PAM Validation Sequence

PAM first checks that the Authorization header is present and that the JWT has a valid three-part structure. It accepts RS256-signed tokens only. Tokens using no signature or an HMAC algorithm are rejected.

PAM selects the Microsoft Entra public key by the token key ID, validates the signature, and checks token lifetime claims including exp, iat, and nbf with the configured leeway. PAM then validates issuer, audience, and tenant against the selected Entra integration.

PAM matches appid for v1 tokens or azp for v2 tokens to the Application Token App Client ID. It evaluates Required Role when configured, then applies existing AAPM controls such as source network, requested Vault Account, time or usage limits, security level, and account resolution. When all validation and authorization checks pass, PAM returns the permitted secret with HTTP 200. The request remains connected to the Application Token for the existing AAPM audit flow.

A missing Authorization header returns HTTP 400 with Token can not be empty. A token with a tampered signature returns HTTP 401. A token issued for another Audience returns HTTP 401 with Token not issued for this API.

A caller whose appid or azp does not match the configured App Client ID returns HTTP 403. A caller missing one or more configured Required Role values also returns HTTP 403. These responses distinguish token-validation failures from application-authorization failures.