async def authenticate_emulator_token(auth_header: str, credentials: CredentialProvider, channel_id: str) -> ClaimsIdentity:
        """ Validate the incoming Auth Header

        Validate the incoming Auth Header as a token sent from the Bot Framework Service.
        A token issued by the Bot Framework emulator will FAIL this check.

        :param auth_header: The raw HTTP header in the format: 'Bearer [longString]'
        :type auth_header: str
        :param credentials: The user defined set of valid credentials, such as the AppId.
        :type credentials: CredentialProvider

        :return: A valid ClaimsIdentity.
        :raises Exception:
        """
        token_extractor = JwtTokenExtractor(
            EmulatorValidation.TO_BOT_FROM_EMULATOR_TOKEN_VALIDATION_PARAMETERS,
            Constants.TO_BOT_FROM_EMULATOR_OPEN_ID_METADATA_URL,
            Constants.ALLOWED_SIGNING_ALGORITHMS)

        identity = await asyncio.ensure_future(
            token_extractor.get_identity_from_auth_header(auth_header, channel_id))
        if not identity:
            # No valid identity. Not Authorized.
            raise Exception('Unauthorized. No valid identity.')

        if not identity.isAuthenticated:
            # The token is in some way invalid. Not Authorized.
            raise Exception('Unauthorized. Is not authenticated')

        # Now check that the AppID in the claimset matches
        # what we're looking for. Note that in a multi-tenant bot, this value
        # comes from developer code that may be reaching out to a service, hence the
        # Async validation.
        version_claim = identity.get_claim_value(EmulatorValidation.VERSION_CLAIM)
        if version_claim is None:
            raise Exception('Unauthorized. "ver" claim is required on Emulator Tokens.')

        app_id = ''

        # The Emulator, depending on Version, sends the AppId via either the
        # appid claim (Version 1) or the Authorized Party claim (Version 2).
        if not version_claim or version_claim == '1.0':
            # either no Version or a version of "1.0" means we should look for
            # the claim in the "appid" claim.
            app_id_claim = identity.get_claim_value(EmulatorValidation.APP_ID_CLAIM)
            if not app_id_claim:
                # No claim around AppID. Not Authorized.
                raise Exception('Unauthorized. '
                                '"appid" claim is required on Emulator Token version "1.0".')

            app_id = app_id_claim
        elif version_claim == '2.0':
            # Emulator, "2.0" puts the AppId in the "azp" claim.
            app_authz_claim = identity.get_claim_value(Constants.AUTHORIZED_PARTY)
            if not app_authz_claim:
                # No claim around AppID. Not Authorized.
                raise Exception('Unauthorized. '
                                '"azp" claim is required on Emulator Token version "2.0".')

            app_id = app_authz_claim
        else:
            # Unknown Version. Not Authorized.
            raise Exception('Unauthorized. Unknown Emulator Token version ', version_claim, '.')

        is_valid_app_id = await asyncio.ensure_future(credentials.is_valid_appid(app_id))
        if not is_valid_app_id:
            raise Exception('Unauthorized. Invalid AppId passed on token: ', app_id)

        return identity
async def authenticate_emulator_token(auth_header: str, credentials: CredentialProvider, channel_id: str) -> ClaimsIdentity:
        """ Validate the incoming Auth Header

        Validate the incoming Auth Header as a token sent from the Bot Framework Service.
        A token issued by the Bot Framework emulator will FAIL this check.

        :param auth_header: The raw HTTP header in the format: 'Bearer [longString]'
        :type auth_header: str
        :param credentials: The user defined set of valid credentials, such as the AppId.
        :type credentials: CredentialProvider

        :return: A valid ClaimsIdentity.
        :raises Exception:
        """
        token_extractor = JwtTokenExtractor(
            EmulatorValidation.TO_BOT_FROM_EMULATOR_TOKEN_VALIDATION_PARAMETERS,
            Constants.TO_BOT_FROM_EMULATOR_OPEN_ID_METADATA_URL,
            Constants.ALLOWED_SIGNING_ALGORITHMS)

        identity = await asyncio.ensure_future(
            token_extractor.get_identity_from_auth_header(auth_header, channel_id))
        if not identity:
            # No valid identity. Not Authorized.
            raise Exception('Unauthorized. No valid identity.')

        if not identity.isAuthenticated:
            # The token is in some way invalid. Not Authorized.
            raise Exception('Unauthorized. Is not authenticated')

        # Now check that the AppID in the claimset matches
        # what we're looking for. Note that in a multi-tenant bot, this value
        # comes from developer code that may be reaching out to a service, hence the
        # Async validation.
        version_claim = identity.get_claim_value(EmulatorValidation.VERSION_CLAIM)
        if version_claim is None:
            raise Exception('Unauthorized. "ver" claim is required on Emulator Tokens.')

        app_id = ''

        # The Emulator, depending on Version, sends the AppId via either the
        # appid claim (Version 1) or the Authorized Party claim (Version 2).
        if not version_claim or version_claim == '1.0':
            # either no Version or a version of "1.0" means we should look for
            # the claim in the "appid" claim.
            app_id_claim = identity.get_claim_value(EmulatorValidation.APP_ID_CLAIM)
            if not app_id_claim:
                # No claim around AppID. Not Authorized.
                raise Exception('Unauthorized. '
                                '"appid" claim is required on Emulator Token version "1.0".')

            app_id = app_id_claim
        elif version_claim == '2.0':
            # Emulator, "2.0" puts the AppId in the "azp" claim.
            app_authz_claim = identity.get_claim_value(Constants.AUTHORIZED_PARTY)
            if not app_authz_claim:
                # No claim around AppID. Not Authorized.
                raise Exception('Unauthorized. '
                                '"azp" claim is required on Emulator Token version "2.0".')

            app_id = app_authz_claim
        else:
            # Unknown Version. Not Authorized.
            raise Exception('Unauthorized. Unknown Emulator Token version ', version_claim, '.')

        is_valid_app_id = await asyncio.ensure_future(credentials.is_valid_appid(app_id))
        if not is_valid_app_id:
            raise Exception('Unauthorized. Invalid AppId passed on token: ', app_id)

        return identity
async def authenticate_emulator_token ( auth_header : str , credentials : CredentialProvider , channel_id : str ) -> ClaimsIdentity : token_extractor = JwtTokenExtractor ( EmulatorValidation . TO_BOT_FROM_EMULATOR_TOKEN_VALIDATION_PARAMETERS , Constants . TO_BOT_FROM_EMULATOR_OPEN_ID_METADATA_URL , Constants . ALLOWED_SIGNING_ALGORITHMS ) identity = await asyncio . ensure_future ( token_extractor . get_identity_from_auth_header ( auth_header , channel_id ) ) if not identity : # No valid identity. Not Authorized. raise Exception ( 'Unauthorized. No valid identity.' ) if not identity . isAuthenticated : # The token is in some way invalid. Not Authorized. raise Exception ( 'Unauthorized. Is not authenticated' ) # Now check that the AppID in the claimset matches # what we're looking for. Note that in a multi-tenant bot, this value # comes from developer code that may be reaching out to a service, hence the # Async validation. version_claim = identity . get_claim_value ( EmulatorValidation . VERSION_CLAIM ) if version_claim is None : raise Exception ( 'Unauthorized. "ver" claim is required on Emulator Tokens.' ) app_id = '' # The Emulator, depending on Version, sends the AppId via either the # appid claim (Version 1) or the Authorized Party claim (Version 2). if not version_claim or version_claim == '1.0' : # either no Version or a version of "1.0" means we should look for # the claim in the "appid" claim. app_id_claim = identity . get_claim_value ( EmulatorValidation . APP_ID_CLAIM ) if not app_id_claim : # No claim around AppID. Not Authorized. raise Exception ( 'Unauthorized. ' '"appid" claim is required on Emulator Token version "1.0".' ) app_id = app_id_claim elif version_claim == '2.0' : # Emulator, "2.0" puts the AppId in the "azp" claim. app_authz_claim = identity . get_claim_value ( Constants . AUTHORIZED_PARTY ) if not app_authz_claim : # No claim around AppID. Not Authorized. raise Exception ( 'Unauthorized. ' '"azp" claim is required on Emulator Token version "2.0".' ) app_id = app_authz_claim else : # Unknown Version. Not Authorized. raise Exception ( 'Unauthorized. Unknown Emulator Token version ' , version_claim , '.' ) is_valid_app_id = await asyncio . ensure_future ( credentials . is_valid_appid ( app_id ) ) if not is_valid_app_id : raise Exception ( 'Unauthorized. Invalid AppId passed on token: ' , app_id ) return identity
Validate the incoming Auth Header

        Validate the incoming Auth Header as a token sent from the Bot Framework Service.
        A token issued by the Bot Framework emulator will FAIL this check.

        :param auth_header: The raw HTTP header in the format: 'Bearer [longString]'
        :type auth_header: str
        :param credentials: The user defined set of valid credentials, such as the AppId.
        :type credentials: CredentialProvider

        :return: A valid ClaimsIdentity.
        :raises Exception:
Validate the incoming Auth Header