Signature validation of my access-token, Private-key?

Question

Hello I want to know how to get the keys to verify the access token. I got the x5c from https://login.microsoftonline.com/{{tenantid}}/discovery/keys?appid={{app-id}}

but if i put this key in jwt-decode function its failing. Do i need to do some processing on this key. Its a public key, do i need to know the private key to validate the signature or only public key is enough.

Can you please tell me some basic algo to validate the access_token.

Answer 1

Hi @Akhtar Naved ,

Thanks for reaching out.

I understand you are looking to verify the signature of the access token issued by Azure Ad by using public endpoint.

The OpenID discovery document contains the public keys that can be used to validate the signature of the token**.**

The x5c property in the JSON Web Key (JWK) set returned by the OpenID discovery document contains the public key in the form of an X.509 certificate. To validate the signature of the token, you need to extract the public key from the certificate and use it to verify the signature.

You need to obtain public key by calling the public Azure AD OpenID configuration endpoint:

https://login.microsoftonline.com/{tenant_id}/discovery/keys?appid={client_id} and verify against the private key generated by Azure AD token.

You need to decode your access token using jwt.ms and extract the "kid" from the header and need to match that kid should exist with the public keys.

If it matches, you know the contents were signed with the private key. If not, you can’t be sure of it so you should treat the JWT token as an invalid token.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens#validate-the-signature

Hope this will help.

Thanks,

Shweta

---

Please remember to "Accept Answer" if answer helped you.