Amazon Cognito as Generic OAuth2 Provider for Bot from MSBotFramework in Teams

0
votes

I've put together this sample to integrate a bot in Microsoft Teams:

https://github.com/microsoft/BotBuilder-Samples/tree/main/samples/csharp_dotnetcore/46.teams-auth

Good news is, it works just fine out of the box with an Azure AD Connection as OAuth2 sign-in.

We use Amazon Cognito User Pools, and in order to call queries and other things, I need to be signed in, for obvious reasons. Therefore, I've tried configuring another connection, this time with a Generic OAuth2 Provider since Cognito is not in the list.

These are my connection settings for the Generic Provider

enter image description here

I've hidden the actual IDs for obvious reasons, but the core URLs are present, as stated in the Cognito docs.

I've also added "token.botframework.com" and "*.amazoncognito.com" in the validDomains list of the manifest.

Now, when I click on the sign in card button, the popup opens, but I'm getting a redirect_mismatch error in the URL, like so

enter image description here

I have looked up the reason for this error and it is stated that the redirection URL must match the atleast one of the callback URLs in the Cognito App Client corresponding to the provided ID.

However, in the sample's code for the bot, I can't seem to see where you specify such callback URL when dealing when the OAuth Prompt directly.

enter image description here

enter image description here

enter image description here

Any wizards in here have ideas about this? I would greatly appreciate any and all help.

Thanks!

EDIT As requested, here's the settings page for the app client

enter image description here

Given that it's a MS Teams app, I have ngrok tunnels setup for traffic, so I put both URLs in there just to be sure... localhost:3000 is actually where the ngrok.io tunnel points to.

And here is proof that our Hosted UI, when opened from the User Pool, actually shows up, and at a redirect_uri of localhost:3000/

enter image description here

1
botframeworkamazon-cognitomicrosoft-teams
Did you add your web app's url to the Cognito App Client's Callback url? That is in the Cognito console under App Integration -> App client settings - Dylan
@Dylan, thanks for the quick reply. I did add it, as indicated by the added screenshots to OP - aLx450
Not sure if this will help, but have you tried removing the trailing slash from on the localhost url? - Dylan
I have tried with and without, to no avail unfortunatly. - aLx450
When using the built-in auth support in Azure Bot Service, it fully handles the auth redirects. So your registered redirect URL ("callback URL" in Amazon Cognito?) should be https://token.botframework.com/.auth/web/redirect. This should have been your redirect URL when you tried it with AAD too. - Nafis Zaman

1 Answers

1
votes

(Posting my comment above as an answer, since it seems to have solved the issue.)

When using the built-in auth support in Azure Bot Service, it fully handles the auth redirects. So your registered redirect URL ("callback URL" in Amazon Cognito?) should be https://token.botframework.com/.auth/web/redirect. This should have been your redirect URL when you tried it with AAD too, as indicated in the Bot Framework documentation for adding authentication to a bot.