Contents
When should I use access token and ID token?
Access token used in token-based authentication to gain access to resources by using them as bearer tokens. ID token carries identity information encoded in the token itself, which must be a JWT. It must not contain any authorization information, or any audience information — it is merely an identifier for the user.
What does ID token contain?
The ID Token is a security token that contains Claims about the Authentication of an End-User by an Authorization Server when using a Client, and potentially other requested Claims. The ID Token is represented as a JSON Web Token (JWT). ID Token contains claims about user authentication and other claims.
How is the at _ hash ID token claim defined?
The at_hash ID Token claim is defined by OpenID Connect as such: Access Token hash value. Its value is the base64url encoding of the left-most half of the hash of the octets of the ASCII representation of the access_token value, where the hash algorithm used is the hash algorithm used in the alg Header Parameter of the ID Token’s JOSE Header.
How to validate an access token using the hybrid flow?
The at_hash value is a case sensitive string. The c_hash ID Token claim for the hybrid flow is defined similarly, the same steps can be used to verify either. Steps to generate an at_hash or c_hash from the token:
How to generate hash for Google access token?
Steps to generate an at_hash or c_hash from the token: Hash the ASCII representation of the token using the same alg as the ID Token itself, SHA-256 in Google’s case. Truncate the hash to the first half of the raw hash value (importantly: not the string hex representation of the hash). Base64url encode (without padding) the truncated hash bytes.
How to add custom claims to Microsoft tokens?
Select additional claims to include in tokens for your application. Change the behavior of certain claims that the Microsoft identity platform returns in tokens. Add and access custom claims for your application. For the lists of standard claims, see the access token and id_token claims documentation.