docs: public ProviderAuthenticationResult handleRedirectToServer(HttpServletRequest req, HttpServletResponse res, ConvergedClientConfig clientConfig) {
          String authorizationEndpoint = clientConfig.getAuthorizationEndpointUrl();
  
          if (!checkHttpsRequirement(clientConfig, authorizationEndpoint)) {
              Tr.error(tc, "OIDC_CLIENT_URL_PROTOCOL_NOT_HTTPS", authorizationEndpoint);
              return new ProviderAuthenticationResult(AuthResult.SEND_401, HttpServletResponse.SC_UNAUTHORIZED);
          }
  
          if (clientConfig.createSession()) {
              try {
                  req.getSession(true);
              } catch (Exception e) {
                  // ignore it. Session exists
              }
          }
  
          String strRandom = OidcUtil.generateRandom(OidcUtil.RANDOM_LENGTH);
          String timestamp = OidcUtil.getTimeStamp();
          String state = timestamp + strRandom;
          if (!req.getMethod().equalsIgnoreCase("GET") && req.getParameter("oidc_client") != null) {
              state = state + req.getParameter("oidc_client");
          }
          String cookieValue = HashUtils.createStateCookieValue(clientConfig, state);
          String cookieName = ClientConstants.WAS_OIDC_STATE_KEY + HashUtils.getStrHashCode(state);
          boolean isHttpsRequest = req.getScheme().toLowerCase().contains("https");
          int cookieLifeTime = (int) clientConfig.getAuthenticationTimeLimitInSeconds();
          Cookie cookie = OidcClientUtil.createCookie(cookieName, cookieValue, cookieLifeTime, req);
          if (clientConfig.isHttpsRequired() == true && isHttpsRequest) {
              cookie.setSecure(true);
          }
          res.addCookie(cookie);
  
          String redirect_url = setRedirectUrlIfNotDefined(req, clientConfig);
          if (!checkHttpsRequirement(clientConfig, redirect_url)) {
              Tr.error(tc, "OIDC_CLIENT_URL_PROTOCOL_NOT_HTTPS", redirect_url);
              return new ProviderAuthenticationResult(AuthResult.SEND_401, HttpServletResponse.SC_UNAUTHORIZED);
          }
  
          String acr_values = req.getParameter("acr_values");
  
          String authzEndPointUrlWithQuery = null;
          try {
              boolean openidScopeMissing = !clientConfig.isSocial() && !isOpenIDScopeSpecified(clientConfig); // some social media use nonstandard scope
              boolean scopeMissing = clientConfig.getScope() == null || clientConfig.getScope().length() == 0;
              if (openidScopeMissing || scopeMissing) {
                  Tr.error(tc, "OIDC_CLIENT_REQUEST_MISSING_OPENID_SCOPE",
                          clientConfig.getClientId(), clientConfig.getScope()); // CWWKS1713E
                  return new ProviderAuthenticationResult(AuthResult.SEND_401, HttpServletResponse.SC_UNAUTHORIZED);
              }
  
              authzEndPointUrlWithQuery = buildAuthorizationUrlWithQuery(req, (OidcClientRequest) req.getAttribute(ClientConstants.ATTRIB_OIDC_CLIENT_REQUEST), state, clientConfig, redirect_url, acr_values);
  
              // preserve post param.
              WebAppSecurityConfig webAppSecConfig = WebAppSecurityCollaboratorImpl.getGlobalWebAppSecurityConfig();
              PostParameterHelper pph = new PostParameterHelper(webAppSecConfig);
              pph.save(req, res);
              // Redirect to OP
              // If clientSideRedirect is true (default is true) then do the
              // redirect.  If the user agent doesn't support javascript then config can set this to false.
              if (clientConfig.isClientSideRedirect()) {
                  String domain = OidcClientUtil.getSsoDomain(req);
                  doClientSideRedirect(res, authzEndPointUrlWithQuery, state, domain);
              } else {
                  String urlCookieName = ClientConstants.WAS_REQ_URL_OIDC + HashUtils.getStrHashCode(state);
                  Cookie c = OidcClientUtil.createCookie(urlCookieName, getReqURL(req), cookieLifeTime, req);
                  if (clientConfig.isHttpsRequired() == true && isHttpsRequest) {
                      cookie.setSecure(true);
                  }
                  res.addCookie(c);
              }
  
          } catch (UnsupportedEncodingException e) {
              Tr.error(tc, "OIDC_CLIENT_AUTHORIZE_ERR", new Object[] { clientConfig.getClientId(), e.getLocalizedMessage(), ClientConstants.CHARSET });
              return new ProviderAuthenticationResult(AuthResult.SEND_401, HttpServletResponse.SC_UNAUTHORIZED);
          } catch (IOException ioe) {
              Tr.error(tc, "OIDC_CLIENT_AUTHORIZE_ERR", new Object[] { clientConfig.getClientId(), ioe.getLocalizedMessage(), ClientConstants.CHARSET });
              return new ProviderAuthenticationResult(AuthResult.SEND_401, HttpServletResponse.SC_UNAUTHORIZED);
  
          }
  
          return new ProviderAuthenticationResult(AuthResult.REDIRECT_TO_PROVIDER, HttpServletResponse.SC_OK, null, null, null, authzEndPointUrlWithQuery);
      }