microsoft / botbuilder-dotnet

Welcome to the Bot Framework SDK for .NET repository, which is the home for the libraries and packages that enable developers to build sophisticated bot applications using .NET.
https://github.com/Microsoft/botframework
MIT License
864 stars 480 forks source link

BuiltinBotFrameworkAuthentication.GetAppId try to check (appid/azp) before (aud) #6724

Closed fangyangci closed 6 months ago

fangyangci commented 6 months ago

Fixes #6725

Description

BuiltinBotFrameworkAuthentication.GetAppId get appid from claim appid/azp before aud. Because token from AAD also contains claim aud, but token from ABS don't have claim appid/azp.

While using User Assigned Managed Identity, after Microsoft.Identity.Client version update to 4.55 from 4.50 (#6643) The aud won't be appid.

Specific Changes

BuiltinBotFrameworkAuthentication.GetAppId will try to get appid from claim (appid/azp) than claim(aud).

Testing

ABS token example: image

User Assigned Managed Identity AAD token example: image