Cannot find Public Key to Verify Token

J 0 Reputation points
2024-12-08T11:36:07.3066667+00:00

Hi,

For the life of me I cannot find the correct JWKS to verify the token that is generated by:

 Office.context.mailbox.getCallbackTokenAsync();

I need to find the public key but I don't know where to look. I have tried:
https://login.microsoftonline.com/common/discovery/v2.0/keys
https://substrate.office.com/sts/common/discovery/keys

But the there is no matching kid that is in the header of my token. The epk in my token has some metadata with a kid that is matched with a kid in substrate.office.com... but that is not the right one it seems as it needs to be the kid from the header. Please tell me where to find the public key!

Token Header:

{  "alg": "RS256",  "typ": "JWT",  "kid": "EZbL9Wnccmkj6rNNMuE/QT9rH5U=",  "x5t": "EZbL9Wnccmkj6rNNMuE/QT9rH5U=",  "nonce": "bnj4SnEYkcRbr5MC76HR7LAsjXtBzVxvr1LuVNLk2JhDU86PJ_KoU06z0wUhuLc3eSnfaKiQ9RX75xDVt2m9BkaDvSyj6XZxmWi1J61p4G8a06M5typC2PffNUWfJBY54i8GW2A0p_-rXmC7HUUN9ZtRczi2B4QrULCuZ98u09E",  "issloc": "AS8PR02MB10169",  "srsn": 638685689694795900}

Token body:

 {
  "sap-version": "13",
  "appid": "33f1ce9e-xxxx-4164-8d4b-16d52404404d",
  "issring": "WW",
  "appidacr": "2",
  "app_displayname": "",
  "uti": "7119ed2c-xxxx-49d3-a1b2-16bd52b7030b",
  "iat": 1733655993,
  "ver": "STI.User.CallbackToken.V1",
  "tid": "84df9e7fe9xx40afb435aaaaaaaaaaaa",
  "trustedfordelegation": "false",
  "topology": "{\"Type\":\"Machine\",\"Value\":\"AS8PR02MB10169.eurprd02.prod.outlook.com\"}",
  "requestor_appid": "eed83176-xxxx-48c7-a887-cc5cc534c7b8",
  "requestor_app_displayname": "Office 365 Exchange Microservice",
  "scp": "Mail.ReadWrite Mail.Send Calendars.ReadWrite Contacts.ReadWrite",
  "oid": "00064000-xx-3c39-0000-000000000000",
  "puid": "0006400xxEB73C39",
  "smtp": "******@hotmail.com",
  "epk": "{\"kty\":\"RSA\",\"n\":\"qBKF1aMyz2tuDeRbM4K3Wt-INf6ssrxJkqGkS91ymALD5wsFJM7w0J3FHD70Yiv6DuWiPg4AHMu8Ugvirhod0NJxC5_n0i7MevR0FIvSqb7G8Gde1pMcSyiwj3Re4_7fup3YvcZ4F5aTJT-QfyyYRsi4HCrSG_ILQqsMf49JQGCJo6q5q8YT9nfxluoIGtp5r7Kt1mOxTMr0gdsYQ-RHq4yBCnoHnL88dJeyK9u51Q5nXVGMJkYM1VQ_LCsGSdc_Axm-U1oETxPTVq_aJAjEzRrwU_xOlmV_JS3wHN_c6ryvIyjovQaZhTi7PLe0BKr17hHjA8QgBDApmSemalvz1Q\",\"e\":\"AQAB\",\"alg\":\"RS256\",\"exp\":\"1733745417\",\"exp_diff\":\"86400\",\"kid\":\"1YFSb8ccMbpxNQo9ohTngP_U5Ng\"}.....w==",
  "nbf": 1733655993,
  "exp": 1733656893,
  "iss": "https://substrate.office.com/sts/",
  "aud": "https://outlook.office365.com",
  "ssec": "C5Lrd09I9/W+H+52"
}
Microsoft 365 and Office Development Other
Outlook Windows Classic Outlook for Windows For business
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.