New Permission Scopes (RTM?)

[mathew-fleisch]

I have used this library successfully a few times mainly by parsing text through the RTM flow. I just tried to set up a new bot in the same way, and can't figure out what permissions I need to give the bot to connect to the RTM socket. The old bots still work for the moment, but I get a deprecated scope error when I log into the "my apps" permissions section. Looks like this bot user method will be sunset by 2/21/2020. Any thoughts about how to keep this functionality up and running?
Event: {connection_error not_allowed_token_type}
This scope is deprecated. Please update scopes to use granular permissions.

[nod]

I've run into this problem before, and the solution is to create an integrated application. Once you "install your app" you'll get the "xoxb-" token you need to connect.

edit - I was wrong. Slack has made changes to their API and this is not correct.

[nod]

One more note, you'll want to add the users:read scope to the application's scopes or you'll run into other problems.

edit - I was wrong. Slack has made changes to their API and this is not correct. See my comment below.

[nod]

On second thought, I did quite a bit of digging on this and have written up a brief doc on getting a legacy token.

https://github.com/threatsimple/smug-broker/blob/master/doc/slack.md

[mathew-fleisch]

Thanks! I heard that there was a link to get a legacy bot token/permissions but couldn't find it myself. I wonder how long this will stay active for? Seems like slack is trying to get away from this type of bot user. ¯_(ツ)_/¯

[nod]

@mathew-fleisch I pinged Slack on both support and through twitter trying to find out what their intentions are. If they're deprecating RTM for bots, that's going to seriously hamper enteprise projects and I'll have to migrate away from them.

[mathew-fleisch]

That's great! Thanks for checking with them. Is there a thread I can follow, or can you update this thread with the info you find out? I'd love to stay in the loop. I will also need to know if I'll need to migrate away from RTM as well.

[nod]

I'll update here if I hear anything back. RTM is a big enough deal that I may have to migrate away from Slack altogether.

[parsley42]

I've always generated my bot tokens using the Slack bots app, which I get to via this URL:
https://<team>.slack.com/services/new/bot

Nothing there indicates this is legacy, deprecated, or will otherwise stop working. Am I missing something? Likewise for me with RTM; if it goes away, I'll likely stop using Slack - unless they have a really good alternate solution for a chat bot connecting from behind a firewall. This is currently why I don't support Teams at all; too hard to make a working bot in our environment.

[mathew-fleisch]

It might be that slack just hasn't added RTM to their new permissions model, but it isn't in there right now, as far as I can tell.
https://medium.com/slack-developer-blog/more-precision-less-restrictions-a3550006f9c3

[nod]

This page is pretty clear.. https://api.slack.com/authentication/quickstart

New bot user API access tokens may not access RTM. For most apps, the Events API lets your app listen to Slack goings-on in a more structured, safe way. If you require access to RTM (say, because you're building your app behind a corporate firewall), continue to use a classic Slack app bot token to call rtm.connect.

[nod]

Follow up from slack.

I let them know that this apparent deprecation was pretty horrendous from a slack adoption standpoint for enterprise integrations and gave a couple of examples of how this could be harmful.

----8<------

Thanks for your patience here. It sounds like you may have either created a Granular Bot Permissions app (this is actually the default app that gets created) or upgraded your existing Slack API app to use granular scopes.

Unfortunately, I'm afraid that our new 'Granular Bot Permission' app type does not support the RTM API. This is indicated on the following page: https://api.slack.com/authentication/migration#select_user

New Slack apps may not access RTM. For most apps, the Events API lets your app listen to Slack goings-on in a more structured, safe way. If you require access to RTM (say, because you're building your app behind a corporate firewall), continue to use a classic Slack app bot token to call rtm.connect.

Also, unfortunately, it's not possible to revert an app that have been converted to use granular scopes back to being a classic app. Therefore, you'll need to re-create a new classic app here: https://api.slack.com/apps?new_classic_app=1

Given this, hopefully, you can create a new app with the bot scope and get it set back up to use our RTM API.

We're very sorry for the trouble here, and hope to find a way to make it more clear during the migration process about the limitations of the 'Granular Bot Permission' apps.

---->8------

[mathew-fleisch]

oof. that's dumb. Any idea how long they'll keep this legacy option available?

[nod]

@mathew-fleisch They didn't say, but I have communicated that merely calling it "classic" indicates they're looking to deprecate it and that's a bad sign for enterprise users.

[parsley42]

The FAQ doesn't sound scary at all:
https://api.slack.com/faq#events_api

My reading of that is Slack understands some use cases will always need a websocket.

[mjlshen]

It looks like this new legacy options will be pulled on May 5! https://api.slack.com/legacy/custom-integrations/legacy-tokens

[mathew-fleisch]

dude. @nod who else can we complain to about this? There's gotta be a way for them to scope permissions for the RTM functionality.

[unkls]

So for the moment we cannot use new endpoint with legacy/RTM tokens ?

[dan-v]

For those looking to use the RTM API with legacy tokens now gone, there are a bunch of different methods documented here: https://github.com/erroneousboat/slack-term/wiki#running-slack-term-without-legacy-tokens. I ended up using method 4:

• Go to the slack customization page for your organization
• Open developer tools
• Go to the console and enter: window.prompt("your api token is: ", TS.boot_data.api_token)

This method is preferable from the standpoint it doesn't require installing an application into your organization, although it is undocumented and who knows if it will continue to work. If that method stops working, I also created a tool slack-rtm-token that uses the recommended approach from Slack of creating a classic app in your organization (you need permission to do this) and it will locally generate an OAuth token that provides access to the RTM API. This is the same as method 1 from that wiki, but it doesn't require sending sensitive data to Github pages (and method 2 to workaround this did not work for me).

[kanata2]

Now you can use Socket Mode instead of RTM API in many cases and we support it several days ago.
Please try it if you need!

https://api.slack.com/apis/connections/socket