ivangeorgiev / az-jwt Goto Github PK

There are scenarios where the application cannot access Internet (Azure AD) directly, but still needs to be able to validate provided tokens.

In common cases metadata configuration endpoint could be constructed using a template. The URL could be used to retrieve metadata configuration of Azure AD tenant.

There are multiple scenarios (I might not be aware of all of them). For that reason the endpoint construction is not part of Azure AD metadata discovery (OpenIdDiscovery class), but is rather a parameter.

Given OpenId metadata URL, retrieve the metadata so that it could be used for validation purposes.

Django is not even part of this project.

Client code needs that calls to Azure AD are cached so that bandwidth is preserved is latency is smaller.

There is no need that each time keys or metadata configuration is needed, we retrieve them from Azure AD. Changes to Azure AD tenant metadata are so rear that we could pre-fetch the metadata and use it offline.

Necessary in order to get a particular key and validate a signature, e.g. JWT signature.

Instead of client code having to call conversion, we could return converted key.

Client code is able to create metadata discovery instance with tenant id, so that there is no need to first construct the metadata configuration url

RSA PEM is a common format used to validate signatures. It is used, for example, by pyJWT package. Client code need an easy way to convert JWK keys, provided by Azure AD tenant metadata to RSA PEM keys.

JWT tokens specify in the header the identifier of the key (kid) used to sign the payload. I want to be able to get the key easily, e.g. via a single method call.

Authenticate in Django using Azure AD JWT token