code: @Override
      public Response build(final WebApplicationService webApplicationService, final String ticketId, final Authentication authentication) {
  
          val service = (OpenIdService) webApplicationService;
          val parameterList = new ParameterList(HttpRequestUtils.getHttpServletRequestFromRequestAttributes().getParameterMap());
  
          val parameters = new HashMap<String, String>();
  
          if (StringUtils.isBlank(ticketId)) {
              parameters.put(OpenIdProtocolConstants.OPENID_MODE, OpenIdProtocolConstants.CANCEL);
              return buildRedirect(service, parameters);
          }
  
          val association = getAssociation(serverManager, parameterList);
          val associated = association != null;
          val associationValid = isAssociationValid(association);
          var successFullAuthentication = true;
  
          var assertion = (Assertion) null;
          try {
              if (associated && associationValid) {
                  assertion = centralAuthenticationService.validateServiceTicket(ticketId, service);
                  LOGGER.debug("Validated openid ticket [{}] for [{}]", ticketId, service);
              } else if (!associated) {
                  LOGGER.debug("Responding to non-associated mode. Service ticket [{}] must be validated by the RP", ticketId);
              } else {
                  LOGGER.warn("Association does not exist or is not valid");
                  successFullAuthentication = false;
              }
          } catch (final AbstractTicketException e) {
              LOGGER.error("Could not validate ticket : [{}]", e.getMessage(), e);
              successFullAuthentication = false;
          }
          val id = determineIdentity(service, assertion);
          return buildAuthenticationResponse(service, parameters, successFullAuthentication, id, parameterList);
      }
docs: Generates an Openid response.
  If no ticketId is found, response is negative.
  If we have a ticket id, then we check if we have an association.
  If so, we ask OpenId server manager to generate the answer according with the existing association.
  If not, we send back an answer with the ticket id as association handle.
  This will force the consumer to ask a verification, which will validate the service ticket.
  
  @param ticketId              the service ticket to provide to the service.
  @param webApplicationService the service requesting an openid response
  @return the generated authentication answer