How To: Obtain an OIDC Access Token Using PowerShell

Version Affected: All

 

Overview

This article shows how to obtain an OpenID Connect (OIDC) access token from a realm's oidctoken.aspx endpoint using PowerShell. See How To: Test OAuth / OpenID Connect Flows for other ways to test OAuth/OIDC flows.

Obtain an Access Token Using PowerShell

Update $Url, username, password, client_id, and client_secret to match the realm being tested, then run:

$Url = "https://IdP_FQDN/secureauth123/oidctoken.aspx"
$Body = @{
  username = "user1"
  password = "YOUR_PASSWORD"
  grant_type = "password"
  scope = "openid offline_access"
  client_id = "YOUR_CLIENT_ID"
  client_secret = "YOUR_CLIENT_SECRET"
}

$response = ''
$idToken = ''
$paddedIdToken = ''
$results = ''

$response = Invoke-RestMethod -Method Post -Uri $Url -Body $Body -UseDefaultCredentials
$idToken = ($response.id_token.Split(".")[1] -replace "-", "+" -replace "_", "/")
$paddedIdToken = $idToken.PadRight($idToken.Length + (4 - $idToken.Length % 4) % 4, "=")

$results = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($paddedIdToken)) | ConvertFrom-Json

The script requests a token using the Resource Owner Password Credentials grant, then decodes the returned ID token's payload from base64 into $results so its claims can be inspected.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.