private JwtConsumer newJwtConsumer() {
        // If we don't have a JWK we can't create a consumer to verify anything.
        // Why might we not have one? If the remote authentication service was down when Stroom started
        // then we wouldn't. It might not be up now but we're going to try and fetch it.
        final List<PublicJsonWebKey> publicJsonWebKeys = publicJsonWebKeyProvider.list();
        final JsonWebKeySet publicJsonWebKey = new JsonWebKeySet(publicJsonWebKeys);

        final VerificationKeyResolver verificationKeyResolver = new JwksVerificationKeyResolver(
                publicJsonWebKey.getJsonWebKeys());

        final OpenIdConfiguration openIdConfiguration = openIdConfigurationProvider.get();
        final String[] validIssuers = getValidIssuers();

        final JwtConsumerBuilder builder = new JwtConsumerBuilder()
                .setAllowedClockSkewInSeconds(30) // allow some leeway in validating time based claims
                // to account for clock skew
                .setRequireSubject() // the JWT must have a subject claim
                .setVerificationKeyResolver(verificationKeyResolver)
                .setRelaxVerificationKeyValidation() // relaxes key length requirement
                .setJwsAlgorithmConstraints(// only allow the expected signature algorithm(s) in the given context
                        new AlgorithmConstraints(
                                AlgorithmConstraints.ConstraintType.WHITELIST, // which is only RS256 here
                                AlgorithmIdentifiers.RSA_USING_SHA256))
//                .setExpectedIssuer(InternalIdpConfigurationProvider.INTERNAL_ISSUER);
                .setExpectedIssuers(true, validIssuers);

        if (openIdConfiguration.isValidateAudience()) {
            // aud does not appear in access tokens by default it seems
            builder.setExpectedAudience(openIdClientDetailsFactory.getClient().getClientId());
        } else {
            builder.setSkipDefaultAudienceValidation();
        }
        return builder.build();
    }
Verify the JSON Web Signature and then extract the user identity from it
stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/InternalJwtContextFactory.java