<!--
{
  "documentType" : "article",
  "framework" : "AuthenticationServices",
  "identifier" : "/documentation/AuthenticationServices/processing-the-json-web-encryption-jwe-login-response",
  "metadataVersion" : "0.1.0",
  "role" : "article",
  "title" : "Processing the JSON Web Encryption (JWE) login response"
}
-->

# Processing the JSON Web Encryption (JWE) login response

Validate the encrypted response.

## Discussion

Your login configuration instructs Platform SSO how to receive and verify the login response from an identity provider (IdP).

If the HTTP response code is `200`, the system decrypts the response body according to RFC 7516 Section 5.2, using JWE Compact Serialization. Use of the zip header isn’t supported. The system checks `PartyUInfo` for the Ephemeral Public Key in the response. `PartyVInfo` is the `jwe_crypto.apv` from the login request.

The following code sample provides an example of an encrypted login response JWE:

```http
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Type: application/platformsso-login-response+jwt; charset=utf-8
ewogI...luEng
```

For more information, see [Creating a JSON Web Encryption (JWE) login response](/documentation/AuthenticationServices/creating-a-json-web-encryption-jwe-login-response).

### Validate the ID token

The `id_token` is a JSON Object Signing and Encryption (JOSE) object that the IdP signs using either RS256 or ES256 algorithms per RFC 7515 using compact serialization. The system retrieves the signing keys from the [`jwksEndpointURL`](/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/jwksEndpointURL).

The following table specifies the values that the system uses to validate the ID token:

|Key                                                                                                                                                                  |Value                                                                                                                                                                                                                                                                                                                      |Notes                              |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------|
|`nonce`                                                                                                                                                              |The `nonce` value from the login request.                                                                                                                                                                                                                                                                                  |Required.                          |
|`iss`                                                                                                                                                                |Must match the ``doc://com.apple.authenticationservices/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/issuer``.                                                                                                                                                                  |Required.                          |
|`aud`                                                                                                                                                                |Must match the ``doc://com.apple.authenticationservices/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/clientID`` or must contain the ``doc://com.apple.authenticationservices/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/clientID``.|Required.                          |
|`azp`                                                                                                                                                                |If present, must match the ``doc://com.apple.authenticationservices/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/clientID``.                                                                                                                                                    |Required only if `aud` is an array.|
|`iat`                                                                                                                                                                |Must be in past.                                                                                                                                                                                                                                                                                                           |Required.                          |
|`exp`                                                                                                                                                                |Must be in the future.                                                                                                                                                                                                                                                                                                     |Required.                          |
|`nbf`                                                                                                                                                                |If present, must be in the past.                                                                                                                                                                                                                                                                                           |Optional.                          |
|`groups` or ``doc://com.apple.authenticationservices/documentation/AuthenticationServices/ASAuthorizationProviderExtensionLoginConfiguration/groupResponseClaimName``|The requested group membership for the user.                                                                                                                                                                                                                                                                               |Optional.                          |

If validation succeeds, the system saves the response tokens to the keychain using the keychain data-protection attribute <doc://com.apple.documentation/documentation/Security/kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly> and checks the Kerberos mapping.

For a group membership request, the system adds the user to the groups that the IdP supplies in the `id_token`, and it removes the user from the groups not returned. The system ignores groups that you didn’t specify in the Device Management profile.

For more information, see <doc://com.apple.documentation/documentation/DeviceManagement/configuring-platform-single-sign-on>.

---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)