3

I'm following the teams auth sample available here. To sign in into the bot using oAuth Prompt with AADV2 connection, the token is received but after one hour or so, the bot again prompts for "Signin", from my understanding the bot should fetch the new token silently and not prompt the user to sign in.

In the sample, it mentions about this but not sure what exactly that means.

How do we get the new token without another sign in the prompt as the user is already signed in?

3
  • Could you please share your app manifest with us? Jun 23, 2020 at 11:07
  • Application is running on localhost with ngrok, will sharing the manifest help?
    – bravokeyl
    Jun 23, 2020 at 12:47
  • Can you perhaps post a sample of your code? Jun 30, 2020 at 20:24

3 Answers 3

2

The bot is not designed to automatically refresh tokens. That's on the dev to check that the token is valid/not expired and if so, request a new one (reprompt for signin). The line of code that you've reference in your second link exhibits how the prompt is not sent to the user on every turn (that would get very tedious for users), but instead checks every turn that that the token is valid. For the hour that the token is valid, it returns the valid token and the user is unaffected in anyway. After the token is expired, because this check, the oauthprompt card is resent to the user to log back in.

Broken down, the following method runs if the user chooses 'yes' on a prompt from a previous step. It then takes that activity (const result = stepContext.result), and sends it back to OAuthPrompt to see if there is a valid token on it. :

async displayTokenPhase1(stepContext) {
        await stepContext.context.sendActivity('Thank you.');

        const result = stepContext.result;
        if (result) {
            // Call the prompt again because we need the token. The reasons for this are:
            // 1. If the user is already logged in we do not need to store the token locally in the bot and worry
            // about refreshing it. We can always just call the prompt again to get the token.
            // 2. We never know how long it will take a user to respond. By the time the
            // user responds the token may have expired. The user would then be prompted to login again.
            //
            // There is no reason to store the token locally in the bot because we can always just call
            // the OAuth prompt to get the token or get a new token if needed.
            return await stepContext.beginDialog(OAUTH_PROMPT);
        }
        return await stepContext.endDialog();
    }

Part of the constructor for an OauthPrompt is checking if there is already a valid token:

/**
     * Creates a new OAuthPrompt instance.
     * @param dialogId Unique ID of the dialog within its parent `DialogSet` or `ComponentDialog`.
     * @param settings Settings used to configure the prompt.
     * @param validator (Optional) validator that will be called each time the user responds to the prompt.
     */
    constructor(dialogId: string, private settings: OAuthPromptSettings, private validator?: PromptValidator<TokenResponse>) {
        super(dialogId);
    }

 public async beginDialog(dc: DialogContext, options?: PromptOptions): Promise<DialogTurnResult> {
        // Ensure prompts have input hint set
        const o: Partial<PromptOptions> = {...options};
        if (o.prompt && typeof o.prompt === 'object' && typeof o.prompt.inputHint !== 'string') {
            o.prompt.inputHint = InputHints.ExpectingInput;
        }
        if (o.retryPrompt && typeof o.retryPrompt === 'object' && typeof o.retryPrompt.inputHint !== 'string') {
            o.retryPrompt.inputHint = InputHints.ExpectingInput;
        }

        // Initialize prompt state
        const timeout: number = typeof this.settings.timeout === 'number' ? this.settings.timeout : 54000000;
        const state: OAuthPromptState = dc.activeDialog.state as OAuthPromptState;
        state.state = {};
        state.options = o;
        state.expires = new Date().getTime() + timeout;

        // Attempt to get the users token
        const output: TokenResponse = await this.getUserToken(dc.context);
        if (output !== undefined) {
            // Return token
            return await dc.endDialog(output);
        } else {
            // Prompt user to login
            await this.sendOAuthCardAsync(dc.context, state.options.prompt);

            return Dialog.EndOfTurn;
        }
    }

The comment isn't very clear on this. I've rewritten some of it for clarity, and will reach out to coworkers to fix this.

// Call the prompt again because we need the token. The reasons for this are:
// 1. If the user is already logged in, we do not need to store the token locally in the bot. We can always just call the prompt again to get the token.
// 2. We never know how long it will take a user to respond. By the time the
// user responds the token may have expired. The user would then be prompted to login again.
// 3. If the token is expired, OAuthPrompt will send a new login card to the user to login, and get a new token
5
  • 1
    Prompting the user for sign-in every hour isn't good from the end-user pov. To request a new token, is there any other way apart from prompting with the oAuth card? I noticed that refresh tokens are not returned as it is AADV2 and I see no way to renew tokens in the background.
    – bravokeyl
    Jun 23, 2020 at 20:34
  • 1
    May I know what the dev should do to get a new valid token? Thanks
    – bravokeyl
    Jun 23, 2020 at 20:34
  • I'm facing the same issue on Bot composer. I am using OAuth Login external resource, and AADV2. Assigned offline_access to the OAuth setting for Web APP Bot. Still not getting refresh token. If AADV2 does not return refresh token, then it is huge bump for the development. Any solution for this issue?
    – shyambabu
    Jul 13, 2020 at 7:36
  • Having the same issue, @bravokeyl did you find any solution for this? Thank you! Jul 15, 2021 at 15:39
  • @IvanSangines I didn't find any viable solution for this.
    – bravokeyl
    Jul 17, 2021 at 15:39
0

I haven't worked with signin all that much, but when I've see this behaviour, it's because I was caching the token myself, and the token you get back is very short lived (1-2 hours). In the end, I realised you're actually meant to call getUserToken every time you want a token - it will cache the token correctly for you (albeit that you need to make a call every time - I wanted to avoid that).

7
  • I'm using the sample code itself not many changes apart from consuming the token to make authenticated api calls to our backend. I'm working with javascript sample, so how to call getUserToken every time?
    – bravokeyl
    Jun 30, 2020 at 20:39
  • I don't think you need to "call" it every time per se - the dialog framework will do that automatically for you, if you're using dialogs. Are you trying to cache the token yourself in any way though? Jun 30, 2020 at 21:18
  • Using the waterfall dialog same as mentioned in the sample and it returns oAuthCard when the token is expired(say every 65mins). github.com/microsoft/BotBuilder-Samples/issues/2530
    – bravokeyl
    Jul 1, 2020 at 19:17
  • The issue here with oAuthCard prompt is, it doesn't refresh the token and I'm unable to figure out how to get the new token without prompting the user with card again and again
    – bravokeyl
    Jul 1, 2020 at 19:19
  • ok. Wanted to confirm that you're not doing anything specifically yourself, to cache the tokens. Jul 2, 2020 at 12:38
0

alwaysPrompt flag should be false. Then OAuth prompt will get refresh tokens silently without prompting login card. Please refer the answer on github about this isse.

Bot composer OAuth refresh token

1
  • I don't think that bot builder js SDK has that option
    – bravokeyl
    Jul 17, 2020 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.