(Visual FoxPro) Azure OpenID Connect Step 2 -- Get id_token and Validate

See more OIDC Examples

After getting the endpoints by querying the Azure's OIDC well-known discovery document (OpenID Configuration document), we use the authorization_endpoint to get the id_token, and then validate it..

For more information, see https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-protocols-oidc

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

LOCAL lnSuccess
LOCAL lcAuthorization_endpoint
LOCAL lcJwks_uri
LOCAL loReq
LOCAL loPrng
LOCAL lcEncodedParams
LOCAL loSbUrl
LOCAL lcUrl
LOCAL loListenSock
LOCAL lnBackLog
LOCAL lnMaxWaitMs
LOCAL loTask
LOCAL loSock
LOCAL lcStartLine
LOCAL lcRequestHeader
LOCAL loSbRequestBody
LOCAL loSbResponseHtml
LOCAL loSbResponse
LOCAL loHashTab
LOCAL lcIdToken
LOCAL loJwt
LOCAL lnLeeway
LOCAL lnBTimeValid
LOCAL lcPayload
LOCAL loJson
LOCAL lcJoseHeader
LOCAL loJsonJoseHeader
LOCAL loSbJwks
LOCAL loHttp
LOCAL loJwkset
LOCAL lcKid
LOCAL loJwk
LOCAL lnVerified
LOCAL loPubkey

* This example requires the Chilkat API to have been previously unlocked.
* See Global Unlock Sample for sample code.

* In our previous example (Azure Fetch OpenID Connect metadata document) we fetched
* the OpenID configuration document which is JSON which contains an entry for authorization_endpoint.

lcAuthorization_endpoint = "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/oauth2/v2.0/authorize"

* The OpenID Connect metadata document also contained a jwks_uri entry.  This is the JSON Web Key Set (JWKS),
* which is a set of keys containing the public keys used to verify any JSON Web Token (JWT) (in this case the id_token)
* issued by the authorization server and signed using the RS256 signing algorithm. 
lcJwks_uri = "https://login.microsoftonline.com/6d8ddd66-68d1-44b0-af5c-e31b4b7ee5cd/discovery/v2.0/keys"

* We're going to send the following GET request, but it will be sent through an interactive web browser (not by Chilkat).
* The following code will form the URL that is to be programmatically loaded and sent in a browser.

* GET https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?
* client_id=6731de76-14a6-49ae-97bc-6eba6914391e
* &response_type=id_token
* &redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F
* &response_mode=form_post
* &scope=openid
* &state=12345
* &nonce=678910

* Use this object to set params and then get the URL-encoded query params string 
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.HttpRequest')
loReq = CreateObject('Chilkat.HttpRequest')
loReq.AddParam("client_id","f125d695-c50e-456e-a579-a486f06d1213")
loReq.AddParam("response_type","id_token")
loReq.AddParam("redirect_uri","http://localhost:3017/")
loReq.AddParam("response_mode","form_post")
loReq.AddParam("scope","openid")
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Prng')
loPrng = CreateObject('Chilkat.Prng')
loReq.AddParam("state",loPrng.GenRandom(3,"decimal"))
loReq.AddParam("nonce",loPrng.GenRandom(4,"decimal"))

lcEncodedParams = loReq.GetUrlEncodedParams()
? lcEncodedParams

* Sample URL encoded params:
* client_id=6731de76-14a6-49ae-97bc-6eba6914391e&redirect_uri=http%3A%2F%2Flocalhost%3A3017%2F&response_mode=form_post&scope=openid&state=3572902&nonce=57352474

* This is the URL to be programmatically loaded and sent in an interactive web browser..
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.StringBuilder')
loSbUrl = CreateObject('Chilkat.StringBuilder')
loSbUrl.Append(lcAuthorization_endpoint)
loSbUrl.Append("?")
loSbUrl.Append(lcEncodedParams)
lcUrl = loSbUrl.GetAsString()

* Before we launch the browser with the contents of sbUrl, create a socket to listen for the eventual callback..

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Socket')
loListenSock = CreateObject('Chilkat.Socket')

* Listen at the port indicated by the redirect_uri above.
lnBackLog = 5
lnSuccess = loListenSock.BindAndListen(3017,lnBackLog)
IF (lnSuccess <> 1) THEN
    ? loListenSock.LastErrorText
    RELEASE loReq
    RELEASE loPrng
    RELEASE loSbUrl
    RELEASE loListenSock
    CANCEL
ENDIF

* Wait for the browser's connection in a background thread.
* (We'll send load the URL into the browser following this..)
* Wait a max of 60 seconds before giving up.
lnMaxWaitMs = 60000
loTask = loListenSock.AcceptNextConnectionAsync(lnMaxWaitMs)
loTask.Run()

* -------------------------------------------------------------------
* At this point, your application should load the URL in a browser.
* You'll need to add code here to do it..

* For example, 
* in C#: System.Diagnostics.Process.Start(url);
* in Java: Desktop.getDesktop().browse(new URI(url));
* in VBScript: Set wsh=WScript.CreateObject("WScript.Shell")
*              wsh.Run url
* in Xojo: ShowURL(url)  (see http://docs.xojo.com/index.php/ShowURL)
* in Dataflex: Runprogram Background "c:\Program Files\Internet Explorer\iexplore.exe" sUrl        
* The account owner would interactively accept or deny the authorization request.

* Add the code to load the url in a web browser here...
* Add the code to load the url in a web browser here...
* Add the code to load the url in a web browser here...
* System.Diagnostics.Process.Start(url);

* -------------------------------------------------------------------

* Wait for the listenSock's task to complete.
lnSuccess = loTask.Wait(lnMaxWaitMs)
IF (NOT lnSuccess OR (loTask.StatusInt <> 7) OR (loTask.TaskSuccess <> 1)) THEN
    IF (NOT lnSuccess) THEN
        * The task.LastErrorText applies to the Wait method call.
        ? loTask.LastErrorText
    ELSE
        * The ResultErrorText applies to the underlying task method call (i.e. the AcceptNextConnection)
        ? loTask.Status
        ? loTask.ResultErrorText
    ENDIF

    RELEASE loTask
    RELEASE loReq
    RELEASE loPrng
    RELEASE loSbUrl
    RELEASE loListenSock
    CANCEL
ENDIF

* If we get to this point, a connection on listenSock was accepted, and the redirected POST
* is waiting to be read on the connected socket.
* The POST we are going to read contains the following:

* POST /myapp/ HTTP/1.1
* Host: localhost
* Content-Type: application/x-www-form-urlencoded
* 
* id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ik1uQ19WWmNB...&state=12345

* But first.. we no longer need the listen socket...
* Stop listening on port 3017.
loListenSock.Close(10)

* Get the connected socket.
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Socket')
loSock = CreateObject('Chilkat.Socket')
loSock.LoadTaskResult(loTask)
RELEASE loTask

* We're acting as a temporary web server to receive this one redirected HTTP request..
* Read the start line of the request.. (i.e. the "POST /myapp/ HTTP/1.1")
lcStartLine = loSock.ReceiveUntilMatch(CHR(13) + CHR(10))
IF (loSock.LastMethodSuccess <> 1) THEN
    ? loSock.LastErrorText
    RELEASE loReq
    RELEASE loPrng
    RELEASE loSbUrl
    RELEASE loListenSock
    RELEASE loSock
    CANCEL
ENDIF

* Read the request header.
lcRequestHeader = loSock.ReceiveUntilMatch(CHR(13) + CHR(10) + CHR(13) + CHR(10))
IF (loSock.LastMethodSuccess <> 1) THEN
    ? loSock.LastErrorText
    RELEASE loReq
    RELEASE loPrng
    RELEASE loSbUrl
    RELEASE loListenSock
    RELEASE loSock
    CANCEL
ENDIF

? lcRequestHeader
? "----"

* Read the body.
* The body will contain "id_token= eyJ......"
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.StringBuilder')
loSbRequestBody = CreateObject('Chilkat.StringBuilder')
lnSuccess = loSock.ReceiveSb(loSbRequestBody)
IF (lnSuccess = 0) THEN
    ? loSock.LastErrorText
    RELEASE loReq
    RELEASE loPrng
    RELEASE loSbUrl
    RELEASE loListenSock
    RELEASE loSock
    RELEASE loSbRequestBody
    CANCEL
ENDIF

? loSbRequestBody.GetAsString()

* Given that we're acting as a web server, we must send a response..
* We can now send our HTTP response.
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.StringBuilder')
loSbResponseHtml = CreateObject('Chilkat.StringBuilder')
loSbResponseHtml.Append("<html><body><p>Thank you!</b></body</html>")

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.StringBuilder')
loSbResponse = CreateObject('Chilkat.StringBuilder')
loSbResponse.Append("HTTP/1.1 200 OK" + CHR(13) + CHR(10))
loSbResponse.Append("Content-Length: ")
loSbResponse.AppendInt(loSbResponseHtml.Length)
loSbResponse.Append(CHR(13) + CHR(10))
loSbResponse.Append("Content-Type: text/html" + CHR(13) + CHR(10))
loSbResponse.Append(CHR(13) + CHR(10))
loSbResponse.AppendSb(loSbResponseHtml)

loSock.SendString(loSbResponse.GetAsString())
loSock.Close(50)

* Get the id_token from the sbRequestBody that we just received.
* (Remember, we're acting as the web server, thus we received the redirect request..)
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Hashtable')
loHashTab = CreateObject('Chilkat.Hashtable')
loHashTab.AddQueryParams(loSbRequestBody.GetAsString())

* See https://docs.microsoft.com/en-us/azure/active-directory/develop/id-tokens#validating-an-id-token
* for more information about ID tokens..
lcIdToken = loHashTab.LookupStr("id_token")

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Jwt')
loJwt = CreateObject('Chilkat.Jwt')

* Let's see if the time constraints, if any, are valid.
* The above JWT was created on the afternoon of 16-May-2016, with an expiration of 1 hour.
* If the current system time is before the "nbf" time, or after the "exp" time,
* then IsTimeValid will return false/0.
* Also, we'll allow a leeway of 60 seconds to account for any clock skew.
* Note: If the token has no "nbf" or "exp" claim fields, then IsTimeValid is always true.
lnLeeway = 60
lnBTimeValid = loJwt.IsTimeValid(lcIdToken,lnLeeway)
? "time constraints valid: " + STR(lnBTimeValid)

* Now let's recover the original claims JSON (the payload).
lcPayload = loJwt.GetPayload(lcIdToken)
* The payload will likely be in compact form:
? lcPayload

* We can format for human viewing by loading it into Chilkat's JSON object
* and emit.
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.JsonObject')
loJson = CreateObject('Chilkat.JsonObject')
lnSuccess = loJson.Load(lcPayload)
loJson.EmitCompact = 0
? loJson.Emit()

* Sample output:

* {
*   "aud": "f125d695-c50e-456e-a579-a486f06d1213",
*   "iss": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0",
*   "iat": 1626535322,
*   "nbf": 1626535322,
*   "exp": 1626539222,
*   "aio": "AWQAm/8TAAAAHQncmY0VvhgyMIhfleHX3DjsGfmlPM1CopkJ3mPnBUnCxrJ0ubruaACEhwGO7NsoHBhqFEzRzPxOq7MtuGVFsql+qJKZx8vQCszKYEPX9Wb3b5+d5KJTABHCIH48bTFd",
*   "idp": "https://sts.windows.net/9188040d-6c67-4c5b-b112-36a304b66dad/",
*   "nonce": "1519043321",
*   "rh": "0.ARgAZt2NbdFosEOvXOMbS33VzZXWJfEOxW5FpXmkhvBtEhMYALQ.",
*   "sub": "RMIZlHJ7hfsJmL8Qq3h6M0nPi4g-HEavnAFgxzaT2KM",
*   "tid": "6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd",
*   "uti": "-BXGHxvfREW-r9HI5NBiAA",
*   "ver": "2.0"
* }

* We can recover the original JOSE header in the same way:
lcJoseHeader = loJwt.GetHeader(lcIdToken)
* The payload will likely be in compact form:
? lcJoseHeader

* We can format for human viewing by loading it into Chilkat's JSON object
* and emit.
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.JsonObject')
loJsonJoseHeader = CreateObject('Chilkat.JsonObject')
lnSuccess = loJsonJoseHeader.Load(lcJoseHeader)
loJsonJoseHeader.EmitCompact = 0
? loJsonJoseHeader.Emit()

* Sample output:

* {
*   "typ": "JWT",
*   "alg": "RS256",
*   "kid": "nOo3ZDrODXEK1jKWhXslHR_KXEg"
* }

* Finally, we need to fetch the JSON Web Key Sets from the jwks_uri
* and use it to verify the id_token's RSA signature.
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.StringBuilder')
loSbJwks = CreateObject('Chilkat.StringBuilder')
* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.Http')
loHttp = CreateObject('Chilkat.Http')
lnSuccess = loHttp.QuickGetSb(lcJwks_uri,loSbJwks)
IF (lnSuccess = 0) THEN
    ? loHttp.LastErrorText
    RELEASE loReq
    RELEASE loPrng
    RELEASE loSbUrl
    RELEASE loListenSock
    RELEASE loSock
    RELEASE loSbRequestBody
    RELEASE loSbResponseHtml
    RELEASE loSbResponse
    RELEASE loHashTab
    RELEASE loJwt
    RELEASE loJson
    RELEASE loJsonJoseHeader
    RELEASE loSbJwks
    RELEASE loHttp
    CANCEL
ENDIF

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.JsonObject')
loJwkset = CreateObject('Chilkat.JsonObject')
lnSuccess = loJwkset.LoadSb(loSbJwks)
loJwkset.EmitCompact = 0
? loJwkset.Emit()

* A sample jwkset:

* {
*   "keys": [
*     {
*       "kty": "RSA",
*       "use": "sig",
*       "kid": "nOo3ZDrODXEK1jKWhXslHR_KXEg",
*       "x5t": "nOo3ZDrODXEK1jKWhXslHR_KXEg",
*       "n": "oaLLT9hkcSj ... NVrZdUdTBQ",
*       "e": "AQAB",
*       "x5c": [
*         "MIIDBTC ... MRku44Dw7R"
*       ],
*       "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
*     },
*     {
*       "kty": "RSA",
*       "use": "sig",
*       "kid": "l3sQ-50cCH4xBVZLHTGwnSR7680",
*       "x5t": "l3sQ-50cCH4xBVZLHTGwnSR7680",
*       "n": "sfsXMXW ... AYkwb6xUQ",
*       "e": "AQAB",
*       "x5c": [
*         "MIIDBTCCA ... BWrh+/vJ"
*       ],
*       "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
*     },
*     {
*       "kty": "RSA",
*       "use": "sig",
*       "kid": "DqUu8gf-nAgcyjP3-SuplNAXAnc",
*       "x5t": "DqUu8gf-nAgcyjP3-SuplNAXAnc",
*       "n": "1n7-nWSL ... V3pFWhQ",
*       "e": "AQAB",
*       "x5c": [
*         "MIIC8TC ... 9pIcnkPQ=="
*       ],
*       "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
*     },
*     {
*       "kty": "RSA",
*       "use": "sig",
*       "kid": "OzZ5Dbmcso9Qzt2ModGmihg30Bo",
*       "x5t": "OzZ5Dbmcso9Qzt2ModGmihg30Bo",
*       "n": "01re9a2BU ... 5OzQ6Q",
*       "e": "AQAB",
*       "x5c": [
*         "MIIC8TC ... YmwJ6sDdRvQ=="
*       ],
*       "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
*     }
*   ]
* }

* We should have an RSA key with kid matching the kid from the joseHeader..
lcKid = loJsonJoseHeader.StringOf("kid")

* Find the RSA key with the specified key id
loJwk = loJwkset.FindRecord("keys","kid",lcKid,1)
IF (loJwkset.LastMethodSuccess = 0) THEN
    ? "Failed to find a matching RSA key in the JWK key set..."
    RELEASE loReq
    RELEASE loPrng
    RELEASE loSbUrl
    RELEASE loListenSock
    RELEASE loSock
    RELEASE loSbRequestBody
    RELEASE loSbResponseHtml
    RELEASE loSbResponse
    RELEASE loHashTab
    RELEASE loJwt
    RELEASE loJson
    RELEASE loJsonJoseHeader
    RELEASE loSbJwks
    RELEASE loHttp
    RELEASE loJwkset
    CANCEL
ENDIF

* For versions of Chilkat < 10.0.0, use CreateObject('Chilkat_9_5_0.PublicKey')
loPubkey = CreateObject('Chilkat.PublicKey')

lnSuccess = loPubkey.LoadFromString(loJwk.Emit())
IF (lnSuccess = 0) THEN
    ? loPubkey.LastErrorText
    ? loJwk.Emit()
ELSE
    lnVerified = loJwt.VerifyJwtPk(lcIdToken,loPubkey)
    ? "Verified: " + STR(lnVerified)
ENDIF

RELEASE loJwk

RELEASE loReq
RELEASE loPrng
RELEASE loSbUrl
RELEASE loListenSock
RELEASE loSock
RELEASE loSbRequestBody
RELEASE loSbResponseHtml
RELEASE loSbResponse
RELEASE loHashTab
RELEASE loJwt
RELEASE loJson
RELEASE loJsonJoseHeader
RELEASE loSbJwks
RELEASE loHttp
RELEASE loJwkset
RELEASE loPubkey