Validate/Introspect Access Token

Question

I am currently receiving an access token in the Authorization headers from my Angular UI. I need to introspect or validate that access token. In different articles over the internet, an endpoint is mentioned for introspection of the access token. But it does not work when I try to validate an access token in my Postman.

I want my spring boot application to validate the access token by calling an endpoint that can provide me details regarding the access token.

So, is there any endpoint that can validate the access token I am receiving? If not, then is there any other way to validate the access token?

Answer 1

Hello @Anshuman Pattnaik , there's no endpoint to validate an Azure AD access token however there are recommended practices such as token signature and issuer validation using values published in the OpenID discovery document.

The Azure AD middleware has built-in capabilities for validating access tokens. You can find samples for Java here.

Alternatively you can validate an access token using non Microsoft libraries. Take a look to Decode a JWT Token in Java.

Finally, and for a better understanding of the inner workings and considerations for access token validation take a look to the official Azure AD documentation.

Let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.