How to introspect an ID token without a TokenEndpointResponse

[Lordfirespeed]

This library used to contain methods for introspecting claims from an ID token without a TokenEndpointResponse by fetching public keys from the keystore of the identity provider and using these to verify the ID token.
Is it possible to do this in v6 of this library?

Edit: it looks like the validateIdTokenClaims function from oauth4webapi library contains most of the salient stuff, apart from retrieving public keys from the identity provider keystore.

[RaphaelFakhri]

Not with an openid-client v6 function. v6 only validates ID tokens as part of a flow (authorizationCodeGrant, refreshTokenGrant, implicitAuthentication, and so on), and none of its exports takes a bare ID token (src/index.ts).

The remote-keystore part is what jose does, and openid-client already depends on it (package.json#L91-L94). Since you import it directly, add it to your own dependencies too (npm i jose). Get the issuer and jwks_uri from discovery, then verify:

import * as client from 'openid-client'
import { createRemoteJWKSet, jwtVerify } from 'jose'

const config = await client.discovery(new URL(issuerUrl), clientId)
const { issuer, jwks_uri } = config.serverMetadata()

const JWKS = createRemoteJWKSet(new URL(jwks_uri!)) // create once, it caches keys

const { payload } = await jwtVerify(idToken, JWKS, {
  issuer,
  audience: clientId,
  algorithms: ['RS256'], // whatever your client's id_token_signed_response_alg is
  requiredClaims: ['sub', 'iat', 'exp'],
})

This checks the signature against the provider's JWKS (and refetches when it sees an unknown kid), plus iss, aud, exp, and nbf. It doesn't do the OIDC-specific checks, so if they matter for you, add them yourself: nonce if you sent one, azp when aud has more than one value, and auth_time/max_age if you requested them.