@Override
    public boolean isAuthorized(final WebContext webContext, final IndirectClient client,
                                final WebApplicationService currentService) {
        val result = SamlIdPSessionManager.of(openSamlConfigBean, sessionStore)
            .fetch(webContext, AuthnRequest.class);
        if (result.isEmpty()) {
            LOGGER.trace("No SAML2 authentication request found in session store");
            return true;
        }

        val authnRequest = (AuthnRequest) result.get().getLeft();
        LOGGER.trace("Retrieved the SAML2 authentication request from [{}]", SamlIdPUtils.getIssuerFromSamlObject(authnRequest));
        val idpList = authnRequest.getScoping() != null ? authnRequest.getScoping().getIDPList() : null;
        val idpEntries = idpList != null && idpList.getIDPEntrys() != null ? idpList.getIDPEntrys() : List.<IDPEntry>of();
        val providerList = idpEntries.stream().map(IDPEntry::getProviderID).collect(Collectors.toSet());
        LOGGER.debug("Scoped identity providers are [{}] to examine against client [{}]", providerList, client.getName());
        if (supports(client, webContext)) {
            val saml2Client = (SAML2Client) client;
            val authorized = providerList.isEmpty() || providerList.contains(getIdentityProviderEntityId(saml2Client));
            if (!authorized) {
                val registeredService = servicesManager.findServiceBy(currentService);
                val delegatedAuthenticationPolicy = registeredService != null ? registeredService.getAccessStrategy().getDelegatedAuthenticationPolicy() : null;
                return delegatedAuthenticationPolicy != null && delegatedAuthenticationPolicy.isProviderAllowed(saml2Client.getName(), registeredService);
            }
        }
        return true;
    }
This is {@link SamlIdPDelegatedClientAuthenticationRequestCustomizer}.

@author Misagh Moayyed
@since 6.4.0
support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/delegation/SamlIdPDelegatedClientAuthenticationRequestCustomizer.java