@Override
    public Optional<Credentials> validate(final CallContext callContext, final Credentials creds) {
        return FunctionUtils.doAndHandle(() -> {
            val registeredService = getOidcRegisteredService(callContext);
            RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(registeredService);

            if (OAuth20Utils.isAccessTokenRequest(callContext.webContext())) {
                val authMethodDisabled = oidcServerDiscoverySettings.getTokenEndpointAuthMethodsSupported()
                    .stream()
                    .map(OAuth20ClientAuthenticationMethods::parse)
                    .noneMatch(method -> method == OAuth20ClientAuthenticationMethods.CLIENT_SECRET_JWT || method == OAuth20ClientAuthenticationMethods.PRIVATE_KEY_JWT);
                if (authMethodDisabled || !OAuth20Utils.isTokenAuthenticationMethodSupportedFor(callContext, registeredService,
                    OAuth20ClientAuthenticationMethods.CLIENT_SECRET_JWT, OAuth20ClientAuthenticationMethods.PRIVATE_KEY_JWT)) {
                    LOGGER.warn("Private key JWT authentication method is not enabled for CAS, or is not supported for service [{}]", registeredService.getName());
                    return Optional.<Credentials>empty();
                }
            }

            val credentials = (UsernamePasswordCredentials) creds;
            val jwt = verifyCredentials(credentials, callContext.webContext());
            if (jwt == null) {
                LOGGER.warn("Unable to verify credentials");
                return Optional.<Credentials>empty();
            }

            val keys = OidcJsonWebKeyStoreUtils.getJsonWebKeySet(registeredService,
                applicationContext, Optional.of(OidcJsonWebKeyUsage.SIGNING));
            keys.ifPresent(Unchecked.consumer(jwks ->
                jwks.getJsonWebKeys()
                    .forEach(Unchecked.consumer(jsonWebKey -> {
                        val consumer = new JwtConsumerBuilder()
                            .setVerificationKey(jsonWebKey.getKey())
                            .setRequireJwtId()
                            .setRequireExpirationTime()
                            .setRequireSubject()
                            .setExpectedIssuer(true, issuerService.determineIssuer(Optional.of(registeredService)))
                            .setExpectedAudience(true, registeredService.getClientId())
                            .build();
                        determineUserProfile(credentials, consumer);
                    }))));
            return Optional.<Credentials>of(credentials);
        }, e -> {
            LoggingUtils.error(LOGGER, e);
            return Optional.<Credentials>empty();
        }).get();
    }
This is {@link OidcJwtAuthenticator}.

@author Misagh Moayyed
@since 6.1.0
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/authn/OidcJwtAuthenticator.java