protected Optional<UserProfile> resolveUserProfile(final RequestContext requestContext, final ClientCredential credentials) {
        return Optional.ofNullable(credentials.getUserProfile())
            .or(() -> {
                val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(requestContext);
                val response = WebUtils.getHttpServletResponseFromExternalWebflowContext(requestContext);
                val webContext = new JEEContext(request, response);
                val client = configContext.getIdentityProviders()
                    .findClient(credentials.getClientName(), webContext)
                    .orElseThrow(() -> new IllegalArgumentException("Unable to locate client"));

                val callContext = new CallContext(webContext, configContext.getSessionStore());
                return client.getUserProfile(callContext, credentials.getCredentials());
            });
    }
This is {@link BaseDelegatedClientAuthenticationCredentialResolver}.

@author Misagh Moayyed
@since 6.6.0
support/cas-server-support-pac4j-core/src/main/java/org/apereo/cas/authentication/principal/BaseDelegatedClientAuthenticationCredentialResolver.java