code: @GetMapping(path = WSFederationConstants.ENDPOINT_FEDERATION_REQUEST_CALLBACK)
      protected ModelAndView handleFederationRequest(final HttpServletResponse response, final HttpServletRequest request) throws Exception {
          val fedRequest = WSFederationRequest.of(request);
          LOGGER.debug("Received callback profile request [{}]", request.getRequestURI());
  
          val serviceUrl = constructServiceUrl(request, response, fedRequest);
          val targetService = getWsFederationRequestConfigurationContext().getServiceSelectionStrategy()
              .resolveServiceFrom(getWsFederationRequestConfigurationContext().getWebApplicationServiceFactory().createService(serviceUrl));
          val service = findAndValidateFederationRequestForRegisteredService(targetService, fedRequest);
          LOGGER.debug("Located matching service [{}]", service);
  
          val ticket = CommonUtils.safeGetParameter(request, CasProtocolConstants.PARAMETER_TICKET);
          if (StringUtils.isBlank(ticket)) {
              LOGGER.error("Can not validate the request because no [{}] is provided via the request", CasProtocolConstants.PARAMETER_TICKET);
              return new ModelAndView(CasWebflowConstants.VIEW_ID_ERROR, new HashMap<>(), HttpStatus.FORBIDDEN);
          }
  
          val assertion = validateRequestAndBuildCasAssertion(response, request, fedRequest);
          val securityTokenReq = getSecurityTokenFromRequest(request);
          val securityToken = FunctionUtils.doIfNull(securityTokenReq,
              () -> {
                  LOGGER.debug("No security token is yet available. Invoking security token service to issue token");
                  return fetchSecurityTokenFromAssertion(assertion, targetService);
              },
              () -> securityTokenReq)
              .get();
          addSecurityTokenTicketToRegistry(request, securityToken);
          val rpToken = produceRelyingPartyToken(request, targetService, fedRequest, securityToken, assertion);
          return postResponseBackToRelyingParty(rpToken, fedRequest);
      }
docs: Handle federation request.
  
  @param response the response
  @param request  the request
  @return the model and view
  @throws Exception the exception