How to verify JWT id_token produced by MS Azure AD? : <p>I have an angularjs SPA web app which uses <a href="https://github.com/AzureAD/azure-activedirectory-library-for-js" rel="noreferrer">ADAL-JS</a> (and adal-angular).
It's set up to authenticate vs our corporate AD in MS Azure. The log-in flow seems to work correctly, and the SPA receives an id_token.</p>

<p>Next, when the user clicks a button, the SPA makes a request to a REST API I am hosting on AWS API Gateway. I am passing the id_token on the <code>Authorization: Bearer &lt;id_token&gt;</code> header.
The API Gateway receives the header as intended, and now has to determine if the given token is good or not to either allow or deny access.</p>

<p>I have a sample token, and it parses correctly on <a href="https://jwt.io/" rel="noreferrer">https://jwt.io/</a> but I have so far failed to find the Public Key or Certificate I should use to verify the signature. I have looked in:</p>

<ul>
<li><a href="https://login.microsoftonline.com/" rel="noreferrer">https://login.microsoftonline.com/</a>{tenantid}/federationmetadata/2007-06/federationmetadata.xml</li>
<li><a href="https://login.microsoftonline.com/" rel="noreferrer">https://login.microsoftonline.com/</a>{tenantId}/discovery/keys</li>
<li><a href="https://login.microsoftonline.com/common/.well-known/openid-configuration" rel="noreferrer">https://login.microsoftonline.com/common/.well-known/openid-configuration</a> (to get the jwks_uri)</li>
<li><a href="https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration" rel="noreferrer">https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration</a></li>
<li><a href="https://login.microsoftonline.com/common/discovery/keys" rel="noreferrer">https://login.microsoftonline.com/common/discovery/keys</a></li>
<li><a href="https://login.microsoftonline.com/common/discovery/v2.0/keys" rel="noreferrer">https://login.microsoftonline.com/common/discovery/v2.0/keys</a></li>
</ul>

<p>I <em>think</em> I should use the value of the x5c property of the key in <a href="https://login.microsoftonline.com/common/discovery/keys" rel="noreferrer">https://login.microsoftonline.com/common/discovery/keys</a> matching the kid and x5t properties from the JWT id_token (currently <code>a3QN0BZS7s4nN-BdrjbF0Y_LdMM</code>, which leads to an x5c value starting with "MIIDBTCCAe2gAwIBAgIQY..." ). However, the <a href="https://jwt.io/" rel="noreferrer">https://jwt.io/</a> page reports "Invalid Signature" (I also tried wrapping the key value with "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----").</p>

<p>Also, is there a (possibly python) library that can facilitate the verification of a given id_token as in the case above (so that I won't have to go grab the signing key on the fly myself?)... The best I could find (<a href="https://github.com/AzureAD/azure-activedirectory-library-for-python" rel="noreferrer">ADAL for python</a>) doesn't seem to provide this feature?</p>
