@Test
        void verifyClaimReleaseAllowedByScopeFreePolicyInChain() throws Throwable {
            val request = new MockHttpServletRequest();
            val profile = new CommonProfile();
            profile.setClientName("OIDC");
            profile.setId(UUID.randomUUID().toString());

            request.setAttribute(Pac4jConstants.USER_PROFILES,
                CollectionUtils.wrapLinkedHashMap(profile.getClientName(), profile));

            val principal = RegisteredServiceTestUtils.getPrincipal(profile.getId(), CollectionUtils.wrap(
                OIDC_CLAIM_EMAIL, List.of("casuser@example.org"), "sys_id", List.of("1234567890")));

            val authentication = CoreAuthenticationTestUtils.getAuthentication(principal,
                CollectionUtils.wrap(
                    OAuth20Constants.STATE, List.of(UUID.randomUUID().toString()),
                    OAuth20Constants.NONCE, List.of(UUID.randomUUID().toString())));
            val tgt = new MockTicketGrantingTicket(authentication);
            val callback = casProperties.getServer().getPrefix()
                + OAuth20Constants.BASE_OAUTH20_URL + '/'
                + OAuth20Constants.CALLBACK_AUTHORIZE_URL_DEFINITION;
            val service = webApplicationServiceFactory.createService(callback);
            tgt.getServices().putAll(CollectionUtils.wrap("service", service));

            val accessToken = buildAccessToken(tgt);

            val registeredService = getOidcRegisteredService(UUID.randomUUID().toString());
            registeredService.setIdTokenIssuer(UUID.randomUUID().toString());
            registeredService.setScopes(CollectionUtils.wrapSet(OPENID.getScope(), PROFILE.getScope()));
            registeredService.setAttributeReleasePolicy(new ChainingAttributeReleasePolicy().addPolicies(new OidcScopeFreeAttributeReleasePolicy(List.of("sys_id"))));
            servicesManager.save(registeredService);

            val idTokenContext = IdTokenGenerationContext.builder()
                .accessToken(accessToken)
                .userProfile(profile)
                .responseType(OAuth20ResponseTypes.ID_TOKEN)
                .grantType(OAuth20GrantTypes.NONE)
                .registeredService(registeredService)
                .build();

            val idToken = oidcIdTokenGenerator.generate(idTokenContext);
            assertNotNull(idToken);

            val claims = oidcTokenSigningAndEncryptionService.decode(idToken.token(), Optional.of(registeredService));
            assertEquals("1234567890", claims.getClaimValueAsString("sys_id"));
        }
This is {@link OidcIdTokenGeneratorServiceTests}.

@author Misagh Moayyed
@since 5.3.0
support/cas-server-support-oidc/src/test/java/org/apereo/cas/oidc/token/OidcIdTokenGeneratorServiceTests.java