how to validate azure active directory token in webapi

Question

I am trying to validate azure active directory token got in angularapp

i used following code in web api

        [HttpGet]
    [Route("Validate")]
    public JwtSecurityToken Validate(string token)
    {
        string stsDiscoveryEndpoint = "https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration";


        ConfigurationManager<OpenIdConnectConfiguration> configManager = new ConfigurationManager<OpenIdConnectConfiguration>(stsDiscoveryEndpoint, new OpenIdConnectConfigurationRetriever());

        OpenIdConnectConfiguration config = configManager.GetConfigurationAsync().Result;

        TokenValidationParameters validationParameters = new TokenValidationParameters
        {
            ValidateAudience = false,
            ValidateIssuer = false,
            IssuerSigningTokens = config.SigningTokens,
            ValidateLifetime = false
        };

        JwtSecurityTokenHandler tokendHandler = new JwtSecurityTokenHandler();

        SecurityToken jwt;

        var result = tokendHandler.ValidateToken(token, validationParameters, out jwt);

        return jwt as JwtSecurityToken;
    }

the code show error at IssuerSigningTokens = config.SigningTokens, with the message

TokenValidationParameters does not contain definition for IssuerSigningTokens

Can any one please provide me the solution?

Also i want to return my own token from validate method.

What's the kind of your app? If it's .NET Core App, that's should be IssuerSigningKeys = config.SigningKeys. — Sa Yang
– Sa Yang, Commented May 16, 2018 at 1:50

Turbo · Accepted Answer · 2020-02-26 20:04:41Z

3

Today,we can use jwtSecurityTokenHandler with System.IdentityModel.Tokens.Jwt.

ATTENTION System.IdentityModel.Tokens.Jwt version 5.x.x requires .NET Framework 5.x. If the target framework is .NET Framework 4.5.x or 4.6.x take latest stable 4.x.x version of System.IdentityModel.Tokens.Jwt package.

Validate JWT

public override async Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken)
{
    ...

    // validate JWT
    try
    {
        await JwtValidator.ValidateJwtToken(token, cancellationToken);
    }
    catch (SecurityTokenException e)
    {
        var validationSucceeded = false;
        Contract.Assert(validationSucceeded, $"{ErrorCode.UNAUTHORIZED}JWT validation failed ({e.Message}).");
    }

    ...
}

public class JwtValidator
{
    private const string STS_DISCOVERY_ENDPOINT_SUFFIX = ".well-known/openid-configuration";
    private const string URI_DELIMITER = "/";

    public static async Task<SecurityToken> ValidateJwtToken(string token, CancellationToken cancellationToken)
    {
        var aadInstance = "https://login.microsoftonline.com/{0}";
        var tenant = "example.com";
        var audience = "853fb202-4201-4e20-97ae-4d5840d9490f";
        var authority = string.Format(CultureInfo.InvariantCulture, aadInstance, tenant);

        // Fetch configuration
        var stsDiscoveryEndpoint = string.Concat(authority, URI_DELIMITER, STS_DISCOVERY_ENDPOINT_SUFFIX);
        ConfigurationManager<OpenIdConnectConfiguration> configManager = new ConfigurationManager<OpenIdConnectConfiguration>(stsDiscoveryEndpoint);
        var config = await configManager.GetConfigurationAsync(cancellationToken);

        // extract issuer and token for validation
        var issuer = config.Issuer;
        var signingTokens = config.SigningTokens.ToList();

        // validate token
        var validationParameters = CreateTokenValidationParameters(signingTokens, issuer, audience);

        var jwtSecurityTokenHandler = new JwtSecurityTokenHandler();

        SecurityToken jwt;
        jwtSecurityTokenHandler.ValidateToken(token, validationParameters, out jwt);
        return jwt;
    }

    private static TokenValidationParameters CreateTokenValidationParameters(List<SecurityToken> signingTokens, string issuer, string audience)
    {
        Contract.Requires(null != signingTokens);
        Contract.Requires(!string.IsNullOrWhiteSpace(issuer));

        return new TokenValidationParameters()
        {
            ValidAudience = audience,
            ValidIssuer = issuer,
            IssuerSigningTokens = signingTokens,
            CertificateValidator = X509CertificateValidator.None,
            ValidateLifetime = true
        };
    }
}

Also i want to return my own token from validate method.

When using OpenIdConnectConfiguration configManager.GetConfigurationAsync(cancellationToken); has to be called in async context by using await (Implies that the surrounding method has to be async).

Otherwise the method call GetConfigurationAsync(cancellationToken) did never return. Even when I tried to run the asynchronous method synchronously by calling .Result or using other mechanisms to run ansynchronous methods synchronous the method didn’t return.

You can see more details about Manual JWT Validation against Azure Active Directory in this blog.

edited Feb 26, 2020 at 20:04

Turbo

2,5912 gold badges23 silver badges40 bronze badges

answered May 16, 2018 at 6:30

Sa Yang

9,4042 gold badges24 silver badges41 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

rakshith Over a year ago

i am working on dotnet framework 4.5.2,and i have latest System.IdentityModel.Tokens.Jwt dll(5.2.2),but i am getting error OpenIdConnectConfiguration does not contain definition for SigningTokens

rakshith Over a year ago

i changed dll(verion 4.0.1) ,1.getting following errors ConfigurationManager<OpenIdConnectConfiguration> does not contain constructer taking one arguement,2.OpenIdConnectConfiguration does not contain definition for SigningTokens,3.cannot convert from 'Microsoft.IdentityModel.Tokens.TokenValidationParameters' to 'System.IdentityModel.Tokens.TokenValidationParameters',4.TokenValidationParameters' does not contain a definition for 'IssuerSigningTokens

Judy007 Over a year ago

Are we able to use for .net core as well?

Collectives™ on Stack Overflow

how to validate azure active directory token in webapi

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related