MoreInfo.url causes failure of loading GRAPH-capable spam-addin manifest.
Opened this issue · 8 comments
Provide required information needed to triage your issue
Adding 'WebApplicationInfo' in the manifest, with MoreInfo.url defined, causes Outlook to fail in loading the manifest.
Your Environment
- Platform [PC desktop, Mac, iOS, Office on the web]: MAC Outlook
- Host [Excel, Word, PowerPoint, etc.]: Outlook
Expected behavior
Spam addin manifest, with GRAPH WebApplicationInfo defined, should load with no issues in Outlook.
Current behavior
Spam addin manifest, with GRAPH WebApplicationInfo defined, fails to load in Outlook.
Steps to reproduce
- Visit the contoso sample repository in : https://github.com/OfficeDev/Office-Add-in-samples/tree/main/Samples/outlook-spam-reporting
- Download the file manifest.xml.
- At the bottom of the manifest, add the WebApplicationInfo section underneath resources.
</Resources>
<WebApplicationInfo>
<Id>aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee</Id>
<Resource>api://officedev.github.io/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee</Resource>
<Scopes>
<Scope>profile</Scope>
<Scope>openid</Scope>
</Scopes>
</WebApplicationInfo>
</VersionOverrides>
- Once the manifest is modified, sideload the xml file using MAC Outlook.
- MAC Outlook fails to load the manifest with the following error :
- To fix this, open the manifest and remove the 'MoreInfo.url' line in the current manifest. This leaves behind WebViewRuntime and JSRuntime urls.
<bt:Urls>
<bt:Url id="WebViewRuntime.Url" DefaultValue="https://officedev.github.io/Office-Add-in-samples/Samples/outlook-spam-reporting/src/spamreporting.html"/>
<bt:Url id="JSRuntime.Url" DefaultValue="https://officedev.github.io/Office-Add-in-samples/Samples/outlook-spam-reporting/src/spamreporting.js"/>
</bt:Urls>
- Save the modified manifest.
- Load the manifest (without MoreInfo.url) using outlook and this succeeds.
Link to live example(s)
None
Provide additional details
None
Context
'MoreInfo' related manifest entries are causing some trouble. (#4521)
This is stopping us from creating GRAPH-enabled manifests for spam addins.
Useful logs
None
Thank you for taking the time to report an issue. Our triage team will respond to you in less than 72 hours. Normally, response time is <10 hours Monday through Friday. We do not triage on weekends.
Thanks for reporting this issue regarding Integrated Spam feature. It has been put on our backlog. We unfortunately have no timelines to share at this point
Internal tracking id: Office: [4637020]
So I think this is kind of weird. But what is happening is the sample manifest has the url in the moreInfo category as:
https://learn.microsoft.com/...
This is ok...but when you add the WebApplicationInfo it puts more restrictions on what you are allowed to include in the URL section. (I can't find documentation for this, but checking to see if it's out there somewhere). I believe this is because the URL section is also used to load Web Taskpanes in Outlook, and they want to ensure that your graph calls are coming from URLs that are approved.
The URL for the MoreInfo section is only used to display in the dialog...but since it falls under the URLs section it is under the same restriction/security protocols.
What IS a problem is that the installer USED to give more informative error messages about the manifest. It should have said something like this:
So you can use the MoreInfo section with WebApplicationInfo, but you need to make sure the URL is still in the same domain.
@timwan10 thank you so much for your explanation. Unfortunately, I don't think that forcing the domain of moreinfo same as webapplicationinfo is acceptable for our use. On the other side of the fence, I am thinking of :
- Why not make MoreInfo.url and MoreInfo.label optional? (Right now a UI-bug happens when you remove MoreInfo.url and Moreinfo.label.)
- If we opt to use MoreInfo.url, can't we just register the domain in the appdomains list?
I highly recommend making Moreinfo optional. Having links in the dialog to click on can be confusing for some.
Thank you again.
Thank you very much @akshayta23 .
Hello @timwan10 . I have tried adding the domain of the url in MoreInfo.url in the appdomains list. Outlook would still not install the manifest saying 'Sorry we can't complete this operation.'. However, as you have tried, if I set the Moreinfo.url with the same domain as the link in webapplicationinfo, then the manifest gets installed.
I don't need moreinfo but my ugly trick was to host a html file on the right domain with instant redirection to the desired external link, if it can help someone