code: private Response process(String ticket, String[] claimNames, String[] claimLocales)
      {
          // If the end-user did not grant authorization to the client application.
          if (mSpi.isClientAuthorized() == false)
          {
              // The end-user denied the authorization request.
              return fail(ticket, Reason.DENIED);
          }
  
          // The subject (= unique identifier) of the end-user.
          String subject = mSpi.getUserSubject();
  
          // If the subject of the end-user is not available.
          if (subject == null || subject.length() == 0)
          {
              // The end-user is not authenticated.
              return fail(ticket, Reason.NOT_AUTHENTICATED);
          }
  
          // The time when the end-user was authenticated.
          long authTime = mSpi.getUserAuthenticatedAt();
  
          // The ACR (Authentication Context Class Reference) of the
          // end-user authentication.
          String acr = mSpi.getAcr();
  
          // Collect claim values.
          Map<String, Object> claims = collectClaims(subject, claimNames, claimLocales);
  
          // Extra properties to associate with an access token and/or
          // an authorization code.
          Property[] properties = mSpi.getProperties();
  
          // Scopes to associate with an access token and/or an authorization code.
          // If a non-null value is returned from mSpi.getScopes(), the scope set
          // replaces the scopes that have been specified in the original
          // authorization request.
          String[] scopes = mSpi.getScopes();
  
          // Authorize the authorization request.
          return authorize(ticket, subject, authTime, acr, claims, properties, scopes);
      }
docs: Process the end-user's decision.