Cherry-Pick Skill Validation to 4.9 (#1375) (#1377)

EricDahlvang · web-flow · commit 414f6a48c50e · 2020-09-03T20:04:57.000-07:00
* Throw if is_skill_claim and claims_validator is null (#1375) * Throw if is_skill_claim and claims_validator is null * Update jwt_token_validation.py * pin black version
diff --git a/libraries/botframework-connector/botframework/connector/auth/jwt_token_validation.py b/libraries/botframework-connector/botframework/connector/auth/jwt_token_validation.py
@@ -165,6 +165,9 @@ async def validate_claims(
     ):
         if auth_config and auth_config.claims_validator:
             await auth_config.claims_validator(claims)
+        elif SkillValidation.is_skill_claim(claims):
+            # Skill claims must be validated using AuthenticationConfiguration claims_validator
+            raise PermissionError("Unauthorized Access. Request is not authorized. Skill Claims require validation.")
 
     @staticmethod
     def is_government(channel_service: str) -> bool:
diff --git a/pipelines/botbuilder-python-ci.yml b/pipelines/botbuilder-python-ci.yml
@@ -60,7 +60,7 @@ jobs:
       pip install -r ./libraries/botbuilder-ai/tests/requirements.txt
       pip install coveralls
       pip install pylint==2.4.4
-      pip install black
+      pip install black==19.10b0
     displayName: 'Install dependencies'
 
   - script: |
