JavaBearer Token validation in Azure AD

Bogdan C 0
Viewed 34

I'm trying to validate a token (just using postman), final solution would be written in Java (spring). The problem is I don't find the exact URL to validate the token against AAD. I found this helpful article : https://docs.microsoft.com/en-us/answers/questions/884100/azure-ad-access-token-validation.html And in that article they said to validate the token against this URL: https://login.microsoftonline.com/<<<tenant_id>>>/v2.0/ The problem is I got 404 when I hit that URL. I also got "200 OK status" when I hit this URL https://login.microsoftonline.com/<<<tenant_id>>/oauth2/v2.0/authorize no matter what I put in the token !! Which is strange!

This link works for me: https://login.microsoftonline.com/<<<tenant_id>>/discovery/v2.0/keys - and I get back a very descriptive JSON, but I am still stuck.

Could you please provide me the URL which would give me 200-ok when I have a valid token, and also to give me a bad-invalid response when I have a wrong token ?

I found some sample Postman requests here: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth-ropc?WT.mc_id=AZ-MVP-5003203 I got same behavior with them.

Thank you.

access-token azure-active-directory
1 Answers

There is no introspection endpoint listed in https://login.microsoftonline.com/common/.well-known/openid-configuration

This authorization-server obviously supports JWTs only. To validate access-tokens, you'll have to configure a JWT decoder/validator in your Java app.

With Spring, this is done by configuring a JWT resource-server. Sample in this article. Skip the part about Keycloak and use

  • spring.security.oauth2.resourceserver.jwt.issuer-uri=https://login.microsoftonline.com/common in properties
  • not sure this authorization-server provides with user roles or groups or whatever claim to map spring authorities from (try to submit an access-token to https://jwt.io to see if you have a claim like that)
ch4mp0
Related