Can't get sample 18 to work without using a magic code

[JonathanFingold]

Version

What version of the Emulator are you using: 4.4.1

Describe the bug

When I try to run the 18.Bot-authentication sample, it didn't work correctly, until I checked the Use a sing-in verification code for OAuthCards emulator setting, forcing the use of a magic code. However, the point of the sample is to show how to avoid the need for a magic code.

To Reproduce

Steps to reproduce the behavior:

1. Register an Azure AD v1 app for use with the No x86_32 Build #18 bot. (I haven't tried reproducing with a v2 app yet.)
2. Create a channels registration bot and add an OAuth connection for the v1 app.
3. Update the appsettings.json file for the bot.
4. Run the bot locally.
5. Attach to it in the Emulator, using the bot's app ID and password. (Use the http:// endpoint.)
6. Attempt to exercise the bot and log in.
7. Error: The log in flow never completes correctly. (It should ask if you want to see your token.)
8. Select the Use a sing-in verification code for OAuthCards emulator setting and restart the emulator.
9. Try connecting to the bot again and logging in.
10. You get a magic code to use, but now the bot appear to otherwise work correctly, in that you are asked if you want to see your token.

Expected behavior

We shouldn't have to use a magic code to get this sample to work correctly.

Screenshots

Here's the bot behavior with using the magic code:

Additional context

1. I've been trying to get this to work with help from @EricDahlvang and @mingweiw.
2. This issue means the current authentication how-to documentation is in error and is blocked from being corrected.

[bug]

[tonyanziano]

Hmm, this is interesting. I took a look at the history of the code affected by the verification code checkbox, and it hasn't been touched in over a year.

This isn't a scenario we test often, but it seems unlikely to me that we would have recently introduced a bug that would affect this flow.

[JonathanFingold]

The Azure UI for creating AAD app registrations changed very recently. There appears to be some untoward interaction between Azure, the sample, and the Emulator that I have not been able to narrow down further.

I don't think the code for the check box broke anything. It's just that it is providing a work around for whatever is broken.

[v-kydela]

An event activity with a token is supposed to be sent to the bot to indicate that the user has signed in successfully. This does not happen in 4.4.1. When the user signs in, the bot is not notified.

[stevkan]

What @v-kydela describes predates version 4.4.1. I spoke with @Jeffders some few months ago regarding some OAuth questions I had in which this topic came up. His explanation suggested that this was the known, if not expected, behavior. Without the magic code, the user needs to prompt the bot with another comment in order for the dialog to continue normally.

[v-kydela]

I do remember having this problem in older versions, but authentication without the magic code worked in 4.4.0. The problem seems to have been reintroduced in 4.4.1.

[JonathanFingold]

Ming was able to get the sample to work in the v3 emulator, the issue appears to be in the v4 emulator (as opposed to the sample code or the Azure service).

[v-kydela]

Can the responsible party please label this as a bug?

[tonyanziano]

I now have some cycles to take a look at this and investigate what's going on.

[tonyanziano]

After some investigation I've figured out the problem, and I have a workaround that should be sufficient until we get a fix into master.

TLDR; Uncheck the "Bypass ngrok for local addresses" option in the app settings as a workaround for now, and OAuth prompt cards should work.

===

The Problem:

In both V3 and V4 of the Emulator, we have the option to bypass ngrok for bots running on localhost.

When we go through the OAuth flow, after the user has signed in through Microsoft, we contact the Bot Framework token server with a postback URL that the token server can send the newly generated access token to.

In V3, we always have a running ngrok URL that we use as the postback URL, so that when the token server grants us a token, it sends it to this ngrok URL (the Emulator) that the Emulator then sends to the bot, completing the auth flow.

However, in V4, when we have "Bypass ngrok for localhost" enabled, we instead send the actual Emulator localhost service url as the postback URL, which the token server tries to contact, but cannot, because there is no tunnel from the user's machine to the token server. Therefore, the token never makes it back to the Emulator, thus the Emulator never sends the token back to the bot.

Temporary Workaround

To get around this until we merge a fix into master, you can go to app settings and uncheck the "Bypass ngrok for local addresses" option and save your settings.

Working

[JonathanFingold]

I'll put a comment in for now in the authentication how to to this effect.

[EricDahlvang]

V3 had both of these settings too:

Can we require "Use a sign-in verification code for OAuthCards" if "Bypass ngrok for local addresses" is checked?