Asserted Identity Wins

A server with an authenticated peer identity on the transport layer (TLS client cert, mTLS, SPNEGO, SIC) reads a second identity string out of an application-layer request field and uses it as the effective identity. The code falls back to the authenticated source only when the asserted field is absent. The null check is on the caller's assertion, not on whether the two identities agree. The identity the server authorizes against is the one the attacker chose.