@Override
    public void authorize(final HttpServletRequest request, final Service service, final Assertion assertion) {
        val registeredService = this.servicesManager.findServiceBy(service);
        RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(service, registeredService);
        LOGGER.debug("Evaluating service [{}] for delegated authentication policy", service);
        Optional.ofNullable(registeredService.getAccessStrategy().getDelegatedAuthenticationPolicy())
            .ifPresent(Unchecked.consumer(policy -> {
                val attributes = assertion.getPrimaryAuthentication().getAttributes();
                if (attributes.containsKey(ClientCredential.AUTHENTICATION_ATTRIBUTE_CLIENT_NAME)) {
                    val clientNameAttr = attributes.get(ClientCredential.AUTHENTICATION_ATTRIBUTE_CLIENT_NAME);
                    val value = CollectionUtils.firstElement(clientNameAttr);
                    if (value.isPresent()) {
                        val client = value.get().toString();
                        LOGGER.debug("Evaluating delegated authentication policy [{}] for client [{}] and service [{}]", policy, client, registeredService);
                        val context = AuditableContext.builder()
                            .registeredService(registeredService)
                            .properties(CollectionUtils.wrap(Client.class.getSimpleName(), client))
                            .build();
                        val result = delegatedAuthenticationPolicyEnforcer.execute(context);
                        result.throwExceptionIfNeeded();
                    }
                }
            }));
    }
This is {@link DelegatedAuthenticationServiceTicketValidationAuthorizer}.

@author Misagh Moayyed
@since 5.2.0
support/cas-server-support-pac4j-core/src/main/java/org/apereo/cas/validation/DelegatedAuthenticationServiceTicketValidationAuthorizer.java