fix(apps): support AAD v1 issuers in token validation#556
Merged
heyitsaamir merged 6 commits intoMay 6, 2026
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds configurable inbound JWT validation relaxations in @microsoft/teams.apps to better support single-tenant Teams/Bot scenarios that receive Azure AD v1-style issuers and/or need extra accepted audiences, while keeping the default validation behavior unchanged unless opted into.
Changes:
- Extend tenant-based issuer validation in
JwtValidatorto also accept AAD v1 issuers of the formhttps://sts.windows.net/{tenantId}/. - Add
tokenOptions.additionalAudienceplumbing fromAppOptionsthrough both the Entra validator factory and the/api/messagesservice-token validation path. - Normalize
audienceinput to accept either a single string or an array, and compose Entra validator audiences fromapplicationIdUriplus any additional audience values.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| packages/apps/src/middleware/auth/service-token-validator.ts | Adds an optional audience parameter and forwards it into JwtValidator construction for /api/messages token validation. |
| packages/apps/src/middleware/auth/service-token-validator.spec.ts | Adds a unit test verifying custom audience values are passed through to JwtValidator. |
| packages/apps/src/middleware/auth/jwt-validator.ts | Adds audience normalization, composes Entra validator audiences, and extends tenant issuer validation to accept sts.windows.net v1 issuers. |
| packages/apps/src/middleware/auth/jwt-validator.spec.ts | Adds tests for v1 issuer acceptance and Entra validator audience composition with custom audiences. |
| packages/apps/src/http/http-server.ts | Introduces tokenOptions on HttpServerOptions and forwards additionalAudience to ServiceTokenValidator. |
| packages/apps/src/http/http-server.spec.ts | Adds a test verifying HttpServer passes audience options into ServiceTokenValidator. |
| packages/apps/src/app.ts | Adds AppOptions.tokenOptions and threads additionalAudience into both Entra token validation and HttpServer construction. |
| packages/apps/src/app.spec.ts | Adds a test verifying App config propagates additional audience into the Entra validator audience list. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
heyitsaamir
changed the title
4 tasks
heyitsaamir
force-pushed
the
feat/token-audience-v1-issuer
branch
from
bb54e71 to
34d8b38
Compare
rido-min
approved these changes
May 6, 2026
This was referenced May 6, 2026
heyitsaamir
added a commit
to microsoft/teams.py
that referenced
this pull request
May 6, 2026
## Summary Mirrors [microsoft/teams.ts#556](microsoft/teams.ts#556) in this codebase. Some valid Microsoft Entra access tokens are issued with the Azure AD v1 issuer format (`https://sts.windows.net/{tenantId}/`) instead of the v2 issuer (`https://login.microsoftonline.com/{tenantId}/v2.0`). Today `TokenValidator.for_entra` only accepts the v2 form, causing valid v1 tokens to be rejected. ## Changes - `packages/apps/src/microsoft_teams/apps/auth/token_validator.py`: when a `tenant_id` is provided, `TokenValidator.for_entra` now adds both the v2 (`{login_endpoint}/{tenant_id}/v2.0`) and v1 (`https://sts.windows.net/{tenant_id}/`) issuers to `valid_issuers`. - `packages/apps/tests/test_token_validator.py`: - Updated `test_for_entra_initialization` to assert both issuers are present. - Added `test_validate_entra_token_v1_sts_issuer` covering acceptance of a v1 `sts.windows.net` issuer through the full validation pipeline. Note: Unlike the TS PR, this change does not introduce multi-tenant `allowedTenantIds` semantics, since the Python `TokenValidator` doesn't currently expose multi-tenant configuration. The fix is kept narrowly scoped to issuer format acceptance. Reference: https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens ## Test plan - `uv run pytest packages/apps/tests/test_token_validator.py -q` — all 27 tests pass, including the new v1 issuer test.
Merged
heyitsaamir
added a commit
that referenced
this pull request
May 6, 2026
Merges main into release and sets version to 2.0.10. ## Commits since last release - 7147cd8 fix(apps): support AAD v1 issuers in token validation (#556) - eb8037e address model gaps (#525) - ac21af6 fix(http-stream): resolve race condition in close() and streamType override in final message (#553) - 6b0da8a MCP Server Example on MCP SDK (#534) - a749172 chore: bump version to 2.0.10-preview (#555)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds Azure AD v1 issuer support to inbound Entra token validation in
@microsoft/teams.apps.Specifically, tenant-based issuer validation now accepts both:
https://login.microsoftonline.com/{tenantId}/...https://sts.windows.net/{tenantId}/Motivation
Some valid Microsoft Entra tokens are issued with the Azure AD v1 issuer format (
sts.windows.net) instead of the v2-stylelogin.microsoftonline.com/.../v2.0issuer.Related external issue:
This PR keeps the change narrowly scoped to issuer validation only.
Changes
JwtValidatorto also accept:https://sts.windows.net/{tenantId}/Tests
Added/updated tests for:
sts.windows.netissuer acceptanceiss,aud,tid,azp/appid,scp,vershape) — both pass through the fullJwtValidator.validateAccessTokenpipeline (signature + expiry + audience + issuer + scope)