private OAuth20AccessToken exchangeTokenForAccessToken(final Service service, final OAuth20AccessToken accessToken,
                                                           final AccessTokenRequestContext tokenRequestContext) throws Throwable {
        val scopes = new HashSet<>(tokenRequestContext.getScopes());
        scopes.retainAll(tokenRequestContext.getRegisteredService().getScopes());

        val credential = new BasicIdentifiableCredential(accessToken.getAuthentication().getPrincipal().getId());
        var resolvedPrincipal = principalResolver.resolve(credential);
        if (resolvedPrincipal instanceof NullPrincipal) {
            resolvedPrincipal = accessToken.getAuthentication().getPrincipal();
        }
        val exchangedPrincipal = profileScopeToAttributesFilter.filter(service, resolvedPrincipal,
            tokenRequestContext.getRegisteredService(), scopes, accessToken);

        val exchangedAuthentication = DefaultAuthenticationBuilder.newInstance(exchangedPrincipal)
            .addAttribute(OAuth20Constants.GRANT_TYPE, accessToken.getGrantType().getType());
        if (tokenRequestContext.getActorToken() != null) {
            exchangedAuthentication.addAttribute(OAuth20Constants.CLAIM_ACT,
                CollectionUtils.wrap(OAuth20Constants.CLAIM_SUB, tokenRequestContext.getActorToken().getPrincipal().getId()));
        }
        val accessTokenFactory = (OAuth20AccessTokenFactory) ticketFactory.get(OAuth20AccessToken.class);
        val ticketGrantingTicket = tokenRequestContext.getTicketGrantingTicket() == null || tokenRequestContext.getTicketGrantingTicket().isExpired()
            ? null : tokenRequestContext.getTicketGrantingTicket();
        return accessTokenFactory.create(
            service,
            exchangedAuthentication.build(),
            ticketGrantingTicket,
            scopes,
            accessToken.getId(),
            accessToken.getClientId(),
            accessToken.getClaims(),
            accessToken.getResponseType(),
            accessToken.getGrantType());
    }
This is {@link OAuth20DefaultTokenGenerator}.

@author Misagh Moayyed
@since 5.2.0
support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/web/response/accesstoken/OAuth20DefaultTokenGenerator.java