/// <summary>
/// Authenticates the auth header token from the request.
/// </summary>
private static async Task <ClaimsIdentity> AuthenticateToken(string authHeader, ICredentialProvider credentials, string channelId, AuthenticationConfiguration authConfig, string serviceUrl, HttpClient httpClient)
{
if (SkillValidation.IsSkillToken(authHeader))
{
return(await SkillValidation.AuthenticateChannelToken(authHeader, credentials, httpClient, channelId, authConfig).ConfigureAwait(false));
}
if (EmulatorValidation.IsTokenFromEmulator(authHeader))
{
return(await EmulatorValidation.AuthenticateEmulatorToken(authHeader, credentials, httpClient, channelId, authConfig).ConfigureAwait(false));
}
// No empty or null check. Empty can point to issues. Null checks only.
if (serviceUrl != null)
{
return(await ChannelValidation.AuthenticateChannelToken(authHeader, credentials, serviceUrl, httpClient, channelId, authConfig).ConfigureAwait(false));
}
return(await ChannelValidation.AuthenticateChannelToken(authHeader, credentials, httpClient, channelId, authConfig).ConfigureAwait(false));
}
public override async Task OnActionExecutingAsync(HttpActionContext actionContext, CancellationToken cancellationToken)
{
var authorizationHeader = actionContext.Request.Headers.Authorization;
if (authorizationHeader != null && SkillValidation.IsSkillToken(authorizationHeader.ToString()))
{
var activities = base.GetActivities(actionContext);
if (activities.Any())
{
var authConfiguration = this.GetAuthenticationConfiguration();
var credentialProvider = this.GetCredentialProvider();
try
{
foreach (var activity in activities)
{
var claimsIdentity = await JwtTokenValidation.AuthenticateRequest(activity, authorizationHeader.ToString(), credentialProvider, authConfiguration, _httpClient).ConfigureAwait(false);
// this is done in JwtTokenValidation.AuthenticateRequest, but the oauthScope is not set so we update it here
MicrosoftAppCredentials.TrustServiceUrl(activity.ServiceUrl, oauthScope: JwtTokenValidation.GetAppIdFromClaims(claimsIdentity.Claims));
}
}
catch (UnauthorizedAccessException)
{
actionContext.Response = BotAuthenticator.GenerateUnauthorizedResponse(actionContext.Request, "BotAuthenticator failed to authenticate incoming request!");
return;
}
await base.ContinueOnActionExecutingAsync(actionContext, cancellationToken);
return;
}
}
await base.OnActionExecutingAsync(actionContext, cancellationToken);
}