protected void generateAccessTokenHash(final OAuth20AccessToken accessToken,
                                           final OidcRegisteredService registeredService,
                                           final JwtClaims claims) throws Throwable {
        val oidcIssuer = getConfigurationContext().getIssuerService().determineIssuer(Optional.of(registeredService));
        val cipher = OAuth20JwtAccessTokenEncoder.toEncodableCipher(getConfigurationContext(),
            registeredService, accessToken, oidcIssuer);
        val encodedAccessToken = cipher.encode(accessToken.getId());
        val jsonWebKey = getConfigurationContext().getIdTokenSigningAndEncryptionService()
            .getJsonWebKeySigningKey(Optional.of(registeredService));

        val alg = getConfigurationContext().getIdTokenSigningAndEncryptionService()
            .getJsonWebKeySigningAlgorithm(registeredService, jsonWebKey);
        val hash = OAuth20TokenHashGenerator.builder()
            .token(encodedAccessToken)
            .algorithm(alg)
            .registeredService(registeredService)
            .build()
            .generate();
        claims.setClaim(OidcConstants.CLAIM_AT_HASH, hash);
    }
This is {@link OidcIdTokenGeneratorService}.

@author Misagh Moayyed
@since 5.0.0
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/OidcIdTokenGeneratorService.java