code: private AuthenticationResult handleFormLogin(HttpServletRequest req, HttpServletResponse res, WebRequest webRequest) {
          AuthenticationResult authResult = null;
          authResult = ssoAuthenticator.authenticate(webRequest);
  
          if (authResult != null) {
              authResult.setAuditCredType(AuditEvent.CRED_TYPE_FORM);
          }
  
          if (authResult != null && authResult.getStatus() != AuthResult.FAILURE) {
              postParameterHelper.restore(req, res);
              return authResult;
          }
  
          try {
              authResult = providerAuthenticatorProxy.authenticate(req, res, null);
          } catch (Exception e) {
              return new AuthenticationResult(AuthResult.FAILURE, e.getLocalizedMessage());
          }
  
          if (authResult.getStatus() == AuthResult.CONTINUE) {
              authResult = null;
              if (webRequest.isFormLoginRedirectEnabled()) {
                  authResult = handleRedirect(req, res, webRequest);
                  if (authResult != null) {
                      authResult.setAuditCredType(AuditEvent.CRED_TYPE_FORM);
                      authResult.setAuditOutcome(AuditEvent.OUTCOME_REDIRECT);
                  }
  
              }
          }
          return authResult;
      }
docs: This method handle formlogin; If the SSO cookie exist, then it will use the cookie to authenticate. If
  the cookie does not exist, then it will re-redirect to the login page.
  
  @param req
  @param res
  @param enableRedirect
  @return