@Override
    public Set<String> resolveRequestScopes(final WebContext context) {
        val parameterValues = resolveRequestParameter(context, OAuth20Constants.SCOPE);
        if (parameterValues.isEmpty()) {
            return new HashSet<>();
        }
        val supported = jwtBuilder.getCasProperties().getAuthn().getOidc().getDiscovery().getScopes();
        val results = CollectionUtils.wrapSet(parameterValues.get().split(" "));
        results.retainAll(supported);
        return results;
    }
This is {@link DefaultOAuth20RequestParameterResolver}.

@author Misagh Moayyed
@since 6.6.0
support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/web/DefaultOAuth20RequestParameterResolver.java