dei79/node-azure-ad-jwt

An Azure Active Directory Token Validation component for node.js

Hi there 👋

I'm an experienced CTO focused on Workspace Management and Cloud Transformation; my passion is to enable tech teams to leverage disruptive technologies to build simple-to-use products.

I'm excited to work on innovations and products, bringing technology's customer value to the surface and making them more valuable. Recurrent re-iterating all phases of a product lifecycle - Strategy, Design, and Execution - is an enjoyable part of this journey.

Within Matrix42, we help organizations digitize the workspace environment of their employees. I'm proud to be part of the team building the software for a digital workspace experience that manages devices, applications, processes, and services that are simple, secure, and compliant.

I love acting as Public Speaker in that industry to let as many as possible participate in changing IT works!

Should a CTO write code? At least, I do so enjoy my personal preferences:

node-azure-ad-jwt's Issues

Request library is using fs package that throws error

his dependency was not found:
fs in ./node_modules/request/lib/har.js
To install it, you can run: npm install --save fs

I've installed it, and still the same issue.

Azure validation manager prefixes 'issuer' with 'https://sts.windows.net/'

AAD issued me a JWT with issuer "https://login.microsoftonline.com/[tenant-id]/v2.0", and validation is failing because validate always expect this issuer 'https://sts.windows.net/[tentant-id]'. Would it be better if one can define whitch issuer to expect in the options parameter of 'verify = function(jwtString, options, callback)'.?

Publish latest to npm

Hey, thanks for this module! I noticed you added a cache layer in 0.1.1 but it looks like the latest version didn't get published to npm: https://www.npmjs.com/package/azure-ad-jwt

The newest one there is 0.1.0.

Mind running an npm publish real quick?

Dependency on jsonwebtoken required

The jsonwebtoken package needs to be added as a dependency in the package.json file.

Question on caching

In readme file document say that caching not using
Currently the version is not using caching this means the certificates will be downloaded from Mirosoft with every verification request. If you are using Azure AAD tokens in every request against your API additional caching would make sense

But in code, I can see the code level caching part
the question here is like code level caching support correct?

cannot read every of undefined

Hello I hope you can help,

Summary: There is some case where certificates parameter can be undefined
function: self.verify
file: lib/azure-ad-validation-manager.js.

Since there is no try block encapsulating certificates.every, or variable check on certificates before certificates.every, it is causing issues.

Thank you

Use this in passport-azure-ad

Hey @dei79 I'd like to use your approach in the library and since you were the first to write it I'd like you to get credit. Would you like to do a pull request to passport-azure-ad or would you like me to fork and do so? We'd like to have this in our library natively so we can continue to support it.

Why does this error occurs? JsonWebTokenError: invalid signature

AAD 2.0 Support

Microsoft has added AAD 2.0 support, causing this lib to break when using on an internal Microsoft project. @bengreenier has a fix here: bengreenier-archive@13dafdd

Doesn't work with webpack 5

Hi @dei79,

I am trying to use this with React 18 and webpack 5 and getting tons of errors.. see below just a fraction of it.

Compiled with problems:X

ERROR in ./node_modules/asn1/lib/ber/reader.js 3:13-30

Module not found: Error: Can't resolve 'assert' in '/Users/thank-you-cards-new/node_modules/asn1/lib/ber'

BREAKING CHANGE: webpack < 5 used to include polyfills for node.js core modules by default.
This is no longer the case. Verify if you need this module and configure a polyfill for it.

If you want to include a polyfill, you need to:
	- add a fallback 'resolve.fallback: { "assert": require.resolve("assert/") }'
	- install 'assert'
If you don't want to include a polyfill, you can use an empty module like this:
	resolve.fallback: { "assert": false }


ERROR in ./node_modules/asn1/lib/ber/writer.js 3:13-30

Module not found: Error: Can't resolve 'assert' in '/Users/thank-you-cards-new/node_modules/asn1/lib/ber'

BREAKING CHANGE: webpack < 5 used to include polyfills for node.js core modules by default.
This is no longer the case. Verify if you need this module and configure a polyfill for it.

If you want to include a polyfill, you need to:
	- add a fallback 'resolve.fallback: { "assert": require.resolve("assert/") }'
	- install 'assert'
If you don't want to include a polyfill, you can use an empty module like this:
	resolve.fallback: { "assert": false }


ERROR in ./node_modules/assert-plus/assert.js 4:13-30

Module not found: Error: Can't resolve 'assert' in '/Users/thank-you-cards-new/node_modules/assert-plus'
Did you mean './assert'?
Requests that should resolve in the current directory need to start with './'.
Requests that start with a name are treated as module requests and resolve within module directories (node_modules, /Users/thank-you-cards-new/node_modules).
If changing the source code is not an option there is also a resolve options called 'preferRelative' which tries to resolve these kind of requests in the current directory too.

BREAKING CHANGE: webpack < 5 used to include polyfills for node.js core modules by default.
This is no longer the case. Verify if you need this module and configure a polyfill for it.

If you want to include a polyfill, you need to:
	- add a fallback 'resolve.fallback: { "assert": require.resolve("assert/") }'
	- install 'assert'
If you don't want to include a polyfill, you can use an empty module like this:
	resolve.fallback: { "assert": false }

CVE-2022-23540, upgrade to jsonwebtoken 9.0.0

A high severity CVE was raised against jsonwebtoken which this library uses

See: https://security.snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180022

Would it be possible to bump the dependency up to version 9.0.0 where this has been remediated?