public JwtClaims validateToken(String token) throws GuacamoleException {
        // Validating the token requires a JWKS key resolver
        HttpsJwks jwks = new HttpsJwks(confService.getJWKSEndpoint().toString());
        HttpsJwksVerificationKeyResolver resolver = new HttpsJwksVerificationKeyResolver(jwks);

        // Create JWT consumer for validating received token
        JwtConsumer jwtConsumer = new JwtConsumerBuilder()
                .setRequireExpirationTime()
                .setMaxFutureValidityInMinutes(confService.getMaxTokenValidity())
                .setAllowedClockSkewInSeconds(confService.getAllowedClockSkew())
                .setRequireSubject()
                .setExpectedIssuer(confService.getIssuer())
                .setExpectedAudience(confService.getClientID())
                .setVerificationKeyResolver(resolver)
                .build();

        try {
            // Validate JWT
            JwtClaims claims = jwtConsumer.processToClaims(token);

            // Verify a nonce is present
            String nonce = claims.getStringClaimValue("nonce");
            if (nonce != null) {
                // Verify that we actually generated the nonce, and that it has not
                // already been used
                if (nonceService.isValid(nonce)) {
                    // nonce is valid, consider claims valid
                    return claims;
                }
                else {
                    logger.info("Rejected OpenID token with invalid/old nonce.");
                }
            }
            else {
                logger.info("Rejected OpenID token without nonce.");
            }
        }
        // Log any failures to validate/parse the JWT
        catch (MalformedClaimException e) {
            logger.info("Rejected OpenID token with malformed claim: {}", e.getMessage());
            logger.debug("Malformed claim within received JWT.", e);
        }
        catch (InvalidJwtException e) {
            logger.info("Rejected invalid OpenID token: {}", e.getMessage());
            logger.debug("Invalid JWT received.", e);
        }

        return null;
    }
Validates the given ID token, returning the JwtClaims contained therein.
If the ID token is invalid, null is returned.

@param token
    The ID token to validate.

@return
    The JWT claims contained within the given ID token if it passes tests,
    or null if the token is not valid.

@throws GuacamoleException
    If guacamole.properties could not be parsed.
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/src/main/java/org/apache/guacamole/auth/openid/token/TokenValidationService.java