Security Question: Custom signing keys for tenant about entra-docs HOT 4 CLOSED

@govindr-cm
Thanks for your feedback! We will investigate and update as appropriate.

from entra-docs.

Thank you! Let me know if anything is unclear and you'd like me to elaborate.

from entra-docs.

@govindr-cm
Thank you for your feedback!
Since this issue isn't directly related to improving our docs, and to gain a better understanding of your issue, I'd recommend working closer with our support team via an [Azure support request] (https://docs.microsoft.com/en-us/azure/azure-portal/supportability/how-to-create-azure-support-request). Or you can leverage our Q&A forum by posting your issue there so our community, and MVPs can further assist you in troubleshooting this issue or finding potential workarounds.
[Teams Q&A forum] (https://docs.microsoft.com/en-us/answers/topics/46488/office-teams-windows-itpro.html) for technical questions about the configuration and administration of Microsoft Teams on Windows.
[Microsoft Teams Community forum] (https://answers.microsoft.com/en-us/msteams/forum?sort=LastReplyDate&dir=Desc&tab=All&status=all&mod=&modAge=&advFil=&postedAfter=&postedBefore=&threadType=All&isFilterExpanded=false&page=1)
Thank you for your time and patience throughout this issue.

from entra-docs.

Hi Ajay,

The security question itself is not docs related, but the broader question at the bottom is. I'll state it again here:

Could we have a single page with all differences from usual OIDC implementations and recommendations for handling these, and why the resulting flow is secure?

Here is an example of something that I don't see listed in the documentation. The OIDC says that the issuer in the token must match the issuer used to get the token (https://openid.net/specs/openid-connect-core-1_0.html#IssuerIdentifier). This does not hold for Microsoft's OIDC (MicrosoftDocs/azure-docs#38427 (comment)).

This difference is implicitly mentioned here where the issuer claim is mentioned: https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference, but there is no argument about the security of this. But since verifying the issuer is explicitly mentioned in the OIDC spec, the deviation of this deserves a mention - what should the verifier do and why is it secure? I don't see this on this page.

Edit: Upon rereading page mentions that the verifier should restrict the tenant if applicable, which is a concrete recommendation. It would be nice if security of this for "common", "organizations" etc. was also mentioned, and further if it was on a single page.

The reason this is a problem is even though security of checking the tenanted URL may be obvious in isolation, is that in combination with other deviations from the spec there could be security holes - like the one I am worried about.

from entra-docs.