@Override
    public Authentication build(final UserProfile profile,
                                final OAuthRegisteredService registeredService,
                                final WebContext context,
                                final Service service) throws Throwable {

        val attrs = new HashMap<>(profile.getAttributes());
        val profileAttributes = CollectionUtils.toMultiValuedMap(attrs);
        val newPrincipal = principalFactory.createPrincipal(profile.getId(), profileAttributes);
        LOGGER.debug("Created final principal [{}] after filtering attributes based on [{}]", newPrincipal, registeredService);

        val authenticator = profile.getClass().getCanonicalName();
        val credential = new BasicIdentifiableCredential(profile.getId());
        val handlerResult = new DefaultAuthenticationHandlerExecutionResult(authenticator,
            credential, newPrincipal, new ArrayList<>());

        val scopes = requestParameterResolver.resolveRequestedScopes(context);
        scopes.retainAll(registeredService.getScopes());

        val state = context.getRequestParameter(OAuth20Constants.STATE)
            .map(String::valueOf)
            .or(() -> requestParameterResolver.resolveRequestParameter(context, OAuth20Constants.STATE))
            .orElse(StringUtils.EMPTY);
        val nonce = context.getRequestParameter(OAuth20Constants.NONCE)
            .map(String::valueOf)
            .or(() -> requestParameterResolver.resolveRequestParameter(context, OAuth20Constants.NONCE))
            .orElse(StringUtils.EMPTY);
        LOGGER.debug("OAuth [{}] is [{}], and [{}] is [{}]", OAuth20Constants.STATE, state, OAuth20Constants.NONCE, nonce);

        val builder = DefaultAuthenticationBuilder.newInstance();
        if (profile instanceof final BasicUserProfile basicUserProfile) {
            val authenticationAttributes = basicUserProfile.getAuthenticationAttributes();
            builder.addAttributes(authenticationAttributes);
        }
        if (!profile.getRoles().isEmpty()) {
            builder.addAttribute("roles", new LinkedHashSet<>(profile.getRoles()));
        }
        if (!scopes.isEmpty()) {
            builder.addAttribute(OAuth20Constants.SCOPE, scopes);
        }
        FunctionUtils.doIfNotBlank(state, __ -> builder.addAttribute(OAuth20Constants.STATE, state));
        FunctionUtils.doIfNotBlank(nonce, __ -> builder.addAttribute(OAuth20Constants.NONCE, nonce));
        builder
            .addAttribute(OAuth20Constants.CLIENT_ID, registeredService.getClientId())
            .addCredential(credential)
            .setPrincipal(newPrincipal)
            .setAuthenticationDate(ZonedDateTime.now(ZoneOffset.UTC))
            .addSuccess(profile.getClass().getCanonicalName(), handlerResult);

        context.getRequestParameter(OAuth20Constants.ACR_VALUES)
            .ifPresent(value -> builder.addAttribute(OAuth20Constants.ACR_VALUES, value));

        return builder.build();
    }
This is {@link OAuth20DefaultCasAuthenticationBuilder}.

@author Misagh Moayyed
@since 5.1.0
support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/authenticator/OAuth20DefaultCasAuthenticationBuilder.java