In the instructions for adding authentication to a teams bot (https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/authentication/add-authentication) they indicate the usage of an "Identity Provider", an app registration separate from the bot.
In the instructions for bot SSO (https://learn.microsoft.com/en-us/microsoftteams/platform/bots/how-to/authentication/auth-aad-sso-bots), there is no mention of this "Identity Provider" app registration.
In my testing, I am able to get the normal authentication working with the identity provider. I am also able to get the SSO authentication working without the identity provider.
Is it possible to get the bot SSO working with an identity provider app registration? I have tried several approaches, but none seem to work.
thanks,
Tom
are you maybe refering to this https://learn.microsoft.com/en-us/composer/how-to-use-oauth?tabs=v1x
Related
setup:
I have a bot registered in developer portal and created a app by teams tool kit.To add SSO for my bot i have created a azure bot with multi-tenant and create new app.Under bot configuration oauth connection setting create a service provider with azure ad v2.0 name botConnection,client Id & secret of my app already created by tool kit in token exchange url api://botid-clientidofapp then tenant is common and scope is set to User.Read,openId,email.
problem:
when i try to debug the bot while the oauth begin dialog throws "Could not find Connection Setting with name botconnection". i have set webapplicationinfo in manifest with client id of the app.any one can help me on this.
I'm not an expert, but did you update your code accordingly? You can check this link: https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-authentication?view=azure-bot-service-4.0&tabs=userassigned%2Caadv2%2Ccsharp which teaches you how to add authentication for Azure bot.
Also, Teams Toolkit supports adding sso for the scaffolded project. Check https://learn.microsoft.com/en-us/microsoftteams/platform/toolkit/add-single-sign-on?tabs=typescript%2F%3Ffrom%3Dteamstoolkit to see if it can help in your case.
I have a Teams query messaging extension with SSO. SSO and extension works well. The adaptive cards that I return have actions, but one of the actions is to open a SharePoint component that requires TeamLogon.aspx redirect to use. TeamsLogon.aspx requires specific SharePoint webApplicationInfo, e.g. ("id": "00000003-0000-0ff1-ce00-000000000000", "resource": "https://tenant.sharepoint.com"), but I already have my custom config for SSO to work. Are there any workarounds for such a situation yet?
If your bot has SSO credentials for app A then you can't open app B and expect SSO to work. We have restriction on one SSO credentials per app manifest.
We are developing the bot application using Microsoft Bot framework and decided to use a website as a channel.
Question is, our website (Channel) is secured with Azure AD Authentication once user is logged in the website. How we can use the same authenticated user token for the Bot to authenticate the user.
Thanks
Here's a Web Chat sample that shows how to do Single Sign On (SSO) for apps that use Azure Active Directory (AAD)
Note that this is not an easy task, but it is possible.
For other users not using AAD:
SSO for Enterprise Apps sample
SSO for Teams Apps sample
I have a bot running on a hosting page where users are logged in using SSO.
I want to authenticate the user in the bot automatically when the bot starts and I do not want to use anAuthCard to do it. Just want to automatically authenticate the user without prompting anything to him, just using SSO.
I found an article that refers three ways to authenticate an user in the bot:
Sharing the client's user token directly with the bot via ChannelData
Using an OAuthCard to drive a sign-in experience to any OAuth provider
A third option, called Single Sign-On (SSO), that is in development.
And, according to the article my situation is:
WebChat in an authenticated website where the user is already signed in and the website has a token to the same identity provider but to a different app that the bot needs -> in the future, this is single sign-on, but for now you 'll need to use an OAuthCard.
Is there any update about this functionality? How can I authenticate the user into the bot without using an OAuthCard or a SigninCard?
Thanks in advance
Not sure if you have tried the option of using WebChat with Azure Bot Service’s Authentication which provides built-in authentication capability to authenticate chat users with various identity providers such AAD, GitHub, Facebook, etc.
If you are looking for this built-in feature, then probably you need to build your own custom built solution using Google sign-in by passing the token ID of the authenticated users. Or for an Account linking OAuth2 solution as explained in this link: How to implement Login in Dialogflow chatbot.
Microsoft guys Are looking at the issue now. you can track the progress here.
I implemented a solution that worked for me. I have the bot running in a .net core web app
Here's what I did:
Generate an userId before initializing the BotApp
When the user clicks on the button to open the webchat, I'm opening an authenticated controller in a popup that receives the generated userId. The page is authenticated, so you will need to authenticate. I store the userId in my DB, along with access_token and some user information. The controller should be created in the same webapp where the bot is running.
After storing all the information I close the tab and start the BotApp with the generated userId
In bot code you will be able to query your DB (using userId).
To wait until the popup close, you can have a look into this here.
I hope that this helps someone.
Best regards
Newbie question here on Authentication. I am used to incorporating authentication into my app backend server, like Spring Security Authentication for example. I don't really understand how the authentication providers work.
My concern is that somehow each provider can only authenticate its own accounts, ie google can only authenticate for gmail accounts, and Azure Active directory can only authenticate some kind of Microsoft registered account? I am disinclined to oauth because as a user I am always paranoid about signing in for some game or app from an unknown provider becacuse I never am sure whether I just gave my gmail or facebook account password to a rando.
I am fine giving people the option to use Oath, but less comfortable if that's the only option. I would like people to be able to give me whatever email address they want, and a password which they create for my site only.
Also these questions: If I use an authentication provider can I get the actual email address being used to log in? Or do I only get a token?
If I am going to build my own authentication service so I can accept any email domain as user name, what is the easiest to implement in Xamarin forms, and can somebody point me to a tutorial or something?
Advice appreciated thanks.
Yes, you're right, each identity provider provides the ability to authenticate their own users; Google OAuth supports Google accounts, Azure Active Directory supports Microsoft work & school accounts, Microsoft Account supports Microsoft personal accounts, and so on.
You have quite a few options on how to add support for these identity providers in your app, in addition to what we typically call 'local accounts', or accounts created specifically for the given application. I'll list out a few approaches:
You can write all the code yourself to integrate with each identity provider individually, and build-your-own local account solution as well.
You can use an SDK/library in your Xamarin Forms which facilitates using multiple identity providers within your app. The Xamarin.Auth package has historically served this purpose for Xamarin apps. It provides auth capabilities for Facebook, Google, Microsoft, and Twitter.
You can use a dedicated cloud service which provides authentication services for your app. Some examples include Azure Mobile Apps, Firebase Auth, Gigya, and more. The exact identity providers supported and the level of support for Xamarin/Xamarin Forms will vary across each one. Azure AD B2C is another option that I know supports Xamarin Forms as well as Facebook, Google, Twitter, and local accounts (disclaimer: I work on AAD B2C). These services sometimes have free tiers & paid tiers, so you can compare & contrast each.
You could also build your own authentication service using open source code like Identity Server if you wish.
It definitely depends which route you go, but generally speaking each solution will provide you access to some user profile information upon user authentication. For Azure AD B2C, you can configure the claims that are returned to your application in the tokens your app receives. For other services, you may need to make a REST API call to get some user data like the email address.
HTH.