Lua Requires Chilkat v11.0.0+
Lua
Azure OpenID Connect Step 2 -- Get id_token and Validate
See more OIDC Examples
After getting the endpoints by querying the Azure's OIDC well-known discovery document (OpenID Configuration document), we use the authorization_endpoint to get the id_token, and then validate it..Chilkat Lua Downloads
-- In the following call to loadlib, change the path (./chilkat.dll) to the relative or absolute directory where the chilkat.dll, chilkat.so, or chilkat.dylib is located.
chilkat = assert(package.loadlib("./chilkat.dll", "luaopen_chilkat"))()
print(chilkat._VERSION)
local success = false
-- This example requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.
-- In our previous example (Azure Fetch OpenID Connect metadata document) we fetched
-- the OpenID configuration document which is JSON which contains an entry for authorization_endpoint.
local authorization_endpoint = "https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize"
-- The OpenID Connect metadata document also contained a jwks_uri entry. This is the JSON Web Key Set (JWKS),
-- which is a set of keys containing the public keys used to verify any JSON Web Token (JWT) (in this case the id_token)
-- issued by the authorization server and signed using the RS256 signing algorithm.
local jwks_uri = "https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys"
-- We're going to send the following GET request, but it will be sent through an interactive web browser (not by Chilkat).
-- The following code will form the URL that is to be programmatically loaded and sent in a browser.
-- GET https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?
-- client_id=6731de76-14a6-49ae-97bc-6eba6914391e
-- &response_type=id_token
-- &redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F
-- &response_mode=form_post
-- &scope=openid
-- &state=12345
-- &nonce=678910
-- Use this object to set params and then get the URL-encoded query params string
local req = chilkat.newHttpRequest{}
req:AddParam("client_id","{client_id}")
req:AddParam("response_type","id_token")
req:AddParam("redirect_uri","http://localhost:3017/")
req:AddParam("response_mode","form_post")
req:AddParam("scope","openid")
local prng = chilkat.newPrng{}
req:AddParam("state",prng:GenRandom(3,"decimal"))
req:AddParam("nonce",prng:GenRandom(4,"decimal"))
local encodedParams = req:GetUrlEncodedParams()
print(encodedParams)
-- Sample URL encoded params:
-- client_id=6731de76-14a6-49ae-97bc-6eba6914391e&redirect_uri=http%3A%2F%2Flocalhost%3A3017%2F&response_mode=form_post&scope=openid&state=3572902&nonce=57352474
-- This is the URL to be programmatically loaded and sent in an interactive web browser..
local sbUrl = chilkat.newStringBuilder{}
sbUrl:Append(authorization_endpoint)
sbUrl:Append("?")
sbUrl:Append(encodedParams)
local url = sbUrl:GetAsString()
-- Before we launch the browser with the contents of sbUrl, create a socket to listen for the eventual callback..
local listenSock = chilkat.newSocket{}
-- This is the connection received from the browser.
local browserSock = chilkat.newSocket{}
-- Listen at the port indicated by the redirect_uri above.
local backLog = 5
success = listenSock:BindAndListen(3017,backLog)
if success == false then
print(listenSock:LastErrorText())
end
-- Wait for the browser's connection in a background thread.
-- (We'll send load the URL into the browser following this..)
-- Wait a max of 60 seconds before giving up.
local maxWaitMs = 30000
local task = listenSock:AcceptNextAsync(maxWaitMs,browserSock)
task:Run()
-- -------------------------------------------------------------------
-- At this point, your application should load the URL in a browser.
local oauth2 = chilkat.newOAuth2{}
success = oauth2:LaunchBrowser(url)
if success == false then
print(oauth2:LastErrorText())
end
-- -------------------------------------------------------------------
-- Wait for the listenSock's task to complete.
success = task:Wait(maxWaitMs)
if !success || (task:StatusInt() ~= 7) || (task:TaskSuccess() ~= true) then
if !success then
-- The task.LastErrorText applies to the Wait method call.
print(task:LastErrorText())
else
-- The ResultErrorText applies to the underlying task method call (i.e. the AcceptNextConnection)
print(task:Status())
print(task:ResultErrorText())
end
end
-- If we get to this point, a connection on listenSock was accepted, and the redirected POST
-- is waiting to be read on the connected socket.
-- The POST we are going to read contains the following:
-- POST /myapp/ HTTP/1.1
-- Host: localhost
-- Content-Type: application/x-www-form-urlencoded
--
-- id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ik1uQ19WWmNB...&state=12345
-- But first.. we no longer need the listen socket...
-- Stop listening on port 3017.
listenSock:Close(10)
-- We're acting as a temporary web server to receive this one redirected HTTP request..
-- Read the start line of the request.. (i.e. the "POST /myapp/ HTTP/1.1")
local startLine = browserSock:ReceiveUntilMatch("\r\n")
if browserSock:LastMethodSuccess() == false then
print(browserSock:LastErrorText())
end
-- Read the request header.
local requestHeader = browserSock:ReceiveUntilMatch("\r\n\r\n")
if browserSock:LastMethodSuccess() == false then
print(browserSock:LastErrorText())
end
print(requestHeader)
print("----")
-- Read the body.
-- The body will contain "id_token= eyJ......"
local sbRequestBody = chilkat.newStringBuilder{}
success = browserSock:ReceiveSb(sbRequestBody)
if success == false then
print(browserSock:LastErrorText())
end
print(sbRequestBody:GetAsString())
-- Given that we're acting as a web server, we must send a response..
-- We can now send our HTTP response.
local sbResponseHtml = chilkat.newStringBuilder{}
sbResponseHtml:Append("<html><body><p>Thank you!</b></body</html>")
local sbResponse = chilkat.newStringBuilder{}
sbResponse:Append("HTTP/1.1 200 OK\r\n")
sbResponse:Append("Content-Length: ")
sbResponse:AppendInt(sbResponseHtml:Length())
sbResponse:Append("\r\n")
sbResponse:Append("Content-Type: text/html\r\n")
sbResponse:Append("\r\n")
sbResponse:AppendSb(sbResponseHtml)
browserSock:SendString(sbResponse:GetAsString())
browserSock:Close(50)
-- Get the id_token from the sbRequestBody that we just received.
-- (Remember, we're acting as the web server, thus we received the redirect request..)
local hashTab = chilkat.newHashtable{}
hashTab:AddQueryParams(sbRequestBody:GetAsString())
-- See https://docs.microsoft.com/en-us/azure/active-directory/develop/id-tokens#validating-an-id-token
-- for more information about ID tokens..
local idToken = hashTab:LookupStr("id_token")
local jwt = chilkat.newJwt{}
-- Let's see if the time constraints, if any, are valid.
-- The above JWT was created on the afternoon of 16-May-2016, with an expiration of 1 hour.
-- If the current system time is before the "nbf" time, or after the "exp" time,
-- then IsTimeValid will return false/0.
-- Also, we'll allow a leeway of 60 seconds to account for any clock skew.
-- Note: If the token has no "nbf" or "exp" claim fields, then IsTimeValid is always true.
local leeway = 60
local bTimeValid = jwt:IsTimeValid(idToken,leeway)
print("time constraints valid: ", bTimeValid)
-- Now let's recover the original claims JSON (the payload).
local payload = jwt:GetPayload(idToken)
-- The payload will likely be in compact form:
print(payload)
-- We can format for human viewing by loading it into Chilkat's JSON object
-- and emit.
local json = chilkat.newJsonObject{}
success = json:Load(payload)
json:setEmitCompact(false)
print(json:Emit())
-- Sample output:
-- {
-- "aud": "f125d695-c50e-456e-a579-a486f06d1213",
-- "iss": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0",
-- "iat": 1626535322,
-- "nbf": 1626535322,
-- "exp": 1626539222,
-- "aio": "AWQAm/8TAAAAHQncmY0VvhgyMIhfleHX3DjsGfmlPM1CopkJ3mPnBUnCxrJ0ubruaACEhwGO7NsoHBhqFEzRzPxOq7MtuGVFsql+qJKZx8vQCszKYEPX9Wb3b5+d5KJTABHCIH48bTFd",
-- "idp": "https://sts.windows.net/9188040d-6c67-4c5b-b112-36a304b66dad/",
-- "nonce": "1519043321",
-- "rh": "0.ARgAZt2NbdFosEOvXOMbS33VzZXWJfEOxW5FpXmkhvBtEhMYALQ.",
-- "sub": "RMIZlHJ7hfsJmL8Qq3h6M0nPi4g-HEavnAFgxzaT2KM",
-- "tid": "6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd",
-- "uti": "-BXGHxvfREW-r9HI5NBiAA",
-- "ver": "2.0"
-- }
-- We can recover the original JOSE header in the same way:
local joseHeader = jwt:GetHeader(idToken)
-- The payload will likely be in compact form:
print(joseHeader)
-- We can format for human viewing by loading it into Chilkat's JSON object
-- and emit.
local jsonJoseHeader = chilkat.newJsonObject{}
success = jsonJoseHeader:Load(joseHeader)
jsonJoseHeader:setEmitCompact(false)
print(jsonJoseHeader:Emit())
-- Sample output:
-- {
-- "typ": "JWT",
-- "alg": "RS256",
-- "kid": "nOo3ZDrODXEK1jKWhXslHR_KXEg"
-- }
-- Finally, we need to fetch the JSON Web Key Sets from the jwks_uri
-- and use it to verify the id_token's RSA signature.
local sbJwks = chilkat.newStringBuilder{}
local http = chilkat.newHttp{}
success = http:QuickGetSb(jwks_uri,sbJwks)
if success == false then
print(http:LastErrorText())
end
local jwkset = chilkat.newJsonObject{}
success = jwkset:LoadSb(sbJwks)
jwkset:setEmitCompact(false)
print(jwkset:Emit())
-- A sample jwkset:
-- {
-- "keys": [
-- {
-- "kty": "RSA",
-- "use": "sig",
-- "kid": "nOo3ZDrODXEK1jKWhXslHR_KXEg",
-- "x5t": "nOo3ZDrODXEK1jKWhXslHR_KXEg",
-- "n": "oaLLT9hkcSj ... NVrZdUdTBQ",
-- "e": "AQAB",
-- "x5c": [
-- "MIIDBTC ... MRku44Dw7R"
-- ],
-- "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
-- },
-- {
-- "kty": "RSA",
-- "use": "sig",
-- "kid": "l3sQ-50cCH4xBVZLHTGwnSR7680",
-- "x5t": "l3sQ-50cCH4xBVZLHTGwnSR7680",
-- "n": "sfsXMXW ... AYkwb6xUQ",
-- "e": "AQAB",
-- "x5c": [
-- "MIIDBTCCA ... BWrh+/vJ"
-- ],
-- "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
-- },
-- {
-- "kty": "RSA",
-- "use": "sig",
-- "kid": "DqUu8gf-nAgcyjP3-SuplNAXAnc",
-- "x5t": "DqUu8gf-nAgcyjP3-SuplNAXAnc",
-- "n": "1n7-nWSL ... V3pFWhQ",
-- "e": "AQAB",
-- "x5c": [
-- "MIIC8TC ... 9pIcnkPQ=="
-- ],
-- "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
-- },
-- {
-- "kty": "RSA",
-- "use": "sig",
-- "kid": "OzZ5Dbmcso9Qzt2ModGmihg30Bo",
-- "x5t": "OzZ5Dbmcso9Qzt2ModGmihg30Bo",
-- "n": "01re9a2BU ... 5OzQ6Q",
-- "e": "AQAB",
-- "x5c": [
-- "MIIC8TC ... YmwJ6sDdRvQ=="
-- ],
-- "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
-- }
-- ]
-- }
-- We should have an RSA key with kid matching the kid from the joseHeader..
local kid = jsonJoseHeader:StringOf("kid")
-- Find the RSA key with the specified key id
local jwk = jwkset:FindRecord("keys","kid",kid,true)
if jwkset:LastMethodSuccess() == false then
print("Failed to find a matching RSA key in the JWK key set...")
end
local pubkey = chilkat.newPublicKey{}
success = pubkey:LoadFromString(jwk:Emit())
if success == false then
print(pubkey:LastErrorText())
print(jwk:Emit())
else
local verified = jwt:VerifyJwtPk(idToken,pubkey)
print("Verified: ", verified)
end