Search code examples
single-sign-onopenid-connectadfs

How to get the Username with OpenID Connect on ADFS Server

I just realized that the userinfoendpoint doesn't give any useful info about the logged in user.

Now, I saw that you can get an id_token from ADFS tokenendpoint. This id_token is actually a JWT which contains the unique_name.

Now my question is, if it is safe to use this info without signature validation (since we don't have the private key of the HS256 algorithm and validation is as far as I understood, a thing for the issuer not for the client).

Solution

  • • There are two scenarios to your question of whether it is safe to use this info from an ID_token. First, your client, i.e., the application or authorization server will validate the token just like it validates the access token for any tampering. Also, it can validate the issuer to ensure that the correct issuer has sent back the token. Since there are many libraries to validate an ID token, you should use them for ID token validation purposes.

    • Also, only confidential client applications should validate an ID token as their token holds a secret while public applications don’t benefit from validating an ID token as there is always a risk of a malicious user who can intercept and edit the keys used for validation of the token.

    • As you are speaking of the case when you don’t have the private key to the algorithm used for encrypting the ID token, it must be a confidential client application. Thus, validating the ID token on the lines of access token and confirming the below claims are validated by your token validation library, you can then use the information retrieved from these claims for your purpose. The claims that need to be validated are as follows: -

    1. Timestamps: the iat, nbf, and exp timestamps should all fall before or after the current time, as appropriate.
    2. Audience: the aud claim should match the app ID for your application.
    3. Nonce: the nonce claim in the payload must match the nonce parameter passed into the /authorize endpoint during the initial request.

    Please find the below documentation link for more in-depth details on validating the tokens and the inherent process involved in it: -

    https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens#validating-tokens