protected Principal filterClaimsForOidcService(final Service service,
                                                   final Principal givenPrincipal,
                                                   final OAuth20AccessToken accessToken,
                                                   final Principal filteredPrincipal,
                                                   final Set<String> scopes,
                                                   final OidcRegisteredService oidcService) throws Throwable {
        if (!scopes.contains(OidcConstants.StandardScopes.OPENID.getScope())) {
            LOGGER.warn("Access token scopes [{}] cannot identify an OpenID Connect request with [{}] scope(s). "
                    + "This is a REQUIRED scope for OpenID Connect that MUST be present in the request. Given its absence, "
                    + "CAS will not process any attribute claims and will return the authenticated principal as is.",
                OidcConstants.StandardScopes.OPENID.getScope(), scopes.isEmpty() ? "empty" : scopes);
            return principalFactory.createPrincipal(givenPrincipal.getId());
        }

        scopes.retainAll(casProperties.getAuthn().getOidc().getDiscovery().getScopes());
        LOGGER.debug("Collection of scopes filtered based on discovery settings are [{}]", scopes);

        val attributes = getAttributesAllowedForService(scopes, filteredPrincipal, service, oidcService, accessToken);
        LOGGER.debug("Collection of claims filtered by scopes [{}] are [{}]", scopes, attributes);

        filterAttributesByAccessTokenRequestedClaims(oidcService, accessToken, filteredPrincipal, attributes);
        LOGGER.debug("Final collection of claims are [{}]", attributes);
        return principalFactory.createPrincipal(givenPrincipal.getId(), attributes);
    }
This is {@link OidcProfileScopeToAttributesFilter}.

@author Misagh Moayyed
@since 5.1.0
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcProfileScopeToAttributesFilter.java