MS Chat Bot (Bot Framework, Python SDK) cannot send messages to Teams, "message": "Authorization has been denied for this request.",

jcrockett 0 Reputation points
2024-04-05T10:56:12.1433333+00:00

Setup

  • Azure Bot Resource, on multitenant account type (Linked to an App, with an app_id and app_password)
  • Teams Developer Portal App for the bot with a 'bot' feature and the correct id's (triple checked)
  • Bot being hosted publicly, listening on {{domain}}/api/messages, with both the app_id and app_password correctly stored in config

Context

I've tested the bot extensively in the Bot Framework Emulator (v4.14.1) and it works as expected, including when I give the app_id and app_password to the emulator (Not sure if the test authentication actually does anything?)

When used in teams the bot receives messages as expected and is able to process them properly, the problem arises when the bot tries to reply.

The bot doesn't use SSO as it seems unnecessary for my use-case but if that is related to this problem then it can be set up.

Issue

When the bot attempts to reply by calling turn_context.send_activities({{reply}}) (Where turn_context is created by the SDK from the message activity) it generates the following error: [on_turn_error] unhandled error: Operation returned an invalid status code 'Unauthorized'.

To see if the issue was something to do with my bot's code I recreated the request using Postman, First, getting an auth token from https://login.microsoftonline.com/botframework.com/oauth2/v2.0/token using the app_id, app_password and a scope of https://api.botframework.com/.default. Then, using that auth token in a request to https://smba.trafficmanager.net/emea/v3/conversations/{{conversation_id}}/activities with an Authorization header containing Bearer {{token}} and the body being a simple adaptive card (see below) This is the output of that request:

{
    "message": "Authorization has been denied for this request."
}

Seeing as this raised the same error as with the bot I'm guessing there is some sort of configuration error or problem with the tokens being generated.

This is the body of the request to https://smba.trafficmanager.net/emea/v3/conversations/{{conversation_id}}/activities:

{
    "type": "message",
    "serviceUrl": "https://smba.trafficmanager.net/emea/",
    "from": {
        "id": {{app_id}},
        "name": "Bot",
        "role": "bot"
    },
    "conversation": {
        "id": {{conversation_id}},
        "tenantID": {{tenant_id}}
    },
    "attachmentLayout": "list",
    "inputHint": "acceptingInput",
    "attachments": [
        {
            "contentType": "application/vnd.microsoft.card.adaptive",
            "content": {
                "type": "AdaptiveCard",
                "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
                "version": "1.3",
                "body": [
                    {
                        "type": "TextBlock",
                        "text": "Unsupported Usage",
                        "wrap": true,
                        "weight": "Bolder",
                        "size": "Large"
                    },
                    {
                        "type": "TextBlock",
                        "text": "Try: @Bot help",
                        "wrap": true
                    }
                ]
            }
        }
    ]
}

Conclusion

I have gone through what I believe to be all the similar questions on this forum, as well as others, and haven't been able to find a working solution.

Any help/advice would be greatly appreciated, please don't hesitate to ask for more context as I'm not sure what else would be useful to add!Thank you

Azure AI Bot Service
Azure AI Bot Service
An Azure service that provides an integrated environment for bot development.
779 questions
Microsoft Teams Development
Microsoft Teams Development
Microsoft Teams: A Microsoft customizable chat-based workspace.Development: The process of researching, productizing, and refining new or existing technologies.
3,014 questions
{count} votes

1 answer

Sort by: Most helpful
  1. jcrockett 0 Reputation points
    2024-04-16T13:21:34.5833333+00:00

    The issue was with the auth token I was using as part of my requests.

    The type of authentication needed for my use case is single tenant, whereas, the token request that is suggested by the majority of the docs is for multi-tenant.

    To get the correct token I had to send a token request to the following url https://login.microsoftonline.com/MICROSOFT-TENANT-ID/oauth2/v2.0/token as suggested in this docs page as opposed to https://login.microsoftonline.com/botframework.com/oauth2/v2.0/token (suggested in other docs pages).Using the token I received from that single tenant URL I was able to send requests through to teams properly.

    0 comments No comments