@Override
    public Optional<Credentials> validate(final CallContext callContext, final Credentials creds) {
        val credentials = (TokenCredentials) creds;
        val token = extractAccessTokenFrom(credentials.getToken().trim());
        val at = ticketRegistry.getTicket(token, OAuth20AccessToken.class);
        if (!at.getScopes().contains(getRequiredScope())) {
            val err = String.format("Missing scope [%s]. Unable to authenticate access token %s", getRequiredScope(), token);
            throw new CredentialsException(err);
        }
        val profile = new CommonProfile();
        val authentication = at.getAuthentication();
        val principal = authentication.getPrincipal();
        profile.setId(principal.getId());
        val attributes = new LinkedHashMap<String, Object>(authentication.getAttributes());
        attributes.putAll(principal.getAttributes());

        profile.addAttributes(attributes);
        profile.addRoles(at.getScopes());
        profile.addAttribute(OAuth20AccessToken.class.getName(), at);
        profile.addAttribute(OAuth20Constants.CLIENT_ID, at.getClientId());

        LOGGER.debug("Authenticated access token [{}]", profile);
        credentials.setUserProfile(profile);
        return Optional.of(credentials);
    }
This is {@link BaseUmaTokenAuthenticator}.

@author Misagh Moayyed
@since 6.0.0
support/cas-server-support-oauth-uma-core/src/main/java/org/apereo/cas/uma/web/authn/BaseUmaTokenAuthenticator.java