public boolean validateIDToken(String idToken) throws OpenIdException {
        
        logger.debug("Enter OAuth2PlatformClient::validateIDToken");
        
        String[] idTokenParts = idToken.split("\\.");
        
        if (idTokenParts.length < 3) {
            logger.debug("invalid idTokenParts length");
            return false;
        }

        String idTokenHeader = base64UrlDecode(idTokenParts[0]);
        String idTokenPayload = base64UrlDecode(idTokenParts[1]);
        byte[] idTokenSignature = base64UrlDecodeToBytes(idTokenParts[2]);

        JSONObject idTokenHeaderJson = new JSONObject(idTokenHeader);
        JSONObject idTokenHeaderPayload = new JSONObject(idTokenPayload);

        //Step 1 : First check if the issuer is as mentioned in "issuer" in the discovery doc
        String issuer = idTokenHeaderPayload.getString("iss");
        if(!issuer.equalsIgnoreCase(oauth2Config.getIntuitIdTokenIssuer())) {
            logger.debug("issuer value mismtach");
            return false;
        }

        //Step 2 : check if the aud field in idToken is same as application's clientId
        JSONArray jsonaud = idTokenHeaderPayload.getJSONArray("aud"); 
        String aud = jsonaud.getString(0);

        if(!aud.equalsIgnoreCase(oauth2Config.getClientId())) {
            logger.debug("incorrect client id");
            return false;
        }

        //Step 3 : ensure the timestamp has not elapsed
        Long expirationTimestamp = idTokenHeaderPayload.getLong("exp");
        Long currentTime = System.currentTimeMillis() / 1000; 

        if((expirationTimestamp - currentTime) <= 0) {
            logger.debug("expirationTimestamp has elapsed");
            return false;
        }

        //Step 4: Verify that the ID token is properly signed by the issuer
        HashMap<String,JSONObject> keyMap = getKeyMapFromJWKSUri();
        if (keyMap == null || keyMap.isEmpty()) {
            logger.debug("unable to retrive keyMap from JWKS url");
            return false;
        }
        
        //first get the kid from the header.
        String keyId = idTokenHeaderJson.getString("kid");
        JSONObject keyDetails = keyMap.get(keyId);

        //now get the exponent (e) and modulo (n) to form the PublicKey
        String exponent = keyDetails.getString("e");
        String modulo = keyDetails.getString("n");

        //build the public key
        PublicKey publicKey = getPublicKey(modulo, exponent);

        byte[] data = (idTokenParts[0] + "." + idTokenParts[1]).getBytes(StandardCharsets.UTF_8);

        try {
            //verify token using public key
            boolean isSignatureValid = verifyUsingPublicKey(data, idTokenSignature, publicKey);
            logger.debug("isSignatureValid: " + isSignatureValid);
            return isSignatureValid;
           
        } catch (GeneralSecurityException e) {
            logger.error("Exception while validating ID token ", e);
            throw new OpenIdException(e.getMessage(), e);
        }

    }
public boolean validateIDToken ( String idToken ) throws OpenIdException { logger . debug ( "Enter OAuth2PlatformClient::validateIDToken" ) ; String [ ] idTokenParts = idToken . split ( "\\." ) ; if ( idTokenParts . length < 3 ) { logger . debug ( "invalid idTokenParts length" ) ; return false ; } String idTokenHeader = base64UrlDecode ( idTokenParts [ 0 ] ) ; String idTokenPayload = base64UrlDecode ( idTokenParts [ 1 ] ) ; byte [ ] idTokenSignature = base64UrlDecodeToBytes ( idTokenParts [ 2 ] ) ; JSONObject idTokenHeaderJson = new JSONObject ( idTokenHeader ) ; JSONObject idTokenHeaderPayload = new JSONObject ( idTokenPayload ) ; String issuer = idTokenHeaderPayload . getString ( "iss" ) ; if ( ! issuer . equalsIgnoreCase ( oauth2Config . getIntuitIdTokenIssuer ( ) ) ) { logger . debug ( "issuer value mismtach" ) ; return false ; } JSONArray jsonaud = idTokenHeaderPayload . getJSONArray ( "aud" ) ; String aud = jsonaud . getString ( 0 ) ; if ( ! aud . equalsIgnoreCase ( oauth2Config . getClientId ( ) ) ) { logger . debug ( "incorrect client id" ) ; return false ; } Long expirationTimestamp = idTokenHeaderPayload . getLong ( "exp" ) ; Long currentTime = System . currentTimeMillis ( ) / 1000 ; if ( ( expirationTimestamp - currentTime ) <= 0 ) { logger . debug ( "expirationTimestamp has elapsed" ) ; return false ; } HashMap < String , JSONObject > keyMap = getKeyMapFromJWKSUri ( ) ; if ( keyMap == null || keyMap . isEmpty ( ) ) { logger . debug ( "unable to retrive keyMap from JWKS url" ) ; return false ; } String keyId = idTokenHeaderJson . getString ( "kid" ) ; JSONObject keyDetails = keyMap . get ( keyId ) ; String exponent = keyDetails . getString ( "e" ) ; String modulo = keyDetails . getString ( "n" ) ; PublicKey publicKey = getPublicKey ( modulo , exponent ) ; byte [ ] data = ( idTokenParts [ 0 ] + "." + idTokenParts [ 1 ] ) . getBytes ( StandardCharsets . UTF_8 ) ; try { boolean isSignatureValid = verifyUsingPublicKey ( data , idTokenSignature , publicKey ) ; logger . debug ( "isSignatureValid: " + isSignatureValid ) ; return isSignatureValid ; } catch ( GeneralSecurityException e ) { logger . error ( "Exception while validating ID token " , e ) ; throw new OpenIdException ( e . getMessage ( ) , e ) ; } }
Method to validate IDToken

@param idToken
@param clientId
@return
@throws OpenIdException