OAuth installations without public endpoints for Socket Mode apps

At the moment creating simple Bots in SocketMode is easy, but as soon as you want to support OAuth2 installation so that the bot can act on behalf of the user, a whole world of pain and complexity ensues.

The problem is that an app using Socket Mode only makes a single outbound connection, authenticated with its tokens, whereas to support OAuth2 it needs to expose an HTTPS endpoint with a valid certificate. These are very different beasts.

• A Socket Mode app can be run anywhere that can make an outbound connection. If you need OAuth2 then you need to expose the app to the internet.
• A Socket Mode app does not need to know its own DNS address. If you want OAuth2 you do.
• A Socket Mode app does not need a valid SSL certificate. To support OAuth2 you need one.

The requested enhancement, as proposed in this comment on another issue, is that Slack should offer a new API endpoint to provide an OAuth callback location for Socket Mode apps. The Slack API servers would present an endpoint with a URL of the form https://slack.com/api/oauth_redirect/MY_APP_ID and an app would use this in its OAuth2 installation process. When the user completes the OAuth2 flow this endpoint would be hit, the Slack servers would do some simple sanity checks on the values and then the tokens would be presented to the app as an event through the WebSocket connection. If the app is not connected at the time the API would reject the request, so the authentication process would not complete.

Offering this API would greatly simplify the process of deploying OAuth2 apps in Socket Mode. It would allow OAuth2 apps to run in Docker containers that don't have a good idea of where they are running or how they can be addressed. It would have the added security advantage of the app not having to expose any endpoint to the outside world.

Category

• slack_bolt.App and/or its core components
• slack_bolt.async_app.AsyncApp and/or its core components
• Adapters in slack_bolt.adapter
• Others

The request concerns Socket Mode adapters and a new Slack OAuth callback API, but it names no repository file or test. Start by inspecting the slack_bolt.adapter area and the referenced discussion in issue #583. Done would require a defined implementation path in this repository and corresponding validation for OAuth installation events.