private Holder<Boolean> doTokenAuth(Holder<Boolean> successStatus, ApiRequest request,
            IPolicyContext context, KeycloakOauthConfigBean config, IPolicyChain<ApiRequest> chain,
            String rawToken) {
        try {

            TokenVerifier<AccessToken> verifier = TokenVerifier.create(rawToken, AccessToken.class)
                    .withChecks(TokenVerifier.IS_ACTIVE);

            AccessToken parsedToken;
            if (config.getRealmCertificate() != null) {
                parsedToken = verifier.publicKey(config.getRealmCertificate().getPublicKey())
                        .verify()
                        .getToken();
            } else {
                String kid = verifier.getHeader().getKeyId();
                parsedToken = verifier.publicKey(keycloakDeployment.getPublicKeyLocator().getPublicKey(kid, keycloakDeployment))
                        .verify()
                        .getToken();
            }

            delegateKerberosTicket(request, config, parsedToken);
            forwardHeaders(request, config, rawToken, parsedToken);
            stripAuthTokens(request, config);
            forwardAuthRoles(context, config, parsedToken);

            RequestMetric metric = context.getAttribute(PolicyContextKeys.REQUEST_METRIC, (RequestMetric) null);
            if (metric != null) {
                metric.setUser(parsedToken.getPreferredUsername());
            }

            return successStatus.setValue(true);
        } catch (VerificationException e) {
            System.out.println(e);
            chain.doFailure(failureFactory.verificationException(context, e));
            return successStatus.setValue(false);
        }
    }
@see io.apiman.gateway.engine.policies.AbstractMappedPolicy#doApply(io.apiman.gateway.engine.beans.ApiRequest,
     io.apiman.gateway.engine.policy.IPolicyContext, java.lang.Object,
     io.apiman.gateway.engine.policy.IPolicyChain)
plugins/keycloak-oauth-policy/src/main/java/io/apiman/plugins/keycloak_oauth_policy/KeycloakOauthPolicy.java