAttribute.get().toString();
                      id = typePrincipalId(id, profile);
                  }
              } else {
                  LOGGER.warn("CAS cannot use [{}] as the principal attribute id, since the profile attributes do not contain the attribute. "
                      + "Either adjust the CAS configuration to use a different attribute, or contact the delegated authentication provider noted by [{}] "
                      + "to release the expected attribute to CAS", principalAttributeId, profile.getAttributes());
              }
              LOGGER.debug("Delegated authentication indicates usage of attribute [{}] for the identifier [{}]", principalAttributeId, id);
          } else if (isTypedIdUsed) {
              id = profile.getTypedId();
              LOGGER.debug("Delegated authentication indicates usage of typed profile id [{}]", id);
          }
          LOGGER.debug("Final principal id determined based on client [{}] and user profile [{}] is [{}]", profile, client, id);
          return id;
      }