How to verify signature of refreshed id_token in Azure active directory

Nitin Published at Dev

Nitin

We are using Azure active directory Oauth code flow to authenticate the user. We got the access_token, id_token and refresh_token using code(got it on redirect URL). We are using id_token to authorization each request after successful authentication and we can verify JWT using the public key which we got from /discovery/v2.0/keys api.

Now, JWT will expire after 1 hour. so we need to refresh this id_token.

I am refreshing id_token using below cURL

 curl --request POST \
  --url https://login.microsoftonline.com/{tenant_id}/oauth2/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data 'client_id=client%20id&refresh_token=refesh%20token%20&grant_type=refresh_token&client_secret=client_secret&scope=openid

In the response of this API, we got the access_token, refresh_token, id_token, but if you observe id_token, it does not contain JWT signature (the third part of JWT), without signature we can not verify JWT

We can not find any document reference why id_token is not having a signature part. Is there any other way to refresh id_token? Is there any workaround if id_token can not be refreshed?

juunas

In some cases an Id token may be returned without a signature, especially if it is acquired through a back-channel with a client secret. You already are getting the token through an encrypted channel, from the authority. If someone was able to inject something there, they would be able to direct your app's requests for OpenID metadata as well, replacing the signing keys your app expects. Thus the signature would not add much value here.

In addition, you won't send the Id token to any API as Id tokens should not be used for authorization. That's what access tokens are for :)

The OpenID Connect spec has this to say: https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation

If the ID Token is received via direct communication between the Client and the Token Endpoint (which it is in this flow), the TLS server validation MAY be used to validate the issuer in place of checking the token signature. The Client MUST validate the signature of all other ID Tokens according to JWS [JWS] using the algorithm specified in the JWT alg Header Parameter. The Client MUST use the keys provided by the Issuer.

But then, interestingly mentions this as well: https://openid.net/specs/openid-connect-core-1_0.html#IDToken

ID Tokens MUST be signed using JWS and optionally both signed and then encrypted using JWS and JWE respectively, thereby providing authentication, integrity, non-repudiation, and optionally, confidentiality, per Section 16.14. If the ID Token is encrypted, it MUST be signed then encrypted, with the result being a Nested JWT, as defined in [JWT]. ID Tokens MUST NOT use none as the alg value unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow) and the Client explicitly requested the use of none at Registration time.

So.. it could be that Azure AD is not compliant with spec?

EDIT: The v1 endpoint of Azure AD is not compliant in this regard. The newer v2 endpoint is fully OpenID Connect compliant.

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at2020-12-14

Comments

0 comments

TOP Ranking

Article

How to verify signature of refreshed id_token in Azure active directory

How to verify signature of refreshed id_token in Azure active directory

pump.io port in URL

Loopback Error: connect ECONNREFUSED 127.0.0.1:3306 (MAMP)

Can't pre-populate phone number and message body in SMS link on iPhones when SMS app is not running in the background

How to import an asset in swift using Bundle.main.path() in a react-native native module

Failed to listen on localhost:8000 (reason: Cannot assign requested address)

Spring Boot JPA PostgreSQL Web App - Internal Authentication Error

ngClass error (Can't bind ngClass since it isn't a known property of div) in Angular 11.0.3

Using Response.Redirect with Friendly URLS in ASP.NET

Can a 32-bit antivirus program protect you from 64-bit threats

Double spacing in rmarkdown pdf

How to fix "pickle_module.load(f, **pickle_load_args) _pickle.UnpicklingError: invalid load key, '<'" using YOLOv3?

3D Touch Peek Swipe Like Mail

Bootstrap 5 Static Modal Still Closes when I Click Outside

Assembly definition can't resolve namespaces from external packages

Vector input in shiny R and then use it

Emulator wrong screen resolution in Android Studio 1.3

Svchost high CPU from Microsoft.BingWeather app errors

Graphics Context misaligned on first paint

Python connect to firebird docker database

Is this docker-for-mac password dialog legit?

How to save models trained locally in Amazon SageMaker?