protected String buildDuoRegistrationUrlFor(final RequestContext requestContext,
                                                final DuoSecurityMultifactorAuthenticationProvider provider,
                                                final Principal principal) throws Throwable {
        val applicationContext = requestContext.getActiveFlow().getApplicationContext();
        val cipher = CipherExecutorUtils.newStringCipherExecutor(provider.getRegistration().getCrypto(),
            DuoSecurityAuthenticationRegistrationCipherExecutor.class);
        val builder = new URIBuilder(provider.getRegistration().getRegistrationUrl());
        if (cipher.isEnabled()) {
            val jwtBuilder = new JwtBuilder(cipher, applicationContext, servicesManager,
                principalResolver, casProperties, serviceFactory);
            val jwtRequest = JwtBuilder.JwtRequest
                .builder()
                .serviceAudience(Set.of(builder.getHost()))
                .subject(principal.getId())
                .jwtId(UUID.randomUUID().toString())
                .issuer(casProperties.getServer().getName())
                .build();
            val jwt = jwtBuilder.build(jwtRequest);
            builder.addParameter("principal", jwt);
        }
        return builder.toString();
    }
This is {@link DuoSecurityDetermineUserAccountAction}.

@author Misagh Moayyed
@since 5.2.0
support/cas-server-support-duo-core/src/main/java/org/apereo/cas/adaptors/duo/web/flow/action/DuoSecurityDetermineUserAccountAction.java