microsoftgraph / microsoftgraph/microsoft-graph-comms-samples

Lobby rules - breaking through the lobby with a guest identity

Open
#353 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
No language data
Stars
253
Forks
275
Avg merge
1d 5h
Merged PRs (30d)
1

Description

I'm trying to understand if it's possible to get a bot joining a meeting as a guest, and have it bypass the lobby if the lobby controls are set to anything but "Everyone". I've been testing all combinations of settings that could influence this, but none appear to make any difference:

  • Using Calls.JoinGroupCall.All vs Calls.JoinGroupCallAsGuest.All on the Azure AD app reg
  • Setting the JoinMeetingParameters.AllowGuestToBypassLobby setting to true, false, and leaving as null
  • Joining with and without a JoinMeetingParameters.GuestIdentity

I'm setting the GuestIdentity prior to joining, like so:

    var joinParams = new JoinMeetingParameters(chatInfo, meetingInfo, mediaSession)
    {
        TenantId = meetingInfo.Organizer.User.GetTenantId(),
        GuestIdentity = new Identity { DisplayName = "Paulie", Id = Guid.NewGuid().ToString() },
        AllowGuestToBypassLobby = true
    };

Regardless of which combination of settings I use, it seems that the guest user can only automatically get through the lobby if the lobby settings are set to "Everyone", as shown in the matrix below (this matrix is the same regardless of whether the Azure AD app has the Calls.JoinGroupCall.All or the Calls.JoinGroupCallAsGuest.All permission):

  Guest, AGTBL = false Guest, AGTBL = true App, AGTBL = false App, AGTBL = true
Only Me No, 75 sec timeout No, 75 sec timeout Yes Yes
Org No, 75 sec timeout No, 75 sec timeout Yes Yes
Org + Trusted No, 75 sec timeout No, 75 sec timeout Yes Yes
Everyone Yes Yes Yes Yes

Where I refer to the "75 sec timeout", this means that on attempting to join the call, the call state eventually changes to Terminated with a ResultInfo of:

    AdditionalData: Count = 0
    Code: 410
    Message: "An answer for the start incoming negotiation request was not received within 75 seconds.. DiagCode: 410#319009"
    ODataType: "microsoft.graph.resultInfo"
    Subcode: 9999

This doesn't seem right to me. Surely the Azure AD permissions that are selected, and/or the AllowGuestToBypassLobby setting should make some difference to guest lobby bypass?

My ideal is to be able to get the guest user to join the meeting regardless of the lobby settings - is this possible? if not, what's the lowest level of lobby settingsthat would let the guest get in to the meeting , and how would I achieve it?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with JoinMeetingParameters, GuestIdentity, AllowGuestToBypassLobby, and the Calls.JoinGroupCall permissions described in the report. Reproduce the guest and app cases from the settings matrix and inspect the 75-second ResultInfo 410 termination. Done means the supported lobby behavior is established and documented, or the guest-join behavior is corrected and verified against the matrix.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.