@Override
    protected String encryptToken(final OAuthRegisteredService service, final String innerJwt) {
        if (service instanceof final OidcRegisteredService registeredService) {
            val jsonWebKey = getJsonWebKeyForEncryption(registeredService);
            if (jsonWebKey == null && registeredService.isIdTokenEncryptionOptional()) {
                return innerJwt;
            }

            return JsonWebTokenEncryptor.builder()
                .key(jsonWebKey.getPublicKey())
                .keyId(jsonWebKey.getKeyId())
                .algorithm(registeredService.getIdTokenEncryptionAlg())
                .encryptionMethod(registeredService.getIdTokenEncryptionEncoding())
                .allowedAlgorithms(discoverySettings.getIdTokenEncryptionAlgValuesSupported())
                .allowedContentEncryptionAlgorithms(discoverySettings.getIdTokenEncryptionEncodingValuesSupported())
                .headers(Map.of(OAuth20Constants.CLIENT_ID, registeredService.getClientId()))
                .build()
                .encrypt(innerJwt);
        }
        return innerJwt;
    }
This is {@link OidcIdTokenSigningAndEncryptionService}.

@author Misagh Moayyed
@since 5.1.0
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/OidcIdTokenSigningAndEncryptionService.java