@GetMapping(value = {
        '/' + OidcConstants.BASE_OIDC_URL + '/' + OidcConstants.REGISTRATION_INITIAL_TOKEN_URL,
        "/**/" + OidcConstants.REGISTRATION_INITIAL_TOKEN_URL
    }, produces = MediaType.APPLICATION_JSON_VALUE)
    @Operation(summary = "Handle OIDC initial access token request")
    public ModelAndView handleRequestInternal(
        final HttpServletRequest request, final HttpServletResponse response) {
        val webContext = new JEEContext(request, response);
        if (!getConfigurationContext().getIssuerService().validateIssuer(webContext, List.of(OidcConstants.REGISTRATION_INITIAL_TOKEN_URL))) {
            val body = OAuth20Utils.getErrorResponseBody(OAuth20Constants.INVALID_REQUEST, "Invalid issuer");
            val modelAndView = new ModelAndView(new MappingJackson2JsonView(), body);
            modelAndView.setStatus(HttpStatus.BAD_REQUEST);
            return modelAndView;
        }
        val casProperties = getConfigurationContext().getCasProperties();
        val oidcProperties = casProperties.getAuthn().getOidc();

        if (!oidcProperties.getRegistration().getDynamicClientRegistrationMode().isProtected()) {
            LOGGER.warn("Dynamic client registration mode is not configured as protected.");
            return getBadRequestResponseEntity(HttpStatus.NOT_ACCEPTABLE);
        }
        val callContext = new CallContext(webContext, getConfigurationContext().getSessionStore(),
            getConfigurationContext().getOauthConfig().getProfileManagerFactory());
        return accessTokenClient.getCredentials(callContext)
            .map(credentials -> accessTokenClient.validateCredentials(callContext, credentials))
            .filter(Optional::isPresent)
            .map(Optional::get)
            .map(credentials -> {
                val principal = FunctionUtils.doUnchecked(() -> PrincipalFactoryUtils.newPrincipalFactory().createPrincipal(credentials.getUserProfile().getId()));
                val service = getConfigurationContext().getWebApplicationServiceServiceFactory()
                    .createService(casProperties.getServer().getPrefix());

                val tokenRequestContext = AccessTokenRequestContext
                    .builder()
                    .authentication(DefaultAuthenticationBuilder.newInstance().setPrincipal(principal).build())
                    .service(service)
                    .grantType(OAuth20GrantTypes.NONE)
                    .responseType(OAuth20ResponseTypes.NONE)
                    .scopes(Set.of(OidcConstants.StandardScopes.OPENID.getScope(), OidcConstants.CLIENT_REGISTRATION_SCOPE))
                    .build();

                return generateInitialAccessToken(tokenRequestContext)
                    .map(this::resolveAccessToken)
                    .map(accessToken -> {
                        val accessTokenResult = OAuth20TokenGeneratedResult
                            .builder()
                            .registeredService(tokenRequestContext.getRegisteredService())
                            .accessToken(accessToken)
                            .grantType(tokenRequestContext.getGrantType())
                            .responseType(tokenRequestContext.getResponseType())
                            .build();

                        val tokenResult = OAuth20AccessTokenResponseResult.builder()
                            .registeredService(tokenRequestContext.getRegisteredService())
                            .service(tokenRequestContext.getService())
                            .accessTokenTimeout(accessToken.getExpiresIn())
                            .responseType(accessToken.getResponseType())
                            .casProperties(getConfigurationContext().getCasProperties())
                            .generatedToken(accessTokenResult)
                            .grantType(accessToken.getGrantType())
                            .userProfile(credentials.getUserProfile())
                            .build();

                        return getConfigurationContext().getAccessTokenResponseGenerator().generate(tokenResult);
                    })
                    .orElseGet(() -> getBadRequestResponseEntity(HttpStatus.BAD_REQUEST));
            })
            .orElseGet(() -> getBadRequestResponseEntity(HttpStatus.UNAUTHORIZED));
    }
Handle request..

@param request  the request
@param response the response
@return the model and view
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/controllers/dynareg/OidcInitialAccessTokenController.java