How to use

org.keycloak.VerificationException

constructor

private AccessToken parseToken(String tokenString) throws VerificationException {
  JWSInput input = new JWSInput(tokenString);
  AccessToken token;
  try {
    token = input.readJsonContent(AccessToken.class);
  } catch (IOException e) {
    throw new VerificationException(e);
  }
  PublicKey publicKey;
  try {
    publicKey = config.getPublicKey(token.getAudience());
  } catch (Exception e) {
    throw new VerificationException("Failed to get public key", e);
  }
  boolean verified = false;
  try {
    verified = RSAProvider.verify(input, publicKey);
  } catch (Exception ignore) {
  }
  if (!verified) throw new VerificationException("Token signature not validated");
  if (token.getSubject() == null) {
    throw new VerificationException("Token user was null");
  }
  if (!token.isActive()) {
    throw new VerificationException("Token is not active.");
  }
  return token;
}

throw new VerificationException("Invalid state");

private void parseAccessToken(AccessTokenResponse tokenResponse) throws VerificationException {
  tokenString = tokenResponse.getToken();
  refreshToken = tokenResponse.getRefreshToken();
  idTokenString = tokenResponse.getIdToken();
  token = RSATokenVerifier.verifyToken(tokenString, deployment.getRealmKey(), deployment.getRealm());
  if (idTokenString != null) {
    JWSInput input = new JWSInput(idTokenString);
    try {
      idToken = input.readJsonContent(IDToken.class);
    } catch (IOException e) {
      throw new VerificationException();
    }
  }
}