async def authenticate_token(auth_header: str, credentials: CredentialProvider, channel_id: str) -> ClaimsIdentity:
        """ Validate the incoming Auth Header

        Validate the incoming Auth Header as a token sent from the Bot Framework Service.
        A token issued by the Bot Framework emulator will FAIL this check.

        :param auth_header: The raw HTTP header in the format: 'Bearer [longString]'
        :type auth_header: str
        :param credentials: The user defined set of valid credentials, such as the AppId.
        :type credentials: CredentialProvider

        :return: A valid ClaimsIdentity.
        :raises Exception:
        """
        token_extractor = JwtTokenExtractor(
            ChannelValidation.TO_BOT_FROM_CHANNEL_TOKEN_VALIDATION_PARAMETERS,
            Constants.TO_BOT_FROM_CHANNEL_OPEN_ID_METADATA_URL,
            Constants.ALLOWED_SIGNING_ALGORITHMS)

        identity = await asyncio.ensure_future(
            token_extractor.get_identity_from_auth_header(auth_header, channel_id))
        if not identity:
            # No valid identity. Not Authorized.
            raise Exception('Unauthorized. No valid identity.')

        if not identity.isAuthenticated:
            # The token is in some way invalid. Not Authorized.
            raise Exception('Unauthorized. Is not authenticated')

        # Now check that the AppID in the claimset matches
        # what we're looking for. Note that in a multi-tenant bot, this value
        # comes from developer code that may be reaching out to a service, hence the
        # Async validation.

        # Look for the "aud" claim, but only if issued from the Bot Framework
        if identity.get_claim_value(Constants.ISSUER_CLAIM) != Constants.TO_BOT_FROM_CHANNEL_TOKEN_ISSUER:
            # The relevant Audience Claim MUST be present. Not Authorized.
            raise Exception('Unauthorized. Audience Claim MUST be present.')

        # The AppId from the claim in the token must match the AppId specified by the developer.
        # Note that the Bot Framework uses the Audience claim ("aud") to pass the AppID.
        aud_claim = identity.get_claim_value(Constants.AUDIENCE_CLAIM)
        is_valid_app_id = await asyncio.ensure_future(credentials.is_valid_appid(aud_claim or ""))
        if not is_valid_app_id:
            # The AppId is not valid or not present. Not Authorized.
            raise Exception('Unauthorized. Invalid AppId passed on token: ', aud_claim)

        return identity
async def authenticate_token(auth_header: str, credentials: CredentialProvider, channel_id: str) -> ClaimsIdentity:
        """ Validate the incoming Auth Header

        Validate the incoming Auth Header as a token sent from the Bot Framework Service.
        A token issued by the Bot Framework emulator will FAIL this check.

        :param auth_header: The raw HTTP header in the format: 'Bearer [longString]'
        :type auth_header: str
        :param credentials: The user defined set of valid credentials, such as the AppId.
        :type credentials: CredentialProvider

        :return: A valid ClaimsIdentity.
        :raises Exception:
        """
        token_extractor = JwtTokenExtractor(
            ChannelValidation.TO_BOT_FROM_CHANNEL_TOKEN_VALIDATION_PARAMETERS,
            Constants.TO_BOT_FROM_CHANNEL_OPEN_ID_METADATA_URL,
            Constants.ALLOWED_SIGNING_ALGORITHMS)

        identity = await asyncio.ensure_future(
            token_extractor.get_identity_from_auth_header(auth_header, channel_id))
        if not identity:
            # No valid identity. Not Authorized.
            raise Exception('Unauthorized. No valid identity.')

        if not identity.isAuthenticated:
            # The token is in some way invalid. Not Authorized.
            raise Exception('Unauthorized. Is not authenticated')

        # Now check that the AppID in the claimset matches
        # what we're looking for. Note that in a multi-tenant bot, this value
        # comes from developer code that may be reaching out to a service, hence the
        # Async validation.

        # Look for the "aud" claim, but only if issued from the Bot Framework
        if identity.get_claim_value(Constants.ISSUER_CLAIM) != Constants.TO_BOT_FROM_CHANNEL_TOKEN_ISSUER:
            # The relevant Audience Claim MUST be present. Not Authorized.
            raise Exception('Unauthorized. Audience Claim MUST be present.')

        # The AppId from the claim in the token must match the AppId specified by the developer.
        # Note that the Bot Framework uses the Audience claim ("aud") to pass the AppID.
        aud_claim = identity.get_claim_value(Constants.AUDIENCE_CLAIM)
        is_valid_app_id = await asyncio.ensure_future(credentials.is_valid_appid(aud_claim or ""))
        if not is_valid_app_id:
            # The AppId is not valid or not present. Not Authorized.
            raise Exception('Unauthorized. Invalid AppId passed on token: ', aud_claim)

        return identity
async def authenticate_token ( auth_header : str , credentials : CredentialProvider , channel_id : str ) -> ClaimsIdentity : token_extractor = JwtTokenExtractor ( ChannelValidation . TO_BOT_FROM_CHANNEL_TOKEN_VALIDATION_PARAMETERS , Constants . TO_BOT_FROM_CHANNEL_OPEN_ID_METADATA_URL , Constants . ALLOWED_SIGNING_ALGORITHMS ) identity = await asyncio . ensure_future ( token_extractor . get_identity_from_auth_header ( auth_header , channel_id ) ) if not identity : # No valid identity. Not Authorized. raise Exception ( 'Unauthorized. No valid identity.' ) if not identity . isAuthenticated : # The token is in some way invalid. Not Authorized. raise Exception ( 'Unauthorized. Is not authenticated' ) # Now check that the AppID in the claimset matches # what we're looking for. Note that in a multi-tenant bot, this value # comes from developer code that may be reaching out to a service, hence the # Async validation. # Look for the "aud" claim, but only if issued from the Bot Framework if identity . get_claim_value ( Constants . ISSUER_CLAIM ) != Constants . TO_BOT_FROM_CHANNEL_TOKEN_ISSUER : # The relevant Audience Claim MUST be present. Not Authorized. raise Exception ( 'Unauthorized. Audience Claim MUST be present.' ) # The AppId from the claim in the token must match the AppId specified by the developer. # Note that the Bot Framework uses the Audience claim ("aud") to pass the AppID. aud_claim = identity . get_claim_value ( Constants . AUDIENCE_CLAIM ) is_valid_app_id = await asyncio . ensure_future ( credentials . is_valid_appid ( aud_claim or "" ) ) if not is_valid_app_id : # The AppId is not valid or not present. Not Authorized. raise Exception ( 'Unauthorized. Invalid AppId passed on token: ' , aud_claim ) return identity
Validate the incoming Auth Header

        Validate the incoming Auth Header as a token sent from the Bot Framework Service.
        A token issued by the Bot Framework emulator will FAIL this check.

        :param auth_header: The raw HTTP header in the format: 'Bearer [longString]'
        :type auth_header: str
        :param credentials: The user defined set of valid credentials, such as the AppId.
        :type credentials: CredentialProvider

        :return: A valid ClaimsIdentity.
        :raises Exception:
Validate the incoming Auth Header