Teams app

[Ed Clark (clarked-msft)]

No description provided.

[Copilot]

Pull request overview

Adds Microsoft Teams app + Teams SSO (OBO flow) support to SimpleChat, along with deployment/config updates and documentation so the app can be embedded and authenticated inside the Teams client.

Changes:

• Add a Teams-aware login experience (login.html) and a new backend token exchange endpoint for Teams SSO (/auth/teams/token-exchange).
• Introduce Teams SSO configuration/env vars and adjust security headers + session cookie settings to support iframe embedding.
• Add Teams app packaging assets (manifest template + icons), docs/how-to guidance, and update release notes + bicep deployment parameters.

Reviewed changes

Copilot reviewed 9 out of 13 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
docs/how-to/teams_app.md	New how-to for configuring Teams app + SSO, env vars, and troubleshooting.
docs/explanation/release_notes.md	Release notes entry for Teams app/SSO and bicep fix.
deployers/bicep/main.bicep	Adds enableTeamsSso param; updates ACR suffix to environment-driven value.
deployers/bicep/modules/appService.bicep	Wires enableTeamsSso into app settings (ENABLE_TEAMS_SSO).
application/teams_app/manifest.template.json	Template Teams manifest for SSO-enabled tab.
application/teams_app/color.png / outline.png	Teams app icon assets.
application/single_app/templates/login.html	New Teams detection + SSO login page with fallback to normal AAD auth.
application/single_app/static/js/MicrosoftTeams.min.js	Bundled Teams JS SDK for offline/disconnected scenarios.
application/single_app/route_frontend_authentication.py	Adds Teams login routing behavior + token exchange endpoint.
application/single_app/config.py	Adds Teams SSO config + CSP frame-ancestors behavior; version bump.
application/single_app/app.py	Sets cookie attributes needed for Teams iframe embedding when Teams SSO enabled.
.gitignore	Ignores a generated application/teams_app/manifest.json.

[Copilot]

Pull request overview

Adds Microsoft Teams app packaging + SSO support to SimpleChat, wiring a Teams-aware login experience into the existing Flask/MSAL auth flow and updating deployment/config/docs accordingly.

Changes:

• Added Teams-aware login.html + local Teams JS SDK and a new /auth/teams/token-exchange endpoint for OBO token exchange.
• Introduced Teams SSO configuration knobs (ENABLE_TEAMS_SSO, CSP frame-ancestors handling, session cookie settings).
• Added Teams app package templates/assets + deployment plumbing (Bicep param + env var) and documentation/release notes.

Reviewed changes

Copilot reviewed 9 out of 13 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
docs/how-to/teams_app.md	New how-to guide for Teams app + SSO configuration and troubleshooting.
docs/explanation/release_notes.md	Release notes entry for Teams SSO + related infra changes.
deployers/bicep/modules/appService.bicep	Adds enableTeamsSso param and sets ENABLE_TEAMS_SSO app setting.
deployers/bicep/main.bicep	Plumbs enableTeamsSso through and uses az.environment().suffixes.acrLoginServer for ACR suffix.
application/teams_app/manifest.template.json	Teams manifest template with SSO-ready webApplicationInfo and tab URLs.
application/teams_app/color.png	Teams app icon asset.
application/teams_app/outline.png	Teams app outline icon asset.
application/single_app/templates/login.html	New Teams-aware sign-in page that attempts Teams SSO and falls back to standard login.
application/single_app/static/js/MicrosoftTeams.min.js	Vendored Teams JS SDK for disconnected environments.
application/single_app/route_frontend_authentication.py	Adds Teams SSO branching in /login and implements /auth/teams/token-exchange.
application/single_app/config.py	Version bump + Teams SSO env vars + CSP frame-ancestors composition and conditional X-Frame-Options.
application/single_app/app.py	Adjusts session cookie settings for iframe embedding when Teams SSO is enabled.
.gitignore	Ignores generated application/teams_app/manifest.json.

[Copilot]

Pull request overview

Adds Microsoft Teams app packaging + documentation and wires up Teams SSO (OBO flow) into the existing Flask auth flow, alongside a small Bicep improvement for ACR suffix portability.

Changes:

• Introduces Teams SSO login flow (/login Teams-detecting page + /auth/teams/token-exchange OBO endpoint) and adjusts cookies/CSP to support iframe embedding.
• Adds Teams app package assets (manifest template + icons) and a how-to guide for setup/troubleshooting.
• Updates Bicep to use az.environment().suffixes.acrLoginServer and adds an enableTeamsSso deployment parameter.

Reviewed changes

Copilot reviewed 9 out of 13 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
docs/how-to/teams_app.md	New how-to guide for Teams SSO configuration and troubleshooting.
docs/explanation/release_notes.md	Release notes entry for Teams integration + Bicep fix.
deployers/bicep/modules/appService.bicep	Adds enableTeamsSso param and sets ENABLE_TEAMS_SSO app setting.
deployers/bicep/main.bicep	Plumbs enableTeamsSso parameter; uses environment-derived ACR suffix.
application/teams_app/outline.png	Teams app outline icon asset.
application/teams_app/color.png	Teams app color icon asset.
application/teams_app/manifest.template.json	Teams manifest template configured for tab + SSO fields.
application/single_app/templates/login.html	New Teams-aware login page that attempts Teams SSO then falls back.
application/single_app/static/js/MicrosoftTeams.min.js	Bundled Teams JS SDK for disconnected environments.
application/single_app/route_frontend_authentication.py	Implements Teams login branching and token-exchange endpoint.
application/single_app/config.py	Adds Teams SSO config/env vars and CSP frame-ancestors handling; bumps version.
application/single_app/app.py	Sets session cookie attributes for Teams iframe compatibility when enabled.
.gitignore	Ignores generated Teams manifest.json.

[Copilot]

Pull request overview

Adds Microsoft Teams tab packaging + Teams SSO (OBO) support to SimpleChat, including deployment toggles, CSP/cookie adjustments for iframe embedding, and documentation/templates for configuring the Teams app.

Changes:

• Adds Teams SSO login UX (/login?teams=true) and a backend token-exchange endpoint (/auth/teams/token-exchange) using MSAL OBO.
• Updates security headers and session cookie settings to support Teams iframe embedding.
• Adds Teams app packaging assets (manifest template + icons) and how-to documentation; updates Bicep and release notes.

Reviewed changes

Copilot reviewed 9 out of 13 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
docs/how-to/teams_app.md	New how-to guide for Teams app + SSO configuration.
docs/explanation/release_notes.md	Release notes entry for Teams app/SSO and Bicep ACR suffix fix.
deployers/bicep/modules/appService.bicep	Adds enableTeamsSso param and sets ENABLE_TEAMS_SSO app setting.
deployers/bicep/main.bicep	Plumbs enableTeamsSso into app service module; fixes ACR suffix via az.environment().suffixes.acrLoginServer.
application/teams_app/manifest.template.json	Teams manifest template for packaging a personal tab with SSO fields.
application/teams_app/color.png	Teams app icon asset (color).
application/teams_app/outline.png	Teams app icon asset (outline).
application/single_app/templates/login.html	New Teams-aware login page that attempts Teams SSO then falls back to standard Azure AD.
application/single_app/static/js/MicrosoftTeams.min.js	Bundled Teams JS SDK for offline/disconnected environments.
application/single_app/route_frontend_authentication.py	Adds Teams SSO entry path and /auth/teams/token-exchange endpoint.
application/single_app/config.py	Adds Teams SSO env vars; updates CSP frame-ancestors; bumps version.
application/single_app/app.py	Sets SameSite=None/Secure/HttpOnly session cookie flags when Teams SSO is enabled.
.gitignore	Ignores generated application/teams_app/manifest.json.

[Bionic711]

Ed Clark (@clarked-msft) Could you resolve the conflicts so I can review?

[Ed Clark (clarked-msft)]

Ed Clark (@clarked-msft) Could you resolve the conflicts so I can review?

Fixed... release_notes probably needs work. Looks like merge conflicts had previously been merged to Development.

[Copilot]

Pull request overview

Adds Microsoft Teams “tab app” support for SimpleChat with Teams SSO (OBO) login flow, plus deployment knobs and documentation so the app can be embedded in Teams and authenticate seamlessly.

Changes:

• Introduces a Teams-aware /login experience and a new /auth/teams/token-exchange endpoint to perform MSAL OBO token exchange.
• Adds Teams SSO configuration and CSP/session-cookie adjustments for iframe embedding, plus a Bicep parameter to toggle Teams SSO.
• Adds Teams app manifest/icon templates and documentation, and updates release notes.

Reviewed changes

Copilot reviewed 9 out of 13 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
docs/how-to/teams_app.md	New how-to guide for configuring Teams app + SSO prerequisites/troubleshooting.
docs/explanation/release_notes.md	Documents Teams SSO feature + related deployment changes (currently duplicated in-file).
deployers/bicep/modules/appService.bicep	Adds enableTeamsSso param and wires ENABLE_TEAMS_SSO app setting.
deployers/bicep/main.bicep	Adds enableTeamsSso param + uses az.environment().suffixes.acrLoginServer for ACR suffix.
application/teams_app/manifest.template.json	Adds Teams manifest template placeholders for HOSTNAME/CLIENT_ID.
application/teams_app/color.png	Teams app icon asset.
application/teams_app/outline.png	Teams app icon asset.
application/single_app/templates/login.html	New Teams-detecting login page with SSO + fallback to standard Azure AD login.
application/single_app/static/js/MicrosoftTeams.min.js	Vendored Teams JS SDK for offline/disconnected environments.
application/single_app/route_frontend_authentication.py	Adds Teams-aware login path + token-exchange endpoint.
application/single_app/config.py	Adds Teams SSO env vars and updates CSP/X-Frame-Options behavior for Teams embedding.
application/single_app/app.py	Sets session cookie attributes required for cross-origin iframe scenarios when Teams SSO enabled.
.gitignore	Ignores application/teams_app/manifest.json (generated/customized manifest).

[Copilot]

The Teams SSO feature block is duplicated in two different places in the release notes (once under v0.241.006 at the top, and again later in the file). This makes the changelog confusing and risks the same content being maintained in multiple spots; keep a single entry in the appropriate version section and remove the duplicate block.

[Copilot]

The comment on TEAMS_FRAME_ANCESTORS says it can be left blank to allow framing from any domain, but the CSP is always built as frame-ancestors 'self' {TEAMS_FRAME_ANCESTORS}; so a blank value will only allow 'self' and will block Teams iframe embedding. Either require/populate TEAMS_FRAME_ANCESTORS when ENABLE_TEAMS_SSO is true (especially for AZURE_ENVIRONMENT=="custom"), or update the comment/logic so the behavior matches the guidance.

[Copilot]

request.get_json() can return None (missing/invalid JSON body or wrong Content-Type). The next line calls data.get(...), which will raise and return a 500. Handle a non-dict JSON body explicitly and return a 400 with a clear error instead of falling into the generic exception handler.

Suggested change

	data=request.get_json()
	teams_token=data.get('token') or {}
	data=request.get_json(silent=True)
	ifnotisinstance(data, dict):
	returnjsonify({
	"error": "invalid_request",
	"error_description": "Request body must be a valid JSON object."
	}), 400
	teams_token=data.get("token")

[Copilot]

This endpoint assumes result.get("id_token_claims") exists and is a dict, but config.SCOPE is Graph-only (no openid/profile/email), so the OBO result may not include ID token claims. If session["user"] becomes None, session['user'].get(...) will throw and the login will fail. Populate session user data from a reliable source (e.g., decode the incoming Teams JWT assertion claims, or call Graph /me with the acquired access token) and guard against missing claims.

[Copilot]

log_event(..., exceptionTraceback=True) is used here on a non-exception error path and with the default INFO level, which can emit misleading NoneType: None tracebacks. Log this as an error-level event (and include structured properties like MSAL error code/description) without forcing an exception traceback unless you’re inside an actual exception handler.

[Copilot]

This PR introduces a new login.html page and client-side authentication flow (Teams detection + fallback) but doesn’t add/update any Playwright UI coverage. Add a UI test under ui_tests/ that at least validates the login page renders, the loading/error states toggle correctly, and the non-Teams fallback path is reachable (e.g., /login?teams=false).

[Copilot]

This PR includes runtime and deployer changes (not just docs), but VERSION in config.py is still 0.241.006. Repo instructions require bumping only the 3rd segment after code changes; please increment the version (e.g., to 0.241.007) and keep release notes aligned.

[Paul Lizer (paullizer)]

There are some changes that need to be adjudicated due to improvements on security, app hardening, and performance that we implemented in the upcoming release. I'm working on implementing them in a new branch, I should be able to test with my Commercial environment, but I will need you support for other environments.

Main Findings

Security: Teams token exchange needs more hardening

The PR adds a Teams SSO token-exchange endpoint that establishes a Flask session. It is feature-gated, but it still needs robust request validation, Origin/Referer validation for the pre-session POST, and a clean login-CSRF story. Current development already has broader same-origin enforcement in app.py, but that only applies after session["user"] exists, so the Teams bootstrap endpoint needs its own check.

Implementation: OBO identity handling is likely incomplete

The PR stores session["user"] from id_token_claims returned by acquire_token_on_behalf_of. For Graph-only OBO scopes, MSAL may not return id_token_claims. Current token-cache logic later expects oid, tid, and preferred_username, so Teams SSO should populate a full user dict from validated Teams assertion claims or from Graph /me using the exchanged access token.

Current app drift: PR auth changes conflict with newer auth work

Current route_frontend_authentication.py now includes CI bearer session auth, Easy Auth logout handling, and login activity tracking changes. The PR branch predates those. The rebase should transplant only the Teams behavior into the newer route rather than accept the PR’s older copy.

Cookie/CSRF model changed since the PR

Current config.py already has configurable SESSION_COOKIE_SAMESITE, SESSION_COOKIE_SECURE, CSRF_ENFORCE_ORIGIN_FOR_UNSAFE_METHODS, and CSRF_TRUSTED_ORIGINS. The PR’s conditional cookie update in app.py should be redesigned to fit that model. For Teams-enabled deployments, we probably need SameSite=None; Secure, plus trusted Teams origins and the app public origin in the CSRF allow-list.

Azure cloud support needs to be explicit

The PR has the right instinct for commercial and US Government Teams domains, but custom clouds need clearer configuration. We should model these separately:

• Commercial: teams.microsoft.com / *.teams.microsoft.com
• US Gov: teams.microsoft.us / *.teams.microsoft.us
• Custom/air-gapped: explicit TEAMS_FRAME_ANCESTORS, CUSTOM_TEAMS_ORIGINS, and probably CSRF_TRUSTED_ORIGINS

Browser-side Teams SDK origin checks are not a server-side security boundary.

Easy Auth conflict is real

Current deployer still configures authsettingsV2 with requireAuthentication: true in appService.bicep. The PR docs say Easy Auth must not intercept the Teams iframe. We need a deployer option, not just docs, to either relax unauthenticated access when Teams SSO is enabled or document a supported split deployment pattern.

Deployer overlap is partial

The PR’s ACR suffix fix is already present in appService.bicep, but main.bicep still has an older public-vs-gov suffix expression. Also, because deployer files change, version.txt must be bumped when we implement this.

Tests/docs are missing for the risk level

This needs functional tests for disabled Teams SSO, invalid JSON, missing token, OBO missing-claims behavior, security headers/CSP, and session cookie settings. It also needs at least a small UI test for the login bootstrap page and fallback path. Release notes will need cleanup after the version bump.

[Bionic711]

Paul Lizer (@paullizer) Is this the same as what we just integrated for Teams?

[Bionic711]

Closing as superseded by the hardened Teams SSO implementation integrated in commit 04d2c4c1 and released through PR #923. All Teams package and runtime capabilities from this PR are represented, with additional security, identity, deployment, documentation, and test improvements.