private Element requestSecurityTokenResponse(final WSFederationRegisteredService service,
                                                 final SecurityTokenServiceClient sts,
                                                 final TicketValidationResult assertion) {
        try {
            val properties = sts.getProperties();
            properties.put(SecurityConstants.USERNAME, assertion.getPrincipal().getId());
            val uid = credentialCipherExecutor.encode(assertion.getPrincipal().getId());
            properties.put(SecurityConstants.PASSWORD, uid);
            return FunctionUtils.doUnchecked(() -> sts.requestSecurityTokenResponse(service.getAppliesTo()));
        } catch (final SoapFault ex) {
            if (ex.getFaultCode() != null && "RequestFailed".equals(ex.getFaultCode().getLocalPart())) {
                throw new IllegalArgumentException(new ProcessingException(ProcessingException.TYPE.BAD_REQUEST));
            }
            LoggingUtils.error(LOGGER, ex);
            throw ex;
        }
    }
This is {@link DefaultRelyingPartyTokenProducer}.

@author Misagh Moayyed
@since 5.1.0
support/cas-server-support-ws-idp/src/main/java/org/apereo/cas/ws/idp/services/DefaultRelyingPartyTokenProducer.java