Search code examples
c#botframeworkbotschatbot

How to enable multiple AD authentication in BOT while using OAuthPrompt or which other mechanism can be used to enable multiple AD?

I want to enable multiple AD authentication using OAuth Prompt in my BOT that i have developed.Currently, there is only one connection that it is taking through which our project AD is getting hit and the credentials are validated. But, i want the same O-Auth prompt to work for different AD's at a time in the BOT which was created using MS Bot framework V4 SDK in C#.

To clearly explain my query, let me take and example and also let me tell you the steps i have followed for enabling the Authentication in my BOT:

  1. MS Bot deployed to AZURE
  2. In the setting of WebApp Bot created OAuth Connection setting with Name: OauthConnection by providing my AZURE AD client ID and secret during creation. Tested the connection it was successful.
  3. In my BOT code, used OAuthPrompt method for enabling the authentication and to it passed the Connection name as "OauthConnection" which was created in STEP #2
  4. Added this Prompt method to the Dialog stack
  5. Now my Bot code when executed gives me sign in option where if i enter the required credentials, it gets validated against the AZURE AD using the connection name provided in the OAuth Prompt method where in turn the required client ID was given
  6. Now if we observe, The credentials are validated against the AZURE AD of which the connection name was given

What I Want to achieve is:

How to make the OAuth Prompt method such that it supports Multiple ADs simultaneously at a time?

Meaning, if my AD uses the domain as @axct.com and another AD uses domain as @avabt.com currently the oauth prompt if configured using above steps either supports the authentication of AD which uses login as @axct.com or @avabt.com at any given point of time but not both at a time in parallel.

I want to enable it such that it uses both AD for authentication at any given time in parallel such that if i use [email protected] and its password during login it should successfully authenticate and return the respective Token at the same time if I use [email protected] as login credentials with proper password it should still successfully authenticate and return me the Token such that i can retrieve the user name from using the returned token using graph API.

How to achieve this is my query or issue as i am not sure how to do it?

Similarly, how to enable for any given AD like social networking sites, google or any other credentials using single Oauth Prompt method.

Is this can be achieved using Oauth Prompt? If yes please explain in detailed guide step by step manner in solving this issue as i am new to BOT and coding

or this is wrong expectation we have to use another method and not Oauth prompt?

Please explain in detailed guide step by step manner in solving this issue as i am new to BOT and coding.

Language: C#

Bot SDK: V4

Thanks in Advance

Regards -ChaitanyaNG

Expected Result: Enable multiple AD authentication at a any given point of time using OAuth prompt in BOT SDK V4 code done in C# such that it works in parallel

Actual Result: Only one AD authentication works

Update to the query: 14 Aug 2019 -

To make my query more easily understandable-

How to make/convert my BOT using OAuth Prompt for authentication such that it works as a multi-tenant SaaS application using Azure AD?

Please help me with this query or issue so that i can implement it in my BOT having Water Fall Dialog.

Solution

  • The sample bots are configured to only look for one connection string. This leaves you with two options:

    1) you can configure your dialogs to branch based on user input of what type of domain they're going to be using. Then, based on the dialog, for example axctDialog.cs or avabtDialog.cs, an auth prompt could be created, and it would use the connection string you have for it in appsettings. This would mean, however, asking your users to select their domain before signing in, something they might find tedious and extraneous.

    2) When you create your Azure AD application (what you created in order to create the connection string on the bot), you create it to be multi-tenant. Much simpler. If you've already created your AAD app, you can go into the app manifest and change the values. For example, signInAudience would need to be set to either AzureADMultipleOrgs or AzureADandPersonalMicrosoftAccount and the endpoint would be common instead of the tenant domain. More details about this can be read here.