@Audit(action = AuditableActions.ACCOUNT_REGISTRATION,
        actionResolverName = AuditActionResolvers.ACCOUNT_REGISTRATION_TOKEN_VALIDATION_ACTION_RESOLVER,
        resourceResolverName = AuditResourceResolvers.ACCOUNT_REGISTRATION_TOKEN_VALIDATION_RESOURCE_RESOLVER)
    @Override
    public AccountRegistrationRequest validateToken(final String token) throws Exception {
        val claimsJson = this.cipherExecutor.decode(token);
        val claims = JwtClaims.parse(claimsJson);

        val issuer = casProperties.getServer().getPrefix();
        if (!claims.getIssuer().equals(issuer)) {
            LOGGER.error("Token issuer [{}] does not match CAS' [{}]", claims.getIssuer(), issuer);
            return null;
        }
        if (claims.getAudience().isEmpty() || !claims.getAudience().getFirst().equals(issuer)) {
            LOGGER.error("Token audience does not match CAS");
            return null;
        }
        if (StringUtils.isBlank(claims.getSubject())) {
            LOGGER.error("Token has no subject identifier");
            return null;
        }
        val props = casProperties.getAccountRegistration().getCore();
        val holder = ClientInfoHolder.getClientInfo();
        val origin = claims.getStringClaimValue("origin");
        if (props.isIncludeServerIpAddress() && !origin.equals(holder.getServerIpAddress())) {
            LOGGER.error("Token origin server IP address [{}] does not match CAS [{}]", origin, holder.getServerIpAddress());
            return null;
        }
        val client = claims.getStringClaimValue("client");
        if (props.isIncludeClientIpAddress() && !client.equals(holder.getClientIpAddress())) {
            LOGGER.error("Token client IP address [{}] does not match CAS [{}]", client, holder.getClientIpAddress());
            return null;
        }

        val expirationTime = claims.getExpirationTime();
        if (expirationTime.isBefore(NumericDate.now())) {
            LOGGER.error("Token has expired with expiration time of [{}].", expirationTime);
            return null;
        }
        return new AccountRegistrationRequest(claims.getClaimsMap());
    }
This is {@link DefaultAccountRegistrationService}.

@author Misagh Moayyed
@since 6.5.0
support/cas-server-support-account-mgmt-core/src/main/java/org/apereo/cas/acct/DefaultAccountRegistrationService.java