extract appid from decoded jwttoken

Question

I have&nbsp; &nbsp;below ymal . where I am using PowerShell script to extract app from Jw token after decoding it . I am not able to get exact app id ( guid )&nbsp; &nbsp;from the decoded object.&nbsp; it is coming as&nbsp; ***
Could someone suggest me&nbsp; how to extract appid from jwt token.
&nbsp;
parameters:- name: jwttokendefault: ''steps:- powershell: | $encodedToken = '${{ parameters.jwttoken }}'Write-Host $encodedToken$tokenParts = $encodedToken -split '\.'$tokenPayload = $tokenParts[1]#Fix padding as needed, keep adding "=" until string length modulus 4 reaches 0while ($tokenPayload.Length % 4) { Write-Verbose "Invalid length for a Base-64 char array or string, adding ="; $tokenPayload += "=" }$decodedPayload = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($tokenPayload))$tokenObject = $decodedPayload | ConvertFrom-Json$appId = $tokenObject.appidWrite-Host $appId

lainrobertson · Answer

Rajendra605&nbsp;&nbsp;Hi, Rajendra.&nbsp;From having a read of the following article, I quickly knocked up two functions that reliably (for me) decide the JWT. The appid field is in "proper" GUID notation.&nbsp;I tested using certificate-based authentication (i.e. servicePrincipal + certificate).&nbsp;For testing purposes, I obtained a token (stored in $Token) using Get-AzAccessToken.&nbsp;From your sample code, what I'm seeing missing is the reversal of the two special character replacements - as per the reference documentation below.&nbsp;Reference&nbsp;Client assertions (MSAL.NET) - Microsoft Authentication Library for .NET | Microsoft Learn&nbsp;PowerShell functionsfunction Get-NormalisedTokenSection
{
    [cmdletbinding()]
    param(
        [parameter(Mandatory=$true)][ValidateNotNullOrEmpty()][string] $TokenSection
    )

$Value = $TokenSection.Replace("_", "/").Replace("-", "+");

switch ($Value.Length % 4)
    {
        1 {
            $Value += "===";
            break;
        }

2 {
            $Value += "==";
            break;
        }

3 {
            $Value += "=";
            break;
        }
    }

[string]::new([System.Convert]::FromBase64String($Value)) | ConvertFrom-Json;
}

function Get-TokenSections
{
    [cmdletbinding()]
    param(
        [parameter(Mandatory=$true)][ValidateNotNullOrEmpty()][string] $Token
    )

if (3 -ne ($Sections = $Token.Split(".")).Length)
    {
        throw("Invalid access token.");
    }

[PSCustomObject] @{
        Header = Get-NormalisedTokenSection -TokenSection $Sections[0];
        Claim = Get-NormalisedTokenSection -TokenSection $Sections[1];
    }
}&nbsp;&nbsp;Output (scoped down to just the appid)&nbsp;&nbsp;Cheers,Lain

rajendra605 · Answer

LainRobertson&nbsp;,
&nbsp;
even I am using replacement , I am getting same issue .&nbsp;
$TokenSection.Replace("_", "/").Replace("-", "+");
&nbsp;
actually when I am passing hard coded value in $tokensection variable , then I am able to appid in guid format else I am getting ***

lainrobertson · Answer

Rajendra605&nbsp;&nbsp;The only other diagnostic I can think of is to compare tokens, as the only kind I compared against is an Azure JWT.&nbsp;You're not using the value from a header, are you, which begins with "Bearer "?&nbsp;Perhaps purely for the sake of testing, you can fetch a token using the Az.Accounts module, using Get-AzAccessToken, and use the Token property of the returned object to test your existing user-defined function.&nbsp;Cheers,Lain

Forum Discussion

extract appid from decoded jwttoken

Reference

PowerShell functions

Output (scoped down to just the appid)

Share

Resources