anchor.diff:  belief, 256 is not the key length but the hashing algorithm signature length. Any RSA key can be used with this JWT
   algorithm. Here is an information table:
   
  ----
  -+-------------------+---------------------------------+
  -| "alg" Param Value | Digital Signature Algorithm     |
  -+-------------------+---------------------------------+
  -| RS256             | RSASSA-PKCS1-v1_5 using SHA-256 |
  -| RS384             | RSASSA-PKCS1-v1_5 using SHA-384 |
  -| RS512             | RSASSA-PKCS1-v1_5 using SHA-512 |
  -+-------------------+---------------------------------+
  ----
  +----
  +  +-------------------+---------------------------------+
  +  | "alg" Param Value | Digital Signature Algorithm     |
  +  +-------------------+---------------------------------+
  +  | RS256             | RSASSA-PKCS1-v1_5 using SHA-256 |
  +  | RS384             | RSASSA-PKCS1-v1_5 using SHA-384 |
  +  | RS512             | RSASSA-PKCS1-v1_5 using SHA-512 |
  +  +-------------------+---------------------------------+
  +----
   
   If you would like to generate a 2048bit RSA key pair, then you would do (please remember **not** to add a passphrase
   otherwise you will not be able to read the private key in the JWT auth):
   
  ----
  +----
   openssl genrsa -out private.pem 2048
  ----
  +----
   
   You can observe that the key is correct as the file content is similar to this:
   
  ----
  +----
   -----BEGIN RSA PRIVATE KEY-----
   MIIEowIBAAKCAQEAxPSbCQY5mBKFDIn1kggvWb4ChjrctqD4nFnJOJk4mpuZ/u3h
   ...
   e4k0yN3F1J1DVlqYWJxaIMzxavQsi9Hz4p2JgyaZMDGB6kGixkMo
   -----END RSA PRIVATE KEY-----
  ----
  +----
   
   The standard JDK cannot read this file as is, so we **must** convert it to PKCS8 format first:
   
  ----
  +----
   openssl pkcs8 -topk8 -inform PEM -in private.pem -out private_key.pem -nocrypt
  ----
  +----
   
   Now the new file `private_key.pem` which resembles the original one contains:
   
  ----
  +----
   -----BEGIN PRIVATE KEY-----
   MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDE9JsJBjmYEoUM
   ...
   0fPinYmDJpkwMYHqQaLGQyg=
   -----END PRIVATE KEY-----
  ----
  +----
   
   If we are verifying tokens only (you will only need the private_key.pem file) however at some point you will need to
   issue tokens too, so you will a public key. In this case you need to extract the public key from the private key file:
   
  ----
  +----
   openssl rsa -in private.pem -outform PEM -pubout -out public.pem
  ----
  +----
   
   And you should see that the content of the file is similar to this:
   
  ----
  +----
   -----BEGIN PUBLIC KEY-----
   MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxPSbCQY5mBKFDIn1kggv
   ...
   qwIDAQAB
   -----END PUBLIC KEY-----
  ----
  +----
   
   Now you can use this to issue or validate tokens:
   
  
positive.code: So in this example we configure the JWT to work with Keycloak token format. In this case the claims will be checked
  under the path `realm_access/roles` rather than `permissions`.
  
  
  @author <a href="mailto:julien@julienviet.com">Julien Viet</a>
  @author <a href="http://tfox.org">Tim Fox</a>
  
negative.code: 
  The usage is very similar to RSA, first you create a private key:
  
  ----
  openssl ecparam -name secp256r1 -genkey -out private.pem
  ----
  
  So you will get something similar to this:
  
  ----
  -----BEGIN EC PARAMETERS-----
  BggqhkjOPQMBBw==
  -----END EC PARAMETERS-----
  