@Override
    protected void validateAccessToken(final String accessTokenId, final OAuth20AccessToken accessToken,
                                       final HttpServletRequest request, final HttpServletResponse response) {
        val dPopProof = request.getHeader(OAuth20Constants.DPOP);
        if (accessToken.getAuthentication().containsAttribute(OAuth20Constants.DPOP_CONFIRMATION)) {
            val cnf = CollectionUtils.firstElement(accessToken.getAuthentication().getAttributes().get(OAuth20Constants.DPOP_CONFIRMATION));
            cnf.ifPresent(Unchecked.consumer(conf -> {
                val confirmation = new JWKThumbprintConfirmation(new Base64URL(conf.toString()));
                val acceptedAlgs = getConfigurationContext().getDiscoverySettings().getDPopSigningAlgValuesSupported()
                    .stream()
                    .map(JWSAlgorithm::parse)
                    .collect(Collectors.toSet());

                val seconds = Beans.newDuration(getConfigurationContext().getCasProperties().getAuthn().getOidc().getCore().getSkew()).toSeconds();
                val verifier = new DPoPProtectedResourceRequestVerifier(acceptedAlgs, seconds, null);
                val signedProof = SignedJWT.parse(dPopProof);
                val dPoPIssuer = new DPoPIssuer(new ClientID(accessToken.getClientId()));
                Assert.notNull(JWTParser.parse(accessTokenId), "Provided access token id must be a (signed) JWT");
                val dpopAccessToken = new DPoPAccessToken(accessTokenId);
                verifier.verify(request.getMethod(), new URI(request.getRequestURL().toString()),
                    dPoPIssuer, signedProof, dpopAccessToken, confirmation, null);
            }));
        }
    }
/" + OidcConstants.PROFILE_URL
    }, produces = {MediaType.APPLICATION_JSON_VALUE, OidcConstants.CONTENT_TYPE_JWT})
    @Operation(summary = "Handle user profile request",
        parameters = @Parameter(name = "access_token", in = ParameterIn.QUERY, required = true, description = "Access token"))
    @Override
    public ResponseEntity handleGetRequest(final HttpServletRequest request,
                                           final HttpServletResponse response) throws Exception {
        val webContext = new JEEContext(request, response);
        if (!getConfigurationContext().getIssuerService().validateIssuer(webContext, List.of(OidcConstants.PROFILE_URL, OAuth20Constants.PROFILE_URL))) {
            val body = OAuth20Utils.getErrorResponseBody(OAuth20Constants.INVALID_REQUEST, "Invalid issuer");
            return new ResponseEntity<>(body, HttpStatus.BAD_REQUEST);
        }
        return super.handleGetRequest(request, response);
    }

    @PostMapping(value = {
        '/' + OidcConstants.BASE_OIDC_URL + '/' + OAuth20Constants.PROFILE_URL,
        "/*
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/controllers/profile/OidcUserProfileEndpointController.java