@Override
    public boolean isParticipating(final SingleSignOnParticipationRequest ssoRequest) {
        val registeredService = getRegisteredService(ssoRequest);
        if (registeredService == null) {
            return true;
        }
        val accessStrategy = registeredService.getAccessStrategy();
        if (accessStrategy == null || accessStrategy.getDelegatedAuthenticationPolicy() == null) {
            return true;
        }

        val ticketGrantingTicketId = getTicketGrantingTicketId(ssoRequest);
        if (ticketGrantingTicketId.isEmpty()) {
            return true;
        }

        val authentication = getTicketState(ssoRequest)
            .map(AuthenticationAwareTicket.class::cast)
            .map(AuthenticationAwareTicket::getAuthentication)
            .orElseThrow(() -> new InvalidTicketException(ticketGrantingTicketId.get()));
        val policy = accessStrategy.getDelegatedAuthenticationPolicy();
        val attributes = authentication.getAttributes();
        if (attributes.containsKey(ClientCredential.AUTHENTICATION_ATTRIBUTE_CLIENT_NAME)) {
            val clientNameAttr = attributes.get(ClientCredential.AUTHENTICATION_ATTRIBUTE_CLIENT_NAME);
            val value = CollectionUtils.firstElement(clientNameAttr);
            if (value.isPresent()) {
                val client = value.get().toString();
                LOGGER.debug("Evaluating delegated access strategy for client [{}] and service [{}]",
                    client, registeredService);
                return policy.isProviderAllowed(client, registeredService);
            }
            return false;
        }
        return !policy.isProviderRequired();
    }
This is {@link DelegatedAuthenticationSingleSignOnParticipationStrategy}.

@author Misagh Moayyed
@since 6.3.0
support/cas-server-support-pac4j-core/src/main/java/org/apereo/cas/web/flow/DelegatedAuthenticationSingleSignOnParticipationStrategy.java