How to validate the id_token value received from Azure AD v2.0 authentication response?

As you can see from the previous tutorials, you can easily decode the "id_token" value received from Azure AD authentication response using a simple PHP script.

After decoding, you can get all information about the end user from the body component, and trust it without any validation.

But, since the "id_token" is included in the authentication response delivered over the public Internet, you should not trust it and perform a number validation steps:

1. Data structure validation.

• The "id_token" must have 3 components.
• Each component must be a Base64URL encoded string.
• The decoded "Header" and 'Body" (also called "Payload") components must be JSON strings.

2. Data attributes validation.

• The "Header " component must have all required attributes and values. For example, "typ": "JWT", "alg": "...", and "kid": "..." are required.
• The "Body" component must have all required attributes and values. For example, "ver": "2.0", is required to indicate the version of the id_token structure. "iss": "..." must match the id of the Active Directory your app is registered in. "aud": "..." must match the "client_id" value in your authentication request.

3. Timestamp attributes validation. This will prevent someone to repost the authentication response to your server script at a later time.

• "iat": "1416968588" specifies the "Issue AT" time. It must be very recent.
• "nbf": "1416968588" specifies the "Not BeFore" time. It must be a past time.
• "exp": "1416968588" specifies the "EXPiration" time. It must be a future time.

4. "nonce" protection and validation. This will prevent someone to repost the authentication response again immediately.

• Generate a new random value for the "nonce" and included in your authentication request and save it into the server cache.
• Take the "nonce" value out of the "Body" component of the authentication response and search it in the server cache.
• If a match found, the "nonce" is valid and remove it from the server cache.
• If no match found, the "nonce" is invalid. Someone is hacking your application, or Azure AD service is sending a duplicate authentication response.
• Remove old "nonce" values from the server cache. Some authentication requests will never result any authentication response, because not all end users are going to complete their Azure AD v2.0 Sign-on processes.

5. Signature validation. This is to ensure the entire authentication response message has not been modified by someone else. See next tutorial on how to perform "id_token" signature validation.

⇒ Validate Azure AD v2 id_token Signature

⇐ Adding Claims in Azure AD v2 id_token

⇑ Azure AD Integration v2.0

⇑⇑ OpenID Tutorials