Throw UnauthorizedAccessException if IsSkillClaim and ClaimsValidator is null. (#4570) (#4579)

Author: EricDahlvang

libraries/Microsoft.Bot.Connector/Authentication/JwtTokenValidation.cs

@@ -183,7 +183,7 @@ public static string GetAppIdFromClaims(IEnumerable<Claim> claims)
         /// <param name="authConfig">An <see cref="AuthenticationConfiguration"/> instance.</param>
         /// <param name="claims">The list of claims to validate.</param>
         /// <returns>A <see cref="Task"/> representing the asynchronous operation.</returns>
-        /// <exception cref="UnauthorizedAccessException">If the validation returns false.</exception>
+        /// <exception cref="UnauthorizedAccessException">If the validation returns false, or ClaimsValidator is null and this is a skill claim.</exception>
         internal static async Task ValidateClaimsAsync(AuthenticationConfiguration authConfig, IEnumerable<Claim> claims)
         {
             if (authConfig.ClaimsValidator != null)
@@ -192,6 +192,10 @@ internal static async Task ValidateClaimsAsync(AuthenticationConfiguration authC
                 var claimsList = claims as IList<Claim> ?? claims.ToList();
                 await authConfig.ClaimsValidator.ValidateClaimsAsync(claimsList).ConfigureAwait(false);
             }
+            else if (SkillValidation.IsSkillClaim(claims))
+            {
+                throw new UnauthorizedAccessException("ClaimsValidator is required for validation of Skill Host calls.");
+            }
         }
 
         /// <summary>