js

page_type	description	products	languages	extensions	urlFragment
sample	Sample channel and group tab with SSO hello world app.	office-teams office office-365	javascript nodejs	contentType createdDate samples 07/07/2021 01:38:27 PM	officedev-microsoft-teams-samples-tab-channel-group-sso-quickstart-js

Teams Tab SSO Authentication Sample Node.js

Tabs are Teams-aware webpages embedded in Microsoft Teams. Personal tabs are scoped to a single user. They can be pinned to the left navigation bar for easy access.

Interaction with app

Prerequisites

• NodeJS

• ngrok

• M365 developer account or access to a Teams account with the appropriate permissions to install an app.

Setup

1. Register a new application in the Azure Active Directory – App Registrations portal.

• On the overview page, copy and save the Application (client) ID, Directory (tenant) ID. You’ll need those later when updating your Teams application manifest and in the .env file at both client and server.

• Navigate to the Certificates & secrets. In the Client secrets section, click on "+ New client secret". Add a description (Name of the secret) for the secret and select “Never” for Expires. Click "Add". Once the client secret is created, copy its value, it need to be placed in the appsettings.json file.

• Navigate to Authentication If an app hasn't been granted IT admin consent, users will have to provide consent the first time they use an app.

  Set a redirect URI:

  • Select Add a platform.
  • Select web.
  • Enter the redirect URI for your app. This will be the page where a successful implicit grant flow will redirect the user. Set it as https://Base_Url/auth-end, ex:https://f631****.ngrok.io/auth-end

  Next, enable implicit grant by checking the following boxes:
  ✔ ID Token
  ✔ Access Token

• Under Manage, select Expose an API.

  • Select the Set link to generate the Application ID URI in the form of api://{AppID}. Insert your fully qualified domain name (with a forward slash "/" appended to the end) between the double forward slashes and the GUID. The entire ID should have the form of: api://fully-qualified-domain-name.com/{AppID}

    • ex: api://subdomain.example.com/00000000-0000-0000-0000-000000000000.

    The fully qualified domain name is the human readable domain name from which your app is served. If you are using a tunneling service such as ngrok, you will need to update this value whenever your ngrok subdomain changes.

    • ex: api://f631****.ngrok.io/9051a142-901a-4384-a83c-556c2888b071.

  • Select the Add a scope button. In the panel that opens, enter access_as_user as the Scope name.

  • Set Who can consent? to Admins and users

  • Fill in the fields for configuring the admin and user consent prompts with values that are appropriate for the access_as_user scope:

    • Admin consent display name: Teams can access the user’s profile.
    • Admin consent description: Allows Teams to call the app’s web APIs as the current user.

  • Ensure that State is set to Enabled

  • Select the Add scope button to save

    • The domain part of the Scope name displayed just below the text field should automatically match the Application ID URI set in the previous step, with /access_as_user appended to the end:
      • api://subdomain.example.com/00000000-0000-0000-0000-000000000000/access_as_user

  • In the Authorized client applications section, identify the applications that you want to authorize for your app’s web application. Select Add a client application. Enter each of the following client IDs and select the authorized scope you created in the previous step:

    • 1fec8e78-bce4-4aaf-ab1b-5451cc387264 (Teams mobile/desktop application)
    • 5e3ce6c0-2b1f-4285-8d4b-75ee78787346 (Teams web application)

2. Setup for Bot

In Azure portal, create a Azure Bot resource. - For bot handle, make up a name. - Select "Use existing app registration" (Create the app registration in Azure Active Directory beforehand.) - If you don't have an Azure account create an Azure free account here

In the new Azure Bot resource in the Portal, - Ensure that you've enabled the Teams Channel - In Settings/Configuration/Messaging endpoint, enter the current https URL you were given by running ngrok. Append with the path /api/messages

3. Setup NGROK

• Run ngrok - point to port 3978

```bash
ngrok http -host-header=rewrite 3978
```

4. Setup for code

• Clone the repository bash git clone https://github.com/OfficeDev/Microsoft-Teams-Samples.git

• Update the .env configuration for the bot to use the REACT_APP_AZURE_APP_REGISTRATION_ID and REACT_APP_BASE_URL, BaseUrl with application base url. For e.g., your ngrok url. (Note the MicrosoftAppId is the REACT_APP_AZURE_APP_REGISTRATION_ID created in step 1.

• In a terminal, navigate to tab-channel-group-sso-quickstart/js

• Install modules

  npm install

• Run Client

  • Run npm start command in terminal
  • The client will start running on 3000 port

• Run Server

  • Open new terminal
  • Change directory to api-server folder with command i.e. cd api-server
  • Install pacakge with npm install
  • npm start
  • The server will start running on 5000 port

5. Setup Manifest for Teams

• This step is specific to Teams.

  • Edit the manifest.json contained in the appPackage/ folder to replace with your MicrosoftAppId (that was created in step1.1 and is the same value of MicrosoftAppId in .env file) everywhere you see the place holder string {MicrosoftAppId} (depending on the scenario the Microsoft App Id may occur multiple times in the manifest.json)

  • • Edit the manifest.json for validDomains and REACT_APP_BASE_URL replace {{domain-name}}with base Url of your domain. E.g. if you are using ngrok it would behttps://1234.ngrok.io` then your domain-name will be 1234.ngrok.io.

  • Edit the manifest.json for webApplicationInfo resource ""api://<<REACT_APP_BASE_URL>>/<<REACT_APP_AZURE_APP_REGISTRATION_ID>>"" with MicrosoftAppId. E.g. `""api://<<ngrok.io>><>

  • Zip up the contents of the appPackage/ folder to create a manifest.zip

  • Upload the manifest.zip to Teams (in the left-bottom Apps view, click "Upload a custom app")

Running the sample

Further Reading.

Tab-channel-group-sso-quickstart