Running the fastapi/empty_agent.py sample results in a 500 error

[matthiasblondeel]

I'm running the sample fastapi/empty_agent.py using python 3.12 on windows
I am getting the following errors:

Traceback (most recent call last):
File "C:\project\src.venv\Lib\site-packages\uvicorn\protocols\http\httptools_impl.py", line 409, in run_asgi
result = await app( # type: ignore[func-returns-value]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\project\src.venv\Lib\site-packages\uvicorn\middleware\proxy_headers.py", line 60, in call
return await self.app(scope, receive, send)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\project\src.venv\Lib\site-packages\fastapi\applications.py", line 1134, in call
await super().call(scope, receive, send)
File "C:\project\src.venv\Lib\site-packages\starlette\applications.py", line 113, in call
await self.middleware_stack(scope, receive, send)
File "C:\project\src.venv\Lib\site-packages\starlette\middleware\errors.py", line 186, in call
raise exc
File "C:\project\src.venv\Lib\site-packages\starlette\middleware\errors.py", line 164, in call
await self.app(scope, receive, _send)
File "C:\project\src.venv\Lib\site-packages\microsoft_agents\hosting\fastapi\jwt_authorization_middleware.py", line 67, in call
await token_validator.get_anonymous_claims()
TypeError: object ClaimsIdentity can't be used in 'await' expression

I have the following versions of packages installed:
microsoft-agents-activity==0.6.0.dev11
microsoft-agents-authentication-msal==0.6.0.dev11
microsoft-agents-hosting-aiohttp==0.6.0.dev11
microsoft-agents-hosting-core==0.6.0.dev11
microsoft-agents-hosting-fastapi==0.6.0.dev11
microsoft-agents-hosting-teams==0.6.0.dev11

[jkshan]

It seems the still the case. matthiasblondeel, did you managed to make it work?

[jkshan]

It seems the still the case. @matthiasblondeel, did you managed to make it work?

I made it work by doing the below,

app = FastAPI(title="Authorization Agent Sample", version="1.0.0")
agent_config = CONNECTION_MANAGER.get_default_connection_configuration()
agent_config.ANONYMOUS_ALLOWED = True
app.state.agent_configuration = agent_config
app.add_middleware(JwtAuthorizationMiddleware)

Came up by referring to codes from authorization agent python sample they in their repo

[jkshan]

I think, both the empty_agent.py and authorization_agent.py still has issue for GET endpoint (health endpoint) as JwtAuthorizationMiddleware is added to run for all the endpoints in the FastAPI app. The middleware has to be ported to be decorator, so it can be applied to only the teams messaging endpoint alone, so that agent messaging endpoint can coexist with other endpoints of the app which could follow their own auth logics.

Below is the custom decorator I have created for the same (just wrapped the SDK's JWT validation code with functools), so I can attach the validation only to the agent's messages endpoint.

fastapi import Request
from fastapi.responses import JSONResponse
from microsoft_agents.hosting.core import AgentAuthConfiguration, JwtTokenValidator

import functools


def jwt_authorization_decorator(func):
    """
    JWT Authorization Decorator for FastAPI endpoints. Until a SDK solution is made available, 
    this decorator can be applied to any FastAPI route handler to enforce JWT validation using the Microsoft Agents SDK's JwtTokenValidator.
    """
    @functools.wraps(func)
    async def wrapper(request: Request):
        if request is None:
            return JSONResponse({"error": "Request object not found"}, status_code=500)

        auth_config: AgentAuthConfiguration = getattr(
            request.app.state, "agent_configuration", None
        )

        if auth_config is None:
            return JSONResponse(
                {"error": "Agent Authentication configuration not found"},
                status_code=500,
            )

        token_validator = JwtTokenValidator(auth_config)
        auth_header = request.headers.get("Authorization")

        if auth_header:
            parts = auth_header.split(" ")
            if len(parts) == 2 and parts[0].lower() == "bearer":
                token = parts[1]
                try:
                    claims = await token_validator.validate_token(token)
                    request.state.claims_identity = claims
                except ValueError:
                    return JSONResponse(
                        {"error": "Invalid token or authentication failed."},
                        status_code=401,
                    )
            else:
                return JSONResponse(
                    {"error": "Invalid authorization header format"},
                    status_code=401,
                )
        else:
            return JSONResponse(
                {"error": "Authorization header not found"},
                status_code=401,
            )

        return await func(request)

    return wrapper

Usage:

@router.post(
    "/teams/messages",
    summary="Handle Teams Bot Messages",
    description="Handles incoming messages and activity events from Microsoft Teams via the Bot Framework.",
    tags=["Teams"],
    responses={
        200: {"description": "Message processed successfully"},
        401: {"description": "JWT authorization failed"},
        503: {"description": "Teams bot not initialized"},
    },
)
@jwt_authorization_decorator
async def teams_bot_messages(request: Request):
     pass

[rodrigobr-msft]

Good point! I opened up a new issue here: #470