Throw if IsSkillClaim and claimsValidator is null (#2761)

microsoft · Sep 4, 2020 · 8d9a3e3 · 8d9a3e3
1 parent ea0506d
commit 8d9a3e3
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/libraries/botframework-connector/src/auth/jwtTokenValidation.ts b/libraries/botframework-connector/src/auth/jwtTokenValidation.ts
@@ -131,6 +131,9 @@ export namespace JwtTokenValidation {
         if (authConfig.validateClaims) {
             // Call the validation method if defined (it should throw an exception if the validation fails)
             await authConfig.validateClaims(claims);
+        } else if (SkillValidation.isSkillClaim(claims)) {
+            // Skill claims must be validated using AuthenticationConfiguration validateClaims
+            throw new AuthenticationError('Unauthorized Access. Request is not authorized. Skill Claims require validation.', StatusCodes.UNAUTHORIZED); 
         }
     }