search

microsoft / BotBuilder-Samples

Welcome to the Bot Framework samples repository. Here you will find task-focused samples in C#, JavaScript/TypeScript, and Python to help you get started with the Bot Framework SDK!
https://github.com/Microsoft/botframework
MIT License
4.38k stars 4.88k forks source link

Teams Bot Auth: oAuth Card with AADV2 returns expired tokens #2530

Closed bravokeyl closed 4 years ago

bravokeyl commented 4 years ago

Sample information

  1. Sample type: samples
  2. Sample language: nodejs
  3. Sample name: 46.teams-auth

Describe the bug

I'm using sample auth with AADV2 connection and custom scope. The token is not renewed and receiving the expired token.

To Reproduce

Steps to reproduce the behavior:

  1. Use the 46 sample with AADV2 connection type
  2. Set the scopes to be "offline_access" and custom scope like "api://appid/myscope"
  3. Try the sample now the token is received
  4. After an hour we also receive the same even though the token is expired

Expected behavior

  1. We should receive the new token after the previous token is expired.

Additional context

https://stackoverflow.com/questions/62527519/teams-bot-auth-oauth-card-prompts-for-login-every-hour-with-aadv2

[bug]

jwiley84 commented 4 years ago

Hi @bravokeyl

Token handling is not something the bot does; it does not automatically refresh. The OAuth samples are meant to show simple implementation of sign-in and sign-out logic. As you've already asked this question on stackoverflow, I'm going to close this issue, and answer further queries there.

bravokeyl commented 4 years ago

@jwiley84 Thanks for the quick response.

I'm confused from the comments in the code. I thought when we call the prompt it returns the new token if the previous token is expired, is my assumption wrong here?

pujita9610 commented 4 years ago

@jwiley84 Stumbled upon on the same thing today, I'm wondering how we can retreive a new token. It would be great to add some notes on how to do that. Currently I can see that there is no way to renew the token as we just get a hold on accestoken and no refresh token is received.

What are the possible ways to retreive a new token without re-prompting the user with sign-in card?

bravokeyl commented 4 years ago

@jwiley84 @pujita9610 Yes, it would be very helpful if there are notes/guidance on how to retrieve a new token with oAuthCard

bravokeyl commented 4 years ago

@jwiley84 Any further input on this would be great to retrieve the valid token. Thanks

nayanaramakanth commented 3 years ago

Any updates on this issue ?