@Override
    protected Event doExecuteInternal(final RequestContext requestContext) {
        val registeredService = WebUtils.getRegisteredService(requestContext);
        LOGGER.trace("Found registered service [{}] from the context", registeredService);
        if (registeredService != null && registeredService.getAccessStrategy() != null) {
            val unauthorizedRedirectUrl = registeredService.getAccessStrategy().getUnauthorizedRedirectUrl();
            LOGGER.debug("Putting unauthorized redirect URL [{}] into the webflow", unauthorizedRedirectUrl);
            WebUtils.putUnauthorizedRedirectUrlIntoFlowScope(requestContext, unauthorizedRedirectUrl);
        }
        return null;
    }
The services manager with access to the registry.
support/cas-server-support-actions-core/src/main/java/org/apereo/cas/web/flow/login/SetServiceUnauthorizedRedirectUrlAction.java