feat: Support Single Tenant authentication through BotFramework-Emulator

libraries/Microsoft.Bot.Connector/Authentication/AuthenticationConstants.cs

@@ -163,6 +163,11 @@ public static class AuthenticationConstants
         /// </summary>
         public const string AnonymousAuthType = "anonymous";
 
+        /// <summary>
+        /// Tenant Id claim name. As used in Microsoft AAD tokens.
+        /// </summary>
+        public const string TenantIdClaim = "tid";
+
         /// <summary>
         /// Allowed token signing algorithms. Tokens come from channels to the bot. The code
         /// that uses this also supports tokens coming from the emulator.

libraries/Microsoft.Bot.Connector/Authentication/EmulatorValidation.cs

@@ -7,6 +7,7 @@
 using System.Net.Http;
 using System.Security.Claims;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using Microsoft.IdentityModel.Tokens;
 
 namespace Microsoft.Bot.Connector.Authentication
@@ -70,6 +71,18 @@ public static bool IsTokenFromEmulator(string authHeader)
                 return false;
             }
 
+            var tenantId = token.Claims.FirstOrDefault(c => c.Type == AuthenticationConstants.TenantIdClaim)?.Value ?? string.Empty;
+
+            //Validate if there is an existing issuer with the same tid value.
+            if (!string.IsNullOrEmpty(tenantId) && !ToBotFromEmulatorTokenValidationParameters.ValidIssuers.Any((issuer) => issuer.Contains(tenantId)))
+            {
+                //If the issuer doesn't exist, this is added using the Emulator token issuer structure.
+                //This allows use of the SingleTenant authentication through Emulator.
+                var newIssuer = AuthenticationConstants.ValidTokenIssuerUrlTemplateV1.Replace("{0}", tenantId);
+                ToBotFromEmulatorTokenValidationParameters.ValidIssuers = 
+                    ToBotFromEmulatorTokenValidationParameters.ValidIssuers.Concat(new string[] { newIssuer });
+            }
+
             // Is the token issues by a source we consider to be the emulator?
             if (!ToBotFromEmulatorTokenValidationParameters.ValidIssuers.Contains(token.Issuer))
             {