Authentication fails

[Freeeder]

Following the readme I ran into issues authenticating to the Copilot-Plugin

I can see the swagger , both on localhost and on the tunneled address.

When I publish the plugin to Teams, it's visible right away and I can start chatting immediately, however when it comes to the point to authenticate with the plugin it closes after a while but it requests another authentication.

Maybe seems like the redirect Uri isn't right?

Any idea on that?

[jasonjoh]

Let me start by saying it's possible that your Microsoft 365 tenant hasn't had all of the required bits rolled out yet.

when it comes to the point to authenticate with the plugin it closes after a while but it requests another authentication.

I'm not sure I follow - do you get this?

Clicking Sign in to Budget Tracker should cause a pop-up window to do the auth and consent.

Maybe seems like the redirect Uri isn't right?

Redirect for the plugin should be https://teams.microsoft.com/api/platform/v1.0/oAuthRedirect

[Freeeder]

Thanks for your quick reply.

Yes, that's excactly what happens, at least on the first time.
It asks me for username and password and the consent.

Still, after a while it asks me the to Sign in to Budget Tracker again.
This time no popup shows up, but the loading animation starts and stops after a few seconds and it asks me to sign in again.

So I'm trapped in a loop here.

The only interesting thing I found in debug mode is this:

You can see three clicks on Sign In to Budget Tracker here.

[jasonjoh]

Does it ever successfully call the API? If so, how long is "a while" before it asks again?

Those errors look like errors calling back to the "plugin auth vault" that stores the information about your client ID and secret. If you sign into https://dev.teams.microsoft.com/tools, can you see an option for OAuth client registration?

[Freeeder]

No, it never actually calls the API. There is no traffic at all on the endpoint.

Interestingly, if I acquire an Authorization Code - Access Token via Postman (and adding the Postman redirect Uri), I can call the API successfully. Same settings as in the Plugin:

It takes between 5 and 10 seconds and then the loading animation is gone and I can click Sign In to Buget again.

Here is the Oauth Clien Registration: (Triple checked the input parameters. )

I Can find the ID in the browser:

and in the App Manifest dev JSON:

[jasonjoh]

Yeah, I would expect it to work with a token in Postman or similar. The issue it appears is with the auth calls back to the plugin vault. For that error you showed, is it returning a 40x error, and were there any response headers you can share? If you have a value for the Traceresponse header I can see if I can get any information, but I'm not in support so I have limited ability here.

Also just to verify, on your plugin app registration, you have the access_as_user scope for your API set in API Permissions?

[Freeeder]

Actually it's returning a 200 but with an error in the message:
TraceResponse: 00-154a910e1a705f5f89aab40046847085-1541eef0be46d856-00

Response:

This is the permission config of the plugin app registration: