Share via

Access Token validation using JWK

Erik Martino 6 Reputation points
2021-09-16T18:56:07.85+00:00

I have a web page that needs to authenticate with Azure. The scopes provided are openid profile. I receive a JWT access token that I want to validate offline using JWK keyset. In the JWT header the algorithm is the expected RS256 and the kid is present in the JWK published in the openid-configuration.

Everything looks correct, except that the token doesn't verify (I use the Nimbus java framework). There is some folklore around this. Some says that if there is a nonce in the JWT token header it will not validate. Others says that it has something to do with permissions to api's in Azure AD. Some says it has something to do with using the graph api, some say that the algorithm in the JWT header is incorrect and it works with H256.

The Azure AD documentation is a bit shallow regarding validation of access tokens and how they deviate from standards.

Do you know how to make Azure behave and issue proper access tokens that you can verify?

Microsoft Security Microsoft Entra Microsoft Entra ID

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.