Support SN+I authentication with AAD for CertificateServiceClientCred…

…entialsFactory

libraries/Microsoft.Bot.Connector/Authentication/CertificateServiceClientCredentialsFactory.cs

@@ -16,11 +16,8 @@ namespace Microsoft.Bot.Connector.Authentication
     /// </summary>
     public class CertificateServiceClientCredentialsFactory : ServiceClientCredentialsFactory
     {
-        private readonly X509Certificate2 _certificate;
+        private readonly CertificateAppCredentials _certificateAppCredentials;
         private readonly string _appId;
-        private readonly string _tenantId;
-        private readonly HttpClient _httpClient;
-        private readonly ILogger _logger;
 
         /// <summary>
         /// Initializes a new instance of the <see cref="CertificateServiceClientCredentialsFactory"/> class.
@@ -30,19 +27,33 @@ public class CertificateServiceClientCredentialsFactory : ServiceClientCredentia
         /// <param name="tenantId">The oauth token tenant.</param>
         /// <param name="httpClient">A custom httpClient to use.</param>
         /// <param name="logger">A logger instance to use.</param>
-        public CertificateServiceClientCredentialsFactory(X509Certificate2 certificate, string appId, string tenantId = null, HttpClient httpClient = null, ILogger logger = null)
+        /// <param name="sendX5c">A flag if CertificateAppCredentials should send certificate chains in the request.
+        /// It enables authentication with AAD using certificate subject name (not CNAME) and issuer instead of a thumbprint.
+        /// </param>
+        public CertificateServiceClientCredentialsFactory(
+            X509Certificate2 certificate,
+            string appId,
+            string tenantId = null,
+            HttpClient httpClient = null,
+            ILogger logger = null,
+            bool sendX5c = false)
             : base()
         {
             if (string.IsNullOrWhiteSpace(appId))
             {
                 throw new ArgumentNullException(nameof(appId));
             }
 
-            _certificate = certificate ?? throw new ArgumentNullException(nameof(certificate));
             _appId = appId;
-            _tenantId = tenantId;
-            _httpClient = httpClient;
-            _logger = logger;
+
+            // Instance must be reused otherwise it will cause throttling on AAD.
+            _certificateAppCredentials = new CertificateAppCredentials(
+                certificate ?? throw new ArgumentNullException(nameof(certificate)),
+                sendX5c,
+                appId,
+                tenantId,
+                httpClient,
+                logger);
         }
 
         /// <inheritdoc />
@@ -67,8 +78,7 @@ public override Task<ServiceClientCredentials> CreateCredentialsAsync(
                 throw new InvalidOperationException("Invalid Managed ID.");
             }
 
-            return Task.FromResult<ServiceClientCredentials>(
-                new CertificateAppCredentials(_certificate, _appId, _tenantId, _httpClient, _logger));
+            return Task.FromResult<ServiceClientCredentials>(_certificateAppCredentials);
         }
     }
 }

tests/Microsoft.Bot.Connector.Tests/Authentication/CertificateServiceClientCredentialsFactoryTests.cs

@@ -27,6 +27,7 @@ public void ConstructorTests()
             _ = new CertificateServiceClientCredentialsFactory(certificate.Object, TestAppId, tenantId: TestTenantId);
             _ = new CertificateServiceClientCredentialsFactory(certificate.Object, TestAppId, logger: logger.Object);
             _ = new CertificateServiceClientCredentialsFactory(certificate.Object, TestAppId, httpClient: new HttpClient());
+            _ = new CertificateServiceClientCredentialsFactory(certificate.Object, TestAppId, httpClient: new HttpClient(), sendX5c: true);
         }
 
         [Fact]