public Pair<Assertion, WsFederationConfiguration> buildAndVerifyAssertion(final RequestedSecurityToken reqToken,
                                                                              final Collection<WsFederationConfiguration> config,
                                                                              final Service service) {
        val securityToken = getSecurityTokenFromRequestedToken(reqToken, config);
        if (securityToken instanceof final Assertion assertion) {
            LOGGER.debug("Extracted assertion successfully: [{}]", assertion);
            val configuration = config.stream()
                .filter(cfg -> StringUtils.isNotBlank(cfg.getIdentityProviderIdentifier()))
                .filter(cfg -> {
                    val id = cfg.getIdentityProviderIdentifier();
                    LOGGER.trace("Comparing identity provider identifier [{}] with assertion issuer [{}]", id, assertion.getIssuer());
                    return RegexUtils.find(id, assertion.getIssuer());
                })
                .findFirst()
                .orElseThrow(() ->
                    new IllegalArgumentException("Could not locate wsfed configuration for security token provided. The assertion issuer "
                                                 + assertion.getIssuer() + " does not match any of the identity provider identifiers in the configuration"));

            return Pair.of(assertion, configuration);
        }
        throw new IllegalArgumentException("Could not extract or decrypt an assertion based on the security token provided");
    }
converts a token into an assertion.

@param reqToken the req token
@param config   the config
@param service  the service
@return an assertion
support/cas-server-support-wsfederation/src/main/java/org/apereo/cas/support/wsfederation/WsFederationHelper.java