protected final Pair<? extends RequestAbstractType, MessageContext> retrieveAuthenticationRequest(
        final HttpServletResponse response, final HttpServletRequest request) {
        return lock.tryLock(() -> {
            LOGGER.info("Received SAML2 callback profile request [{}]", request.getRequestURI());
            val webContext = new JEEContext(request, response);
            return SamlIdPSessionManager.of(configurationContext.getOpenSamlConfigBean(), configurationContext.getSessionStore())
                .fetch(webContext, AuthnRequest.class)
                .orElseThrow(() -> {
                    val samlAuthnRequestId = webContext.getRequestParameter(SamlIdPConstants.AUTHN_REQUEST_ID).orElse("N/A");
                    val message = """
                        SAML2 authentication request cannot be determined from the CAS session store for request id %s.
                        This typically means that the original SAML2 authentication request that was submitted to CAS via a SAML2 service provider
                        cannot be retrieved and restored after an authentication attempt. If you are running a multi-node CAS deployment, you may
                        need to opt for a different session storage mechanism than what is configured now: %s
                        """;
                    return new MissingSamlAuthnRequestException(message.stripIndent().stripLeading().trim()
                        .formatted(samlAuthnRequestId, configurationContext.getSessionStore().getClass().getName()));
                });
        });
    }
Handle SAML2 exceptions.

@param req the req
@param ex  the ex
@return the model and view
support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/AbstractSamlIdPProfileHandlerController.java