1

I am porting some code into the newer Microsoft Bot Framework V4 using C#.

The original code was a POC in v3 (still c# though).

I am trying to copy the authentication aspect whereby the user us redirected using a signin card to their bespoke (personal) login page external to the bot. Upon logging in there they are issued a refresh token via our external software, which is then sent via a POST request back to the a controller in the bot, which resumes the conversation (I think this is now referred to as direct line?).

This refresh token is then used to call our api and access data via dialogs.

The state of the conversation I can see is stored in a ResumptionCookie which seems to be part of the BotFramework v3. I understand the sequence but can't seem to locate a ResumptionCookie in v4, nor can I find any examples that I can match to this need.

I was wondering if any core concepts have changed with this regard, or simply the name of the cookie etc.

I'm very new to the framework which has made it slightly more confusing. Unfortunately it feels like the auth is the hardest and first part though!

Any help much appreciated!

Thanks

1 Answer 1

2

ResumptionCookie has been replaced with ConversationReference.

Also, Azure Bot Service now provides an OAuth Service configurable from within the Bot Settings:

enter image description here

Using the Azure Bot Service OAuth with the OAuthPrompt, Bot Service will retrieve the token for you, and simplify the process of authenticating.

More information can be found here: https://learn.microsoft.com/en-us/azure/bot-service/bot-builder-authentication

A blog post announcing this feature can be found here: https://blog.botframework.com/2018/08/28/sign-in-experiences/

9
  • Thanks Eric, I love the idea of using the OAuth prompt and managing the tokens in Azure. However I'm not sure it will be flexible enough for our needs as we have maybe a bit of an unusual setup. A user may authenticate via our site using local username/pass or SAML - also the url for authenticating will be different per tenant as they have their own domains. I can create a process to return a bearer token etc, but is it possible to hook it up this way using the connections you mentioned? Is that what the OAuth2 Generic Provider is for, i.e. the Authorisation Url Template? Many thanks
    – Grenville
    Mar 27, 2019 at 21:43
  • Following on from that comment, is there any documentation you're aware of for the Oauth 2 Generic Provider connection service provider?
    – Grenville
    Mar 27, 2019 at 21:49
  • I don't know of documentation specific for the OAuth 2 Generic Provider, but it should work with your internal/custom OAuth provider as long as your provider is following the OAuth 2 spec. Mar 27, 2019 at 23:01
  • Ok, thanks. I can't understand the format of the available fields for the connection. Looking back into sending the conversationreference data and continuing after visiting out website to login, what would be the approach to sending an activity back to the bot from our website? Would it be using the Bot Connector API?
    – Grenville
    Mar 28, 2019 at 16:55
  • You can make a different endpoint in the bot code, and call it after the authentication piece is finished. This code is a V3 example: github.com/MicrosoftArchive/botauth/blob/master/CSharp/BotAuth/… But you can also do something similar in Bot Builder V4. Mar 28, 2019 at 18:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.