Merge branch 'nightlyBuild'

6 files changed, 109 insertions, 19 deletions

diff --git a/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/data/VerificationResult.java b/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/data/VerificationResult.java
index bb0c41d7..0f88e251 100644
--- a/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/data/VerificationResult.java
+++ b/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/data/VerificationResult.java
@@ -9,6 +9,7 @@ public class VerificationResult {
 
   private Boolean validSigned = null;
   private List<X509Certificate> certs = null;
+  private JsonNode header = null;
   private JsonNode payload = null;
 
   public VerificationResult(final JsonNode payload) {
@@ -19,11 +20,14 @@ public class VerificationResult {
   /**
    * JWS signature verification-result container.
    * 
+   * @param joseHeader JWS header
    * @param payload JWS payload
    * @param certs JWS signercertificate
    * @param wasValidSigned true if signature was valid
    */
-  public VerificationResult(final JsonNode payload, final List<X509Certificate> certs, final boolean wasValidSigned) {
+  public VerificationResult(final JsonNode joseHeader, final JsonNode payload, 
+      final List<X509Certificate> certs, final boolean wasValidSigned) {
+    this.header = joseHeader;
     this.payload = payload;
     this.certs = certs;
     this.validSigned = wasValidSigned;
@@ -42,4 +46,8 @@ public class VerificationResult {
     return payload;
   }
 
+  public JsonNode getJoseHeader() {
+    return header;
+    
+  }
 }
diff --git a/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/tasks/AbstractCreateQualEidRequestTask.java b/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/tasks/AbstractCreateQualEidRequestTask.java
index d1887d5c..6a5e1ef0 100644
--- a/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/tasks/AbstractCreateQualEidRequestTask.java
+++ b/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/tasks/AbstractCreateQualEidRequestTask.java
@@ -1,5 +1,6 @@
 package at.gv.egiz.eaaf.modules.auth.sl20.tasks;
 
+import java.io.Serializable;
 import java.security.cert.CertificateEncodingException;
 import java.util.ArrayList;
 import java.util.List;
@@ -28,8 +29,8 @@ import at.gv.egiz.eaaf.core.api.idp.ISpConfiguration;
 import at.gv.egiz.eaaf.core.api.idp.process.ExecutionContext;
 import at.gv.egiz.eaaf.core.exceptions.EaafAuthenticationException;
 import at.gv.egiz.eaaf.core.exceptions.TaskExecutionException;
+import at.gv.egiz.eaaf.core.impl.http.IHttpClientFactory;
 import at.gv.egiz.eaaf.core.impl.idp.auth.modules.AbstractAuthServletTask;
-import at.gv.egiz.eaaf.core.impl.utils.IHttpClientFactory;
 import at.gv.egiz.eaaf.core.impl.utils.KeyValueUtils;
 import at.gv.egiz.eaaf.core.impl.utils.Random;
 import at.gv.egiz.eaaf.core.impl.utils.TransactionIdUtils;
@@ -39,6 +40,7 @@ import at.gv.egiz.eaaf.modules.auth.sl20.data.VerificationResult;
 import at.gv.egiz.eaaf.modules.auth.sl20.exceptions.SL20Exception;
 import at.gv.egiz.eaaf.modules.auth.sl20.exceptions.SlCommandoParserException;
 import at.gv.egiz.eaaf.modules.auth.sl20.utils.SL20Constants;
+import at.gv.egiz.eaaf.modules.auth.sl20.utils.SL20Constants.VdaAuthMethod;
 import at.gv.egiz.eaaf.modules.auth.sl20.utils.SL20HttpBindingUtils;
 import at.gv.egiz.eaaf.modules.auth.sl20.utils.SL20JsonBuilderUtils;
 import at.gv.egiz.eaaf.modules.auth.sl20.utils.SL20JsonExtractorUtils;
@@ -95,6 +97,15 @@ public abstract class AbstractCreateQualEidRequestTask extends AbstractAuthServl
       final List<NameValuePair> parameters = new ArrayList<>();
       parameters.add(new BasicNameValuePair(SL20Constants.PARAM_SL20_REQ_COMMAND_PARAM,
           Base64Url.encode(sl20Req.toString().getBytes("UTF-8"))));
+      
+      //set specific authentication method if it was selection by process step before
+      VdaAuthMethod authMethod = getVdaAuthMethodFromContext(executionContext);
+      if (authMethod != null) {
+        log.debug("Request VDA with authType: {}", authMethod);
+        parameters.add(new BasicNameValuePair(SL20Constants.PARAM_SL20_REQ_AUTH_METHOD_PARAM,
+            authMethod.getAuthMethod()));
+      }
+      
       httpReq.setEntity(new UrlEncodedFormEntity(parameters));
 
       // build http GET request
@@ -191,6 +202,13 @@ public abstract class AbstractCreateQualEidRequestTask extends AbstractAuthServl
   }
 
   /**
+   * Get ExecutionContext parameter-key for VDA AuthMethod information. 
+   * 
+   * @return Key to get AuthMethod from {@link ExecutionContext}
+   */
+  protected abstract String getAuthMethodContextParamKey();
+
+  /**
    * Create a implementation specific qualified eID SL2.0 command
    *
    * @param oaConfig
@@ -201,6 +219,18 @@ public abstract class AbstractCreateQualEidRequestTask extends AbstractAuthServl
    */
   protected abstract String buildSignedQualifiedEidCommand() throws CertificateEncodingException, SL20Exception;
 
+  
+  private VdaAuthMethod getVdaAuthMethodFromContext(ExecutionContext executionContext) {
+    Serializable authMethodRaw = executionContext.get(getAuthMethodContextParamKey());
+    if (authMethodRaw instanceof String) {
+      log.trace("Find authMethod parameter: {} on context", authMethodRaw);
+      return VdaAuthMethod.fromString((String) authMethodRaw);
+      
+    }
+    
+    return null;
+  }
+  
   private String extractVdaUrlForSpecificOa(final ISpConfiguration oaConfig, final ExecutionContext executionContext) {
 
     // load SP specific config for development and testing purposes
diff --git a/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/JsonSecurityUtils.java b/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/JsonSecurityUtils.java
index 1b1f090f..43c44647 100644
--- a/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/JsonSecurityUtils.java
+++ b/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/JsonSecurityUtils.java
@@ -13,22 +13,6 @@ import java.util.List;
 import javax.annotation.Nonnull;
 import javax.annotation.PostConstruct;
 
-import at.gv.egiz.eaaf.core.api.idp.IConfiguration;
-import at.gv.egiz.eaaf.core.exception.EaafKeyAccessException;
-import at.gv.egiz.eaaf.core.exceptions.EaafConfigurationException;
-import at.gv.egiz.eaaf.core.impl.credential.EaafKeyStoreFactory;
-import at.gv.egiz.eaaf.core.impl.credential.EaafKeyStoreUtils;
-import at.gv.egiz.eaaf.core.impl.credential.KeyStoreConfiguration;
-import at.gv.egiz.eaaf.core.impl.credential.KeyStoreConfiguration.KeyStoreType;
-import at.gv.egiz.eaaf.core.impl.data.Pair;
-import at.gv.egiz.eaaf.core.impl.utils.X509Utils;
-import at.gv.egiz.eaaf.modules.auth.sl20.Constants;
-import at.gv.egiz.eaaf.modules.auth.sl20.data.VerificationResult;
-import at.gv.egiz.eaaf.modules.auth.sl20.exceptions.SL20Exception;
-import at.gv.egiz.eaaf.modules.auth.sl20.exceptions.SL20SecurityException;
-import at.gv.egiz.eaaf.modules.auth.sl20.exceptions.SlCommandoBuildException;
-import at.gv.egiz.eaaf.modules.auth.sl20.exceptions.SlCommandoParserException;
-
 import org.apache.commons.lang3.StringUtils;
 import org.jose4j.jca.ProviderContext;
 import org.jose4j.jwa.AlgorithmConstraints;
@@ -50,6 +34,22 @@ import org.springframework.util.Base64Utils;
 import com.fasterxml.jackson.core.JsonParseException;
 import com.fasterxml.jackson.databind.JsonNode;
 
+import at.gv.egiz.eaaf.core.api.idp.IConfiguration;
+import at.gv.egiz.eaaf.core.exception.EaafKeyAccessException;
+import at.gv.egiz.eaaf.core.exceptions.EaafConfigurationException;
+import at.gv.egiz.eaaf.core.impl.credential.EaafKeyStoreFactory;
+import at.gv.egiz.eaaf.core.impl.credential.EaafKeyStoreUtils;
+import at.gv.egiz.eaaf.core.impl.credential.KeyStoreConfiguration;
+import at.gv.egiz.eaaf.core.impl.credential.KeyStoreConfiguration.KeyStoreType;
+import at.gv.egiz.eaaf.core.impl.data.Pair;
+import at.gv.egiz.eaaf.core.impl.utils.X509Utils;
+import at.gv.egiz.eaaf.modules.auth.sl20.Constants;
+import at.gv.egiz.eaaf.modules.auth.sl20.data.VerificationResult;
+import at.gv.egiz.eaaf.modules.auth.sl20.exceptions.SL20Exception;
+import at.gv.egiz.eaaf.modules.auth.sl20.exceptions.SL20SecurityException;
+import at.gv.egiz.eaaf.modules.auth.sl20.exceptions.SlCommandoBuildException;
+import at.gv.egiz.eaaf.modules.auth.sl20.exceptions.SlCommandoParserException;
+
 @Service
 public class JsonSecurityUtils implements IJoseTools {
   private static final Logger log = LoggerFactory.getLogger(JsonSecurityUtils.class);
@@ -230,7 +230,10 @@ public class JsonSecurityUtils implements IJoseTools {
     jws.setKey(selectedKey);
 
     // load payLoad
-    return new VerificationResult(mapper.getMapper().readTree(jws.getPayload()), null, jws.verifySignature());
+    return new VerificationResult(
+        mapper.getMapper().readTree(jws.getHeaders().getFullHeaderAsJsonString()), 
+        mapper.getMapper().readTree(jws.getPayload()), 
+        x5cCerts, jws.verifySignature());
 
   }
 
diff --git a/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/SL20Constants.java b/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/SL20Constants.java
index 01316b9b..bfc393db 100644
--- a/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/SL20Constants.java
+++ b/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/SL20Constants.java
@@ -4,6 +4,8 @@ import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+
 import org.jose4j.jwe.ContentEncryptionAlgorithmIdentifiers;
 import org.jose4j.jwe.KeyManagementAlgorithmIdentifiers;
 import org.jose4j.jws.AlgorithmIdentifiers;
@@ -11,10 +13,54 @@ import org.jose4j.jws.AlgorithmIdentifiers;
 public class SL20Constants {
   public static final int CURRENT_SL20_VERSION = 10;
 
+  
   // http binding parameters
   public static final String PARAM_SL20_REQ_COMMAND_PARAM = "slcommand";
   public static final String PARAM_SL20_REQ_COMMAND_PARAM_OLD = "sl2command";
 
+  public static final String PARAM_SL20_REQ_AUTH_METHOD_PARAM = "authtype";
+  
+  public enum VdaAuthMethod {
+    ANY("any"), MOBILEPHONE("handy"), CARD("card"), SMARTPHONE("smartphone");
+
+    private final String authMethod;
+
+    VdaAuthMethod(final String method) {
+      this.authMethod = method;
+    }
+
+    /**
+     * Get VDA AuthMethod.
+     *
+     * @return
+     */
+    public String getAuthMethod() {
+      return this.authMethod;
+    }
+
+    /**
+     * Get VDA authmethod from String representation.
+     *
+     * @param s authMethod parameter
+     * @return AuthMethod, or VdaAuthMethod.ANY if the parameter is unknown
+     */
+    public static VdaAuthMethod fromString(@Nonnull final String s) {
+      try {
+        return VdaAuthMethod.valueOf(s.toUpperCase());
+
+      } catch (IllegalArgumentException | NullPointerException e) {
+        return VdaAuthMethod.ANY;
+        
+      }
+    }
+
+    @Override
+    public String toString() {
+      return getAuthMethod();
+
+    }
+  }
+  
   public static final String PARAM_SL20_REQ_ICP_RETURN_URL_PARAM = "slIPCReturnUrl";
   public static final String PARAM_SL20_REQ_TRANSACTIONID = "slTransactionID";
 
diff --git a/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/SL20JsonBuilderUtils.java b/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/SL20JsonBuilderUtils.java
index eb17781b..d76f4aad 100644
--- a/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/SL20JsonBuilderUtils.java
+++ b/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/SL20JsonBuilderUtils.java
@@ -105,6 +105,7 @@ public class SL20JsonBuilderUtils {
    * @param name            commando name
    * @param result          commando result
    * @param encryptedResult encrypted commando result
+   * @param signer {@link JsonSecurityUtils} implementation
    * @return JWS in serialized form
    * @throws SlCommandoBuildException in case of an error
    * 
diff --git a/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/SL20JsonExtractorUtils.java b/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/SL20JsonExtractorUtils.java
index eb6de461..40ea0430 100644
--- a/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/SL20JsonExtractorUtils.java
+++ b/eaaf_modules/eaaf_module_auth_sl20/src/main/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/SL20JsonExtractorUtils.java
@@ -63,6 +63,7 @@ public class SL20JsonExtractorUtils {
    * @param input      JSON
    * @param keyID      Element identifier
    * @param isRequired true, if the element must not null
+   * @param defaultValue in case of no existing element with key
    * @return Boolean
    * @throws SlCommandoParserException In case of an error
    */
@@ -269,6 +270,7 @@ public class SL20JsonExtractorUtils {
    *
    * @param container JSON
    * @param joseTools JWS implementation
+   * @param mustBeSigned Throw an error if the result was not signed
    * @return Signature verification result that contains the payLoad
    * @throws SlCommandoParserException In case of an error
    */