...
A secondary feature in V4.1+ allows for a Java Subject that contains one or more IdPAttributePrincipal objects to be processed directly for an IdPAttribute to pull the value from. This is primarily of use with various "external" authentication options such as SAML proxying, allowing a SAML Attribute decoded from another IdP to be directly consumed and used as a canonical principal name without the hassle of the attribute resolution process (and configuration). This feature can be leveraged by adjusting various properties (see the reference below) to disable use of the Attribute Resolver and reference the Subject directly.
...