if (principal.picture.mediumUri) {
    principal.picture.medium = ContentUtil.getSignedDownloadUrl(ctx, principal.picture.mediumUri, duration, offset);
    delete principal.picture.mediumUri;
  }