@Override
    protected void finalizeProfileResponse(final OAuth20AccessToken accessToken,
                                           final Map<String, Object> modelAttributes,
                                           final Principal principal,
                                           final RegisteredService registeredService) {
        super.finalizeProfileResponse(accessToken, modelAttributes, principal, registeredService);
        if (registeredService instanceof OidcRegisteredService) {
            if (accessToken.getClaims().isEmpty()) {
                if (accessToken.getTicketGrantingTicket() instanceof final AuthenticationAwareTicket aat) {
                    modelAttributes.put(OidcConstants.CLAIM_AUTH_TIME, aat.getAuthentication().getAuthenticationDate().toEpochSecond());
                }
            } else {
                modelAttributes.keySet().retainAll(CollectionUtils.wrapList(OAuth20UserProfileViewRenderer.MODEL_ATTRIBUTE_ATTRIBUTES));
            }
        }
        if (!modelAttributes.containsKey(OAuth20Constants.CLAIM_SUB)) {
            modelAttributes.put(OAuth20Constants.CLAIM_SUB, principal.getId());
        }
        LOGGER.trace("Finalized user profile data as [{}] for access token [{}]", modelAttributes, accessToken.getId());
    }
This is {@link OidcUserProfileDataCreator}.

@author Misagh Moayyed
@since 5.3.0
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcUserProfileDataCreator.java