private void generateCibaClaims(final IdTokenGenerationContext context, final JwtClaims claims) throws Throwable {
        val deliveryMode = OidcBackchannelTokenDeliveryModes.valueOf(
            ((OidcRegisteredService) context.getRegisteredService()).getBackchannelTokenDeliveryMode().toUpperCase(Locale.ENGLISH));
        if (deliveryMode == OidcBackchannelTokenDeliveryModes.PUSH) {
            val requestId = context.getAccessToken().getAuthentication().getSingleValuedAttribute(OidcConstants.AUTH_REQ_ID, String.class);
            claims.setStringClaim(OidcConstants.CLAIM_AUTH_REQ_ID, requestId);

            if (context.getRefreshToken() != null) {
                val jsonWebKey = getConfigurationContext().getIdTokenSigningAndEncryptionService()
                    .getJsonWebKeySigningKey(Optional.of(context.getRegisteredService()));
                val alg = getConfigurationContext().getIdTokenSigningAndEncryptionService()
                    .getJsonWebKeySigningAlgorithm(context.getRegisteredService(), jsonWebKey);
                val hash = OAuth20TokenHashGenerator.builder()
                    .token(context.getRefreshToken().getId())
                    .algorithm(alg)
                    .registeredService(context.getRegisteredService())
                    .build()
                    .generate();
                claims.setClaim(OidcConstants.CLAIM_RT_HASH, hash);
            }
        }
    }
This is {@link OidcIdTokenGeneratorService}.

@author Misagh Moayyed
@since 5.0.0
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/OidcIdTokenGeneratorService.java