@Override
    protected String encryptToken(final OAuthRegisteredService service,
                                  final String innerJwt) {
        if (service instanceof final OidcRegisteredService svc) {
            val jsonWebKey = getJsonWebKeyForEncryption(svc);
            return JsonWebTokenEncryptor.builder()
                .key(jsonWebKey.getPublicKey())
                .keyId(jsonWebKey.getKeyId())
                .algorithm(svc.getIdTokenEncryptionAlg())
                .encryptionMethod(svc.getIdTokenEncryptionEncoding())
                .allowedAlgorithms(discoverySettings.getUserInfoEncryptionAlgValuesSupported())
                .allowedContentEncryptionAlgorithms(discoverySettings.getUserInfoEncryptionEncodingValuesSupported())
                .headers(Map.of(OAuth20Constants.CLIENT_ID, svc.getClientId()))
                .build()
                .encrypt(innerJwt);
        }
        return innerJwt;
    }
Default encoding for user-info encrypted responses.
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcUserProfileSigningAndEncryptionService.java