@Override
    public Optional<SecurityToken> fetch(final Service service, final String principalId) throws Throwable {
        val resolvedService = selectionStrategy.resolveServiceFrom(service);
        LOGGER.debug("Resolved service as [{}]", resolvedService);
        if (resolvedService != null) {
            val rp = servicesManager.findServiceBy(resolvedService, WSFederationRegisteredService.class);
            if (rp == null || !rp.getAccessStrategy().isServiceAccessAllowed(rp, service)) {
                LOGGER.warn("Service [{}] is not allowed to use SSO.", rp);
                throw new UnauthorizedSsoServiceException();
            }
            LOGGER.debug("Building security token service client for registered service [{}]", rp);
            val sts = clientBuilder.buildClientForSecurityTokenRequests(rp);
            return Optional.ofNullable(invokeSecurityTokenServiceForToken(rp, sts, principalId));
        }
        return Optional.empty();
    }
This is {@link DefaultSecurityTokenServiceTokenFetcher}.

@author Misagh Moayyed
@since 6.0.0
support/cas-server-support-ws-sts-api/src/main/java/org/apereo/cas/authentication/DefaultSecurityTokenServiceTokenFetcher.java