public static JwtTicketCipherExecutor get(final String signingKey, final String encryptionKey,
                                              final RegisteredService registeredService,
                                              final OidcRegisteredServiceJwtCipherExecutor cipherExecutor) {
        val cipher = new InternalJwtAccessTokenCipherExecutor(encryptionKey, signingKey, cipherExecutor);
        Unchecked.consumer(__ -> {
            if (EncodingUtils.isJsonWebKey(encryptionKey)) {
                val jsonWebKey = toJsonWebKey(encryptionKey, registeredService);
                cipher.setEncryptionKey(jsonWebKey.getPublicKey());
                cipher.setEncryptionWebKey(jsonWebKey);
            }
            if (EncodingUtils.isJsonWebKey(signingKey)) {
                val jsonWebKey = toJsonWebKey(signingKey, registeredService);

                /*
                 * Use the private key as the primary key to handle signing operations.
                 * The private key may also be used for validating signed objects.
                 * If the private key is not found, in the case where the keystore only contains a public
                 * key, then use the public key as the primary signing key, turning this cipher into one
                 * that can only verify signed objects, which would be useful when processing signed
                 * request objects that are sent by the RP, which has the only copy of the private key.
                 */
                cipher.setSigningKey(ObjectUtils.defaultIfNull(jsonWebKey.getPrivateKey(), jsonWebKey.getKey()));
                cipher.setSigningWebKey(jsonWebKey);
            }
        }).accept(cipher);

        if (EncodingUtils.isJsonWebKey(encryptionKey) || EncodingUtils.isJsonWebKey(signingKey)) {
            cipher.setEncryptionAlgorithm(KeyManagementAlgorithmIdentifiers.RSA_OAEP_256);
        }
        cipher.setCommonHeaders(CollectionUtils.wrap(
            RegisteredServiceCipherExecutor.CUSTOM_HEADER_REGISTERED_SERVICE_ID, registeredService.getId()));
        return cipher;
    }
Get ticket cipher executor.

@param signingKey        the signing key
@param encryptionKey     the encryption key
@param registeredService the registered service
@param cipherExecutor    the cipher executor
@return the jwt ticket cipher executor
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/util/InternalJwtAccessTokenCipherExecutor.java