基于Bot Framework SDK的多Bot共享端点SSO实现问题求助

核心思路 #

基于现有ConfigurationBotFrameworkAuthentication扩展多Bot认证能力，同时动态匹配对应Bot的SSO中间件，规避过时的ICredentialProvider依赖。

步骤1：扩展多Bot认证配置 #

创建自定义认证类，继承ConfigurationBotFrameworkAuthentication，重写认证逻辑，根据请求中的Bot ID匹配对应App凭证：

public class MultiBotFrameworkAuthentication : ConfigurationBotFrameworkAuthentication
{
    private readonly IConfiguration _configuration;

    public MultiBotFrameworkAuthentication(IConfiguration configuration) : base(configuration)
    {
        _configuration = configuration;
    }

    public override async Task<AuthenticateRequestResult> AuthenticateRequestAsync(HttpRequest httpRequest, CancellationToken cancellationToken = default)
    {
        // 从请求Activity中提取Bot ID
        var activity = await httpRequest.ReadFromJsonAsync<Activity>(cancellationToken);
        var botId = activity?.Recipient?.Id;

        // 从配置中加载对应Bot的AppID和密码，配置格式参考步骤4
        var botConfig = _configuration.GetSection($"Bots:{botId}");
        if (botConfig.Exists())
        {
            var appId = botConfig["AppId"];
            var appPassword = botConfig["AppPassword"];
            this.CredentialProvider = new SimpleCredentialProvider(appId, appPassword);
        }

        return await base.AuthenticateRequestAsync(httpRequest, cancellationToken);
    }
}

步骤2：实现动态SSO中间件 #

替换原有单一SSO中间件，创建动态匹配的中间件，根据Bot ID调用对应连接名的SSO逻辑：

public class MultiBotSSOTokenExchangeMiddleware : IMiddleware
{
    private readonly IStorage _storage;
    private readonly IConfiguration _configuration;
    private readonly Dictionary<string, TeamsSSOTokenExchangeMiddleware> _middlewareCache = new();

    public MultiBotSSOTokenExchangeMiddleware(IStorage storage, IConfiguration configuration)
    {
        _storage = storage;
        _configuration = configuration;
    }

    public async Task OnTurnAsync(ITurnContext turnContext, NextDelegate next, CancellationToken cancellationToken = default)
    {
        var botId = turnContext.Activity.Recipient.Id;
        var connectionName = _configuration[$"Bots:{botId}:ConnectionName"];

        if (!string.IsNullOrEmpty(connectionName))
        {
            // 缓存中间件实例，避免重复创建
            if (!_middlewareCache.TryGetValue(botId, out var ssoMiddleware))
            {
                ssoMiddleware = new TeamsSSOTokenExchangeMiddleware(_storage, connectionName);
                _middlewareCache[botId] = ssoMiddleware;
            }

            await ssoMiddleware.OnTurnAsync(turnContext, next, cancellationToken);
            return;
        }

        await next(cancellationToken);
    }
}

步骤3：更新服务注册 #

在Program.cs中替换原有的认证和中间件配置：

// 注册自定义多Bot认证
builder.Services.AddSingleton<BotFrameworkAuthentication, MultiBotFrameworkAuthentication>();

// 注册动态SSO中间件，替代原有的单一TeamsSSOTokenExchangeMiddleware
builder.Services.AddSingleton<IMiddleware, MultiBotSSOTokenExchangeMiddleware>();

// 保持原有Adapter配置逻辑
builder.Services.AddSingleton<IBotFrameworkHttpAdapter, AdapterWithErrorHandler>();

步骤4：配置文件新增多Bot信息 #

在appsettings.json中添加所有Bot的凭证与连接名配置：

{
  "Bots": {
    "Bot1_AppId": {
      "AppId": "Bot1_AppId",
      "AppPassword": "Bot1_AppPassword",
      "ConnectionName": "Bot1_OAuth_Connection"
    },
    "Bot2_AppId": {
      "AppId": "Bot2_AppId",
      "AppPassword": "Bot2_AppPassword",
      "ConnectionName": "Bot2_OAuth_Connection"
    }
  }
}

关键注意事项 #

• 确保每个Bot在Azure AD中注册的OAuth连接名与配置完全匹配
• 动态中间件使用缓存机制减少实例化开销
• Bot ID提取逻辑需根据实际请求场景调整，保证准确性

内容的提问来源于stack exchange，提问作者Punit