Identityserver4: How to Properly Validate an Access Token that was Issued by Identity Server 4

[randalvance]

Given an accessToken, what is the correct way of validating an accessToken? I am trying to use Identity Server for custom authentication of Azure App Service. To do that, you must create a controller action and validate it using custom logic.

The code for custom validation is:

[MobileAppController]
public class AuthController : ApiController
{
    public HttpResponseMessage Post(string accessToken)
    {
        // implementation below, not sure how to validate using Identity Server
        if (!this.IsAccessTokenValid(accessToken))
        {
            return this.Request.CreateUnauthorizedResponse();
        }

        JwtSecurityToken token = this.GetAuthenticationToken(accessToken);

        return this.Request.CreateResponse(HttpStatusCode.OK, new
        {
            Token = token.RawData,
            Username = username
        });
    }

    private bool IsAccessTokenValid(string accessToken)
    {
        // this is where we would do checks agains a database

        return true;
    }
}

I am not sure what I should do in IsAccessTokenValid to validate a given accessToken. I dissected the code for IdentityServer4.AccessTokenValidation and it seems it uses JwtSecurityTokenHandler to validate accessTokens. So is this code sufficient to validate a token?

private bool IsAccessTokenValid(string accessToken)
{
    try
    {
        var handler = new JwtSecurityTokenHandler();
        handler.ValidateToken(accessToken);
        return true;
    }
    catch 
    {
        return false;
    }
}

There seems to be a separate endpoint for token validation in Identity Server 3 called AccessTokenValidationController. Is there an equivalent endpoint for that in version 4? Thank you.

[scottbrady91]

Check out the Introspection Endpoint. This implements RFC 7662:

...method for a protected resource to query an OAuth 2.0 authorization server to determine the active state of an OAuth 2.0 token and to determine meta-information about this token.

[randalvance]

Thanks a lot. Will check that out.

[AKlaus]

The docs say:

... or JWTs if the consumer does not have support for appropriate JWT or cryptographic libraries

So, is it possible to validate a JWT token (not a reference token) in a more traditional way (e.g. with using JwtSecurityTokenHandler.ValidateToken() or like here)?

[brockallen]

yes

[paramdeepsinghsaini]

Hi, I want to use IdentityServer 4 with SharePoint 2013 and have it integrated with another home built application which uses its owm mechanism of authentication and authorization. Is it possible that Identity Server receives a POST request from that application having username and role and generate a token which is then passed to SharePoint 2013 for Single Sign On login without validating against any user store?

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.