public AccessTokenResponse createAccesToken(AccessTokenRequest request) throws NoSuchAlgorithmException, DienstencatalogusException {
        var openIdSession = openIdRepository.findByCode(request.getCode()).orElseThrow(()
                -> new OpenIdSessionNotFoundException("OpenIdSession not found"));

        var metadata = dcClient.retrieveMetadataFromDc(request.getClientId());

        validateCodeChallenge(request.getCodeVerifier(), openIdSession);
        validateMimumAuthenticationLevel(openIdSession, metadata);

        AccessTokenResponse response = new AccessTokenResponse();
        response.setTokenType("Bearer");
        response.setAccessToken(getAccessToken(openIdSession));
        response.setIdToken(getIdToken(openIdSession));
        response.setState(openIdSession.getState());

        var logCode = Map.of("20", "743", "25", "1124").get(openIdSession.getAuthenticationLevel());
        adClient.remoteLog(logCode, Map.of("account_id", openIdSession.getAccountId(), "webservice_id", openIdSession.getLegacyWebserviceId(), "webservice_name", openIdSession.getServiceName()));

        openIdRepository.delete(openIdSession);

        return response;
    }
@Test
    void createAccesTokenWithInvalidChallengeTest() throws InvalidSignatureException, DienstencatalogusException, IOException, ParseException, JOSEException {
        mockDcMetadataResponse();

        AccessTokenRequest accessTokenRequest = new AccessTokenRequest();
        accessTokenRequest.setCode("testCode");
        accessTokenRequest.setCodeVerifier("SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS");
        accessTokenRequest.setClientId(client.CLIENT_ID);
        OpenIdSession openIdSession = new OpenIdSession();
        openIdSession.setAuthenticationLevel("20");
        openIdSession.setCodeChallenge("SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS");

        when(openIdRepository.findByCode(accessTokenRequest.getCode())).thenReturn(Optional.of(openIdSession));

        assertThrows(ValidationException.class, () -> openIdService.createAccesToken(accessTokenRequest));
    }