From 6319b42d4e7170c1599a23baf107a91ae39b2154 Mon Sep 17 00:00:00 2001 From: Tracy Boehrer Date: Mon, 9 Sep 2024 10:07:33 -0500 Subject: [PATCH] Fix for Skills endorsement check --- .../Authentication/JwtTokenExtractor.cs | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libraries/Microsoft.Bot.Connector/Authentication/JwtTokenExtractor.cs b/libraries/Microsoft.Bot.Connector/Authentication/JwtTokenExtractor.cs index 6e87659a27..0110de3388 100644 --- a/libraries/Microsoft.Bot.Connector/Authentication/JwtTokenExtractor.cs +++ b/libraries/Microsoft.Bot.Connector/Authentication/JwtTokenExtractor.cs @@ -264,7 +264,7 @@ private async Task ValidateTokenAsync(string jwtToken, string c var keyId = parsedToken.SigningKey.KeyId; var endorsements = await _endorsementsData.GetConfigurationAsync().ConfigureAwait(false); - // Note: On the Emulator Code Path, the endorsements collection is empty so the validation code + // Note: On the Emulator/Skills Code Path, the endorsements collection is empty so the validation code // below won't run. This is normal. if (!string.IsNullOrEmpty(keyId) && endorsements.TryGetValue(keyId, out var endorsementsForKey)) { @@ -287,10 +287,10 @@ private async Task ValidateTokenAsync(string jwtToken, string c } else { - // If we are to skip endorsement check, we want to double check we are in the emulator by explictly checking the token + // If we are to skip endorsement check, we want to double check we are in the emulator/skill by explicitly checking the token // Instead of assuming that the token is from the emulator based on the empty endorsements collection - var originalAuthHeader = "Bearer " + jwtToken; // We have to add the Bearer scheme back in for the Emulator check - if (!EmulatorValidation.IsTokenFromEmulator(originalAuthHeader)) + var originalAuthHeader = "Bearer " + jwtToken; // We have to add the Bearer scheme back in for the Emulator/Skill check + if (!EmulatorValidation.IsTokenFromEmulator(originalAuthHeader) && !SkillValidation.IsSkillToken(originalAuthHeader)) { throw new UnauthorizedAccessException("Could not validate endorsement key."); }