if (session != null) {
                final String sesState = (String) session.getAttribute(SAML_STATE);
                if (StringUtil.isNotBlank(sesState)) {
                    session.removeAttribute(SAML_STATE);
                    try {
                        final Auth auth = new Auth(getSettings(), request, response);
                        auth.processResponse();