protected IGoogleAuthenticator toAuthenticatorInstance() {
        val clientInfo = ClientInfoHolder.getClientInfo();
        if (clientInfo != null && StringUtils.isNotBlank(clientInfo.getTenant())) {
            val tenantDefinition = tenantExtractor.getTenantsManager().findTenant(clientInfo.getTenant()).orElseThrow();
            val bindingContext = tenantDefinition.bindProperties();
            if (bindingContext.isBound() && bindingContext.containsBindingFor(CoreGoogleAuthenticatorMultifactorProperties.class)) {
                val properties = bindingContext.value();
                val gauth = properties.getAuthn().getMfa().getGauth().getCore();
                return buildGoogleAuthenticatorFrom(gauth);
            }
        }
        
        val gauth = casProperties.getAuthn().getMfa().getGauth().getCore();
        return buildGoogleAuthenticatorFrom(gauth);
    }
This is {@link DefaultCasGoogleAuthenticator}.
A wrapper around the google authenticator instance {@link CasGoogleAuthenticator}
to allow for {@link org.springframework.cloud.context.config.annotation.RefreshScope}
on beans since original class is marked as final and cannot be refreshed
via proxies.
This uses the delegate pattern to route calls to the real instance.

@author Misagh Moayyed
@since 6.2.0
support/cas-server-support-gauth-core/src/main/java/org/apereo/cas/gauth/DefaultCasGoogleAuthenticator.java