This repository was archived by the owner on Jul 9, 2025. It is now read-only.
Repository navigation
This repository was archived by the owner on Jul 9, 2025. It is now read-only.
USER scope variable values do not transfer to skill when SSO is configured #9533
Description
Transferring data from root bot to skill bot using "user" scope variable does not seem to work when SSO is configured.
Example tutorial to Transfer data between Root bot and Skill Bot in Bot Composer:
https://www.youtube.com/watch?v=_I7fhwJO7nU&ab_channel=LearnMicrosoftAI
Looks like issue occurs when using "user" scope instead of "dialog":
Single sign on for skills documentation:
https://learn.microsoft.com/en-us/composer/how-to-single-sign-on-skill
Activity
[-]USER scope variable values does transfer to skill when SSO is configured[/-][+]USER scope variable values do not transfer to skill when SSO is configured[/+]ram-xv commentedon Mar 8, 2023
Investigating further on this.
ram-xv commentedon Mar 13, 2023
I'm able to reproduce this issue after adding SSO for the skills by using the TokenExchangeSkillHandler package.
Sharing the steps to repro:
Attached is minimal reproducible .zip composer project:
https://file.io/jXbnuRF6qsz2
Example Composer setup of transferring data to skill:
See the Activity
valueproperty; when SSO OAuth is NOT configured, it's showing the appropriate user scope variable data (999):{ “lgType”: “Activity”, “text”: { "type": "event", "id": "d6ef52c0-c1c5-11ed-9543-6de6bb2c76c8", "serviceUrl": "http://127.0.0.1:3981/api/skills", "channelId": "emulator", "from": { "id": "2969b251-0239-4ba5-8893-b411488fc245", "name": "User", "role": "user" }, "conversation": { "id": "48a6a729-691e-4e84-adc1-e5cb4c5e3393" }, "recipient": { "id": "d405c760-c1c5-11ed-9b3a-8d75c85f18b5", "name": "Bot", "role": "skill" }, "locale": "en-US", "value": "999", "name": "startSkill", "relatesTo": { "activityId": "d6ef52c0-c1c5-11ed-9543-6de6bb2c76c8", "conversation": { "id": "d4183df0-c1c5-11ed-9543-6de6bb2c76c8|livechat" }, "channelId": "emulator", "locale": "en-US", "serviceUrl": "http://localhost:61197" }, "callerId": "urn:botframework:aadappid:57501............................d73c" } }After SSO is configured, See the Activity
valueproperty. ("value": "999" does not show):{ “lgType”: “Activity”, “text”: { "type": "invoke", "timestamp": "2023-03-13T10:33:30.0144756-07:00", "serviceUrl": "http://127.0.0.1:3981/api/skills", "channelId": "emulator", "from": { "id": "e8046f07-d69e-4a7c-8072-fff5acf0c36f", "name": "User" }, "conversation": { "id": "a98aa330-5a84-4e4b-a709-11b9dc289f24" }, "recipient": { "id": "0eee4dd0-c1c5-11ed-b0ce-7fc2b507b10b", "name": "Bot", "role": "skill" }, "locale": "en-US", "text": "", "attachments": [], "entities": [], "value": { "id": "2855bf...............b4c934", "connectionName": "<MyOAuthConnectionName>", "token": "eyJ0eXAiOiJKV1QiLCJhbGciO.................j4dSuCgGimnDyN1BXLvWtZg4WrltejhCqw" }, "name": "signin/tokenExchange", "relatesTo": { "conversation": { "id": "0efb9440-c1c5-11ed-b481-cd85d765d611|livechat" }, "channelId": "emulator", "locale": "en-US", "serviceUrl": "http://127.0.0.1:3981/api/skills" }, "callerId": "urn:botframework:aadappid:5750185.........................73c" } }ram-xv commentedon Mar 13, 2023
Hi Cecilia Avila (@ceciliaavila),
It appears this issue is reproducible. Assigning this to you for now.
Please let me know if you have any questions.
Thanks.
ceciliaavila commentedon Mar 15, 2023
Hi @ramfattah, we added this one to our backlog. We'll let you know as soon as we have new information.
Thanks!
sw-joelmut commentedon Mar 20, 2023
Hi @ramfattah, we were able to reproduce the issue by following the provided steps.
Analyzing the behavior of the bots (root/skill), we can see that SSO is working as intended.
When transferring data, the skill receives the Activity from the root bot, but after the OAuth login step is executed, this Activity is no longer available as it's replaced with the invoke activity the root bot sends to exchange the token.
A workaround for this behavior could be creating a property to store the Activity before the OAuth login step happens, and then use this property to access the data.
The following image shows how the host and skill behave.
ram-xv commentedon Mar 27, 2023
Hey Joel Mut (@sw-joelmut),
Thanks for sharing this information.
Indeed I'm able to see the Value in the skill before OAuth.
In regards to the workaround, I tried to create a property
user.myValueto store the Activity value before OAuth. But it seems the property does not contain the activity value anymore after OAuth step.Additionally, all my other "user" memory scope properties within the skill dialog are also erased after OAuth.
Example:
sw-joelmut commentedon Mar 28, 2023
We were able to reproduce the issue where the
userscope variable loses the state after the OAuth step when using Emulator. Web Chat works as expected.We will investigate why the scope variable is behaving this way, and let you know when we have some information.
ceciliaavila commentedon Mar 31, 2023
Hi @ramfattah, we found the cause of the issue. The user scope is not saved in the state until there's an endOfTurn in the dialog.
As the root bot interrupts the dialog flow to send the token exchange activity, the skill saves its state later than it should, causing the issue.
We are working on a fix, forcing the saving of the state in the SetProperty action.
Please, let us know if you have any questions.
ram-xv commentedon Mar 31, 2023
Thank you for the update Cecilia Avila (@ceciliaavila).