@Override
    protected Credential constructCredentialsFromRequest(final RequestContext requestContext) {
        val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(requestContext);
        val service = resolveServiceFromRequest(requestContext);
        return Optional.ofNullable(tokenRequestExtractor.extract(request))
            .or(() -> {
                val tokenValue = service.getAttributes().get(TokenConstants.PARAMETER_NAME_TOKEN);
                return CollectionUtils.firstElement(tokenValue).map(Object::toString);
            })
            .filter(StringUtils::isNotBlank)
            .map(authTokenValue -> {
                val registeredService = servicesManager.findServiceBy(service);
                RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(service, registeredService);
                val credential = new TokenCredential(authTokenValue, service);
                LOGGER.debug("Received token authentication request [{}] ", credential);
                return credential;
            })
            .orElse(null);
    }
This is {@link TokenAuthenticationAction}.  This class represents an action in the webflow to retrieve
user information from an AES128 encrypted token. If the auth_token
parameter exists in the web request, it is used to create a new TokenCredential.

@author Eric Pierce
@author Misagh Moayyed
@since 4.2.0
support/cas-server-support-token-webflow/src/main/java/org/apereo/cas/web/flow/TokenAuthenticationAction.java