@Audit(action = AuditableActions.OIDC_ID_TOKEN,
        actionResolverName = AuditActionResolvers.OIDC_ID_TOKEN_ACTION_RESOLVER,
        resourceResolverName = AuditResourceResolvers.OIDC_ID_TOKEN_RESOURCE_RESOLVER)
    @Override
    public OidcIdToken generate(final IdTokenGenerationContext context) throws Throwable {
        Assert.isAssignable(OidcRegisteredService.class, context.getRegisteredService().getClass(),
            "Registered service instance is not registered as an OpenID Connect application");
        if (!context.getAccessToken().getScopes().contains(OidcConstants.StandardScopes.OPENID.getScope())) {
            LOGGER.warn("Authentication request does not include the [{}] scope. "
                    + "Including this scope is a MUST for OpenID Connect and CAS will not produce an ID token without this scope.",
                OidcConstants.StandardScopes.OPENID.getScope());
            return null;
        }
        val claims = buildJwtClaims(context);

        var deviceSecret = StringUtils.EMPTY;
        if (context.getGrantType() == OAuth20GrantTypes.AUTHORIZATION_CODE
            && context.getAccessToken().getScopes().contains(OidcConstants.StandardScopes.DEVICE_SSO.getScope())
            && getConfigurationContext().getDiscoverySettings().isNativeSsoSupported()) {
            deviceSecret = getConfigurationContext().getDeviceSecretGenerator().generate();
            claims.setStringClaim(OidcConstants.DS_HASH, getConfigurationContext().getDeviceSecretGenerator().hash(deviceSecret));
            if (context.getAccessToken().getTicketGrantingTicket() != null) {
                val encoded = (byte[]) getConfigurationContext().getTicketRegistry().getCipherExecutor()
                    .encode(context.getAccessToken().getTicketGrantingTicket().getId().getBytes(StandardCharsets.UTF_8));
                val sessionId = EncodingUtils.encodeUrlSafeBase64(encoded);
                claims.setStringClaim(OidcConstants.CLAIM_SESSION_REF, sessionId);
            }
        }

        val finalIdToken = encodeAndFinalizeToken(claims, context);
        return new OidcIdToken(finalIdToken, claims, deviceSecret);
    }
This is {@link OidcIdTokenGeneratorService}.

@author Misagh Moayyed
@since 5.0.0
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/OidcIdTokenGeneratorService.java