code: func (c *Client) Issue(ctx context.Context, req TokenRequest) (*Signer, error) {
  	s := &Signer{
  		Certificate: req.Certificate,
  		keyID:       req.KeyID,
  		Token:       req.Token,
  		user:        req.Userinfo,
  	}
  
  	rst, err := c.newRequest(req, "Issue", s)
  	if err != nil {
  		return nil, err
  	}
  
  	if req.ActAs {
  		rst.ActAs = &internal.Target{
  			Token: req.Token,
  		}
  	}
  
  	header := soap.Header{
  		Security: s,
  		Action:   rst.Action(),
  	}
  
  	res, err := internal.Issue(c.WithHeader(ctx, header), c, &rst)
  	if err != nil {
  		return nil, err
  	}
  
  	s.Token = res.RequestSecurityTokenResponse.RequestedSecurityToken.Assertion
  
  	return s, s.setLifetime(res.RequestSecurityTokenResponse.Lifetime)
  }
docs: // Issue is used to request a security token.
  // The returned Signer can be used to sign SOAP requests, such as the SessionManager LoginByToken method and the RequestSecurityToken method itself.
  // One of TokenRequest Certificate or Userinfo is required, with Certificate taking precedence.
  // When Certificate is set, a Holder-of-Key token will be requested.  Otherwise, a Bearer token is requested with the Userinfo credentials.
  // See: http://docs.oasis-open.org/ws-sx/ws-trust/v1.4/errata01/os/ws-trust-1.4-errata01-os-complete.html#_Toc325658937