SignatureVerificationException while validating the token in Java

Question

Dear Team, While we are validating the access token from Java, we are getting Signature Verification Exception. Please help us identify where the problem exactly lies in. We have setup the application registrations as per the link below: https://learn.microsoft.com/en-us/azure/active-directory-b2c/configure-authentication-sample-angular-spa-app Please do the needful.

Answer 1

Thanks for reaching out.

I understand you are looking to verify the signature of the access token issued by Azure Ad by using public endpoint. An access token contains claims that you can use Azure Active Directory to identify the granted permissions to your APIs.

When your internal application receives an access token, it must validate the signature to prove that the token is authentic.

To Verify the JWT token: Verify that the JWT contains three segments, separated by two period ('.') characters. Parse the JWT to extract its three components. The first segment is the Header, the second is the Payload, and the third is the Signature. Each segment is base64url encoded. Signature contains the digital signature of the token that was generated by Azure AD’s private key and verify that the token was signed by the sender. To validate the authenticity of the JWT token’s data is by using Azure AD’s public key to verify the signature. You can obtain public key by calling the public Azure AD OpenID configuration endpoint:

https://login.microsoftonline.com/{tenant_id}/discovery/keys?appid={client_id} and verify against the private key generated by Azure AD token. For validation, developers can decode JWTs using jwt.ms and verify against "kid" claim. If it works, you know the contents were signed with the private key. If not, you can’t be sure of it so you should treat the JWT token as an invalid token.
Hope this will help.

Thanks,

Shweta

Please remember to "Accept Answer" if answer helped you.