@Override
    public JwtClaims decode(final String token, final Optional<OAuthRegisteredService> registeredService) {
        return FunctionUtils.doUnchecked(() -> {
            val jsonWebKey = getJsonWebKeySigningKey(registeredService);
            FunctionUtils.throwIf(jsonWebKey.getPublicKey() == null,
                () -> new IllegalArgumentException("JSON web key to validate the ID token signature has no public key"));
            val jwt = Objects.requireNonNull(verifySignature(token, jsonWebKey),
                "Unable to verify signature of the token using the JSON web key public key");
            val result = new String(jwt, StandardCharsets.UTF_8);
            val claims = JwtBuilder.parse(result);

            FunctionUtils.throwIf(StringUtils.isBlank(claims.getIssuer()),
                () -> new IllegalArgumentException("Claims do not contain an issuer"));

            validateIssuerClaim(claims, registeredService);

            FunctionUtils.throwIf(StringUtils.isBlank(claims.getStringClaim(OAuth20Constants.CLIENT_ID)),
                () -> new IllegalArgumentException("Claims do not contain a client id claim"));
            return JwtClaims.parse(claims.toString());
        });
    }
This is {@link BaseTokenSigningAndEncryptionService}.

@author Misagh Moayyed
@since 6.0.0
support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/ticket/BaseTokenSigningAndEncryptionService.java