@Override
    public boolean isTokenExchangeAllowed(final RegisteredService registeredService, final Set<String> resources,
                                          final Set<String> audience, final String requestedType) {
        val resourceAllowed = allowedResources == null || allowedResources.stream().anyMatch(resource -> RegexUtils.findFirst(resource, resources).isPresent());
        val audienceAllowed = allowedAudience == null || allowedAudience.stream().anyMatch(aud -> RegexUtils.findFirst(aud, audience).isPresent());
        val tokenTypeAllowed = allowedTokenTypes == null || allowedTokenTypes.stream().anyMatch(type -> RegexUtils.find(type, requestedType));
        val allowedExchange = resourceAllowed && audienceAllowed && tokenTypeAllowed;
        if (!allowedExchange) {
            LOGGER.warn("Token exchange is not allowed for service [{}] for resource [{}], audience [{}] or requested token type[{}]",
                registeredService.getName(), resources, audience, requestedType);
        }
        return allowedExchange;
    }
This is {@link DefaultRegisteredServiceOAuthTokenExchangePolicy}.

@author Misagh Moayyed
@since 7.1.0
support/cas-server-support-oauth-services/src/main/java/org/apereo/cas/support/oauth/services/DefaultRegisteredServiceOAuthTokenExchangePolicy.java