libraries/botframework-connector/botframework/connector/auth/emulator_validation.py
async def authenticate_emulator_token(auth_header: str, credentials: CredentialProvider, channel_id: str) -> ClaimsIdentity:
        """ Validate the incoming Auth Header

        Validate the incoming Auth Header as a token sent from the Bot Framework Service.
        A token issued by the Bot Framework emulator will FAIL this check.

        :param auth_header: The raw HTTP header in the format: 'Bearer [longString]'
        :type auth_header: str
        :param credentials: The user defined set of valid credentials, such as the AppId.
        :type credentials: CredentialProvider

        :return: A valid ClaimsIdentity.
        :raises Exception:
        """
        token_extractor = JwtTokenExtractor(
            EmulatorValidation.TO_BOT_FROM_EMULATOR_TOKEN_VALIDATION_PARAMETERS,
            Constants.TO_BOT_FROM_EMULATOR_OPEN_ID_METADATA_URL,
            Constants.ALLOWED_SIGNING_ALGORITHMS)

        identity = await asyncio.ensure_future(
            token_extractor.get_identity_from_auth_header(auth_header, channel_id))
        if not identity:
            # No valid identity. Not Authorized.
            raise Exception('Unauthorized. No valid identity.')

        if not identity.isAuthenticated:
            # The token is in some way invalid. Not Authorized.
            raise Exception('Unauthorized. Is not authenticated')

        # Now check that the AppID in the claimset matches
        # what we're looking for. Note that in a multi-tenant bot, this value
        # comes from developer code that may be reaching out to a service, hence the
        # Async validation.
        version_claim = identity.get_claim_value(EmulatorValidation.VERSION_CLAIM)
        if version_claim is None:
            raise Exception('Unauthorized. "ver" claim is required on Emulator Tokens.')

        app_id = ''

        # The Emulator, depending on Version, sends the AppId via either the
        # appid claim (Version 1) or the Authorized Party claim (Version 2).
        if not version_claim or version_claim == '1.0':
            # either no Version or a version of "1.0" means we should look for
            # the claim in the "appid" claim.
            app_id_claim = identity.get_claim_value(EmulatorValidation.APP_ID_CLAIM)
            if not app_id_claim:
                # No claim around AppID. Not Authorized.
                raise Exception('Unauthorized. '
                                '"appid" claim is required on Emulator Token version "1.0".')

            app_id = app_id_claim
        elif version_claim == '2.0':
            # Emulator, "2.0" puts the AppId in the "azp" claim.
            app_authz_claim = identity.get_claim_value(Constants.AUTHORIZED_PARTY)
            if not app_authz_claim:
                # No claim around AppID. Not Authorized.
                raise Exception('Unauthorized. '
                                '"azp" claim is required on Emulator Token version "2.0".')

            app_id = app_authz_claim
        else:
            # Unknown Version. Not Authorized.
            raise Exception('Unauthorized. Unknown Emulator Token version ', version_claim, '.')

        is_valid_app_id = await asyncio.ensure_future(credentials.is_valid_appid(app_id))
        if not is_valid_app_id:
            raise Exception('Unauthorized. Invalid AppId passed on token: ', app_id)

        return identity
async def authenticate_emulator_token(auth_header: str, credentials: CredentialProvider, channel_id: str) -> ClaimsIdentity:
        """ Validate the incoming Auth Header

        Validate the incoming Auth Header as a token sent from the Bot Framework Service.
        A token issued by the Bot Framework emulator will FAIL this check.

        :param auth_header: The raw HTTP header in the format: 'Bearer [longString]'
        :type auth_header: str
        :param credentials: The user defined set of valid credentials, such as the AppId.
        :type credentials: CredentialProvider

        :return: A valid ClaimsIdentity.
        :raises Exception:
        """
        token_extractor = JwtTokenExtractor(
            EmulatorValidation.TO_BOT_FROM_EMULATOR_TOKEN_VALIDATION_PARAMETERS,
            Constants.TO_BOT_FROM_EMULATOR_OPEN_ID_METADATA_URL,
            Constants.ALLOWED_SIGNING_ALGORITHMS)

        identity = await asyncio.ensure_future(
            token_extractor.get_identity_from_auth_header(auth_header, channel_id))
        if not identity:
            # No valid identity. Not Authorized.
            raise Exception('Unauthorized. No valid identity.')

        if not identity.isAuthenticated:
            # The token is in some way invalid. Not Authorized.
            raise Exception('Unauthorized. Is not authenticated')

        # Now check that the AppID in the claimset matches
        # what we're looking for. Note that in a multi-tenant bot, this value
        # comes from developer code that may be reaching out to a service, hence the
        # Async validation.
        version_claim = identity.get_claim_value(EmulatorValidation.VERSION_CLAIM)
        if version_claim is None:
            raise Exception('Unauthorized. "ver" claim is required on Emulator Tokens.')

        app_id = ''

        # The Emulator, depending on Version, sends the AppId via either the
        # appid claim (Version 1) or the Authorized Party claim (Version 2).
        if not version_claim or version_claim == '1.0':
            # either no Version or a version of "1.0" means we should look for
            # the claim in the "appid" claim.
            app_id_claim = identity.get_claim_value(EmulatorValidation.APP_ID_CLAIM)
            if not app_id_claim:
                # No claim around AppID. Not Authorized.
                raise Exception('Unauthorized. '
                                '"appid" claim is required on Emulator Token version "1.0".')

            app_id = app_id_claim
        elif version_claim == '2.0':
            # Emulator, "2.0" puts the AppId in the "azp" claim.
            app_authz_claim = identity.get_claim_value(Constants.AUTHORIZED_PARTY)
            if not app_authz_claim:
                # No claim around AppID. Not Authorized.
                raise Exception('Unauthorized. '
                                '"azp" claim is required on Emulator Token version "2.0".')

            app_id = app_authz_claim
        else:
            # Unknown Version. Not Authorized.
            raise Exception('Unauthorized. Unknown Emulator Token version ', version_claim, '.')

        is_valid_app_id = await asyncio.ensure_future(credentials.is_valid_appid(app_id))
        if not is_valid_app_id:
            raise Exception('Unauthorized. Invalid AppId passed on token: ', app_id)

        return identity
Validate the incoming Auth Header

        Validate the incoming Auth Header as a token sent from the Bot Framework Service.
        A token issued by the Bot Framework emulator will FAIL this check.

        :param auth_header: The raw HTTP header in the format: 'Bearer [longString]'
        :type auth_header: str
        :param credentials: The user defined set of valid credentials, such as the AppId.
        :type credentials: CredentialProvider

        :return: A valid ClaimsIdentity.
        :raises Exception: