private void grantServiceTicket(final AuthenticationResult authenticationResult,
                                    final Service service,
                                    final RequestContext requestContext) {
        serviceTicketAuthorities
            .stream()
            .sorted(AnnotationAwareOrderComparator.INSTANCE)
            .filter(auth -> auth.supports(authenticationResult, service))
            .findFirst()
            .ifPresent(Unchecked.consumer(auth -> {
                if (auth.shouldGenerate(authenticationResult, service)) {
                    FunctionUtils.doUnchecked(__ -> {
                        val ticketGrantingTicket = WebUtils.getTicketGrantingTicketId(requestContext);
                        val serviceTicketId = centralAuthenticationService.grantServiceTicket(ticketGrantingTicket, service, authenticationResult);
                        WebUtils.putServiceTicketInRequestScope(requestContext, serviceTicketId);
                        LOGGER.debug("Granted service ticket [{}] and added it to the request scope", serviceTicketId);
                    });
                }
            }));
    }
{@inheritDoc}
<p>
In the initial primary authentication flow, credentials are cached and available.
Since they are authenticated as part of submission first, there is no need to doubly
authenticate and verify credentials.
<p>
In subsequent authentication flows where a TGT is available and only an ST needs to be
created, there are no cached copies of the credential, since we do have a TGT available.
So we will grab the available authentication and produce the final result based on that.
support/cas-server-support-actions-core/src/main/java/org/apereo/cas/web/flow/GenerateServiceTicketAction.java