How to verify Azure AD B2C token? (2024)

Azure AD B2C is a great service, it helps simplify software architect. You don't need to build an SSO system but only apply few lines of code. When making authorization with Az B2C, the AD will response a payload with access token. TheMicrosoft docs doesn't mention about how to verify it, there are many libraries support the validation, but I suppose to make and API to verify token as below:

The Token from Az B2C has three segments separated by "." The first segment is a header, the second segment is payload, the third segment is a signature which is created by encrypting the hash of first and second segment, and Az B2C encrypts it with private key. To verify the token, you need to decrypt the signature with public key to get hash 1, hashing the header + payload to get hash 2 then compare hash 1 and hash 2. If 2 hashes are matched, then the token is valid.

Next question is: Where is public key? The doc says you can get public key from https://<tenant>.b2clogin.com/<tenant>.onmicrosoft.com/<policy name>/discovery/v2.0/keys

But when GET into that URL, you don't see public key

 "keys": [ {"kid":"X5eXk4xy8dlNP4-c57dO6QGTVBwaNk", "nbf":1493763266, "use":"sig", "kty":"RSA", "e":"AQAB", "n":"tVKUtcxLq6CScb0P3ZGXYbPzXvmmLiWZizpb-h0qup5jznOvOr-Dhw9908584BSgC83YacjWNqEK3urxhyE2jWjwRm2N95WGgb5mzE5XmZIvkvyXnn7X8dvgFPF5QwIngGsDG8LyHuJS5s8vJL0pVSrkuNojtokp84AtkADCDU_BUhrc2sIgfnvZ03koCQRoZmWiHu86SuJZYkDFstVTVSR0hiXudFlfQ2rOhPlpObmku68lXw-7V-P7jwrQRFfQVXw" } 

According to the doc. Azure AD B2C uses the RS256 algorithm, which is based on theRFC 3447specification. The public key consists of two components: the RSA modulus (n) and the RSA public exponent (e). You can programmatically convertnandevalues to a certificate format for token validation. So you need to make your own code to create public key from modulus and exponent.

I have made a public docker image to verify token, the program language is golang. Why golang? Because it fasts and small, the image is only 9 Mb, and when deploy it with Az Container App, it takes less than minute to provision.

https://hub.docker.com/repository/docker/kimcuongbvh/azureb2cauth