Validating Tokens

Once your application obtains access (and ID) tokens from Digital Identity Management, you may want to periodically verify that a token is still valid. You can to achieve this by inspecting the Java Web Token (JWT) or calling the Digital Identity Management’s /oidc/ userInfo endpoint.

Inspecting the JWT

In support of OAuth 2.0 and OIDC, Digital Identity Management issues access, refresh, and ID tokens as JSON Web Tokens (JWTs). JWT Expiration When a token is first issued and delivered to the client, that token’s decoded payload contains an expiry time noted in the exp field as seconds in UNIX epoch time.

**Example token payload **
{
  "sub": "4fa6ffe1-96c0-4780-b3db-d530cdc52a8b",
  "aud": "sensicalDeviceGrant-OIDC-Client",
  "email_verified": true,
  "kid": "rsa1",
  "iss": "https://sensical-ulm-pdt.m1amdocs.io/oidc",
  "name": "Primary User Display Name Here",
  "ulm_user_id": 103,
  "exp": 1610468880,
  "iat": 1610468280,
  "jti": "ac3951cf-e9ad-420f-978f-bbb8e6cf3e5b",
  "email": "tgokcen20210112@mailinator.com"
}

Once a token expires, it can no longer be used. The token expiration period can be defined in the Digital Identity Management Admin console for your organization’s administrators. JWT Signature To check that a token was actually signed by Digital Identity Management, use the access token GET /oidc/jwk endpoint to obtain all of the Digital Identity Management public keys. The response is a JSON object with a single keys field, and that field contains a list of JSON Web Key (JWK) values.

**GET /oidc/jwk response**
{
   "keys": [
   {
      "kty": "RSA",
      "e": "AQAB",
      "kid": "rsa1",
      "alg": "RS256",
      "n": "qt6yOiI_wCoCVlGO0MySsez0VkSqhPvDl3rfabOslx35mYEO-n4ABfIT5Gn2zN-CeIcOZ5ugAXvIIRWv5H55-
           tzjFazi5IKkOIMCiz5__MtsdxKCqGlZu2zt-BLpqTOAPiflNPpM3RUAlxKAhnYEqNha6-allPnFQupnW_eTYoy
           uzuedT7dSp90ry0ZcQDimntXWeaSbrYKCj9Rr9W1jn2uTowUuXaScKXTCjAmJVnsD75JNzQfa8DweklTyWQF-Y
           5Ky039I0VIu-0CIGhXY48GAFe2EFb8VpNhf07DP63p138RWQ1d3KPEM9mYJVpQC68j3wzDQYSljpLf9by7TGw"
    }
  ]
}

In this case, Digital Identity Management has only a single key with a key ID, or kid, of rsa1 using algorithm, or alg, of RS256. The public key n value is visible for the purposes of verifying the asymmetric signature on any tokens.

Calling the `/oidc/userinfo` Endpoint

You can call the GET /oidc/userinfo API with an access token. The response includes the latest claim values authorized for the relying party according to the scopes in the specified access token. If the token is invalid for example, because it has been revoked), then Digital Identity Management responds with HTTP 401 Unauthorized and a payload that indicates the error code invalid_token.

**Error Response - body**
{
  "error": "invalid_token",
  "error_description": "Invalid access token: eyJraWQiOiJyc2ExIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiI0
                       ZmE2ZmZlMS05NmMwLTQ3ODAtYjNkYi1kNTMwY2RjNTJhOGIiLCJhenAiOiJzZW5zaWNhbERldm
                       ljZUdyYW50LU9JREMtQ2xpW50IiwiaXNzIjoiaHR0cHM6XC9cL3NlbnNpY2FsLXVsbS1wZHQub
                       TFhbWRvY3MuaW9cL29pZGMiLCJleHAiOjE2MTA1NTE0NTIsImlhdCI6MTYxMDU0Nzg1MiwianR
                       pIjoiYTQ5ZTUwZDktOTEwOS00ZDAwLWJlZWUtZTZjNzM0OTE5ZmRhIn0.Px2yh3AL6mqTvLd6E
                       VTHvAPsisHbfsoIIQ4feRJjaLew-K-29SiRWqnXYzZ2QKqT8cT6i7xZWUEchbtFz900i5Nj66D
                       JeXTw-t1QSFsRrKYPM7a5XfKvQhZ92vDvWeutsFBaS_yAUq6WutBz19vHzbnl39-igQtm8LwbX
                       EJX32hU10mnkm3WMne8HVUVPCSkNRi6a4t7LExzQbVEjmeEjPWUADbGc9zUS-5mA6V1_cUjepY
                       5jXH-NMvyi8MtrYOYSNEd4sIE1z21XD8v6nwxzG5Urz3JjF_TQ8TWls3wcN28JH2Y4lAntURu8
                       G1oHKEtjhf5jHMQ9ER455BWig7EsQ"
}

For more details on the /userinfo endpoint, refer to the UserInfo Endpoint topic. Alternatively, to know more about MarketONE OIDC API spec, refer to the API Reference on the Developer Portal. Parent topic:Single Sign-On

Home

Guides

APIs

Inspecting the JWT

Calling the `/oidc/userinfo` Endpoint

​Inspecting the JWT

​Calling the /oidc/userinfo Endpoint

Inspecting the JWT

Calling the `/oidc/userinfo` Endpoint