Closed sadika9 closed 4 years ago
Hey! Thanks for the pull request!
Actually, from looking at the docs, I think the validation of appid
and azp
should be removed completely, because this way, it probably breaks the on_behalf_of flow since the value will always be different from the current client_id
if I understood the docs correctly.
What are your thoughts about this? Eventually, do you think you could modify the PR to remove the validation of appid
and azp
completely? Thanks a lot!
@hajekj I've removed app id validation. Also change the PR title accordingly.
Awesome! Thanks for the contribution!
Use correct claim based on token version to validate application ID.
Doc: https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens#claims-in-access-tokens