diff --git a/libraries/Microsoft.Bot.Connector/Authentication/AuthenticationConstants.cs b/libraries/Microsoft.Bot.Connector/Authentication/AuthenticationConstants.cs
index e01d571bd3..d697c28bcd 100644
--- a/libraries/Microsoft.Bot.Connector/Authentication/AuthenticationConstants.cs
+++ b/libraries/Microsoft.Bot.Connector/Authentication/AuthenticationConstants.cs
@@ -163,6 +163,11 @@ public static class AuthenticationConstants
///
public const string AnonymousAuthType = "anonymous";
+ ///
+ /// Tenant Id claim name. As used in Microsoft AAD tokens.
+ ///
+ public const string TenantIdClaim = "tid";
+
///
/// Allowed token signing algorithms. Tokens come from channels to the bot. The code
/// that uses this also supports tokens coming from the emulator.
diff --git a/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs b/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs
index 49b7efdde8..99e656bba4 100644
--- a/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs
+++ b/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs
@@ -7,6 +7,7 @@
using System.Net.Http;
using System.Security.Claims;
using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
using Microsoft.IdentityModel.Tokens;
namespace Microsoft.Bot.Connector.Authentication
@@ -70,6 +71,18 @@ public static bool IsTokenFromEmulator(string authHeader)
return false;
}
+ var tenantId = token.Claims.FirstOrDefault(c => c.Type == AuthenticationConstants.TenantIdClaim)?.Value ?? string.Empty;
+
+ //Validate if there is an existing issuer with the same tid value.
+ if (!string.IsNullOrEmpty(tenantId) && !ToBotFromEmulatorTokenValidationParameters.ValidIssuers.Any((issuer) => issuer.Contains(tenantId)))
+ {
+ //If the issuer doesn't exist, this is added using the Emulator token issuer structure.
+ //This allows use of the SingleTenant authentication through Emulator.
+ var newIssuer = AuthenticationConstants.ValidTokenIssuerUrlTemplateV1.Replace("{0}", tenantId);
+ ToBotFromEmulatorTokenValidationParameters.ValidIssuers =
+ ToBotFromEmulatorTokenValidationParameters.ValidIssuers.Concat(new string[] { newIssuer });
+ }
+
// Is the token issues by a source we consider to be the emulator?
if (!ToBotFromEmulatorTokenValidationParameters.ValidIssuers.Contains(token.Issuer))
{