2

I'm following this guide and using the jwt.io chrome addin but I can't find my key so that I can manually verify the signature.

JWT Header

{
  "typ": "JWT",
  "alg": "RS256",
  "kid": "c9HOlAkfaBs4YSKZ7RoMnZlKrVzdkXHB2QoLv1fETQ8"
}

The OpenID Connect metadata document leads me to https://login.microsoftonline.com/common/discovery/v2.0/keys but that response not have this kid.

I've also referenced this blog post.

spottedmahn
  • 14,823
  • 13
  • 108
  • 178

2 Answers2

9

The URL to retrieve your Azure AD B2C tenant's keys has the following format:

https://login.microsoftonline.com/te/<tenantName>.onmicrosoft.com/b2c_1_<policyName>/discovery/v2.0/keys

For example:

https://login.microsoftonline.com/te/fabrikamb2c.onmicrosoft.com/b2c_1_edit_profile/discovery/v2.0/keys

Note that both the keys and URLs are different from those for regular Azure AD and Azure AD's v2.0 endpoint (the latter being the URL you referenced in your question).

At this time, the keys for all built-in policies (even across tenants) use the same keys, however in the case of custom policies you'll see different keys per tenant and even in some cases, per policy.

Important note: You won't be able to use jwt.io out of the box to validate Azure AD B2C tokens given that the keys in Azure AD B2C are in a different format. See Azure AD B2C - Token validation does not work

Saca
  • 10,355
  • 1
  • 34
  • 47
  • That worked but I'm at a loss. Why couldn't I follow the guide? Is is out of date maybe? – spottedmahn Aug 20 '17 at 18:53
  • 1
    You were looking at the docs for (regluar) Azure AD's v2 endpoint which is different from Azure AD B2C. They have different metadata URLs and keys. – Saca Aug 20 '17 at 18:56
  • gotcha, thanks! Here: [Azure AD B2C: Token reference](https://learn.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-reference-tokens) – spottedmahn Aug 20 '17 at 19:00
7

This answer is quite old and the URL as at October 2021 is now:

https://<tenantName>.b2clogin.com/<tenantName>.onmicrosoft.com/b2c_1_<policyName>/discovery/v2.0/keys

Derek
  • 151
  • 2
  • 4