private PublicKey fetchAwsPublicKey(final String uri) {

        LOGGER.debug(() -> LogUtil.message("Fetching AWS public key from uri: {}, current cache size: {}",
                uri, awsPublicKeyCache.estimatedSize()));
        final Client client = jerseyClientFactory.getNamedClient(JerseyClientName.AWS_PUBLIC_KEYS);
        // Don't use injected WebTargetFactory as that slaps a token on which we don't want in
        // this case as it is an unauthenticated endpoint
        final WebTarget target = client.target(uri);
        final Response res = target
                .request()
                .get();
        final int status = res.getStatus();
        if (status == HttpStatus.OK_200) {
            final String pubKey = res.readEntity(String.class);
            LOGGER.debug("Received public key '{}'", pubKey);

            // The public key is PEM format.
            return decodePublicKey(pubKey, "EC");
        } else {
            throw new AuthenticationException(LogUtil.message(
                    "Unable to retrieve public key from uri: '{}', status: {}, response: '{}'",
                    uri,
                    status,
                    LogUtil.swallowExceptions(() -> res.readEntity(String.class))));
        }
    }
Verify the JSON Web Signature and then extract the user identity from it
stroom-security/stroom-security-common-impl/src/main/java/stroom/security/common/impl/StandardJwtContextFactory.java