protected boolean handleAuthorizationForService(final String clientName, final Service service) throws Throwable {
        if (service == null || StringUtils.isBlank(service.getId())) {
            LOGGER.trace("Can not evaluate delegated authentication policy without a service");
            return true;
        }
        if (StringUtils.isBlank(clientName)) {
            LOGGER.trace("No identity provider is provided to enforce authorization for delegated authentication. SSO session "
                + "may have been established without delegated authentication");
            return true;
        }
        val registeredService = servicesManager.findServiceBy(service);
        if (registeredService == null || !registeredService.getAccessStrategy().isServiceAccessAllowed(registeredService, service)) {
            LOGGER.warn("Service access for [{}] is denied", registeredService);
            return false;
        }
        LOGGER.trace("Located registered service definition [{}] matching [{}]", registeredService, service);
        val auditContext = AuditableContext.builder()
            .registeredService(registeredService)
            .service(service)
            .properties(CollectionUtils.wrap(Client.class.getSimpleName(), clientName))
            .build();
        val result = delegatedAuthenticationPolicyEnforcer.execute(auditContext);
        if (!result.isExecutionFailure()) {
            LOGGER.debug("Delegated authentication policy for [{}] allows for using provider [{}]", registeredService, clientName);
            return true;
        }
        LOGGER.warn("Delegated authentication policy for [{}] refuses access to provider [{}]", registeredService.getServiceId(), clientName);
        return false;
    }
This is {@link BaseDelegatedClientIdentityProviderAuthorizer}.

@author Misagh Moayyed
@since 6.6.0
support/cas-server-support-pac4j-core/src/main/java/org/apereo/cas/pac4j/client/authz/BaseDelegatedClientIdentityProviderAuthorizer.java