Add Authentication configuration for CloudAdapter

Leandro Dardick (ldardick) · Jul 14, 2021 · Jul 14, 2021 · Jul 14, 2021 · Jul 14, 2021 · Jul 14, 2021
commit 99b6908751e5e7991987495a56d694f7e0ccce3d
diff --git a/...r/src/main/java/com/microsoft/bot/connector/authentication/AuthenticateRequestResult.java b/...r/src/main/java/com/microsoft/bot/connector/authentication/AuthenticateRequestResult.java
@@ -0,0 +1,79 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+package com.microsoft.bot.connector.authentication;
+
+/**
+ * The result from a call to authenticate a Bot Framework Protocol request.
+ */
+public class AuthenticateRequestResult {
+
+    private String audience;
+    private ClaimsIdentity claimsIdentity;
+    private String callerId;
+    private ConnectorFactory connectorFactory;
+
+    /**
+     * Gets a value for the Audience.
+     * @return A value for the Audience.
+     */
+    public String getAudience() {
+        return audience;
+    }
+
+    /**
+     * Sets a value for the Audience.
+     * @param audience A value for the Audience.
+     */
+    public void setAudience(String audience) {
+        this.audience = audience;
+    }
+
+    /**
+     * Gets a value for the ClaimsIdentity.
+     * @return A value for the ClaimsIdentity.
+     */
+    public ClaimsIdentity getClaimsIdentity() {
+        return claimsIdentity;
+    }
+
+    /**
+     * Sets a value for the ClaimsIdentity.
+     * @param claimsIdentity A value for the ClaimsIdentity.
+     */
+    public void setClaimsIdentity(ClaimsIdentity claimsIdentity) {
+        this.claimsIdentity = claimsIdentity;
+    }
+
+    /**
+     * Gets a value for the CallerId.
+     * @return A value for the CallerId.
+     */
+    public String getCallerId() {
+        return callerId;
+    }
+
+    /**
+     * Sets a value for the CallerId.
+     * @param callerId A value for the CallerId.
+     */
+    public void setCallerId(String callerId) {
+        this.callerId = callerId;
+    }
+
+    /**
+     * Gets a value for the ConnectorFactory.
+     * @return A value for the ConnectorFactory.
+     */
+    public ConnectorFactory getConnectorFactory() {
+        return connectorFactory;
+    }
+
+    /**
+     * Sets a value for the ConnectorFactory.
+     * @param connectorFactory A value for the ConnectorFactory.
+     */
+    public void setConnectorFactory(ConnectorFactory connectorFactory) {
+        this.connectorFactory = connectorFactory;
+    }
+}
diff --git a/.../src/main/java/com/microsoft/bot/connector/authentication/BotFrameworkAuthentication.java b/.../src/main/java/com/microsoft/bot/connector/authentication/BotFrameworkAuthentication.java
@@ -0,0 +1,109 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+package com.microsoft.bot.connector.authentication;
+
+import java.util.concurrent.CompletableFuture;
+
+import com.microsoft.bot.connector.skills.BotFrameworkClient;
+import com.microsoft.bot.schema.Activity;
+import com.microsoft.bot.schema.CallerIdConstants;
+
+import org.apache.commons.lang3.NotImplementedException;
+
+/**
+ * Represents a Cloud Environment used to authenticate Bot Framework Protocol
+ * network calls within this environment.
+ */
+public abstract class BotFrameworkAuthentication {
+
+    /**
+     * Validate Bot Framework Protocol requests.
+     *
+     * @param activity   The inbound Activity.
+     * @param authHeader The http auth header.
+     * @return Asynchronous Task with {@link AuthenticateRequestResult}.
+     */
+    public abstract CompletableFuture<AuthenticateRequestResult> authenticateRequest(Activity activity,
+            String authHeader);
+
+    /**
+     * Validate Bot Framework Protocol requests.
+     *
+     * @param authHeader      The http auth header.
+     * @param channelIdHeader The channel Id HTTP header.
+     * @return Asynchronous Task with {@link AuthenticateRequestResult}.
+     */
+    public abstract CompletableFuture<AuthenticateRequestResult> authenticateStreamingRequest(String authHeader,
+            String channelIdHeader);
+
+    /**
+     * Creates a {@link ConnectorFactory} that can be used to create
+     * {@link com.microsoft.bot.connector.ConnectorClient} that use credentials from this particular cloud
+     * environment.
+     *
+     * @param claimsIdentity The inbound @{link Activity}'s {@link ClaimsIdentity}.
+     * @return A {@link ConnectorFactory}.
+     */
+    public abstract ConnectorFactory createConnectorFactory(ClaimsIdentity claimsIdentity);
+
+    /**
+     * Creates the appropriate {@link UserTokenClient} instance.
+     *
+     * @param claimsIdentity The inbound @{link Activity}'s {@link ClaimsIdentity}.
+     * @return Asynchronous Task with {@link UserTokenClient} instance.
+     */
+    public abstract CompletableFuture<UserTokenClient> createUserTokenClient(ClaimsIdentity claimsIdentity);
+
+    /**
+     * Creates a {@link BotFrameworkClient} used for calling Skills.
+     *
+     * @return A {@link BotFrameworkClient} instance to call Skills.
+     */
+    public BotFrameworkClient createBotFrameworkClient() {
+        throw new NotImplementedException("createBotFrameworkClient is not implemented");
+    }
+
+    /**
+     * Gets the originating audience from Bot OAuth scope.
+     *
+     * @return The originating audience.
+     */
+    public String getOriginatingAudience() {
+        throw new NotImplementedException("getOriginatingAudience is not implemented");
+    }
+
+    /**
+     * Authenticate Bot Framework Protocol requests to Skills.
+     * @param authHeader The http auth header received in the skill request.
+     * @return A {@link ClaimsIdentity}.
+     */
+    public CompletableFuture<ClaimsIdentity> authenticateChannelRequest(String authHeader) {
+        throw new NotImplementedException("authenticateChannelRequest is not implemented");
+    }
+
+    /**
+     * Generates the appropriate callerId to write onto the activity, this might be
+     * null.
+     *
+     * @param credentialFactory A {@link ServiceClientCredentialsFactory} to use.
+     * @param claimsIdentity    The inbound claims.
+     * @param callerId          The default callerId to use if this is not a skill.
+     * @return The callerId, this might be null.
+     */
+    protected CompletableFuture<String> generateCallerId(ServiceClientCredentialsFactory credentialFactory,
+            ClaimsIdentity claimsIdentity, String callerId) {
+        // Is the bot accepting all incoming messages?
+        return credentialFactory.isAuthenticationDisabled().thenApply(isDisabled -> {
+            if (isDisabled) {
+                // Return null so that the callerId is cleared.
+                return null;
+            }
+
+            // Is the activity from another bot?
+            return SkillValidation.isSkillClaim(claimsIdentity.claims()) ? String.format("%s%s",
+                    CallerIdConstants.BOT_TO_BOT_PREFIX, JwtTokenValidation.getAppIdFromClaims(claimsIdentity.claims()))
+                    : callerId;
+        });
+    }
+}
diff --git a/...in/java/com/microsoft/bot/connector/authentication/BotFrameworkAuthenticationFactory.java b/...in/java/com/microsoft/bot/connector/authentication/BotFrameworkAuthenticationFactory.java
@@ -0,0 +1,114 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+package com.microsoft.bot.connector.authentication;
+
+import com.microsoft.bot.schema.CallerIdConstants;
+import okhttp3.OkHttpClient;
+import org.apache.commons.lang3.StringUtils;
+
+/**
+ * A factory for {@link BotFrameworkAuthentication}
+ * which encapsulate the environment specific Bot Framework Protocol auth code.
+ */
+public final class BotFrameworkAuthenticationFactory {
+
+    private BotFrameworkAuthenticationFactory() { }
+
+    /**
+     * Creates the a {@link BotFrameworkAuthentication} instance for anonymous testing scenarios.
+     * @return A new {@link BotFrameworkAuthentication} instance.
+     */
+    public static BotFrameworkAuthentication create() {
+        return create(
+            null,
+            false,
+            null,
+            null,
+            null,
+            null,
+            null,
+            null,
+            null,
+            new PasswordServiceClientCredentialFactory(),
+            new AuthenticationConfiguration(),
+            new OkHttpClient());
+    }
+
+    @SuppressWarnings("checkstyle:ParameterNumber")
+    public static BotFrameworkAuthentication create(
+        String channelService,
+        Boolean validateAuthority,
+        String toChannelFromBotLoginUrl,
+        String toChannelFromBotOAuthScope,
+        String toBotFromChannelTokenIssuer,
+        String oAuthUrl,
+        String toBotFromChannelOpenIdMetadataUrl,
+        String toBotFromEmulatorOpenIdMetadataUrl,
+        String callerId,
+        ServiceClientCredentialsFactory credentialFactory,
+        AuthenticationConfiguration authConfiguration,
+        OkHttpClient httpClient
+    ) {
+        if (StringUtils.isNotBlank(toChannelFromBotLoginUrl)
+            || StringUtils.isNotBlank(toChannelFromBotOAuthScope)
+            || StringUtils.isNotBlank(toBotFromChannelTokenIssuer)
+            || StringUtils.isNotBlank(oAuthUrl)
+            || StringUtils.isNotBlank(toBotFromChannelOpenIdMetadataUrl)
+            || StringUtils.isNotBlank(toBotFromEmulatorOpenIdMetadataUrl)
+            || StringUtils.isNotBlank(callerId)) {
+            // if we have any of the 'parameterized' properties defined we'll assume this is the parameterized code
+            return new ParameterizedBotFrameworkAuthentication(
+                validateAuthority,
+                toChannelFromBotLoginUrl,
+                toChannelFromBotOAuthScope,
+                toBotFromChannelTokenIssuer,
+                oAuthUrl,
+                toBotFromChannelOpenIdMetadataUrl,
+                toBotFromEmulatorOpenIdMetadataUrl,
+                callerId,
+                credentialFactory,
+                authConfiguration,
+                httpClient
+            );
+        } else {
+            // else apply the built in default behavior, which is either the public cloud or the gov cloud
+            // depending on whether we have a channelService value present
+            if (StringUtils.isBlank(channelService)) {
+                return new ParameterizedBotFrameworkAuthentication(
+                    true,
+                    String.format(
+                        AuthenticationConstants.TO_CHANNEL_FROM_BOT_LOGIN_URL_TEMPLATE,
+                        AuthenticationConstants.DEFAULT_CHANNEL_AUTH_TENANT),
+                    AuthenticationConstants.TO_CHANNEL_FROM_BOT_OAUTH_SCOPE,
+                    AuthenticationConstants.TO_BOT_FROM_CHANNEL_TOKEN_ISSUER,
+                    AuthenticationConstants.OAUTH_URL,
+                    AuthenticationConstants.TO_BOT_FROM_CHANNEL_OPENID_METADATA_URL,
+                    AuthenticationConstants.TO_BOT_FROM_EMULATOR_OPENID_METADATA_URL,
+                    CallerIdConstants.PUBLIC_AZURE_CHANNEL,
+                    credentialFactory,
+                    authConfiguration,
+                    httpClient
+                );
+            } else if (channelService == GovernmentAuthenticationConstants.CHANNELSERVICE) {
+                return new ParameterizedBotFrameworkAuthentication(
+                    true,
+                    GovernmentAuthenticationConstants.TO_CHANNEL_FROM_BOT_LOGIN_URL,
+                    GovernmentAuthenticationConstants.TO_CHANNEL_FROM_BOT_OAUTH_SCOPE,
+                    GovernmentAuthenticationConstants.TO_BOT_FROM_CHANNEL_TOKEN_ISSUER,
+                    GovernmentAuthenticationConstants.OAUTH_URL_GOV,
+                    GovernmentAuthenticationConstants.TO_BOT_FROM_CHANNEL_OPENID_METADATA_URL,
+                    GovernmentAuthenticationConstants.TO_BOT_FROM_EMULATOR_OPENID_METADATA_URL,
+                    CallerIdConstants.US_GOV_CHANNEL,
+                    credentialFactory,
+                    authConfiguration,
+                    httpClient
+                );
+            } else {
+                // The ChannelService value is used an indicator of which built in set of constants to use.
+                // If it is not recognized, a full configuration is expected.
+                throw new IllegalArgumentException("The provided ChannelService value is not supported.");
+            }
+        }
+    }
+}