@Override
    public Optional<JwtContext> getJwtContext(final String jwt) {
        Optional<JwtContext> optionalJwtContext = Optional.empty();

        Objects.requireNonNull(jwt, "Null JWS");
        LOGGER.trace(() -> "Found auth header in request. It looks like this: " + jwt);

        try {
            final JwtConsumer jwtConsumer = newJwtConsumer();
            final JwtContext jwtContext = jwtConsumer.process(jwt);

            if (LOGGER.isDebugEnabled()) {
                final String uniqueIdentityClaim = openIdConfigurationProvider.get().getUniqueIdentityClaim();
                final String userDisplayNameClaim = openIdConfigurationProvider.get().getUserDisplayNameClaim();
                final String uniqueId = NullSafe.isBlankString(uniqueIdentityClaim)
                        ? "<ERROR uniqueIdentityClaim not configured>"
                        : JwtUtil.getClaimValue(jwtContext, uniqueIdentityClaim).orElse(null);
                final String displayName = NullSafe.isBlankString(userDisplayNameClaim)
                        ? "<ERROR userDisplayNameClaim not configured>"
                        : JwtUtil.getClaimValue(jwtContext, userDisplayNameClaim).orElse(null);

                LOGGER.debug(() -> LogUtil.message("Verified token - {}: '{}', {}: '{}'",
                        uniqueIdentityClaim, uniqueId, userDisplayNameClaim, displayName));
            }

            optionalJwtContext = Optional.ofNullable(jwtContext);

        } catch (final RuntimeException | InvalidJwtException e) {
            // You will likely come in here when trying to decode an external IDP jws using the internal IDP
            // first.
            LOGGER.debug(() -> "Unable to verify token: " + e.getMessage(), e);
        }

        return optionalJwtContext;
    }
Verify the JSON Web Signature and then extract the user identity from it
stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/InternalJwtContextFactory.java