(Delphi DLL) Azure OpenID Connect Step 2 -- Get id_token and Validate

See more OIDC Examples

After getting the endpoints by querying the Azure's OIDC well-known discovery document (OpenID Configuration document), we use the authorization_endpoint to get the id_token, and then validate it..

For more information, see https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-protocols-oidc

Chilkat for Delphi Downloads Chilkat non-ActiveX DLL for Delphi Chilkat ActiveX DLL for Delphi * The examples here use the non-ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Http, Jwt, Hashtable, Prng, Socket, StringBuilder, JsonObject, PublicKey, HttpRequest, Task;

...

procedure TForm1.Button1Click(Sender: TObject);
var
success: Boolean;
authorization_endpoint: PWideChar;
jwks_uri: PWideChar;
req: HCkHttpRequest;
prng: HCkPrng;
encodedParams: PWideChar;
sbUrl: HCkStringBuilder;
url: PWideChar;
listenSock: HCkSocket;
backLog: Integer;
maxWaitMs: Integer;
task: HCkTask;
sock: HCkSocket;
startLine: PWideChar;
requestHeader: PWideChar;
sbRequestBody: HCkStringBuilder;
sbResponseHtml: HCkStringBuilder;
sbResponse: HCkStringBuilder;
hashTab: HCkHashtable;
idToken: PWideChar;
jwt: HCkJwt;
leeway: Integer;
bTimeValid: Boolean;
payload: PWideChar;
json: HCkJsonObject;
joseHeader: PWideChar;
jsonJoseHeader: HCkJsonObject;
sbJwks: HCkStringBuilder;
http: HCkHttp;
jwkset: HCkJsonObject;
kid: PWideChar;
jwk: HCkJsonObject;
verified: Boolean;
pubkey: HCkPublicKey;

begin
// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// In our previous example (Azure Fetch OpenID Connect metadata document) we fetched
// the OpenID configuration document which is JSON which contains an entry for authorization_endpoint.

authorization_endpoint := 'https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/oauth2/v2.0/authorize';

// The OpenID Connect metadata document also contained a jwks_uri entry.  This is the JSON Web Key Set (JWKS),
// which is a set of keys containing the public keys used to verify any JSON Web Token (JWT) (in this case the id_token)
// issued by the authorization server and signed using the RS256 signing algorithm. 
jwks_uri := 'https://login.microsoftonline.com/6d8ddd66-68d1-44b0-af5c-e31b4b7ee5cd/discovery/v2.0/keys';

// We're going to send the following GET request, but it will be sent through an interactive web browser (not by Chilkat).
// The following code will form the URL that is to be programmatically loaded and sent in a browser.

// GET https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?
// client_id=6731de76-14a6-49ae-97bc-6eba6914391e
// &response_type=id_token
// &redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F
// &response_mode=form_post
// &scope=openid
// &state=12345
// &nonce=678910

// Use this object to set params and then get the URL-encoded query params string 
req := CkHttpRequest_Create();
CkHttpRequest_AddParam(req,'client_id','f125d695-c50e-456e-a579-a486f06d1213');
CkHttpRequest_AddParam(req,'response_type','id_token');
CkHttpRequest_AddParam(req,'redirect_uri','http://localhost:3017/');
CkHttpRequest_AddParam(req,'response_mode','form_post');
CkHttpRequest_AddParam(req,'scope','openid');
prng := CkPrng_Create();
CkHttpRequest_AddParam(req,'state',CkPrng__genRandom(prng,3,'decimal'));
CkHttpRequest_AddParam(req,'nonce',CkPrng__genRandom(prng,4,'decimal'));

encodedParams := CkHttpRequest__getUrlEncodedParams(req);
Memo1.Lines.Add(encodedParams);

// Sample URL encoded params:
// client_id=6731de76-14a6-49ae-97bc-6eba6914391e&redirect_uri=http%3A%2F%2Flocalhost%3A3017%2F&response_mode=form_post&scope=openid&state=3572902&nonce=57352474

// This is the URL to be programmatically loaded and sent in an interactive web browser..
sbUrl := CkStringBuilder_Create();
CkStringBuilder_Append(sbUrl,authorization_endpoint);
CkStringBuilder_Append(sbUrl,'?');
CkStringBuilder_Append(sbUrl,encodedParams);
url := CkStringBuilder__getAsString(sbUrl);

// Before we launch the browser with the contents of sbUrl, create a socket to listen for the eventual callback..

listenSock := CkSocket_Create();

// Listen at the port indicated by the redirect_uri above.
backLog := 5;
success := CkSocket_BindAndListen(listenSock,3017,backLog);
if (success <> True) then
  begin
    Memo1.Lines.Add(CkSocket__lastErrorText(listenSock));
    Exit;
  end;

// Wait for the browser's connection in a background thread.
// (We'll send load the URL into the browser following this..)
// Wait a max of 60 seconds before giving up.
maxWaitMs := 60000;
task := CkSocket_AcceptNextConnectionAsync(listenSock,maxWaitMs);
CkTask_Run(task);

// -------------------------------------------------------------------
// At this point, your application should load the URL in a browser.
// You'll need to add code here to do it..

// For example, 
// in C#: System.Diagnostics.Process.Start(url);
// in Java: Desktop.getDesktop().browse(new URI(url));
// in VBScript: Set wsh=WScript.CreateObject("WScript.Shell")
//              wsh.Run url
// in Xojo: ShowURL(url)  (see http://docs.xojo.com/index.php/ShowURL)
// in Dataflex: Runprogram Background "c:\Program Files\Internet Explorer\iexplore.exe" sUrl        
// The account owner would interactively accept or deny the authorization request.

// Add the code to load the url in a web browser here...
// Add the code to load the url in a web browser here...
// Add the code to load the url in a web browser here...
// System.Diagnostics.Process.Start(url);

// -------------------------------------------------------------------

// Wait for the listenSock's task to complete.
success := CkTask_Wait(task,maxWaitMs);
if (not success or (CkTask_getStatusInt(task) <> 7) or (CkTask_getTaskSuccess(task) <> True)) then
  begin
    if (not success) then
      begin
        // The task.LastErrorText applies to the Wait method call.
        Memo1.Lines.Add(CkTask__lastErrorText(task));
      end
    else
      begin
        // The ResultErrorText applies to the underlying task method call (i.e. the AcceptNextConnection)
        Memo1.Lines.Add(CkTask__status(task));
        Memo1.Lines.Add(CkTask__resultErrorText(task));
      end;
    CkTask_Dispose(task);
    Exit;
  end;

// If we get to this point, a connection on listenSock was accepted, and the redirected POST
// is waiting to be read on the connected socket.
// The POST we are going to read contains the following:

// POST /myapp/ HTTP/1.1
// Host: localhost
// Content-Type: application/x-www-form-urlencoded
// 
// id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ik1uQ19WWmNB...&state=12345

// But first.. we no longer need the listen socket...
// Stop listening on port 3017.
CkSocket_Close(listenSock,10);

// Get the connected socket.
sock := CkSocket_Create();
CkSocket_LoadTaskResult(sock,task);
CkTask_Dispose(task);

// We're acting as a temporary web server to receive this one redirected HTTP request..
// Read the start line of the request.. (i.e. the "POST /myapp/ HTTP/1.1")
startLine := CkSocket__receiveUntilMatch(sock,#13#10);
if (CkSocket_getLastMethodSuccess(sock) <> True) then
  begin
    Memo1.Lines.Add(CkSocket__lastErrorText(sock));
    Exit;
  end;

// Read the request header.
requestHeader := CkSocket__receiveUntilMatch(sock,#13#10 + #13#10);
if (CkSocket_getLastMethodSuccess(sock) <> True) then
  begin
    Memo1.Lines.Add(CkSocket__lastErrorText(sock));
    Exit;
  end;

Memo1.Lines.Add(requestHeader);
Memo1.Lines.Add('----');

// Read the body.
// The body will contain "id_token= eyJ......"
sbRequestBody := CkStringBuilder_Create();
success := CkSocket_ReceiveSb(sock,sbRequestBody);
if (success = False) then
  begin
    Memo1.Lines.Add(CkSocket__lastErrorText(sock));
    Exit;
  end;

Memo1.Lines.Add(CkStringBuilder__getAsString(sbRequestBody));

// Given that we're acting as a web server, we must send a response..
// We can now send our HTTP response.
sbResponseHtml := CkStringBuilder_Create();
CkStringBuilder_Append(sbResponseHtml,'<html><body><p>Thank you!</b></body</html>');

sbResponse := CkStringBuilder_Create();
CkStringBuilder_Append(sbResponse,'HTTP/1.1 200 OK' + #13#10);
CkStringBuilder_Append(sbResponse,'Content-Length: ');
CkStringBuilder_AppendInt(sbResponse,CkStringBuilder_getLength(sbResponseHtml));
CkStringBuilder_Append(sbResponse,#13#10);
CkStringBuilder_Append(sbResponse,'Content-Type: text/html' + #13#10);
CkStringBuilder_Append(sbResponse,#13#10);
CkStringBuilder_AppendSb(sbResponse,sbResponseHtml);

CkSocket_SendString(sock,CkStringBuilder__getAsString(sbResponse));
CkSocket_Close(sock,50);

// Get the id_token from the sbRequestBody that we just received.
// (Remember, we're acting as the web server, thus we received the redirect request..)
hashTab := CkHashtable_Create();
CkHashtable_AddQueryParams(hashTab,CkStringBuilder__getAsString(sbRequestBody));

// See https://docs.microsoft.com/en-us/azure/active-directory/develop/id-tokens#validating-an-id-token
// for more information about ID tokens..
idToken := CkHashtable__lookupStr(hashTab,'id_token');

jwt := CkJwt_Create();

// Let's see if the time constraints, if any, are valid.
// The above JWT was created on the afternoon of 16-May-2016, with an expiration of 1 hour.
// If the current system time is before the "nbf" time, or after the "exp" time,
// then IsTimeValid will return false/0.
// Also, we'll allow a leeway of 60 seconds to account for any clock skew.
// Note: If the token has no "nbf" or "exp" claim fields, then IsTimeValid is always true.
leeway := 60;
bTimeValid := CkJwt_IsTimeValid(jwt,idToken,leeway);
Memo1.Lines.Add('time constraints valid: ' + IntToStr(Ord(bTimeValid)));

// Now let's recover the original claims JSON (the payload).
payload := CkJwt__getPayload(jwt,idToken);
// The payload will likely be in compact form:
Memo1.Lines.Add(payload);

// We can format for human viewing by loading it into Chilkat's JSON object
// and emit.
json := CkJsonObject_Create();
success := CkJsonObject_Load(json,payload);
CkJsonObject_putEmitCompact(json,False);
Memo1.Lines.Add(CkJsonObject__emit(json));

// Sample output:

// {
//   "aud": "f125d695-c50e-456e-a579-a486f06d1213",
//   "iss": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0",
//   "iat": 1626535322,
//   "nbf": 1626535322,
//   "exp": 1626539222,
//   "aio": "AWQAm/8TAAAAHQncmY0VvhgyMIhfleHX3DjsGfmlPM1CopkJ3mPnBUnCxrJ0ubruaACEhwGO7NsoHBhqFEzRzPxOq7MtuGVFsql+qJKZx8vQCszKYEPX9Wb3b5+d5KJTABHCIH48bTFd",
//   "idp": "https://sts.windows.net/9188040d-6c67-4c5b-b112-36a304b66dad/",
//   "nonce": "1519043321",
//   "rh": "0.ARgAZt2NbdFosEOvXOMbS33VzZXWJfEOxW5FpXmkhvBtEhMYALQ.",
//   "sub": "RMIZlHJ7hfsJmL8Qq3h6M0nPi4g-HEavnAFgxzaT2KM",
//   "tid": "6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd",
//   "uti": "-BXGHxvfREW-r9HI5NBiAA",
//   "ver": "2.0"
// }

// We can recover the original JOSE header in the same way:
joseHeader := CkJwt__getHeader(jwt,idToken);
// The payload will likely be in compact form:
Memo1.Lines.Add(joseHeader);

// We can format for human viewing by loading it into Chilkat's JSON object
// and emit.
jsonJoseHeader := CkJsonObject_Create();
success := CkJsonObject_Load(jsonJoseHeader,joseHeader);
CkJsonObject_putEmitCompact(jsonJoseHeader,False);
Memo1.Lines.Add(CkJsonObject__emit(jsonJoseHeader));

// Sample output:

// {
//   "typ": "JWT",
//   "alg": "RS256",
//   "kid": "nOo3ZDrODXEK1jKWhXslHR_KXEg"
// }

// Finally, we need to fetch the JSON Web Key Sets from the jwks_uri
// and use it to verify the id_token's RSA signature.
sbJwks := CkStringBuilder_Create();
http := CkHttp_Create();
success := CkHttp_QuickGetSb(http,jwks_uri,sbJwks);
if (success = False) then
  begin
    Memo1.Lines.Add(CkHttp__lastErrorText(http));
    Exit;
  end;

jwkset := CkJsonObject_Create();
success := CkJsonObject_LoadSb(jwkset,sbJwks);
CkJsonObject_putEmitCompact(jwkset,False);
Memo1.Lines.Add(CkJsonObject__emit(jwkset));

// A sample jwkset:

// {
//   "keys": [
//     {
//       "kty": "RSA",
//       "use": "sig",
//       "kid": "nOo3ZDrODXEK1jKWhXslHR_KXEg",
//       "x5t": "nOo3ZDrODXEK1jKWhXslHR_KXEg",
//       "n": "oaLLT9hkcSj ... NVrZdUdTBQ",
//       "e": "AQAB",
//       "x5c": [
//         "MIIDBTC ... MRku44Dw7R"
//       ],
//       "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
//     },
//     {
//       "kty": "RSA",
//       "use": "sig",
//       "kid": "l3sQ-50cCH4xBVZLHTGwnSR7680",
//       "x5t": "l3sQ-50cCH4xBVZLHTGwnSR7680",
//       "n": "sfsXMXW ... AYkwb6xUQ",
//       "e": "AQAB",
//       "x5c": [
//         "MIIDBTCCA ... BWrh+/vJ"
//       ],
//       "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
//     },
//     {
//       "kty": "RSA",
//       "use": "sig",
//       "kid": "DqUu8gf-nAgcyjP3-SuplNAXAnc",
//       "x5t": "DqUu8gf-nAgcyjP3-SuplNAXAnc",
//       "n": "1n7-nWSL ... V3pFWhQ",
//       "e": "AQAB",
//       "x5c": [
//         "MIIC8TC ... 9pIcnkPQ=="
//       ],
//       "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
//     },
//     {
//       "kty": "RSA",
//       "use": "sig",
//       "kid": "OzZ5Dbmcso9Qzt2ModGmihg30Bo",
//       "x5t": "OzZ5Dbmcso9Qzt2ModGmihg30Bo",
//       "n": "01re9a2BU ... 5OzQ6Q",
//       "e": "AQAB",
//       "x5c": [
//         "MIIC8TC ... YmwJ6sDdRvQ=="
//       ],
//       "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
//     }
//   ]
// }

// We should have an RSA key with kid matching the kid from the joseHeader..
kid := CkJsonObject__stringOf(jsonJoseHeader,'kid');

// Find the RSA key with the specified key id
jwk := CkJsonObject_FindRecord(jwkset,'keys','kid',kid,True);
if (CkJsonObject_getLastMethodSuccess(jwkset) = False) then
  begin
    Memo1.Lines.Add('Failed to find a matching RSA key in the JWK key set...');
    Exit;
  end;

pubkey := CkPublicKey_Create();

success := CkPublicKey_LoadFromString(pubkey,CkJsonObject__emit(jwk));
if (success = False) then
  begin
    Memo1.Lines.Add(CkPublicKey__lastErrorText(pubkey));
    Memo1.Lines.Add(CkJsonObject__emit(jwk));
  end
else
  begin
    verified := CkJwt_VerifyJwtPk(jwt,idToken,pubkey);
    Memo1.Lines.Add('Verified: ' + IntToStr(Ord(verified)));
  end;

CkJsonObject_Dispose(jwk);

CkHttpRequest_Dispose(req);
CkPrng_Dispose(prng);
CkStringBuilder_Dispose(sbUrl);
CkSocket_Dispose(listenSock);
CkSocket_Dispose(sock);
CkStringBuilder_Dispose(sbRequestBody);
CkStringBuilder_Dispose(sbResponseHtml);
CkStringBuilder_Dispose(sbResponse);
CkHashtable_Dispose(hashTab);
CkJwt_Dispose(jwt);
CkJsonObject_Dispose(json);
CkJsonObject_Dispose(jsonJoseHeader);
CkStringBuilder_Dispose(sbJwks);
CkHttp_Dispose(http);
CkJsonObject_Dispose(jwkset);
CkPublicKey_Dispose(pubkey);

end;