ts

page_type	description	products	languages	extensions	urlFragment
sample	This application showcases how to implement Microsoft Entra SSO authentication within channel tabs in Microsoft Teams, facilitating seamless user profile access and collaborative spaces.	office-teams office office-365	typescript nodejs	contentType createdDate samples 07/07/2021 01:38:27 PM	officedev-microsoft-teams-samples-tab-channel-group-sso-quickstart-ts

Teams Tab SSO Authentication Sample TS

Explore this sample application that demonstrates Microsoft Entra SSO authentication in Microsoft Teams channel tabs, allowing users to securely access their profiles and collaborate on web-based content. With detailed setup guidance covering Azure AD registration, tunneling solutions, and the use of Teams Toolkit for Visual Studio Code, this sample is perfect for developers looking to enhance their Teams applications with robust authentication features.

Interaction with app

Prerequisites

• Microsoft Teams is installed and you have an account (not a guest account)
• To test locally, NodeJS must be installed on your development machine (version 16.14.2 or higher)
• dev tunnel or ngrok or equivalent tunneling solution
• M365 developer account or access to a Teams account with the
• Teams Toolkit for VS Code or TeamsFx CLI

Run the app (Using Teams Toolkit for Visual Studio Code)

The simplest way to run this sample in Teams is to use Teams Toolkit for Visual Studio Code.

1. Ensure you have downloaded and installed Visual Studio Code
2. Install the Teams Toolkit extension
3. Select File > Open Folder in VS Code and choose this samples directory from the repo
4. Using the extension, sign in with your Microsoft 365 account where you have permissions to upload custom apps
5. Select Debug > Start Debugging or F5 to run the app in a Teams web client.
6. In the browser that launches, select the Add button to install the app to Teams.

If you do not have permission to upload custom apps (sideloading), Teams Toolkit will recommend creating and using a Microsoft 365 Developer Program account - a free program to get your own dev environment sandbox that includes Teams.

Setup

Register your application with Azure AD

1. Register a new application in the Microsoft Entra ID – App Registrations portal.

• On the overview page, copy and save the Application (client) ID, Directory (tenant) ID. You’ll need those later when updating your Teams application manifest and in the .env file at both client and server.

• Navigate to the Certificates & secrets. In the Client secrets section, click on "+ New client secret". Add a description (Name of the secret) for the secret and select “Never” for Expires. Click "Add". Once the client secret is created, copy its value, it need to be placed in the appsettings.json file.

• Navigate to Authentication If an app hasn't been granted IT admin consent, users will have to provide consent the first time they use an app.

  Set a redirect URI:

  • Select Add a platform.
  • Select web.
  • Enter the redirect URI for your app. This will be the page where a successful implicit grant flow will redirect the user. Set it as https://Base_Url/auth-end, ex:https://f631****.ngrok-free.app/auth-end

  Next, enable implicit grant by checking the following boxes:
  ✔ ID Token
  ✔ Access Token

• Under Manage, select Expose an API.

• Select the Set link to generate the Application ID URI in the form of api://{AppID}. Insert your fully qualified domain name (with a forward slash "/" appended to the end) between the double forward slashes and the GUID. The entire ID should have the form of: api://fully-qualified-domain-name.com/{AppID}

  • ex: api://subdomain.example.com/00000000-0000-0000-0000-000000000000.

  The fully qualified domain name is the human readable domain name from which your app is served. If you are using a tunneling service such as ngrok, you will need to update this value whenever your ngrok subdomain changes.

  • ex: api://f631****.ngrok-free.app/00000000-0000-0000-0000-000000000000

-Select the **Add a scope** button. In the panel that opens, enter `access_as_user` as the **Scope name**.
-Set **Who can consent?** to `Admins and users`
-Fill in the fields for configuring the admin and user consent prompts with values that are appropriate for the `access_as_user` scope:
    * **Admin consent display name:** Teams can access the user’s profile.
    * **Admin consent description**: Allows Teams to call the app’s web APIs as the current user.
- Ensure that **State** is set to **Enabled**
- Select the **Add scope** button to save 
    * The domain part of the **Scope name** displayed just below the text field should automatically match the **Application ID** URI set in the previous step, with `/access_as_user` appended to the end:
        * `api://subdomain.example.com/00000000-0000-0000-0000-000000000000/access_as_user`
- In the **Authorized client applications** section, identify the applications that you want to authorize for your app’s web application. Select *Add a client application*. Enter each of the following client IDs and select the authorized scope you created in the previous step:
    * `1fec8e78-bce4-4aaf-ab1b-5451cc387264` (Teams mobile/desktop application)
    * `5e3ce6c0-2b1f-4285-8d4b-75ee78787346` (Teams web application)

Set up the client .env with the following keys:

- `"REACT_APP_AZURE_APP_REGISTRATION_ID"` : Application ID of the Azure AD application
- `"REACT_APP_BASE_URL"` : tunnel URL you get after running the tunnel commands.

Set up the api-server .env with the following keys:

Go to the folder api-server and update following values in .env files

- `"CLIENT_ID"` : Application ID of the Azure AD application
- `"CLIENT_SECRET"` : Application secret of the Azure AD application

2. Setup for Bot

   In Azure portal, create a Azure Bot resource.

   • For bot handle, make up a name.
   • Select "Use existing app registration" (Create the app registration in Microsoft Entra ID beforehand.)
   • If you don't have an Azure account create an Azure free account here

   In the new Azure Bot resource in the Portal,

   • Ensure that you've enabled the Teams Channel
   • In Settings/Configuration/Messaging endpoint, enter the current https URL you were given by running ngrok. Append with the path /api/messages

3. Setup NGROK

• Run ngrok - point to port 3978

  ngrok http 3978 --host-header="localhost:3978"

  Alternatively, you can also use the dev tunnels. Please follow Create and host a dev tunnel and host the tunnel with anonymous user access command as shown below:

  devtunnel host -p 3978 --allow-anonymous

4. Setup for code

• Clone the repository

  git clone https://github.com/OfficeDev/Microsoft-Teams-Samples.git

• In a terminal, navigate to samples/tab-channel-group-sso-quickstart/ts

-Update the .env configuration for the bot to use the REACT_APP_AZURE_APP_REGISTRATION_ID , REACT_APP_BASE_URL` with application base url. For e.g., your ngrok or dev tunnels url. (Note the MicrosoftAppId is the AppId created in step 1 (Setup for Bot).

• Build and Run You can build and run the project from the command line or an IDE:

• Navigate to the Project root folder

• Build Client

  • Open terminal
  • Install pacakge with npm install
  • npm run build

• Run Client

  • Open new terminal
  • npm start
  • The client will start running on 3000 port

• Run Server

  • Open new terminal
  • Change directory to api-server folder with command i.e. cd api-server
  • Install pacakge with npm install
  • npm start
  • The server will start running on 5000 port

5 . Setup Manifest for Teams

• This step is specific to Teams.

  • Edit the manifest.json contained in the ./appManifest folder to replace your Microsoft App Id (that was created when you registered your app registration earlier) everywhere you see the place holder string {{Microsoft-App-Id}} (depending on the scenario the Microsoft App Id may occur multiple times in the manifest.json)
  • Edit the manifest.json for validDomains and replace {{domain-name}} with base Url of your domain. E.g. if you are using ngrok it would be https://1234.ngrok-free.app then your domain-name will be 1234.ngrok-free.app and if you are using dev tunnels then your domain will be like: 12345.devtunnels.ms.
  • Edit the manifest.json for webApplicationInfo resource "api://<<REACT_APP_BASE_URL>>/<<REACT_APP_AZURE_APP_REGISTRATION_ID>>" with MicrosoftAppId. E.g. "api://1234.ngrok-free.app/000000000000-00000000-00".
  • Zip up the contents of the appManifest folder to create a manifest.zip (Make sure that zip file does not contains any subfolder otherwise you will get error while uploading your .zip package)

• Upload the manifest.zip to Teams (in the Apps view click "Upload a custom app")

  • Go to Microsoft Teams. From the lower left corner, select Apps
  • From the lower left corner, choose Upload a custom App
  • Go to your project directory, the ./appManifest folder, select the zip folder, and choose Open.
  • Select Add in the pop-up dialog box. Your app is uploaded to Teams.

Build for production

npm run build

Running the sample.

Builds the app for production to the build folder.
It correctly bundles React in production mode and optimizes the build for the best performance.

The build is minified and the filenames include the hashes.
Your app is ready to be deployed!

See the section about deployment for more information.

Further Reading.

Tab-channel-group-SSO-QuickStart