Verification of Oidc-Access-Token Header

[juur]

Hi,

Is it possible to verify the JWT passed in the Oidc-Access-Token header, when passed downstream via Apache doing reverse proxy & OIDC?

I have a Python/Flask application behind Apache that is acting as a reverse proxy with OIDC. The provider is Azure and all seems to be working on from an OIDC perspective.

When I try to verify in Python the Oidc-Access-Token it fails to verify.
However, when I pass the id-token via header - it verifies fine.
I have also tried taking both tokens from the ?info=json endpoint (including inside the session) same result: access-token fails verification, id-token passes.
The token's header and payload will base64 decode fine

Relevant bits of my Apache configuration (NB: this is working as the token payload contains my email address etc.)

OIDCProviderMetadataURL https://login.microsoftonline.com//v2.0/.well-known/openid-configuration
OIDCRedirectURI https:///redirect_uri
OIDCClientID ""
OIDCClientSecret ""
OIDCCryptoPassphrase ""
OIDCResponseType code
OIDCScope "openid profile"
OIDCRemoteUserClaim upn
OIDCInfoHook access_token userinfo id_token refresh_token session iat
OIDCPassIDTokenAs claims
OIDCPassUserInfoAs claims
OIDCPassClaimsAs both

Offline verification code below, however the Flask application is using Flask-JWT-Extended - both fail.

#!/usr/bin/python3

import sys, requests, jwt, json
from jwt import PyJWKClient

TENANT_ID=''

fh = open(sys.argv[1], 'rb')
raw_token = fh.read().decode('UTF-8').strip()
fh.close()

wk_uri      = f'https://login.microsoftonline.com/{TENANT_ID}/.well-known/openid-configuration'
jwks_client = PyJWKClient(requests.get(wk_uri).json()['jwks_uri'])
sign_key    = jwks_client.get_signing_key_from_jwt(raw_token)

print(json.dumps(jwt.decode(
        raw_token,
        sign_key.key,
        algorithms=['RS256'],
        options={'verify_aud':False}
        )))

[zandbelt]

the access token is not supposed to be verified by the client, which is what mod_auth_openidc is in the OpenID Connect setup