@Override
    public boolean canSubjectTokenActAs(final Authentication subject, final Authentication actor, final String actorTokenType) {
        val actorTokenTypeAllowed = allowedActorTokenTypes == null || allowedActorTokenTypes.stream().anyMatch(type -> RegexUtils.find(type, actorTokenType));

        val availableAttributes = new HashMap<>(actor.getAttributes());
        availableAttributes.putAll(actor.getPrincipal().getAttributes());

        val actorTokenAllowed = requiredActorTokenAttributes == null || requiredActorTokenAttributes
            .entrySet()
            .stream()
            .allMatch(entry -> {
                val requiredAttributeValues = entry.getValue();
                val actorAttributeValues = availableAttributes.get(entry.getKey());
                return actorAttributeValues != null && requiredAttributeValues.stream().allMatch(value -> RegexUtils.findFirst(value, actorAttributeValues).isPresent());
            });
        return actorTokenTypeAllowed && actorTokenAllowed;
    }
This is {@link DefaultRegisteredServiceOAuthTokenExchangePolicy}.

@author Misagh Moayyed
@since 7.1.0
support/cas-server-support-oauth-services/src/main/java/org/apereo/cas/support/oauth/services/DefaultRegisteredServiceOAuthTokenExchangePolicy.java