extract appid from decoded jwttoken

Rajendra605 

Hi, Rajendra.

From having a read of the following article, I quickly knocked up two functions that reliably (for me) decide the JWT. The appid field is in "proper" GUID notation.

I tested using certificate-based authentication (i.e. servicePrincipal + certificate).

For testing purposes, I obtained a token (stored in $Token) using Get-AzAccessToken.

From your sample code, what I'm seeing missing is the reversal of the two special character replacements - as per the reference documentation below.

Reference

• Client assertions (MSAL.NET) - Microsoft Authentication Library for .NET | Microsoft Learn

PowerShell functions

function Get-NormalisedTokenSection
{
    [cmdletbinding()]
    param(
        [parameter(Mandatory=$true)][ValidateNotNullOrEmpty()][string] $TokenSection
    )

    $Value = $TokenSection.Replace("_", "/").Replace("-", "+");

    switch ($Value.Length % 4)
    {
        1 {
            $Value += "===";
            break;
        }

        2 {
            $Value += "==";
            break;
        }

        3 {
            $Value += "=";
            break;
        }
    }

    [string]::new([System.Convert]::FromBase64String($Value)) | ConvertFrom-Json;
}

function Get-TokenSections
{
    [cmdletbinding()]
    param(
        [parameter(Mandatory=$true)][ValidateNotNullOrEmpty()][string] $Token
    )

    if (3 -ne ($Sections = $Token.Split(".")).Length)
    {
        throw("Invalid access token.");
    }

    [PSCustomObject] @{
        Header = Get-NormalisedTokenSection -TokenSection $Sections[0];
        Claim = Get-NormalisedTokenSection -TokenSection $Sections[1];
    }
}

Output (scoped down to just the appid)

Cheers,

Lain