ZenDesk JWT integration

[FritzTheWonderMutt]

Greetings!
I'm trying to integrate our CAS 5.1 instance with Zendesk's JWT login flow. I have solved this in previous CAS versions using an ArgumentExtractor and an extension of AbstractWebApplicationService.
Two main issues are incoming parametes need to be mapped to expected ones (ie: return_to --> service) and the JWT needs additional properties not found in TokenWebApplicationServiceResponseBuilder.

ZenDesk doc:
https://support.zendesk.com/hc/en-us/articles/203663816-Setting-up-single-sign-on-with-JWT-JSON-Web-Token-

Questions:
1) Where do argument extractors live now and where would I add one?
2) What is the best way to extend the JWT TokenWebApplicationService (if that's even the right starting point)?

[FritzTheWonderMutt]

Also, it looks like org.apereo.cas.util.EncodingUtils only allows HS512, (line232). ZenDesk uses HS256. One more thing to override...