protected Map<String, List<Object>> returnFinalAttributesCollection(final Map<String, List<Object>> attributesToRelease,
                                                                        final RegisteredService service) {
        LOGGER.debug("Final collection of attributes allowed are: [{}]", attributesToRelease);
        val transform = StringUtils.isBlank(canonicalizationMode)
            ? CaseCanonicalizationMode.NONE
            : CaseCanonicalizationMode.valueOf(this.canonicalizationMode);
        if (transform != CaseCanonicalizationMode.NONE) {
            val transformedAttributes = new HashMap<>(attributesToRelease);
            transformedAttributes.forEach((key, value) -> {
                val values = value
                    .stream()
                    .map(Object::toString)
                    .map(transform::canonicalize)
                    .toList();
                transformedAttributes.put(key, (List) values);
            });
            return transformedAttributes;
        }
        return attributesToRelease;
    }
Post load, after having loaded the bean via JPA, etc.
core/cas-server-core-authentication-attributes/src/main/java/org/apereo/cas/services/AbstractRegisteredServiceAttributeReleasePolicy.java