private void verifyClientIsAuthorizedForService(final RequestContext requestContext, final Service service, final BaseClient client) {
        LOGGER.debug("Delegated authentication client is [{}] with service [{}]", client, service);
        if (service != null) {
            val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(requestContext);
            request.setAttribute(CasProtocolConstants.PARAMETER_SERVICE, service);
        }
        if (!isDelegatedClientAuthorizedForService(client, service, requestContext)) {
            LOGGER.error("Delegated client [{}] is not authorized by service [{}]", client, service);
            throw UnauthorizedServiceException.denied("Denied: %s".formatted(service));
        }
    }
This class represents an action to put at the beginning of the webflow.
<p>
Before any authentication, redirection urls are computed for the different clients defined as well as the theme,
locale, method and service are saved into the web session.</p>
After authentication, appropriate information are expected on this callback url to finish the authentication
process with the provider.

@author Jerome Leleu
@since 3.5.0
support/cas-server-support-pac4j-webflow/src/main/java/org/apereo/cas/web/flow/actions/DelegatedClientAuthenticationAction.java