@Override
    protected TokenExchangeRequest extractSubjectTokenExchangeRequest(final WebContext webContext) throws Throwable {
        val configurationContext = getConfigurationContext().getObject();
        val requestParameterResolver = configurationContext.getRequestParameterResolver();
        val subjectTokenType = requestParameterResolver.resolveRequestParameter(webContext, OAuth20Constants.SUBJECT_TOKEN_TYPE)
            .map(OAuth20TokenExchangeTypes::from)
            .orElseThrow();
        val subjectToken = requestParameterResolver.resolveRequestParameter(webContext, OAuth20Constants.SUBJECT_TOKEN)
            .orElseThrow(() -> new IllegalArgumentException("Subject token cannot be undefined"));

        if (subjectTokenType == OAuth20TokenExchangeTypes.ID_TOKEN) {
            val userProfile = extractUserProfile(webContext).orElseThrow();
            val requestingClientId = userProfile.getId();
            
            val clientIdInIdToken = OAuth20Utils.extractClientIdFromToken(subjectToken);
            val registeredService = OAuth20Utils.getRegisteredOAuthServiceByClientId(configurationContext.getServicesManager(), clientIdInIdToken);
            val claimSet = configurationContext.getIdTokenSigningAndEncryptionService().decode(subjectToken, Optional.ofNullable(registeredService));
            val service = configurationContext.getWebApplicationServiceServiceFactory().createService(claimSet.getIssuer());
            service.getAttributes().put(OAuth20Constants.CLIENT_ID, List.of(requestingClientId));
            
            userProfile.setId(claimSet.getSubject());
            claimSet.getClaimsMap().forEach(userProfile::addAttribute);
            val authentication = configurationContext.getAuthenticationBuilder().build(userProfile, registeredService, webContext, service);
            val accessTokenFactory = (OAuth20AccessTokenFactory) configurationContext.getTicketFactory().get(OAuth20AccessToken.class);
            val scopes = configurationContext.getRequestParameterResolver().resolveRequestedScopes(webContext);
            val accessToken = accessTokenFactory.create(service, authentication, scopes, requestingClientId,
                OAuth20ResponseTypes.NONE, OAuth20GrantTypes.TOKEN_EXCHANGE);
            val requestedRegisteredService = OAuth20Utils.getRegisteredOAuthServiceByClientId(
                configurationContext.getServicesManager(), requestingClientId);
            return new TokenExchangeRequest(accessToken, service, requestedRegisteredService, authentication);

        }
        return super.extractSubjectTokenExchangeRequest(webContext);
    }
This is {@link OidcAccessTokenTokenExchangeGrantRequestExtractor}.

@author Misagh Moayyed
@since 7.3.0
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/OidcAccessTokenTokenExchangeGrantRequestExtractor.java