protected Map<String, List<Object>> getAttributesAllowedForService(
        final Collection<String> scopes,
        final Principal principal,
        final Service service,
        final OidcRegisteredService oidcService,
        final OAuth20AccessToken accessToken) throws Throwable {
        val serviceScopes = oidcService.getScopes();
        LOGGER.trace("Scopes assigned to service definition [{}] are [{}]", oidcService.getName(), serviceScopes);
        val scopeFree = serviceScopes.isEmpty() || (serviceScopes.size() == 1
            && serviceScopes.contains(OidcConstants.StandardScopes.OPENID.getScope()));
        if (!scopeFree) {
            scopes.retainAll(serviceScopes);
            LOGGER.trace("Service definition [{}] will filter claims based on scopes [{}]", oidcService.getName(), scopes);
            return filterAttributesByScope(scopes, principal, service, oidcService, accessToken);
        }
        LOGGER.trace("Service definition [{}] invokes the assigned claims release policy without using scopes", oidcService.getName());
        val releasePolicyContext = RegisteredServiceAttributeReleasePolicyContext.builder()
            .registeredService(oidcService)
            .service(service)
            .principal(principal)
            .applicationContext(applicationContext)
            .attributeReleasePolicyPredicate(policy ->
                !(policy instanceof final OidcRegisteredServiceAttributeReleasePolicy oidcPolicy)
                    || scopes.contains(oidcPolicy.getScopeType()))
            .build();
        return oidcService.getAttributeReleasePolicy().getAttributes(releasePolicyContext);
    }
This is {@link OidcProfileScopeToAttributesFilter}.

@author Misagh Moayyed
@since 5.1.0
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcProfileScopeToAttributesFilter.java