code: func (s *Server) SAMLACS(w http.ResponseWriter, r *http.Request) {
  	if s.ServiceProvider == nil {
  		http.NotFound(w, r)
  		return
  	}
  
  	assertion, err := s.ServiceProvider.Parse(w, r)
  	if err != nil {
  		if err, ok := err.(*saml.InvalidResponseError); ok {
  			reporter.Report(r.Context(), err.PrivateErr)
  		}
  		http.Error(w, err.Error(), 403)
  		return
  	}
  
  	session := samlauth.SessionFromAssertion(assertion)
  
  	// Create an Access Token for the API.
  	at, err := s.Heroku.AccessTokensCreate(&heroku.AccessToken{
  		ExpiresAt: session.ExpiresAt,
  		User:      session.User,
  	})
  	if err != nil {
  		http.Error(w, err.Error(), 403)
  		return
  	}
  
  	switch r.Header.Get("Accept") {
  	case "text/plain":
  		w.Header().Set("Content-Type", "text/plain")
  		io.WriteString(w, at.Token)
  	default:
  		w.Header().Set("Content-Type", "text/html")
  		instructionsTemplate.Execute(w, &instructionsData{
  			URL:   s.URL,
  			User:  session.User,
  			Token: at,
  		})
  	}
  }
docs: // SAMLACS handles the SAML Response call. It will validate the SAML Response
  // and assertions, generate an API token, then present the token to the user.