Custom OAuthEndpoint doesn't work as documented

Version

Microsoft.Bot.Builder.Integration.AspNet.Core 4.19.3

Describe the bug

The documentation says this is how to configure the OAuth-URL “for public-cloud bots with data residency in Europe”:

string uri = "https://europe.api.botframework.com";
MicrosoftAppCredentials.TrustServiceUrl(uri);
OAuthClientConfig.OAuthEndpoint = uri;

This actually does nothing. It will still connect to https://api.botframework.com instead and will obviously fail if your Azure bot is configured to be accessible for West Europe.

To Reproduce

Steps to reproduce the behavior: Do as the documentation says.

Expected behavior

Bot will never try to contact the international DirectLine API but instead alwas uses the European one.

Additional context

Here is a workaround (using reflection) that mitigates this problem:

Create a new class like this:

public class CustomBotFrameworkAuthentication : ConfigurationBotFrameworkAuthentication
{
    public CustomBotFrameworkAuthentication(IConfiguration configuration,
        ServiceClientCredentialsFactory? credentialsFactory = null,
        AuthenticationConfiguration? authConfiguration = null, IHttpClientFactory? httpClientFactory = null,
        ILogger? logger = null) : base(configuration, credentialsFactory, authConfiguration, httpClientFactory, logger)
    {
        var inner = (BotFrameworkAuthentication)typeof(ConfigurationBotFrameworkAuthentication)
            .GetField("_inner", BindingFlags.Instance | BindingFlags.NonPublic)!.GetValue(this)!;
        inner.GetType().BaseType!.GetField("_oauthEndpoint", BindingFlags.Instance | BindingFlags.NonPublic)!
            .SetValue(inner, "https://europe.api.botframework.com");
    }
}

And register it using DI:

builder.Services.AddSingleton<BotFrameworkAuthentication, CustomBotFrameworkAuthentication>();

There is actually a way to configure OAuthUrl in the configuration file and have BotFrameworkAuthenticationFactory create a ParameterizedBotFrameworkAuthentication for you, that will allow you to specify things like custom endpoints. This needs additional configuration parameters though and there is no documentation available whatsoever.

[ceciliaavila]

Hi everyone, we reproduced this issue and if it’s ok, we’ll work on finding a solution. Thanks.

[AndyCross]

<del>I’ve a very similar problem, the settings don’t work however. Visiting NGROK tells me that I have forbidden errors, with a JWT set with an iss as “api.botframework.com”. Are the above settings verified as correct? </del>

Update

The trailing slashes are invalid in @ceciliaavila 's post.

  "MicrosoftAppType": "",
  "MicrosoftAppId": "<your-app-id>",
  "MicrosoftAppPassword": "<your-app-secret>",
  "MicrosoftAppTenantId": "",
  "ConnectionName": "<your-connection-name>",
  "OAuthUrl": "https://europe.api.botframework.com",
  "BotOpenIdMetadata": "https://login.botframework.com/v1/.well-known/openidconfiguration",
  "ValidateAuthority": "true",
  "ToChannelFromBotLoginUrl": "https://login.microsoftonline.com/botframework.com",
  "ToChannelFromBotOAuthScope": "https://api.botframework.com",
  "ToBotFromChannelTokenIssuer": "https://api.botframework.com",
  "ToBotFromChannelOpenIdMetadataUrl": "https://login.botframework.com/v1/.well-known/openidconfiguration",
  "ToBotFromEmulatorOpenIdMetadataUrl": "https://login.microsoftonline.com/botframework.com/v2.0/.well-known/openid-configuration",
  "CallerId": "urn:botframework:azure"