@Override
    public Map<String, ? extends Serializable> store(final RequestContext requestContext, final WebContext webContext,
                                                     final Client client) throws Throwable {
        val httpRequest = ((JEEContext) webContext).getNativeRequest();
        val originalService = configContext.getArgumentExtractor().extractService(httpRequest);
        val service = configContext.getAuthenticationRequestServiceSelectionStrategies().resolveService(originalService);

        val properties = buildTicketProperties(webContext);
        properties.put(CasProtocolConstants.PARAMETER_SERVICE, originalService);
        properties.put(CasProtocolConstants.PARAMETER_TARGET_SERVICE, service);
        properties.put(Client.class.getName(), client.getName());

        val registeredService = configContext.getServicesManager().findServiceBy(service);
        webContext.getRequestParameter(RedirectionActionBuilder.ATTRIBUTE_FORCE_AUTHN)
            .or(() -> Optional.of(Boolean.toString(RegisteredServiceProperty.RegisteredServiceProperties.DELEGATED_AUTHN_FORCE_AUTHN.isAssignedTo(registeredService))))
            .filter(value -> StringUtils.equalsIgnoreCase(value, "true"))
            .ifPresent(attr -> properties.put(RedirectionActionBuilder.ATTRIBUTE_FORCE_AUTHN, true));
        webContext.getRequestParameter(RedirectionActionBuilder.ATTRIBUTE_PASSIVE)
            .or(() -> Optional.of(Boolean.toString(RegisteredServiceProperty.RegisteredServiceProperties.DELEGATED_AUTHN_PASSIVE_AUTHN.isAssignedTo(registeredService))))
            .filter(value -> StringUtils.equalsIgnoreCase(value, "true"))
            .ifPresent(attr -> properties.put(RedirectionActionBuilder.ATTRIBUTE_PASSIVE, true));
        if (registeredService != null && !registeredService.getAccessStrategy().isServiceAccessAllowedForSso(registeredService)) {
            properties.put(RedirectionActionBuilder.ATTRIBUTE_FORCE_AUTHN, true);
        }
        return properties;
    }
Build the ticket properties.

@param webContext the web context
@return the ticket properties
support/cas-server-support-pac4j-core/src/main/java/org/apereo/cas/web/flow/DefaultDelegatedClientAuthenticationWebflowStateContributor.java