protected Optional<TransientSessionTicket> retrieveSessionTicketViaClientId(final WebContext webContext, final String clientId) {
        if (StringUtils.isBlank(clientId) || !clientId.startsWith(TransientSessionTicket.PREFIX)) {
            LOGGER.info("Delegated client identifier [{}] is undefined in request URL [{}]", clientId, webContext.getFullRequestURL());
            return Optional.empty();
        }

        return FunctionUtils.doAndHandle(() -> {
            val ticket = configContext.getTicketRegistry().getTicket(clientId, TransientSessionTicket.class);
            LOGGER.debug("Located delegated authentication client identifier as [{}]", ticket.getId());
            return Optional.of(ticket);
        }, e -> {
            LoggingUtils.error(LOGGER, e);
            throw UnauthorizedServiceException.denied("Rejected: %s".formatted(clientId));
        }).get();
    }
This is {@link DefaultDelegatedClientAuthenticationWebflowManager}.

@author Misagh Moayyed
@since 5.3.0
support/cas-server-support-pac4j-core/src/main/java/org/apereo/cas/web/flow/DefaultDelegatedClientAuthenticationWebflowManager.java