Azure B2C 访问令牌验证和自定义 JWT 令牌生成

Question

For a web application in Spring Boot (API REST) + Angular as front-end we need to integrate with Azure B2C for the authentication part.

I am reading some Microsoft documentation but I have no experience with Azure B2C.

The need would be to validate the Access Token obtained from the Client application (Angular) on Azure and then generate (From Java application) a custom JWT token (ID Token) with user roles and permissions taken from the Database. We can't put the roles on Azure AD.

At this point Client (Angular) and Server (API REST) would only use this token to handle API calls.

What I didn't understand is how to validate the Azure Access Token through the Spring Framework. Which Microsoft web service should be called and how (which library)

Thanks in advance.

Answer 1

I think the answer in this question should get you started: How to validate JWT token generated from Azure AD B2C in Java?

The AD B2C accesstoken is "just" an oauth2 token, so any library that can validate oauth2 should do it.

Edit (can't comment yet): I think this link (linked in the other answer) is your best start: https://learn.microsoft.com/en-us/azure/active-directory-b2c/tokens-overview . Anyway, you need a tenant-specific url to get the correct keys, something like https://contoso.b2clogin.com/contoso.onmicrosoft.com/b2c_1_signupsignin1/discovery/v2.0/keys instead of the generic microsoft keys.

Alternatively you could look at the sample application for java and b2c from microsoft, which uses msal for java: https://github.com/Azure-Samples/ms-identity-java-webapp/tree/master/msal-b2c-web-sample