id-token-reviewer

To validate an OIDC ID Token, you must verify its structure, critical claims like iss and aud, and RS256 signature integrity using the provider's public keys. This process ensures compliance with OpenID Connect Core sections 3.1.3.6 and 3.1.3.7.

Required ID Token claims for validation include issuer, audience, expiration, and iat. Conditional claims such as nonce, auth_time, azp, and at_hash are also reviewed to ensure strict adherence to OpenID Connect profile specifications.

This validation process specifically supports RS256-based ID Tokens used within Basic OP. It verifies signatures by retrieving and applying the OpenID Connect provider's public keys to the token.

Verifying the nonce claim involves checking it against the value sent in the authentication request during the Authorization Code flow. This checklist-driven review confirms conditional claims like nonce meet OIDC expectations.

The best way to check ID Token compliance is using a structured checklist to review fields and generate a coverage gap report. This produces a compliance report verifying structure, claims, and signatures for Basic OP test scenarios.