Security Review

source/Octopus.Server.Extensibility.Authentication.AzureAD/Octopus.Server.Extensibility.Authentication.AzureAD.csproj

@@ -152,6 +152,9 @@
     <EmbeddedResource Include="Web\Static\styles\azureAD.css" />
   </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+  <PropertyGroup>
+    <PostBuildEvent>xcopy "$(TargetDir)Octopus.Server.Extensibility.Authentication.AzureAD.*" "C:\ProgramData\Octopus\CustomExtensions" /S /Y /I /D</PostBuildEvent>
+  </PropertyGroup>
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
   <Target Name="BeforeBuild">

source/Octopus.Server.Extensibility.Authentication.GoogleApps/Octopus.Server.Extensibility.Authentication.GoogleApps.csproj

@@ -178,6 +178,9 @@
     <None Include="Web\Static\fonts\LICENSE.txt" />
   </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+  <PropertyGroup>
+    <PostBuildEvent>xcopy "$(TargetDir)Octopus.Server.Extensibility.Authentication.GoogleApps.*" "C:\ProgramData\Octopus\CustomExtensions" /S /Y /I /D</PostBuildEvent>
+  </PropertyGroup>
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
   <Target Name="BeforeBuild">

source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Infrastructure/Nonce.cs

@@ -6,9 +6,13 @@ namespace Octopus.Server.Extensibility.Authentication.OpenIDConnect.Infrastructu
 {
     public static class Nonce
     {
+        static readonly RNGCryptoServiceProvider Rng = new RNGCryptoServiceProvider();
+
         public static string Generate()
         {
-            var nonce = Guid.NewGuid().ToString("N");
+            var data = new byte[16];
+            Rng.GetNonZeroBytes(data);
+            var nonce = Convert.ToBase64String(data);
             return nonce;
         }
 

source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Octopus.Server.Extensibility.Authentication.OpenIdConnect.csproj

@@ -151,6 +151,10 @@
     </None>
   </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+  <PropertyGroup>
+    <PostBuildEvent>xcopy "$(TargetDir)System.IdentityModel.Tokens*.dll" "C:\ProgramData\Octopus\CustomExtensions" /S /Y /I /D
+xcopy "$(TargetDir)*OpenIDConnect.dll" "C:\ProgramData\Octopus\CustomExtensions" /S /Y /I /D</PostBuildEvent>
+  </PropertyGroup>
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
   <Target Name="BeforeBuild">

source/Octopus.Server.Extensibility.Authentication.OpenIDConnect/Tokens/OpenIDConnectAuthTokenHandler.cs

@@ -64,6 +64,8 @@ async Task<ClaimsPrincipleContainer> GetPrincipalFromToken(string accessToken, s
 
             var validationParameters = new TokenValidationParameters
             {
+                ValidateActor = true,
+                ValidateIssuerSigningKey = true,
                 ValidAudience = issuer + "/resources",
                 ValidIssuer = issuerConfig.Issuer,
                 IssuerSigningKeyResolver = (s, securityToken, identifier, parameters) => !certificates.ContainsKey(identifier) ? null : new [] { new X509SecurityKey(certificates[identifier]) }