anchor.diff:  AwEHoUQDQgAEG1O9LCrP6hg3Y9q68+LF0q48UcOkwVKE1ax0b56wjVusf3qnuFO2
   /+XHKKhtzEavvFMeXRQ+ZVEqM0yGNb04qw==
   -----END EC PRIVATE KEY-----
  ----
  +----
   
   However the JDK prefers PKCS8 format so we must convert:
   
  ----
  +----
   openssl pkcs8 -topk8 -nocrypt -in private.pem -out private_key.pem
  ----
  +----
   
   Which will give you a key similar to this:
   
  ----
  +----
   -----BEGIN PRIVATE KEY-----
   MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgxkZqpkNMcv4jMVgR
   YshghNekbM4m6JDFHZU0aF6rtKGhRANCAAQbU70sKs/qGDdj2rrz4sXSrjxRw6TB
   UoTVrHRvnrCNW6x/eqe4U7b/5ccoqG3MRq+8Ux5dFD5lUSozTIY1vTir
   -----END PRIVATE KEY-----
  ----
  +----
   
   Using the private key you can already generate tokens:
   
   [source,java]
  -----
  +-----
   {@link examples.AuthJWTExamples#example17}
  -----
  +-----
   
   So in order to validate the tokens you will need a public key:
   
  ----
  +----
   openssl ec -in private.pem -pubout -out public.pem
  ----
  +----
   
   So you can do all operations with it:
   
  
positive.code: So in this example we configure the JWT to work with Keycloak token format. In this case the claims will be checked
  under the path `realm_access/roles` rather than `permissions`.
  
  
  @author <a href="mailto:julien@julienviet.com">Julien Viet</a>
  @author <a href="http://tfox.org">Tim Fox</a>
  
negative.code: belief, 256 is not the key length but the hashing algorithm signature length. Any RSA key can be used with this JWT
  algorithm. Here is an information table:
  
  ----
    +-------------------+---------------------------------+
    | "alg" Param Value | Digital Signature Algorithm     |
    +-------------------+---------------------------------+
    | RS256             | RSASSA-PKCS1-v1_5 using SHA-256 |
    | RS384             | RSASSA-PKCS1-v1_5 using SHA-384 |
    | RS512             | RSASSA-PKCS1-v1_5 using SHA-512 |
    +-------------------+---------------------------------+
  ----
  
  If you would like to generate a 2048bit RSA key pair, then you would do (please remember **not** to add a passphrase
  otherwise you will not be able to read the private key in the JWT auth):
  
  ----
  openssl genrsa -out private.pem 2048
  ----
  
  You can observe that the key is correct as the file content is similar to this:
  
  ----
  -----BEGIN RSA PRIVATE KEY-----
  MIIEowIBAAKCAQEAxPSbCQY5mBKFDIn1kggvWb4ChjrctqD4nFnJOJk4mpuZ/u3h
  ...
  e4k0yN3F1J1DVlqYWJxaIMzxavQsi9Hz4p2JgyaZMDGB6kGixkMo
  -----END RSA PRIVATE KEY-----
  ----
  
  The standard JDK cannot read this file as is, so we **must** convert it to PKCS8 format first:
  
  ----
  openssl pkcs8 -topk8 -inform PEM -in private.pem -out private_key.pem -nocrypt
  ----
  
  Now the new file `private_key.pem` which resembles the original one contains:
  
  ----
  -----BEGIN PRIVATE KEY-----
  MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDE9JsJBjmYEoUM
  ...
  0fPinYmDJpkwMYHqQaLGQyg=
  -----END PRIVATE KEY-----
  ----
  
  If we are verifying tokens only (you will only need the private_key.pem file) however at some point you will need to
  issue tokens too, so you will a public key. In this case you need to extract the public key from the private key file:
  
  ----
  openssl rsa -in private.pem -outform PEM -pubout -out public.pem
  ----
  
  And you should see that the content of the file is similar to this:
  
  ----
  -----BEGIN PUBLIC KEY-----
  MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxPSbCQY5mBKFDIn1kggv
  ...
  qwIDAQAB
  -----END PUBLIC KEY-----
  ----
  
  Now you can use this to issue or validate tokens:
  
  