Skip to content
This repository was archived by the owner on Dec 4, 2023. It is now read-only.

Commit a870286

Browse files
LeeParrishMSFTLeeParrishMSFT
authored
Removed references to TrustServiceUrl (#1126)
1 parent 7893dbd commit a870286

File tree

5 files changed

+7
-164
lines changed

5 files changed

+7
-164
lines changed

‎libraries/bot-builder/src/main/java/com/microsoft/bot/builder/BotFrameworkAdapter.java‎

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -379,21 +379,11 @@ public CompletableFuture<Void> continueConversation(
379379
context.getTurnState().add(BOT_IDENTITY_KEY, claimsIdentity);
380380
context.getTurnState().add(OAUTH_SCOPE_KEY, audience);
381381

382-
String appIdFromClaims = JwtTokenValidation.getAppIdFromClaims(claimsIdentity.claims());
383-
return credentialProvider.isValidAppId(appIdFromClaims).thenCompose(isValidAppId -> {
384-
// If we receive a valid app id in the incoming token claims, add the
385-
// channel service URL to the trusted services list so we can send messages
386-
// back.
387-
if (!StringUtils.isEmpty(appIdFromClaims) && isValidAppId) {
388-
AppCredentials.trustServiceUrl(reference.getServiceUrl());
389-
}
390-
391-
return createConnectorClient(reference.getServiceUrl(), claimsIdentity, audience)
392-
.thenCompose(connectorClient -> {
393-
context.getTurnState().add(CONNECTOR_CLIENT_KEY, connectorClient);
394-
return runPipeline(context, callback);
395-
});
396-
});
382+
return createConnectorClient(reference.getServiceUrl(), claimsIdentity, audience)
383+
.thenCompose(connectorClient -> {
384+
context.getTurnState().add(CONNECTOR_CLIENT_KEY, connectorClient);
385+
return runPipeline(context, callback);
386+
});
397387
} catch (Exception e) {
398388
pipelineResult.completeExceptionally(e);
399389
}

‎libraries/bot-connector/src/main/java/com/microsoft/bot/connector/authentication/AppCredentials.java‎

Lines changed: 1 addition & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,10 @@
77
import com.microsoft.bot.restclient.credentials.ServiceClientCredentials;
88
import okhttp3.OkHttpClient;
99
import org.apache.commons.lang3.StringUtils;
10-
import org.slf4j.LoggerFactory;
1110

1211
import java.net.MalformedURLException;
1312
import java.net.URL;
14-
import java.time.LocalDateTime;
1513
import java.util.concurrent.CompletableFuture;
16-
import java.util.concurrent.ConcurrentHashMap;
17-
import java.util.concurrent.ConcurrentMap;
1814

1915
/**
2016
* Base abstraction for AAD credentials for auth and caching.
@@ -24,16 +20,6 @@
2420
* </p>
2521
*/
2622
public abstract class AppCredentials implements ServiceClientCredentials {
27-
private static final int EXPIRATION_SLACK = 5;
28-
private static final int EXPIRATION_DAYS = 1;
29-
private static ConcurrentMap<String, LocalDateTime> trustHostNames = new ConcurrentHashMap<>();
30-
31-
static {
32-
trustHostNames.put("api.botframework.com", LocalDateTime.MAX);
33-
trustHostNames.put("token.botframework.com", LocalDateTime.MAX);
34-
trustHostNames.put("api.botframework.azure.us", LocalDateTime.MAX);
35-
trustHostNames.put("token.botframework.azure.us", LocalDateTime.MAX);
36-
}
3723

3824
private String appId;
3925
private String authTenant;
@@ -62,73 +48,6 @@ public AppCredentials(String withChannelAuthTenant, String withOAuthScope) {
6248
: withOAuthScope;
6349
}
6450

65-
/**
66-
* Adds the host of service url to trusted hosts.
67-
*
68-
* @param serviceUrl The service URI.
69-
*/
70-
public static void trustServiceUrl(String serviceUrl) {
71-
trustServiceUrl(serviceUrl, LocalDateTime.now().plusDays(EXPIRATION_DAYS));
72-
}
73-
74-
/**
75-
* Adds the host of service url to trusted hosts with the specified expiration.
76-
*
77-
* <p>
78-
* Note: The will fail to add if the url is not valid.
79-
* </p>
80-
*
81-
* @param serviceUrl The service URI.
82-
* @param expirationTime The expiration time after which this service url is not
83-
* trusted anymore.
84-
*/
85-
public static void trustServiceUrl(String serviceUrl, LocalDateTime expirationTime) {
86-
try {
87-
URL url = new URL(serviceUrl);
88-
trustServiceUrl(url, expirationTime);
89-
} catch (MalformedURLException e) {
90-
LoggerFactory.getLogger(MicrosoftAppCredentials.class).error("trustServiceUrl", e);
91-
}
92-
}
93-
94-
/**
95-
* Adds the host of service url to trusted hosts with the specified expiration.
96-
*
97-
* @param serviceUrl The service URI.
98-
* @param expirationTime The expiration time after which this service url is not
99-
* trusted anymore.
100-
*/
101-
public static void trustServiceUrl(URL serviceUrl, LocalDateTime expirationTime) {
102-
trustHostNames.put(serviceUrl.getHost(), expirationTime);
103-
}
104-
105-
/**
106-
* Checks if the service url is for a trusted host or not.
107-
*
108-
* @param serviceUrl The service URI.
109-
* @return true if the service is trusted.
110-
*/
111-
public static boolean isTrustedServiceUrl(String serviceUrl) {
112-
try {
113-
URL url = new URL(serviceUrl);
114-
return isTrustedServiceUrl(url);
115-
} catch (MalformedURLException e) {
116-
LoggerFactory.getLogger(AppCredentials.class).error("trustServiceUrl", e);
117-
return false;
118-
}
119-
}
120-
121-
/**
122-
* Checks if the service url is for a trusted host or not.
123-
*
124-
* @param serviceUrl The service URI.
125-
* @return true if the service is trusted.
126-
*/
127-
public static boolean isTrustedServiceUrl(URL serviceUrl) {
128-
return !trustHostNames.getOrDefault(serviceUrl.getHost(), LocalDateTime.MIN)
129-
.isBefore(LocalDateTime.now().minusMinutes(EXPIRATION_SLACK));
130-
}
131-
13251
/**
13352
* Gets the App ID for this credential.
13453
*
@@ -245,7 +164,7 @@ boolean shouldSetToken(String url) {
245164
if (StringUtils.isBlank(getAppId()) || getAppId().equals(AuthenticationConstants.ANONYMOUS_SKILL_APPID)) {
246165
return false;
247166
}
248-
return isTrustedServiceUrl(url);
167+
return true;
249168
}
250169

251170
// lazy Authenticator create.

‎libraries/bot-connector/src/main/java/com/microsoft/bot/connector/authentication/JwtTokenValidation.java‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -98,13 +98,7 @@ public static CompletableFuture<ClaimsIdentity> authenticateRequest(
9898
return JwtTokenValidation.validateAuthHeader(
9999
authHeader, credentials, channelProvider, activity.getChannelId(),
100100
activity.getServiceUrl(), authConfig
101-
)
102-
103-
.thenApply(identity -> {
104-
// On the standard Auth path, we need to trust the URL that was incoming.
105-
MicrosoftAppCredentials.trustServiceUrl(activity.getServiceUrl());
106-
return identity;
107-
});
101+
);
108102
}
109103

110104
/**

‎libraries/bot-connector/src/test/java/com/microsoft/bot/connector/JwtTokenValidationTests.java‎

Lines changed: 0 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -155,24 +155,6 @@ public void Emulator_AuthHeader_CorrectAppIdAndServiceUrl_WithPrivateChannelServ
155155
"TheChannel");
156156
}
157157

158-
/**
159-
* Tests with a valid Token and service url; and ensures that Service url is added to Trusted service url list.
160-
*/
161-
@Test
162-
public void ChannelMsaHeaderValidServiceUrlShouldBeTrusted() throws IOException, ExecutionException, InterruptedException {
163-
String header = getHeaderToken();
164-
CredentialProvider credentials = new SimpleCredentialProvider(APPID, "");
165-
Activity activity = new Activity(ActivityTypes.MESSAGE);
166-
activity.setServiceUrl("https://smba.trafficmanager.net/amer-client-ss.msg/");
167-
JwtTokenValidation.authenticateRequest(
168-
activity,
169-
header,
170-
credentials,
171-
new SimpleChannelProvider()).join();
172-
173-
Assert.assertTrue(MicrosoftAppCredentials.isTrustedServiceUrl("https://smba.trafficmanager.net/amer-client-ss.msg/"));
174-
}
175-
176158
/**
177159
* Tests with a valid Token and invalid service url; and ensures that Service url is NOT added to Trusted service url list.
178160
*/
@@ -192,7 +174,6 @@ public void ChannelMsaHeaderInvalidServiceUrlShouldNotBeTrusted() throws IOExcep
192174
Assert.fail("Should have thrown AuthenticationException");
193175
} catch (CompletionException e) {
194176
Assert.assertTrue(e.getCause() instanceof AuthenticationException);
195-
Assert.assertFalse(MicrosoftAppCredentials.isTrustedServiceUrl("https://webchat.botframework.com/"));
196177
}
197178
}
198179

@@ -255,26 +236,6 @@ public void ChannelNoHeaderAuthenticationEnabledShouldThrow() throws IOException
255236
} catch (CompletionException e) {
256237
Assert.assertTrue(e.getCause() instanceof AuthenticationException);
257238
}
258-
259-
Assert.assertFalse(MicrosoftAppCredentials.isTrustedServiceUrl("https://smba.trafficmanager.net/amer-client-ss.msg/"));
260-
}
261-
262-
/**
263-
* Tests with no authentication header and makes sure the service URL is not added to the trusted list.
264-
*/
265-
@Test
266-
public void ChannelAuthenticationDisabledServiceUrlShouldNotBeTrusted() throws ExecutionException, InterruptedException {
267-
String header = "";
268-
CredentialProvider credentials = new SimpleCredentialProvider("", "");
269-
270-
Activity activity = new Activity(ActivityTypes.MESSAGE);
271-
activity.setServiceUrl("https://webchat.botframework.com/");
272-
ClaimsIdentity identity = JwtTokenValidation.authenticateRequest(
273-
activity,
274-
header,
275-
credentials,
276-
new SimpleChannelProvider()).join();
277-
Assert.assertFalse(MicrosoftAppCredentials.isTrustedServiceUrl("https://webchat.botframework.com/"));
278239
}
279240

280241
@Test

‎libraries/bot-connector/src/test/java/com/microsoft/bot/connector/MicrosoftAppCredentialsTests.java‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -14,27 +14,6 @@
1414
import java.time.LocalDateTime;
1515

1616
public class MicrosoftAppCredentialsTests {
17-
@Test
18-
public void ValidUrlTrusted() {
19-
MicrosoftAppCredentials.trustServiceUrl("https://goodurl.com");
20-
Assert.assertTrue(MicrosoftAppCredentials.isTrustedServiceUrl("https://goodurl.com"));
21-
}
22-
23-
@Test
24-
public void InvalidUrlTrusted() {
25-
MicrosoftAppCredentials.trustServiceUrl("badurl");
26-
Assert.assertFalse(MicrosoftAppCredentials.isTrustedServiceUrl("badurl"));
27-
}
28-
29-
@Test
30-
public void TrustedUrlExpiration() throws InterruptedException {
31-
// There is a +5 minute window for an expired url
32-
MicrosoftAppCredentials.trustServiceUrl("https://goodurl.com", LocalDateTime.now().minusMinutes(6));
33-
Assert.assertFalse(MicrosoftAppCredentials.isTrustedServiceUrl("https://goodurl.com"));
34-
35-
MicrosoftAppCredentials.trustServiceUrl("https://goodurl.com", LocalDateTime.now().minusMinutes(4));
36-
Assert.assertTrue(MicrosoftAppCredentials.isTrustedServiceUrl("https://goodurl.com"));
37-
}
3817

3918
@Test
4019
public void ValidateAuthEndpoint() {

0 commit comments

Comments
 (0)