@Override
    public Principal getUserPrincipal() {
        if (getAuthenticationScheme() == null) {
            return () -> null;
        }

        if (getAuthenticationScheme().equals(AUTH_SCHEME_CUSTOM) || getAuthenticationScheme().equals(AUTH_SCHEME_AWS_IAM)) {
            return () -> {
                if (getAuthenticationScheme().equals(AUTH_SCHEME_CUSTOM)) {
                    switch (event.getRequestSource()) {
                    case API_GATEWAY:
                        return event.getRequestContext().getAuthorizer().getPrincipalId();
                    case ALB:
                        return event.getMultiValueHeaders().getFirst(ALB_IDENTITY_HEADER);
                    }
                } else if (getAuthenticationScheme().equals(AUTH_SCHEME_AWS_IAM)) {
                    // if we received credentials from Cognito Federated Identities then we return the identity id
                    if (event.getRequestContext().getIdentity().getCognitoIdentityId() != null) {
                        return event.getRequestContext().getIdentity().getCognitoIdentityId();
                    } else { // otherwise the user arn from the credentials
                        return event.getRequestContext().getIdentity().getUserArn();
                    }
                }

                // return null if we couldn't find a valid scheme
                return null;
            };
        }

        if (getAuthenticationScheme().equals(AUTH_SCHEME_COGNITO_POOL)) {
            return new CognitoUserPoolPrincipal(event.getRequestContext().getAuthorizer().getClaims());
        }

        throw new RuntimeException("Cannot recognize authorization scheme in event");
    }
@Test
    void userPool_getClaims_retrieveCustomClaim() {
        AwsProxySecurityContext context = new AwsProxySecurityContext(null, REQUEST_COGNITO_USER_POOL);
        Principal userPrincipal = context.getUserPrincipal();
        assertNotNull(userPrincipal.getName());
        assertEquals(COGNITO_IDENTITY_ID, userPrincipal.getName());

        assertTrue(userPrincipal instanceof AwsProxySecurityContext.CognitoUserPoolPrincipal);
        assertNotNull(((AwsProxySecurityContext.CognitoUserPoolPrincipal)userPrincipal).getClaims().getClaim(CLAIM_KEY));
        assertEquals(CLAIM_VALUE, ((AwsProxySecurityContext.CognitoUserPoolPrincipal)userPrincipal).getClaims().getClaim(CLAIM_KEY));
    }