code: protected Credential getServiceCredentialsFromRequest(final WebApplicationService service, final HttpServletRequest request) {
          val pgtUrl = request.getParameter(CasProtocolConstants.PARAMETER_PROXY_CALLBACK_URL);
          if (StringUtils.isNotBlank(pgtUrl)) {
              try {
                  val registeredService = serviceValidateConfigurationContext.getServicesManager().findServiceBy(service);
                  verifyRegisteredServiceProperties(registeredService, service);
                  return new HttpBasedServiceCredential(new URL(pgtUrl), registeredService);
              } catch (final Exception e) {
                  LOGGER.error("Error constructing [{}]", CasProtocolConstants.PARAMETER_PROXY_CALLBACK_URL, e);
              }
          }
          return null;
      }
docs: Overrideable method to determine which credentials to use to grant a
  proxy granting ticket. Default is to use the pgtUrl.
  
  @param service the webapp service requesting proxy
  @param request the HttpServletRequest object.
  @return the credentials or null if there was an error or no credentials
  provided.