Skip to content

Commit 4984669

Browse files
aaceboaacebo
authored
Auth Credentials Improvement (#25)
* Update README.md * update telemetry header prefix * sign client token * undo client token * cleanup * add tenantid to token resolve call * fix oauth ttk config * fix connection name * fmt
1 parent a57efcd commit 4984669

File tree

3 files changed

+240
-178
lines changed

3 files changed

+240
-178
lines changed

‎packages/cli/configs/ttk/oauth/aad.manifest.json

+90
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
{
2+
"id": "${{AAD_APP_OBJECT_ID}}",
3+
"appId": "${{BOT_ID}}",
4+
"displayName": "SsoAuthBot${{APP_NAME_SUFFIX}}",
5+
"identifierUris": ["api://botid-${{BOT_ID}}"],
6+
"signInAudience": "AzureADMultipleOrgs",
7+
"api": {
8+
"requestedAccessTokenVersion": 2,
9+
"oauth2PermissionScopes": [
10+
{
11+
"adminConsentDescription": "Allows Teams to call the app's web APIs as the current user.",
12+
"adminConsentDisplayName": "Teams can access app's web APIs",
13+
"id": "${{AAD_APP_ACCESS_AS_USER_PERMISSION_ID}}",
14+
"isEnabled": true,
15+
"type": "User",
16+
"userConsentDescription": "Enable Teams to call this app's web APIs with the same rights that you have",
17+
"userConsentDisplayName": "Teams can access app's web APIs and make requests on your behalf",
18+
"value": "access_as_user"
19+
}
20+
],
21+
"preAuthorizedApplications": [
22+
{
23+
"appId": "1fec8e78-bce4-4aaf-ab1b-5451cc387264",
24+
"delegatedPermissionIds": ["${{AAD_APP_ACCESS_AS_USER_PERMISSION_ID}}"]
25+
},
26+
{
27+
"appId": "5e3ce6c0-2b1f-4285-8d4b-75ee78787346",
28+
"delegatedPermissionIds": ["${{AAD_APP_ACCESS_AS_USER_PERMISSION_ID}}"]
29+
},
30+
{
31+
"appId": "d3590ed6-52b3-4102-aeff-aad2292ab01c",
32+
"delegatedPermissionIds": ["${{AAD_APP_ACCESS_AS_USER_PERMISSION_ID}}"]
33+
},
34+
{
35+
"appId": "00000002-0000-0ff1-ce00-000000000000",
36+
"delegatedPermissionIds": ["${{AAD_APP_ACCESS_AS_USER_PERMISSION_ID}}"]
37+
},
38+
{
39+
"appId": "bc59ab01-8403-45c6-8796-ac3ef710b3e3",
40+
"delegatedPermissionIds": ["${{AAD_APP_ACCESS_AS_USER_PERMISSION_ID}}"]
41+
},
42+
{
43+
"appId": "0ec893e0-5785-4de6-99da-4ed124e5296c",
44+
"delegatedPermissionIds": ["${{AAD_APP_ACCESS_AS_USER_PERMISSION_ID}}"]
45+
},
46+
{
47+
"appId": "4765445b-32c6-49b0-83e6-1d93765276ca",
48+
"delegatedPermissionIds": ["${{AAD_APP_ACCESS_AS_USER_PERMISSION_ID}}"]
49+
},
50+
{
51+
"appId": "4345a7b9-9a63-4910-a426-35363201d503",
52+
"delegatedPermissionIds": ["${{AAD_APP_ACCESS_AS_USER_PERMISSION_ID}}"]
53+
}
54+
]
55+
},
56+
"info": {},
57+
"optionalClaims": {
58+
"idToken": [],
59+
"accessToken": [
60+
{
61+
"name": "idtyp",
62+
"source": null,
63+
"essential": false,
64+
"additionalProperties": []
65+
}
66+
],
67+
"saml2Token": []
68+
},
69+
"publicClient": {
70+
"redirectUris": []
71+
},
72+
"requiredResourceAccess": [
73+
{
74+
"resourceAppId": "Microsoft Graph",
75+
"resourceAccess": [
76+
{
77+
"id": "User.Read",
78+
"type": "Scope"
79+
}
80+
]
81+
}
82+
],
83+
"web": {
84+
"redirectUris": ["https://token.botframework.com/.auth/web/redirect"],
85+
"implicitGrantSettings": {}
86+
},
87+
"spa": {
88+
"redirectUris": []
89+
}
90+
}

‎packages/cli/configs/ttk/oauth/teamsapp.local.yml

+94-109
Original file line numberDiff line numberDiff line change
@@ -12,122 +12,107 @@ environmentFolderPath: ./env
1212
# Defines what the `provision` lifecycle step does with Teams Toolkit.
1313
# Runs first during Start Debugging (F5) or run manually using `teamsfx provision --env local`.
1414
provision:
15-
# Automates the creation of a Teams app registration and saves the App ID to an environment file.
16-
- uses: teamsApp/create
17-
with:
18-
name: OAthBot${{APP_NAME_SUFFIX}}
19-
writeToEnvironmentFile:
20-
teamsAppId: TEAMS_APP_ID
15+
# Automates the creation of a Teams app registration and saves the App ID to an environment file.
16+
- uses: teamsApp/create
17+
with:
18+
name: SsoAuthBot${{APP_NAME_SUFFIX}}
19+
writeToEnvironmentFile:
20+
teamsAppId: TEAMS_APP_ID
2121

22-
# Creates a new Microsoft Entra app to authenticate users if
23-
# the environment variable that stores clientId is empty
24-
- uses: aadApp/create
25-
with:
26-
# Note: when you run aadApp/update, the Microsoft Entra app name will be updated
27-
# based on the definition in manifest. If you don't want to change the
28-
# name, make sure the name in Microsoft Entra manifest is the same with the name
29-
# defined here.
30-
name: OAuthBot${{APP_NAME_SUFFIX}}
31-
# If the value is false, the driver will not generate client secret for you
32-
generateClientSecret: true
33-
# organization's Microsoft Entra tenant (for example, single tenant).
34-
signInAudience: AzureADMultipleOrgs
35-
# Write the information of created resources into environment file for the
36-
# specified environment variable(s).
37-
writeToEnvironmentFile:
38-
clientId: BOT_ID
39-
# Environment variable that starts with `SECRET_` will be stored to the
40-
# .env.{envName}.user environment file
41-
clientSecret: SECRET_BOT_PASSWORD
42-
objectId: AAD_APP_OBJECT_ID
43-
tenantId: AAD_APP_TENANT_ID
44-
authority: AAD_APP_OAUTH_AUTHORITY
45-
authorityHost: AAD_APP_OAUTH_AUTHORITY_HOST
22+
# Creates a new Microsoft Entra app to authenticate users if
23+
# the environment variable that stores clientId is empty
24+
- uses: aadApp/create
25+
with:
26+
# Note: when you run aadApp/update, the Microsoft Entra app name will be updated
27+
# based on the definition in manifest. If you don't want to change the
28+
# name, make sure the name in Microsoft Entra manifest is the same with the name
29+
# defined here.
30+
name: SsoAuthBot${{APP_NAME_SUFFIX}}
31+
# If the value is false, the driver will not generate client secret for you
32+
generateClientSecret: true
33+
# organization's Microsoft Entra tenant (for example, single tenant).
34+
signInAudience: AzureADMultipleOrgs
35+
# Write the information of created resources into environment file for the
36+
# specified environment variable(s).
37+
writeToEnvironmentFile:
38+
clientId: BOT_ID
39+
# Environment variable that starts with `SECRET_` will be stored to the
40+
# .env.{envName}.user environment file
41+
clientSecret: SECRET_BOT_PASSWORD
42+
objectId: AAD_APP_OBJECT_ID
43+
tenantId: AAD_APP_TENANT_ID
44+
authority: AAD_APP_OAUTH_AUTHORITY
45+
authorityHost: AAD_APP_OAUTH_AUTHORITY_HOST
4646

47-
# Apply the Microsoft Entra manifest to an existing Microsoft Entra app. Will use the object id in
48-
# manifest file to determine which Microsoft Entra app to update.
49-
- uses: aadApp/update
50-
with:
51-
# Relative path to this file. Environment variables in manifest will
52-
# be replaced before apply to Microsoft Entra app
53-
manifestPath: ./aad.manifest.json
54-
outputFilePath: ./build/aad.manifest.${{TEAMSFX_ENV}}.json
47+
# Apply the Microsoft Entra manifest to an existing Microsoft Entra app. Will use the object id in
48+
# manifest file to determine which Microsoft Entra app to update.
49+
- uses: aadApp/update
50+
with:
51+
# Relative path to this file. Environment variables in manifest will
52+
# be replaced before apply to Microsoft Entra app
53+
manifestPath: ./aad.manifest.json
54+
outputFilePath: ./build/aad.manifest.${{TEAMSFX_ENV}}.json
5555

56-
- uses: arm/deploy # Deploy given ARM templates parallelly.
57-
env:
58-
# an arbitrary name for the connection
59-
OAUTH_CONNECTION_NAME: graph
60-
with:
61-
# AZURE_SUBSCRIPTION_ID is a built-in environment variable,
62-
# if its value is empty, TeamsFx will prompt you to select a subscription.
63-
# Referencing other environment variables with empty values
64-
# will skip the subscription selection prompt.
65-
subscriptionId: ${{AZURE_SUBSCRIPTION_ID}}
66-
# AZURE_RESOURCE_GROUP_NAME is a built-in environment variable,
67-
# if its value is empty, TeamsFx will prompt you to select or create one
68-
# resource group.
69-
# Referencing other environment variables with empty values
70-
# will skip the resource group selection prompt.
71-
resourceGroupName: ${{AZURE_RESOURCE_GROUP_NAME}}
72-
templates:
73-
- path: ./infra/azure.local.bicep # Relative path to this file
74-
# Relative path to this yaml file.
75-
# Placeholders will be replaced with corresponding environment
76-
# variable before ARM deployment.
77-
parameters: ./infra/azure.parameters.local.json
78-
# Required when deploying ARM template
79-
deploymentName: create-resources-for-OAuthBot-${{TEAMSFX_ENV}}
80-
bicepCliVersion: v0.9.1
56+
- uses: arm/deploy # Deploy given ARM templates parallelly.
57+
env:
58+
# an arbitrary name for the connection
59+
OAUTH_CONNECTION_NAME: graph
60+
with:
61+
# AZURE_SUBSCRIPTION_ID is a built-in environment variable,
62+
# if its value is empty, TeamsFx will prompt you to select a subscription.
63+
# Referencing other environment variables with empty values
64+
# will skip the subscription selection prompt.
65+
subscriptionId: ${{AZURE_SUBSCRIPTION_ID}}
66+
# AZURE_RESOURCE_GROUP_NAME is a built-in environment variable,
67+
# if its value is empty, TeamsFx will prompt you to select or create one
68+
# resource group.
69+
# Referencing other environment variables with empty values
70+
# will skip the resource group selection prompt.
71+
resourceGroupName: ${{AZURE_RESOURCE_GROUP_NAME}}
72+
templates:
73+
- path: ./infra/azure.local.bicep # Relative path to this file
74+
# Relative path to this yaml file.
75+
# Placeholders will be replaced with corresponding environment
76+
# variable before ARM deployment.
77+
parameters: ./infra/azure.parameters.local.json
78+
# Required when deploying ARM template
79+
deploymentName: Create-resources-for-SsoAuthBot-${{TEAMSFX_ENV}}
80+
bicepCliVersion: v0.9.1
8181

82-
# Optional: Automates schema and error checking of the Teams app manifest and outputs the results in the console.
83-
- uses: teamsApp/validateManifest
84-
with:
85-
manifestPath: ./appPackage/manifest.json
82+
# Optional: Automates schema and error checking of the Teams app manifest and outputs the results in the console.
83+
- uses: teamsApp/validateManifest
84+
with:
85+
manifestPath: ./appPackage/manifest.json
8686

87-
# Automates the creation and configuration of a Bot Framework registration which is required for a bot.
88-
# This configures the bot to use the Azure AD app registration created in the previous step.
89-
# Teams Toolkit automatically creates a local Dev Tunnel URL and updates BOT_ENDPOINT when debugging (F5).
90-
- uses: botFramework/create
91-
with:
92-
botId: ${{BOT_ID}}
93-
name: OAuthBot
94-
messagingEndpoint: ${{BOT_ENDPOINT}}/api/messages
95-
description: ''
96-
channels:
97-
- name: msteams
87+
# Automates the creation of a Teams app package (.zip).
88+
- uses: teamsApp/zipAppPackage
89+
with:
90+
manifestPath: ./appPackage/manifest.json
91+
outputZipPath: ./appPackage/build/appPackage.${{TEAMSFX_ENV}}.zip
92+
outputJsonPath: ./appPackage/build/manifest.${{TEAMSFX_ENV}}.json
9893

99-
# Optional: Automates schema and error checking of the Teams app manifest and outputs the results in the console.
100-
- uses: teamsApp/validateManifest
101-
with:
102-
manifestPath: ./appPackage/manifest.json
103-
104-
# Automates the creation of a Teams app package (.zip).
105-
- uses: teamsApp/zipAppPackage
106-
with:
107-
manifestPath: ./appPackage/manifest.json
108-
outputZipPath: ./appPackage/build/appPackage.${{TEAMSFX_ENV}}.zip
109-
outputJsonPath: ./appPackage/build/manifest.${{TEAMSFX_ENV}}.json
110-
111-
# Automates updating the Teams app manifest in Teams Developer Portal using the App ID from the mainfest file.
112-
# This action ensures that any manifest changes are reflected when launching the app again in Teams.
113-
- uses: teamsApp/update
114-
with:
115-
# Relative path to this file. This is the path for built zip file.
116-
appPackagePath: ./appPackage/build/appPackage.${{TEAMSFX_ENV}}.zip
94+
# Automates updating the Teams app manifest in Teams Developer Portal using the App ID from the mainfest file.
95+
# This action ensures that any manifest changes are reflected when launching the app again in Teams.
96+
- uses: teamsApp/update
97+
with:
98+
# Relative path to this file. This is the path for built zip file.
99+
appPackagePath: ./appPackage/build/appPackage.${{TEAMSFX_ENV}}.zip
117100

118101
# Defines what the `deploy` lifecycle step does with Teams Toolkit.
119102
# Runs after `provision` during Start Debugging (F5) or run manually using `teamsfx deploy --env local`.
120103
deploy:
121-
# Install any dependencies and build the web app using NPM
122-
- uses: cli/runNpmCommand
123-
name: install dependencies
124-
with:
125-
args: install --no-audit --workspaces=false
126-
# Provides the Teams Toolkit .env file values to the apps runtime so they can be accessed with `process.env`.
127-
- uses: file/createOrUpdateEnvironmentFile
128-
with:
129-
target: ./.env
130-
envs:
131-
PORT: 3978
132-
CLIENT_ID: ${{BOT_ID}}
133-
CLIENT_SECRET: ${{SECRET_BOT_PASSWORD}}
104+
# Install any dependencies and build the web app using NPM
105+
- uses: cli/runNpmCommand
106+
name: install dependencies
107+
with:
108+
args: install --no-audit --workspaces=false
109+
# Provides the Teams Toolkit .env file values to the apps runtime so they can be accessed with `process.env`.
110+
- uses: file/createOrUpdateEnvironmentFile
111+
with:
112+
target: ./.env
113+
envs:
114+
PORT: 3978
115+
CLIENT_ID: ${{BOT_ID}}
116+
CLIENT_SECRET: ${{SECRET_BOT_PASSWORD}}
117+
# an arbitrary name for the connection
118+
OAUTH_CONNECTION_NAME: graph

0 commit comments

Comments
 (0)