Merge branch 'opensaml_4.x' into nightlyBuild

# Conflicts:
#	eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/metadata/PvpMetadataResolverAdapter.java
#	eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/SamlVerificationEngine.java
#	eaaf_modules/eaaf_module_pvp2_core/src/test/java/at/gv/egiz/eaaf/modules/pvp2/test/binding/SoapBindingTest.java
#	eaaf_modules/eaaf_module_pvp2_core/src/test/java/at/gv/egiz/eaaf/modules/pvp2/test/dummy/DummyMetadataProvider.java
#	eaaf_modules/eaaf_module_pvp2_idp/src/main/java/at/gv/egiz/eaaf/modules/pvp2/idp/impl/AbstractPvp2XProtocol.java
#	eaaf_modules/eaaf_module_pvp2_sp/src/main/java/at/gv/egiz/eaaf/modules/pvp2/sp/impl/PvpAuthnRequestBuilder.java
#	pom.xml

23 files changed, 247 insertions, 209 deletions

diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/api/metadata/IPvp2MetadataProvider.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/api/metadata/IPvp2MetadataProvider.java
index b213425d..ca3aa844 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/api/metadata/IPvp2MetadataProvider.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/api/metadata/IPvp2MetadataProvider.java
@@ -22,12 +22,12 @@ package at.gv.egiz.eaaf.modules.pvp2.api.metadata;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import org.opensaml.saml.metadata.resolver.ExtendedRefreshableMetadataResolver;
+import org.opensaml.saml.metadata.resolver.RefreshableMetadataResolver;
 import org.opensaml.saml.saml2.metadata.EntityDescriptor;
 
 import net.shibboleth.utilities.java.support.resolver.ResolverException;
 
-public interface IPvp2MetadataProvider extends ExtendedRefreshableMetadataResolver {
+public interface IPvp2MetadataProvider extends RefreshableMetadataResolver {
 
   /**
    * Get a SAML2 EntityDescriptor with an EntityId from metadata provider.
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/binding/AbstractBinding.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/binding/AbstractBinding.java
index 3543d85a..80697ee9 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/binding/AbstractBinding.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/binding/AbstractBinding.java
@@ -2,29 +2,12 @@ package at.gv.egiz.eaaf.modules.pvp2.impl.binding;
 
 import javax.xml.namespace.QName;
 
-import at.gv.egiz.eaaf.core.api.idp.IConfiguration;
-import at.gv.egiz.eaaf.modules.pvp2.api.credential.EaafX509Credential;
-import at.gv.egiz.eaaf.modules.pvp2.api.message.InboundMessageInterface;
-import at.gv.egiz.eaaf.modules.pvp2.api.metadata.IPvp2MetadataProvider;
-import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2Exception;
-import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2InternalErrorException;
-import at.gv.egiz.eaaf.modules.pvp2.exception.SamlBindingException;
-import at.gv.egiz.eaaf.modules.pvp2.exception.SamlMessageValidationException;
-import at.gv.egiz.eaaf.modules.pvp2.exception.SamlSigningException;
-import at.gv.egiz.eaaf.modules.pvp2.impl.message.InboundMessage;
-import at.gv.egiz.eaaf.modules.pvp2.impl.message.PvpSProfileRequest;
-import at.gv.egiz.eaaf.modules.pvp2.impl.message.PvpSProfileResponse;
-import at.gv.egiz.eaaf.modules.pvp2.impl.utils.Saml2Utils;
-import at.gv.egiz.eaaf.modules.pvp2.impl.validation.TrustEngineFactory;
-import at.gv.egiz.eaaf.modules.pvp2.impl.verification.PvpSamlMessageHandlerChain;
-
 import org.opensaml.core.config.ConfigurationService;
 import org.opensaml.messaging.context.BaseContext;
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.decoder.MessageDecodingException;
 import org.opensaml.messaging.decoder.servlet.HttpServletRequestMessageDecoder;
 import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.SignableSAMLObject;
 import org.opensaml.saml.common.binding.SAMLBindingSupport;
 import org.opensaml.saml.common.binding.encoding.SAMLMessageEncoder;
@@ -48,6 +31,22 @@ import com.google.common.base.Optional;
 import com.google.common.base.Predicates;
 import com.google.common.base.Throwables;
 import com.google.common.collect.FluentIterable;
+
+import at.gv.egiz.eaaf.core.api.idp.IConfiguration;
+import at.gv.egiz.eaaf.modules.pvp2.api.credential.EaafX509Credential;
+import at.gv.egiz.eaaf.modules.pvp2.api.message.InboundMessageInterface;
+import at.gv.egiz.eaaf.modules.pvp2.api.metadata.IPvp2MetadataProvider;
+import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2Exception;
+import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2InternalErrorException;
+import at.gv.egiz.eaaf.modules.pvp2.exception.SamlBindingException;
+import at.gv.egiz.eaaf.modules.pvp2.exception.SamlMessageValidationException;
+import at.gv.egiz.eaaf.modules.pvp2.exception.SamlSigningException;
+import at.gv.egiz.eaaf.modules.pvp2.impl.message.InboundMessage;
+import at.gv.egiz.eaaf.modules.pvp2.impl.message.PvpSProfileRequest;
+import at.gv.egiz.eaaf.modules.pvp2.impl.message.PvpSProfileResponse;
+import at.gv.egiz.eaaf.modules.pvp2.impl.utils.Saml2Utils;
+import at.gv.egiz.eaaf.modules.pvp2.impl.validation.TrustEngineFactory;
+import at.gv.egiz.eaaf.modules.pvp2.impl.verification.PvpSamlMessageHandlerChain;
 import lombok.extern.slf4j.Slf4j;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 
@@ -65,8 +64,8 @@ public abstract class AbstractBinding {
 
   public abstract String getSaml2BindingName();
 
-  protected MessageContext<SAMLObject> internalMessageDecode(
-      HttpServletRequestMessageDecoder<SAMLObject> decoder,
+  protected MessageContext internalMessageDecode(
+      HttpServletRequestMessageDecoder decoder,
       String binding) throws Pvp2Exception {
     try {
       decoder.initialize();
@@ -97,9 +96,9 @@ public abstract class AbstractBinding {
 
   }
 
-  protected MessageContext<SAMLObject> buildBasicMessageContext(
+  protected MessageContext buildBasicMessageContext(
       SAMLMessageEncoder encoder, SignableSAMLObject response) {
-    final MessageContext<SAMLObject> messageContext = new MessageContext<>();
+    final MessageContext messageContext = new MessageContext();
     messageContext.setMessage(response);
     encoder.setMessageContext(messageContext);
     return messageContext;
@@ -139,7 +138,7 @@ public abstract class AbstractBinding {
 
   }
 
-  protected void injectInboundMessageContexts(MessageContext<SAMLObject> messageContext,
+  protected void injectInboundMessageContexts(MessageContext messageContext,
       IPvp2MetadataProvider metadataProvider, QName peerEntityRole) throws Pvp2InternalErrorException {
     final SAMLPeerEntityContext peerEntityContext = new SAMLPeerEntityContext();
     peerEntityContext.setRole(peerEntityRole);
@@ -164,7 +163,7 @@ public abstract class AbstractBinding {
   }
 
   protected void performMessageValidation(PvpSamlMessageHandlerChain messageValidatorChain,
-      MessageContext<SAMLObject> messageContext) throws Pvp2Exception {
+      MessageContext messageContext) throws Pvp2Exception {
     try {
       messageValidatorChain.initialize();
       messageValidatorChain.invoke(messageContext);
@@ -191,7 +190,7 @@ public abstract class AbstractBinding {
   }
 
   protected InboundMessageInterface performMessageDecodePostProcessing(
-      MessageContext<SAMLObject> messageContext, boolean isVerified) {
+      MessageContext messageContext, boolean isVerified) {
     InboundMessage msg = null;
     if (messageContext.getMessage() instanceof RequestAbstractType) {
       final RequestAbstractType inboundMessage =
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/binding/PostBinding.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/binding/PostBinding.java
index c679de20..829f771a 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/binding/PostBinding.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/binding/PostBinding.java
@@ -23,6 +23,17 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.xml.namespace.QName;
 
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.saml.common.binding.SAMLBindingSupport;
+import org.opensaml.saml.common.binding.impl.CheckMessageVersionHandler;
+import org.opensaml.saml.common.binding.security.impl.MessageLifetimeSecurityHandler;
+import org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler;
+import org.opensaml.saml.common.messaging.SAMLMessageSecuritySupport;
+import org.opensaml.saml.common.xml.SAMLConstants;
+import org.opensaml.saml.saml2.core.RequestAbstractType;
+import org.opensaml.saml.saml2.core.StatusResponseType;
+import org.springframework.beans.factory.annotation.Autowired;
+
 import at.gv.egiz.eaaf.core.api.IRequest;
 import at.gv.egiz.eaaf.core.api.gui.IGuiBuilderConfigurationFactory;
 import at.gv.egiz.eaaf.core.api.gui.IVelocityGuiBuilderConfiguration;
@@ -41,19 +52,6 @@ import at.gv.egiz.eaaf.modules.pvp2.impl.opensaml.EaafHttpPostDecoder;
 import at.gv.egiz.eaaf.modules.pvp2.impl.opensaml.HttpPostEncoderWithOwnTemplate;
 import at.gv.egiz.eaaf.modules.pvp2.impl.verification.EaafSamlProtocolMessageXmlSignatureSecurityHandler;
 import at.gv.egiz.eaaf.modules.pvp2.impl.verification.PvpSamlMessageHandlerChain;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.saml.common.SAMLObject;
-import org.opensaml.saml.common.binding.SAMLBindingSupport;
-import org.opensaml.saml.common.binding.impl.CheckMessageVersionHandler;
-import org.opensaml.saml.common.binding.security.impl.MessageLifetimeSecurityHandler;
-import org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler;
-import org.opensaml.saml.common.messaging.SAMLMessageSecuritySupport;
-import org.opensaml.saml.common.xml.SAMLConstants;
-import org.opensaml.saml.saml2.core.RequestAbstractType;
-import org.opensaml.saml.saml2.core.StatusResponseType;
-import org.springframework.beans.factory.annotation.Autowired;
-
 import lombok.extern.slf4j.Slf4j;
 import net.shibboleth.utilities.java.support.net.URIComparator;
 
@@ -85,7 +83,7 @@ public class PostBinding extends AbstractBinding implements IDecoder, IEncoder {
       encoder.setHttpServletResponse(httpResp);
 
       // inject message context
-      final MessageContext<SAMLObject> messageContext = buildBasicMessageContext(encoder, request);
+      final MessageContext messageContext = buildBasicMessageContext(encoder, request);
 
       // inject signing context
       messageContext.addSubcontext(injectSigningInfos(credentials));
@@ -131,7 +129,7 @@ public class PostBinding extends AbstractBinding implements IDecoder, IEncoder {
       encoder.setHttpServletResponse(httpResp);
 
       // inject message context
-      final MessageContext<SAMLObject> messageContext = buildBasicMessageContext(encoder, response);
+      final MessageContext messageContext = buildBasicMessageContext(encoder, response);
 
       // inject signing context
       messageContext.addSubcontext(injectSigningInfos(credentials));
@@ -165,7 +163,7 @@ public class PostBinding extends AbstractBinding implements IDecoder, IEncoder {
       throws Pvp2Exception {
 
     final EaafHttpPostDecoder decode = new EaafHttpPostDecoder(req);
-    final MessageContext<SAMLObject> messageContext = internalMessageDecode(decode, PvpConstants.POST);
+    final MessageContext messageContext = internalMessageDecode(decode, PvpConstants.POST);
 
     // check if PVP2 AuthnRequest is signed
     if (!SAMLBindingSupport.isMessageSigned(messageContext)) {
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/binding/RedirectBinding.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/binding/RedirectBinding.java
index f62f8a11..c66c773e 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/binding/RedirectBinding.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/binding/RedirectBinding.java
@@ -23,6 +23,18 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.xml.namespace.QName;
 
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.saml.common.binding.SAMLBindingSupport;
+import org.opensaml.saml.common.binding.impl.CheckMessageVersionHandler;
+import org.opensaml.saml.common.binding.security.impl.MessageLifetimeSecurityHandler;
+import org.opensaml.saml.common.messaging.context.SAMLBindingContext;
+import org.opensaml.saml.common.xml.SAMLConstants;
+import org.opensaml.saml.saml2.binding.encoding.impl.HTTPRedirectDeflateEncoder;
+import org.opensaml.saml.saml2.core.RequestAbstractType;
+import org.opensaml.saml.saml2.core.StatusResponseType;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
 import at.gv.egiz.eaaf.core.api.IRequest;
 import at.gv.egiz.eaaf.modules.pvp2.PvpConstants;
 import at.gv.egiz.eaaf.modules.pvp2.api.binding.IDecoder;
@@ -36,20 +48,6 @@ import at.gv.egiz.eaaf.modules.pvp2.exception.SamlBindingException;
 import at.gv.egiz.eaaf.modules.pvp2.impl.opensaml.EaafHttpRedirectDeflateDecoder;
 import at.gv.egiz.eaaf.modules.pvp2.impl.verification.EaafSaml2HttpRedirectDeflateSignatureSecurityHandler;
 import at.gv.egiz.eaaf.modules.pvp2.impl.verification.PvpSamlMessageHandlerChain;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.saml.common.SAMLObject;
-import org.opensaml.saml.common.binding.SAMLBindingSupport;
-import org.opensaml.saml.common.binding.impl.CheckMessageVersionHandler;
-import org.opensaml.saml.common.binding.security.impl.MessageLifetimeSecurityHandler;
-import org.opensaml.saml.common.messaging.context.SAMLBindingContext;
-import org.opensaml.saml.common.xml.SAMLConstants;
-import org.opensaml.saml.saml2.binding.encoding.impl.HTTPRedirectDeflateEncoder;
-import org.opensaml.saml.saml2.core.RequestAbstractType;
-import org.opensaml.saml.saml2.core.StatusResponseType;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
 import net.shibboleth.utilities.java.support.net.URIComparator;
 
 public class RedirectBinding extends AbstractBinding implements IDecoder, IEncoder {
@@ -67,7 +65,7 @@ public class RedirectBinding extends AbstractBinding implements IDecoder, IEncod
       final HTTPRedirectDeflateEncoder encoder = new HTTPRedirectDeflateEncoder();
       encoder.setHttpServletResponse(resp);
 
-      final MessageContext<SAMLObject> messageContext = buildBasicMessageContext(encoder, request);
+      final MessageContext messageContext = buildBasicMessageContext(encoder, request);
 
       // set endpoint url
       messageContext.addSubcontext(injectEndpointInfos(request, targetLocation));
@@ -104,7 +102,7 @@ public class RedirectBinding extends AbstractBinding implements IDecoder, IEncod
       final HTTPRedirectDeflateEncoder encoder = new HTTPRedirectDeflateEncoder();
       encoder.setHttpServletResponse(resp);
 
-      final MessageContext<SAMLObject> messageContext = buildBasicMessageContext(encoder, response);
+      final MessageContext messageContext = buildBasicMessageContext(encoder, response);
 
       // set endpoint url
       messageContext.addSubcontext(injectEndpointInfos(response, targetLocation));
@@ -136,7 +134,7 @@ public class RedirectBinding extends AbstractBinding implements IDecoder, IEncod
       throws Pvp2Exception {
 
     final EaafHttpRedirectDeflateDecoder decode = new EaafHttpRedirectDeflateDecoder(req);
-    final MessageContext<SAMLObject> messageContext = internalMessageDecode(decode, PvpConstants.REDIRECT);
+    final MessageContext messageContext = internalMessageDecode(decode, PvpConstants.REDIRECT);
 
     final SAMLBindingContext bindingContext = messageContext.getSubcontext(SAMLBindingContext.class, true);
     if (!bindingContext.hasBindingSignature()) {
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/binding/SoapBinding.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/binding/SoapBinding.java
index 49e93f0a..cd651a1e 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/binding/SoapBinding.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/binding/SoapBinding.java
@@ -23,6 +23,20 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.xml.namespace.QName;
 
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.saml.common.binding.SAMLBindingSupport;
+import org.opensaml.saml.common.binding.impl.CheckMessageVersionHandler;
+import org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler;
+import org.opensaml.saml.common.binding.impl.SAMLSOAPDecoderBodyHandler;
+import org.opensaml.saml.common.binding.security.impl.MessageLifetimeSecurityHandler;
+import org.opensaml.saml.common.messaging.SAMLMessageSecuritySupport;
+import org.opensaml.saml.common.xml.SAMLConstants;
+import org.opensaml.saml.saml2.binding.decoding.impl.HTTPSOAP11Decoder;
+import org.opensaml.saml.saml2.binding.encoding.impl.HTTPSOAP11Encoder;
+import org.opensaml.saml.saml2.core.RequestAbstractType;
+import org.opensaml.saml.saml2.core.StatusResponseType;
+import org.opensaml.soap.messaging.context.SOAP11Context;
+
 import at.gv.egiz.eaaf.core.api.IRequest;
 import at.gv.egiz.eaaf.modules.pvp2.PvpConstants;
 import at.gv.egiz.eaaf.modules.pvp2.api.binding.IDecoder;
@@ -38,22 +52,6 @@ import at.gv.egiz.eaaf.modules.pvp2.impl.utils.Saml2Utils;
 import at.gv.egiz.eaaf.modules.pvp2.impl.verification.EaafMessageContextInitializationHandler;
 import at.gv.egiz.eaaf.modules.pvp2.impl.verification.EaafSamlProtocolMessageXmlSignatureSecurityHandler;
 import at.gv.egiz.eaaf.modules.pvp2.impl.verification.PvpSamlMessageHandlerChain;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.saml.common.SAMLObject;
-import org.opensaml.saml.common.binding.SAMLBindingSupport;
-import org.opensaml.saml.common.binding.impl.CheckMessageVersionHandler;
-import org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler;
-import org.opensaml.saml.common.binding.impl.SAMLSOAPDecoderBodyHandler;
-import org.opensaml.saml.common.binding.security.impl.MessageLifetimeSecurityHandler;
-import org.opensaml.saml.common.messaging.SAMLMessageSecuritySupport;
-import org.opensaml.saml.common.xml.SAMLConstants;
-import org.opensaml.saml.saml2.binding.decoding.impl.HTTPSOAP11Decoder;
-import org.opensaml.saml.saml2.binding.encoding.impl.HTTPSOAP11Encoder;
-import org.opensaml.saml.saml2.core.RequestAbstractType;
-import org.opensaml.saml.saml2.core.StatusResponseType;
-import org.opensaml.soap.messaging.context.SOAP11Context;
-
 import lombok.extern.slf4j.Slf4j;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 import net.shibboleth.utilities.java.support.net.URIComparator;
@@ -72,7 +70,7 @@ public class SoapBinding extends AbstractBinding implements IDecoder, IEncoder {
 
     injectMessageHandlerChain(soapDecoder, metadataProvider, peerEntityRole);
 
-    final MessageContext<SAMLObject> messageContext =
+    final MessageContext messageContext =
         internalMessageDecode(soapDecoder, PvpConstants.SOAP);
 
     // check if PVP2 AuthnRequest is signed
@@ -141,7 +139,7 @@ public class SoapBinding extends AbstractBinding implements IDecoder, IEncoder {
       encoder.setHttpServletResponse(resp);
 
       // inject message context
-      final MessageContext<SAMLObject> messageContext = buildBasicMessageContext(encoder, response);
+      final MessageContext messageContext = buildBasicMessageContext(encoder, response);
 
       //inject SOAP enveloped
       final SOAP11Context soap11Context = new SOAP11Context();
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/builder/PvpMetadataBuilder.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/builder/PvpMetadataBuilder.java
index 92922e09..05a7360b 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/builder/PvpMetadataBuilder.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/builder/PvpMetadataBuilder.java
@@ -21,6 +21,8 @@ package at.gv.egiz.eaaf.modules.pvp2.impl.builder;
 
 import java.io.IOException;
 import java.text.MessageFormat;
+import java.time.Duration;
+import java.time.Instant;
 import java.util.Collection;
 import java.util.List;
 
@@ -29,15 +31,7 @@ import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.transform.TransformerException;
 import javax.xml.transform.TransformerFactoryConfigurationError;
 
-import at.gv.egiz.eaaf.core.exceptions.EaafBuilderException;
-import at.gv.egiz.eaaf.core.exceptions.EaafException;
-import at.gv.egiz.eaaf.modules.pvp2.api.credential.EaafX509Credential;
-import at.gv.egiz.eaaf.modules.pvp2.api.metadata.IPvpMetadataBuilderConfiguration;
-import at.gv.egiz.eaaf.modules.pvp2.exception.CredentialsNotAvailableException;
-import at.gv.egiz.eaaf.modules.pvp2.impl.utils.Saml2Utils;
-
 import org.apache.commons.lang3.StringUtils;
-import org.joda.time.DateTime;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.core.xml.util.XMLObjectSupport;
 import org.opensaml.saml.common.SignableSAMLObject;
@@ -67,6 +61,12 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.w3c.dom.Element;
 
+import at.gv.egiz.eaaf.core.exceptions.EaafBuilderException;
+import at.gv.egiz.eaaf.core.exceptions.EaafException;
+import at.gv.egiz.eaaf.modules.pvp2.api.credential.EaafX509Credential;
+import at.gv.egiz.eaaf.modules.pvp2.api.metadata.IPvpMetadataBuilderConfiguration;
+import at.gv.egiz.eaaf.modules.pvp2.exception.CredentialsNotAvailableException;
+import at.gv.egiz.eaaf.modules.pvp2.impl.utils.Saml2Utils;
 import net.shibboleth.utilities.java.support.xml.SerializeSupport;
 
 /**
@@ -114,7 +114,7 @@ public class PvpMetadataBuilder {
       throws CredentialsNotAvailableException, EaafException, SecurityException,
       TransformerFactoryConfigurationError, MarshallingException, TransformerException,
       ParserConfigurationException, IOException, SignatureException {
-    final DateTime date = new DateTime();
+    final Instant date = Instant.now();
     final EntityDescriptor entityDescriptor = Saml2Utils.createSamlObject(EntityDescriptor.class);
 
     // set entityID
@@ -161,19 +161,19 @@ public class PvpMetadataBuilder {
     }
 
     SignableSAMLObject metadataToSign;
-
+    
     // build entities descriptor
     if (config.buildEntitiesDescriptorAsRootElement()) {
       final EntitiesDescriptor entitiesDescriptor =
           Saml2Utils.createSamlObject(EntitiesDescriptor.class);
       entitiesDescriptor.setName(config.getEntityFriendlyName());
       entitiesDescriptor.setID(Saml2Utils.getSecureIdentifier());
-      entitiesDescriptor.setValidUntil(date.plusHours(config.getMetadataValidUntil()));
+      entitiesDescriptor.setValidUntil(date.plus(Duration.ofHours(config.getMetadataValidUntil())));
       entitiesDescriptor.getEntityDescriptors().add(entityDescriptor);
       metadataToSign = entitiesDescriptor;
 
     } else {
-      entityDescriptor.setValidUntil(date.plusHours(config.getMetadataValidUntil()));
+      entityDescriptor.setValidUntil(date.plus(Duration.ofHours(config.getMetadataValidUntil())));
       entityDescriptor.setID(Saml2Utils.getSecureIdentifier());
       metadataToSign = entityDescriptor;
 
@@ -320,7 +320,7 @@ public class PvpMetadataBuilder {
 
     if (reqSpAttr != null && reqSpAttr.size() > 0) {
       log.debug("Add " + reqSpAttr.size() + " attributes to SP metadata");
-      attributeService.getRequestAttributes().addAll(reqSpAttr);
+      attributeService.getRequestedAttributes().addAll(reqSpAttr);
 
     } else {
       log.debug("SP metadata contains NO requested attributes.");
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/metadata/AbstractChainingMetadataProvider.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/metadata/AbstractChainingMetadataProvider.java
index 28f5d618..32e82ce4 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/metadata/AbstractChainingMetadataProvider.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/metadata/AbstractChainingMetadataProvider.java
@@ -21,6 +21,7 @@ package at.gv.egiz.eaaf.modules.pvp2.impl.metadata;
 
 import java.io.IOException;
 import java.security.cert.CertificateException;
+import java.time.Instant;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
@@ -34,7 +35,6 @@ import javax.annotation.Nullable;
 import javax.naming.ConfigurationException;
 
 import org.apache.commons.lang3.StringUtils;
-import org.joda.time.DateTime;
 import org.opensaml.core.criterion.EntityIdCriterion;
 import org.opensaml.saml.metadata.resolver.ClearableMetadataResolver;
 import org.opensaml.saml.metadata.resolver.MetadataResolver;
@@ -63,7 +63,7 @@ public abstract class AbstractChainingMetadataProvider implements IGarbageCollec
   @Nonnull
   @NonnullElements
   private final List<MetadataResolver> internalResolvers;
-  private DateTime lastRefeshTimestamp;
+  private Instant lastRefeshTimestamp;
   private boolean lastRefeshSuccessful;
   private static Object mutex = new Object();
 
@@ -110,10 +110,10 @@ public abstract class AbstractChainingMetadataProvider implements IGarbageCollec
   @Override
   public synchronized boolean refreshMetadataProvider(final String entityId) {
     try {
-      //if (resolveEntityDescriporForRefesh(entityId)) {
-      //  return true;
+      // if (resolveEntityDescriporForRefesh(entityId)) {
+      // return true;
       //
-      //}
+      // }
 
       // reload metadata provider
       final String metadataUrl = getMetadataUrl(entityId);
@@ -159,7 +159,6 @@ public abstract class AbstractChainingMetadataProvider implements IGarbageCollec
 
   }
 
-
   @Override
   public final MetadataFilter getMetadataFilter() {
     log.warn("{} does NOT support {}", AbstractChainingMetadataProvider.class.getName(),
@@ -274,17 +273,17 @@ public abstract class AbstractChainingMetadataProvider implements IGarbageCollec
       }
     }
 
-    this.lastRefeshTimestamp = DateTime.now();
+    this.lastRefeshTimestamp = Instant.now();
     this.lastRefeshSuccessful = true;
   }
 
   @Override
   @Nullable
-  public final DateTime getLastUpdate() {
-    DateTime ret = null;
+  public final Instant getLastUpdate() {
+    Instant ret = null;
     for (final MetadataResolver resolver : internalResolvers) {
       if (resolver instanceof RefreshableMetadataResolver) {
-        final DateTime lastUpdate = ((RefreshableMetadataResolver) resolver).getLastUpdate();
+        final Instant lastUpdate = ((RefreshableMetadataResolver) resolver).getLastUpdate();
         if (ret == null || ret.isBefore(lastUpdate)) {
           ret = lastUpdate;
         }
@@ -296,11 +295,11 @@ public abstract class AbstractChainingMetadataProvider implements IGarbageCollec
 
   @Override
   @Nullable
-  public final DateTime getLastRefresh() {
-    DateTime ret = null;
+  public final Instant getLastRefresh() {
+    Instant ret = null;
     for (final MetadataResolver resolver : internalResolvers) {
       if (resolver instanceof RefreshableMetadataResolver) {
-        final DateTime lastRefresh = ((RefreshableMetadataResolver) resolver).getLastRefresh();
+        final Instant lastRefresh = ((RefreshableMetadataResolver) resolver).getLastRefresh();
         if (ret == null || ret.isBefore(lastRefresh)) {
           ret = lastRefresh;
         }
@@ -311,7 +310,7 @@ public abstract class AbstractChainingMetadataProvider implements IGarbageCollec
   }
 
   @Override
-  public final DateTime getLastSuccessfulRefresh() {
+  public final Instant getLastSuccessfulRefresh() {
     return this.lastRefeshTimestamp;
 
   }
@@ -346,6 +345,20 @@ public abstract class AbstractChainingMetadataProvider implements IGarbageCollec
 
   }
 
+  @Override
+  public final Throwable getLastFailureCause() {
+    for (final MetadataResolver resolver : internalResolvers) {
+      if (resolver instanceof RefreshableMetadataResolver) {
+        final RefreshableMetadataResolver refreshable = (RefreshableMetadataResolver) resolver;
+        if (refreshable.getLastFailureCause() != null) {
+          return refreshable.getLastFailureCause();
+        }
+      }
+    }
+
+    return null;
+  }
+
   /**
    * Get the URL to metadata for a specific entityID.
    *
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/metadata/PvpMetadataResolverAdapter.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/metadata/PvpMetadataResolverAdapter.java
index 4115cc7c..f0291847 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/metadata/PvpMetadataResolverAdapter.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/metadata/PvpMetadataResolverAdapter.java
@@ -1,8 +1,10 @@
 package at.gv.egiz.eaaf.modules.pvp2.impl.metadata;
 
-import org.joda.time.DateTime;
+
+import java.time.Instant;
+
 import org.opensaml.core.criterion.EntityIdCriterion;
-import org.opensaml.saml.metadata.resolver.ExtendedRefreshableMetadataResolver;
+import org.opensaml.saml.metadata.resolver.RefreshableMetadataResolver;
 import org.opensaml.saml.metadata.resolver.filter.MetadataFilter;
 import org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver;
 import org.opensaml.saml.saml2.metadata.EntityDescriptor;
@@ -16,9 +18,9 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
 @Slf4j
 public class PvpMetadataResolverAdapter implements IPvp2MetadataProvider, IRefreshableMetadataProvider {
 
-  private final ExtendedRefreshableMetadataResolver internalProvider;
+  private final RefreshableMetadataResolver internalProvider;
 
-  public PvpMetadataResolverAdapter(ExtendedRefreshableMetadataResolver provider) {
+  public PvpMetadataResolverAdapter(RefreshableMetadataResolver provider) {
     this.internalProvider = provider;
   }
 
@@ -29,13 +31,13 @@ public class PvpMetadataResolverAdapter implements IPvp2MetadataProvider, IRefre
   }
 
   @Override
-  public DateTime getLastRefresh() {
+  public Instant getLastRefresh() {
     return internalProvider.getLastRefresh();
 
   }
 
   @Override
-  public DateTime getLastUpdate() {
+  public Instant getLastUpdate() {
     return internalProvider.getLastUpdate();
   }
 
@@ -88,7 +90,7 @@ public class PvpMetadataResolverAdapter implements IPvp2MetadataProvider, IRefre
   }
 
   @Override
-  public DateTime getLastSuccessfulRefresh() {
+  public Instant getLastSuccessfulRefresh() {
     return internalProvider.getLastSuccessfulRefresh();
   }
 
@@ -122,7 +124,11 @@ public class PvpMetadataResolverAdapter implements IPvp2MetadataProvider, IRefre
           internalProvider.getClass().getName());
 
     }
+  }
 
+  public Throwable getLastFailureCause() {
+    return internalProvider.getLastFailureCause();
+    
   }
 
 }
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/metadata/PvpMetadataResolverFactory.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/metadata/PvpMetadataResolverFactory.java
index d29f1a0e..bf541b67 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/metadata/PvpMetadataResolverFactory.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/metadata/PvpMetadataResolverFactory.java
@@ -1,6 +1,7 @@
 package at.gv.egiz.eaaf.modules.pvp2.impl.metadata;
 
 import java.io.IOException;
+import java.time.Duration;
 import java.util.Timer;
 
 import javax.annotation.Nonnull;
@@ -10,7 +11,7 @@ import javax.net.ssl.SSLHandshakeException;
 
 import org.apache.http.client.HttpClient;
 import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
-import org.opensaml.saml.metadata.resolver.ExtendedRefreshableMetadataResolver;
+import org.opensaml.saml.metadata.resolver.RefreshableMetadataResolver;
 import org.opensaml.saml.metadata.resolver.filter.MetadataFilter;
 import org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver;
 import org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver;
@@ -102,7 +103,7 @@ public class PvpMetadataResolverFactory implements IDestroyableObject {
       @Nullable final MetadataFilter filter, @Nonnull final String idForLogging,
       @Nullable final ParserPool pool, @Nullable final HttpClient httpClient) throws Pvp2MetadataException {
 
-    ExtendedRefreshableMetadataResolver internalProvider = null;
+    RefreshableMetadataResolver internalProvider = null;
 
     try {
       if (metadataLocation.startsWith(URI_PREFIX_HTTP)
@@ -181,7 +182,7 @@ public class PvpMetadataResolverFactory implements IDestroyableObject {
    * @throws ComponentInitializationException In case of a metadata resolver
    *                                          initialization error
    */
-  private ExtendedRefreshableMetadataResolver createNewFileSystemMetaDataProvider(final Resource metadataFile,
+  private RefreshableMetadataResolver createNewFileSystemMetaDataProvider(final Resource metadataFile,
       final MetadataFilter filter, final String idForLogging, final Timer timer,
       final ParserPool pool) throws IOException, ComponentInitializationException {
     ResourceBackedMetadataResolver fileSystemResolver = null;
@@ -212,7 +213,7 @@ public class PvpMetadataResolverFactory implements IDestroyableObject {
    * @throws ResolverException                In case of an internal OpenSAML
    *                                          resolver error
    */
-  private ExtendedRefreshableMetadataResolver createNewHttpMetaDataProvider(final String metadataUrl,
+  private RefreshableMetadataResolver createNewHttpMetaDataProvider(final String metadataUrl,
       final MetadataFilter filter, final String idForLogging, final Timer timer,
       final ParserPool pool, final HttpClient httpClient) throws ComponentInitializationException,
       ResolverException {
@@ -241,8 +242,8 @@ public class PvpMetadataResolverFactory implements IDestroyableObject {
     }
 
     resolver.setRequireValidMetadata(true);
-    resolver.setMinRefreshDelay(1000 * 60 * 15); // 15 minutes
-    resolver.setMaxRefreshDelay(1000 * 60 * 60 * 24); // 24 hours
+    resolver.setMinRefreshDelay(Duration.ofMinutes(15));       
+    resolver.setMaxRefreshDelay(Duration.ofHours(24)); 
     resolver.setMetadataFilter(filter);
 
   }
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/EaafHttpPostDecoder.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/EaafHttpPostDecoder.java
index fdd44b9a..f9860839 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/EaafHttpPostDecoder.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/EaafHttpPostDecoder.java
@@ -6,16 +6,17 @@ import java.io.UnsupportedEncodingException;
 
 import javax.servlet.http.HttpServletRequest;
 
-import at.gv.egiz.eaaf.modules.pvp2.impl.utils.Saml2Utils;
-import at.gv.egiz.eaaf.modules.pvp2.impl.utils.SamlHttpUtils;
-
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.messaging.decoder.MessageDecodingException;
 import org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder;
 
 import com.google.common.base.Strings;
+
+import at.gv.egiz.eaaf.modules.pvp2.impl.utils.Saml2Utils;
+import at.gv.egiz.eaaf.modules.pvp2.impl.utils.SamlHttpUtils;
 import lombok.extern.slf4j.Slf4j;
 import net.shibboleth.utilities.java.support.codec.Base64Support;
+import net.shibboleth.utilities.java.support.codec.DecodingException;
 
 /**
  * SAML2 Post-Binding decoder with same EAAF specific hardening regarding http
@@ -51,18 +52,26 @@ public class EaafHttpPostDecoder extends HTTPPostDecoder {
       throw new MessageDecodingException("No SAML message present in request");
     }
 
-    log.trace("Base64 decoding SAML message: {}", encodedMessage);
-    final byte[] decodedBytes = Base64Support.decode(encodedMessage);
-
     try {
-      log.trace("Decoded SAML message: {}", new String(decodedBytes, "UTF-8"));
+      log.trace("Base64 decoding SAML message: {}", encodedMessage);
+      final byte[] decodedBytes = Base64Support.decode(encodedMessage);
 
-    } catch (final UnsupportedEncodingException e) {
-      log.warn("Logging of incomming message failed", e);
+      try {
+        log.trace("Decoded SAML message: {}", new String(decodedBytes, "UTF-8"));
 
-    }
+      } catch (final UnsupportedEncodingException e) {
+        log.warn("Logging of incomming message failed", e);
+
+      }
+
+      return new ByteArrayInputStream(decodedBytes);
+      
+    } catch (final DecodingException e) {        
+      log.error("Unable to Base64 decode SAML message");
+      throw new MessageDecodingException("Unable to Base64 decode SAML message",e);
+    }      
+    
 
-    return new ByteArrayInputStream(decodedBytes);
   }
 
   /**
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/EaafHttpRedirectDeflateDecoder.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/EaafHttpRedirectDeflateDecoder.java
index c5174f02..28f98d30 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/EaafHttpRedirectDeflateDecoder.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/EaafHttpRedirectDeflateDecoder.java
@@ -4,9 +4,6 @@ import java.io.InputStream;
 
 import javax.servlet.http.HttpServletRequest;
 
-import at.gv.egiz.eaaf.modules.pvp2.impl.utils.Saml2Utils;
-import at.gv.egiz.eaaf.modules.pvp2.impl.utils.SamlHttpUtils;
-
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.decoder.MessageDecodingException;
@@ -16,6 +13,9 @@ import org.opensaml.saml.common.xml.SAMLConstants;
 import org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder;
 
 import com.google.common.base.Strings;
+
+import at.gv.egiz.eaaf.modules.pvp2.impl.utils.Saml2Utils;
+import at.gv.egiz.eaaf.modules.pvp2.impl.utils.SamlHttpUtils;
 import lombok.extern.slf4j.Slf4j;
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
@@ -39,7 +39,7 @@ public class EaafHttpRedirectDeflateDecoder extends HTTPRedirectDeflateDecoder {
 
   @Override
   protected void doDecode() throws MessageDecodingException {
-    final MessageContext<SAMLObject> messageContext = new MessageContext<>();
+    final MessageContext messageContext = new MessageContext();
     final HttpServletRequest request = getHttpServletRequest();
 
     if (!"GET".equalsIgnoreCase(request.getMethod())) {
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/HttpPostEncoderWithOwnTemplate.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/HttpPostEncoderWithOwnTemplate.java
index fa77b73c..396b513f 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/HttpPostEncoderWithOwnTemplate.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/HttpPostEncoderWithOwnTemplate.java
@@ -28,17 +28,15 @@ import java.io.Writer;
 
 import javax.servlet.http.HttpServletResponse;
 
-import at.gv.egiz.eaaf.core.api.gui.IVelocityGuiBuilderConfiguration;
-import at.gv.egiz.eaaf.core.api.gui.IVelocityGuiFormBuilder;
-import at.gv.egiz.eaaf.core.impl.gui.velocity.VelocityProvider;
-
 import org.apache.velocity.VelocityContext;
 import org.apache.velocity.app.Velocity;
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.encoder.MessageEncodingException;
-import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostEncoder;
 
+import at.gv.egiz.eaaf.core.api.gui.IVelocityGuiBuilderConfiguration;
+import at.gv.egiz.eaaf.core.api.gui.IVelocityGuiFormBuilder;
+import at.gv.egiz.eaaf.core.impl.gui.velocity.VelocityProvider;
 import lombok.extern.slf4j.Slf4j;
 import net.shibboleth.utilities.java.support.net.HttpServletSupport;
 
@@ -80,7 +78,7 @@ public class HttpPostEncoderWithOwnTemplate extends HTTPPostEncoder {
    *                                  message
    */
   @Override
-  protected void postEncode(final MessageContext<SAMLObject> messageContext, final String endpointUrl)
+  protected void postEncode(final MessageContext messageContext, final String endpointUrl)
       throws MessageEncodingException {
     log.debug("Invoking Velocity template to create POST body");
     InputStream is = null;
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/StringRedirectDeflateEncoder.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/StringRedirectDeflateEncoder.java
index 38735fb8..e75be5de 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/StringRedirectDeflateEncoder.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/StringRedirectDeflateEncoder.java
@@ -39,8 +39,8 @@ public class StringRedirectDeflateEncoder extends HTTPRedirectDeflateEncoder {
 
   @Override
   protected void doEncode() throws MessageEncodingException {
-    final MessageContext<SAMLObject> messageContext = getMessageContext();
-    final SAMLObject outboundMessage = messageContext.getMessage();
+    final MessageContext messageContext = getMessageContext();
+    final SAMLObject outboundMessage = (SAMLObject) messageContext.getMessage();
 
     final String endpointUrl = getEndpointURL(messageContext).toString();
 
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/initialize/EaafOpenSaml3xInitializer.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/initialize/EaafOpenSaml3xInitializer.java
index 5c6d861d..2c90bc57 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/initialize/EaafOpenSaml3xInitializer.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/opensaml/initialize/EaafOpenSaml3xInitializer.java
@@ -25,15 +25,6 @@ import java.util.Map;
 import javax.annotation.Nonnull;
 import javax.xml.XMLConstants;
 
-import at.gv.egiz.eaaf.modules.pvp2.api.reqattr.EaafRequestedAttribute;
-import at.gv.egiz.eaaf.modules.pvp2.api.reqattr.EaafRequestedAttributes;
-import at.gv.egiz.eaaf.modules.pvp2.impl.builder.reqattr.EaafRequestedAttributeBuilder;
-import at.gv.egiz.eaaf.modules.pvp2.impl.builder.reqattr.EaafRequestedAttributeMarshaller;
-import at.gv.egiz.eaaf.modules.pvp2.impl.builder.reqattr.EaafRequestedAttributeUnmarshaller;
-import at.gv.egiz.eaaf.modules.pvp2.impl.builder.reqattr.EaafRequestedAttributesBuilder;
-import at.gv.egiz.eaaf.modules.pvp2.impl.builder.reqattr.EaafRequestedAttributesMarshaller;
-import at.gv.egiz.eaaf.modules.pvp2.impl.builder.reqattr.EaafRequestedAttributesUnmarshaller;
-
 import org.opensaml.core.config.ConfigurationService;
 import org.opensaml.core.config.InitializationException;
 import org.opensaml.core.config.InitializationService;
@@ -43,6 +34,14 @@ import org.opensaml.xmlsec.EncryptionConfiguration;
 import org.opensaml.xmlsec.SignatureSigningConfiguration;
 import org.opensaml.xmlsec.SignatureValidationConfiguration;
 
+import at.gv.egiz.eaaf.modules.pvp2.api.reqattr.EaafRequestedAttribute;
+import at.gv.egiz.eaaf.modules.pvp2.api.reqattr.EaafRequestedAttributes;
+import at.gv.egiz.eaaf.modules.pvp2.impl.builder.reqattr.EaafRequestedAttributeBuilder;
+import at.gv.egiz.eaaf.modules.pvp2.impl.builder.reqattr.EaafRequestedAttributeMarshaller;
+import at.gv.egiz.eaaf.modules.pvp2.impl.builder.reqattr.EaafRequestedAttributeUnmarshaller;
+import at.gv.egiz.eaaf.modules.pvp2.impl.builder.reqattr.EaafRequestedAttributesBuilder;
+import at.gv.egiz.eaaf.modules.pvp2.impl.builder.reqattr.EaafRequestedAttributesMarshaller;
+import at.gv.egiz.eaaf.modules.pvp2.impl.builder.reqattr.EaafRequestedAttributesUnmarshaller;
 import lombok.extern.slf4j.Slf4j;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 import net.shibboleth.utilities.java.support.xml.BasicParserPool;
@@ -66,16 +65,16 @@ public class EaafOpenSaml3xInitializer extends InitializationService {
    */
   public static synchronized void eaafInitialize() throws InitializationException,
       ComponentInitializationException {
-    log.debug("Initializing OpenSAML 3.x ... ");
+    log.debug("Initializing OpenSAML 4.x ... ");
     initialize();
 
-    log.debug("Injecting EAAF-specific configuration into OpenSAML 3.x ... ");
+    log.debug("Injecting EAAF-specific configuration into OpenSAML 4.x ... ");
     injectEaafSecurityProperty();
     injectEaafExtenstions();
 
     XMLObjectProviderRegistrySupport.setParserPool(eaafSecuredBasicParserPool());
 
-    log.info("OpenSAML3.x with EAAF extensions initialized");
+    log.info("OpenSAML 4.x with EAAF extensions initialized");
 
   }
 
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/reqattr/EaafRequestedAttributeImpl.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/reqattr/EaafRequestedAttributeImpl.java
index e391bb31..bde67205 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/reqattr/EaafRequestedAttributeImpl.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/reqattr/EaafRequestedAttributeImpl.java
@@ -23,15 +23,15 @@ import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 
-import at.gv.egiz.eaaf.modules.pvp2.api.reqattr.EaafRequestedAttribute;
-
+import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.schema.XSBooleanValue;
 import org.opensaml.core.xml.util.AttributeMap;
 import org.opensaml.core.xml.util.XMLObjectChildrenList;
-import org.opensaml.saml.common.AbstractSAMLObject;
 
-public class EaafRequestedAttributeImpl extends AbstractSAMLObject
+import at.gv.egiz.eaaf.modules.pvp2.api.reqattr.EaafRequestedAttribute;
+
+public class EaafRequestedAttributeImpl extends AbstractXMLObject
     implements EaafRequestedAttribute {
 
   private final XMLObjectChildrenList<XMLObject> attributeValues;
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/reqattr/EaafRequestedAttributesImpl.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/reqattr/EaafRequestedAttributesImpl.java
index 9c251233..a370b305 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/reqattr/EaafRequestedAttributesImpl.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/reqattr/EaafRequestedAttributesImpl.java
@@ -23,14 +23,14 @@ import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 
-import at.gv.egiz.eaaf.modules.pvp2.api.reqattr.EaafRequestedAttribute;
-import at.gv.egiz.eaaf.modules.pvp2.api.reqattr.EaafRequestedAttributes;
-
+import org.opensaml.core.xml.AbstractXMLObject;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
-import org.opensaml.saml.common.AbstractSAMLObject;
 
-public class EaafRequestedAttributesImpl extends AbstractSAMLObject
+import at.gv.egiz.eaaf.modules.pvp2.api.reqattr.EaafRequestedAttribute;
+import at.gv.egiz.eaaf.modules.pvp2.api.reqattr.EaafRequestedAttributes;
+
+public class EaafRequestedAttributesImpl extends AbstractXMLObject
     implements EaafRequestedAttributes {
 
   private final IndexedXMLObjectChildrenList<XMLObject> indexedChildren;
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/AbstractMetadataSignatureFilter.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/AbstractMetadataSignatureFilter.java
index c28dd7fb..fe619ef0 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/AbstractMetadataSignatureFilter.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/AbstractMetadataSignatureFilter.java
@@ -23,24 +23,28 @@ import java.util.ArrayList;
 import java.util.Iterator;
 import java.util.List;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import at.gv.egiz.eaaf.core.exceptions.EaafException;
-import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2MetadataException;
-import at.gv.egiz.eaaf.modules.pvp2.exception.SignatureValidationException;
-
 import org.opensaml.core.xml.XMLObject;
+import org.opensaml.saml.metadata.resolver.filter.FilterException;
 import org.opensaml.saml.metadata.resolver.filter.MetadataFilter;
+import org.opensaml.saml.metadata.resolver.filter.MetadataFilterContext;
 import org.opensaml.saml.saml2.metadata.EntitiesDescriptor;
 import org.opensaml.saml.saml2.metadata.EntityDescriptor;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import at.gv.egiz.eaaf.core.exceptions.EaafException;
+import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2MetadataException;
+import at.gv.egiz.eaaf.modules.pvp2.exception.SignatureValidationException;
+
 public abstract class AbstractMetadataSignatureFilter implements MetadataFilter {
   private static final Logger log = LoggerFactory.getLogger(AbstractMetadataSignatureFilter.class);
 
   @Override
-  public XMLObject filter(@Nullable final XMLObject metadata) throws SignatureValidationException {
+  public XMLObject filter(@Nullable final XMLObject metadata, 
+      @Nonnull final MetadataFilterContext context)  throws FilterException {
     try {
       if (metadata instanceof EntitiesDescriptor) {
         final EntitiesDescriptor entitiesDescriptor = (EntitiesDescriptor) metadata;
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/PvpEntityCategoryFilter.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/PvpEntityCategoryFilter.java
index efbeb7e5..7317e7ba 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/PvpEntityCategoryFilter.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/PvpEntityCategoryFilter.java
@@ -22,17 +22,15 @@ package at.gv.egiz.eaaf.modules.pvp2.impl.validation.metadata;
 import java.util.ArrayList;
 import java.util.List;
 
-import at.gv.egiz.eaaf.core.impl.data.Triple;
-import at.gv.egiz.eaaf.modules.pvp2.PvpConstants;
-import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2MetadataException;
-import at.gv.egiz.eaaf.modules.pvp2.impl.builder.PvpAttributeBuilder;
-import at.gv.egiz.eaaf.modules.pvp2.impl.utils.Saml2Utils;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 import org.opensaml.saml.ext.saml2mdattr.EntityAttributes;
 import org.opensaml.saml.metadata.resolver.filter.FilterException;
 import org.opensaml.saml.metadata.resolver.filter.MetadataFilter;
+import org.opensaml.saml.metadata.resolver.filter.MetadataFilterContext;
 import org.opensaml.saml.saml2.core.Attribute;
 import org.opensaml.saml.saml2.metadata.AttributeConsumingService;
 import org.opensaml.saml.saml2.metadata.EntitiesDescriptor;
@@ -44,6 +42,12 @@ import org.opensaml.saml.saml2.metadata.ServiceName;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import at.gv.egiz.eaaf.core.impl.data.Triple;
+import at.gv.egiz.eaaf.modules.pvp2.PvpConstants;
+import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2MetadataException;
+import at.gv.egiz.eaaf.modules.pvp2.impl.builder.PvpAttributeBuilder;
+import at.gv.egiz.eaaf.modules.pvp2.impl.utils.Saml2Utils;
+
 /**
  * Metadata filter that inject requested attributes based on Metadata
  * EntityCategories.
@@ -75,7 +79,8 @@ public class PvpEntityCategoryFilter implements MetadataFilter {
    * .XMLObject)
    */
   @Override
-  public XMLObject filter(final XMLObject metadata) throws FilterException {
+  public XMLObject filter(@Nullable final XMLObject metadata, 
+      @Nonnull final MetadataFilterContext context)  throws FilterException {
 
     if (isUsed) {
       log.trace("Map PVP EntityCategory to single PVP Attributes ... ");
@@ -197,7 +202,7 @@ public class PvpEntityCategoryFilter implements MetadataFilter {
         attributeService.getNames().add(serviceName);
 
         if (attrList != null && !attrList.isEmpty()) {
-          attributeService.getRequestAttributes().addAll(attrList);
+          attributeService.getRequestedAttributes().addAll(attrList);
           log.info("Add  " + attrList.size() + " attributes for 'EntityAttribute': " + entityAttr);
 
         }
@@ -211,14 +216,14 @@ public class PvpEntityCategoryFilter implements MetadataFilter {
 
           // load currently requested attributes
           final List<String> currentlyReqAttr = new ArrayList<>();
-          for (final RequestedAttribute reqAttr : el.getRequestAttributes()) {
+          for (final RequestedAttribute reqAttr : el.getRequestedAttributes()) {
             currentlyReqAttr.add(reqAttr.getName());
           }
 
           // check against EntityAttribute List
           for (final RequestedAttribute entityAttrListEl : attrList) {
             if (!currentlyReqAttr.contains(entityAttrListEl.getName())) {
-              el.getRequestAttributes().add(entityAttrListEl);
+              el.getRequestedAttributes().add(entityAttrListEl);
 
             } else {
               log.debug("'AttributeConsumingService' already contains attr: "
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/SchemaValidationFilter.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/SchemaValidationFilter.java
index b9e0c37f..2c7892f9 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/SchemaValidationFilter.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/SchemaValidationFilter.java
@@ -19,20 +19,23 @@
 
 package at.gv.egiz.eaaf.modules.pvp2.impl.validation.metadata;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.validation.Schema;
 import javax.xml.validation.Validator;
 
-import at.gv.egiz.eaaf.modules.pvp2.exception.SchemaValidationException;
-
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.saml.common.xml.SAMLSchemaBuilder;
 import org.opensaml.saml.common.xml.SAMLSchemaBuilder.SAML1Version;
 import org.opensaml.saml.metadata.resolver.filter.FilterException;
 import org.opensaml.saml.metadata.resolver.filter.MetadataFilter;
+import org.opensaml.saml.metadata.resolver.filter.MetadataFilterContext;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import at.gv.egiz.eaaf.modules.pvp2.exception.SchemaValidationException;
+
 public class SchemaValidationFilter implements MetadataFilter {
   private static final Logger log = LoggerFactory.getLogger(SchemaValidationFilter.class);
   private boolean isActive = true;
@@ -64,13 +67,14 @@ public class SchemaValidationFilter implements MetadataFilter {
    * .XMLObject)
    */
   @Override
-  public XMLObject filter(final XMLObject arg0) throws FilterException {
+  public XMLObject filter(@Nullable final XMLObject metadata, 
+      @Nonnull final MetadataFilterContext context)  throws FilterException {
 
     if (isActive) {
       try {
         final Schema test = schemaBuilder.getSAMLSchema();
         final Validator val = test.newValidator();
-        final DOMSource source = new DOMSource(arg0.getDOM());
+        final DOMSource source = new DOMSource(metadata.getDOM());
         val.validate(source);
         log.info("Metadata Schema validation check done OK");
 
@@ -90,7 +94,7 @@ public class SchemaValidationFilter implements MetadataFilter {
 
     }
 
-    return arg0;
+    return metadata;
   }
 
 }
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/EaafMessageContextInitializationHandler.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/EaafMessageContextInitializationHandler.java
index aba0a68b..ff587f1b 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/EaafMessageContextInitializationHandler.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/EaafMessageContextInitializationHandler.java
@@ -2,15 +2,10 @@ package at.gv.egiz.eaaf.modules.pvp2.impl.verification;
 
 import javax.annotation.Nonnull;
 
-import at.gv.egiz.eaaf.modules.pvp2.api.metadata.IPvp2MetadataProvider;
-import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2InternalErrorException;
-import at.gv.egiz.eaaf.modules.pvp2.impl.validation.TrustEngineFactory;
-
 import org.opensaml.core.config.ConfigurationService;
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.handler.AbstractMessageHandler;
 import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.messaging.context.SAMLMessageInfoContext;
 import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
 import org.opensaml.xmlsec.SignatureValidationConfiguration;
@@ -18,11 +13,14 @@ import org.opensaml.xmlsec.SignatureValidationParameters;
 import org.opensaml.xmlsec.context.SecurityParametersContext;
 import org.opensaml.xmlsec.signature.support.SignatureTrustEngine;
 
+import at.gv.egiz.eaaf.modules.pvp2.api.metadata.IPvp2MetadataProvider;
+import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2InternalErrorException;
+import at.gv.egiz.eaaf.modules.pvp2.impl.validation.TrustEngineFactory;
 import lombok.extern.slf4j.Slf4j;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 
 @Slf4j
-public class EaafMessageContextInitializationHandler extends AbstractMessageHandler<SAMLObject> {
+public class EaafMessageContextInitializationHandler extends AbstractMessageHandler {
 
   private final IPvp2MetadataProvider internalMetadataProvider;
   private SignatureTrustEngine trustEngine;
@@ -44,7 +42,7 @@ public class EaafMessageContextInitializationHandler extends AbstractMessageHand
 
 
   @Override
-  protected void doInvoke(MessageContext<SAMLObject> messageContext) throws MessageHandlerException {
+  protected void doInvoke(MessageContext messageContext) throws MessageHandlerException {
     log.trace("Injecting sub-context to SAML2 message ... ");
     messageContext.addSubcontext(new SAMLPeerEntityContext());
     messageContext.addSubcontext(new SAMLMessageInfoContext());
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/EaafSaml2HttpRedirectDeflateSignatureSecurityHandler.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/EaafSaml2HttpRedirectDeflateSignatureSecurityHandler.java
index 204229ee..36c8a1ee 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/EaafSaml2HttpRedirectDeflateSignatureSecurityHandler.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/EaafSaml2HttpRedirectDeflateSignatureSecurityHandler.java
@@ -3,19 +3,20 @@ package at.gv.egiz.eaaf.modules.pvp2.impl.verification;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import at.gv.egiz.eaaf.modules.pvp2.api.metadata.IPvp2MetadataProvider;
-import at.gv.egiz.eaaf.modules.pvp2.api.metadata.IRefreshableMetadataProvider;
-import at.gv.egiz.eaaf.modules.pvp2.exception.SamlSigningException;
-import at.gv.egiz.eaaf.modules.pvp2.impl.utils.SamlHttpUtils;
-
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.handler.MessageHandlerException;
 import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
 import org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPRedirectDeflateSignatureSecurityHandler;
 
 import com.google.common.base.Strings;
+
+import at.gv.egiz.eaaf.modules.pvp2.api.metadata.IPvp2MetadataProvider;
+import at.gv.egiz.eaaf.modules.pvp2.api.metadata.IRefreshableMetadataProvider;
+import at.gv.egiz.eaaf.modules.pvp2.exception.SamlSigningException;
+import at.gv.egiz.eaaf.modules.pvp2.impl.utils.SamlHttpUtils;
 import lombok.extern.slf4j.Slf4j;
 import net.shibboleth.utilities.java.support.codec.Base64Support;
+import net.shibboleth.utilities.java.support.codec.DecodingException;
 
 /**
  * Always extracts the last http parameter with a specific name from request, if
@@ -95,7 +96,12 @@ public class EaafSaml2HttpRedirectDeflateSignatureSecurityHandler extends
       return null;
 
     }
-    return Base64Support.decode(signature);
+    try {
+      return Base64Support.decode(signature);
+      
+    } catch (DecodingException e) {
+      throw new MessageHandlerException("Base64 decoding error", e);
+    }
   }
 
   @Override
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/PvpSamlMessageHandlerChain.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/PvpSamlMessageHandlerChain.java
index a1365023..44ed2013 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/PvpSamlMessageHandlerChain.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/PvpSamlMessageHandlerChain.java
@@ -7,25 +7,24 @@ import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.handler.MessageHandler;
 import org.opensaml.messaging.handler.MessageHandlerChain;
 import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.saml.common.SAMLObject;
 
 import lombok.extern.slf4j.Slf4j;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 
 @Slf4j
-public class PvpSamlMessageHandlerChain implements MessageHandlerChain<SAMLObject> {
-  private final List<MessageHandler<SAMLObject>> handlers = new ArrayList<>();
+public class PvpSamlMessageHandlerChain implements MessageHandlerChain {
+  private final List<MessageHandler> handlers = new ArrayList<>();
   private boolean isInitialized = false;
 
   @Override
-  public void invoke(MessageContext<SAMLObject> messageContext) throws MessageHandlerException {
+  public void invoke(MessageContext messageContext) throws MessageHandlerException {
     if (!isInitialized) {
       throw new RuntimeException("Component: "
           + PvpSamlMessageHandlerChain.class.getName() + " not initialized");
 
     }
 
-    for (final MessageHandler<SAMLObject> handler : getHandlers()) {
+    for (final MessageHandler handler : getHandlers()) {
       log.trace("Initializing SAML message handler: {}", handler.getClass().getName());
       handler.invoke(messageContext);
 
@@ -41,7 +40,7 @@ public class PvpSamlMessageHandlerChain implements MessageHandlerChain<SAMLObjec
   @Override
   public void initialize() throws ComponentInitializationException {
     if (!isInitialized) {
-      for (final MessageHandler<SAMLObject> handler : getHandlers()) {
+      for (final MessageHandler handler : getHandlers()) {
         log.trace("Initializing SAML message handler: {}", handler.getClass().getName());
         handler.initialize();
 
@@ -53,17 +52,17 @@ public class PvpSamlMessageHandlerChain implements MessageHandlerChain<SAMLObjec
   }
 
   @Override
-  public List<MessageHandler<SAMLObject>> getHandlers() {
+  public List<MessageHandler> getHandlers() {
     return handlers;
 
   }
 
-  public void addHandler(MessageHandler<SAMLObject> handler) {
+  public void addHandler(MessageHandler handler) {
     handlers.add(handler);
 
   }
 
-  public void addHandlers(List<MessageHandler<SAMLObject>> handlerList) {
+  public void addHandlers(List<MessageHandler> handlerList) {
     handlers.addAll(handlerList);
 
   }
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/SamlVerificationEngine.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/SamlVerificationEngine.java
index a209a131..2257eba9 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/SamlVerificationEngine.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/SamlVerificationEngine.java
@@ -19,6 +19,8 @@
 
 package at.gv.egiz.eaaf.modules.pvp2.impl.verification;
 
+import java.time.Duration;
+import java.time.Instant;
 import java.util.ArrayList;
 import java.util.List;
 
@@ -76,8 +78,8 @@ import at.gv.egiz.eaaf.modules.pvp2.impl.message.PvpSProfileRequest;
 import at.gv.egiz.eaaf.modules.pvp2.impl.message.PvpSProfileResponse;
 import at.gv.egiz.eaaf.modules.pvp2.impl.validation.SignatureTrustEngineDecorator;
 import lombok.extern.slf4j.Slf4j;
-import net.shibboleth.utilities.java.support.net.BasicURLComparator;
 import net.shibboleth.utilities.java.support.net.URIException;
+import net.shibboleth.utilities.java.support.net.impl.BasicURLComparator;
 import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
 import net.shibboleth.utilities.java.support.xml.SerializeSupport;
 
@@ -95,7 +97,7 @@ public class SamlVerificationEngine {
   private static final Object SIG_VAL_ERROR_MSG = "Signature verification return false";
 
   /**
-   * 5 allow 3 minutes time jitter in before validation.
+   * allow 3 minutes time jitter in before validation.
    */
   private static final int TIME_JITTER = 3;
 
@@ -302,10 +304,11 @@ public class SamlVerificationEngine {
       // validate DateTime conditions
       final Conditions conditions = saml2assertion.getConditions();
       if (conditions != null) {
-        final DateTime notbefore = conditions.getNotBefore().minusMinutes(5);
-        final DateTime notafter = conditions.getNotOnOrAfter();
+        final Instant notbefore = conditions.getNotBefore().minus(Duration.ofMinutes(5));
+        final Instant notafter = conditions.getNotOnOrAfter();
+        final Instant now = Instant.now();
         if (validateDateTime
-            && (notbefore.isAfterNow() || notafter.isBeforeNow())) {
+            && (notbefore.isAfter(now) || notafter.isBefore(now))) {
           isAssertionValid = false;
           log.info("Assertion with ID:{} is out of Date. [ Current:{}  NotBefore:{} NotAfter:{} ]",
               saml2assertion.getID(), new DateTime(), notbefore, notafter);
@@ -495,14 +498,14 @@ public class SamlVerificationEngine {
       throws SamlAssertionValidationExeption {
     if (samlResp.getStatus().getStatusCode().getValue().equals(StatusCode.SUCCESS)) {
       // validate response issueInstant
-      final DateTime issueInstant = samlResp.getIssueInstant();
+      final Instant issueInstant = samlResp.getIssueInstant();
       if (issueInstant == null) {
         log.warn("PVP response does not include a 'IssueInstant' attribute");
         throw new SamlAssertionValidationExeption(ERROR_14,
             new Object[] { loggerName, "'IssueInstant' attribute is not included" });
 
       }
-      if (validateDateTime && issueInstant.minusMinutes(TIME_JITTER).isAfterNow()) {
+      if (validateDateTime && issueInstant.minus(Duration.ofMinutes(TIME_JITTER)).isAfter(Instant.now())) {
         log.warn("PVP response: IssueInstant DateTime is not valid anymore.");
         throw new SamlAssertionValidationExeption(ERROR_14,
             new Object[] { loggerName, "'IssueInstant' Time is not valid any more" });