Verify the ID token

The raw ID token is a JSON Web Token (JWT) that contains information about the authenticated user, including the user's email address. You can access the raw ID token with the following code:

// Handle the authentication redirect and get the sign-in response object 
const signInResponse = await openPassClient.handleAuthenticationRedirect();

// access the raw ID token JWT
console.log(signInResponse.rawIdToken);

IMPORTANT: Verify that the ID token JWT was supplied by OpenPass and has not been modified wherever it is used, such as when passing the ID token to a back-end application. Without this verification, it's possible for attackers to fake the token.

To verify the ID token JWT, follow these steps (or use a library such as Verify a JWT from Auth0):

  1. Get the OpenPass JWKS from https://auth.myopenpass.com/.well-known/jwks.
  2. Get the Key ID (kid value) from the ID token JWT headers.
  3. Get the correct JWK from the JWKS using the Key ID. This is the public signing key for the JWT.
  4. Verify the JWT signature using the JWK.
  5. Verify that the algorithm used to generate the JWT is the same algorithm listed in the JWK.
  6. Verify that the JWT token issuer is https://auth.myopenpass.com.

Example code for sign-in

The following is a Java code example for decoding and verifying the ID token (using a third-party Java library). 


void verifyIdToken(String rawIdTokenJwt){

    // decode JWT to check for valid structure.
    DecodedJWT decodedJwt = JWT.decode(rawIdTokenJwt);

    // Connect to the OpenPass JWKS provider endpoint to retrieve the JSON web key related to the JWT Key ID.
    JwkProvider jwkProvider = new UrlJwkProvider("https://auth.myopenpass.com/.well-known/jwks");
    Jwk jwk = jwkProvider.get(decodedJwt.getKeyId());

    // Get the public key from the JWK endpoint and create verification algorithm.
    PublicKey publicKey = jwk.getPublicKey();
    Algorithm algorithm = Algorithm.RSA256((RSAKey) publicKey);

    // verify that the JWT has the expected algorithm and is signed and issued by OpenPass.
    JWTVerifier verifier = JWT.require(algorithm).withIssuer("https://auth.myopenpass.com").build();

    verifier.verify(decodedJwt);
}

Additional resources

For more information, see the following pages: