I can develop skills in Emulator without an app password

[clearab]

Scenario

As a developer, I need to be able to test by skill as a skill (not a stand alone bot) from the emulator without registering an app Id/password).

Background

Several sections of the bot framework code need to know if the activity being process is in a consumer bot or a skill bot. The code uses the claims extracted from the auth header to determine this and that requires that the consumer and the skill have an AppId and Password configured.

This causes friction for developers that are not quite ready to register the consumer or the skill as a bot.

Here are the places where we use SkillValidation.IsSkillClaim() in the framework code and samples:

• AllowedSkillsClaimsValidator sample uses it to determine if the request is coming from a skill and validate the appId against the allowed apps list.
• OAuthInput.SendOAuthCardAsync() uses to determine the cardActionType to use in the promp.
• DialogExtensions.SendEoCToParent() helper uses it to determine if it should send EoC to the caller when the dialog stack is empty.
• DialogExtensions.IsFromParentToSkill() helper uses it to determine if the message is sent from a parent that is talking to a channel or to another skill.
• DialogManager.OnTurnAsync() uses it to determine if the bot is running as a skill or as a parent bot.
• DialogManager.IsFromParentToSkill() helper uses it to determine if the message is sent from a parent that is talking to a channel or to another skill.
• DialogManager.ShouldSendEndOfConversationToParent() helper uses it to determine if it should send EoC to the parent or not.
• BotFrameworkAdapter.ContinueConversationAsync() uses it to determine if it should add the activity service Url to the AppCredentials.TrustServiceUrl list.
• BotFrameworkAdapter.ProcessActivityAsync() uses it to extract the OAuthScope and place it in turn state for later use.
• BotFrameworkAdapter.GenerateCallerIdAsync() uses it to generate the callerId property.
• BotFrameworkAdapter.CreateConnectorClientAsync() uses it to get the OAuthScope and that will be used to generate the connector client.
• The botframwork-skills repo uses it in several places:
• The botframwork-skills repo also an extension method for ITurnContext that wraps the logic around inspecting claims to determine if something is a skill or not
  • In MainDialog to determine if the need to end the dialog stack or begin a new dialog on a cancelation.
  • In DefaultAdapter to determine if the bot needs to send an EoC if there's a catastrophic error on the skill.

Constraints

• The scenario only applies when the channelId is Emulator, all other channels will require AppId and password.
• All the bots involved should be running locally (parent and consumers), if any of them has or require and App/Id and password, all the bots will require it too (e.g.: I can't have a consumer running locally without appId and password that calls a skill that has an appId and password configured.

Solution

We introduced a new RoleType = "skill" that is set on the Recipient of the activity when an activity is sent from the consumer bot to a child bot through BotframeworkHttpClient.

We also updated the auth logic in the framework to create a special claim for anonymous skill calls (see SkillValidation.CreateAnonymousSkillClaim() for details on the claim) that is set when there is no AuthHeader and the channel is Emulator.

Component Impact

• Emulator
• Composer
• BF SDK

Tracking Status

Dotnet SDK 4752

• PR
• Merged

Javascript SDK 2860

• PR
• Merged

Python SDK 1396

• PR
• Merged

Java SDK 809

• PR
• Merged

[stevengum]

This has implications for generating the callerId (see microsoft/botbuilder-dotnet#3753)

[clearab]

Yeah, we'll probably need to have an new IRI for the Emulator

[gabog]

dotnet, JS and Python are done, Java will be done in a future release

[tracyboehrer]

Java merged today