static String getAwsPublicKeyUri(final JwsParts jwsParts,
                                     final Set<String> expectedSignerPrefixes) {

        final Map<String, String> headerValues = jwsParts.getHeaderValues(
                SIGNER_HEADER_KEY,
                OpenId.KEY_ID);

        final String signer = Optional.ofNullable(headerValues.get(SIGNER_HEADER_KEY))
                .orElseThrow(() -> new RuntimeException(LogUtil.message("Missing '{}' key in jws header {}",
                        SIGNER_HEADER_KEY, jwsParts.header)));

        // 'arn:aws:elasticloadbalancing:region-code:account-id:loadbalancer/app/load-balancer-name/load-balancer-id'
        // The LB ID is not known at provisioning time so validate signer against a set of valid prefixes
        // which should go at least up to the account ID.
        final boolean isExpectedSigner = NullSafe.stream(expectedSignerPrefixes)
                .anyMatch(expectedSignerPrefix -> {
                    if (expectedSignerPrefix == null || signer == null) {
                        return false;
                    } else {
                        return signer.startsWith(expectedSignerPrefix);
                    }
                });

        // Make sure the signer value is one we expect
        if (!isExpectedSigner) {
            throw new RuntimeException(LogUtil.message(
                    "The value for key '{}' in the JWS header '{}' does not match any of the values in the '{}' " +
                    "configuration property: [{}]. You need to set '{}' to the partial ARN(s) of the " +
                    "AWS load balancer that is handling authentication for Stroom. The partial " +
                    "ARN needs to include at least up to the account ID part.",
                    SIGNER_HEADER_KEY,
                    signer,
                    AbstractOpenIdConfig.PROP_NAME_EXPECTED_SIGNER_PREFIXES,
                    String.join(", ", NullSafe.set(expectedSignerPrefixes)),
                    AbstractOpenIdConfig.PROP_NAME_EXPECTED_SIGNER_PREFIXES));
        }

        final String keyId = Optional.ofNullable(headerValues.get(OpenId.KEY_ID))
                .orElseThrow(() -> new RuntimeException(LogUtil.message("Missing '{}' key in jws header {}",
                        OpenId.KEY_ID, jwsParts.header)));

        final String awsRegion = extractAwsRegionFromSigner(signer);

        // TODO: 24/02/2023 Ought to come from config
        return LogUtil.message("https://public-keys.auth.elb.{}.amazonaws.com/{}",
                awsRegion, keyId);
    }
Verify the JSON Web Signature and then extract the user identity from it
stroom-security/stroom-security-common-impl/src/main/java/stroom/security/common/impl/StandardJwtContextFactory.java