@Override
    public JwtClaims decode(final String token, final Optional<OAuthRegisteredService> registeredService) {
        return Unchecked.supplier(() -> {
            if (registeredService.isPresent()) {
                val jwt = JWTParser.parse(token);
                if (jwt instanceof EncryptedJWT) {
                    val encryptionKey = getJsonWebKeyForEncryption(registeredService.get());
                    val decoded = EncodingUtils.decryptJwtValue(encryptionKey.getPrivateKey(), token);
                    return super.decode(decoded, registeredService);
                }
            }
            return super.decode(token, registeredService);
        }, throwable -> {
            throw new IllegalArgumentException(throwable);
        }).get();
    }
This is {@link BaseOidcJsonWebKeyTokenSigningAndEncryptionService}.

@author Misagh Moayyed
@since 6.1.0
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/BaseOidcJsonWebKeyTokenSigningAndEncryptionService.java