I am running the web-app-samples-for-adal4j and I am able to see the /secure/aad page and I am able to recover the idToken sent by Azure AD.
But, my idea is to pass that token to different services and them, each one of them could verify that the token is valid.
So, summarizing, I want to be able to check from a service, that the idtoken given is valid. As far as I understood, you have to verify that the JWT you can recover from the token was signed with a certificate. Am I wrong?
I am using this website http://jwt.calebb.net/ to check that I can decode the JWT. In the last part I can see the signature.
So, my question is, how can an external service verify that the token was encode by a certain certificate? And, where is that certificate (is it in the FEDERATION METADATA DOCUMENT)?