Provide Authentication sample for ASP.NET Core

[DamianReeves]

It would be extremely helpful if the team could provide an authentication sample using ASP.NET Core. I'm not talking CoreClr support here, and an example targeting .NET 4.6 is sufficient.
The closest example of this is the old ASP.NET Core sample in the repo around Microsoft Graph, however this example suffers from:

1. Being outdated and not targeting a stable version of ASP.NET Core

2. Intermingling an example of authenticating against the Microsoft Graph, which makes it difficult to figure out which portion of the Authentication example provided applies to Bot authentication versus Microsoft Graph authentication.

   What should be covered in the sample/samples:

• How to authenticate your bot using current asp.net Security middle-ware i.e. (OpenIdConnect and/or JwtBearer)
• How to hand-roll an ActionFilter which accomplishes what the BotAuthentication attribute accomplishes using just HttpClient and REST calls (this would essentially provide a C# implementation of this: https://docs.botframework.com/en-us/restapi/authentication/#navtitle)

I have tried both methods myself and for reasons which are unclear to me, I did not have success, but I am by no means an expert on all the technologies involved in making the proper security handshake.

This would also provide users with guidance/an example of how to create a bot messaging endpoint in an existing ASP.NET Core project.

[DamianReeves]

So I spent some time and figured out everything I need to do to get this working.
I've posted a solution here: https://github.com/DamianReeves/EchoBotForCore. There were some non-intuitive steps involved so I hope this helps someone else.

This approach does not use Middleware. A middleware solution would still be great, but at least this works.

[Maarten88]

@DamianReeves based on your work and code from the Connector I created a version of the BotAuthenticationAttribute that works with System.IdentityModel.Tokens.Jwt version 5.0.0, so that I can combine it in a DotNetCore project that also uses Microsoft.IdentityModel.Protocols.OpenIdConnect.
See: https://gist.github.com/Maarten88/84d06d858429cdc0110cfb471808f068

In my project I use a private build of BotBuilder and Connector that uses project.json instead of packages.config, this attribute enables me to remove all files and references that use WebApi/Katana from the BotBuilder and Connector projects.

[dandriscoll]

Adding @msft-shahins for .Net Core.

[msft-shahins]

We prereleased Microsoft.Bot.Connector nuget 3.5.1-alpha which adds support for asp.net core to connector SDK. Bot authentication is now implemented as a middleware: https://github.com/Microsoft/BotBuilder/blob/master/CSharp/Library/Microsoft.Bot.Connector.AspNetCore/BotAuthentication.cs#L73 and here is an example asp.net core bot: https://github.com/Microsoft/BotBuilder/tree/master/CSharp/Samples/Microsoft.Bot.Sample.AspNetCore.Echo

[sowsan]

When I compile the sample it always fail to load the dependency :

"Microsoft.Bot.Connector.AspNetCore": "1.0.0-*", which mentioned in the project.json

https://raw.githubusercontent.com/Microsoft/BotBuilder/master/CSharp/Samples/Microsoft.Bot.Sample.AspNetCore.Echo/project.json

Because of this, not able to call the middleware at startup.js for the bot authentication. Using VS 2015, asp.net core template for .net framework with version 4.5. Any comments ?

[berhir]

@sowsan The problem is that the Microsoft.Bot.Connector.AspNetCore library targets netstandard1.6 which is not supported by .NET 4.5 as you can see in the documentation.

@msft-shahins What is the reason why you can't target a lower netstandard version? Because 1.6 is not supported by any version of the full .NET Framework right now.

[msft-shahins]

@sowsan the sample is using the connector library as a project dependency rather than a nuget dependency. You can use the prereleased nuget instead by just referencing it in your project.json. Below is a sample project.json that consumes the connector library as nuget:

{
  "dependencies": {
    "Microsoft.NETCore.App": {
      "version": "1.0.1",
      "type": "platform"
    },
    "Microsoft.AspNetCore.Mvc": "1.1.0",
    "Microsoft.AspNetCore.Routing": "1.1.0",
    "Microsoft.AspNetCore.Server.IISIntegration": "1.1.0",
    "Microsoft.AspNetCore.Server.Kestrel": "1.1.0",
    "Microsoft.Extensions.Configuration.EnvironmentVariables": "1.1.0",
    "Microsoft.Extensions.Configuration.FileExtensions": "1.1.0",
    "Microsoft.Extensions.Configuration.Json": "1.1.0",
    "Microsoft.Extensions.Configuration.CommandLine": "1.1.0",
    "Microsoft.Extensions.Logging": "1.1.0",
    "Microsoft.Extensions.Logging.Console": "1.1.0",
    "Microsoft.Extensions.Logging.Debug": "1.1.0",
    "Microsoft.Extensions.Options.ConfigurationExtensions": "1.1.0",
    "Microsoft.Bot.Connector": {
      "include": "all",
      "version": "3.5.1.0-alpha"
    },
    "Microsoft.AspNetCore.StaticFiles": "1.0.0"
  },

  "tools": {
    "Microsoft.AspNetCore.Server.IISIntegration.Tools": "1.1.0-preview4-final"
  },

  "frameworks": {
    "netcoreapp1.0": {
      "imports": [
        "dotnet5.6",
        "portable-net45+win8"
      ]
    }
  },

  "buildOptions": {
    "emitEntryPoint": true,
    "preserveCompilationContext": true
  },

  "runtimeOptions": {
    "configProperties": {
      "System.GC.Server": true
    }
  },

  "publishOptions": {
    "include": [
      "wwwroot",
      "**/*.cshtml",
      "appsettings.json",
      "web.config"
    ]
  },

  "scripts": {
    "postpublish": [ "dotnet publish-iis --publish-folder %publish:OutputPath% --framework %publish:FullTargetFramework%" ]
  },

  "tooling": {
    "defaultNamespace": "testbot"
  },
}

[msft-shahins]

@berhir the asp.net core version of the connector library is dependent on "Microsoft.AspNetCore.Mvc.Core": "1.0.1" which requires net.standard 1.6. The library still have support for full .net framework. If you look at the nuget package it has assemblies for both net.standard 1.6 and .net 4.5.

[berhir]

@msft-shahins I checked again but I can't find a way to get the asp.net core version running on .net 4.5. The assembly that targets .net 4.5 is for Web Api and not for asp.net core.

From what I see you support asp.net core only on .net core. But we use asp.net core with .net 4.5. I guess you will have to create a second nuget package for the asp.net core version. The existing nuget package is for .net 4.5 and the legacy web api. The second nuget package should contain assemblies for asp.net core targeting both .net 4.5 and .net core.

[msft-shahins]

because of some of our dependencies we are targeting net standard 1.6: https://github.com/Microsoft/BotBuilder/blob/master/CSharp/Library/Microsoft.Bot.Connector.AspNetCore/project.json#L18

and I believe that currently it is not possible to run it on top of net framework: https://docs.microsoft.com/en-us/dotnet/articles/standard/library

We plan to revisit our .net core support for connector once net standard 2.0 is released.

[EPinci]

Is there any hope of .net core support now that net standard 2.0 is out?
Thank you.

[JasonSowers]

#572 is where that conversation is taking place @EPinci feel free to join the conversation on that issue.