diff --git a/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj b/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj
index 32b5efe..b940b82 100644
--- a/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj
+++ b/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj
@@ -75,12 +75,12 @@
..\packages\Octopus.Diagnostics.1.0.11\lib\netstandard1.0\Octopus.Diagnostics.dll
True
-
- ..\packages\Octopus.Server.Extensibility.1.0.39\lib\net45\Octopus.Server.Extensibility.dll
+
+ ..\packages\Octopus.Server.Extensibility.1.1.45\lib\net45\Octopus.Server.Extensibility.dll
True
-
- ..\packages\Octopus.Server.Extensibility.Authentication.1.0.11\lib\net45\Octopus.Server.Extensibility.Authentication.dll
+
+ ..\packages\Octopus.Server.Extensibility.Authentication.1.1.13\lib\net45\Octopus.Server.Extensibility.Authentication.dll
True
diff --git a/source/Octopus.Server.Extensibility.Authentication.AzureAD/Web/AzureADUserAuthenticationAction.cs b/source/Octopus.Server.Extensibility.Authentication.AzureAD/Web/AzureADUserAuthenticationAction.cs
index 0f1dd87..d791902 100644
--- a/source/Octopus.Server.Extensibility.Authentication.AzureAD/Web/AzureADUserAuthenticationAction.cs
+++ b/source/Octopus.Server.Extensibility.Authentication.AzureAD/Web/AzureADUserAuthenticationAction.cs
@@ -4,6 +4,7 @@
using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Issuer;
using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Web;
using Octopus.Server.Extensibility.Extensions.Infrastructure.Web.Api;
+using Octopus.Server.Extensibility.HostServices.Web;
namespace Octopus.Server.Extensibility.Authentication.AzureAD.Web
{
@@ -14,7 +15,8 @@ public AzureADUserAuthenticationAction(
IAzureADConfigurationStore configurationStore,
IIdentityProviderConfigDiscoverer identityProviderConfigDiscoverer,
IAzureADAuthorizationEndpointUrlBuilder urlBuilder,
- IApiActionResponseCreator responseCreator) : base(log, configurationStore, identityProviderConfigDiscoverer, urlBuilder, responseCreator)
+ IApiActionResponseCreator responseCreator,
+ IWebPortalConfigurationStore webPortalConfigurationStore) : base(log, configurationStore, identityProviderConfigDiscoverer, urlBuilder, responseCreator, webPortalConfigurationStore)
{
}
}
diff --git a/source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config b/source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config
index aea5b39..3b0af19 100644
--- a/source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config
+++ b/source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config
@@ -11,8 +11,8 @@
-
-
+
+
diff --git a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj
index 721749a..bd85b11 100644
--- a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj
+++ b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj
@@ -75,12 +75,12 @@
..\packages\Octopus.Diagnostics.1.0.11\lib\netstandard1.0\Octopus.Diagnostics.dll
True
-
- ..\packages\Octopus.Server.Extensibility.1.0.39\lib\net45\Octopus.Server.Extensibility.dll
+
+ ..\packages\Octopus.Server.Extensibility.1.1.45\lib\net45\Octopus.Server.Extensibility.dll
True
-
- ..\packages\Octopus.Server.Extensibility.Authentication.1.0.11\lib\net45\Octopus.Server.Extensibility.Authentication.dll
+
+ ..\packages\Octopus.Server.Extensibility.Authentication.1.1.13\lib\net45\Octopus.Server.Extensibility.Authentication.dll
True
diff --git a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Web/GoogleAppsUserAuthenticationAction.cs b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Web/GoogleAppsUserAuthenticationAction.cs
index bf60627..c0a7e29 100644
--- a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Web/GoogleAppsUserAuthenticationAction.cs
+++ b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Web/GoogleAppsUserAuthenticationAction.cs
@@ -4,6 +4,7 @@
using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Issuer;
using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Web;
using Octopus.Server.Extensibility.Extensions.Infrastructure.Web.Api;
+using Octopus.Server.Extensibility.HostServices.Web;
namespace Octopus.Server.Extensibility.Authentication.GoogleApps.Web
{
@@ -14,7 +15,8 @@ public GoogleAppsUserAuthenticationAction(
IGoogleAppsConfigurationStore configurationStore,
IIdentityProviderConfigDiscoverer identityProviderConfigDiscoverer,
IGoogleAppsAuthorizationEndpointUrlBuilder urlBuilder,
- IApiActionResponseCreator responseCreator) : base(log, configurationStore, identityProviderConfigDiscoverer, urlBuilder, responseCreator)
+ IApiActionResponseCreator responseCreator,
+ IWebPortalConfigurationStore webPortalConfigurationStore) : base(log, configurationStore, identityProviderConfigDiscoverer, urlBuilder, responseCreator, webPortalConfigurationStore)
{
}
}
diff --git a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config
index aea5b39..3b0af19 100644
--- a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config
+++ b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config
@@ -11,8 +11,8 @@
-
-
+
+
diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj
index 734d193..48dd53e 100644
--- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj
+++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj
@@ -77,12 +77,12 @@
..\packages\Octopus.Diagnostics.1.0.11\lib\netstandard1.0\Octopus.Diagnostics.dll
True
-
- ..\packages\Octopus.Server.Extensibility.1.0.39\lib\net45\Octopus.Server.Extensibility.dll
+
+ ..\packages\Octopus.Server.Extensibility.1.1.45\lib\net45\Octopus.Server.Extensibility.dll
True
-
- ..\packages\Octopus.Server.Extensibility.Authentication.1.0.11\lib\net45\Octopus.Server.Extensibility.Authentication.dll
+
+ ..\packages\Octopus.Server.Extensibility.Authentication.1.1.13\lib\net45\Octopus.Server.Extensibility.Authentication.dll
True
diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/OpenIDConnectAuthenticationProvider.cs b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/OpenIDConnectAuthenticationProvider.cs
index 0f13807..45e5238 100644
--- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/OpenIDConnectAuthenticationProvider.cs
+++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/OpenIDConnectAuthenticationProvider.cs
@@ -38,7 +38,7 @@ private bool IsProviderConfigComplete()
public bool SupportsPasswordManagement => false;
- public string AuthenticateUri => $"/api/users/authenticate/{ConfigurationStore.ConfigurationSettingsName}";
+ public string AuthenticateUri => $"/users/authenticate/{ConfigurationStore.ConfigurationSettingsName}";
protected abstract string LoginLinkHtml(string requestDirectoryPath);
diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs
index bc74752..8bd7523 100644
--- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs
+++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs
@@ -7,6 +7,7 @@
using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Issuer;
using Octopus.Server.Extensibility.Extensions.Infrastructure.Web.Api;
using Octopus.Diagnostics;
+using Octopus.Server.Extensibility.Authentication.HostServices;
using Octopus.Server.Extensibility.HostServices.Web;
namespace Octopus.Server.Extensibility.Authentication.OpenIDConnect.Web
@@ -20,16 +21,19 @@ public abstract class UserAuthenticationAction : IAsyncApiAction
protected readonly TStore ConfigurationStore;
protected readonly IApiActionResponseCreator ResponseCreator;
+ readonly IWebPortalConfigurationStore webPortalConfigurationStore;
protected UserAuthenticationAction(
ILog log,
TStore configurationStore,
IIdentityProviderConfigDiscoverer identityProviderConfigDiscoverer,
IAuthorizationEndpointUrlBuilder urlBuilder,
- IApiActionResponseCreator responseCreator)
+ IApiActionResponseCreator responseCreator,
+ IWebPortalConfigurationStore webPortalConfigurationStore)
{
this.log = log;
ResponseCreator = responseCreator;
+ this.webPortalConfigurationStore = webPortalConfigurationStore;
ConfigurationStore = configurationStore;
this.identityProviderConfigDiscoverer = identityProviderConfigDiscoverer;
this.urlBuilder = urlBuilder;
@@ -46,17 +50,33 @@ public async Task ExecuteAsync(NancyContext context, IResponseFormatte
if (context.Request.Url.SiteBase.StartsWith("https://", StringComparison.OrdinalIgnoreCase) == false)
log.Warn($"{ConfigurationStore.ConfigurationSettingsName} user authentication API was called without using https.");
+ var directoryPathResult = context.Request.AbsoluteVirtualDirectoryPath();
+ if (!directoryPathResult.IsValid)
+ {
+ return ResponseCreator.BadRequest(directoryPathResult.InvalidReason);
+ }
+
var postLoginRedirectTo = context.Request.Query["redirectTo"];
var state = "~/app";
if (string.IsNullOrWhiteSpace(postLoginRedirectTo) == false)
state = postLoginRedirectTo;
+
+ var whitelist = webPortalConfigurationStore.GetTrustedRedirectUrls();
+
+ if (!Requests.IsLocalUrl(directoryPathResult.Path, state, whitelist))
+ {
+ log.WarnFormat("Prevented potential Open Redirection attack on an authentication request from the local instance {0} to the non-local url {1}", directoryPathResult.Path, state);
+ return ResponseCreator.BadRequest("Request not allowed, due to potential Open Redirection attack");
+ }
+
var nonce = Nonce.GenerateUrlSafeNonce();
try
{
var issuer = ConfigurationStore.GetIssuer();
var issuerConfig = await identityProviderConfigDiscoverer.GetConfigurationAsync(issuer);
- var url = urlBuilder.Build(context.Request.DirectoryPath(), issuerConfig, nonce, state);
+
+ var url = urlBuilder.Build(directoryPathResult.Path, issuerConfig, nonce, state);
return response.AsRedirect(url)
.WithCookie(new NancyCookie("s", State.Protect(state), true, false, DateTime.UtcNow.AddMinutes(20)))
diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config
index 0455016..5be18c6 100644
--- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config
+++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config
@@ -11,8 +11,8 @@
-
-
+
+