@Override
    protected Authentication finalizeAuthentication(final AccessTokenRequestContext tokenRequestContext,
                                                    final AuthenticationBuilder authenticationBuilder) {
        if (tokenRequestContext.getGrantType() == OAuth20GrantTypes.CIBA) {
            FunctionUtils.doIfNotNull(tokenRequestContext.getCibaRequestId(),
                __ -> authenticationBuilder.addAttribute(OidcConstants.AUTH_REQ_ID, tokenRequestContext.getCibaRequestId()));
        }

        return super.finalizeAuthentication(tokenRequestContext, authenticationBuilder);
    }
This is {@link OidcDefaultTokenGenerator}.

@author Misagh Moayyed
@since 7.1.0
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/OidcDefaultTokenGenerator.java