Azure AD - validate idToken

Anonymous

Hi all,

I was trying to validate the idToken I got from my Vue SPA (single page application) which was integrated with Azure AD.

I've found one thread with 2 answers but I still can't figure it out. [Link] (https://learn.microsoft.com/en-us/answers/questions/793793/azure-ad-vlidate-access-token.html)

As far as I know, to validate / verify a JWT, one need to check if the signature match the hash result of one's own. Please, correct me if I'm wrong.

Below is what I got so far.

decode the token, and get the "kid" value from header.
call the key API from microsoft to look for a match for the "kid" value got from step 1.
API endpoint should be like this, https://login.microsoftonline.com/{{AD_tenantId}}/discovery/keys?appid={{AD_appId}}

Then what should I do?
Please help, thanks in advance.

Cristian SPIRIDON 4,471 Reputation points

2022-10-24T19:20:28.627+00:00

Hi Patrick-4896,

I think below tutorial explains in great detail how to validate JWT signature:

https://www.google.com/amp/s/www.freecodecamp.org/news/how-to-sign-and-validate-json-web-tokens/amp/

You can also use a well known library of your language of choice:

https://learn.microsoft.com/en-us/azure/active-directory/develop/reference-v2-libraries

Hope this helps!
Anonymous

2022-10-25T09:45:04.277+00:00

Hi CristianSPIRIDON72,

Thank you for your fast reply, the first link certainly is through about how to validate JWT signature.
Though I already know the flow, it's still a good read.

Unfortunately the second url doesn't help.
My question is specific about Azure AD - idToken.

I'll write an answer later to clarify that.
Thank you again!

1 answer

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,246 Reputation points

2022-10-24T19:52:56.603+00:00

Hello @Anonymous and thanks for reaching out. Azure AD ID token signature validation is usually done through a programming language library. For Vue, you can use MSAL JS TokenValidator or any other JavaScript JWT validator library. If you want to do it manually or know more about the inner workings, please take a look to Validating an ID token., RFC 7519: Validating a JWT and RFC 7515: JSON Web Signature (JWS).

Let us know if you need additional assistance. If the answer was helpful, please accept it and complete the quality survey so that others can find a solution.
Please sign in to rate this answer.
Anonymous

2022-10-25T09:48:53.03+00:00

Hi alfredorevilla-msft,

Thank you for your fast reply, the last reference did help.
I didn't mention in the question that I'll be validating the token, or signature in Java.
But after some digging, I've successfully figure it out.

I'll write an answer later to clarify that.
Thank you again!

Anonymous

2022-10-25T10:06:08.96+00:00

Turns out my statement in the question is not correct.

To get public keys is via this url https://login.microsoftonline.com/common/discovery/v2.0/keys

Let me try to rephrase my question then answer it myself.

---

I was trying to validate the idToken I got from my Vue SPA (single page application) which was integrated with Azure AD.

Since the data are all in browser dev tool. Any one with a little knowledge can modify their username and other data in the token.

Hence the need to verify it.

I'm also creating backend service with Java.

With this thread on stackOverFlow, one can create "PublicKey" with n and e in the JWK keys get from the first url.

By finding the mathing kid in the idToken header, and public keys API.

We get the n and e to create "PublicKey" to validate the token (signature) and see if it's tampered.

Hope this can also be a reference to those who encounter the issue.

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,246 Reputation points

2022-10-26T17:34:41.64+00:00

Hello @Anonymous and thanks for sharing your findings. Actually, the first key endpoint you share is valid too for applications with custom signing keys. You can find more about that here: https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens#validating-the-signature.

I've updated my answer with in-depth technical information coming from the very same RFCs that our involved product follows. We encourage every developer to keep it simple and avoid double effort by relying on well-known validation libraries.

Let us know if you need additional assistance. If my answer was helpful, please accept it and complete the quality survey so that others can find a solution.
Sign in to comment