Botframework-sdk: 401 Unauthorized on new Bot

[robertobandeira]

Bot Info

• SDK Platform: .NET
• Active Channels: MS Teams
• Deployment Environment: Azure, local development with Emulator

Issue Description

Trying to create a new chatbot, but keep getting 401 Unauthorized. Here's the sequence of facts:

• I already had some bots created (from when the bot service was still on preview) and had no trouble upgrading;
• Created a new one through Azure and deployed (local git repo) the same code that was already working in one of the bots and locally;
• When testing it through Web chat on Azure it never answered me, got to a 401 error after analyzing;
• Updated all Nuget Packages and starting retesting it locally - started getting 401 error locally now as well

I've already gone through this troubleshooting: https://docs.microsoft.com/pt-br/azure/bot-service/bot-service-troubleshoot-authentication-problems?view=azure-bot-service-3.0
My problem is rising on Step 3: I'm enabling security, but still get 401. Anyone knows what might be the problem?

[JasonSowers]

Did make sure you input your appID and password on both the emulator and in your config file? Would you mind sharing your code by putting it in a repo so we can take a look?

[ankitbko]

Are you using LUIS?

[robertobandeira]

@JasonSowers I did make sure to put the appID and password on both! And unfortunately I can't share the code because it's for my job =/

@ankitbko Yes, I'm using LUIS! (Please tell me it means you know what's wrong haha) It works fine on the other bot though

[ankitbko]

@robertobandeira haha.. could you check what region you have created your LUIS subscription(not the bot) in?
To check this go to your LUIS application -> Publish -> Resources and Keys (scroll to bottom) and check what Region and Endpoint domain you have for your published key. It should match your domain in LuisService in bot.

[robertobandeira]

@ankitbko I'm not able to send the image right now, but they do match, both are southcentralus.

[ankitbko]

Is 401 arising from MessageController or somewhere internally in the bot? You could find it by remote debugging your deployed application.

Just want to make it sure again, you did specify domain in your C# code in LUIS attribute?

[robertobandeira]

In the code I specify it as [LuisModel("xxxxx", "xxxxx", domain: "southcentralus.api.cognitive.microsoft.com")]

This is what I get when I try to start a conversation with the bot locally (just connect with the bot):
{ "type": "conversationUpdate", "membersAdded": [ { "id": "default-user", "name": "User" } ], "id": "a0clm1k754k", "channelId": "emulator", "timestamp": "2018-05-10T17:28:27.256Z", "localTimestamp": "2018-05-10T14:28:27-03:00", "recipient": { "id": "n8lfke71a7h6", "name": "Bot" }, "conversation": { "id": "h4737n377eid" }, "serviceUrl": "http://localhost:57189" }

• The error I see on the bot emulator is "[14:28:27] -> POST Response code 401 (Unauthorized) "

• The error I get from the version deployed in Azure is:
  Message: POST to marketquotes-homologacao failed: POST to the bot's endpoint failed with HTTP status 401
Call Stack: Microsoft.Bot.Schema.BotException: at Microsoft.Bot.ChannelConnector.BotAPI+<PostActivityToBotAsync>d__30.MoveNext (Microsoft.Bot.ChannelConnector, Version=3.2.1.0, Culture=neutral, PublicKeyToken=null) Inner exception System.Exception handled at Microsoft.Bot.ChannelConnector.BotAPI+<PostActivityToBotAsync>d__30.MoveNext: at Microsoft.Bot.ChannelConnector.BotAPI+<PostActivityToBotAsync>d__30.MoveNext (Microsoft.Bot.ChannelConnector, Version=3.2.1.0, Culture=neutral, PublicKeyToken=null)
  Response Body: Failed authenticating incoming request: System.IO.FileLoadException: Could not load file or assembly 'Microsoft.IdentityModel.Protocols, Version=2.1.4.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The located assembly's manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040)
  File name: 'Microsoft.IdentityModel.Protocols, Version=2.1.4.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35'
  at Microsoft.Bot.Connector.JwtTokenExtractor..ctor(TokenValidationParameters tokenValidationParameters, String metadataUrl, String[] allowedSigningAlgorithms, EndorsementsValidator validator)
  at Microsoft.Bot.Connector.BotAuthenticator.d__14.MoveNext()
  --- End of stack trace from previous location where exception was thrown ---
  at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
  at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
  at Microsoft.Bot.Connector.BotAuthenticator.d__10.MoveNext()
  --- End of stack trace from previous location where exception was thrown ---
  at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
  at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
  at Microsoft.Bot.Connector.BotAuthentication.d__28.MoveNext()

  WRN: Assembly binding logging is turned OFF.
  To enable assembly bind failure logging, set the registry value [HKLMSoftwareMicrosoftFusion!EnableLog] (DWORD) to 1.
  Note: There is some performance penalty associated with assembly bind failure logging.
  To turn this feature off, remove the registry value [HKLMSoftwareMicrosoftFusion!EnableLog].

[JasonSowers]

Do you have it deployed on Azure, and if so is it working there? I'm asking to see if this is an emulator only issue. It was a bit unclear in your original post.

[robertobandeira]

It is deployed on Azure and it does not work there. On my last comment I posted the error I get on the version deployed there when I try to test it using Web Chat.

Sorry if it's not very clear. I'm trying to select what information exactly might be important to debug it, but I honestly have no idea even where to search for the problem right now.

[JasonSowers]

Were you by any chance using a trial subscription and now not using a trial subscription?

[robertobandeira]

The code I'm using is from a Bot that started as the Preview Bot application (and now has been migrated). I'm using that same code on a new Bot application I created to test it. I'm not sure if that answers your question...

[EricDahlvang]

@robertobandeira I see you've updated all nuget packages. There might be a conflict somewhere. Can you share your packages.json, binding redirects in web.config, and/or your project file? (I'd try downgrading the packages to what they were previously, then upgrade one at a time until you determine which package upgrade brakes authentication)

[robertobandeira]

@EricDahlvang The code wasn't working on the Amazon-deployed version even before I updated the packages, it was the local version that stopped working after the updates =/

but I'll try that, it might give me some insight, thanks for the tip!

Unfortunately as a company's rule, I cannot send the files, but here are my web.config's binding redirects:
``xml <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1"> <dependentAssembly> <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35"/> <bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0"/> </dependentAssembly> <dependentAssembly> <assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35"/> <bindingRedirect oldVersion="1.0.0.0-5.2.3.0" newVersion="5.2.3.0"/> </dependentAssembly> <dependentAssembly> <assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35"/> <bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0"/> </dependentAssembly> <dependentAssembly> <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral"/> <bindingRedirect oldVersion="0.0.0.0-11.0.0.0" newVersion="11.0.0.0"/> </dependentAssembly> <dependentAssembly> <assemblyIdentity name="System.Net.Http.Primitives" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/> <bindingRedirect oldVersion="0.0.0.0-4.2.29.0" newVersion="4.2.29.0"/> </dependentAssembly> <dependentAssembly> <assemblyIdentity name="System.Net.Http.Formatting" publicKeyToken="31bf3856ad364e35" culture="neutral"/> <bindingRedirect oldVersion="0.0.0.0-5.2.5.0" newVersion="5.2.5.0"/> </dependentAssembly> <dependentAssembly> <assemblyIdentity name="System.IdentityModel.Tokens.Jwt" publicKeyToken="31bf3856ad364e35" culture="neutral"/> <bindingRedirect oldVersion="0.0.0.0-5.2.2.0" newVersion="5.2.2.0"/> </dependentAssembly> <dependentAssembly> <assemblyIdentity name="Microsoft.IdentityModel.Logging" publicKeyToken="31bf3856ad364e35" culture="neutral"/> <bindingRedirect oldVersion="0.0.0.0-5.2.2.0" newVersion="5.2.2.0"/> </dependentAssembly> <dependentAssembly> <assemblyIdentity name="Microsoft.IdentityModel.Tokens" publicKeyToken="31bf3856ad364e35" culture="neutral"/> <bindingRedirect oldVersion="0.0.0.0-5.2.2.0" newVersion="5.2.2.0"/> </dependentAssembly> <dependentAssembly> <assemblyIdentity name="System.Web.Http" publicKeyToken="31bf3856ad364e35" culture="neutral"/> <bindingRedirect oldVersion="0.0.0.0-5.2.5.0" newVersion="5.2.5.0"/> </dependentAssembly> <dependentAssembly> <assemblyIdentity name="Autofac" publicKeyToken="17863af14b0044da" culture="neutral"/> <bindingRedirect oldVersion="0.0.0.0-4.8.0.0" newVersion="4.8.0.0"/> </dependentAssembly> </assemblyBinding>

Also my packages.config:
<packages> <package id="Autofac" version="4.8.0" targetFramework="net46" /> <package id="AutoMapper" version="6.2.2" targetFramework="net46" /> <package id="Chronic.Signed" version="0.3.2" targetFramework="net46" /> <package id="EntityFramework" version="6.2.0" targetFramework="net46" /> <package id="Microsoft.AspNet.WebApi" version="5.2.5" targetFramework="net46" /> <package id="Microsoft.AspNet.WebApi.Client" version="5.2.5" targetFramework="net46" /> <package id="Microsoft.AspNet.WebApi.Core" version="5.2.5" targetFramework="net46" /> <package id="Microsoft.AspNet.WebApi.WebHost" version="5.2.5" targetFramework="net46" /> <package id="Microsoft.Bot.Builder" version="3.15.2.2" targetFramework="net46" /> <package id="Microsoft.Bot.Connector" version="3.15.2.2" targetFramework="net46" /> <package id="Microsoft.CodeDom.Providers.DotNetCompilerPlatform" version="1.0.1" targetFramework="net46" /> <package id="Microsoft.IdentityModel.Clients.ActiveDirectory" version="3.19.4" targetFramework="net46" /> <package id="Microsoft.IdentityModel.Logging" version="5.2.2" targetFramework="net46" /> <package id="Microsoft.IdentityModel.Protocol.Extensions" version="1.0.4.403061554" targetFramework="net46" /> <package id="Microsoft.IdentityModel.Protocols" version="5.2.2" targetFramework="net46" /> <package id="Microsoft.IdentityModel.Protocols.OpenIdConnect" version="5.2.2" targetFramework="net46" /> <package id="Microsoft.IdentityModel.Tokens" version="5.2.2" targetFramework="net46" /> <package id="Microsoft.Net.Compilers" version="1.2.1" targetFramework="net46" developmentDependency="true" /> <package id="Microsoft.Rest.ClientRuntime" version="2.3.11" targetFramework="net46" /> <package id="Microsoft.WindowsAzure.ConfigurationManager" version="3.2.3" targetFramework="net46" /> <package id="Newtonsoft.Json" version="11.0.2" targetFramework="net46" /> <package id="RestSharp" version="106.2.2" targetFramework="net46" /> <package id="System.IdentityModel.Tokens.Jwt" version="5.2.2" targetFramework="net46" /> </packages>

[EricDahlvang]

The packages.config has "Microsoft.IdentityModel.Protocols" version="5.2.2" and the stack trace you shared has: System.IO.FileLoadException: Could not load file or assembly 'Microsoft.IdentityModel.Protocols, Version=2.1.4.0 You could try adding a binding redirect for Microsoft.IdentityModel.Protocols

Do you see any errors or stack trace in the output window when you debug locally?

[robertobandeira]

No errors/stack trace when I run locally. Gonna try adding that redirect and see what happens, thanks a lot! =)

[robertobandeira]

Hey guys, forgot to update the thread, but it worked after I downgraded "Microsoft.IdentityModel.Protocols" to version 2.1.4, both locally and Azure-deployed. Thank you all for the help!