{"id":20267160,"url":"https://github.com/odwyersoftware/azure-ad-verify-token","last_synced_at":"2025-04-11T03:36:48.662Z","repository":{"id":45297131,"uuid":"275858126","full_name":"odwyersoftware/azure-ad-verify-token","owner":"odwyersoftware","description":"Verify JWT issued by Azure Active Directory B2C in Python 🐍","archived":false,"fork":false,"pushed_at":"2022-12-29T10:49:33.000Z","size":55,"stargazers_count":24,"open_issues_count":2,"forks_count":6,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-25T01:38:05.331Z","etag":null,"topics":["authentication","azure","azure-active-directory-b2c","jwt-authentication","python-library","security"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/odwyersoftware.png","metadata":{"files":{"readme":"README.md","changelog":"HISTORY.md","contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-06-29T15:39:54.000Z","updated_at":"2025-01-26T15:41:39.000Z","dependencies_parsed_at":"2023-01-31T08:45:44.567Z","dependency_job_id":null,"html_url":"https://github.com/odwyersoftware/azure-ad-verify-token","commit_stats":null,"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/odwyersoftware%2Fazure-ad-verify-token","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/odwyersoftware%2Fazure-ad-verify-token/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/odwyersoftware%2Fazure-ad-verify-token/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/odwyersoftware%2Fazure-ad-verify-token/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/odwyersoftware","download_url":"https://codeload.github.com/odwyersoftware/azure-ad-verify-token/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248085321,"owners_count":21045139,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authentication","azure","azure-active-directory-b2c","jwt-authentication","python-library","security"],"created_at":"2024-11-14T12:13:31.696Z","updated_at":"2025-04-11T03:36:48.634Z","avatar_url":"https://github.com/odwyersoftware.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# azure-ad-verify-token\nVerify JWT issued by Azure Active Directory B2C in Python 🐍.\n\n[![Build Status](https://travis-ci.org/ODwyerSoftware/azure-ad-verify-token.svg?branch=master)](https://travis-ci.org/ODwyerSoftware/azure-ad-verify-token) [![PyPI version](https://badge.fury.io/py/azure-ad-verify-token.svg)](https://pypi.org/project/azure-ad-verify-token/)\n\n    Validation steps this library makes:\n\n    1. Accepts an Azure AD B2C JWT.\n    2. Extracts `kid` from unverified headers.\n    3. Finds `kid` within Azure JWKS.\n    4. Obtains RSA key from JWK.\n    5. Calls `jwt.decode` with nessary parameters, which inturn validates:\n\n        - Signature\n        - Expiration\n        - Audience\n        - Issuer\n        - Key\n        - Algorithm\n\n## License\n\n![https://creativecommons.org/licenses/by-nc-nd/4.0/\n](https://licensebuttons.net/l/by-nc-nd/4.0/88x31.png)\n\nThis work is licensed under a [Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License](https://creativecommons.org/licenses/by-nc-nd/4.0/).\n\nFor commercial use licenses [contact us](mailto:github@odwyer.software).\n\n## Installation\n\n```bash\npip install azure-ad-verify-token\n```\n\n## Usage\n\n\nFirst you'll need to get your `azure_ad_app_id`, `azure_ad_issuer` and `azure_ad_jwks_uri`. See below steps to obtain these.\n\n1. For app id. Login to [Azure Portal](https://portal.azure.com/), navigation to Azure AD B2C, Click on the Applications section and your app id should be listed.\n\n2. For Issuer and JWKS URI:\n\nUnder the \"User Flows\", note down the name of yours, this will be needed shortly.\n\n![https://i.imgur.com/uYmghAZ.png](https://i.imgur.com/uYmghAZ.png)\n\nNext, under Azure AD B2C, within the Applications section.\n\nClick on \"Endpoints\".\n\nCopy the endpoint with the label \"OpenID Connect configuration endpoint (v2)\"\n\nIt will look something like:\n\n`https://exampletenant.b2clogin.com/exampletenant.onmicrosoft.com/\u003cpolicy-name\u003e/v2.0/.well-known/openid-configuration`\n\n![https://i.imgur.com/3bQGZBn.png](https://i.imgur.com/3bQGZBn.png)\n\nNow replace `\u003cpolicy-name\u003e` with the name of your User Flow from earlier\n\n`https://exampletenant.b2clogin.com/exampletenant.onmicrosoft.com/B2C_1_app_sign_in/v2.0/.well-known/openid-configuration`\n\nNow visit that URL in your web browser.\n\nYou should get a JSON response, note down the values for the keys 'issuer' and 'jwks_uri'.\n\nNow you have those values you can proceed to verify a Azure generated JWT Token.\n\n```python\nfrom azure_ad_verify_token import verify_jwt\n\nazure_ad_app_id = 'b74cd13f-8f79-4c98-b748-7789ecb1111d5'\nazure_ad_issuer = 'https://exampletenant.b2clogin.com/0867afa-24e7-40e9-9d27-74bb598zzzzc/v2.0/'\nazure_ad_jwks_uri = 'https://exampletenant.b2clogin.com/exampletenant.onmicrosoft.com/B2C_1_app_sign_in/discovery/v2.0/keys'\npayload = verify_jwt(\n    token='\u003cAZURE_JWT_TO_VERIFY_HERE\u003e',\n    valid_audiences=[azure_ad_app_id],\n    issuer=azure_ad_issuer,\n    jwks_uri=azure_ad_jwks_uri,\n    verify=True,\n)\n\nprint(payload)\n{'aud': 'b74cd13f-8f79-4c98-b748-7789ecb1111d5',\n 'auth_time': 1591800638,\n 'emails': ['bob@example.com'],\n 'exp': 1591804238,\n 'family_name': 'Exp Admin',\n 'given_name': 'Richard',\n 'iat': 1591800638,\n 'iss': 'https://exampletenant.b2clogin.com/90867afa-24e7-40e9-9d27-74bb598zzzzc/v2.0/',\n 'nbf': 1591800638,\n 'sub': 'e07bbc53-b812-4572-9edc-4b5d4ac88447',\n 'tfp': 'B2C_1_app_sign_in',\n 'ver': '1.0'}\n```\n\nIf something goes wrong, one of the below exceptions will be raised:\n\n```\n# If the token is found to be invalid.\nazure_ad_verify_token.InvalidAuthorizationToken\n\n# Base exception, raised if the checks which call the Azure server recieve an unhappy response.\nazure_ad_verify_token.AzureVerifyTokenError\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fodwyersoftware%2Fazure-ad-verify-token","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fodwyersoftware%2Fazure-ad-verify-token","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fodwyersoftware%2Fazure-ad-verify-token/lists"}