class XsuaaJkuValidator implements Validator<Token> {

	@Override
	public ValidationResult validate(Token token) {
		String tokenKeyUrl = token.getHeaderParameterAsString(TokenHeader.JWKS_URL);
		URI jkuUri;

		if (tokenKeyUrl == null || tokenKeyUrl.trim().isEmpty()) {
			return createInvalid(
					"Issuer validation can not be performed because Jwt token does not contain 'jku' header parameter.");
		}
		try {
			jkuUri = URI.create(tokenKeyUrl);
		} catch (IllegalArgumentException e) {
			return createInvalid(
					"Issuer validation can not be performed because Jwt token does not contain a valid uri as 'jku' header parameter.");
		}
		if (!matchesTokenKeyUrlDomain(jkuUri)) {
			return createInvalid(
					"Issuer is not trusted because 'jku' '{}' does not match uaa domain '{}' of the identity service.",
					jkuUri, domain);
		}
		if (!matchesTokenKeyEndpoint(jkuUri)) {
			return createInvalid(
					"Jwt token does not contain a valid 'jku' header parameter.",
					jkuUri, domain);
		}
		return createValid();
	}

	  XsuaaJkuValidator(String uaaDomain);

}