@Override
    public boolean shouldEncryptToken(final OAuthRegisteredService registeredService) {
        if (registeredService instanceof final OidcRegisteredService service) {

            if (AlgorithmIdentifiers.NONE.equalsIgnoreCase(service.getUserInfoEncryptedResponseAlg())
                && !discoverySettings.getUserInfoEncryptionAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {
                LOGGER.error("Service [{}] has defined 'none' for user-info encryption algorithm, "
                             + "yet CAS is configured to support the following encryption algorithms: [{}]. "
                             + "This is quite likely due to misconfiguration of the CAS server or the service definition",
                    registeredService.getServiceId(), discoverySettings.getUserInfoEncryptionAlgValuesSupported());
                throw new IllegalArgumentException("Unable to use 'none' as user-info encryption algorithm");
            }
            return StringUtils.isNotBlank(service.getUserInfoEncryptedResponseAlg())
                   && !StringUtils.equalsIgnoreCase(service.getUserInfoEncryptedResponseAlg(), AlgorithmIdentifiers.NONE);
        }
        return false;
    }
Default encoding for user-info encrypted responses.
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcUserProfileSigningAndEncryptionService.java