Botframework-sdk: Incorrect id posting from activity.from.id

[Nitin2392]

I have a web chat client that communicates to a .NET Bot Framework model.

1) The webclient hits an endpoint to fetch the DirectLineToken object. I referred to this article to build the endpoint - https://blog.botframework.com/2018/09/25/enhanced-direct-line-authentication-features/. Like the article suggested, I created a new user - dl_new GUID()

2) In my web chat code, I create a user object (I retrieve the user who is currently chatting with the bot) and not the dl_new GUID(). I send the token from step 1 and the user object as follows.

const user = { 
id: `I retrieve user id here`,
name : `I retrieve user name here`
}

  const botConnection = new BotChat.DirectLine({
    token,
  });

 BotChat.App(
    {
      botConnection,
      user,
      bot: { id: 'BOT NAME` },
    },
  );

3) In my .NET Bot Framework, I use activity.from.id to log the users that are speaking with the bot. My issue here is that the activity.from.id is now only logging the dl_new GUID() and not the user.id value that I'm passing from my web client.

This web client has been running for a while now and this change is being observed only since 24th July, 2019.

Has there been any changes to the SDK recently that has modified this behavior ?

[tdurnford]

I'm fairly certain that Direct Line uses the user ID from the token and overwrites the user ID passed to Bot Chat. There have been some changes regarding how Direct Line handles conversation updates, but I don't believe this would affect the user ID behavior.

[Nitin2392]

@tdurnford - Thanks for the response. Does this mean that the SDK overrides the user object that I pass and instead fetches the userId from the token ?

If so, is there a way for me to explicitly suggest to the SDK to only consume the userId passed with the user object ?

[tdurnford]

Yes, the user ID overrides the user object you've created. I would recommend retrieving the user ID first and then using that ID to generate the token.

[EricDahlvang]

If Direct Line Enhanced Authentication is in use, the From.Id should be required by the protocol to match the id supplied in the token.

[stevengum]

@mingweiw can you chime in on this topic?

[mingweiw]

@Nitin2392, this overwrite behavior kicks in when Enhanced Authentication options is enabled for a site. The overwrite happens in the Direct Line service, not the SDK.