Validate access_token signature in php

Wiaam TALEB 1 Reputation point
2022-04-15T15:08:15.003+00:00

Hello,

How can I verify the signature of the token in php laravel.

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,655 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,581 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Shweta Mathur 27,711 Reputation points Microsoft Employee
    2022-04-18T17:15:28.443+00:00

    Hi @ 01525690,

    Thanks for reaching out.

    Access tokens are signed using RS256 which would mean that the JWT is signed with Azure AD private key and would be validated by Azure AD public key.

    Once you will get the access token using token endpoint, token need to verify to validate the authenticity of the JWT token’s data is by using Azure AD’s public key to verify the signature. You can obtain public key by calling the public Azure AD OpenID configuration endpoint https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration and verify against the private key(kid) generated by Azure AD token.

    I am not sure about how to implement in PHP but found a stack overflow thread to verify JWT using PHP.

    Hope this will help.

    Thanks,
    Shweta

    ---------------------------------------

    Please remember to "Accept Answer" if answer helped you.

    0 comments