diff --git a/Samples/BetaSamples/LocalMediaSamples/PolicyRecordingBot/FirewallREADME.md b/Samples/BetaSamples/LocalMediaSamples/PolicyRecordingBot/FirewallREADME.md index 4bf9a1311..cdc5aaa80 100644 --- a/Samples/BetaSamples/LocalMediaSamples/PolicyRecordingBot/FirewallREADME.md +++ b/Samples/BetaSamples/LocalMediaSamples/PolicyRecordingBot/FirewallREADME.md @@ -3,42 +3,175 @@ ## Step 1: Create a Virtual Network and Subnet for Azure Firewall -1. Go to Virtual Network or create a new one if it doesn't exist. -2. Create a subnet for the firewall with the purpose set to "Azure Firewall". ![Create subnet](Images/CreateSubnet.png) -3. Go to the firewall section and click on "Add firewall". ![Create firewall](Images/CreateFirewall.png) + 1. Go to Virtual Network or create a new one if it doesn't exist. + 2. Create a subnet for the firewall with the purpose set to "Azure Firewall". ![Create subnet](Images/CreateSubnet.png) + 3. Go to the firewall section and click on "Add firewall". ![Create firewall](Images/CreateFirewall.png) ## Step 2: Configure Firewall Settings -1. Choose a name for the firewall (e.g., "MyFirewall"). -2. Create a new firewall policy. ![Create policy](Images/CreatePolicy.png) -3. Select the existing Virtual Network. -4. Create a new public IP address (e.g., "MyFWPublicIP"). -5. Review and create the firewall. + 1. Choose a name for the firewall (e.g., "MyFirewall"). + 2. Create a new firewall policy. ![Create policy](Images/CreatePolicy.png) + 3. Select the existing Virtual Network. + 4. Create a new public IP address (e.g., "MyFWPublicIP"). + 5. Review and create the firewall. ## Step 3: Configure Firewall Policy -1. Open the firewall policy created in Step 2. -2. Navigate to Settings. - -### Configure Application Rules (Ingress) - -1. Add an application rule: - * Give a descriptive name. - * Select "Application rule collection" as the rule type. - * Assign the lowest number as the priority. - * Specify a name for the rule. - * Define the source (e.g., your VM subnet) or use `*` to allow all IP addresses. - * Allow specific domains (e.g., `policyrecordingbot.eastus.cloudapp.azure.com`). - * Save the rule. - -### Configure Network Rules (Egress) - -1. Add a network rule: - * Give a descriptive name. - * Select "Network rule collection" as the rule type. - * Assign the lowest number as the priority. - * Specify a name for the rule. - * Define the source (e.g., your VM subnet) or use `*` to allow all IP addresses. - * Specify external IPs or ranges (e.g., `0.0.0.0/0` for all). - * Specify allowed protocols and ports.(TCP: 5060, 5061 ,UDP: 10000-20000) - * Save the rule. \ No newline at end of file + 1. Open the firewall policy created in Step 2. + 2. Navigate to Settings. + +## Step 4: Configure Application Rules (Ingress) + + Add an application rule: + a. Give a descriptive name. + b. Select "Application rule collection" as the rule type. + c. Assign the lowest number as the priority. + d. Specify a name for the rule. + e. Define the source (e.g., your VM subnet) or use `*` to allow all IP addresses. + f. Allow specific domains (e.g., `policyrecordingbot.eastus.cloudapp.azure.com`). + g. Save the rule. + +## Step 5: Configure Network Rules (Egress) + + Add a network rule: + a. Give a descriptive name. + b. Select "Network rule collection" as the rule type. + c. Assign the lowest number as the priority. + d. Specify a name for the rule. + e. Define the source (e.g., your VM subnet) or use `*` to allow all IP addresses. + f. Specific external IPs or ranges (e.g., 192.168.1.0/24 for a subnet) instead of using 0.0.0.0/0 for all. This ensures that only trusted sources can access your service. If you want to allow access from all IPs, you can configure it as 0.0.0.0/0. + g. Specify only particular protocols and ports you want to allow. For example, you may configure TCP ports like 9444, 8445, 9442, 443, and port ranges like 10100-10199 and 20100-20199. If you want to restrict access to everything else, you should mention specific configurations like below: + Allowed TCP ports: 9444, 8445, 9442, 443, 9441, 10100-10199, 20100-20199. + All other ports and protocols will be restricted. + h. Save the rule. + +## Step 6: Firewall Configuration Summary + + 1. Specify External IPs or Ranges + Allow only specific external IPs or ranges (e.g., 192.168.1.0/24 for a subnet) instead of using 0.0.0.0/0 for all. This ensures that only trusted sources can access your service. If you want to allow access from all IPs, you can configure it as 0.0.0.0/0. + + Example: + To allow access from a specific subnet: + Allow: 192.168.1.0/24 + + To allow access from all IPs: + Allow: 0.0.0.0/0 + + 2. Specify Allowed Protocols and Ports + You can specify only particular protocols and ports you want to allow. For example, configure the following: + Allowed TCP Ports: 9444 (SignalingPort) + 8445 (MediaPort) + 9442 (TcpForwardingPort) + 443 (DefaultEndpoint) + 9441 (localPort) + 10100-10199 (InstanceCallControlEndpoint) + 20100-20199 (InstanceMediaControlEndpoint) + + * All other ports and protocols will be restricted. + + Example of Ingress Allow Rules: + + a. Allow TCP Port 9444: + Rule Name: Allow SignalingPort + Action: Allow + Protocol: TCP + Port: 9444 + + b. Allow TCP Port 8445: + Rule Name: Allow MediaPort + Action: Allow + Protocol: TCP + Port: 8445 + + c. Allow TCP Port 9442: + Rule Name: Allow TcpForwardingPort + Action: Allow + Protocol: TCP + Port: 9442 + + d. Allow TCP Port 443: + Rule Name: Allow DefaultEndpoint + Action: Allow + Protocol: TCP + Port: 443 + + e. Allow TCP Port 9441: + Rule Name: Allow LocalPort + Action: Allow + Protocol: TCP + Port: 9441 + + f. Allow TCP Port Range 10100-10199: + Rule Name: Allow InstanceCallControlEndpoint + Action: Allow + Protocol: TCP + Port Range: 10100-10199 + + g. Allow TCP Port Range 20100-20199: + Rule Name: Allow InstanceMediaControlEndpoint + Action: Allow + Protocol: TCP + Port Range: 20100-20199 + + 3. Restrict All Other Ingress Ports and Protocols: + After creating the allow rules, add a rule to deny all other traffic. This ensures that any port or protocol not explicitly allowed is blocked. + + Example of Deny Rule: + Deny All Other Ingress Traffic: + Rule Name: Deny All Other Ingress Traffic + Action: Deny + Protocol: Any + Port: Any + + Example of Egress Allow Rules + a. Allow TCP Port 9444: + Rule Name: Allow Egress SignalingPort + Action: Allow + Protocol: TCP + Port: 9444 + + b. Allow TCP Port 8445: + Rule Name: Allow Egress MediaPort + Action: Allow + Protocol: TCP + Port: 8445 + + c. Allow TCP Port 9442: + Rule Name: Allow Egress TcpForwardingPort + Action: Allow + Protocol: TCP + Port: 9442 + + d. Allow TCP Port 443: + Rule Name: Allow Egress DefaultEndpoint + Action: Allow + Protocol: TCP + Port: 443 + + e. Allow TCP Port 9441: + Rule Name: Allow Egress LocalPort + Action: Allow + Protocol: TCP + Port: 9441 + + f. Allow TCP Port Range 10100-10199: + Rule Name: Allow Egress InstanceCallControlEndpoint + Action: Allow + Protocol: TCP + Port Range: 10100-10199 + + g. Allow TCP Port Range 20100-20199: + Rule Name: Allow Egress InstanceMediaControlEndpoint + Action: Allow + Protocol: TCP + Port Range: 20100-20199 + + 4. Restrict All Other Egress Ports and Protocols + * Similarly, add a rule to deny all other egress traffic. + + Example of Deny Rule: + Deny All Other Egress Traffic: + Rule Name: Deny All Other Egress Traffic + Action: Deny + Protocol: Any + Port: Any \ No newline at end of file diff --git a/Samples/BetaSamples/LocalMediaSamples/PolicyRecordingBot/README.md b/Samples/BetaSamples/LocalMediaSamples/PolicyRecordingBot/README.md index a9832ce8c..b3fcab0d6 100644 --- a/Samples/BetaSamples/LocalMediaSamples/PolicyRecordingBot/README.md +++ b/Samples/BetaSamples/LocalMediaSamples/PolicyRecordingBot/README.md @@ -1,3 +1,4 @@ + # Introduction ## Note @@ -7,7 +8,7 @@ This sample is only designed for compliance recording scenario. Do not use it fo ## About -The Policy Recording bot sample guides you through building, deploying and testing a bot. This sample demonstrates how a bot can receive media streams for recording. Please note that the sample does not actually record. This logic is left up to the developer. +The Policy Recording bot sample guides you through building, deploying, and testing a bot. This sample demonstrates how a bot can receive media streams for recording. Please note that the sample does not actually record. This logic is left up to the developer. ## Getting Started @@ -15,16 +16,15 @@ This section walks you through the process of deploying and testing the sample b ### Bot Registration -1. Follow the steps in [Register Calling Bot](https://microsoftgraph.github.io/microsoft-graph-comms-samples/docs/articles/calls/register-calling-bot.html). Save the bot name, bot app id and bot secret for configuration. - * For the calling webhook, by default the notification will go to https://{your domain}/api/calling. This is configured with the `CallSignalingRoutePrefix` in [HttpRouteConstants.cs](FrontEnd/Http/Controllers/HttpRouteConstants.cs). +1. Follow the steps in [Register Calling Bot](https://microsoftgraph.github.io/microsoft-graph-comms-samples/docs/articles/calls/register-calling-bot.html). Save the bot name, bot app id, and bot secret for configuration. + * For the calling webhook, by default the notification will go to `https://{your domain}/api/calling`. This is configured with the `CallSignalingRoutePrefix` in [HttpRouteConstants.cs](FrontEnd/Http/Controllers/HttpRouteConstants.cs). * Ignore the "Register bot in Microsoft Teams" section as the Policy Recording bot won't be called directly. These bots are related to the policies discussed below, and are "attached" to users, and will be automatically invited to the call. -1. Add the following Application Permissions to the bot: +2. Add the following Application Permissions to the bot: + * `Calls.AccessMedia.All` + * `Calls.JoinGroupCall.All` - * Calls.AccessMedia.All - * Calls.JoinGroupCall.All - -1. The permission needs to be consented by tenant admin. Go to "https://login.microsoftonline.com/common/adminconsent?client_id=&state=&redirect_uri=" using tenant admin to sign-in, then consent for the whole tenant. +3. The permission needs to be consented by the tenant admin. Go to "https://login.microsoftonline.com/common/adminconsent?client_id=&state=&redirect_uri=" using tenant admin to sign in, then consent for the whole tenant. ### Create an Application Instance @@ -44,9 +44,11 @@ After 30-60 seconds, the policy should show up. To verify your policy was create * `Get-CsTeamsComplianceRecordingPolicy ` ### Assign the Recording Policy + Requries the policy identity created above. Contine your powershell session and run the following commands. * `Grant-CsTeamsComplianceRecordingPolicy -Identity -PolicyName ` + To verify your policy was assigned correctly: * `Get-CsOnlineUser | ft sipaddress, tenantid, TeamsComplianceRecordingPolicy` @@ -58,132 +60,152 @@ To verify your policy was assigned correctly: ### Deploy -* Prerequisites for deploying Azure Cloud Services (extended support)(https://learn.microsoft.com/en-us/azure/cloud-services-extended-support/deploy-prerequisite) - -Step 1: Securely Store Certificates with Azure Key Vault - * Certificates are crucial for securing communication between your services. Azure Key Vault is used to store and manage these certificates securely. - - Create an Azure Key Vault: - * Follow these instructions to create your Azure Key Vault: https://learn.microsoft.com/en-us/azure/key-vault/general/quick-create-portal. - -Step 2: Obtain and Configure Your SSL Certificate - * To secure your service, you need a valid SSL certificate. Here’s how to obtain and configure it: - - Get a Wildcard Certificate: - * Obtain a wildcard SSL certificate for your domain. For example, if your service is hosted at bot.contoso.com,get a certificate for *.contoso.com. - * Ensure that the certificate is issued by a trusted Certificate Authority (CA) and not self-signed. - - Upload to Azure Key Vault: - * Upload your SSL certificate to the Azure Key Vault. Follow these steps: https://learn.microsoft.com/en-us/azure/key-vault/certificates/tutorial-import-certificate?tabs=azure-portal. - - Get the Thumbprint: - * Copy the certificate thumbprint from Azure Key Vault. You will need to add this thumbprint to your .cscfg (cloud service configuration) and .csdef (cloud service definition) files. - 1. Update the Certificate section in your .cscfg file with the thumbprint. - - - - - 2. Update the Certificate element in your .csdef file. - - - - * Replace YourCertificateName with the actual name of your certificate as it appears in your Azure Key Vault or wherever it is stored. Here are the key attributes: - name: This should match the certificate's name as referenced in your Azure Key Vault or local certificate store. - storeLocation: Specifies where the certificate is stored. LocalMachine is a common location for certificates installed on the local machine. - storeName: Specifies the store name where the certificate is located. My is a common store name used for personal certificates. - -Step 3: Define Your Virtual Network - * For Azure Extended Services, you can define the virtual network and subnet configurations in your .cscfg file. Azure can create the virtual network during the service setup if it doesn't already exist. - * When deploying your cloud service (extended) in Azure, virtual network and subnet configurations are managed automatically based on your .cscfg file. Follow these guidelines to ensure proper configuration: - -#### Using Existing Virtual Network: - - * If you have an existing Virtual Network (VNet) that you want to use: - - - - - - - - - - - - * Replace "YourExistingVNetName" with the name of your existing Virtual Network and "YourExistingSubnetName" with the name of your existing subnet within that Virtual Network. - -### Automatic Creation of Virtual Network: - - * If the Virtual Network doesn't exist, Azure will create it based on the configuration provided: - - - - - - - - - - - * Replace "NewVNetName" with the name of the Virtual Network you want Azure to create, and "NewSubnetName" with the name of the subnet within that Virtual Network. - - ### Note on Domain Name and Public IP: +* Prerequisites for deploying Azure Cloud Services (extended support) [here](https://learn.microsoft.com/en-us/azure/cloud-services-extended-support/deploy-prerequisite). - - - - * PublicIP name: "MyPublicIP" – Provide a unique name for the public IP. - * domainNameLabel: "myservice" – Set this to your service's domain label. - - Azure Extended Services: - * Public IP: You must provide a Public IP name in your configuration when creating the service. - * Domain Name: The domain name (domainNameLabel) is optional during initial creation and can be specified or updated later. +#### Step 1: Securely Store Certificates with Azure Key Vault + +Certificates are crucial for securing communication between your services. Azure Key Vault is used to store and manage these certificates securely. + +Create an Azure Key Vault: +* Follow these instructions to create your Azure Key Vault: [Create Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/general/quick-create-portal). + +#### Step 2: Obtain and Configure Your SSL Certificate + +To secure your service, you need a valid SSL certificate. Here’s how to obtain and configure it: + +1. **Get a Wildcard Certificate**: + * Obtain a wildcard SSL certificate for your domain. For example, if your service is hosted at bot.contoso.com, get a certificate for \*.contoso.com. + * Ensure that the certificate is issued by a trusted Certificate Authority (CA) and not self-signed. + +2. **Upload to Azure Key Vault**: + * Upload your SSL certificate to the Azure Key Vault. Follow these steps: [Import Certificate](https://learn.microsoft.com/en-us/azure/key-vault/certificates/tutorial-import-certificate?tabs=azure-portal). + +3. **Get the Thumbprint**: + * Copy the certificate thumbprint from Azure Key Vault. You will need to add this thumbprint to your `.cscfg` (cloud service configuration) and `.csdef` (cloud service definition) files. + + 1. Update the Certificate section in your `.cscfg` file with the thumbprint. + ```xml + + + + + ``` + + 2. Update the Certificate element in your `.csdef` file. + ```xml + + + + ``` + * Replace YourCertificateName with the actual name of your certificate as it appears in your Azure Key Vault or wherever it is stored. Here are the key attributes: - Match Public IP Name: - * Ensure that the name attribute under (MyPublicIP in this example) matches the name used in your application code to fetch the public IP address dynamically. - * To ensure that the domainNameLabel matches between your configuration (.cscfg file) and the Azure portal settings. + **name**: This should match the certificate's name as referenced in your Azure Key Vault or local certificate store. + + **storeLocation**: Specifies where the certificate is stored. LocalMachine is a common location for certificates installed on the local machine. + + **storeName**: Specifies the store name where the certificate is located. My is a common store name used for personal certificates. + + +#### Step 3: Define Your Virtual Network + +* For Azure Extended Services, you can define the virtual network and subnet configurations in your `.cscfg` file. Azure can create the virtual network during the service setup if it doesn't already exist. +* When deploying your cloud service (extended) in Azure, virtual network and subnet configurations are managed automatically based on your .cscfg file. Follow these guidelines to ensure proper configuration. + +##### Using Existing Virtual Network: + +* If you have an existing Virtual Network (VNet) that you want to use: + +```xml + + + + + + + + + + +``` +* Replace "YourExistingVNetName" with the name of your existing Virtual Network and "YourExistingSubnetName" with the name of your existing subnet within that Virtual Network. + +##### Automatic Creation of Virtual Network: + +* If the Virtual Network doesn't exist, Azure will create it based on the configuration provided: + +```xml + + + + + + + + + + +``` +* Replace "NewVNetName" with the name of the Virtual Network you want Azure to create, and "NewSubnetName" with the name of the subnet within that Virtual Network. + +### Note on Domain Name and Public IP + +```xml + + + +``` +* PublicIP name: "MyPublicIP" – Provide a unique name for the public IP. +* domainNameLabel: "myservice" – Set this to your service's domain label. + +Azure Extended Services Configuration: +* **Public IP**: You must provide a Public IP name in your configuration when creating the service. +* **Domain Name**: The domain name (domainNameLabel) is optional during initial creation and can be specified or updated later. + +Match Public IP Name: +* Ensure that the `name` attribute under `` ("MyPublicIP" in this example) matches the name used in your application code to fetch the public IP address dynamically. +* To ensure that the `domainNameLabel` matches between your configuration (.cscfg file) and the Azure portal settings. - Step 4: Deploy +#### Step 4: Deploy - 1. Create Your Cloud Service (Extended Support) - 1. Use the Azure portal to create a Cloud Service (Extended Support). - Follow this guide: Create a Cloud Service (Extended Support).(https://learn.microsoft.com/en-us/azure/cloud-services-extended-support/deploy-portal) - 2. Obtain Your Public IP DNS name: +1. Create Your Cloud Service (Extended Support): + * Use the Azure portal to create a Cloud Service (Extended Support). Follow this guide: [Create Cloud Service](https://learn.microsoft.com/en-us/azure/cloud-services-extended-support/deploy-portal). + * Obtain Your Public IP DNS name: After the service is created, obtain the "Public IP DNS name" from the Azure portal. This URL will serve as your DNS name and Common Name (CN) for further configurations (e.g. bot.contoso.com). - ![Public IP DNS name](Images/PublicIPDNSName.png). - - 2. Update the app configs with values - 1. Set up cloud service configuration - 1. Open powershell, go to the folder that contains file `configure_cloud.ps1`. The file is in the `Samples` directory. - 2. Run the powershell script with parameters: - ` .\configure_cloud.ps1 -p {path to project} -dns {your DNS name} -cn {your CN name, should be the same as your DNS name} -bid {your bot name} -aid {your bot app id} -as {your bot secret}` - - For example: - - `.\configure_cloud.ps1 -p .\V1.0Samples\LocalMediaSamples\PolicyRecordingBot\ -dns bot.contoso.com -cn bot.contoso.com -bid bot -aid 3853f935-2c6f-43d7-859d-6e8f83b519ae -as 123456!@#$%^` - - 3. Deploy to Cloud Service (Extended Support) - 1. Configure Storage Account for Configuration Files. - * To store configuration files for your Azure extended service, you'll need to set up a storage account. Follow these steps to configure the storage account:(https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal). - 2. Package Your Cloud Service for Deployment - * Before you can create your Azure extended service, you need to package your cloud service application to include configuration files and dependencies. - * Right click PolicyRecordingBot, then click `Package...`. - - Option 1: Upload to Azure Storage Account: - * Upload your packaged application (cspkg file) along with the .cscfg and .csdef files to an Azure Storage Account container. - * This method allows you to deploy directly from the Azure Storage Account during service creation. - - Option 2: Use Local Files: - * Deploy directly from local files during the service creation process. - * Ensure all required files, including .cscfg and .csdef, are accessible and correctly referenced during deployment. + ![Public IP DNS name](Images/PublicIPDNSName.png). + +2. Update the App Configurations: + * Set up cloud service configuration with PowerShell: + 1. Open PowerShell, go to the folder that contains the file `configure_cloud.ps1`. The file is in the `Samples` directory. + 2. Run the PowerShell script with parameters: + ```powershell + .\configure_cloud.ps1 -p {path to project} -dns {your DNS name} -cn {your CN name, should be the same as your DNS name} -bid {your bot name} -aid {your bot app id} -as {your bot secret} + ``` + For example: + ```powershell + .\configure_cloud.ps1 -p .\V1.0Samples\LocalMediaSamples\PolicyRecordingBot\ -dns bot.contoso.com -cn bot.contoso.com -bid bot -aid 3853f935-2c6f-43d7-859d-6e8f83b519ae -as 123456!@#$%^ + ``` + +3. Deploy to Cloud Service (Extended Support): + 1. Configure Storage Account for Configuration Files. + * To store configuration files for your Azure extended service, you'll need to set up a storage account. Follow these steps to configure the storage account:(https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal). + 2. Package Your Cloud Service for Deployment + * Before you can create your Azure extended service, you need to package your cloud service application to include configuration files and dependencies. + * Right click PolicyRecordingBot, then click `Package...`. + +**Option 1**: Upload to Azure Storage Account: +* Upload your packaged application (cspkg file) along with the .cscfg and .csdef files to an Azure Storage Account container. +* This method allows you to deploy directly from the Azure Storage Account during service creation. + +**Option 2**: Use Local Files: +* Deploy directly from local files during the service creation process. +* Ensure all required files, including .cscfg and .csdef, are accessible and correctly referenced during deployment. ### Firewall setup * Please follow below steps to configure firewall. - [document](FirewallREADME.md) - ### Test 1. Set up the test meeting and test clients: @@ -197,8 +219,8 @@ Step 3: Define Your Virtual Network 3. Interact with your service, _adjusting the service URL appropriately_. 1. Get diagnostics data from the bot. Open the url https://bot.contoso.com:10101/calls in a browser for auto-refresh. Search for the most recent CallId and replace with it in the below url. - * Active calls: https://bot.contoso.com:10101/calls/{CallId} - * Service logs: https://bot.contoso.com:10101/logs + * Active calls: https://bot.contoso.com:10101/calls/{CallId} + * Service logs: https://bot.contoso.com:10101/logs 2. Terminating the call through `DELETE`, as needed for testing. Replace the {CallId} below with your call id from the first response. diff --git a/Samples/Common/Sample.Common/Sample.Common.csproj b/Samples/Common/Sample.Common/Sample.Common.csproj index 526a06438..fa43ef611 100644 --- a/Samples/Common/Sample.Common/Sample.Common.csproj +++ b/Samples/Common/Sample.Common/Sample.Common.csproj @@ -10,11 +10,10 @@ - - + @@ -24,7 +23,7 @@ - + diff --git a/Samples/V1.0DeltaRosterSample/LocalMediaSamples/PolicyRecordingBot/FirewallREADME.md b/Samples/V1.0DeltaRosterSample/LocalMediaSamples/PolicyRecordingBot/FirewallREADME.md index 4bf9a1311..a5e5ddd78 100644 --- a/Samples/V1.0DeltaRosterSample/LocalMediaSamples/PolicyRecordingBot/FirewallREADME.md +++ b/Samples/V1.0DeltaRosterSample/LocalMediaSamples/PolicyRecordingBot/FirewallREADME.md @@ -3,42 +3,174 @@ ## Step 1: Create a Virtual Network and Subnet for Azure Firewall -1. Go to Virtual Network or create a new one if it doesn't exist. -2. Create a subnet for the firewall with the purpose set to "Azure Firewall". ![Create subnet](Images/CreateSubnet.png) -3. Go to the firewall section and click on "Add firewall". ![Create firewall](Images/CreateFirewall.png) + 1. Go to Virtual Network or create a new one if it doesn't exist. + 2. Create a subnet for the firewall with the purpose set to "Azure Firewall". ![Create subnet](Images/CreateSubnet.png) + 3. Go to the firewall section and click on "Add firewall". ![Create firewall](Images/CreateFirewall.png) ## Step 2: Configure Firewall Settings -1. Choose a name for the firewall (e.g., "MyFirewall"). -2. Create a new firewall policy. ![Create policy](Images/CreatePolicy.png) -3. Select the existing Virtual Network. -4. Create a new public IP address (e.g., "MyFWPublicIP"). -5. Review and create the firewall. + 1. Choose a name for the firewall (e.g., "MyFirewall"). + 2. Create a new firewall policy. ![Create policy](Images/CreatePolicy.png) + 3. Select the existing Virtual Network. + 4. Create a new public IP address (e.g., "MyFWPublicIP"). + 5. Review and create the firewall. ## Step 3: Configure Firewall Policy -1. Open the firewall policy created in Step 2. -2. Navigate to Settings. - -### Configure Application Rules (Ingress) - -1. Add an application rule: - * Give a descriptive name. - * Select "Application rule collection" as the rule type. - * Assign the lowest number as the priority. - * Specify a name for the rule. - * Define the source (e.g., your VM subnet) or use `*` to allow all IP addresses. - * Allow specific domains (e.g., `policyrecordingbot.eastus.cloudapp.azure.com`). - * Save the rule. - -### Configure Network Rules (Egress) - -1. Add a network rule: - * Give a descriptive name. - * Select "Network rule collection" as the rule type. - * Assign the lowest number as the priority. - * Specify a name for the rule. - * Define the source (e.g., your VM subnet) or use `*` to allow all IP addresses. - * Specify external IPs or ranges (e.g., `0.0.0.0/0` for all). - * Specify allowed protocols and ports.(TCP: 5060, 5061 ,UDP: 10000-20000) - * Save the rule. \ No newline at end of file + 1. Open the firewall policy created in Step 2. + 2. Navigate to Settings. + +## Step 4: Configure Application Rules (Ingress) + + Add an application rule: + a. Give a descriptive name. + b. Select "Application rule collection" as the rule type. + c. Assign the lowest number as the priority. + d. Specify a name for the rule. + e. Define the source (e.g., your VM subnet) or use `*` to allow all IP addresses. + f. Allow specific domains (e.g., `policyrecordingbot.eastus.cloudapp.azure.com`). + g. Save the rule. + +## Step 5: Configure Network Rules (Egress) + + Add a network rule: + a. Give a descriptive name. + b. Select "Network rule collection" as the rule type. + c. Assign the lowest number as the priority. + d. Specify a name for the rule. + e. Define the source (e.g., your VM subnet) or use `*` to allow all IP addresses. + f. Specific external IPs or ranges (e.g., 192.168.1.0/24 for a subnet) instead of using 0.0.0.0/0 for all. This ensures that only trusted sources can access your service. If you want to allow access from all IPs, you can configure it as 0.0.0.0/0. + g. Specify only particular protocols and ports you want to allow. For example, you may configure TCP ports like 9444, 8445, 9442, 443, and port ranges like 10100-10199 and 20100-20199. If you want to restrict access to everything else, you should mention specific configurations like below: + Allowed TCP ports: 9444, 8445, 9442, 443, 9441, 10100-10199, 20100-20199. + All other ports and protocols will be restricted. + h. Save the rule. + +## Step 6: Firewall Configuration Summary + + 1. Specify External IPs or Ranges + Allow only specific external IPs or ranges (e.g., 192.168.1.0/24 for a subnet) instead of using 0.0.0.0/0 for all. This ensures that only trusted sources can access your service. If you want to allow access from all IPs, you can configure it as 0.0.0.0/0. + + Example: + To allow access from a specific subnet: + Allow: 192.168.1.0/24 + + To allow access from all IPs: + Allow: 0.0.0.0/0 + + 2. Specify Allowed Protocols and Ports + You can specify only particular protocols and ports you want to allow. For example, configure the following: + Allowed TCP Ports: 9444 (SignalingPort) + 8445 (MediaPort) + 9442 (TcpForwardingPort) + 443 (DefaultEndpoint) + 9441 (localPort) + 10100-10199 (InstanceCallControlEndpoint) + 20100-20199 (InstanceMediaControlEndpoint) + + * All other ports and protocols will be restricted. + + Example of Ingress Allow Rules: + a. Allow TCP Port 9444: + Rule Name: Allow SignalingPort + Action: Allow + Protocol: TCP + Port: 9444 + + b. Allow TCP Port 8445: + Rule Name: Allow MediaPort + Action: Allow + Protocol: TCP + Port: 8445 + + c. Allow TCP Port 9442: + Rule Name: Allow TcpForwardingPort + Action: Allow + Protocol: TCP + Port: 9442 + + d. Allow TCP Port 443: + Rule Name: Allow DefaultEndpoint + Action: Allow + Protocol: TCP + Port: 443 + + e. Allow TCP Port 9441: + Rule Name: Allow LocalPort + Action: Allow + Protocol: TCP + Port: 9441 + + f. Allow TCP Port Range 10100-10199: + Rule Name: Allow InstanceCallControlEndpoint + Action: Allow + Protocol: TCP + Port Range: 10100-10199 + + g. Allow TCP Port Range 20100-20199: + Rule Name: Allow InstanceMediaControlEndpoint + Action: Allow + Protocol: TCP + Port Range: 20100-20199 + + 3. Restrict All Other Ingress Ports and Protocols: + After creating the allow rules, add a rule to deny all other traffic. This ensures that any port or protocol not explicitly allowed is blocked. + + Example of Deny Rule: + Deny All Other Ingress Traffic: + Rule Name: Deny All Other Ingress Traffic + Action: Deny + Protocol: Any + Port: Any + + Example of Egress Allow Rules + a. Allow TCP Port 9444: + Rule Name: Allow Egress SignalingPort + Action: Allow + Protocol: TCP + Port: 9444 + + b. Allow TCP Port 8445: + Rule Name: Allow Egress MediaPort + Action: Allow + Protocol: TCP + Port: 8445 + + c. Allow TCP Port 9442: + Rule Name: Allow Egress TcpForwardingPort + Action: Allow + Protocol: TCP + Port: 9442 + + d. Allow TCP Port 443: + Rule Name: Allow Egress DefaultEndpoint + Action: Allow + Protocol: TCP + Port: 443 + + e. Allow TCP Port 9441: + Rule Name: Allow Egress LocalPort + Action: Allow + Protocol: TCP + Port: 9441 + + f. Allow TCP Port Range 10100-10199: + Rule Name: Allow Egress InstanceCallControlEndpoint + Action: Allow + Protocol: TCP + Port Range: 10100-10199 + + g. Allow TCP Port Range 20100-20199: + Rule Name: Allow Egress InstanceMediaControlEndpoint + Action: Allow + Protocol: TCP + Port Range: 20100-20199 + + 4. Restrict All Other Egress Ports and Protocols + * Similarly, add a rule to deny all other egress traffic. + + Example of Deny Rule: + Deny All Other Egress Traffic: + Rule Name: Deny All Other Egress Traffic + Action: Deny + Protocol: Any + Port: Any \ No newline at end of file diff --git a/Samples/V1.0DeltaRosterSample/LocalMediaSamples/PolicyRecordingBot/README.md b/Samples/V1.0DeltaRosterSample/LocalMediaSamples/PolicyRecordingBot/README.md index a9832ce8c..b29dae529 100644 --- a/Samples/V1.0DeltaRosterSample/LocalMediaSamples/PolicyRecordingBot/README.md +++ b/Samples/V1.0DeltaRosterSample/LocalMediaSamples/PolicyRecordingBot/README.md @@ -1,3 +1,4 @@ + # Introduction ## Note @@ -7,7 +8,7 @@ This sample is only designed for compliance recording scenario. Do not use it fo ## About -The Policy Recording bot sample guides you through building, deploying and testing a bot. This sample demonstrates how a bot can receive media streams for recording. Please note that the sample does not actually record. This logic is left up to the developer. +The Policy Recording bot sample guides you through building, deploying, and testing a bot. This sample demonstrates how a bot can receive media streams for recording. Please note that the sample does not actually record. This logic is left up to the developer. ## Getting Started @@ -15,16 +16,15 @@ This section walks you through the process of deploying and testing the sample b ### Bot Registration -1. Follow the steps in [Register Calling Bot](https://microsoftgraph.github.io/microsoft-graph-comms-samples/docs/articles/calls/register-calling-bot.html). Save the bot name, bot app id and bot secret for configuration. - * For the calling webhook, by default the notification will go to https://{your domain}/api/calling. This is configured with the `CallSignalingRoutePrefix` in [HttpRouteConstants.cs](FrontEnd/Http/Controllers/HttpRouteConstants.cs). +1. Follow the steps in [Register Calling Bot](https://microsoftgraph.github.io/microsoft-graph-comms-samples/docs/articles/calls/register-calling-bot.html). Save the bot name, bot app id, and bot secret for configuration. + * For the calling webhook, by default the notification will go to `https://{your domain}/api/calling`. This is configured with the `CallSignalingRoutePrefix` in [HttpRouteConstants.cs](FrontEnd/Http/Controllers/HttpRouteConstants.cs). * Ignore the "Register bot in Microsoft Teams" section as the Policy Recording bot won't be called directly. These bots are related to the policies discussed below, and are "attached" to users, and will be automatically invited to the call. -1. Add the following Application Permissions to the bot: +2. Add the following Application Permissions to the bot: + * `Calls.AccessMedia.All` + * `Calls.JoinGroupCall.All` - * Calls.AccessMedia.All - * Calls.JoinGroupCall.All - -1. The permission needs to be consented by tenant admin. Go to "https://login.microsoftonline.com/common/adminconsent?client_id=&state=&redirect_uri=" using tenant admin to sign-in, then consent for the whole tenant. +3. The permission needs to be consented by the tenant admin. Go to "https://login.microsoftonline.com/common/adminconsent?client_id=&state=&redirect_uri=" using tenant admin to sign in, then consent for the whole tenant. ### Create an Application Instance @@ -44,9 +44,11 @@ After 30-60 seconds, the policy should show up. To verify your policy was create * `Get-CsTeamsComplianceRecordingPolicy ` ### Assign the Recording Policy + Requries the policy identity created above. Contine your powershell session and run the following commands. * `Grant-CsTeamsComplianceRecordingPolicy -Identity -PolicyName ` + To verify your policy was assigned correctly: * `Get-CsOnlineUser | ft sipaddress, tenantid, TeamsComplianceRecordingPolicy` @@ -58,126 +60,147 @@ To verify your policy was assigned correctly: ### Deploy -* Prerequisites for deploying Azure Cloud Services (extended support)(https://learn.microsoft.com/en-us/azure/cloud-services-extended-support/deploy-prerequisite) - -Step 1: Securely Store Certificates with Azure Key Vault - * Certificates are crucial for securing communication between your services. Azure Key Vault is used to store and manage these certificates securely. - - Create an Azure Key Vault: - * Follow these instructions to create your Azure Key Vault: https://learn.microsoft.com/en-us/azure/key-vault/general/quick-create-portal. - -Step 2: Obtain and Configure Your SSL Certificate - * To secure your service, you need a valid SSL certificate. Here’s how to obtain and configure it: - - Get a Wildcard Certificate: - * Obtain a wildcard SSL certificate for your domain. For example, if your service is hosted at bot.contoso.com,get a certificate for *.contoso.com. - * Ensure that the certificate is issued by a trusted Certificate Authority (CA) and not self-signed. - - Upload to Azure Key Vault: - * Upload your SSL certificate to the Azure Key Vault. Follow these steps: https://learn.microsoft.com/en-us/azure/key-vault/certificates/tutorial-import-certificate?tabs=azure-portal. - - Get the Thumbprint: - * Copy the certificate thumbprint from Azure Key Vault. You will need to add this thumbprint to your .cscfg (cloud service configuration) and .csdef (cloud service definition) files. - 1. Update the Certificate section in your .cscfg file with the thumbprint. - - - - - 2. Update the Certificate element in your .csdef file. - - - - * Replace YourCertificateName with the actual name of your certificate as it appears in your Azure Key Vault or wherever it is stored. Here are the key attributes: - name: This should match the certificate's name as referenced in your Azure Key Vault or local certificate store. - storeLocation: Specifies where the certificate is stored. LocalMachine is a common location for certificates installed on the local machine. - storeName: Specifies the store name where the certificate is located. My is a common store name used for personal certificates. - -Step 3: Define Your Virtual Network - * For Azure Extended Services, you can define the virtual network and subnet configurations in your .cscfg file. Azure can create the virtual network during the service setup if it doesn't already exist. - * When deploying your cloud service (extended) in Azure, virtual network and subnet configurations are managed automatically based on your .cscfg file. Follow these guidelines to ensure proper configuration: - -#### Using Existing Virtual Network: - - * If you have an existing Virtual Network (VNet) that you want to use: - - - - - - - - - - - - * Replace "YourExistingVNetName" with the name of your existing Virtual Network and "YourExistingSubnetName" with the name of your existing subnet within that Virtual Network. - -### Automatic Creation of Virtual Network: - - * If the Virtual Network doesn't exist, Azure will create it based on the configuration provided: - - - - - - - - - - - * Replace "NewVNetName" with the name of the Virtual Network you want Azure to create, and "NewSubnetName" with the name of the subnet within that Virtual Network. - - ### Note on Domain Name and Public IP: +* Prerequisites for deploying Azure Cloud Services (extended support) [here](https://learn.microsoft.com/en-us/azure/cloud-services-extended-support/deploy-prerequisite). + +#### Step 1: Securely Store Certificates with Azure Key Vault + +Certificates are crucial for securing communication between your services. Azure Key Vault is used to store and manage these certificates securely. + +Create an Azure Key Vault: +* Follow these instructions to create your Azure Key Vault: [Create Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/general/quick-create-portal). - - - - * PublicIP name: "MyPublicIP" – Provide a unique name for the public IP. - * domainNameLabel: "myservice" – Set this to your service's domain label. +#### Step 2: Obtain and Configure Your SSL Certificate + +To secure your service, you need a valid SSL certificate. Here’s how to obtain and configure it: + +1. **Get a Wildcard Certificate**: + * Obtain a wildcard SSL certificate for your domain. For example, if your service is hosted at bot.contoso.com, get a certificate for \*.contoso.com. + * Ensure that the certificate is issued by a trusted Certificate Authority (CA) and not self-signed. + +2. **Upload to Azure Key Vault**: + * Upload your SSL certificate to the Azure Key Vault. Follow these steps: [Import Certificate](https://learn.microsoft.com/en-us/azure/key-vault/certificates/tutorial-import-certificate?tabs=azure-portal). + +3. **Get the Thumbprint**: + * Copy the certificate thumbprint from Azure Key Vault. You will need to add this thumbprint to your `.cscfg` (cloud service configuration) and `.csdef` (cloud service definition) files. - Azure Extended Services: - * Public IP: You must provide a Public IP name in your configuration when creating the service. - * Domain Name: The domain name (domainNameLabel) is optional during initial creation and can be specified or updated later. + 1. Update the Certificate section in your `.cscfg` file with the thumbprint. + ```xml + + + + + ``` + + 2. Update the Certificate element in your `.csdef` file. + ```xml + + + + ``` + * Replace YourCertificateName with the actual name of your certificate as it appears in your Azure Key Vault or wherever it is stored. Here are the key attributes: - Match Public IP Name: - * Ensure that the name attribute under (MyPublicIP in this example) matches the name used in your application code to fetch the public IP address dynamically. - * To ensure that the domainNameLabel matches between your configuration (.cscfg file) and the Azure portal settings. + **name**: This should match the certificate's name as referenced in your Azure Key Vault or local certificate store. + + **storeLocation**: Specifies where the certificate is stored. LocalMachine is a common location for certificates installed on the local machine. + + **storeName**: Specifies the store name where the certificate is located. My is a common store name used for personal certificates. + + +#### Step 3: Define Your Virtual Network + +* For Azure Extended Services, you can define the virtual network and subnet configurations in your `.cscfg` file. Azure can create the virtual network during the service setup if it doesn't already exist. +* When deploying your cloud service (extended) in Azure, virtual network and subnet configurations are managed automatically based on your .cscfg file. Follow these guidelines to ensure proper configuration. + +##### Using Existing Virtual Network: + +* If you have an existing Virtual Network (VNet) that you want to use: + +```xml + + + + + + + + + + +``` +* Replace "YourExistingVNetName" with the name of your existing Virtual Network and "YourExistingSubnetName" with the name of your existing subnet within that Virtual Network. + +##### Automatic Creation of Virtual Network: + +* If the Virtual Network doesn't exist, Azure will create it based on the configuration provided: + +```xml + + + + + + + + + + +``` +* Replace "NewVNetName" with the name of the Virtual Network you want Azure to create, and "NewSubnetName" with the name of the subnet within that Virtual Network. + +### Note on Domain Name and Public IP + +```xml + + + +``` +* PublicIP name: "MyPublicIP" – Provide a unique name for the public IP. +* domainNameLabel: "myservice" – Set this to your service's domain label. + +Azure Extended Services Configuration: +* **Public IP**: You must provide a Public IP name in your configuration when creating the service. +* **Domain Name**: The domain name (domainNameLabel) is optional during initial creation and can be specified or updated later. + +Match Public IP Name: +* Ensure that the `name` attribute under `` ("MyPublicIP" in this example) matches the name used in your application code to fetch the public IP address dynamically. +* To ensure that the `domainNameLabel` matches between your configuration (.cscfg file) and the Azure portal settings. - Step 4: Deploy +#### Step 4: Deploy - 1. Create Your Cloud Service (Extended Support) - 1. Use the Azure portal to create a Cloud Service (Extended Support). - Follow this guide: Create a Cloud Service (Extended Support).(https://learn.microsoft.com/en-us/azure/cloud-services-extended-support/deploy-portal) - 2. Obtain Your Public IP DNS name: +1. Create Your Cloud Service (Extended Support): + * Use the Azure portal to create a Cloud Service (Extended Support). Follow this guide: [Create Cloud Service](https://learn.microsoft.com/en-us/azure/cloud-services-extended-support/deploy-portal). + * Obtain Your Public IP DNS name: After the service is created, obtain the "Public IP DNS name" from the Azure portal. This URL will serve as your DNS name and Common Name (CN) for further configurations (e.g. bot.contoso.com). - ![Public IP DNS name](Images/PublicIPDNSName.png). - - 2. Update the app configs with values - 1. Set up cloud service configuration - 1. Open powershell, go to the folder that contains file `configure_cloud.ps1`. The file is in the `Samples` directory. - 2. Run the powershell script with parameters: - ` .\configure_cloud.ps1 -p {path to project} -dns {your DNS name} -cn {your CN name, should be the same as your DNS name} -bid {your bot name} -aid {your bot app id} -as {your bot secret}` - - For example: - - `.\configure_cloud.ps1 -p .\V1.0Samples\LocalMediaSamples\PolicyRecordingBot\ -dns bot.contoso.com -cn bot.contoso.com -bid bot -aid 3853f935-2c6f-43d7-859d-6e8f83b519ae -as 123456!@#$%^` - - 3. Deploy to Cloud Service (Extended Support) - 1. Configure Storage Account for Configuration Files. - * To store configuration files for your Azure extended service, you'll need to set up a storage account. Follow these steps to configure the storage account:(https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal). - 2. Package Your Cloud Service for Deployment - * Before you can create your Azure extended service, you need to package your cloud service application to include configuration files and dependencies. - * Right click PolicyRecordingBot, then click `Package...`. - - Option 1: Upload to Azure Storage Account: - * Upload your packaged application (cspkg file) along with the .cscfg and .csdef files to an Azure Storage Account container. - * This method allows you to deploy directly from the Azure Storage Account during service creation. - - Option 2: Use Local Files: - * Deploy directly from local files during the service creation process. - * Ensure all required files, including .cscfg and .csdef, are accessible and correctly referenced during deployment. + ![Public IP DNS name](Images/PublicIPDNSName.png). + +2. Update the App Configurations: + * Set up cloud service configuration with PowerShell: + 1. Open PowerShell, go to the folder that contains the file `configure_cloud.ps1`. The file is in the `Samples` directory. + 2. Run the PowerShell script with parameters: + ```powershell + .\configure_cloud.ps1 -p {path to project} -dns {your DNS name} -cn {your CN name, should be the same as your DNS name} -bid {your bot name} -aid {your bot app id} -as {your bot secret} + ``` + For example: + ```powershell + .\configure_cloud.ps1 -p .\V1.0Samples\LocalMediaSamples\PolicyRecordingBot\ -dns bot.contoso.com -cn bot.contoso.com -bid bot -aid 3853f935-2c6f-43d7-859d-6e8f83b519ae -as 123456!@#$%^ + ``` + +3. Deploy to Cloud Service (Extended Support): + 1. Configure Storage Account for Configuration Files. + * To store configuration files for your Azure extended service, you'll need to set up a storage account. Follow these steps to configure the storage account:(https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal). + 2. Package Your Cloud Service for Deployment + * Before you can create your Azure extended service, you need to package your cloud service application to include configuration files and dependencies. + * Right click PolicyRecordingBot, then click `Package...`. + +**Option 1**: Upload to Azure Storage Account: +* Upload your packaged application (cspkg file) along with the .cscfg and .csdef files to an Azure Storage Account container. +* This method allows you to deploy directly from the Azure Storage Account during service creation. + +**Option 2**: Use Local Files: +* Deploy directly from local files during the service creation process. +* Ensure all required files, including .cscfg and .csdef, are accessible and correctly referenced during deployment. ### Firewall setup @@ -197,8 +220,8 @@ Step 3: Define Your Virtual Network 3. Interact with your service, _adjusting the service URL appropriately_. 1. Get diagnostics data from the bot. Open the url https://bot.contoso.com:10101/calls in a browser for auto-refresh. Search for the most recent CallId and replace with it in the below url. - * Active calls: https://bot.contoso.com:10101/calls/{CallId} - * Service logs: https://bot.contoso.com:10101/logs + * Active calls: https://bot.contoso.com:10101/calls/{CallId} + * Service logs: https://bot.contoso.com:10101/logs 2. Terminating the call through `DELETE`, as needed for testing. Replace the {CallId} below with your call id from the first response. diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/AVPWindowsService/AVPWindowsService.csproj b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/AVPWindowsService/AVPWindowsService.csproj index f4b78e0ef..73163df9e 100644 --- a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/AVPWindowsService/AVPWindowsService.csproj +++ b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/AVPWindowsService/AVPWindowsService.csproj @@ -76,8 +76,8 @@ ..\..\..\..\packages\Azure.Core.1.21.0\lib\net461\Azure.Core.dll - - ..\..\..\..\packages\Microsoft.Bcl.AsyncInterfaces.6.0.0\lib\net461\Microsoft.Bcl.AsyncInterfaces.dll + + ..\..\..\..\packages\Microsoft.Bcl.AsyncInterfaces.8.0.0\lib\net462\Microsoft.Bcl.AsyncInterfaces.dll ..\..\..\..\packages\Microsoft.Extensions.Configuration.6.0.0\lib\net461\Microsoft.Extensions.Configuration.dll @@ -124,11 +124,14 @@ ..\..\..\..\packages\Microsoft.Identity.Client.4.39.0\lib\net461\Microsoft.Identity.Client.dll - - ..\..\..\..\packages\Microsoft.IdentityModel.JsonWebTokens.6.15.0\lib\net472\Microsoft.IdentityModel.JsonWebTokens.dll + + ..\..\..\..\packages\Microsoft.IdentityModel.Abstractions.8.0.1\lib\net472\Microsoft.IdentityModel.Abstractions.dll - - ..\..\..\..\packages\Microsoft.IdentityModel.Logging.6.15.0\lib\net472\Microsoft.IdentityModel.Logging.dll + + ..\..\..\..\packages\Microsoft.IdentityModel.JsonWebTokens.8.0.1\lib\net472\Microsoft.IdentityModel.JsonWebTokens.dll + + + ..\..\..\..\packages\Microsoft.IdentityModel.Logging.8.0.1\lib\net472\Microsoft.IdentityModel.Logging.dll ..\..\..\..\packages\Microsoft.IdentityModel.Protocols.6.15.0\lib\net472\Microsoft.IdentityModel.Protocols.dll @@ -136,8 +139,8 @@ ..\..\..\..\packages\Microsoft.IdentityModel.Protocols.OpenIdConnect.6.15.0\lib\net472\Microsoft.IdentityModel.Protocols.OpenIdConnect.dll - - ..\..\..\..\packages\Microsoft.IdentityModel.Tokens.6.15.0\lib\net472\Microsoft.IdentityModel.Tokens.dll + + ..\..\..\..\packages\Microsoft.IdentityModel.Tokens.8.0.1\lib\net472\Microsoft.IdentityModel.Tokens.dll ..\..\..\..\packages\Microsoft.Owin.Host.HttpListener.4.0.1\lib\net45\Microsoft.Owin.Host.HttpListener.dll @@ -145,8 +148,8 @@ ..\..\..\..\packages\Microsoft.Skype.Bots.Media.1.20.0.348-alpha\lib\net472\Microsoft.Skype.Bots.Media.dll - - ..\..\..\..\packages\Newtonsoft.Json.12.0.2\lib\net45\Newtonsoft.Json.dll + + ..\..\..\..\packages\Newtonsoft.Json.13.0.3\lib\net45\Newtonsoft.Json.dll @@ -160,13 +163,13 @@ - - ..\..\..\..\packages\System.IdentityModel.Tokens.Jwt.6.15.0\lib\net472\System.IdentityModel.Tokens.Jwt.dll + + ..\..\..\..\packages\System.IdentityModel.Tokens.Jwt.8.0.1\lib\net472\System.IdentityModel.Tokens.Jwt.dll - - ..\..\..\..\packages\System.Memory.4.5.4\lib\net461\System.Memory.dll + + ..\..\..\..\packages\System.Memory.4.5.5\lib\net461\System.Memory.dll ..\..\..\..\packages\System.Memory.Data.1.0.2\lib\net461\System.Memory.Data.dll @@ -180,11 +183,11 @@ - - ..\..\..\..\packages\System.Text.Encodings.Web.6.0.0\lib\net461\System.Text.Encodings.Web.dll + + ..\..\..\..\packages\System.Text.Encodings.Web.8.0.0\lib\net462\System.Text.Encodings.Web.dll - - ..\..\..\..\packages\System.Text.Json.6.0.1\lib\net461\System.Text.Json.dll + + ..\..\..\..\packages\System.Text.Json.8.0.4\lib\net462\System.Text.Json.dll ..\..\..\..\packages\System.Threading.Tasks.Dataflow.4.9.0\lib\netstandard2.0\System.Threading.Tasks.Dataflow.dll @@ -404,7 +407,5 @@ This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. - - \ No newline at end of file diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/AVPWindowsService/App.config b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/AVPWindowsService/App.config index 6a674899a..92f98dc3e 100644 --- a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/AVPWindowsService/App.config +++ b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/AVPWindowsService/App.config @@ -11,15 +11,15 @@ - + - + - + @@ -31,7 +31,7 @@ - + @@ -49,13 +49,33 @@ + + + + + + + + + + + + + + + + + + + + - + diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/AVPWindowsService/WindowsServiceConfiguration.cs b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/AVPWindowsService/WindowsServiceConfiguration.cs index 87d5412c8..63dabdff8 100644 --- a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/AVPWindowsService/WindowsServiceConfiguration.cs +++ b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/AVPWindowsService/WindowsServiceConfiguration.cs @@ -99,6 +99,15 @@ public class WindowsServiceConfiguration : IConfiguration /// public int AudioVideoFileLengthInSec { get; private set; } + /// + public int SignalingPort { get; private set; } + + /// + public int MediaPort { get; private set; } + + /// + public int TcpForwardingPort { get; private set; } + /// /// Gets the h264 1920 x 1080 vbss file location. /// diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/AVPWindowsService/packages.config b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/AVPWindowsService/packages.config index 42d54e306..d07f6fa7a 100644 --- a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/AVPWindowsService/packages.config +++ b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/AVPWindowsService/packages.config @@ -1,7 +1,7 @@  - + @@ -17,14 +17,15 @@ - - + + + - + - + @@ -32,17 +33,17 @@ - + - + - - + + diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/FirewallREADME.md b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/FirewallREADME.md new file mode 100644 index 000000000..313c874bf --- /dev/null +++ b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/FirewallREADME.md @@ -0,0 +1,176 @@ +# Steps to Configure Azure Firewall +===================================== + +## Step 1: Create a Virtual Network and Subnet for Azure Firewall + + 1. Go to Virtual Network or create a new one if it doesn't exist. + 2. Create a subnet for the firewall with the purpose set to "Azure Firewall". ![Create subnet](Images/CreateSubnet.png) + 3. Go to the firewall section and click on "Add firewall". ![Create firewall](Images/CreateFirewall.png) + +## Step 2: Configure Firewall Settings + + 1. Choose a name for the firewall (e.g., "MyFirewall"). + 2. Create a new firewall policy. ![Create policy](Images/CreatePolicy.png) + 3. Select the existing Virtual Network. + 4. Create a new public IP address (e.g., "MyFWPublicIP"). + 5. Review and create the firewall. + +## Step 3: Configure Firewall Policy + + 1. Open the firewall policy created in Step 2. + 2. Navigate to Settings. + +## Step 4: Configure Application Rules (Ingress) + + Add an application rule: + a. Give a descriptive name. + b. Select "Application rule collection" as the rule type. + c. Assign the lowest number as the priority. + d. Specify a name for the rule. + e. Define the source (e.g., your VM subnet) or use `*` to allow all IP addresses. + f. Allow specific domains (e.g., `audiovideoplaybackbot.eastus.cloudapp.azure.com`). + g. Save the rule. + +## Step 5: Configure Network Rules (Egress) + + Add a network rule: + a. Give a descriptive name. + b. Select "Network rule collection" as the rule type. + c. Assign the lowest number as the priority. + d. Specify a name for the rule. + e. Define the source (e.g., your VM subnet) or use `*` to allow all IP addresses. + f. Specific external IPs or ranges (e.g., 192.168.1.0/24 for a subnet) instead of using 0.0.0.0/0 for all. This ensures that only trusted sources can access your service. If you want to allow access from all IPs, you can configure it as 0.0.0.0/0. + g. Specify only particular protocols and ports you want to allow. For example, you may configure TCP ports like 9444, 8445, 9442, 443, and port ranges like 10100-10199 and 20100-20199. If you want to restrict access to everything else, you should mention specific configurations like below: + Allowed TCP ports: 9444, 8445, 9442, 443, 9441, 10100-10199, 20100-20199. + All other ports and protocols will be restricted. + h. Save the rule. + +## Step 6: Firewall Configuration Summary + + 1. Specify External IPs or Ranges + Allow only specific external IPs or ranges (e.g., 192.168.1.0/24 for a subnet) instead of using 0.0.0.0/0 for all. This ensures that only trusted sources can access your service. If you want to allow access from all IPs, you can configure it as 0.0.0.0/0. + + Example: + To allow access from a specific subnet: + Allow: 192.168.1.0/24 + + To allow access from all IPs: + Allow: 0.0.0.0/0 + + 2. Specify Allowed Protocols and Ports + You can specify only particular protocols and ports you want to allow. For example, configure the following: + Allowed TCP Ports: 9444 (SignalingPort) + 8445 (MediaPort) + 9442 (TcpForwardingPort) + 443 (DefaultEndpoint) + 9441 (localPort) + 10100-10199 (InstanceCallControlEndpoint) + 20100-20199 (InstanceMediaControlEndpoint) + + * All other ports and protocols will be restricted. + + Example of Ingress Allow Rules: + a. Allow TCP Port 9444: + Rule Name: Allow SignalingPort + Action: Allow + Protocol: TCP + Port: 9444 + + b. Allow TCP Port 8445: + Rule Name: Allow MediaPort + Action: Allow + Protocol: TCP + Port: 8445 + + c. Allow TCP Port 9442: + Rule Name: Allow TcpForwardingPort + Action: Allow + Protocol: TCP + Port: 9442 + + d. Allow TCP Port 443: + Rule Name: Allow DefaultEndpoint + Action: Allow + Protocol: TCP + Port: 443 + + e. Allow TCP Port 9441: + Rule Name: Allow LocalPort + Action: Allow + Protocol: TCP + Port: 9441 + + f. Allow TCP Port Range 10100-10199: + Rule Name: Allow InstanceCallControlEndpoint + Action: Allow + Protocol: TCP + Port Range: 10100-10199 + + g. Allow TCP Port Range 20100-20199: + Rule Name: Allow InstanceMediaControlEndpoint + Action: Allow + Protocol: TCP + Port Range: 20100-20199 + + 3. Restrict All Other Ingress Ports and Protocols: + After creating the allow rules, add a rule to deny all other traffic. This ensures that any port or protocol not explicitly allowed is blocked. + + Example of Deny Rule: + Deny All Other Ingress Traffic: + Rule Name: Deny All Other Ingress Traffic + Action: Deny + Protocol: Any + Port: Any + + Example of Egress Allow Rules + a. Allow TCP Port 9444: + Rule Name: Allow Egress SignalingPort + Action: Allow + Protocol: TCP + Port: 9444 + + b. Allow TCP Port 8445: + Rule Name: Allow Egress MediaPort + Action: Allow + Protocol: TCP + Port: 8445 + + c. Allow TCP Port 9442: + Rule Name: Allow Egress TcpForwardingPort + Action: Allow + Protocol: TCP + Port: 9442 + + d. Allow TCP Port 443: + Rule Name: Allow Egress DefaultEndpoint + Action: Allow + Protocol: TCP + Port: 443 + + e. Allow TCP Port 9441: + Rule Name: Allow Egress LocalPort + Action: Allow + Protocol: TCP + Port: 9441 + + f. Allow TCP Port Range 10100-10199: + Rule Name: Allow Egress InstanceCallControlEndpoint + Action: Allow + Protocol: TCP + Port Range: 10100-10199 + + g. Allow TCP Port Range 20100-20199: + Rule Name: Allow Egress InstanceMediaControlEndpoint + Action: Allow + Protocol: TCP + Port Range: 20100-20199 + + 4. Restrict All Other Egress Ports and Protocols + * Similarly, add a rule to deny all other egress traffic. + + Example of Deny Rule: + Deny All Other Egress Traffic: + Rule Name: Deny All Other Egress Traffic + Action: Deny + Protocol: Any + Port: Any \ No newline at end of file diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/FrontEnd/AVPFrontEnd.csproj b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/FrontEnd/AVPFrontEnd.csproj index eb0f46404..33e4d3dfb 100644 --- a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/FrontEnd/AVPFrontEnd.csproj +++ b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/FrontEnd/AVPFrontEnd.csproj @@ -59,7 +59,7 @@ False - ..\..\..\..\packages\Microsoft.Skype.Bots.Media\1.19.0.25-alpha\src\skype_media_lib\Microsoft.Skype.Internal.Media.H264.dll + ..\..\..\..\packages\Microsoft.Skype.Bots.Media\1.20.0.348-alpha\src\skype_media_lib\Microsoft.Skype.Internal.Media.H264.dll diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/FrontEnd/IConfiguration.cs b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/FrontEnd/IConfiguration.cs index 6ccf5df87..c1e22a7e7 100644 --- a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/FrontEnd/IConfiguration.cs +++ b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/FrontEnd/IConfiguration.cs @@ -40,7 +40,7 @@ public interface IConfiguration : IDisposable /// Gets the List of HTTP URLs the app should listen on for incoming call /// signaling requests from Skype Platform. /// - IEnumerable CallControlListeningUrls { get; } + IEnumerable CallControlListeningUrls { get; } /// /// Gets the base callback URL for this instance. To ensure that all requests diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/Images/CreateFirewall.png b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/Images/CreateFirewall.png new file mode 100644 index 000000000..b59c26234 Binary files /dev/null and b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/Images/CreateFirewall.png differ diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/Images/CreatePolicy.png b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/Images/CreatePolicy.png new file mode 100644 index 000000000..7c5e5e787 Binary files /dev/null and b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/Images/CreatePolicy.png differ diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/Images/CreateSubnet.png b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/Images/CreateSubnet.png new file mode 100644 index 000000000..0c13d277e Binary files /dev/null and b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/Images/CreateSubnet.png differ diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/Images/PublicIPDNSName.png b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/Images/PublicIPDNSName.png new file mode 100644 index 000000000..4aa454c31 Binary files /dev/null and b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/Images/PublicIPDNSName.png differ diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/README.md b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/README.md index 82eefff44..16164c11c 100644 --- a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/README.md +++ b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/README.md @@ -11,49 +11,171 @@ This section walks you through the process of deploying and testing the sample b ### Bot Registration 1. Follow the steps in [Register Calling Bot](https://microsoftgraph.github.io/microsoft-graph-comms-samples/docs/articles/calls/register-calling-bot.html). Save the bot name, bot app id and bot secret for configuration. - + 2. Add the following Application Permissions to the bot: + * `Calls.AccessMedia.All` + * `Calls.Initiate.All` + * `Calls.JoinGroupCall.All` + * `Calls.JoinGroupCallAsGuest.All` - * Calls.AccessMedia.All - * Calls.Initiate.All - * Calls.JoinGroupCall.All - * Calls.JoinGroupCallAsGuest.All - -3. The permission needs to be consented by tenant admin. Go to `https://login.microsoftonline.com/common/adminconsent?client_id=&state=&redirect_uri=` using tenant admin to sign-in, then consent for the whole tenant. +3. The permission needs to be consented by tenant admin. Go to https://login.microsoftonline.com/common/adminconsent?client_id=&state=&redirect_uri= using tenant admin to sign-in, then consent for the whole tenant.. ### Prerequisites * Install the prerequisites: - * [Visual Studio 2017+](https://visualstudio.microsoft.com/downloads/) - * [PowerShell] 7.0+ - * [Mirosoft Azure Subscription] (Can register for a free account) - * [PostMan](https://chrome.google.com/webstore/detail/postman/fhbjgbiflinjbdggehcddcbncdddomop) + * [Visual Studio 2017+](https://visualstudio.microsoft.com/downloads/) + * [PowerShell] 7.0+ + * [Mirosoft Azure Subscription] (Can register for a free account) + * [PostMan](https://chrome.google.com/webstore/detail/postman/fhbjgbiflinjbdggehcddcbncdddomop) -## Deploy +### Deploy -#### [Azure] deployment +* Prerequisites for deploying Azure Cloud Services (extended support) [here](https://learn.microsoft.com/en-us/azure/cloud-services-extended-support/deploy-prerequisite). -##### Cloud Service (classic) [Planned Deprecation] +#### Step 1: Securely Store Certificates with Azure Key Vault -1. Create a cloud service (classic) in Azure. Get your "Site URL" from Azure portal, this will be your DNS name and CN name for later configuration, for example: `bot.contoso.com`. +Certificates are crucial for securing communication between your services. Azure Key Vault is used to store and manage these certificates securely. -2. Set up SSL certificate and upload to the cloud service - 1. Create a wildcard certificate for your service. This certificate should not be a self-signed certificate. For instance, if your bot is hosted at `bot.contoso.com`, create the certificate for `*.contoso.com`. - 2. Upload the certificate to the cloud service. - 3. Copy the thumbprint for later. +Create an Azure Key Vault: +* Follow these instructions to create your Azure Key Vault: [Create Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/general/quick-create-portal). + +#### Step 2: Obtain and Configure Your SSL Certificate + +To secure your service, you need a valid SSL certificate. Here’s how to obtain and configure it: + +1. **Get a Wildcard Certificate**: + * Obtain a wildcard SSL certificate for your domain. For example, if your service is hosted at bot.contoso.com, get a certificate for \*.contoso.com. + * Ensure that the certificate is issued by a trusted Certificate Authority (CA) and not self-signed. + +2. **Upload to Azure Key Vault**: + * Upload your SSL certificate to the Azure Key Vault. Follow these steps: [Import Certificate](https://learn.microsoft.com/en-us/azure/key-vault/certificates/tutorial-import-certificate?tabs=azure-portal). + +3. **Get the Thumbprint**: + * Copy the certificate thumbprint from Azure Key Vault. You will need to add this thumbprint to your `.cscfg` (cloud service configuration) and `.csdef` (cloud service definition) files. + + 1. Update the Certificate section in your `.cscfg` file with the thumbprint. + ```xml + + + + + ``` -3. Set up cloud service configuration - 1. Open powershell, go to the folder that contains file `configure_cloud.ps1`. The file is in the `Samples` directory. - 2. Run the powershell script with parameters: + 2. Update the Certificate element in your `.csdef` file. + ```xml + + + + ``` + * Replace YourCertificateName with the actual name of your certificate as it appears in your Azure Key Vault or wherever it is stored. Here are the key attributes: + + **name**: This should match the certificate's name as referenced in your Azure Key Vault or local certificate store. - `.\configure_cloud.ps1 -p {path to project} -dns {your DNS name} -cn {your CN name, should be the same as your DNS name} -thumb {your certificate thumbprint} -bid {your bot name} -aid {your bot app id} -as {your bot secret}` + **storeLocation**: Specifies where the certificate is stored. LocalMachine is a common location for certificates installed on the local machine. - For example: + **storeName**: Specifies the store name where the certificate is located. My is a common store name used for personal certificates. - `.\configure_cloud.ps1 -p .\V1.0Samples\LocalMediaSamples\AudioVideoPlaybackBot\ -dns bot.contoso.com -cn bot.contoso.com -thumb ABC0000000000000000000000000000000000CBA -bid bot -aid 3853f935-2c6f-43d7-859d-6e8f83b519ae -as 123456!@#$%^` -4. Publish AudioVideoPlaybackBot from VS: - 1. Right click AudioVideoPlaybackBot, then click Publish.... Publish it to the cloud service you created earlier. +#### Step 3: Define Your Virtual Network + +* For Azure Extended Services, you can define the virtual network and subnet configurations in your `.cscfg` file. Azure can create the virtual network during the service setup if it doesn't already exist. +* When deploying your cloud service (extended) in Azure, virtual network and subnet configurations are managed automatically based on your .cscfg file. Follow these guidelines to ensure proper configuration. + +##### Using Existing Virtual Network: + +* If you have an existing Virtual Network (VNet) that you want to use: + +```xml + + + + + + + + + + +``` +* Replace "YourExistingVNetName" with the name of your existing Virtual Network and "YourExistingSubnetName" with the name of your existing subnet within that Virtual Network. + +##### Automatic Creation of Virtual Network: + +* If the Virtual Network doesn't exist, Azure will create it based on the configuration provided: + +```xml + + + + + + + + + + +``` +* Replace "NewVNetName" with the name of the Virtual Network you want Azure to create, and "NewSubnetName" with the name of the subnet within that Virtual Network. + +### Note on Domain Name and Public IP + +```xml + + + +``` +* PublicIP name: "MyPublicIP" – Provide a unique name for the public IP. +* domainNameLabel: "myservice" – Set this to your service's domain label. + +Azure Extended Services Configuration: +* **Public IP**: You must provide a Public IP name in your configuration when creating the service. +* **Domain Name**: The domain name (domainNameLabel) is optional during initial creation and can be specified or updated later. + +Match Public IP Name: +* Ensure that the `name` attribute under `` ("MyPublicIP" in this example) matches the name used in your application code to fetch the public IP address dynamically. +* To ensure that the `domainNameLabel` matches between your configuration (.cscfg file) and the Azure portal settings. + +#### Step 4: Deploy + +1. Create Your Cloud Service (Extended Support): + * Use the Azure portal to create a Cloud Service (Extended Support). Follow this guide: [Create Cloud Service](https://learn.microsoft.com/en-us/azure/cloud-services-extended-support/deploy-portal). + * Obtain Your Public IP DNS name: + After the service is created, obtain the "Public IP DNS name" from the Azure portal. This URL will serve as your DNS name and Common Name (CN) for further configurations (e.g. bot.contoso.com). + ![Public IP DNS name](Images/PublicIPDNSName.png). + +2. Update the App Configurations: + * Set up cloud service configuration with PowerShell: + 1. Open PowerShell, go to the folder that contains the file `configure_cloud.ps1`. The file is in the `Samples` directory. + 2. Run the PowerShell script with parameters: + ```powershell + .\configure_cloud.ps1 -p {path to project} -dns {your DNS name} -cn {your CN name, should be the same as your DNS name} -bid {your bot name} -aid {your bot app id} -as {your bot secret} + ``` + For example: + ```powershell + .\configure_cloud.ps1 -p .\V1.0Samples\LocalMediaSamples\AudioVideoPlaybackBot\ -dns bot.contoso.com -cn bot.contoso.com -bid bot -aid 3853f935-2c6f-43d7-859d-6e8f83b519ae -as 123456!@#$%^ + ``` + +3. Deploy to Cloud Service (Extended Support): + 1. Configure Storage Account for Configuration Files. + * To store configuration files for your Azure extended service, you'll need to set up a storage account. Follow these steps to configure the storage account:(https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal). + 2. Package Your Cloud Service for Deployment + * Before you can create your Azure extended service, you need to package your cloud service application to include configuration files and dependencies. + * Right click AudioVideoPlaybackBot, then click `Package...`. + +**Option 1**: Upload to Azure Storage Account: +* Upload your packaged application (cspkg file) along with the .cscfg and .csdef files to an Azure Storage Account container. +* This method allows you to deploy directly from the Azure Storage Account during service creation. + +**Option 2**: Use Local Files: +* Deploy directly from local files during the service creation process. +* Ensure all required files, including .cscfg and .csdef, are accessible and correctly referenced during deployment. + +### Firewall setup + + * Please follow below steps to configure firewall. + - [document](FirewallREADME.md) ### Local Deployment diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/ServiceConfiguration.Cloud.cscfg b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/ServiceConfiguration.Cloud.cscfg index 71078ad34..cbffff66a 100644 --- a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/ServiceConfiguration.Cloud.cscfg +++ b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/ServiceConfiguration.Cloud.cscfg @@ -3,11 +3,18 @@ - + + @@ -16,8 +23,12 @@ + + + + diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/ServiceConfiguration.Local.cscfg b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/ServiceConfiguration.Local.cscfg index 518ce5af2..a283680ac 100644 --- a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/ServiceConfiguration.Local.cscfg +++ b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/ServiceConfiguration.Local.cscfg @@ -3,11 +3,18 @@ - + + @@ -16,8 +23,12 @@ + + + + diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/ServiceDefinition.csdef b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/ServiceDefinition.csdef index 77c00c6bc..631a34d51 100644 --- a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/ServiceDefinition.csdef +++ b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/ServiceDefinition.csdef @@ -21,7 +21,6 @@ - diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/WorkerRole/AVPWorkerRole.csproj b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/WorkerRole/AVPWorkerRole.csproj index 4ef6b6901..5a057e023 100644 --- a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/WorkerRole/AVPWorkerRole.csproj +++ b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/WorkerRole/AVPWorkerRole.csproj @@ -37,18 +37,15 @@ - 4.1.0 + 4.2.2.0 - 1.19.0.25-alpha + 1.20.0.348-alpha - - - 4.3.4 - + diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/WorkerRole/AzureConfiguration.cs b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/WorkerRole/AzureConfiguration.cs index b2a5694b5..3794b51ab 100644 --- a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/WorkerRole/AzureConfiguration.cs +++ b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/WorkerRole/AzureConfiguration.cs @@ -100,6 +100,13 @@ public class AzureConfiguration : IConfiguration /// private const string H264640X36030FpsKey = "H264_640x360_30Fps"; + /// + /// localPort specified in + /// in .csdef. This is needed for running in emulator. Currently only messaging can be debugged in the emulator. + /// Media debugging in emulator will be supported in future releases. + /// + private const int DefaultPort = 9441; + /// /// videoFile location for the specified resolution. /// @@ -177,7 +184,7 @@ public AzureConfiguration(IGraphLogger logger, bool isWindowsService = false) public string ServiceCname { get; private set; } /// - public IEnumerable CallControlListeningUrls { get; private set; } + public IEnumerable CallControlListeningUrls { get; private set; } /// public Uri CallControlBaseUrl { get; private set; } @@ -400,14 +407,14 @@ public void Initialize() this.AudioVideoFileLengthInSec = avFileLengthInSec; - var controlListenUris = new List(); + var controlListenUris = new List(); if (RoleEnvironment.IsEmulated) { // Create structured config objects for service. this.CallControlBaseUrl = new Uri($"https://{this.ServiceCname}/{HttpRouteConstants.CallSignalingRoutePrefix}"); - controlListenUris.Add("https://+:" + this.SignalingPort + "/"); - controlListenUris.Add("http://+:" + (this.SignalingPort + 1) + "/"); + controlListenUris.Add(new Uri("https://+:" + this.SignalingPort + "/")); + controlListenUris.Add(new Uri("http://+:" + (this.SignalingPort + 1) + "/")); } else { @@ -418,8 +425,8 @@ public void Initialize() instanceCallControlPublicPort, HttpRouteConstants.CallSignalingRoutePrefix)); - controlListenUris.Add("https://" + instanceCallControlIpEndpoint + "/"); - controlListenUris.Add("https://" + defaultEndpoint.IPEndpoint + "/"); + controlListenUris.Add(new Uri("https://" + instanceCallControlIpEndpoint + "/")); + controlListenUris.Add(new Uri("https://" + defaultEndpoint.IPEndpoint + "/")); } this.TraceConfigValue("CallControlCallbackUri", this.CallControlBaseUrl); diff --git a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/WorkerRole/app.config b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/WorkerRole/app.config index c10ad6734..ed4f02192 100644 --- a/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/WorkerRole/app.config +++ b/Samples/V1.0Samples/LocalMediaSamples/AudioVideoPlaybackBot/WorkerRole/app.config @@ -46,10 +46,6 @@ - - - - @@ -60,16 +56,28 @@ - + - + - + + + + + + + + + + + + + diff --git a/Samples/V1.0Samples/LocalMediaSamples/PolicyRecordingBot/FirewallREADME.md b/Samples/V1.0Samples/LocalMediaSamples/PolicyRecordingBot/FirewallREADME.md index 4bf9a1311..a5e5ddd78 100644 --- a/Samples/V1.0Samples/LocalMediaSamples/PolicyRecordingBot/FirewallREADME.md +++ b/Samples/V1.0Samples/LocalMediaSamples/PolicyRecordingBot/FirewallREADME.md @@ -3,42 +3,174 @@ ## Step 1: Create a Virtual Network and Subnet for Azure Firewall -1. Go to Virtual Network or create a new one if it doesn't exist. -2. Create a subnet for the firewall with the purpose set to "Azure Firewall". ![Create subnet](Images/CreateSubnet.png) -3. Go to the firewall section and click on "Add firewall". ![Create firewall](Images/CreateFirewall.png) + 1. Go to Virtual Network or create a new one if it doesn't exist. + 2. Create a subnet for the firewall with the purpose set to "Azure Firewall". ![Create subnet](Images/CreateSubnet.png) + 3. Go to the firewall section and click on "Add firewall". ![Create firewall](Images/CreateFirewall.png) ## Step 2: Configure Firewall Settings -1. Choose a name for the firewall (e.g., "MyFirewall"). -2. Create a new firewall policy. ![Create policy](Images/CreatePolicy.png) -3. Select the existing Virtual Network. -4. Create a new public IP address (e.g., "MyFWPublicIP"). -5. Review and create the firewall. + 1. Choose a name for the firewall (e.g., "MyFirewall"). + 2. Create a new firewall policy. ![Create policy](Images/CreatePolicy.png) + 3. Select the existing Virtual Network. + 4. Create a new public IP address (e.g., "MyFWPublicIP"). + 5. Review and create the firewall. ## Step 3: Configure Firewall Policy -1. Open the firewall policy created in Step 2. -2. Navigate to Settings. - -### Configure Application Rules (Ingress) - -1. Add an application rule: - * Give a descriptive name. - * Select "Application rule collection" as the rule type. - * Assign the lowest number as the priority. - * Specify a name for the rule. - * Define the source (e.g., your VM subnet) or use `*` to allow all IP addresses. - * Allow specific domains (e.g., `policyrecordingbot.eastus.cloudapp.azure.com`). - * Save the rule. - -### Configure Network Rules (Egress) - -1. Add a network rule: - * Give a descriptive name. - * Select "Network rule collection" as the rule type. - * Assign the lowest number as the priority. - * Specify a name for the rule. - * Define the source (e.g., your VM subnet) or use `*` to allow all IP addresses. - * Specify external IPs or ranges (e.g., `0.0.0.0/0` for all). - * Specify allowed protocols and ports.(TCP: 5060, 5061 ,UDP: 10000-20000) - * Save the rule. \ No newline at end of file + 1. Open the firewall policy created in Step 2. + 2. Navigate to Settings. + +## Step 4: Configure Application Rules (Ingress) + + Add an application rule: + a. Give a descriptive name. + b. Select "Application rule collection" as the rule type. + c. Assign the lowest number as the priority. + d. Specify a name for the rule. + e. Define the source (e.g., your VM subnet) or use `*` to allow all IP addresses. + f. Allow specific domains (e.g., `policyrecordingbot.eastus.cloudapp.azure.com`). + g. Save the rule. + +## Step 5: Configure Network Rules (Egress) + + Add a network rule: + a. Give a descriptive name. + b. Select "Network rule collection" as the rule type. + c. Assign the lowest number as the priority. + d. Specify a name for the rule. + e. Define the source (e.g., your VM subnet) or use `*` to allow all IP addresses. + f. Specific external IPs or ranges (e.g., 192.168.1.0/24 for a subnet) instead of using 0.0.0.0/0 for all. This ensures that only trusted sources can access your service. If you want to allow access from all IPs, you can configure it as 0.0.0.0/0. + g. Specify only particular protocols and ports you want to allow. For example, you may configure TCP ports like 9444, 8445, 9442, 443, and port ranges like 10100-10199 and 20100-20199. If you want to restrict access to everything else, you should mention specific configurations like below: + Allowed TCP ports: 9444, 8445, 9442, 443, 9441, 10100-10199, 20100-20199. + All other ports and protocols will be restricted. + h. Save the rule. + +## Step 6: Firewall Configuration Summary + + 1. Specify External IPs or Ranges + Allow only specific external IPs or ranges (e.g., 192.168.1.0/24 for a subnet) instead of using 0.0.0.0/0 for all. This ensures that only trusted sources can access your service. If you want to allow access from all IPs, you can configure it as 0.0.0.0/0. + + Example: + To allow access from a specific subnet: + Allow: 192.168.1.0/24 + + To allow access from all IPs: + Allow: 0.0.0.0/0 + + 2. Specify Allowed Protocols and Ports + You can specify only particular protocols and ports you want to allow. For example, configure the following: + Allowed TCP Ports: 9444 (SignalingPort) + 8445 (MediaPort) + 9442 (TcpForwardingPort) + 443 (DefaultEndpoint) + 9441 (localPort) + 10100-10199 (InstanceCallControlEndpoint) + 20100-20199 (InstanceMediaControlEndpoint) + + * All other ports and protocols will be restricted. + + Example of Ingress Allow Rules: + a. Allow TCP Port 9444: + Rule Name: Allow SignalingPort + Action: Allow + Protocol: TCP + Port: 9444 + + b. Allow TCP Port 8445: + Rule Name: Allow MediaPort + Action: Allow + Protocol: TCP + Port: 8445 + + c. Allow TCP Port 9442: + Rule Name: Allow TcpForwardingPort + Action: Allow + Protocol: TCP + Port: 9442 + + d. Allow TCP Port 443: + Rule Name: Allow DefaultEndpoint + Action: Allow + Protocol: TCP + Port: 443 + + e. Allow TCP Port 9441: + Rule Name: Allow LocalPort + Action: Allow + Protocol: TCP + Port: 9441 + + f. Allow TCP Port Range 10100-10199: + Rule Name: Allow InstanceCallControlEndpoint + Action: Allow + Protocol: TCP + Port Range: 10100-10199 + + g. Allow TCP Port Range 20100-20199: + Rule Name: Allow InstanceMediaControlEndpoint + Action: Allow + Protocol: TCP + Port Range: 20100-20199 + + 3. Restrict All Other Ingress Ports and Protocols: + After creating the allow rules, add a rule to deny all other traffic. This ensures that any port or protocol not explicitly allowed is blocked. + + Example of Deny Rule: + Deny All Other Ingress Traffic: + Rule Name: Deny All Other Ingress Traffic + Action: Deny + Protocol: Any + Port: Any + + Example of Egress Allow Rules + a. Allow TCP Port 9444: + Rule Name: Allow Egress SignalingPort + Action: Allow + Protocol: TCP + Port: 9444 + + b. Allow TCP Port 8445: + Rule Name: Allow Egress MediaPort + Action: Allow + Protocol: TCP + Port: 8445 + + c. Allow TCP Port 9442: + Rule Name: Allow Egress TcpForwardingPort + Action: Allow + Protocol: TCP + Port: 9442 + + d. Allow TCP Port 443: + Rule Name: Allow Egress DefaultEndpoint + Action: Allow + Protocol: TCP + Port: 443 + + e. Allow TCP Port 9441: + Rule Name: Allow Egress LocalPort + Action: Allow + Protocol: TCP + Port: 9441 + + f. Allow TCP Port Range 10100-10199: + Rule Name: Allow Egress InstanceCallControlEndpoint + Action: Allow + Protocol: TCP + Port Range: 10100-10199 + + g. Allow TCP Port Range 20100-20199: + Rule Name: Allow Egress InstanceMediaControlEndpoint + Action: Allow + Protocol: TCP + Port Range: 20100-20199 + + 4. Restrict All Other Egress Ports and Protocols + * Similarly, add a rule to deny all other egress traffic. + + Example of Deny Rule: + Deny All Other Egress Traffic: + Rule Name: Deny All Other Egress Traffic + Action: Deny + Protocol: Any + Port: Any \ No newline at end of file diff --git a/Samples/V1.0Samples/LocalMediaSamples/PolicyRecordingBot/README.md b/Samples/V1.0Samples/LocalMediaSamples/PolicyRecordingBot/README.md index 3a72413f1..0afe9dcbe 100644 --- a/Samples/V1.0Samples/LocalMediaSamples/PolicyRecordingBot/README.md +++ b/Samples/V1.0Samples/LocalMediaSamples/PolicyRecordingBot/README.md @@ -1,16 +1,15 @@ - # Introduction ## Note The system will load the bot and join it to appropriate calls and meetings in order for the bot to enforce compliance with the administrative set policy. This sample is only designed for compliance recording scenario. Do not use it for any other scenarios. -This sample should be used only for Org Regulated recording instead of other recording purpose. Otherwise it might block the user calling experience. (https://learn.microsoft.com/en-us/MicrosoftTeams/teams-recording-policy) +This sample should be used only for Org Regulated recording instead of other recording purpose. Otherwise, it might block the user calling experience. [Learn more](https://learn.microsoft.com/en-us/MicrosoftTeams/teams-recording-policy). ## About -The Policy Recording bot sample guides you through building, deploying and testing a bot. This sample demonstrates how a bot can receive media streams for recording. Please note that the sample does not actually record. This logic is left up to the developer. +The Policy Recording bot sample guides you through building, deploying, and testing a bot. This sample demonstrates how a bot can receive media streams for recording. Please note that the sample does not actually record. This logic is left up to the developer. ## Getting Started @@ -18,16 +17,15 @@ This section walks you through the process of deploying and testing the sample b ### Bot Registration -1. Follow the steps in [Register Calling Bot](https://microsoftgraph.github.io/microsoft-graph-comms-samples/docs/articles/calls/register-calling-bot.html). Save the bot name, bot app id and bot secret for configuration. - * For the calling webhook, by default the notification will go to https://{your domain}/api/calling. This is configured with the `CallSignalingRoutePrefix` in [HttpRouteConstants.cs](FrontEnd/Http/Controllers/HttpRouteConstants.cs). +1. Follow the steps in [Register Calling Bot](https://microsoftgraph.github.io/microsoft-graph-comms-samples/docs/articles/calls/register-calling-bot.html). Save the bot name, bot app id, and bot secret for configuration. + * For the calling webhook, by default the notification will go to `https://{your domain}/api/calling`. This is configured with the `CallSignalingRoutePrefix` in [HttpRouteConstants.cs](FrontEnd/Http/Controllers/HttpRouteConstants.cs). * Ignore the "Register bot in Microsoft Teams" section as the Policy Recording bot won't be called directly. These bots are related to the policies discussed below, and are "attached" to users, and will be automatically invited to the call. -1. Add the following Application Permissions to the bot: +2. Add the following Application Permissions to the bot: + * `Calls.AccessMedia.All` + * `Calls.JoinGroupCall.All` - * Calls.AccessMedia.All - * Calls.JoinGroupCall.All - -1. The permission needs to be consented by tenant admin. Go to "https://login.microsoftonline.com/common/adminconsent?client_id=&state=&redirect_uri=" using tenant admin to sign-in, then consent for the whole tenant. +3. The permission needs to be consented by the tenant admin. Go to "https://login.microsoftonline.com/common/adminconsent?client_id=&state=&redirect_uri=" using tenant admin to sign in, then consent for the whole tenant. ### Create an Application Instance @@ -46,9 +44,11 @@ After 30-60 seconds, the policy should show up. To verify your policy was create * `Get-CsTeamsComplianceRecordingPolicy ` ### Assign the Recording Policy + Requries the policy identity created above. Contine your powershell session and run the following commands. * `Grant-CsTeamsComplianceRecordingPolicy -Identity -PolicyName ` + To verify your policy was assigned correctly: * `Get-CsOnlineUser | ft sipaddress, tenantid, TeamsComplianceRecordingPolicy` @@ -60,126 +60,147 @@ To verify your policy was assigned correctly: ### Deploy -* Prerequisites for deploying Azure Cloud Services (extended support)(https://learn.microsoft.com/en-us/azure/cloud-services-extended-support/deploy-prerequisite) - -Step 1: Securely Store Certificates with Azure Key Vault - * Certificates are crucial for securing communication between your services. Azure Key Vault is used to store and manage these certificates securely. - - Create an Azure Key Vault: - * Follow these instructions to create your Azure Key Vault: https://learn.microsoft.com/en-us/azure/key-vault/general/quick-create-portal. - -Step 2: Obtain and Configure Your SSL Certificate - * To secure your service, you need a valid SSL certificate. Here’s how to obtain and configure it: - - Get a Wildcard Certificate: - * Obtain a wildcard SSL certificate for your domain. For example, if your service is hosted at bot.contoso.com,get a certificate for *.contoso.com. - * Ensure that the certificate is issued by a trusted Certificate Authority (CA) and not self-signed. - - Upload to Azure Key Vault: - * Upload your SSL certificate to the Azure Key Vault. Follow these steps: https://learn.microsoft.com/en-us/azure/key-vault/certificates/tutorial-import-certificate?tabs=azure-portal. - - Get the Thumbprint: - * Copy the certificate thumbprint from Azure Key Vault. You will need to add this thumbprint to your .cscfg (cloud service configuration) and .csdef (cloud service definition) files. - 1. Update the Certificate section in your .cscfg file with the thumbprint. - - - - - 2. Update the Certificate element in your .csdef file. - - - - * Replace YourCertificateName with the actual name of your certificate as it appears in your Azure Key Vault or wherever it is stored. Here are the key attributes: - name: This should match the certificate's name as referenced in your Azure Key Vault or local certificate store. - storeLocation: Specifies where the certificate is stored. LocalMachine is a common location for certificates installed on the local machine. - storeName: Specifies the store name where the certificate is located. My is a common store name used for personal certificates. - -Step 3: Define Your Virtual Network - * For Azure Extended Services, you can define the virtual network and subnet configurations in your .cscfg file. Azure can create the virtual network during the service setup if it doesn't already exist. - * When deploying your cloud service (extended) in Azure, virtual network and subnet configurations are managed automatically based on your .cscfg file. Follow these guidelines to ensure proper configuration: - -#### Using Existing Virtual Network: - - * If you have an existing Virtual Network (VNet) that you want to use: - - - - - - - - - - - - * Replace "YourExistingVNetName" with the name of your existing Virtual Network and "YourExistingSubnetName" with the name of your existing subnet within that Virtual Network. - -### Automatic Creation of Virtual Network: - - * If the Virtual Network doesn't exist, Azure will create it based on the configuration provided: - - - - - - - - - - - * Replace "NewVNetName" with the name of the Virtual Network you want Azure to create, and "NewSubnetName" with the name of the subnet within that Virtual Network. - - ### Note on Domain Name and Public IP: +* Prerequisites for deploying Azure Cloud Services (extended support) [here](https://learn.microsoft.com/en-us/azure/cloud-services-extended-support/deploy-prerequisite). - - - - * PublicIP name: "MyPublicIP" – Provide a unique name for the public IP. - * domainNameLabel: "myservice" – Set this to your service's domain label. - - Azure Extended Services: - * Public IP: You must provide a Public IP name in your configuration when creating the service. - * Domain Name: The domain name (domainNameLabel) is optional during initial creation and can be specified or updated later. +#### Step 1: Securely Store Certificates with Azure Key Vault + +Certificates are crucial for securing communication between your services. Azure Key Vault is used to store and manage these certificates securely. + +Create an Azure Key Vault: +* Follow these instructions to create your Azure Key Vault: [Create Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/general/quick-create-portal). + +#### Step 2: Obtain and Configure Your SSL Certificate + +To secure your service, you need a valid SSL certificate. Here’s how to obtain and configure it: + +1. **Get a Wildcard Certificate**: + * Obtain a wildcard SSL certificate for your domain. For example, if your service is hosted at bot.contoso.com, get a certificate for \*.contoso.com. + * Ensure that the certificate is issued by a trusted Certificate Authority (CA) and not self-signed. + +2. **Upload to Azure Key Vault**: + * Upload your SSL certificate to the Azure Key Vault. Follow these steps: [Import Certificate](https://learn.microsoft.com/en-us/azure/key-vault/certificates/tutorial-import-certificate?tabs=azure-portal). + +3. **Get the Thumbprint**: + * Copy the certificate thumbprint from Azure Key Vault. You will need to add this thumbprint to your `.cscfg` (cloud service configuration) and `.csdef` (cloud service definition) files. + + 1. Update the Certificate section in your `.cscfg` file with the thumbprint. + ```xml + + + + + ``` + + 2. Update the Certificate element in your `.csdef` file. + ```xml + + + + ``` + * Replace YourCertificateName with the actual name of your certificate as it appears in your Azure Key Vault or wherever it is stored. Here are the key attributes: - Match Public IP Name: - * Ensure that the name attribute under (MyPublicIP in this example) matches the name used in your application code to fetch the public IP address dynamically. - * To ensure that the domainNameLabel matches between your configuration (.cscfg file) and the Azure portal settings. + **name**: This should match the certificate's name as referenced in your Azure Key Vault or local certificate store. + + **storeLocation**: Specifies where the certificate is stored. LocalMachine is a common location for certificates installed on the local machine. + + **storeName**: Specifies the store name where the certificate is located. My is a common store name used for personal certificates. + + +#### Step 3: Define Your Virtual Network + +* For Azure Extended Services, you can define the virtual network and subnet configurations in your `.cscfg` file. Azure can create the virtual network during the service setup if it doesn't already exist. +* When deploying your cloud service (extended) in Azure, virtual network and subnet configurations are managed automatically based on your .cscfg file. Follow these guidelines to ensure proper configuration. + +##### Using Existing Virtual Network: + +* If you have an existing Virtual Network (VNet) that you want to use: + +```xml + + + + + + + + + + +``` +* Replace "YourExistingVNetName" with the name of your existing Virtual Network and "YourExistingSubnetName" with the name of your existing subnet within that Virtual Network. + +##### Automatic Creation of Virtual Network: + +* If the Virtual Network doesn't exist, Azure will create it based on the configuration provided: + +```xml + + + + + + + + + + +``` +* Replace "NewVNetName" with the name of the Virtual Network you want Azure to create, and "NewSubnetName" with the name of the subnet within that Virtual Network. + +### Note on Domain Name and Public IP + +```xml + + + +``` +* PublicIP name: "MyPublicIP" – Provide a unique name for the public IP. +* domainNameLabel: "myservice" – Set this to your service's domain label. + +Azure Extended Services Configuration: +* **Public IP**: You must provide a Public IP name in your configuration when creating the service. +* **Domain Name**: The domain name (domainNameLabel) is optional during initial creation and can be specified or updated later. + +Match Public IP Name: +* Ensure that the `name` attribute under `` ("MyPublicIP" in this example) matches the name used in your application code to fetch the public IP address dynamically. +* To ensure that the `domainNameLabel` matches between your configuration (.cscfg file) and the Azure portal settings. - Step 4: Deploy +#### Step 4: Deploy - 1. Create Your Cloud Service (Extended Support) - 1. Use the Azure portal to create a Cloud Service (Extended Support). - Follow this guide: Create a Cloud Service (Extended Support).(https://learn.microsoft.com/en-us/azure/cloud-services-extended-support/deploy-portal) - 2. Obtain Your Public IP DNS name: +1. Create Your Cloud Service (Extended Support): + * Use the Azure portal to create a Cloud Service (Extended Support). Follow this guide: [Create Cloud Service](https://learn.microsoft.com/en-us/azure/cloud-services-extended-support/deploy-portal). + * Obtain Your Public IP DNS name: After the service is created, obtain the "Public IP DNS name" from the Azure portal. This URL will serve as your DNS name and Common Name (CN) for further configurations (e.g. bot.contoso.com). - ![Public IP DNS name](Images/PublicIPDNSName.png). - - 2. Update the app configs with values - 1. Set up cloud service configuration - 1. Open powershell, go to the folder that contains file `configure_cloud.ps1`. The file is in the `Samples` directory. - 2. Run the powershell script with parameters: - ` .\configure_cloud.ps1 -p {path to project} -dns {your DNS name} -cn {your CN name, should be the same as your DNS name} -bid {your bot name} -aid {your bot app id} -as {your bot secret}` - - For example: - - `.\configure_cloud.ps1 -p .\V1.0Samples\LocalMediaSamples\PolicyRecordingBot\ -dns bot.contoso.com -cn bot.contoso.com -bid bot -aid 3853f935-2c6f-43d7-859d-6e8f83b519ae -as 123456!@#$%^` - - 3. Deploy to Cloud Service (Extended Support) - 1. Configure Storage Account for Configuration Files. - * To store configuration files for your Azure extended service, you'll need to set up a storage account. Follow these steps to configure the storage account:(https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal). - 2. Package Your Cloud Service for Deployment - * Before you can create your Azure extended service, you need to package your cloud service application to include configuration files and dependencies. - * Right click PolicyRecordingBot, then click `Package...`. - - Option 1: Upload to Azure Storage Account: - * Upload your packaged application (cspkg file) along with the .cscfg and .csdef files to an Azure Storage Account container. - * This method allows you to deploy directly from the Azure Storage Account during service creation. - - Option 2: Use Local Files: - * Deploy directly from local files during the service creation process. - * Ensure all required files, including .cscfg and .csdef, are accessible and correctly referenced during deployment. + ![Public IP DNS name](Images/PublicIPDNSName.png). + +2. Update the App Configurations: + * Set up cloud service configuration with PowerShell: + 1. Open PowerShell, go to the folder that contains the file `configure_cloud.ps1`. The file is in the `Samples` directory. + 2. Run the PowerShell script with parameters: + ```powershell + .\configure_cloud.ps1 -p {path to project} -dns {your DNS name} -cn {your CN name, should be the same as your DNS name} -bid {your bot name} -aid {your bot app id} -as {your bot secret} + ``` + For example: + ```powershell + .\configure_cloud.ps1 -p .\V1.0Samples\LocalMediaSamples\PolicyRecordingBot\ -dns bot.contoso.com -cn bot.contoso.com -bid bot -aid 3853f935-2c6f-43d7-859d-6e8f83b519ae -as 123456!@#$%^ + ``` + +3. Deploy to Cloud Service (Extended Support): + 1. Configure Storage Account for Configuration Files. + * To store configuration files for your Azure extended service, you'll need to set up a storage account. Follow these steps to configure the storage account:(https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal). + 2. Package Your Cloud Service for Deployment + * Before you can create your Azure extended service, you need to package your cloud service application to include configuration files and dependencies. + * Right click PolicyRecordingBot, then click `Package...`. + +**Option 1**: Upload to Azure Storage Account: +* Upload your packaged application (cspkg file) along with the .cscfg and .csdef files to an Azure Storage Account container. +* This method allows you to deploy directly from the Azure Storage Account during service creation. + +**Option 2**: Use Local Files: +* Deploy directly from local files during the service creation process. +* Ensure all required files, including .cscfg and .csdef, are accessible and correctly referenced during deployment. ### Firewall setup @@ -199,8 +220,8 @@ Step 3: Define Your Virtual Network 3. Interact with your service, _adjusting the service URL appropriately_. 1. Get diagnostics data from the bot. Open the url https://bot.contoso.com:10101/calls in a browser for auto-refresh. Search for the most recent CallId and replace with it in the below url. - * Active calls: https://bot.contoso.com:10101/calls/{CallId} - * Service logs: https://bot.contoso.com:10101/logs + * Active calls: https://bot.contoso.com:10101/calls/{CallId} + * Service logs: https://bot.contoso.com:10101/logs 2. Terminating the call through `DELETE`, as needed for testing. Replace the {CallId} below with your call id from the first response.