Teams Bot使用SNI证书认证时触发未授权访问异常求助

我在Teams Bot中使用Teams.AI库进行SNI证书认证时，遇到未授权访问异常。该证书以应用ID（AppId）为主题，已上传至Azure KeyVault，使用的包版本为4.22.3。

报错信息如下：

Microsoft.Teams.AI.TeamsAdapter: Error: System.UnauthorizedAccessException: Invalid AppId passed on token: 2cf941ce-f641-47ba-b302-f5ad3e854f96
   at Microsoft.Bot.Connector.Authentication.ChannelValidation.AuthenticateChannelToken(String authHeader, ICredentialProvider credentials, HttpClient httpClient, String channelId, AuthenticationConfiguration authConfig)
   at Microsoft.Bot.Connector.Authentication.ChannelValidation.AuthenticateChannelToken(String authHeader, ICredentialProvider credentials, String serviceUrl, HttpClient httpClient, String channelId, AuthenticationConfiguration authConfig)
   at Microsoft.Bot.Connector.Authentication.JwtTokenValidation.AuthenticateTokenAsync(String authHeader, ICredentialProvider credentials, IChannelProvider channelProvider, String channelId, AuthenticationConfiguration authConfig, String serviceUrl, HttpClient httpClient)
   at Microsoft.Bot.Connector.Authentication.JwtTokenValidation.ValidateAuthHeader(String authHeader, ICredentialProvider credentials, IChannelProvider channelProvider, String channelId, AuthenticationConfiguration authConfig, String serviceUrl, HttpClient httpClient)
   at Microsoft.Bot.Connector.Authentication.JwtTokenValidation.AuthenticateRequest(IActivity activity, String authHeader, ICredentialProvider credentials, IChannelProvider provider, AuthenticationConfiguration authConfig, HttpClient httpClient)
   at Microsoft.Bot.Connector.Authentication.BuiltinBotFrameworkAuthentication.AuthenticateRequestAsync(Activity activity, String authHeader, CancellationToken cancellationToken)
   at Microsoft.Bot.Builder.CloudAdapterBase.ProcessActivityAsync(String authHeader, Activity activity, BotCallbackHandler callback, CancellationToken cancellationToken)
   at Microsoft.Bot.Builder.Integration.AspNet.Core.CloudAdapter.ProcessAsync(HttpRequest httpRequest, HttpResponse httpResponse, IBot bot, CancellationToken cancellationToken)

我的部分代码如下：

ConfigOptions config = builder.Configuration.Get<ConfigOptions>()!;

// Access key vault
CertificateClient client = new(vaultUri: new Uri(config.KeyVaultUrl), credential: new DefaultAzureCredential());
var certificate = client.DownloadCertificate(config.certificateName).Value;

// MSAL certificate auth.
builder.Services.AddSingleton(
    serviceProvider => ConfidentialClientApplicationBuilder.Create(config.BOT_ID)
        .WithCertificate(certificate, true)
        .Build());

// MSAL credential factory: regardless of secret, cert or custom auth, need to add the line below to enable MSAL.
builder.Services.AddSingleton<ServiceClientCredentialsFactory, MsalServiceClientCredentialsFactory>();

// Create the Bot Framework Authentication to be used with the Bot Adapter.
builder.Services.AddSingleton<BotFrameworkAuthentication, ConfigurationBotFrameworkAuthentication>();

// Create the Cloud Adapter with error handling enabled.
// Note: some classes expect a BotAdapter and some expect a BotFrameworkHttpAdapter, so
// register the same adapter instance for all types.
builder.Services.AddSingleton<TeamsAdapter, AdapterWithErrorHandler>();
builder.Services.AddSingleton<IBotFrameworkHttpAdapter>(sp => sp.GetService<TeamsAdapter>()!);
builder.Services.AddSingleton<BotAdapter>(sp => sp.GetService<TeamsAdapter>()!);
builder.Services.AddSingleton<IStorage, MemoryStorage>();

内容的提问来源于stack exchange，提问作者raychen3