From 84f64f87546210df57aebdb2ddb2d94f746155f8 Mon Sep 17 00:00:00 2001
From: Michael Noonan <michaelnoonan@gmail.com>
Date: Tue, 1 Nov 2016 13:56:55 +1000
Subject: [PATCH 1/3] Use RNGCryptoServiceProvider for nonce.

Best practices FTW.
---
 .../Infrastructure/Nonce.cs                                 | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Infrastructure/Nonce.cs b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Infrastructure/Nonce.cs
index c5ce825..17806b6 100644
--- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Infrastructure/Nonce.cs
+++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Infrastructure/Nonce.cs
@@ -6,9 +6,13 @@ namespace Octopus.Server.Extensibility.Authentication.OpenIDConnect.Infrastructu
 {
     public static class Nonce
     {
+        static readonly RNGCryptoServiceProvider Rng = new RNGCryptoServiceProvider();
+
         public static string Generate()
         {
-            var nonce = Guid.NewGuid().ToString("N");
+            var data = new byte[16];
+            Rng.GetNonZeroBytes(data);
+            var nonce = Convert.ToBase64String(data);
             return nonce;
         }
 

From a7a3ebdf20b490072b95515ceb03ba1f64e93f14 Mon Sep 17 00:00:00 2001
From: Michael Noonan <michaelnoonan@gmail.com>
Date: Tue, 1 Nov 2016 14:13:33 +1000
Subject: [PATCH 2/3] Enable ValidateActor and ValidateIssuerSigningKey

---
 .../Tokens/OpenIDConnectAuthTokenHandler.cs                     | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Tokens/OpenIDConnectAuthTokenHandler.cs b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Tokens/OpenIDConnectAuthTokenHandler.cs
index fac4cc9..842bbe7 100644
--- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Tokens/OpenIDConnectAuthTokenHandler.cs
+++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Tokens/OpenIDConnectAuthTokenHandler.cs
@@ -64,6 +64,8 @@ async Task<ClaimsPrincipleContainer> GetPrincipalFromToken(string accessToken, s
 
             var validationParameters = new TokenValidationParameters
             {
+                ValidateActor = true,
+                ValidateIssuerSigningKey = true,
                 ValidAudience = issuer + "/resources",
                 ValidIssuer = issuerConfig.Issuer,
                 IssuerSigningKeyResolver = (s, securityToken, identifier, parameters) => !certificates.ContainsKey(identifier) ? null : new [] { new X509SecurityKey(certificates[identifier]) }

From 4791374381eb95e160dbba5abd4c377717d31da3 Mon Sep 17 00:00:00 2001
From: Michael Noonan <michaelnoonan@gmail.com>
Date: Tue, 1 Nov 2016 14:14:00 +1000
Subject: [PATCH 3/3] POST Build copy into extensions folder.

Makes development time experience better.
---
 ...Octopus.Server.Extensibility.Authentication.AzureAD.csproj | 3 +++
 ...opus.Server.Extensibility.Authentication.GoogleApps.csproj | 3 +++
 ...s.Server.Extensibility.Authentication.OpenIdConnect.csproj | 4 ++++
 3 files changed, 10 insertions(+)

diff --git a/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj b/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj
index cfe8abc..d272f6d 100644
--- a/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj
+++ b/source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj
@@ -152,6 +152,9 @@
     <EmbeddedResource Include="Web\Static\styles\azureAD.css" />
   </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+  <PropertyGroup>
+    <PostBuildEvent>xcopy "$(TargetDir)Octopus.Server.Extensibility.Authentication.AzureAD.*" "C:\ProgramData\Octopus\CustomExtensions" /S /Y /I /D</PostBuildEvent>
+  </PropertyGroup>
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
   <Target Name="BeforeBuild">
diff --git a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj
index fdf3a46..bd71fa6 100644
--- a/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj
+++ b/source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj
@@ -178,6 +178,9 @@
     <None Include="Web\Static\fonts\LICENSE.txt" />
   </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+  <PropertyGroup>
+    <PostBuildEvent>xcopy "$(TargetDir)Octopus.Server.Extensibility.Authentication.GoogleApps.*" "C:\ProgramData\Octopus\CustomExtensions" /S /Y /I /D</PostBuildEvent>
+  </PropertyGroup>
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
   <Target Name="BeforeBuild">
diff --git a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj
index 9675eac..4db8290 100644
--- a/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj
+++ b/source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj
@@ -151,6 +151,10 @@
     </None>
   </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+  <PropertyGroup>
+    <PostBuildEvent>xcopy "$(TargetDir)System.IdentityModel.Tokens*.dll" "C:\ProgramData\Octopus\CustomExtensions" /S /Y /I /D
+xcopy "$(TargetDir)*OpenIDConnect.dll" "C:\ProgramData\Octopus\CustomExtensions" /S /Y /I /D</PostBuildEvent>
+  </PropertyGroup>
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
   <Target Name="BeforeBuild">