Use authorization code flow with PKCE when a client secret is specified

source/Client.OctopusID/Configuration/OctopusIDConfigurationResource.cs

@@ -5,7 +5,7 @@
 namespace Octopus.Client.Extensibility.Authentication.OctopusID.Configuration
 {
     [Description("Sign in to your Octopus Server with your Octopus ID. [Learn more](https://g.octopushq.com/AuthOctopusID).")]
-    public class OctopusIDConfigurationResource : OpenIDConnectConfigurationWithClientSecretResource
+    public class OctopusIDConfigurationResource : OpenIDConnectConfigurationResource
     {
         public OctopusIDConfigurationResource()
         {

source/Client.OpenIDConnect/Client.OpenIDConnect.csproj

@@ -20,8 +20,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <None Include="..\..\LICENSE.txt" Pack="true" PackagePath=""/>
-    <None Include="..\..\build\icon.png" Pack="true" PackagePath=""/>
+    <None Include="..\..\LICENSE.txt" Pack="true" PackagePath="" />
+    <None Include="..\..\build\icon.png" Pack="true" PackagePath="" />
   </ItemGroup>
 
 </Project>

source/Client.OpenIDConnect/Configuration/OpenIDConnectConfigurationResource.cs

@@ -1,6 +1,7 @@
 using System.ComponentModel;
 using Octopus.Client.Extensibility.Attributes;
 using Octopus.Client.Extensibility.Extensions.Infrastructure.Configuration;
+using Octopus.Client.Model;
 
 namespace Octopus.Client.Extensibility.Authentication.OpenIDConnect.Configuration
 {
@@ -15,6 +16,11 @@ public class OpenIDConnectConfigurationResource : ExtensionConfigurationResource
         [Writeable]
         public string ClientId { get; set; }
 
+        [DisplayName("Client Secret")]
+        [Description("Follow our documentation to find the Client Secret for your identity provider")]
+        [Writeable]
+        public SensitiveValue ClientSecret { get; set; }
+
         [Writeable]
         [Description("Only change this if you need to change the OpenID Connect scope requested by Octopus")]
         public string Scope { get; set; }

source/Server.AzureAD/AzureADApi.cs

@@ -16,6 +16,7 @@ public AzureADApi(
         {
             Add<AzureADUserAuthenticationAction>("POST", authenticationProvider.AuthenticateUri, RouteCategory.Raw, new AnonymousWhenEnabledEndpointInvocation<IAzureADConfigurationStore>(), null, "OpenIDConnect");
             Add<AzureADUserAuthenticatedAction>("POST", configurationStore.RedirectUri, RouteCategory.Raw, new AnonymousWhenEnabledEndpointInvocation<IAzureADConfigurationStore>(), null, "OpenIDConnect");
+            Add<AzureADUserAuthenticatedPkceAction>("GET", configurationStore.RedirectUri, RouteCategory.Raw, new AnonymousWhenEnabledEndpointInvocation<IAzureADConfigurationStore>(), null, "OpenIDConnect");
         }
     }
 }

source/Server.AzureAD/AzureADExtension.cs

@@ -60,6 +60,7 @@ public override void Load(ContainerBuilder builder)
             builder.RegisterType<AzureADStaticContentFolders>().As<IContributesStaticContentFolders>().InstancePerDependency();
 
             builder.RegisterType<AzureADUserAuthenticationAction>().AsSelf().InstancePerDependency();
+            builder.RegisterType<AzureADUserAuthenticatedPkceAction>().AsSelf().InstancePerDependency();
             builder.RegisterType<AzureADUserAuthenticatedAction>().AsSelf().InstancePerDependency();
 
             builder.RegisterType<AzureADAuthenticationProvider>()

source/Server.AzureAD/Configuration/AzureADConfigurationSettings.cs

@@ -4,7 +4,7 @@
 
 namespace Octopus.Server.Extensibility.Authentication.AzureAD.Configuration
 {
-    class AzureADConfigurationSettings : OpenIdConnectConfigurationSettings<AzureADConfiguration, AzureADConfigurationResource, IAzureADConfigurationStore>, IAzureADConfigurationSettings
+    class AzureADConfigurationSettings : OpenIDConnectConfigurationSettings<AzureADConfiguration, AzureADConfigurationResource, IAzureADConfigurationStore>, IAzureADConfigurationSettings
     {
         public AzureADConfigurationSettings(IAzureADConfigurationStore configurationDocumentStore) : base(configurationDocumentStore)
         {

source/Server.AzureAD/Configuration/AzureADConfigurationStore.cs

@@ -3,7 +3,7 @@
 
 namespace Octopus.Server.Extensibility.Authentication.AzureAD.Configuration
 {
-    class AzureADConfigurationStore : OpenIdConnectConfigurationWithRoleStore<AzureADConfiguration>, IAzureADConfigurationStore
+    class AzureADConfigurationStore : OpenIDConnectConfigurationWithRoleStore<AzureADConfiguration>, IAzureADConfigurationStore
     {
         public const string SingletonId = "authentication-aad";
 

source/Server.AzureAD/Configuration/AzureADConfigureCommands.cs

@@ -7,7 +7,7 @@
 
 namespace Octopus.Server.Extensibility.Authentication.AzureAD.Configuration
 {
-    class AzureADConfigureCommands : OpenIdConnectConfigureCommands<IAzureADConfigurationStore>
+    class AzureADConfigureCommands : OpenIDConnectConfigureCommands<IAzureADConfigurationStore>
     {
         public AzureADConfigureCommands(
             ISystemLog log,

source/Server.AzureAD/Web/AzureADUserAuthenticatedAction.cs

@@ -16,26 +16,24 @@ public AzureADUserAuthenticatedAction(
             ISystemLog log,
             IAzureADAuthTokenHandler authTokenHandler,
             IAzureADPrincipalToUserResourceMapper principalToUserResourceMapper,
-            IUpdateableUserStore userStore,
             IAzureADConfigurationStore configurationStore,
             IAuthCookieCreator authCookieCreator,
             IInvalidLoginTracker loginTracker,
             ISleep sleep,
             IAzureADIdentityCreator identityCreator,
-            IClock clock,
-            IUrlEncoder encoder) :
+            IUrlEncoder encoder,
+            IUserService userService) :
             base(
                 log,
                 authTokenHandler,
                 principalToUserResourceMapper,
-                userStore,
                 configurationStore,
                 authCookieCreator,
                 loginTracker,
                 sleep,
                 identityCreator,
-                clock,
-                encoder)
+                encoder,
+                userService)
         {
         }
 

source/Server.AzureAD/Web/AzureADUserAuthenticatedPkceAction.cs

@@ -0,0 +1,47 @@
+using Octopus.Diagnostics;
+using Octopus.Server.Extensibility.Authentication.AzureAD.Configuration;
+using Octopus.Server.Extensibility.Authentication.AzureAD.Identities;
+using Octopus.Server.Extensibility.Authentication.AzureAD.Infrastructure;
+using Octopus.Server.Extensibility.Authentication.AzureAD.Tokens;
+using Octopus.Server.Extensibility.Authentication.HostServices;
+using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Common.Issuer;
+using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Common.Web;
+using Octopus.Server.Extensibility.HostServices.Web;
+using Octopus.Server.Extensibility.Mediator;
+using Octopus.Time;
+
+namespace Octopus.Server.Extensibility.Authentication.AzureAD.Web
+{
+    class AzureADUserAuthenticatedPkceAction : UserAuthenticatedPkceAction<IAzureADConfigurationStore, IAzureADAuthTokenHandler, IAzureADIdentityCreator>
+    {
+        public AzureADUserAuthenticatedPkceAction(
+            ISystemLog log,
+            IAzureADAuthTokenHandler authTokenHandler,
+            IAzureADPrincipalToUserResourceMapper principalToUserResourceMapper,
+            IAzureADConfigurationStore configurationStore,
+            IAuthCookieCreator authCookieCreator,
+            IInvalidLoginTracker loginTracker,
+            ISleep sleep,
+            IAzureADIdentityCreator identityCreator,
+            IUrlEncoder encoder,
+            IIdentityProviderConfigDiscoverer identityProviderConfigDiscoverer,
+            IMediator mediator,
+            IUserService service)
+            : base(log,
+                authTokenHandler,
+                principalToUserResourceMapper,
+                configurationStore,
+                authCookieCreator,
+                loginTracker,
+                sleep,
+                identityCreator,
+                encoder,
+                identityProviderConfigDiscoverer,
+                mediator,
+                service)
+        {
+        }
+
+        protected override string ProviderName => AzureADAuthenticationProvider.ProviderName;
+    }
+}

source/Server.AzureAD/Web/AzureADUserAuthenticationAction.cs

@@ -5,6 +5,7 @@
 using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Common.Issuer;
 using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Common.Web;
 using Octopus.Server.Extensibility.Extensions.Infrastructure.Web.Api;
+using Octopus.Server.Extensibility.Mediator;
 
 namespace Octopus.Server.Extensibility.Authentication.AzureAD.Web
 {
@@ -16,7 +17,8 @@ public AzureADUserAuthenticationAction(
             IIdentityProviderConfigDiscoverer identityProviderConfigDiscoverer,
             IAzureADAuthorizationEndpointUrlBuilder urlBuilder,
             IApiActionModelBinder modelBinder,
-            IAuthenticationConfigurationStore authenticationConfigurationStore) : base(log, configurationStore, identityProviderConfigDiscoverer, urlBuilder, modelBinder, authenticationConfigurationStore)
+            IAuthenticationConfigurationStore authenticationConfigurationStore,
+            IMediator mediator) : base(log, configurationStore, identityProviderConfigDiscoverer, urlBuilder, modelBinder, authenticationConfigurationStore, mediator)
         {
         }
     }

source/Server.GoogleApps/Configuration/GoogleAppsConfigurationSettings.cs

@@ -4,7 +4,7 @@
 
 namespace Octopus.Server.Extensibility.Authentication.GoogleApps.Configuration
 {
-    class GoogleAppsConfigurationSettings : OpenIdConnectConfigurationSettings<GoogleAppsConfiguration, GoogleAppsConfigurationResource, IGoogleAppsConfigurationStore>, IGoogleAppsConfigurationSettings
+    class GoogleAppsConfigurationSettings : OpenIDConnectConfigurationSettings<GoogleAppsConfiguration, GoogleAppsConfigurationResource, IGoogleAppsConfigurationStore>, IGoogleAppsConfigurationSettings
     {
         public GoogleAppsConfigurationSettings(IGoogleAppsConfigurationStore configurationDocumentStore) : base(configurationDocumentStore)
         {

source/Server.GoogleApps/Configuration/GoogleAppsConfigurationStore.cs

@@ -3,7 +3,7 @@
 
 namespace Octopus.Server.Extensibility.Authentication.GoogleApps.Configuration
 {
-    class GoogleAppsConfigurationStore : OpenIdConnectConfigurationStore<GoogleAppsConfiguration>, IGoogleAppsConfigurationStore
+    class GoogleAppsConfigurationStore : OpenIDConnectConfigurationStore<GoogleAppsConfiguration>, IGoogleAppsConfigurationStore
     {
         public const string SingletonId = "authentication-googleapps";
 

source/Server.GoogleApps/Configuration/GoogleAppsConfigureCommands.cs

@@ -7,7 +7,7 @@
 
 namespace Octopus.Server.Extensibility.Authentication.GoogleApps.Configuration
 {
-    class GoogleAppsConfigureCommands : OpenIdConnectConfigureCommands<IGoogleAppsConfigurationStore>
+    class GoogleAppsConfigureCommands : OpenIDConnectConfigureCommands<IGoogleAppsConfigurationStore>
     {
         public GoogleAppsConfigureCommands(
             ISystemLog log,

source/Server.GoogleApps/GoogleAppsApi.cs

@@ -16,6 +16,7 @@ public GoogleAppsApi(
         {
             Add<GoogleAppsUserAuthenticationAction>("POST", authenticationProvider.AuthenticateUri, RouteCategory.Raw, new AnonymousWhenEnabledEndpointInvocation<IGoogleAppsConfigurationStore>(), null, "OpenIDConnect");
             Add<GoogleAppsUserAuthenticatedAction>("POST", configurationStore.RedirectUri, RouteCategory.Raw, new AnonymousWhenEnabledEndpointInvocation<IGoogleAppsConfigurationStore>(), null, "OpenIDConnect");
+            Add<GoogleAppsUserAuthenticatedPkceAction>("GET", configurationStore.RedirectUri, RouteCategory.Raw, new AnonymousWhenEnabledEndpointInvocation<IGoogleAppsConfigurationStore>(), null, "OpenIDConnect");
         }
     }
 }

source/Server.GoogleApps/GoogleAppsExtension.cs

@@ -58,6 +58,7 @@ public override void Load(ContainerBuilder builder)
             builder.RegisterType<GoogleKeyRetriever>().As<IGoogleKeyRetriever>().SingleInstance();
 
             builder.RegisterType<GoogleAppsUserAuthenticationAction>().AsSelf().InstancePerDependency();
+            builder.RegisterType<GoogleAppsUserAuthenticatedPkceAction>().AsSelf().InstancePerDependency();
             builder.RegisterType<GoogleAppsUserAuthenticatedAction>().AsSelf().InstancePerDependency();
 
             builder.RegisterType<GoogleAppsAuthenticationProvider>()

source/Server.GoogleApps/Issuer/GoogleAppsAuthorizationEndpointUrlBuilder.cs

@@ -11,9 +11,9 @@ public GoogleAppsAuthorizationEndpointUrlBuilder(IGoogleAppsConfigurationStore c
         {
         }
 
-        public override string Build(string requestDirectoryPath, IssuerConfiguration issuerConfiguration, string nonce, string? state = null)
+        public override string Build(string requestDirectoryPath, IssuerConfiguration issuerConfiguration, string? nonce = null, string? state = null, string? codeChallenge = null)
         {
-            var url = base.Build(requestDirectoryPath, issuerConfiguration, nonce, state);
+            var url = base.Build(requestDirectoryPath, issuerConfiguration, nonce, state, codeChallenge);
 
             var hd = ConfigurationStore.GetHostedDomain();
             if (!string.IsNullOrWhiteSpace(hd))

source/Server.GoogleApps/Web/GoogleAppsUserAuthenticatedAction.cs

@@ -17,14 +17,24 @@ public GoogleAppsUserAuthenticatedAction(
             ISystemLog log,
             IGoogleAuthTokenHandler authTokenHandler,
             IPrincipalToUserResourceMapper principalToUserResourceMapper,
-            IUpdateableUserStore userStore,
             IGoogleAppsConfigurationStore configurationStore,
             IAuthCookieCreator authCookieCreator,
             IInvalidLoginTracker loginTracker,
             ISleep sleep,
             IGoogleAppsIdentityCreator identityCreator,
-            IClock clock, IUrlEncoder encoder)
-            : base(log, authTokenHandler, principalToUserResourceMapper, userStore, configurationStore, authCookieCreator, loginTracker, sleep, identityCreator, clock, encoder)
+            IUrlEncoder encoder,
+            IUserService userService) :
+            base(
+                log,
+                authTokenHandler,
+                principalToUserResourceMapper,
+                configurationStore,
+                authCookieCreator,
+                loginTracker,
+                sleep,
+                identityCreator,
+                encoder,
+                userService)
         {
         }
 

source/Server.GoogleApps/Web/GoogleAppsUserAuthenticatedPkceAction.cs

@@ -0,0 +1,48 @@
+using Octopus.Diagnostics;
+using Octopus.Server.Extensibility.Authentication.GoogleApps.Configuration;
+using Octopus.Server.Extensibility.Authentication.GoogleApps.Identities;
+using Octopus.Server.Extensibility.Authentication.GoogleApps.Tokens;
+using Octopus.Server.Extensibility.Authentication.HostServices;
+using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Common.Infrastructure;
+using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Common.Issuer;
+using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Common.Web;
+using Octopus.Server.Extensibility.HostServices.Web;
+using Octopus.Server.Extensibility.Mediator;
+using Octopus.Time;
+
+namespace Octopus.Server.Extensibility.Authentication.GoogleApps.Web
+{
+    class GoogleAppsUserAuthenticatedPkceAction
+        : UserAuthenticatedPkceAction<IGoogleAppsConfigurationStore, IGoogleAuthTokenHandler, IGoogleAppsIdentityCreator>
+    {
+        public GoogleAppsUserAuthenticatedPkceAction(
+            ISystemLog log,
+            IGoogleAuthTokenHandler authTokenHandler,
+            IPrincipalToUserResourceMapper principalToUserResourceMapper,
+            IGoogleAppsConfigurationStore configurationStore,
+            IAuthCookieCreator authCookieCreator,
+            IInvalidLoginTracker loginTracker,
+            ISleep sleep,
+            IGoogleAppsIdentityCreator identityCreator,
+            IUrlEncoder encoder,
+            IIdentityProviderConfigDiscoverer identityProviderConfigDiscoverer,
+            IMediator mediator,
+            IUserService service)
+            : base(log,
+                authTokenHandler,
+                principalToUserResourceMapper,
+                configurationStore,
+                authCookieCreator,
+                loginTracker,
+                sleep,
+                identityCreator,
+                encoder,
+                identityProviderConfigDiscoverer,
+                mediator,
+                service)
+        {
+        }
+
+        protected override string ProviderName => GoogleAppsAuthenticationProvider.ProviderName;
+    }
+}

source/Server.GoogleApps/Web/GoogleAppsUserAuthenticationAction.cs

@@ -5,6 +5,7 @@
 using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Common.Issuer;
 using Octopus.Server.Extensibility.Authentication.OpenIDConnect.Common.Web;
 using Octopus.Server.Extensibility.Extensions.Infrastructure.Web.Api;
+using Octopus.Server.Extensibility.Mediator;
 
 namespace Octopus.Server.Extensibility.Authentication.GoogleApps.Web
 {
@@ -16,8 +17,9 @@ public GoogleAppsUserAuthenticationAction(
             IIdentityProviderConfigDiscoverer identityProviderConfigDiscoverer,
             IGoogleAppsAuthorizationEndpointUrlBuilder urlBuilder,
             IApiActionModelBinder modelBinder,
-            IAuthenticationConfigurationStore authenticationConfigurationStore)
-                : base(log, configurationStore, identityProviderConfigDiscoverer, urlBuilder, modelBinder, authenticationConfigurationStore)
+            IAuthenticationConfigurationStore authenticationConfigurationStore,
+            IMediator mediator)
+                : base(log, configurationStore, identityProviderConfigDiscoverer, urlBuilder, modelBinder, authenticationConfigurationStore, mediator)
         {
         }
     }

source/Server.OctopusID/Configuration/IOctopusIDConfigurationStore.cs

@@ -2,8 +2,7 @@
 
 namespace Octopus.Server.Extensibility.Authentication.OctopusID.Configuration
 {
-    interface IOctopusIDConfigurationStore : IOpenIDConnectWithClientSecretConfigurationStore<OctopusIDConfiguration>, 
-        IOpenIDConnectConfigurationWithRoleStore<OctopusIDConfiguration>
+    interface IOctopusIDConfigurationStore : IOpenIDConnectConfigurationWithRoleStore<OctopusIDConfiguration>
     {
     }
 }

source/Server.OctopusID/Configuration/OctopusIDConfiguration.cs

@@ -2,7 +2,7 @@
 
 namespace Octopus.Server.Extensibility.Authentication.OctopusID.Configuration
 {
-    class OctopusIDConfiguration : OpenIDConnectConfigurationWithClientSecret, IOpenIDConnectConfigurationWithRole
+    class OctopusIDConfiguration : OpenIDConnectConfiguration, IOpenIDConnectConfigurationWithRole
     {
         public static string DefaultRoleClaimType = "roles";
 

source/Server.OctopusID/Configuration/OctopusIDConfigurationResource.cs

@@ -6,7 +6,7 @@
 namespace Octopus.Server.Extensibility.Authentication.OctopusID.Configuration
 {
     [Description("Sign in to your Octopus Server with an Octopus ID. [Learn more](https://g.octopushq.com/AuthOctopusID).")]
-    class OctopusIDConfigurationResource : OpenIDConnectConfigurationWithClientSecretResource
+    class OctopusIDConfigurationResource : OpenIDConnectConfigurationResource
     {
         [Writeable]
         public override string? Issuer { get; set; }

source/Server.OctopusID/Configuration/OctopusIDConfigurationSettings.cs

@@ -5,7 +5,7 @@
 
 namespace Octopus.Server.Extensibility.Authentication.OctopusID.Configuration
 {
-    class OctopusIDConfigurationSettings : OpenIdConnectConfigurationSettings<OctopusIDConfiguration, OctopusIDConfigurationResource, IOctopusIDConfigurationStore>, IOctopusIDConfigurationSettings
+    class OctopusIDConfigurationSettings : OpenIDConnectConfigurationSettings<OctopusIDConfiguration, OctopusIDConfigurationResource, IOctopusIDConfigurationStore>, IOctopusIDConfigurationSettings
     {
         public OctopusIDConfigurationSettings(IOctopusIDConfigurationStore configurationDocumentStore) : base(configurationDocumentStore)
         {

source/Server.OctopusID/Configuration/OctopusIDConfigurationStore.cs

@@ -3,7 +3,7 @@
 
 namespace Octopus.Server.Extensibility.Authentication.OctopusID.Configuration
 {
-    class OctopusIDConfigurationStore : OpenIDConnectWithClientSecretConfigurationStore<OctopusIDConfiguration>, IOctopusIDConfigurationStore
+    class OctopusIDConfigurationStore : OpenIDConnectConfigurationStore<OctopusIDConfiguration>, IOctopusIDConfigurationStore
     {
         public const string SingletonId = "authentication-octopusid";