Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix for Skills endorsement check #6846

Merged
merged 1 commit into from
Sep 9, 2024
Merged

Fix for Skills endorsement check #6846

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions libraries/Microsoft.Bot.Connector/Authentication/JwtTokenExtractor.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,7 +264,7 @@ private async Task<ClaimsPrincipal> ValidateTokenAsync(string jwtToken, string c
var keyId = parsedToken.SigningKey.KeyId;
var endorsements = await _endorsementsData.GetConfigurationAsync().ConfigureAwait(false);

// Note: On the Emulator Code Path, the endorsements collection is empty so the validation code
// Note: On the Emulator/Skills Code Path, the endorsements collection is empty so the validation code
// below won't run. This is normal.
if (!string.IsNullOrEmpty(keyId) && endorsements.TryGetValue(keyId, out var endorsementsForKey))
{
Expand All @@ -287,10 +287,10 @@ private async Task<ClaimsPrincipal> ValidateTokenAsync(string jwtToken, string c
}
else
{
// If we are to skip endorsement check, we want to double check we are in the emulator by explictly checking the token
// If we are to skip endorsement check, we want to double check we are in the emulator/skill by explicitly checking the token
// Instead of assuming that the token is from the emulator based on the empty endorsements collection
var originalAuthHeader = "Bearer " + jwtToken; // We have to add the Bearer scheme back in for the Emulator check
if (!EmulatorValidation.IsTokenFromEmulator(originalAuthHeader))
var originalAuthHeader = "Bearer " + jwtToken; // We have to add the Bearer scheme back in for the Emulator/Skill check
if (!EmulatorValidation.IsTokenFromEmulator(originalAuthHeader) && !SkillValidation.IsSkillToken(originalAuthHeader))
{
throw new UnauthorizedAccessException("Could not validate endorsement key.");
}
Expand Down
Loading