public class OIDCTokenVerifier {


	private static final Logger LOG = LoggerFactory.getLogger(OIDCTokenVerifier.class);

	private final RPHolder rpHolder;
	private final String token;

	public OIDCTokenVerifier(RPHolder rpHolder, String token) {
		this.rpHolder = rpHolder;
		this.token = token;
	}

	public Map<String, Object> verify() {

		VerificationKeyResolver verificationKeyResolver = new HttpsJwksVerificationKeyResolver(new HttpsJwks(rpHolder.getDiscoveryEndpointInfo().getJwks_uri()));
		JwtConsumer consumer = new JwtConsumerBuilder()
				.setVerificationKeyResolver(verificationKeyResolver)
				//此处有许可项可配置进行校验，请根据实际需要配置
				//更多帮助可访问 https://bitbucket.org/b_c/jose4j/wiki/JWT%20Examples
		//{"user_name":"hr|318751","scope":["openid"],"exp":1615640771,"jti":"f297707f-fd0d-4224-9cd6-559c16f45309","client_id":"CRCC12-LDSC"}
				/**
				 *  payload
				 *      iss: jwt签发者
				 *      sub: jwt所面向的用户
				 *      aud: 接收jwt的一方
				 *      exp: jwt的过期时间，这个过期时间必须要大于签发时间
				 *      nbf: 定义在什么时间之前，该jwt都是不可用的
				 *      iat: jwt的签发时间
				 *      jti: jwt的唯一身份标识，主要用来作为一次性token,从而回避重放攻击。
				 *      。。。
				 */
				.setRequireExpirationTime()
//				.setRequireSubject()
//                .setRequireIssuedAt()
//                .setExpectedAudience(RESOURCE_ID)
//                .setRequireNotBefore()
//                    .setRequireJwtId()
				.build();
		try {
			JwtClaims claims = consumer.processToClaims(token);
			return claims.getClaimsMap();

@Slf4j
public class PigResourceServerConfigurerAdapter extends ResourceServerConfigurerAdapter {

@Override
public void configure(ResourceServerSecurityConfigurer resources) throws JoseException, IOException {
	DefaultAccessTokenConverter accessTokenConverter = new DefaultAccessTokenConverter();
	UserAuthenticationConverter userTokenConverter = new PigUserAuthenticationConverter();
	accessTokenConverter.setUserTokenConverter(userTokenConverter);

	PigCustomTokenServices tokenServices = new PigCustomTokenServices();

	// ,对称加密 转换方法，就可以正常转换token信息，
//	JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
//	converter.setSigningKey("123");
//	converter.setVerifier(new MacSigner("123"));

	// 公钥加密，从 jwks_uri获取公钥，如何转换呢？
     
	HttpsJwks httpsJwks = new HttpsJwks("http://localhost:3000/.well-known/jwks");
	List<JsonWebKey> jsonWebKeys = httpsJwks.getJsonWebKeys();
	JsonWebKeySet jsonWebKeySet=new JsonWebKeySet(jsonWebKeys);
	PublicJsonWebKey publicJsonWebKey = (PublicJsonWebKey) jsonWebKeySet.findJsonWebKey(DEFAULT_KEY_ID, RsaKeyUtil.RSA, USE_SIG, OIDC_ALG);

	MyOIDCJwtAccessTokenConverter converter=new MyOIDCJwtAccessTokenConverter(publicJsonWebKey);

	JwtTokenStore jwtTokenStore = new JwtTokenStore(converter);
	tokenServices.setTokenStore(jwtTokenStore);
	tokenServices.setJwtAccessTokenConverter(converter);
	tokenServices.setDefaultAccessTokenConverter(accessTokenConverter);

	resources
			.authenticationEntryPoint(resourceAuthExceptionEntryPoint)
			.tokenServices(tokenServices);
}