protected Map<String, List<Object>> collectClaimsForAccessToken() throws Throwable {
        val activePrincipal = buildPrincipalForAttributeFilter(token, registeredService);
        val principal = configurationContext.getProfileScopeToAttributesFilter()
            .filter(service, activePrincipal, registeredService, (OAuth20AccessToken) token);
        val attributesToRelease = new HashMap<>(principal.getAttributes());
        val originalAttributes = activePrincipal.getAttributes();
        if (originalAttributes.containsKey(OAuth20Constants.DPOP_CONFIRMATION)) {
            CollectionUtils.firstElement(originalAttributes.get(OAuth20Constants.DPOP_CONFIRMATION))
                .ifPresent(conf -> {
                    val confirmation = new JWKThumbprintConfirmation(new Base64URL(conf.toString()));
                    val claim = confirmation.toJWTClaim();
                    attributesToRelease.put(claim.getKey(), List.of(claim.getValue()));
                });
            attributesToRelease.put(OAuth20Constants.DPOP, originalAttributes.get(OAuth20Constants.DPOP));
            attributesToRelease.put(OAuth20Constants.DPOP_CONFIRMATION, originalAttributes.get(OAuth20Constants.DPOP_CONFIRMATION));
        }

        if (originalAttributes.containsKey(OAuth20Constants.X509_CERTIFICATE_DIGEST)) {
            CollectionUtils.firstElement(originalAttributes.get(OAuth20Constants.X509_CERTIFICATE_DIGEST))
                .ifPresent(conf -> {
                    val confirmation = new X509CertificateConfirmation(new Base64URL(conf.toString()));
                    val claim = confirmation.toJWTClaim();
                    attributesToRelease.put(claim.getKey(), List.of(claim.getValue()));
                });
            attributesToRelease.put(OAuth20Constants.X509_CERTIFICATE_DIGEST, originalAttributes.get(OAuth20Constants.X509_CERTIFICATE_DIGEST));
        }
        FunctionUtils.doIfNotNull(token.getGrantType(), type ->
            attributesToRelease.put(OAuth20Constants.GRANT_TYPE, List.of(type.getType())));
        FunctionUtils.doIfNotNull(token.getResponseType(), type ->
            attributesToRelease.put(OAuth20Constants.RESPONSE_TYPE, List.of(type.getType())));
        attributesToRelease.remove(CasProtocolConstants.PARAMETER_PASSWORD);
        return attributesToRelease;
    }
This is {@link OAuth20JwtAccessTokenEncodableCipher}.

@author Misagh Moayyed
@since 7.2.0
support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/web/response/accesstoken/response/OAuth20JwtAccessTokenEncodableCipher.java