private void validate(final OidcClientRegistrationRequest registrationRequest,
                          final OidcRegisteredService registeredService) throws Exception {
        val context = configurationContext.getObject();
        if (StringUtils.isNotBlank(registeredService.getSectorIdentifierUri())) {
            HttpResponse sectorResponse = null;
            try {
                val exec = HttpExecutionRequest.builder()
                    .method(HttpMethod.GET)
                    .url(registeredService.getSectorIdentifierUri())
                    .build();
                sectorResponse = HttpUtils.execute(exec);
                if (sectorResponse != null && sectorResponse.getCode() == HttpStatus.SC_OK) {
                    try (val content = ((HttpEntityContainer) sectorResponse).getEntity().getContent()) {
                        val result = IOUtils.toString(content, StandardCharsets.UTF_8);
                        val expectedType = MAPPER.getTypeFactory().constructParametricType(List.class, String.class);
                        val urls = MAPPER.readValue(JsonValue.readHjson(result).toString(), expectedType);
                        if (!urls.equals(registrationRequest.getRedirectUris())) {
                            throw new IllegalArgumentException("Invalid sector identifier uri");
                        }
                    }
                }
            } finally {
                HttpUtils.close(sectorResponse);
            }
        }

        val oidc = context.getCasProperties().getAuthn().getOidc();
        if (!oidc.getRegistration().getDynamicClientRegistrationMode().isProtected()
            && (StringUtils.isNotBlank(registrationRequest.getPolicyUri()) || StringUtils.isNotBlank(registrationRequest.getLogo()))) {
            val hosts = registrationRequest.getRedirectUris()
                .stream()
                .map(uri -> FunctionUtils.doUnchecked(() -> new URI(uri).getHost())).toList();
            if (StringUtils.isNotBlank(registrationRequest.getLogo())) {
                val logo = new URI(registrationRequest.getLogo()).getHost();
                if (!hosts.contains(logo)) {
                    throw new IllegalArgumentException("Invalid logo uri from an unknown host");
                }
            }

            if (StringUtils.isNotBlank(registrationRequest.getPolicyUri())) {
                val policy = new URI(registrationRequest.getPolicyUri()).getHost();
                if (!hosts.contains(policy)) {
                    throw new IllegalArgumentException("Invalid policy uri from an unknown host");
                }
            }
        }

        if (StringUtils.equalsAnyIgnoreCase(registeredService.getBackchannelTokenDeliveryMode(),
            OidcBackchannelTokenDeliveryModes.PUSH.getMode(), OidcBackchannelTokenDeliveryModes.PING.getMode())) {
            Assert.hasText(registeredService.getBackchannelClientNotificationEndpoint(),
                "Backchannel client notification endpoint must be specified");
            Assert.isTrue(StringUtils.startsWith(registeredService.getBackchannelClientNotificationEndpoint(), "https://"),
                "Backchannel client notification endpoint MUST be an HTTPS url");
        }
        
    }
This is {@link OidcDefaultClientRegistrationRequestTranslator}.

@author Misagh Moayyed
@since 6.6.0
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/controllers/dynareg/OidcDefaultClientRegistrationRequestTranslator.java