Teams Tab SSO Authentication Sample TS

Code Sample
06/04/2024

Tabs are Teams-aware webpages embedded in Microsoft Teams. A channel/group tab delivers content to channels and group chats, and are a great way to create collaborative spaces around dedicated web-based content.

Interaction with app

setupteams

Prerequisites

Microsoft Teams is installed and you have an account (not a guest account)
To test locally, NodeJS must be installed on your development machine (version 16.14.2 or higher)
dev tunnel or ngrok or equivalent tunneling solution
M365 developer account or access to a Teams account with the
Teams Toolkit for VS Code or TeamsFx CLI

Run the app (Using Teams Toolkit for Visual Studio Code)

The simplest way to run this sample in Teams is to use Teams Toolkit for Visual Studio Code.

Ensure you have downloaded and installed Visual Studio Code
Install the Teams Toolkit extension
Select File > Open Folder in VS Code and choose this samples directory from the repo
Using the extension, sign in with your Microsoft 365 account where you have permissions to upload custom apps
Select Debug > Start Debugging or F5 to run the app in a Teams web client.
In the browser that launches, select the Add button to install the app to Teams.

If you do not have permission to upload custom apps (sideloading), Teams Toolkit will recommend creating and using a Microsoft 365 Developer Program account - a free program to get your own dev environment sandbox that includes Teams.

Setup

Register your application with Azure AD

On the overview page, copy and save the Application (client) ID, Directory (tenant) ID. You’ll need those later when updating your Teams application manifest and in the .env file at both client and server.
Navigate to the Certificates & secrets. In the Client secrets section, click on "+ New client secret". Add a description (Name of the secret) for the secret and select “Never” for Expires. Click "Add". Once the client secret is created, copy its value, it need to be placed in the appsettings.json file.
Navigate to Authentication If an app hasn't been granted IT admin consent, users will have to provide consent the first time they use an app.

Set a redirect URI:
- Select Add a platform.
- Select web.
- Enter the redirect URI for your app. This will be the page where a successful implicit grant flow will redirect the user. Set it as https://Base_Url/auth-end, ex:https://f631****.ngrok-free.app/auth-end
Next, enable implicit grant by checking the following boxes:
✔ ID Token
✔ Access Token
Under Manage, select Expose an API.
Select the Set link to generate the Application ID URI in the form of api://{AppID}. Insert your fully qualified domain name (with a forward slash "/" appended to the end) between the double forward slashes and the GUID. The entire ID should have the form of: api://fully-qualified-domain-name.com/{AppID}
- ex: api://subdomain.example.com/00000000-0000-0000-0000-000000000000.
The fully qualified domain name is the human readable domain name from which your app is served. If you are using a tunneling service such as ngrok, you will need to update this value whenever your ngrok subdomain changes.
- ex: api://f631****.ngrok-free.app/00000000-0000-0000-0000-000000000000

-Select the **Add a scope** button. In the panel that opens, enter `access_as_user` as the **Scope name**.
-Set **Who can consent?** to `Admins and users`
-Fill in the fields for configuring the admin and user consent prompts with values that are appropriate for the `access_as_user` scope:
    * **Admin consent display name:** Teams can access the user’s profile.
    * **Admin consent description**: Allows Teams to call the app’s web APIs as the current user.
- Ensure that **State** is set to **Enabled**
- Select the **Add scope** button to save 
    * The domain part of the **Scope name** displayed just below the text field should automatically match the **Application ID** URI set in the previous step, with `/access_as_user` appended to the end:
        * `api://subdomain.example.com/00000000-0000-0000-0000-000000000000/access_as_user`
- In the **Authorized client applications** section, identify the applications that you want to authorize for your app’s web application. Select *Add a client application*. Enter each of the following client IDs and select the authorized scope you created in the previous step:
    * `1fec8e78-bce4-4aaf-ab1b-5451cc387264` (Teams mobile/desktop application)
    * `5e3ce6c0-2b1f-4285-8d4b-75ee78787346` (Teams web application)

Set up the client .env with the following keys:

- `"REACT_APP_AZURE_APP_REGISTRATION_ID"` : Application ID of the Azure AD application
- `"REACT_APP_BASE_URL"` : tunnel URL you get after running the tunnel commands.

Set up the `api-server` .env with the following keys:

Go to the folder api-server and update following values in .env files

- `"CLIENT_ID"` : Application ID of the Azure AD application
- `"CLIENT_SECRET"` : Application secret of the Azure AD application

Setup for Bot

In Azure portal, create a Azure Bot resource.
- For bot handle, make up a name.
- Select "Use existing app registration" (Create the app registration in Microsoft Entra ID beforehand.)
- If you don't have an Azure account create an Azure free account here
In the new Azure Bot resource in the Portal,
- Ensure that you've enabled the Teams Channel
- In Settings/Configuration/Messaging endpoint, enter the current https URL you were given by running ngrok. Append with the path /api/messages
Setup NGROK

Run ngrok - point to port 3978
```
ngrok http 3978 --host-header="localhost:3978"
```
Alternatively, you can also use the dev tunnels. Please follow Create and host a dev tunnel and host the tunnel with anonymous user access command as shown below:
```
devtunnel host -p 3978 --allow-anonymous
```

Setup for code

Clone the repository

git clone https://github.com/OfficeDev/Microsoft-Teams-Samples.git

In a terminal, navigate to samples/tab-channel-group-sso-quickstart/ts

-Update the .env configuration for the bot to use the REACT_APP_AZURE_APP_REGISTRATION_ID , REACT_APP_BASE_URL` with application base url. For e.g., your ngrok or dev tunnels url. (Note the MicrosoftAppId is the AppId created in step 1 (Setup for Bot).

Build and Run You can build and run the project from the command line or an IDE:
Navigate to the Project root folder
Build Client
- Open terminal
- Install pacakge with npm install
- npm run build
Run Client
- Open new terminal
- npm start
- The client will start running on 3000 port
Run Server
- Open new terminal
- Change directory to api-server folder with command i.e. cd api-server
- Install pacakge with npm install
- npm start
- The server will start running on 5000 port

5 . Setup Manifest for Teams

This step is specific to Teams.
- Edit the manifest.json contained in the ./appManifest folder to replace your Microsoft App Id (that was created when you registered your app registration earlier) everywhere you see the place holder string {{Microsoft-App-Id}} (depending on the scenario the Microsoft App Id may occur multiple times in the manifest.json)
- Edit the manifest.json for validDomains and replace {{domain-name}} with base Url of your domain. E.g. if you are using ngrok it would be https://1234.ngrok-free.app then your domain-name will be 1234.ngrok-free.app and if you are using dev tunnels then your domain will be like: 12345.devtunnels.ms.
- Edit the manifest.json for webApplicationInfo resource "api://<<REACT_APP_BASE_URL>>/<<REACT_APP_AZURE_APP_REGISTRATION_ID>>" with MicrosoftAppId. E.g. "api://1234.ngrok-free.app/000000000000-00000000-00".
- Zip up the contents of the appManifest folder to create a manifest.zip (Make sure that zip file does not contains any subfolder otherwise you will get error while uploading your .zip package)
Upload the manifest.zip to Teams (in the Apps view click "Upload a custom app")
- Go to Microsoft Teams. From the lower left corner, select Apps
- From the lower left corner, choose Upload a custom App
- Go to your project directory, the ./appManifest folder, select the zip folder, and choose Open.
- Select Add in the pop-up dialog box. Your app is uploaded to Teams.

Build for production

npm run build

Running the sample.

tabconfigure

setuptab

Mytab

Builds the app for production to the build folder.
It correctly bundles React in production mode and optimizes the build for the best performance.

The build is minified and the filenames include the hashes.
Your app is ready to be deployed!

See the section about deployment for more information.

Share via

Teams Tab SSO Authentication Sample TS

Interaction with app

Prerequisites

Run the app (Using Teams Toolkit for Visual Studio Code)

Setup

Register your application with Azure AD

Set up the client .env with the following keys:

Set up the `api-server` .env with the following keys:

Build for production

Running the sample.

Further Reading.

Share via

Teams Tab SSO Authentication Sample TS

Interaction with app

Prerequisites

Run the app (Using Teams Toolkit for Visual Studio Code)

Setup

Register your application with Azure AD

Set up the client .env with the following keys:

Set up the api-server .env with the following keys:

Build for production

Running the sample.

Further Reading.

Set up the `api-server` .env with the following keys: