Posting to sideloaded Bot conversation is failing with "Authorization has been denied for this request."

Question

Hi there,

I'm developing a new Bot for notifications only. I'm testing with a "development" version that is not published. The App is sideloaded in an account set up for testing with tenant_id: 986e26d3-45ef-4b9c-ba72-b75890332cd3

This call works with a our old Bot Service that is published using the same App Registration.

The authorization is using a Bot token for Bot id: 1006e5b7-59de-44d3-bc63-3025c9165058.

PATH: https://smba.trafficmanager.net/teams/v3/conversations/19:291aa8b6-068a-4b06-86dc-f33baf9fc324_7917afd4-9825-4c1d-b683-ce1fcb77d5b4@unq.gbl.spaces/activities

REQUEST BODY: 
{
  :type=>"message",
  :from=>{
    :id=>"1006e5b7-59de-44d3-bc63-3025c9165058"
  },
  :conversation=>{
    :id=>"19:291aa8b6-068a-4b06-86dc-f33baf9fc324_7917afd4-9825-4c1d-b683-ce1fcb77d5b4@unq.gbl.spaces"
  },
  :recipient=>{
    :id=>"291aa8b6-068a-4b06-86dc-f33baf9fc324",
    :name=>"Microsoft Teams"
  },
  :attachments=>[
    {
      :contentType=>"application/vnd.microsoft.card.adaptive",
      :content=>{
        :$schema=>"http://adaptivecards.io/schemas/adaptive-card.json",
        :type=>"AdaptiveCard",
        :version=>"1.0",
        :text=>"Preview text",
        :body=>[
          {
            :type=>"Container",
            :items=>[
              {
                :type=>"TextBlock",
                :text=>"Heya Microsoft 👋",
                :wrap=>true
              }
            ]
          }
        ]
      }
    }
  ]
}

RESPONSE BODY: {"message"=>"Authorization has been denied for this request."}

Answer 1

This flow uses a test account that we've set up. Tenant id 986e26d3-45ef-4b9c-ba72-b75890332cd3

Step 1: Grant permissions

Permissions have been granted to the tenant above In browser https://login.microsoftonline.com/common/adminconsent?client_id=1006e5b7-59de-44d3-bc63-3025c9165058&redirect_uri=https%3A%2F%2Fapp.steady-development.space%2Fauth%2Fmicrosoft_teams_v2%2Fcallback

Step 2: Get User-Token

curl --location 'https://login.microsoftonline.com/986e26d3-45ef-4b9c-ba72-b75890332cd3/oauth2/v2.0/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Cookie: fpc=Aq5dKF28Y71ClIq4hkYoeygc1DBAAQAAAOZj8N0OAAAAUOyNxwYAAABPYfDdDgAAAA; stsservicecookie=estsfd; x-ms-gateway-slice=estsfd' \
--data-urlencode 'client_id=1006e5b7-59de-44d3-bc63-3025c9165058' \
--data-urlencode 'scope=https://graph.microsoft.com/.default' \
--data-urlencode 'client_secret=4UD8Q~JCO1cLJY~1vz7grJbRzLjENWJyA-n3.b0W' \
--data-urlencode 'grant_type=client_credentials'

Step 3: List Users Get the user-id by email. Email: wahsnidgobhai@steadydev.onmicrosoft.com Id: 291aa8b6-068a-4b06-86dc-f33baf9fc324

curl --location 'https://graph.microsoft.com/v1.0/users' \
--header 'Authorization: Bearer {{User-Token}}'

Step 4: Push Bot This works for our published Bot (id: 7917afd4-9825-4c1d-b683-ce1fcb77d5b4), but fails for our unpublished bot (id: 1006e5b7-59de-44d3-bc63-3025c9165058) with "The definition for app '1006e5b7-59de-44d3-bc63-3025c9165058' was not found in the org-wide catalog." The unpublished Bot has been successfully side-loaded into our test-tenant.

curl --location 'https://graph.microsoft.com/v1.0/users/291aa8b6-068a-4b06-86dc-f33baf9fc324/teamwork/installedApps' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{User-Token}}' \
--data-raw '{
  "teamsApp@odata.bind": "https://graph.microsoft.com/v1.0/appCatalogs/teamsApps/7917afd4-9825-4c1d-b683-ce1fcb77d5b4"
}
'

Step 5: Get App Installation Id Find the app installation id by Bot name

curl --location 'https://graph.microsoft.com/v1.0/users/291aa8b6-068a-4b06-86dc-f33baf9fc324/teamwork/installedApps?%24expand=teamsAppDefinition' \
--header 'Authorization: Bearer {{User-Token}}'

 [
  {
    "id": "MjkxYWE4YjYtMDY4YS00YjA2LTg2ZGMtZjMzYmFmOWZjMzI0IyM4NTQ1NTdjNC1jNzkwLTQyZTgtYjc1ZC1lMGZmN2JhNDdiYjc=",
    "consentedPermissionSet": null,
    "teamsAppDefinition": {
      "id": "ODU0NTU3YzQtYzc5MC00MmU4LWI3NWQtZTBmZjdiYTQ3YmI3IyMxLjEuMCMjUHVibGlzaGVk",
      "teamsAppId": "854557c4-c790-42e8-b75d-e0ff7ba47bb7",
      "displayName": "Steady (development)",

Step 6: Get the conversation_id Uses id: from above

curl --location 'https://graph.microsoft.com/v1.0/users/291aa8b6-068a-4b06-86dc-f33baf9fc324/teamwork/installedApps/MjkxYWE4YjYtMDY4YS00YjA2LTg2ZGMtZjMzYmFmOWZjMzI0IyM4NTQ1NTdjNC1jNzkwLTQyZTgtYjc1ZC1lMGZmN2JhNDdiYjc=/chat' \
--header 'Authorization: Bearer {{User-Token}}'

Step 7: Get Bot Token

curl --location 'https://login.microsoftonline.com/botframework.com/oauth2/v2.0/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Cookie: fpc=Aq5dKF28Y71ClIq4hkYoeygc1DBAAQAAAOZj8N0OAAAAUOyNxwYAAABPYfDdDgAAAHecYywBAAAApWTw3Q4AAAA; stsservicecookie=estsfd; x-ms-gateway-slice=estsfd' \
--data-urlencode 'client_id=1006e5b7-59de-44d3-bc63-3025c9165058' \
--data-urlencode 'scope=https://graph.microsoft.com/.default' \
--data-urlencode 'client_secret=4UD8Q~JCO1cLJY~1vz7grJbRzLjENWJyA-n3.b0W' \
--data-urlencode 'grant_type=client_credentials'

Step 8: Send message Uses Bot-Token from above. This FAILS for our unpublished Bot, but if I start the flow over with the published Bot, it works.

curl --location 'https://smba.trafficmanager.net/teams/v3/conversations/19:291aa8b6-068a-4b06-86dc-f33baf9fc324_205ed844-0739-4830-a8b8-4b3be06a4845@unq.gbl.spaces/activities' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{Bot-Token}}' \
--data-raw '{
  "type": "message",
  "from": {
    "id": "1006e5b7-59de-44d3-bc63-3025c9165058"
  },
  "conversation": {
    "id": "19:291aa8b6-068a-4b06-86dc-f33baf9fc324_205ed844-0739-4830-a8b8-4b3be06a4845@unq.gbl.spaces"
  },
  "recipient": {
    "id": "291aa8b6-068a-4b06-86dc-f33baf9fc324",
  },
  "attachments": [
    {
      "contentType": "application/vnd.microsoft.card.adaptive",
      "content": {
        "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
        "type": "AdaptiveCard",
        "version": "1.0",
        "text": "Preview text",
        "body": [
          {
            "type": "Container",
            "items": [
              {
                "type": "TextBlock",
                "text": "Heya Microsoft 👋",
                "wrap": true
              }
            ]
          }
        ]
      }
    }
  ]
}
'