tests working, added IdAustriaClientAuthSignalController

11 files changed, 284 insertions, 40 deletions

diff --git a/eidas_modules/authmodule-eIDAS-v2/checks/spotbugs-exclude.xml b/eidas_modules/authmodule-eIDAS-v2/checks/spotbugs-exclude.xml
index 375f73f4..7d7467aa 100644
--- a/eidas_modules/authmodule-eIDAS-v2/checks/spotbugs-exclude.xml
+++ b/eidas_modules/authmodule-eIDAS-v2/checks/spotbugs-exclude.xml
@@ -12,6 +12,12 @@
     </Match>
     <Match>
       <!-- CSFR protection is implemented by pendingRequestId that is an one-time token -->
+      <Class name="at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient.IdAustriaClientAuthSignalController" />
+      <Method name="performAuthentication" />
+      <Bug pattern="SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING" />               
+    </Match>
+    <Match>
+      <!-- CSFR protection is implemented by pendingRequestId that is an one-time token -->
       <Class name="at.asitplus.eidas.specific.modules.auth.eidas.v2.EidasSignalServlet" />
       <Method name="restoreEidasAuthProcess" />
       <Bug pattern="SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING" />               
diff --git a/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/dao/SimpleMobileSignatureData.java b/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/dao/SimpleMobileSignatureData.java
index 254b8c70..2a7beb3b 100644
--- a/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/dao/SimpleMobileSignatureData.java
+++ b/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/dao/SimpleMobileSignatureData.java
@@ -23,8 +23,6 @@
 
 package at.asitplus.eidas.specific.modules.auth.eidas.v2.dao;
 
-import at.asitplus.eidas.specific.modules.auth.eidas.v2.exception.WorkflowException;
-import at.gv.e_government.reference.namespace.persondata._20020228.PostalAddressType;
 import lombok.Data;
 
 @Data
@@ -37,30 +35,21 @@ public class SimpleMobileSignatureData {
   private String familyName;
   private String dateOfBirth;
 
-
-  public boolean equalsSimpleEidasData(SimpleEidasData result) {
-    if (!result.getGivenName().equals(givenName)) {
+  /**
+   * Compares the received authentication data from the mobile phone signature with the eid data received via eIDAS.
+   * @param simpleEidasData The extracted eIDAS data
+   * @return Returns true, if the eIDAS data matches the mobile phone signature data and false otherwise.
+   */
+  public boolean equalsSimpleEidasData(SimpleEidasData simpleEidasData) {
+    if (!simpleEidasData.getGivenName().equals(givenName)) {
       return false;
     }
-    if (!result.getFamilyName().equals(familyName)) {
+    if (!simpleEidasData.getFamilyName().equals(familyName)) {
       return false;
     }
-    if (!result.getDateOfBirth().equals(dateOfBirth)) {
+    if (!simpleEidasData.getDateOfBirth().equals(dateOfBirth)) {
       return false;
     }
     return true;
   }
-
-  private boolean equals(String a, String b) {
-    if (a == null && b == null) {
-      return true;
-    }
-    if (a == null) {
-      return false;
-    }
-    if (b == null) {
-      return false;
-    }
-    return a.equals(b);
-  }
 }
diff --git a/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/idaustriaclient/EidasAuthEventConstants.java b/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/idaustriaclient/EidasAuthEventConstants.java
deleted file mode 100644
index bca04369..00000000
--- a/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/idaustriaclient/EidasAuthEventConstants.java
+++ /dev/null
@@ -1,10 +0,0 @@
-package at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient;
-
-public class EidasAuthEventConstants {
-
-  public static final int AUTHPROCESS_EIDAS_AT_CONNECTOR_SELECTED = 6200;
-  public static final int AUTHPROCESS_EIDAS_AT_CONNECTOR_REQUESTED = 6201;
-  public static final int AUTHPROCESS_EIDAS_AT_CONNECTOR_RECEIVED = 6202;
-  public static final int AUTHPROCESS_EIDAS_AT_CONNECTOR_RECEIVED_ERROR = 6203;
-  public static final int AUTHPROCESS_EIDAS_AT_CONNECTOR_MDS_VALID = 6204;
-}
diff --git a/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/idaustriaclient/IdAustriaClientAuthEventConstants.java b/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/idaustriaclient/IdAustriaClientAuthEventConstants.java
new file mode 100644
index 00000000..03e570fc
--- /dev/null
+++ b/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/idaustriaclient/IdAustriaClientAuthEventConstants.java
@@ -0,0 +1,7 @@
+package at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient;
+
+public class IdAustriaClientAuthEventConstants {
+
+  public static final int AUTHPROCESS_ID_AUSTRIA_RESPONSE_RECEIVED = 6202;
+  public static final int AUTHPROCESS_ID_AUSTRIA_RESPONSE_RECEIVED_ERROR = 6203;
+}
diff --git a/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/idaustriaclient/IdAustriaClientAuthSignalController.java b/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/idaustriaclient/IdAustriaClientAuthSignalController.java
new file mode 100644
index 00000000..5906c7b9
--- /dev/null
+++ b/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/idaustriaclient/IdAustriaClientAuthSignalController.java
@@ -0,0 +1,95 @@
+package at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient;
+
+
+import java.io.IOException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.text.StringEscapeUtils;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+import at.gv.egiz.eaaf.core.exceptions.EaafException;
+import at.gv.egiz.eaaf.core.impl.idp.controller.AbstractProcessEngineSignalController;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * IdAustria client controller that receives the response from national
+ * IdAustria node.
+ *
+ * @author tlenz
+ *
+ */
+@Slf4j
+@Controller
+public class IdAustriaClientAuthSignalController extends AbstractProcessEngineSignalController {
+
+  public static final String HTTP_PARAM_RELAYSTATE = "RelayState";
+
+  /**
+   * Default constructor with logging.
+   *
+   */
+  public IdAustriaClientAuthSignalController() {
+    super();
+    log.debug("Registering servlet " + getClass().getName()
+        + " with mappings '" + IdAustriaClientAuthConstants.ENDPOINT_POST
+        + "' and '" + IdAustriaClientAuthConstants.ENDPOINT_REDIRECT + "'.");
+
+  }
+
+  /**
+   * HTTP end-point for incoming SAML2 Response from ID Austria node.
+   *
+   * @param req HTTP request
+   * @param resp HTTP response
+   * @throws IOException In case of a HTTP communication error
+   * @throws EaafException In case of a state-validation problem
+   */
+  @RequestMapping(value = { IdAustriaClientAuthConstants.ENDPOINT_POST,
+      IdAustriaClientAuthConstants.ENDPOINT_REDIRECT },
+      method = { RequestMethod.POST, RequestMethod.GET })
+  public void performAuthentication(HttpServletRequest req, HttpServletResponse resp)
+      throws IOException, EaafException {
+    signalProcessManagement(req, resp);
+
+  }
+
+  /**
+   * Read the PendingRequestId from SAML2 RelayState parameter.
+   */
+  @Override
+  public String getPendingRequestId(HttpServletRequest request) {
+    String relayState = StringEscapeUtils.escapeHtml4(request.getParameter(HTTP_PARAM_RELAYSTATE));
+    if (StringUtils.isNotEmpty(relayState)) {
+      try {
+        String pendingReqId = transactionStorage.get(relayState, String.class);
+        if (StringUtils.isNotEmpty(pendingReqId)) {
+
+          return pendingReqId;
+
+        } else {
+          log.info("SAML2 RelayState from request is unknown. Can NOT restore session ... ");
+
+        }
+
+      } catch (EaafException e) {
+        log.error("Can NOT map SAML2 RelayState to pendingRequestId", e);
+
+      } finally {
+        transactionStorage.remove(relayState);
+
+      }
+
+    } else {
+      log.info("No SAML2 relaystate. Can NOT restore session ... ");
+
+    }
+
+    return null;
+
+  }
+}
diff --git a/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/tasks/ReceiveMobilePhoneSignatureResponseAndSearchInRegistersTask.java b/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/tasks/ReceiveMobilePhoneSignatureResponseAndSearchInRegistersTask.java
index 101e7c29..1dc8befd 100644
--- a/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/tasks/ReceiveMobilePhoneSignatureResponseAndSearchInRegistersTask.java
+++ b/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/tasks/ReceiveMobilePhoneSignatureResponseAndSearchInRegistersTask.java
@@ -31,13 +31,12 @@ import at.asitplus.eidas.specific.modules.auth.eidas.v2.dao.SimpleMobileSignatur
 import at.asitplus.eidas.specific.modules.auth.eidas.v2.ernp.IErnpClient;
 import at.asitplus.eidas.specific.modules.auth.eidas.v2.exception.InvalidUserInputException;
 import at.asitplus.eidas.specific.modules.auth.eidas.v2.exception.ManualFixNecessaryException;
-import at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient.EidasAuthEventConstants;
+import at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient.IdAustriaClientAuthEventConstants;
 import at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient.IdAustriaClientAuthConstants;
 import at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient.IdAustriaClientAuthCredentialProvider;
 import at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient.IdAustriaClientAuthMetadataProvider;
 import at.asitplus.eidas.specific.modules.auth.eidas.v2.utils.Utils;
 import at.asitplus.eidas.specific.modules.auth.eidas.v2.zmr.IZmrClient;
-import at.gv.egiz.eaaf.core.api.data.ExtendedPvpAttributeDefinitions;
 import at.gv.egiz.eaaf.core.api.data.PvpAttributeDefinitions;
 import at.gv.egiz.eaaf.core.api.idp.process.ExecutionContext;
 import at.gv.egiz.eaaf.core.exceptions.EaafBuilderException;
@@ -195,8 +194,9 @@ public class ReceiveMobilePhoneSignatureResponseAndSearchInRegistersTask extends
         final AssertionAttributeExtractor extractor =
             new AssertionAttributeExtractor(processedMsg.getFirst().getResponse());
 
-        SimpleMobileSignatureData simpleMobileSignatureData = getAuthDataFromInterfederation(extractor, authProcessData);
-        if(!simpleMobileSignatureData.equalsSimpleEidasData(eidData)) {
+        SimpleMobileSignatureData simpleMobileSignatureData =
+            getAuthDataFromInterfederation(extractor, authProcessData);
+        if (!simpleMobileSignatureData.equalsSimpleEidasData(eidData)) {
           //User cheated?
           throw new InvalidUserInputException();//TODO
         }
@@ -273,7 +273,7 @@ public class ReceiveMobilePhoneSignatureResponseAndSearchInRegistersTask extends
 
       msg.setSamlMessage(Saml2Utils.asDomDocument(samlResp).getDocumentElement());
       revisionsLogger.logEvent(pendingReq,
-          EidasAuthEventConstants.AUTHPROCESS_EIDAS_AT_CONNECTOR_RECEIVED,
+          IdAustriaClientAuthEventConstants.AUTHPROCESS_ID_AUSTRIA_RESPONSE_RECEIVED,
           samlResp.getID());
       return Pair.newInstance(msg, false);
 
@@ -289,7 +289,7 @@ public class ReceiveMobilePhoneSignatureResponseAndSearchInRegistersTask extends
       }
 
       revisionsLogger.logEvent(pendingReq,
-          EidasAuthEventConstants.AUTHPROCESS_EIDAS_AT_CONNECTOR_RECEIVED_ERROR);
+          IdAustriaClientAuthEventConstants.AUTHPROCESS_ID_AUSTRIA_RESPONSE_RECEIVED_ERROR);
       throw new AuthnResponseValidationException(ERROR_PVP_05,
           new Object[]{IdAustriaClientAuthConstants.MODULE_NAME_FOR_LOGGING,
               samlResp.getIssuer().getValue(),
@@ -320,7 +320,6 @@ public class ReceiveMobilePhoneSignatureResponseAndSearchInRegistersTask extends
 
     List<String> requiredAttributes = IdAustriaClientAuthConstants.DEFAULT_REQUIRED_PVP_ATTRIBUTE_NAMES;
     SimpleMobileSignatureData simpleMobileSignatureData = new SimpleMobileSignatureData();
-    String bpk = null;
     try {
       // check if all attributes are include
       if (!extractor.containsAllRequiredAttributes(requiredAttributes)) {
diff --git a/eidas_modules/authmodule-eIDAS-v2/src/main/resources/eidas_v2_auth.beans.xml b/eidas_modules/authmodule-eIDAS-v2/src/main/resources/eidas_v2_auth.beans.xml
index b5001d77..019cb03c 100644
--- a/eidas_modules/authmodule-eIDAS-v2/src/main/resources/eidas_v2_auth.beans.xml
+++ b/eidas_modules/authmodule-eIDAS-v2/src/main/resources/eidas_v2_auth.beans.xml
@@ -143,6 +143,9 @@
   <bean id="idAustriaClientAuthMetadataController"
         class="at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient.IdAustriaClientAuthMetadataController" />
 
+  <bean id="idAustriaClientAuthSignalController"
+        class="at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient.IdAustriaClientAuthSignalController" />
+
 
 
 
diff --git a/eidas_modules/authmodule-eIDAS-v2/src/test/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/test/tasks/ReceiveMobilePhoneSignatureResponseAndSearchInRegistersTaskTest.java b/eidas_modules/authmodule-eIDAS-v2/src/test/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/test/tasks/ReceiveMobilePhoneSignatureResponseAndSearchInRegistersTaskTest.java
index fbf011b1..550c2f13 100644
--- a/eidas_modules/authmodule-eIDAS-v2/src/test/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/test/tasks/ReceiveMobilePhoneSignatureResponseAndSearchInRegistersTaskTest.java
+++ b/eidas_modules/authmodule-eIDAS-v2/src/test/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/test/tasks/ReceiveMobilePhoneSignatureResponseAndSearchInRegistersTaskTest.java
@@ -68,6 +68,7 @@ import net.shibboleth.utilities.java.support.xml.XMLParserException;
 public class ReceiveMobilePhoneSignatureResponseAndSearchInRegistersTaskTest {
 
   private static final String METADATA_PATH = "classpath:/data/idp_metadata_classpath_entity.xml";
+  private static final String METADATA_PATH1 = "classpath:/data/idp_metadata_classpath_entity1.xml";
   private static final String TEST_SIGNED_AUTHBLOCK = "MIIBbjCCARSgAwIBAgIEXh7TNzAKBggqhkjOPQQDAjA/MQswCQYDVQQG"
       + "EwJBVDENMAsGA1UECgwERUdJWjEOMAwGA1UECwwFalVuaXQxETAPBgNVBAMMCG1ldGFkYXRhMB4XDTIwMDExNTA4NTQxNVoXDTMw"
       + "MDExNDA4NTQxNVowPzELMAkGA1UEBhMCQVQxDTALBgNVBAoMBEVHSVoxDjAMBgNVBAsMBWpVbml0MREwDwYDVQQDDAhtZXRhZGF0"
@@ -328,9 +329,11 @@ public class ReceiveMobilePhoneSignatureResponseAndSearchInRegistersTaskTest {
 
     metadataProvider.addMetadataResolverIntoChain(metadataFactory.createMetadataProvider(
         METADATA_PATH, null, "jUnit IDP", null));
+    metadataProvider.addMetadataResolverIntoChain(metadataFactory.createMetadataProvider(
+        METADATA_PATH1, null, "jUnit IDP", null));
 
     final Response response = initializeResponse(
-        "classpath:/data/idp_metadata_classpath_entity.xml1",
+        "classpath:/data/idp_metadata_classpath_entity1.xml",
         "/data/Response_without_sig_classpath_entityid.xml",
         credentialProvider.getMessageSigningCredential(),
         true);
diff --git a/eidas_modules/authmodule-eIDAS-v2/src/test/resources/SpringTest-context_tasks_test.xml b/eidas_modules/authmodule-eIDAS-v2/src/test/resources/SpringTest-context_tasks_test.xml
index df7ce85f..da64d25d 100644
--- a/eidas_modules/authmodule-eIDAS-v2/src/test/resources/SpringTest-context_tasks_test.xml
+++ b/eidas_modules/authmodule-eIDAS-v2/src/test/resources/SpringTest-context_tasks_test.xml
@@ -128,5 +128,7 @@
   <bean id="idAustriaAuthPvpConfiguration"
         class="at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient.IdAustriaAuthPvpConfiguration" />
 
+  <bean id="idAustriaClientAuthSignalController"
+        class="at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient.IdAustriaClientAuthSignalController" />
 
 </beans>
\ No newline at end of file
diff --git a/eidas_modules/authmodule-eIDAS-v2/src/test/resources/data/Response_with_wrong_destination_endpoint.xml b/eidas_modules/authmodule-eIDAS-v2/src/test/resources/data/Response_with_wrong_destination_endpoint.xml
index cac4c867..c21381d9 100644
--- a/eidas_modules/authmodule-eIDAS-v2/src/test/resources/data/Response_with_wrong_destination_endpoint.xml
+++ b/eidas_modules/authmodule-eIDAS-v2/src/test/resources/data/Response_with_wrong_destination_endpoint.xml
@@ -1,5 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://localhost/authhandler/idAustriaSp/post" InResponseTo="_aeebfae3ce681fe3ddcaf213a42f01d3" IssueInstant="2014-03-05T06:39:51.017Z" Version="2.0" xmlns:xs="http://www.w3.org/2001/XMLSchema">
+<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
+				 Destination="https://localhost/authhandler/idAustriaSp1/post"
+				 InResponseTo="_aeebfae3ce681fe3ddcaf213a42f01d3" IssueInstant="2014-03-05T06:39:51.017Z" Version="2.0" xmlns:xs="http://www.w3.org/2001/XMLSchema">
 	<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">classpath:/data/idp_metadata_classpath_entity.xml</saml2:Issuer>
 	<saml2p:Status>
 		<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
@@ -9,7 +11,9 @@
 		<saml2:Subject>
 			<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="urn:publicid:gv.at:cdid+BF">QVGm48cqcM4UcyhDTNGYmVdrIoY=</saml2:NameID>
 			<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
-				<saml2:SubjectConfirmationData InResponseTo="_aeebfae3ce681fe3ddcaf213a42f01d3" NotOnOrAfter="2014-03-05T06:44:51.017Z" Recipient="https://localhost/authhandler/idAustriaSp/post"/>
+				<saml2:SubjectConfirmationData InResponseTo="_aeebfae3ce681fe3ddcaf213a42f01d3"
+											   NotOnOrAfter="2014-03-05T06:44:51.017Z"
+											   Recipient="https://localhost/authhandler/idAustriaSp1/post"/>
 			</saml2:SubjectConfirmation>
 		</saml2:Subject>
 		<saml2:Conditions NotBefore="2014-03-05T06:39:51.017Z" NotOnOrAfter="2014-03-05T06:44:51.017Z">
diff --git a/eidas_modules/authmodule-eIDAS-v2/src/test/resources/data/idp_metadata_classpath_entity1.xml b/eidas_modules/authmodule-eIDAS-v2/src/test/resources/data/idp_metadata_classpath_entity1.xml
new file mode 100644
index 00000000..cde66c78
--- /dev/null
+++ b/eidas_modules/authmodule-eIDAS-v2/src/test/resources/data/idp_metadata_classpath_entity1.xml
@@ -0,0 +1,146 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<md:EntityDescriptor
+        xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+        ID="_1a48ec3432f2f3ba6222724a5b06f873"
+        entityID="classpath:/data/idp_metadata_classpath_entity1.xml"
+        validUntil="2045-02-06T08:47:26.211Z">
+    <md:IDPSSODescriptor
+            WantAuthnRequestsSigned="true"
+            protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+        <md:KeyDescriptor use="signing">
+            <ds:KeyInfo
+                    xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+                <ds:X509Data>
+                    <ds:X509Certificate>MIIDMzCCAhsCBFtIcPowDQYJKoZIhvcNAQELBQAwXjELMAkGA1UEBhMCQVQxDTALBgNVBAoMBEVH
+                        SVoxJDAiBgNVBAsMG2NlbnRyYWwgbmF0aW9uYWwgZUlEQVMgbm9kZTEaMBgGA1UEAwwRQXNzZXJ0
+                        aW9uIHNpZ25pbmcwHhcNMTgwNzEzMDkyOTMwWhcNMjEwNDA3MDkyOTMwWjBeMQswCQYDVQQGEwJB
+                        VDENMAsGA1UECgwERUdJWjEkMCIGA1UECwwbY2VudHJhbCBuYXRpb25hbCBlSURBUyBub2RlMRow
+                        GAYDVQQDDBFBc3NlcnRpb24gc2lnbmluZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+                        AJ5zDYxMPRcz6AHaev1tS46Tq8sdgbGFM56uxk6c7LmMDC+HTzNX/3Q5S/YwSzgL3ue5TSw1ltOf
+                        yMXMZ6D0+buWWcsxGEkQ8M3adKRFdQrEwafzwTA7pguq5WiHOkr4qwR7dLMome9z5cc3LRcwdOPP
+                        gq7ahb5jM3hRqc5xkMWIuvql0NFXPzlHrjDLwy5nIWPOhL5abhVt4YsXbpbjXxFSGkDEAZ32K3EU
+                        LNBr9FSUmJfbrVX9AU2T+BKIwiqXP8e/3UJHgPHQ0l5ljWp5P6u5+tvM21o8sUM4eArRa8BkdRsP
+                        C92GVuASSUz2ZJ3JhAK1cSM8bnvaZVLQtTvPMAcCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAAp7z
+                        TubWXW6YMpyLSvWBdZiiQ3X66XpSZLZJDIAkoPzEY0DSBp8I5YASIx4JTR5XJt+6MI9acgNIAYW8
+                        DhtRwUMVaRWEtuCrfKhGLWm5KSxnhPcD3lzRZhY4ZcA7dUlirjf6hnqo2TFEmJ9fkM+rxwy1GkDD
+                        7j2YDSOFmSq9/Ud9/IbIfSnRu/lO0dh7iRrmg3y0Y/+plPxYmp4AHqehP11OchTz2FGGHVsSC2Vs
+                        IVBQI6ANZYyOlicgfEEFHA06jP9OnA0EwEFr2P+di9caZg8vfibyzxMGeuf6CY0c0eLHokBCn2W8
+                        vkzvWiER3pozRvCmXFjCVZfRjUunaJf2ow==
+                    </ds:X509Certificate>
+                </ds:X509Data>
+                <ds:X509Data>
+                    <ds:X509Certificate>MIIC+DCCAeCgAwIBAgIEXh7TbTANBgkqhkiG9w0BAQsFADA+MQswCQYDVQQGEwJB
+                        VDENMAsGA1UECgwERUdJWjEOMAwGA1UECwwFalVuaXQxEDAOBgNVBAMMB3NpZ25p
+                        bmcwHhcNMjAwMTE1MDg1NTA5WhcNMjkwMTE0MDg1NTA5WjA+MQswCQYDVQQGEwJB
+                        VDENMAsGA1UECgwERUdJWjEOMAwGA1UECwwFalVuaXQxEDAOBgNVBAMMB3NpZ25p
+                        bmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUSiRjnDvPafZfhJ+L
+                        1wM86FKJX3VIAV/8TD9qJ6HOBkn5WwYfpheyCfRb6XVDyIGpO8qnMWAgC17Ngbmh
+                        zj8d8HXNQ2l3uppMv24oUTfXyYhQfZWAghx0sTlRIx/ZmlnduJilx2S53Sa7ruJw
+                        lQcBFXj9h9B8dtyegc86Sx6D9BumP1xU7+mEBk8Gv9rR5Khg0Y7qGfZWB0t4aikg
+                        aupWveVwiGifOOSfR8czqIg9qUpMYfZiTEBTSRmN6sPiNWhd4J0GyAI9Rn5C9jz/
+                        sSlQrxpN+4DXzsqSU5F6gzq3yRux6wyOzDlt2birf21VPQ9HIy4YCjZXwgDWG7AO
+                        821pAgMBAAEwDQYJKoZIhvcNAQELBQADggEBADnwdaxUtQU6SIpYwIb2c0ljTmQi
+                        7ryUcUpNHtK0M0E5Mw5Ex8zwrWbNQZ2sUyc4r07M66iOIqHsYZUQlRYvVKHifDpA
+                        r8TCgD7iGGdB3By8Ou0RaNW+03w1fwmi98CufbHCGvpv0o2KxlejoHZminNdQ79i
+                        bN+01nhocezJQATEQlnwHLiQSjilXpZeLYDk8HbrcUXNRxezN4ChdH+uU54vf+Ux
+                        qcj9QHcmBe1+BM8EXfqS1DbTwZl+NTCnh5OYl8fvIFSOHMBxwFrI4pyY0faxg9Uc
+                        rCogn/oQ+mV1gnVUDaDhvvEnVGZQtrlt7heVId2BeNellVgsrcmdW8j4U9U=
+                    </ds:X509Certificate>
+                </ds:X509Data>
+                <ds:X509Data>
+                    <ds:X509Certificate>MIIBbjCCARSgAwIBAgIEXh7TNzAKBggqhkjOPQQDAjA/MQswCQYDVQQGEwJBVDEN
+                        MAsGA1UECgwERUdJWjEOMAwGA1UECwwFalVuaXQxETAPBgNVBAMMCG1ldGFkYXRh
+                        MB4XDTIwMDExNTA4NTQxNVoXDTMwMDExNDA4NTQxNVowPzELMAkGA1UEBhMCQVQx
+                        DTALBgNVBAoMBEVHSVoxDjAMBgNVBAsMBWpVbml0MREwDwYDVQQDDAhtZXRhZGF0
+                        YTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBdBkaxt31p++aZeP3SmlWITj9SY
+                        O4McV2ccXFsH4X4QMHuKAMUvjxPm1kdU01eTOWdiQX0GpDIBspYMZh8ZKcwwCgYI
+                        KoZIzj0EAwIDSAAwRQIhAJ3QKlk9cd90s+i8y62fvmGF6LtfNO+JvkWqDUBeQImn
+                        AiA2KwFtzO7STAp9MEwQGe0vt0F8mO1ttrLE+rr6YxdwGA==
+                    </ds:X509Certificate>
+                </ds:X509Data>
+            </ds:KeyInfo>
+        </md:KeyDescriptor>
+        <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
+        </md:NameIDFormat>
+        <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient
+        </md:NameIDFormat>
+        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
+        </md:NameIDFormat>
+        <md:SingleSignOnService
+                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+                Location="https://vidp.gv.at/ms_connector1/pvp/post" />
+        <md:SingleSignOnService
+                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+                Location="https://vidp.gv.at/ms_connector1/pvp/redirect" />
+        <saml2:Attribute
+                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
+                FriendlyName="BPK" Name="urn:oid:1.2.40.0.10.2.1.1.149"
+                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" />
+        <saml2:Attribute
+                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
+                FriendlyName="BIRTHDATE" Name="urn:oid:1.2.40.0.10.2.1.1.55"
+                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" />
+        <saml2:Attribute
+                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
+                FriendlyName="PRINCIPAL-NAME"
+                Name="urn:oid:1.2.40.0.10.2.1.1.261.20"
+                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" />
+        <saml2:Attribute
+                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
+                FriendlyName="EID-CCS-URL" Name="urn:oid:1.2.40.0.10.2.1.1.261.64"
+                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" />
+        <saml2:Attribute
+                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
+                FriendlyName="EID-ISSUING-NATION"
+                Name="urn:oid:1.2.40.0.10.2.1.1.261.32"
+                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" />
+        <saml2:Attribute
+                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
+                FriendlyName="PVP-VERSION" Name="urn:oid:1.2.40.0.10.2.1.1.261.10"
+                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" />
+        <saml2:Attribute
+                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
+                FriendlyName="EID-SOURCE-PIN"
+                Name="urn:oid:1.2.40.0.10.2.1.1.261.36"
+                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" />
+        <saml2:Attribute
+                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
+                FriendlyName="GIVEN-NAME" Name="urn:oid:2.5.4.42"
+                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" />
+        <saml2:Attribute
+                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
+                FriendlyName="EID-SIGNER-CERTIFICATE"
+                Name="urn:oid:1.2.40.0.10.2.1.1.261.66"
+                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" />
+        <saml2:Attribute
+                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
+                FriendlyName="EID-SECTOR-FOR-IDENTIFIER"
+                Name="urn:oid:1.2.40.0.10.2.1.1.261.34"
+                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" />
+        <saml2:Attribute
+                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
+                FriendlyName="EID-SOURCE-PIN-TYPE"
+                Name="urn:oid:1.2.40.0.10.2.1.1.261.104"
+                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" />
+        <saml2:Attribute
+                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
+                FriendlyName="EID-E-ID-TOKEN"
+                Name="urn:oid:1.2.40.0.10.2.1.1.261.39"
+                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" />
+        <saml2:Attribute
+                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
+                FriendlyName="EID-IDENTITY-LINK"
+                Name="urn:oid:1.2.40.0.10.2.1.1.261.38"
+                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" />
+        <saml2:Attribute
+                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
+                FriendlyName="EID-CITIZEN-QAA-EIDAS-LEVEL"
+                Name="urn:oid:1.2.40.0.10.2.1.1.261.108"
+                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" />
+        <saml2:Attribute
+                xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
+                FriendlyName="EID-IDENTITY-STATUS-LEVEL"
+                Name="urn:oid:1.2.40.0.10.2.1.1.261.109"
+                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" />
+    </md:IDPSSODescriptor>
+</md:EntityDescriptor>