@Override
    public HttpResponse serve(ServiceRequestContext ctx, AggregatedHttpRequest req,
                              String defaultHostname, SamlPortConfig portConfig) {
        MessageContext<Response> messageContext = null;

        try {
            final SamlBindingProtocol bindingProtocol = cfg.endpoint().bindingProtocol();
            if (bindingProtocol == SamlBindingProtocol.HTTP_REDIRECT) {
                messageContext = HttpRedirectBindingUtil.toSamlObject(req, SAML_RESPONSE,
                                                                      idpConfigs, defaultIdpConfig,
                                                                      signatureRequired);
            } else {
                messageContext = HttpPostBindingUtil.toSamlObject(req, SAML_RESPONSE);
            }

            final String endpointUri = cfg.endpoint().toUriString(portConfig.scheme().uriText(),
                                                                  defaultHostname, portConfig.port());
            final Response response = messageContext.getMessage();
            assert response != null;

            final Assertion assertion = getValidatedAssertion(bindingProtocol, response, endpointUri);

            // Find a session index which is sent by an identity provider.
            final String sessionIndex = assertion.getAuthnStatements().stream()
                                                 .map(AuthnStatement::getSessionIndex)
                                                 .filter(Objects::nonNull)
                                                 .findFirst().orElse(null);

            final SAMLBindingContext bindingContext = messageContext.getSubcontext(SAMLBindingContext.class);
            final String relayState = bindingContext != null ? bindingContext.getRelayState() : null;

            return ssoHandler.loginSucceeded(ctx, req, messageContext, sessionIndex, relayState);
        } catch (SamlException e) {
            return ssoHandler.loginFailed(ctx, req, messageContext, e);
        }
    }
A service which receives an assertion from the remote identity provider.
saml/src/main/java/com/linecorp/armeria/server/saml/SamlAssertionConsumerFunction.java