title: Azure Active Directory Token Validation
body: <p>I'm integrating Azure Active Directory into a cloud platform. As our application is multi-tenant and relies on platform-specific claims, we've identified the simplest way to go about this is get an Azure AD token via our SPA, pass it back to our WebApi, validate it and return to the SPA a platform token with all the claims we need to go about our normal business (as if it was a simple username/password athentication request).</p>
  
  <p>I'm concerned at the level of security for this though.</p>
  
  <p><strong>Some Context</strong><br>
  As our platform is multi-tenant, we request that clients each register the application on their Azure AD portal, then supply us with the generated <em>Application (client ID)</em> and <em>Directory (tenant) ID</em>. We use these two pieces of information to make the initial request to Azure via our front-end SPA (following the <code>node.js</code> example provided by Microsoft's <code>Quickstart</code> guide when registering an app). Now because the user is unauthenticated at this point, we needed some way to return those two specific ids for the client. We have accomplished this using a sub-domain for identification.</p>
  
  <p>E.g. <code>acmeinc.mydomain.com</code> will return a different Application (client ID) and Directory (tenant) ID than <code>billy.mydomain.com</code>. These are obviously public now as this request happens from an un-authenticated front-end route.</p>
  
  <p>I can handle the token response just fine, both in the front-end and in the back-end when I pass it along, and validate that these two pieces of information are correct in the token, but seeing as the front-end is given them to begin with, validation on these is redundant. Also, validating the issuer seems equally redundant as someone who knows the Directory (tenant) ID, can fake that too (right?)</p>
  
  <p>Am I missing something here? I would feel far more at ease if it were possible to request the client also include a claim that my platform generates privately such that I could validate this claim alongside the normal JWT validation. Custom claims do not seem possible from the Azure AD Portal.</p>
  
  <p>Am I missing a critical step, or just overthinking this?</p>