They provide your application with long-term access to resources on behalf of users without requiring interaction with those users. Refresh token - Refresh tokens are used to acquire new ID tokens and access tokens in an OAuth 2.0 flow. Depending on the scenario requirements, the claims validated by an application can vary, but your application must perform some common claim validations in every scenario. Your API must also validate a few claims in the token to prove that it's valid. When your API receives an access token, it must validate the signature to prove that the token is authentic. Access tokens are used to provide access to APIs and resource servers. Access tokens are signed, but they aren't encrypted. Depending on the scenario requirements, the claims validated by an application can vary, but your application must perform some common claim validations in every scenario.Īccess token - A JWT that contains claims that you can use to identify the granted permissions to your APIs. Your application or API must also validate a few claims in the token to prove that it's valid. When your application or API receives an ID token, it must validate the signature to prove that the token is authentic. The ID tokens issued by Azure AD B2C are signed, but they're not encrypted. They're commonly used to display account information or to make access control decisions in an application. You can use the claims in an ID token as you see fit. This token is securely sent in HTTP requests for communication between two components of the same application or service. ID token - A JWT that contains claims that you can use to identify users in your application. The following tokens are used in communication with Azure AD B2C: All tokens used in Azure AD B2C are JSON web tokens (JWTs) that contain assertions of information about the bearer and the subject of the token. Token typesĪzure AD B2C supports the OAuth 2.0 and OpenID Connect protocols, which makes use of tokens for authentication and secure access to resources. This article describes the format, security characteristics, and contents of each type of token. Azure Active Directory B2C (Azure AD B2C) emits different types of security tokens as it processes each authentication flow.
0 Comments
Leave a Reply. |