How do I validate a token coming from a third party using the same ADFS authentication server?

Question

An application A (me) needs to communicate with Application B and the communication needs to be secured using ADFS (OAuth2 Client credentials grant flow). Both A and B get their tokens using the same ADFS authentication server.

Reading the Microsoft documentation, it's pretty clear to me how my application A need to get a token from the authentication server and send it to the application B.

However, what I don't understand is how I can validate a token received by Application B.

I also struggle finding examples showing endpoints and JSONs. Is there any resource I can double check?

Thanks!

Answer 1

To validate the JWT, look here.

Basically check issuer, aud, expiry, signature etc.

jwt.io has a bunch of libraries to do this.