How do I get Azure AD to send JTI in JWT?

Question

Hi,

I'm new to OAuth 2.0 and Azure AD. One of the platforms we're using requires JTI in JWT claim. How do I get this in the JWT token? If this is possible, would this be in the Access or ID Token?

Answer 1

Hi @Tdev Feeds ,

Thanks for reaching out and apologies for delay in response.

I understand you are trying to get JTI claim in JWT token.

Azure AD provides "nonce" claim in the ID token to protect against relay attack. Your application can specify a nonce in an authorization request by using the "nonce" query parameter. The value you provide in the request is emitted unmodified in the "nonce" claim of an ID token only. If it does not match, your application should reject the token.

JWT spec sets the claim name as “jti”. While OAuth Spec mentions it as “asserting id”. When Microsoft designs and implements it in AzureAD, we name it as “nonce”.
We don’t have the official method to add the “jti” in the ID token natively.

Reference : https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad/azure-ad-token-missing-jti-claim/m-p/2222704#M6242

Hope this will help.

Thanks,
Shweta

-------------------------------------

Please remember to "Accept Answer" if answer helped you.