boolean validateSignature(SignedJWT jwtToken) {
    boolean valid = false;
    if (JWSObject.State.SIGNED == jwtToken.getState()) {
      LOG.debug("JWT token is in a SIGNED state");
      if (jwtToken.getSignature() != null) {
        LOG.debug("JWT token signature is not null");

        JwtAuthenticationProperties jwtProperties = propertiesProvider.get();
        RSAPublicKey publicKey = (jwtProperties == null) ? null : jwtProperties.getPublicKey();
        if (publicKey == null) {
          LOG.warn("SSO server public key has not be set, validation of the JWT token cannot be performed.");
        } else {
          try {
            JWSVerifier verifier = new RSASSAVerifier(publicKey);
            if (jwtToken.verify(verifier)) {
              valid = true;
              LOG.debug("JWT token has been successfully verified");
            } else {
              LOG.warn("JWT signature verification failed.");
            }
          } catch (JOSEException je) {
            LOG.warn("Error while validating signature", je);
          }
        }
      }
    }
    return valid;
  }
Verify the signature of the JWT token in this method. This method depends
on the public key that was established during init based upon the
provisioned public key. Override this method in subclasses in order to
customize the signature verification behavior.

@param jwtToken the token that contains the signature to be validated
@return valid true if signature verifies successfully; false otherwise
ambari-server/src/main/java/org/apache/ambari/server/security/authentication/jwt/AmbariJwtAuthenticationFilter.java