protected Optional<Credentials> getCredentialsFromDelegatedClient(final RequestContext requestContext, final BaseClient client) {
        return FunctionUtils.doAndHandle(() -> {
            val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(requestContext);
            val response = WebUtils.getHttpServletResponseFromExternalWebflowContext(requestContext);
            val webContext = new JEEContext(request, response);
            val callContext = new CallContext(webContext, this.sessionStore);
            return client.getCredentials(callContext)
                .map(clientCredentials -> client.validateCredentials(callContext, clientCredentials))
                .filter(Optional::isPresent)
                .map(Optional::get);
        }, e -> Optional.<Credentials>empty()).get();

    }
This is {@link DefaultDelegatedAuthenticationCredentialExtractor}.

@author Misagh Moayyed
@since 7.0.0
support/cas-server-support-pac4j-core/src/main/java/org/apereo/cas/authentication/principal/DefaultDelegatedAuthenticationCredentialExtractor.java