用Ruby代码验证AAD令牌是否正确

require 'jwt'
require 'net/http'

def validate_aad_token(token)
  # 解码令牌
  decoded_token = JWT.decode(token, nil, false)

  # 获取令牌中的audience（受众）和issuer（发行者）
  audience = decoded_token[0]['aud']
  issuer = decoded_token[0]['iss']

  # 验证令牌的签名是否正确
  jwks_uri = "#{issuer}/.well-known/openid-configuration/jwks"
  jwks_response = Net::HTTP.get(URI(jwks_uri))
  jwks = JSON.parse(jwks_response)
  jwk = jwks['keys'].first

  public_key = OpenSSL::PKey::RSA.new
  public_key.e = OpenSSL::BN.new(Base64.urlsafe_decode64(jwk['e']), 2)
  public_key.n = OpenSSL::BN.new(Base64.urlsafe_decode64(jwk['n']), 2)

  decoded_header = JWT.decode(token, public_key, true, algorithm: 'RS256')[1]

  # 验证令牌的有效期
  current_time = Time.now.to_i
  expiration_time = decoded_token[0]['exp']
  if current_time > expiration_time
    return false, 'Token has expired'
  end

  # 验证令牌的受众和发行者
  if audience != 'your_audience'
    return false, 'Invalid audience'
  end

  if issuer != 'your_issuer'
    return false, 'Invalid issuer'
  end

  return true, 'Token is valid'
end

# 调用验证方法
token = 'your_aad_token'
valid, message = validate_aad_token(token)
puts message