From 5b390817c0df755dccbf713311e805a42543b25f Mon Sep 17 00:00:00 2001 From: Shannon Lewis Date: Fri, 11 Nov 2016 12:13:24 +1000 Subject: [PATCH 1/3] package update to support cases where the Octopus Deploy server is behind a reverse proxy, and provide error messages if the heades aren't being passed through correctly --- ...pus.Server.Extensibility.Authentication.AzureAD.csproj | 4 ++-- .../packages.config | 2 +- ....Server.Extensibility.Authentication.GoogleApps.csproj | 4 ++-- .../packages.config | 2 +- ...rver.Extensibility.Authentication.OpenIdConnect.csproj | 4 ++-- .../Web/UserAuthenticationAction.cs | 8 +++++++- .../packages.config | 2 +- 7 files changed, 16 insertions(+), 10 deletions(-) diff --git a/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj b/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj index 32b5efe..22b6181 100644 --- a/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj +++ b/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj @@ -75,8 +75,8 @@ ..\packages\Octopus.Diagnostics.1.0.11\lib\netstandard1.0\Octopus.Diagnostics.dll True - - ..\packages\Octopus.Server.Extensibility.1.0.39\lib\net45\Octopus.Server.Extensibility.dll + + ..\packages\Octopus.Server.Extensibility.1.1.41\lib\net45\Octopus.Server.Extensibility.dll True diff --git a/source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config b/source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config index aea5b39..ea1b383 100644 --- a/source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config +++ b/source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config @@ -11,7 +11,7 @@ - + diff --git a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj index 721749a..cd2a44c 100644 --- a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj +++ b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj @@ -75,8 +75,8 @@ ..\packages\Octopus.Diagnostics.1.0.11\lib\netstandard1.0\Octopus.Diagnostics.dll True - - ..\packages\Octopus.Server.Extensibility.1.0.39\lib\net45\Octopus.Server.Extensibility.dll + + ..\packages\Octopus.Server.Extensibility.1.1.41\lib\net45\Octopus.Server.Extensibility.dll True diff --git a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config index aea5b39..ea1b383 100644 --- a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config +++ b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config @@ -11,7 +11,7 @@ - + diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj index 734d193..b6e479e 100644 --- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj +++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj @@ -77,8 +77,8 @@ ..\packages\Octopus.Diagnostics.1.0.11\lib\netstandard1.0\Octopus.Diagnostics.dll True - - ..\packages\Octopus.Server.Extensibility.1.0.39\lib\net45\Octopus.Server.Extensibility.dll + + ..\packages\Octopus.Server.Extensibility.1.1.41\lib\net45\Octopus.Server.Extensibility.dll True diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs index bc74752..78ce115 100644 --- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs +++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs @@ -56,7 +56,13 @@ public async Task ExecuteAsync(NancyContext context, IResponseFormatte { var issuer = ConfigurationStore.GetIssuer(); var issuerConfig = await identityProviderConfigDiscoverer.GetConfigurationAsync(issuer); - var url = urlBuilder.Build(context.Request.DirectoryPath(), issuerConfig, nonce, state); + var directoryPathResult = context.Request.DirectoryPath(); + if (!directoryPathResult.IsValid) + { + return ResponseCreator.BadRequest(directoryPathResult.InvalidReason); + } + + var url = urlBuilder.Build(directoryPathResult.Path, issuerConfig, nonce, state); return response.AsRedirect(url) .WithCookie(new NancyCookie("s", State.Protect(state), true, false, DateTime.UtcNow.AddMinutes(20))) diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config index 0455016..6bca120 100644 --- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config +++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config @@ -11,7 +11,7 @@ - + From a5e2c60b0eb46ff6c53d0bfb71d1da519d2e39db Mon Sep 17 00:00:00 2001 From: Shannon Lewis Date: Fri, 11 Nov 2016 16:23:19 +1000 Subject: [PATCH 2/3] package updates to handle AbsoluteVirtualDirectoryPath better, and also added checks for open redirection attacks --- ...xtensibility.Authentication.AzureAD.csproj | 8 +++---- .../packages.config | 4 ++-- ...nsibility.Authentication.GoogleApps.csproj | 8 +++---- .../packages.config | 4 ++-- ...bility.Authentication.OpenIdConnect.csproj | 8 +++---- .../OpenIDConnectAuthenticationProvider.cs | 2 +- .../Web/UserAuthenticationAction.cs | 24 +++++++++++++++---- .../packages.config | 4 ++-- 8 files changed, 38 insertions(+), 24 deletions(-) diff --git a/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj b/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj index 22b6181..4f7f8e8 100644 --- a/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj +++ b/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj @@ -75,12 +75,12 @@ ..\packages\Octopus.Diagnostics.1.0.11\lib\netstandard1.0\Octopus.Diagnostics.dll True - - ..\packages\Octopus.Server.Extensibility.1.1.41\lib\net45\Octopus.Server.Extensibility.dll + + ..\packages\Octopus.Server.Extensibility.1.1.42\lib\net45\Octopus.Server.Extensibility.dll True - - ..\packages\Octopus.Server.Extensibility.Authentication.1.0.11\lib\net45\Octopus.Server.Extensibility.Authentication.dll + + ..\packages\Octopus.Server.Extensibility.Authentication.1.1.13\lib\net45\Octopus.Server.Extensibility.Authentication.dll True diff --git a/source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config b/source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config index ea1b383..3ebedd5 100644 --- a/source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config +++ b/source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config @@ -11,8 +11,8 @@ - - + + diff --git a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj index cd2a44c..69d5d37 100644 --- a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj +++ b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj @@ -75,12 +75,12 @@ ..\packages\Octopus.Diagnostics.1.0.11\lib\netstandard1.0\Octopus.Diagnostics.dll True - - ..\packages\Octopus.Server.Extensibility.1.1.41\lib\net45\Octopus.Server.Extensibility.dll + + ..\packages\Octopus.Server.Extensibility.1.1.42\lib\net45\Octopus.Server.Extensibility.dll True - - ..\packages\Octopus.Server.Extensibility.Authentication.1.0.11\lib\net45\Octopus.Server.Extensibility.Authentication.dll + + ..\packages\Octopus.Server.Extensibility.Authentication.1.1.13\lib\net45\Octopus.Server.Extensibility.Authentication.dll True diff --git a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config index ea1b383..3ebedd5 100644 --- a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config +++ b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config @@ -11,8 +11,8 @@ - - + + diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj index b6e479e..5c0d315 100644 --- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj +++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj @@ -77,12 +77,12 @@ ..\packages\Octopus.Diagnostics.1.0.11\lib\netstandard1.0\Octopus.Diagnostics.dll True - - ..\packages\Octopus.Server.Extensibility.1.1.41\lib\net45\Octopus.Server.Extensibility.dll + + ..\packages\Octopus.Server.Extensibility.1.1.42\lib\net45\Octopus.Server.Extensibility.dll True - - ..\packages\Octopus.Server.Extensibility.Authentication.1.0.11\lib\net45\Octopus.Server.Extensibility.Authentication.dll + + ..\packages\Octopus.Server.Extensibility.Authentication.1.1.13\lib\net45\Octopus.Server.Extensibility.Authentication.dll True diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/OpenIDConnectAuthenticationProvider.cs b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/OpenIDConnectAuthenticationProvider.cs index 0f13807..45e5238 100644 --- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/OpenIDConnectAuthenticationProvider.cs +++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/OpenIDConnectAuthenticationProvider.cs @@ -38,7 +38,7 @@ private bool IsProviderConfigComplete() public bool SupportsPasswordManagement => false; - public string AuthenticateUri => $"/api/users/authenticate/{ConfigurationStore.ConfigurationSettingsName}"; + public string AuthenticateUri => $"/users/authenticate/{ConfigurationStore.ConfigurationSettingsName}"; protected abstract string LoginLinkHtml(string requestDirectoryPath); diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs index 78ce115..3316398 100644 --- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs +++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs @@ -1,4 +1,5 @@ using System; +using System.Diagnostics; using System.Threading.Tasks; using Nancy; using Nancy.Cookies; @@ -7,6 +8,7 @@ using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Issuer; using Octopus.Server.Extensibility.Extensions.Infrastructure.Web.Api; using Octopus.Diagnostics; +using Octopus.Server.Extensibility.Authentication.HostServices; using Octopus.Server.Extensibility.HostServices.Web; namespace Octopus.Server.Extensibility.Authentication.OpenIDConnect.Web @@ -46,21 +48,33 @@ public async Task ExecuteAsync(NancyContext context, IResponseFormatte if (context.Request.Url.SiteBase.StartsWith("https://", StringComparison.OrdinalIgnoreCase) == false) log.Warn($"{ConfigurationStore.ConfigurationSettingsName} user authentication API was called without using https."); + var directoryPathResult = context.Request.AbsoluteVirtualDirectoryPath(); + if (!directoryPathResult.IsValid) + { + return ResponseCreator.BadRequest(directoryPathResult.InvalidReason); + } + var postLoginRedirectTo = context.Request.Query["redirectTo"]; var state = "~/app"; if (string.IsNullOrWhiteSpace(postLoginRedirectTo) == false) state = postLoginRedirectTo; + + string[] whitelist = null; + if (Debugger.IsAttached) + whitelist = new[] { "http://localhost", "https://localhost" }; + + if (!Requests.IsLocalUrl(directoryPathResult.Path, state, whitelist)) + { + log.WarnFormat("Prevented potential Open Redirection attack on an authentication request from the local instance {0} to the non-local url {1}", directoryPathResult.Path, state); + return ResponseCreator.BadRequest("Request not allowed, due to potential Open Redirection attack"); + } + var nonce = Nonce.GenerateUrlSafeNonce(); try { var issuer = ConfigurationStore.GetIssuer(); var issuerConfig = await identityProviderConfigDiscoverer.GetConfigurationAsync(issuer); - var directoryPathResult = context.Request.DirectoryPath(); - if (!directoryPathResult.IsValid) - { - return ResponseCreator.BadRequest(directoryPathResult.InvalidReason); - } var url = urlBuilder.Build(directoryPathResult.Path, issuerConfig, nonce, state); diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config index 6bca120..6228087 100644 --- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config +++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config @@ -11,8 +11,8 @@ - - + + From 8366b3c0d748c7618c4f34d6ef3f07e707e529bc Mon Sep 17 00:00:00 2001 From: Shannon Lewis Date: Mon, 14 Nov 2016 11:22:50 +1000 Subject: [PATCH 3/3] updates so the truested redirect Urls can be set through configure --- ....Server.Extensibility.Authentication.AzureAD.csproj | 4 ++-- .../Web/AzureADUserAuthenticationAction.cs | 4 +++- .../packages.config | 2 +- ...rver.Extensibility.Authentication.GoogleApps.csproj | 4 ++-- .../Web/GoogleAppsUserAuthenticationAction.cs | 4 +++- .../packages.config | 2 +- ...r.Extensibility.Authentication.OpenIdConnect.csproj | 4 ++-- .../Web/UserAuthenticationAction.cs | 10 +++++----- .../packages.config | 2 +- 9 files changed, 20 insertions(+), 16 deletions(-) diff --git a/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj b/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj index 4f7f8e8..b940b82 100644 --- a/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj +++ b/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj @@ -75,8 +75,8 @@ ..\packages\Octopus.Diagnostics.1.0.11\lib\netstandard1.0\Octopus.Diagnostics.dll True - - ..\packages\Octopus.Server.Extensibility.1.1.42\lib\net45\Octopus.Server.Extensibility.dll + + ..\packages\Octopus.Server.Extensibility.1.1.45\lib\net45\Octopus.Server.Extensibility.dll True diff --git a/source/Octopus.Server.Extensibility.Authentication.AzureAD/Web/AzureADUserAuthenticationAction.cs b/source/Octopus.Server.Extensibility.Authentication.AzureAD/Web/AzureADUserAuthenticationAction.cs index 0f1dd87..d791902 100644 --- a/source/Octopus.Server.Extensibility.Authentication.AzureAD/Web/AzureADUserAuthenticationAction.cs +++ b/source/Octopus.Server.Extensibility.Authentication.AzureAD/Web/AzureADUserAuthenticationAction.cs @@ -4,6 +4,7 @@ using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Issuer; using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Web; using Octopus.Server.Extensibility.Extensions.Infrastructure.Web.Api; +using Octopus.Server.Extensibility.HostServices.Web; namespace Octopus.Server.Extensibility.Authentication.AzureAD.Web { @@ -14,7 +15,8 @@ public AzureADUserAuthenticationAction( IAzureADConfigurationStore configurationStore, IIdentityProviderConfigDiscoverer identityProviderConfigDiscoverer, IAzureADAuthorizationEndpointUrlBuilder urlBuilder, - IApiActionResponseCreator responseCreator) : base(log, configurationStore, identityProviderConfigDiscoverer, urlBuilder, responseCreator) + IApiActionResponseCreator responseCreator, + IWebPortalConfigurationStore webPortalConfigurationStore) : base(log, configurationStore, identityProviderConfigDiscoverer, urlBuilder, responseCreator, webPortalConfigurationStore) { } } diff --git a/source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config b/source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config index 3ebedd5..3b0af19 100644 --- a/source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config +++ b/source/Octopus.Server.Extensibility.Authentication.AzureAD/packages.config @@ -11,7 +11,7 @@ - + diff --git a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj index 69d5d37..bd85b11 100644 --- a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj +++ b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj @@ -75,8 +75,8 @@ ..\packages\Octopus.Diagnostics.1.0.11\lib\netstandard1.0\Octopus.Diagnostics.dll True - - ..\packages\Octopus.Server.Extensibility.1.1.42\lib\net45\Octopus.Server.Extensibility.dll + + ..\packages\Octopus.Server.Extensibility.1.1.45\lib\net45\Octopus.Server.Extensibility.dll True diff --git a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Web/GoogleAppsUserAuthenticationAction.cs b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Web/GoogleAppsUserAuthenticationAction.cs index bf60627..c0a7e29 100644 --- a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Web/GoogleAppsUserAuthenticationAction.cs +++ b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Web/GoogleAppsUserAuthenticationAction.cs @@ -4,6 +4,7 @@ using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Issuer; using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Web; using Octopus.Server.Extensibility.Extensions.Infrastructure.Web.Api; +using Octopus.Server.Extensibility.HostServices.Web; namespace Octopus.Server.Extensibility.Authentication.GoogleApps.Web { @@ -14,7 +15,8 @@ public GoogleAppsUserAuthenticationAction( IGoogleAppsConfigurationStore configurationStore, IIdentityProviderConfigDiscoverer identityProviderConfigDiscoverer, IGoogleAppsAuthorizationEndpointUrlBuilder urlBuilder, - IApiActionResponseCreator responseCreator) : base(log, configurationStore, identityProviderConfigDiscoverer, urlBuilder, responseCreator) + IApiActionResponseCreator responseCreator, + IWebPortalConfigurationStore webPortalConfigurationStore) : base(log, configurationStore, identityProviderConfigDiscoverer, urlBuilder, responseCreator, webPortalConfigurationStore) { } } diff --git a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config index 3ebedd5..3b0af19 100644 --- a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config +++ b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/packages.config @@ -11,7 +11,7 @@ - + diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj index 5c0d315..48dd53e 100644 --- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj +++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj @@ -77,8 +77,8 @@ ..\packages\Octopus.Diagnostics.1.0.11\lib\netstandard1.0\Octopus.Diagnostics.dll True - - ..\packages\Octopus.Server.Extensibility.1.1.42\lib\net45\Octopus.Server.Extensibility.dll + + ..\packages\Octopus.Server.Extensibility.1.1.45\lib\net45\Octopus.Server.Extensibility.dll True diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs index 3316398..8bd7523 100644 --- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs +++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Web/UserAuthenticationAction.cs @@ -1,5 +1,4 @@ using System; -using System.Diagnostics; using System.Threading.Tasks; using Nancy; using Nancy.Cookies; @@ -22,16 +21,19 @@ public abstract class UserAuthenticationAction : IAsyncApiAction protected readonly TStore ConfigurationStore; protected readonly IApiActionResponseCreator ResponseCreator; + readonly IWebPortalConfigurationStore webPortalConfigurationStore; protected UserAuthenticationAction( ILog log, TStore configurationStore, IIdentityProviderConfigDiscoverer identityProviderConfigDiscoverer, IAuthorizationEndpointUrlBuilder urlBuilder, - IApiActionResponseCreator responseCreator) + IApiActionResponseCreator responseCreator, + IWebPortalConfigurationStore webPortalConfigurationStore) { this.log = log; ResponseCreator = responseCreator; + this.webPortalConfigurationStore = webPortalConfigurationStore; ConfigurationStore = configurationStore; this.identityProviderConfigDiscoverer = identityProviderConfigDiscoverer; this.urlBuilder = urlBuilder; @@ -59,9 +61,7 @@ public async Task ExecuteAsync(NancyContext context, IResponseFormatte if (string.IsNullOrWhiteSpace(postLoginRedirectTo) == false) state = postLoginRedirectTo; - string[] whitelist = null; - if (Debugger.IsAttached) - whitelist = new[] { "http://localhost", "https://localhost" }; + var whitelist = webPortalConfigurationStore.GetTrustedRedirectUrls(); if (!Requests.IsLocalUrl(directoryPathResult.Path, state, whitelist)) { diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config index 6228087..5be18c6 100644 --- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config +++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/packages.config @@ -11,7 +11,7 @@ - +