diff --git a/libraries/Microsoft.Bot.Connector/Authentication/AuthenticationConstants.cs b/libraries/Microsoft.Bot.Connector/Authentication/AuthenticationConstants.cs index e01d571bd3..d697c28bcd 100644 --- a/libraries/Microsoft.Bot.Connector/Authentication/AuthenticationConstants.cs +++ b/libraries/Microsoft.Bot.Connector/Authentication/AuthenticationConstants.cs @@ -163,6 +163,11 @@ public static class AuthenticationConstants /// public const string AnonymousAuthType = "anonymous"; + /// + /// Tenant Id claim name. As used in Microsoft AAD tokens. + /// + public const string TenantIdClaim = "tid"; + /// /// Allowed token signing algorithms. Tokens come from channels to the bot. The code /// that uses this also supports tokens coming from the emulator. diff --git a/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs b/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs index 49b7efdde8..99e656bba4 100644 --- a/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs +++ b/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs @@ -7,6 +7,7 @@ using System.Net.Http; using System.Security.Claims; using System.Threading.Tasks; +using Microsoft.Extensions.Logging; using Microsoft.IdentityModel.Tokens; namespace Microsoft.Bot.Connector.Authentication @@ -70,6 +71,18 @@ public static bool IsTokenFromEmulator(string authHeader) return false; } + var tenantId = token.Claims.FirstOrDefault(c => c.Type == AuthenticationConstants.TenantIdClaim)?.Value ?? string.Empty; + + //Validate if there is an existing issuer with the same tid value. + if (!string.IsNullOrEmpty(tenantId) && !ToBotFromEmulatorTokenValidationParameters.ValidIssuers.Any((issuer) => issuer.Contains(tenantId))) + { + //If the issuer doesn't exist, this is added using the Emulator token issuer structure. + //This allows use of the SingleTenant authentication through Emulator. + var newIssuer = AuthenticationConstants.ValidTokenIssuerUrlTemplateV1.Replace("{0}", tenantId); + ToBotFromEmulatorTokenValidationParameters.ValidIssuers = + ToBotFromEmulatorTokenValidationParameters.ValidIssuers.Concat(new string[] { newIssuer }); + } + // Is the token issues by a source we consider to be the emulator? if (!ToBotFromEmulatorTokenValidationParameters.ValidIssuers.Contains(token.Issuer)) {