Verifying JWT from Azure Active Directory

Closing this question as I have moved on from the origional issue. Updated my question with comments showing how I have progressed.

Created a new question for the new specific issue: How do I verify a JSON Web Token using a Public RSA key?

--

Just in case it helps anyone else:

For further information on a solution to obtaining a public key from Microsoft in PHP I did the following:

$string_microsoftPublicKeyURL = 'https://login.windows.net/common/discovery/keys';

$array_publicKeysWithKIDasArrayKey = loadKeysFromAzure($string_microsoftPublicKeyURL);


function loadKeysFromAzure($string_microsoftPublicKeyURL) {
    $array_keys = array();

    $jsonString_microsoftPublicKeys = file_get_contents($string_microsoftPublicKeyURL);
    $array_microsoftPublicKeys = json_decode($jsonString_microsoftPublicKeys, true);

    foreach($array_microsoftPublicKeys['keys'] as $array_publicKey) {
        $string_certText = "-----BEGIN CERTIFICATE-----\r\n".chunk_split($array_publicKey['x5c'][0],64)."-----END CERTIFICATE-----\r\n";
        $array_keys[$array_publicKey['kid']] = getPublicKeyFromX5C($string_certText);
    }

    return $array_keys;
}


function getPublicKeyFromX5C($string_certText) {
    $object_cert = openssl_x509_read($string_certText);
    $object_pubkey = openssl_pkey_get_public($object_cert);
    $array_publicKey = openssl_pkey_get_details($object_pubkey);
    return $array_publicKey['key'];
}

Its better however to cache these to disk so your not loading these them every time, but this is just a simple example of how to do this.

Then, using the array of public keys, check the JWT header for the 'kid' value to find the correct public cert to verify against and use this in parameter 3 within openssl_verify(). I used the JWT class to deal with this for me.

Using this public key array created above and the JWT class should allow you to validate microsoft JWTs.

Link to JWT class from firebase: https://github.com/firebase/php-jwt

Call JWT::Decode with param 1 of your JWT, param 2 of this public key array and param three of an array of just 'RS256'.

JWT::decode($string_JSONWebToken, $array_publicKeysWithKIDasArrayKey, array('RS256'));

This will throw an exception if the JWT is invalid or return a decrypted JWT for you to use (and check the claims).