Single Sign On: Oauth – How to decode the id_token?

In the oauth protocol, the id_token proves successful authentication by the IDP occurred.

When the scope lists openid, oauth will return an id_token.

• The id_token is in a fixed format.
• The token is in JWT.
• Claims are included, if profile and email are in the scopes requested.

 

How to decode the token?

On the wire, the token is encoded.

Visit jwt.io to automatically decode the token (just paste in the encoded text).

https://jwt.io/

 

Header:

This will usually state type:jwt, alg:rs256,kid=key id

Payload:

The payload contains the user claims and includes several critical fields for troubleshooting, if the authentication has issues. 

• Iss = issuer
• aud= audience ie the app that is to receive the token
• iat = issued at time
• exp = expiry time

Check the iat and expiry time for clock skew at the IDP, particularly, if the IDP’s clocks are ahead of the SP.

Bearer Token

The bearer token, is the equivalent of cash.

Possession of the bearer token is all you need, to get what you want, and cash has no identity linked to it.

The other system is called Proof of possession; however this is not widely used, but acts like a visa card, with an identity linked to it.