CODEWITHSUNDEEP
pythonflaskhmacmicrosoft-teams
hellbe
hellbe

Reputation: 321

Verifying HMAC from Microsoft Teams bot in Python Flask

I am trying to build a Microsoft Teams chat bot using Flask, following the instructions on how to build custom bots. However I am unable to verify the HMAC auth which I really want for security.

Based on guides and documentation I've found I am using the following minimial testing app trying to calculate a HMAC for the incoming request. (Bot name and description DevBot and the key/security_token below for testing).

#!/usr/bin/python
# coding=utf-8

from flask import Flask, request, jsonify
import hmac, hashlib, base64, json

app = Flask(__name__)

@app.route('/', methods=['GET', 'POST'])
def webhook():
    if request.method == 'POST':

        # Authenticate
        security_token = b"O5XHU8OSzwx8w9YiM0URkR/Ij4TZZiZUwz7Swc+1hZE="
        request_data = request.get_data()
        digest = hmac.new(security_token, msg=request_data, digestmod=hashlib.sha256).digest()
        signature = base64.b64encode(digest).decode()


        # TODO: Verify signature = Authorization header HMAC here

        return jsonify({
            'type' : 'message',
            'text' : "Auth header: {0} <br>Calculated HMAC: {1}".format(request.headers.get('Authorization'), signature),
        })

    elif request.method == 'GET':
        return "Hello World"


if __name__ == '__main__':
    app.run(debug=True)

Upon sending the message @DevBot test I get the following hashes back in the reply from the bot, but they aren't matching as expected:

Auth header: HMAC LuDmz97y/Z2KWLIZ1WZASz3HlOEtDCwk5/lL/fK8GqM= 
Calculated HMAC: eaxTdJSLuU3Z4l94bxFiWvsBhjNG9SPxwq/UHeR7KcA=

Any ideas or pointers? I've been trying all sorts of stuff with encoding but I have a feeling that Flask might be doing something that modifies the request body or something?

edit 1: small clarification

edit 2: full Flask app example

edit 3: sample bot details, input and output examples

Upvotes: 4

Views: 2549

Answers (2)

hellbe
hellbe

Reputation: 321

After lots of trial and error and trying to reproduce the C# code example from MS I managed to solve it myself. Here's the solution:

#!/usr/bin/python
# coding=utf-8

from flask import Flask, request, jsonify
import hmac, hashlib, base64, json

app = Flask(__name__)

@app.route('/', methods=['GET', 'POST'])
def webhook():
    if request.method == 'POST':


        # Reply
        data = request.get_json()
        channel = data['channelId']
        message_type = data['type']
        sender = data['from']['name']
        message_format = data['textFormat']
        message = data['text']

        # Authenticate

        security_token = b"O5XHU8OSzwx8w9YiM0URkR/Ij4TZZiZUwz7Swc+1hZE="
        request_data = request.get_data()
        digest = hmac.new(base64.b64decode(security_token), msg=request_data, digestmod=hashlib.sha256).digest()
        signature = base64.b64encode(digest).decode()

        # TODO: verify that HMAC header == signature

        return jsonify({
            'type' : 'message',
            'text' : "auth header: {0} <br>hmac: {1}".format(request.headers.get('Authorization').split(' ')[1], signature),
        })

    elif request.method == 'GET':
        return "Hello World"


if __name__ == '__main__':
    app.run(debug=True)

Upvotes: 9

Matthew Brown
Matthew Brown

Reputation: 76

Another option rather than interfacing directly with Microsoft Teams may be to use the Microsoft Bot Connector API.

https://docs.botframework.com/en-us/restapi/connector/

I have a bot working with Microsoft Teams using https://github.com/Grungnie/microsoftbotframework which is validating the JWT that is sent from Microsoft.

Upvotes: 2

Related Questions