@Override
    protected AuthenticationHandlerExecutionResult doAuthentication(
        final Credential credential, final Service service) throws PreventedException {
        try {
            val configurationContext = applicationContext.getBean(OAuth20ConfigurationContext.BEAN_NAME, OAuth20ConfigurationContext.class);
            val tokenCredential = (BasicIdentifiableCredential) credential;
            val accessTokenId = OAuth20JwtAccessTokenEncoder.toDecodableCipher(configurationContext.getAccessTokenJwtBuilder()).decode(tokenCredential.getId());
            val decodedToken = configurationContext.getTicketRegistry().getTicket(accessTokenId, OAuth20AccessToken.class);
            Assert.isTrue(decodedToken != null && !decodedToken.isExpired(), "Access token is invalid or expired");
            val claims = configurationContext.getUserProfileDataCreator().createFrom(decodedToken);
            val attributes = CollectionUtils.toMultiValuedMap((Map) claims.get(OAuth20UserProfileViewRenderer.MODEL_ATTRIBUTE_ATTRIBUTES));
            val principalId = decodedToken.getAuthentication().getPrincipal().getId();
            val principal = principalFactory.createPrincipal(principalId, attributes);
            tokenCredential.setId(principal.getId());
            return createHandlerResult(tokenCredential, principal, new ArrayList<>());
        } catch (final Throwable e) {
            throw new AuthenticationException(e);
        }
    }
This is {@link OAuth20AccessTokenAuthenticationHandler}.

@author Misagh Moayyed
@since 7.2.0
support/cas-server-support-token-authentication/src/main/java/org/apereo/cas/token/authentication/OAuth20AccessTokenAuthenticationHandler.java