Tools, FAQ, Tutorials:
Validate Azure AD v1 id_token
How to validate the id_token value received from Azure AD v1.0 authentication response?
✍: FYIcenter.com
As you can see from the previous tutorials, you can easily decode the
"id_token" value received from Azure AD authentication response using a
simple PHP script.
After decoding, you can get all information about the end user from the body component, and trust it without any validation.
But, since the "id_token" is included in the authentication response delivered over the public Internet, you should not trust it and perform a number validation steps:
1. Data structure validation.
2. Data attributes validation.
3. Timestamp attributes validation. This will prevent someone to repost the authentication response to your server script at a later time.
4. "nonce" protection and validation. This will prevent someone to repost the authentication response again immediately.
5. Signature validation. This is to ensure the entire authentication response message has not been modified by someone else. See next tutorial on how to perform "id_token" signature validation.
Â
⇒ Validate Azure AD v1 id_token Signature
⇠Azure AD v1 id_token Decoded Example
⇑⇑ OpenID Tutorials
2021-05-16, 1000👍, 0💬
Popular Posts:
What is the "__init__()" class method? The "__init__()" class method is a special method that will b...
How to use the "set-variable" Policy Statement to create custom variables for an Azure API service o...
How to view API details on the Publisher Dashboard of an Azure API Management Service? You can follo...
Where to find tutorials on Python programming language? I want to learn Python. Here is a large coll...
Where to find tutorials on the 2017 version of API Management Services at Azure Portal? Here is a li...