@Test
        void verifyDPoPRequest() throws Throwable {
            val ecJWK = new ECKeyGenerator(Curve.P_256).keyID("1234567890").generate();
            val proofFactory = new DefaultDPoPProofFactory(ecJWK, JWSAlgorithm.ES256);

            var request = getHttpRequestForEndpoint("token");
            request.setMethod(HttpMethod.POST.name());
            var response = new MockHttpServletResponse();

            var uri = new URI(request.getRequestURL().toString());
            var dpopProof = proofFactory.createDPoPJWT(HttpMethod.POST.name(), uri);
            var proofJwt = dpopProof.serialize();
            request.addHeader(OAuth20Constants.DPOP, proofJwt);

            val principal = CoreAuthenticationTestUtils.getPrincipal("casuser");
            val oidcRegisteredService = getOidcRegisteredService(UUID.randomUUID().toString());
            servicesManager.save(oidcRegisteredService);
            request.addParameter(OAuth20Constants.CLIENT_ID, oidcRegisteredService.getClientId());
            val code = addCode(principal, oidcRegisteredService);
            request.addParameter(OAuth20Constants.GRANT_TYPE, OAuth20GrantTypes.AUTHORIZATION_CODE.getType());
            request.addParameter(OAuth20Constants.REDIRECT_URI, "https://oauth.example.org");
            request.addParameter(OAuth20Constants.CODE, code.getId());
            oauthInterceptor.preHandle(request, response, new Object());
            val mv = oidcAccessTokenEndpointController.handleRequest(request, response);
            val accessToken = mv.getModel().get(OAuth20Constants.ACCESS_TOKEN).toString();
            assertNotNull(accessToken);
            val dpopAccessToken = JWTParser.parse(accessToken);
            assertNotNull(dpopAccessToken);

            request = getHttpRequestForEndpoint(OidcConstants.PROFILE_URL);
            request.setMethod(HttpMethod.POST.name());
            response = new MockHttpServletResponse();
            uri = new URI(request.getRequestURL().toString());
            dpopProof = proofFactory.createDPoPJWT(HttpMethod.POST.name(), uri, new DPoPAccessToken(accessToken));
            val dpopJwt = dpopProof.serialize();
            request.addHeader(OAuth20Constants.DPOP, dpopJwt);
            request.addParameter(OAuth20Constants.TOKEN, accessToken);
            val entity = oidcProfileController.handlePostRequest(request, response);
            assertEquals(HttpStatus.OK, entity.getStatusCode());
        }
This is {@link OidcAccessTokenEndpointControllerTests}.

@author Misagh Moayyed
@since 6.3.0
support/cas-server-support-oidc/src/test/java/org/apereo/cas/oidc/web/controllers/token/OidcAccessTokenEndpointControllerTests.java