@Override
    public boolean isSatisfiedBy(final Assertion assertion, final HttpServletRequest request) {
        LOGGER.trace("Is validation specification set to enforce [{}] protocol behavior? [{}]. Is assertion issued from a new login? [{}]",
            CasProtocolConstants.PARAMETER_RENEW, BooleanUtils.toStringYesNo(this.renew),
            BooleanUtils.toStringYesNo(assertion.isFromNewLogin()));
        var satisfied = isSatisfiedByInternal(assertion);
        if (!satisfied) {
            LOGGER.warn("[{}] is not internally satisfied by the produced assertion", getClass().getSimpleName());
            return false;
        }
        satisfied = !this.renew || assertion.isFromNewLogin();
        if (!satisfied) {
            LOGGER.warn("[{}] is to enforce the [{}] CAS protocol behavior, yet the assertion is not issued from a new login", getClass().getSimpleName(),
                CasProtocolConstants.PARAMETER_RENEW);
            return false;
        }
        LOGGER.trace("Validation specification is satisfied by the produced assertion");
        return true;
    }
Denotes whether we should always authenticate or not.
core/cas-server-core-validation-api/src/main/java/org/apereo/cas/validation/AbstractCasProtocolValidationSpecification.java