private JwtConsumer newJwtConsumer() {
        // If we don't have a JWK we can't create a consumer to verify anything.
        // Why might we not have one? If the remote authentication service was down when Stroom started
        // then we wouldn't. It might not be up now but we're going to try and fetch it.
        final JsonWebKeySet publicJsonWebKey = openIdPublicKeysSupplier.get();

        final VerificationKeyResolver verificationKeyResolver = new JwksVerificationKeyResolver(
                publicJsonWebKey.getJsonWebKeys());
        final OpenIdConfiguration openIdConfiguration = openIdConfigurationProvider.get();

        final boolean useTestCreds = NullSafe.test(
                openIdConfiguration,
                OpenIdConfiguration::getIdentityProviderType,
                IdpType.TEST_CREDENTIALS::equals);

        final String[] validIssuers = useTestCreds
                ? new String[]{defaultOpenIdCredentials.getOauth2Issuer()}
                : getValidIssuers();

        LOGGER.debug("Expecting issuers: {}", (Object) validIssuers);

        final JwtConsumerBuilder builder = new JwtConsumerBuilder()
                .setAllowedClockSkewInSeconds(30) // allow some leeway in validating time based claims to account
                //                                   for clock skew
                .setRequireSubject() // the JWT must have a subject claim
                .setVerificationKeyResolver(verificationKeyResolver)
                .setRelaxVerificationKeyValidation() // relaxes key length requirement
//                .setJwsAlgorithmConstraints(// only allow the expected signature algorithm(s) in the given context
//                        new AlgorithmConstraints(
//                                AlgorithmConstraints.ConstraintType.WHITELIST, // which is only RS256 here
//                                AlgorithmIdentifiers.RSA_USING_SHA256))
                .setExpectedIssuers(true, validIssuers);

        if (openIdConfiguration.isValidateAudience()) {
            // aud does not appear in access tokens by default it seems so make the check optional
            final String clientId = useTestCreds
                    ? defaultOpenIdCredentials.getOauth2ClientId()
                    : openIdConfiguration.getClientId();
            builder.setExpectedAudience(clientId);
        } else {
            builder.setSkipDefaultAudienceValidation();
        }
        return builder.build();
    }
Verify the JSON Web Signature and then extract the user identity from it
stroom-security/stroom-security-common-impl/src/main/java/stroom/security/common/impl/StandardJwtContextFactory.java