This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthor

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note

Page References

Incoming links Outgoing links
Identity Token Validation
Identity Token Validation

Version management

Difference between version and

At line 1 added 21 lines
!!! Overview
[{$pagename}] requires that the [OAuth Client] [MUST] validate the [Id_token] in the [OAuth Token Response].
If any of the [Verification] procedures defined fail, any operations requiring the information that failed to correctly validate [MUST] be aborted and the information that failed to validate [MUST NOT] be used.
The [OAuth Client] can split the [Id_token] at the period (".") characters, take the second segment, and [base64url] decode it to obtain a [JSON Object] containing the
[Identity Token Claims], which [MUST] be validated as follows:
* Verify the [JWS] [Digital Signature] of the [JWT] [id_token]
* [nonce] - This [MUST] be the [nonce] value you sent in your [Authentication Request]
* [iss] - The Issuer Identifier for the [OpenID Connect Provider], which is typically obtained from [Openid-configuration] [MUST] exactly match the value of the [iss] ([issuer]) [Claim].
* [aud] - The Client [MUST] validate that the [aud] (audience) [Claim] contains its [client_id] value registered at the [OpenID Connect Provider] identified by the [iss] (issuer) Claim as an audience. The [Id_token] [MUST] be rejected if the [Id_token] does not list the Client as a valid audience, or if it contains additional audiences not trusted by the Client.
* [azp] - If the azp contains multiple [Aud] values, the Client [SHOULD] verify that an [azp] Claim is present. If an [azp] ([authorized party]) [Claim] is present, the Client [SHOULD] verify that its [client_id] is the [Claim] Value.
* [exp] - The current time [MUST] be before the time represented by the [exp] Claim (possibly allowing for some small leeway to account for [clock skew]).
* [iat] - The [iat] Claim can be used to reject tokens that were issued too far away from the current time, limiting the amount of time that [nonces] need to be stored to prevent attacks. The acceptable range is Client specific.
* [acr] - If the [acr] [Claim] was requested, the Client [SHOULD] check that the asserted Claim Value is appropriate.
* [Max_age] - When a [max_age] request is made, the Client [SHOULD] check the [auth_time] Claim value and request re-authentication if it determines too much time has elapsed since the last [End-User] [authentication].
!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthorTop