@Override
    protected boolean canAuthenticate(final CallContext callContext) {
        val context = callContext.webContext();
        val grantType = context.getRequestParameter(OAuth20Constants.GRANT_TYPE);
        val clientId = context.getRequestParameter(OAuth20Constants.CLIENT_ID);

        if (clientId.isPresent() && grantType.isPresent()
            && OAuth20Utils.isGrantType(grantType.get(), OAuth20GrantTypes.REFRESH_TOKEN)
            && context.getRequestParameter(OAuth20Constants.REFRESH_TOKEN).isPresent()) {
            val registeredService = OAuth20Utils.getRegisteredOAuthServiceByClientId(getServicesManager(), clientId.get());

            LOGGER.trace("Checking if the client [{}] is eligible for refresh token authentication", clientId.get());
            return registeredService != null && !OAuth20Utils.doesServiceNeedAuthentication(registeredService);
        }
        return false;
    }
This is {@link OAuth20RefreshTokenAuthenticator}.
<p>
{@link OAuth20RefreshTokenAuthenticator} can only be used for a refresh token request of a "public" client.
An OAuth "public" client is one that does not define a secret like a mobile application.

@author Julien Huon
@since 6.2.0
support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/authenticator/OAuth20RefreshTokenAuthenticator.java