private PublicKey getAwsPublicKey(final JwsParts jwsParts) {
        final String uri = getAwsPublicKeyUri(jwsParts, openIdConfigurationProvider.get().getExpectedSignerPrefixes());

        // Lazy initialise the cache and its timer in case we never deal with aws keys
        if (awsPublicKeyCache == null) {
            synchronized (this) {
                if (awsPublicKeyCache == null) {
                    awsPublicKeyCache = createAwsPublicKeyCache();
                }
            }
        }

        return awsPublicKeyCache.get(uri);
    }
Verify the JSON Web Signature and then extract the user identity from it
stroom-security/stroom-security-common-impl/src/main/java/stroom/security/common/impl/StandardJwtContextFactory.java