private static String extractAwsRegionFromSigner(final String signer) {
        if (NullSafe.isBlankString(signer)) {
            return null;
        } else {
            // Signer is an Amazon Resource Name of the form:
            // arn:partition:service:region:account-id:resource-id
            // No need to pre-compile the regex as split will not use regex for single chars
            final String[] signerParts = signer.split(AMZN_OIDC_SIGNER_SPLIT_CHAR);
            if (signerParts.length < 4) {
                throw new RuntimeException(LogUtil.message("Unable to parse value for '{}' key in JWS header {}",
                        SIGNER_HEADER_KEY, signer));
            }
            final String awsRegion = signerParts[3];

            if (!AMZN_REGION_PATTERN.matcher(awsRegion).matches()) {
                throw new RuntimeException(LogUtil.message(
                        "AWS region '{}' extracted from '{}' in property '{}' does not match " +
                        "pattern '{}'",
                        awsRegion,
                        signer,
                        AbstractOpenIdConfig.PROP_NAME_EXPECTED_SIGNER_PREFIXES,
                        AMZN_REGION_PATTERN.toString()));
            }

            return awsRegion;
        }
    }
Verify the JSON Web Signature and then extract the user identity from it
stroom-security/stroom-security-common-impl/src/main/java/stroom/security/common/impl/StandardJwtContextFactory.java