How to validate access_token generated by Azure AD B2C in web Api

Vyom Sharma 21 Reputation points
2021-12-27T01:39:38.893+00:00

Hi,

I am able to generate access_token in my SPA using PKCE flow now i am sending this token to my web API which is a golang micro-service. how can i verify this access_token in my API.

I worked with UAA before fortunately UAA provides a check-token endpoint but i am not able to figure out any endpoint similar to that in Azure. Is there any endpoint in Graph Api which can tell the validity of token?

Any help is much Appreciated.

Thanks!

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,639 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,459 questions
0 comments
Accepted answer
  1. Siva-kumar-selvaraj 15,551 Reputation points
    2021-12-28T07:05:15.257+00:00

    Hello @Vyom Sharma ,

    Thanks for reaching out.

    When your API receives an access token, it must validate the signature to prove that the token is authentic. Your API must also validate a few claims in the token to prove that it is valid. Depending on the scenario requirements, the claims validated by an application can vary, but your application must perform some common claim validations in every scenario.

    A registered application receives tokens and communicates with Azure AD B2C by sending requests to these endpoints:

    https://<tenant-name>.b2clogin.com/<tenant-name>.onmicrosoft.com/<policy-name>/oauth2/v2.0/authorize
    https://<tenant-name>.b2clogin.com/<tenant-name>.onmicrosoft.com/<policy-name>/oauth2/v2.0/token

    To learn more about tokens in Azure Active Directory B2C refer :https://learn.microsoft.com/en-us/azure/active-directory-b2c/tokens-overview

    Hope this helps.

    -----
    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Siva-kumar-selvaraj 15,551 Reputation points
    2022-01-04T07:31:22.043+00:00

    Thanks for detailed information and sorry for the inconvenience caused.

    Azure AD does not have an introspection endpoint. I have taken this feedback to our product team.

    1 person found this answer helpful.
  2. Vyom Sharma 21 Reputation points
    2022-01-02T02:42:30.303+00:00

    Hello @sikumars-msft ,

    Thanks for taking time and replying to my question. I understand that i have to validate the signature and claims. but my issue is little different here there will be cases when the user logs out but the token associated with the user on the client doesn't expire and so when the Resource Servers/APIs invoked with these tokens gets serviced/honored. So i was looking for Introspection endpoint to verify the token just like we have in other Identity provider like Okta and UAA. But i guess that feature is not there yet in Azure

    I am able to find the similar issue raised here https://feedback.azure.com/d365community/idea/ea407180-be25-ec11-b6e6-000d3a4f0789 but i guess this is something under review by Microsoft
    :-(

    0 comments