@Override
    protected Event doExecuteInternal(final RequestContext context) {
        val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(context);
        val response = WebUtils.getHttpServletResponseFromExternalWebflowContext(context);
        val webContext = new JEEContext(request, response);

        val clientName = retrieveClientName(webContext);
        var service = StringUtils.isNotBlank(clientName) ? restoreAuthenticationRequestInContext(context, clientName) : null;

        val clientCredential = extractClientCredential(context, clientName);
        val isLogoutRequest = isLogoutRequest(clientCredential);
        try {
            LOGGER.trace("Delegated authentication is handled by client name [{}]", clientName);
            val isSingleSignOnSessionActive = StringUtils.isNotBlank(clientName)
                && !isLogoutRequest
                && !DelegationWebflowUtils.hasDelegatedClientAuthenticationCandidateProfile(context)
                && ssoEvaluator.singleSignOnSessionExists(context);
            if (isSingleSignOnSessionActive) {
                LOGGER.trace("Found an existing single sign-on session");
                service = populateContextWithService(context, service);
                if (ssoEvaluator.singleSignOnSessionAuthorizedForService(context)) {
                    val providers = configContext.getDelegatedClientIdentityProvidersProducer().produce(context);
                    LOGGER.debug("Skipping delegation and routing back to CAS authentication flow with providers [{}]", providers);
                    return super.doExecuteInternal(context);
                }
                val resolvedService = ssoEvaluator.resolveServiceFromRequestContext(context);
                LOGGER.debug("Single sign-on session is unauthorized for service [{}]", resolvedService);
                removeTicketGrantingTicketIfAny(context, clientName, resolvedService);
            } else if (StringUtils.isNotBlank(clientName) && !isLogoutRequest(clientCredential)) {
                LOGGER.debug("Single sign-on session is inactive for service [{}]", service);
                removeTicketGrantingTicketIfAny(context, clientName, service);
            }

            if (failureEvaluator.evaluate(request, response.getStatus()).isPresent()) {
                throw new IllegalArgumentException("Delegated authentication has failed with client " + clientName);
            }

            if (DelegationWebflowUtils.hasDelegatedClientAuthenticationCandidateProfile(context)) {
                val profile = DelegationWebflowUtils.getDelegatedClientAuthenticationCandidateProfile(context, DelegatedAuthenticationCandidateProfile.class);
                val up = profile.toUserProfile(clientName);
                val clientCredentialSelected = new ClientCredential(clientName, up);
                WebUtils.putCredential(context, clientCredentialSelected);
                return super.doExecuteInternal(context);
            }

            if (clientCredential.isPresent()) {
                service = populateContextWithService(context, service);
                val client = findDelegatedClientByName(clientName, context);
                verifyClientIsAuthorizedForService(context, service, client);
                DelegationWebflowUtils.putDelegatedAuthenticationClientName(context, client.getName());
                if (isLogoutRequest) {
                    val callContext = new CallContext(webContext, configContext.getSessionStore());
                    throw client.processLogout(callContext, clientCredential.get().getCredentials());
                }
                return finalizeDelegatedClientAuthentication(context, clientCredential.get());
            } else if (StringUtils.isNotBlank(clientName)) {
                val msg = "Client %s failed to validate credentials".formatted(clientName);
                LoggingUtils.error(LOGGER, msg);
                return stopWebflow(new AuthenticationException(msg), context);
            }
        } catch (final HttpAction e) {
            FunctionUtils.doIf(LOGGER.isDebugEnabled(),
                o -> LOGGER.debug(e.getMessage(), e), o -> LOGGER.info(e.getMessage())).accept(e);
            val continuation = SingleLogoutContinuation.builder();
            clientCredential.ifPresent(cc -> continuation.context(CollectionUtils.wrap(ClientCredential.class.getName(), cc.getClientName())));
            if (e instanceof final AutomaticFormPostAction formPostAction) {
                continuation.method(HttpMethod.POST).url(formPostAction.getUrl()).data(formPostAction.getData());
            }
            if (e instanceof final WithContentAction withContentAction) {
                continuation.content(withContentAction.getContent());
            }
            webContext.setRequestAttribute(SingleLogoutContinuation.class.getName(), continuation.build());
            return isLogoutRequest(clientCredential) ? getLogoutEvent(e) : success();
        } catch (final UnauthorizedServiceException e) {
            LOGGER.warn(e.getMessage(), e);
            throw e;
        } catch (final Throwable e) {
            LoggingUtils.error(LOGGER, e);
            return stopWebflow(e, context);
        }
        return getFinalEvent();
    }
This class represents an action to put at the beginning of the webflow.
<p>
Before any authentication, redirection urls are computed for the different clients defined as well as the theme,
locale, method and service are saved into the web session.</p>
After authentication, appropriate information are expected on this callback url to finish the authentication
process with the provider.

@author Jerome Leleu
@since 3.5.0
support/cas-server-support-pac4j-webflow/src/main/java/org/apereo/cas/web/flow/actions/DelegatedClientAuthenticationAction.java