oauth 2.0 - verify jwt obtained from cloudfoundry cf client -

i understand better how uaa client token verification works cloud foundry.

after logging in cloud foundry cf tool, have obtained signed token using

cf oauth-token 

as understand token has been signed cf client , contains original access token has received uaa after have logged in.

now can decode token online jwt parser (the token not sensitive information, since cf tool targeted @ local bosh-lite installation). yet how validate token correct? task cloud controller do, correct?

i have tried using jjwt java library follows:

jwts.parser().setsigningkey("").parseclaimsjws(token).getbody(); 

yet complains empty signing key. signing key cf client using? is client secret registered uaa?

any clarification highly appreciated.

my current understanding cf cli saves encoded , signed token generated uaa. token signed uaa private key, , can verified corresponding uaa's public verification key.

in order verify token, have 2 options:

1) use uaa endpoint (/check_token) verifies given token you, in approach don't need uaa's verification key.

see https://github.com/cloudfoundry/uaa/blob/master/server/src/main/java/org/cloudfoundry/identity/uaa/oauth/remotetokenservices.java

2) retrieve uaa public verification key (/token_key), , write code verify jwt signature.

see https://github.com/cloudfoundry-incubator/routing-api/blob/master/authentication/token_validator.go

based on approach take, can mimic corresponding implementation using js.

i hope helps.