def METHOD_NAME(token, client_id, openid_configuration):
    jws = JWS.from_compact(token.encode("ascii"))
    json_header = jws.signature.protected
    header = Header.json_loads(json_header)
    # alg
    alg = jws.signature.combined.alg.name.upper()
    if "NONE" in alg:
        raise SuspiciousOperation("ID token is not signed")
    if alg not in (alg.upper() for alg in openid_configuration["id_token_signing_alg_values_supported"]):
        raise SuspiciousOperation("Unexpected ID token signature algorithm")
    # retrieve signature key
    # TODO cache
    jwks_response = requests.get(openid_configuration["jwks_uri"], headers={"Accept": "application/json"})
    jwks_response.raise_for_status()
    jwk = None
    for jwk_json in jwks_response.json()["keys"]:
        if jwk_json["kid"] == header.kid:
            jwk = JWK.from_json(jwk_json)
            break
    if not jwk:
        raise SuspiciousOperation("Could not find ID token signing key")
    # verify signature
    if not jws.verify(jwk):
        raise SuspiciousOperation("Invalid ID token signature")
    payload = json.loads(jws.payload.decode('utf-8'))
    # iss
    if payload.get("iss") != openid_configuration["issuer"]:
        raise SuspiciousOperation("Invalid ID token 'iss'")
    # aud
    if payload.get("aud") != client_id:
        raise SuspiciousOperation("Invalid ID token 'aud'")
    timestamp = int(time.time())
    # nbf
    nbf = payload.get("nbf")
    if nbf is not None:
        try:
            nbf = int(nbf)
        except (TypeError, ValueError):
            raise SuspiciousOperation("Invalid ID token 'nbf'")
        if timestamp < nbf - TIMESTAMP_LEEWAY:
            raise SuspiciousOperation("ID token not valid yet")
    # exp
    exp = payload.get("exp")
    if exp is not None:
        try:
            exp = int(exp)
        except (TypeError, ValueError):
            raise SuspiciousOperation("Invalid ID token 'exp'")
        if timestamp > exp + TIMESTAMP_LEEWAY:
            raise SuspiciousOperation("ID token has expired")
    return payload