@Override
    protected AuthenticationHandlerExecutionResult doAuthentication(final Credential credential,
                                                                    final Service service) throws PreventedException {
        return FunctionUtils.doAndHandle(() -> {
            val request = WebUtils.getHttpServletRequestFromExternalWebflowContext();
            val response = WebUtils.getHttpServletResponseFromExternalWebflowContext();
            val webContext = new JEEContext(Objects.requireNonNull(request),
                Objects.requireNonNull(response));
            val clientCredentials = (ClientCredential) credential;
            LOGGER.debug("Located client credentials as [{}]", clientCredentials);

            LOGGER.trace("Client name: [{}]", clientCredentials.getClientName());
            val client = identityProviders.findClient(clientCredentials.getClientName(), webContext)
                .map(BaseClient.class::cast)
                .orElseThrow(() -> new IllegalArgumentException("Unable to determine client based on client name "
                    + clientCredentials.getClientName()));
            LOGGER.trace("Delegated client is: [{}]", client);

            var userProfileResult = Optional.ofNullable(clientCredentials.getUserProfile());
            if (userProfileResult.isEmpty()) {
                val credentials = clientCredentials.getCredentials();

                val callContext = new CallContext(webContext, this.sessionStore);
                userProfileResult = client.getUserProfile(callContext, credentials);
            }
            val userProfile = userProfileResult.orElseThrow(
                () -> new PreventedException("Unable to fetch user profile from client " + client.getName()));
            LOGGER.debug("Final user profile is: [{}]", userProfile);
            userProfile.setClientName(clientCredentials.getClientName());
            storeUserProfile(webContext, userProfile);
            return createResult(clientCredentials, userProfile, client, service);
        }, e -> {
            throw new PreventedException(e);
        }).get();
    }
Authentication handler which gets the credentials and then the user profile
in a delegated authentication process from an external identity provider.

@author Jerome Leleu
@since 3.5.0
support/cas-server-support-pac4j-core-clients/src/main/java/org/apereo/cas/support/pac4j/authentication/handler/support/DelegatedClientAuthenticationHandler.java