From 0755dc644a27cc093d6b655ab8582d4de453f6a5 Mon Sep 17 00:00:00 2001 From: JhontSouth Date: Mon, 18 Mar 2024 09:46:53 -0500 Subject: [PATCH 1/2] use dynamic Emulator issuer with tenant id to validate identity --- .../Authentication/EmulatorValidation.cs | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs b/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs index 49b7efdde8..a8ad306614 100644 --- a/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs +++ b/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs @@ -70,6 +70,18 @@ public static bool IsTokenFromEmulator(string authHeader) return false; } + var tid = token.Claims.FirstOrDefault(claim => claim.Type == "tid")?.Value != null ? '/' + token.Claims.FirstOrDefault(claim => claim.Type == "tid")?.Value + '/' : string.Empty; + + //Validate if there is an existing issuer with the same tid value. + if (!string.IsNullOrEmpty(tid) && !ToBotFromEmulatorTokenValidationParameters.ValidIssuers.Any((issuer) => issuer.Contains(tid))) + { + //If the issuer doesn't exist, this is added using the Emulator token issuer structure. + //This allows use of the SingleTenant authentication through Emulator. + var newIssuer = "https://sts.windows.net" + tid; + ToBotFromEmulatorTokenValidationParameters.ValidIssuers = + ToBotFromEmulatorTokenValidationParameters.ValidIssuers.Concat(new string[] { newIssuer }); + } + // Is the token issues by a source we consider to be the emulator? if (!ToBotFromEmulatorTokenValidationParameters.ValidIssuers.Contains(token.Issuer)) { From 5bf5963853f6d1217c90f7fffd5205057d8def4d Mon Sep 17 00:00:00 2001 From: JhontSouth Date: Wed, 3 Apr 2024 08:24:27 -0500 Subject: [PATCH 2/2] use auth constants --- .../Authentication/AuthenticationConstants.cs | 5 +++++ .../Authentication/EmulatorValidation.cs | 7 ++++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/libraries/Microsoft.Bot.Connector/Authentication/AuthenticationConstants.cs b/libraries/Microsoft.Bot.Connector/Authentication/AuthenticationConstants.cs index e01d571bd3..d697c28bcd 100644 --- a/libraries/Microsoft.Bot.Connector/Authentication/AuthenticationConstants.cs +++ b/libraries/Microsoft.Bot.Connector/Authentication/AuthenticationConstants.cs @@ -163,6 +163,11 @@ public static class AuthenticationConstants /// public const string AnonymousAuthType = "anonymous"; + /// + /// Tenant Id claim name. As used in Microsoft AAD tokens. + /// + public const string TenantIdClaim = "tid"; + /// /// Allowed token signing algorithms. Tokens come from channels to the bot. The code /// that uses this also supports tokens coming from the emulator. diff --git a/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs b/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs index a8ad306614..99e656bba4 100644 --- a/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs +++ b/libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs @@ -7,6 +7,7 @@ using System.Net.Http; using System.Security.Claims; using System.Threading.Tasks; +using Microsoft.Extensions.Logging; using Microsoft.IdentityModel.Tokens; namespace Microsoft.Bot.Connector.Authentication @@ -70,14 +71,14 @@ public static bool IsTokenFromEmulator(string authHeader) return false; } - var tid = token.Claims.FirstOrDefault(claim => claim.Type == "tid")?.Value != null ? '/' + token.Claims.FirstOrDefault(claim => claim.Type == "tid")?.Value + '/' : string.Empty; + var tenantId = token.Claims.FirstOrDefault(c => c.Type == AuthenticationConstants.TenantIdClaim)?.Value ?? string.Empty; //Validate if there is an existing issuer with the same tid value. - if (!string.IsNullOrEmpty(tid) && !ToBotFromEmulatorTokenValidationParameters.ValidIssuers.Any((issuer) => issuer.Contains(tid))) + if (!string.IsNullOrEmpty(tenantId) && !ToBotFromEmulatorTokenValidationParameters.ValidIssuers.Any((issuer) => issuer.Contains(tenantId))) { //If the issuer doesn't exist, this is added using the Emulator token issuer structure. //This allows use of the SingleTenant authentication through Emulator. - var newIssuer = "https://sts.windows.net" + tid; + var newIssuer = AuthenticationConstants.ValidTokenIssuerUrlTemplateV1.Replace("{0}", tenantId); ToBotFromEmulatorTokenValidationParameters.ValidIssuers = ToBotFromEmulatorTokenValidationParameters.ValidIssuers.Concat(new string[] { newIssuer }); }