protected void buildAuthenticationContextClassRef(final JwtClaims claims,
                                                      final Authentication authentication) {
        val mfa = getConfigurationContext().getCasProperties().getAuthn().getMfa();
        val oidc = getConfigurationContext().getCasProperties().getAuthn().getOidc();

        val attributes = authentication.getAttributes();
        val mappedAcrValues = org.springframework.util.StringUtils.commaDelimitedListToSet(mfa.getCore().getAuthenticationContextAttribute())
            .stream()
            .filter(attributes::containsKey)
            .map(attribute -> {
                val acrValues = CollectionUtils.toCollection(attributes.get(attribute));
                val authnContexts = oidc.getCore().getAuthenticationContextReferenceMappings();
                val mappings = CollectionUtils.convertDirectedListToMap(authnContexts);
                val acrMapped = acrValues
                    .stream()
                    .map(acrValue ->
                        mappings.entrySet()
                            .stream()
                            .filter(entry -> entry.getValue().equalsIgnoreCase(acrValue.toString()))
                            .map(Map.Entry::getKey)
                            .findFirst()
                            .orElseGet(acrValue::toString))
                    .collect(Collectors.joining(" "));
                LOGGER.debug("ID token acr claim calculated as [{}]", acrMapped);
                return acrMapped;
            })
            .filter(Objects::nonNull)
            .toList();

        if (!mappedAcrValues.isEmpty()) {
            FunctionUtils.doIf(mappedAcrValues.size() == 1,
                    __ -> claims.setStringClaim(OidcConstants.ACR, mappedAcrValues.getFirst()),
                    __ -> claims.setStringListClaim(OidcConstants.ACR, mappedAcrValues))
                .accept(mappedAcrValues);
        }
    }
This is {@link OidcIdTokenGeneratorService}.

@author Misagh Moayyed
@since 5.0.0
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/OidcIdTokenGeneratorService.java