protected void encodeAndEncryptProxyGrantingTicket(final Map<String, Object> model,
                                                       final Map<String, Object> resultingAttributes,
                                                       final Map<String, String> cachedAttributesToEncode,
                                                       final RegisteredServiceCipherExecutor cipher,
                                                       final RegisteredService registeredService) {

        if (model.containsKey(CasViewConstants.MODEL_ATTRIBUTE_NAME_PROXY_GRANTING_TICKET)) {
            val proxyGrantingTicket = (Ticket) model.get(CasViewConstants.MODEL_ATTRIBUTE_NAME_PROXY_GRANTING_TICKET);
            if (proxyGrantingTicket != null && proxyGrantingTicket.isStateless()) {
                putIntoAttributesMap(resultingAttributes, cachedAttributesToEncode,
                    CasViewConstants.MODEL_ATTRIBUTE_NAME_PROXY_GRANTING_TICKET);
            } else {
                encryptAndEncodeAndPutIntoAttributesMap(resultingAttributes, cachedAttributesToEncode,
                    CasViewConstants.MODEL_ATTRIBUTE_NAME_PROXY_GRANTING_TICKET, cipher, registeredService);
            }
        }

        encryptAndEncodeAndPutIntoAttributesMap(resultingAttributes, cachedAttributesToEncode,
            CasViewConstants.MODEL_ATTRIBUTE_NAME_PROXY_GRANTING_TICKET_IOU, cipher, registeredService);
    }
The default implementation of the attribute
encoder that will use a per-service key-pair
to encrypt the credential password and PGT
when available. All other attributes remain in
place.

@author Misagh Moayyed
@since 4.1
core/cas-server-core-services-authentication/src/main/java/org/apereo/cas/authentication/support/DefaultCasProtocolAttributeEncoder.java