diff options
Diffstat (limited to 'eidas_modules')
2 files changed, 34 insertions, 10 deletions
diff --git a/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/dao/SimpleEidasData.java b/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/dao/SimpleEidasData.java index cedf01e3..35f353f4 100644 --- a/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/dao/SimpleEidasData.java +++ b/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/dao/SimpleEidasData.java @@ -38,10 +38,10 @@ public class SimpleEidasData { * Full eIDAS personal identifier with prefix. */ private final String personalIdentifier; - + /** * Citizen country-code from eIDAS personal-identifier. - */ + */ private final String citizenCountryCode; // MDS @@ -67,11 +67,11 @@ public class SimpleEidasData { * @throws WorkflowException if multiple results have been found */ public boolean equalsRegisterData(RegisterResult result) throws WorkflowException { - /*TODO: maybe this is check is not valid, because only the minimum data-set (personalIdentifer, givenName, + /*TODO: maybe this is check is not valid, because only the minimum data-set (personalIdentifer, givenName, * familyName, dateOfBirth) has to be always available. Any other attributes are optional. - * This check will always evaluate to false if register has more information as current eIDAS process!!! + * This check will always evaluate to false if register has more information as current eIDAS process!!! */ - + return new EqualsBuilder() .append(result.getGivenName(), givenName) .append(result.getFamilyName(), familyName) @@ -80,10 +80,20 @@ public class SimpleEidasData { .append(result.getBirthName(), birthName) .append(result.getTaxNumber(), taxNumber) .isEquals() && result.getPseudonym().stream() - .filter(el -> el.equals(pseudonym)) - .findFirst() - .isPresent(); - + .anyMatch(el -> el.equals(pseudonym)); } + /** + * Checks if the MDS (<code>givenName</code>, <code>familyName</code>, + * <code>dateOfBirth</code>) matches. + */ + public boolean equalsMds(SimpleEidasData other) { + return new EqualsBuilder() + .append(other.givenName, givenName) + .append(other.familyName, familyName) + .append(other.dateOfBirth, dateOfBirth) + .isEquals(); + } + + } diff --git a/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/tasks/AlternativeSearchTask.java b/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/tasks/AlternativeSearchTask.java index 38a7076a..4705c56b 100644 --- a/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/tasks/AlternativeSearchTask.java +++ b/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/tasks/AlternativeSearchTask.java @@ -46,6 +46,7 @@ import org.springframework.stereotype.Component; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.util.Map; +import java.util.Objects; import static at.asitplus.eidas.specific.modules.auth.eidas.v2.Constants.TRANSITION_TO_GENERATE_OTHER_LOGIN_METHOD_GUI_TASK; @@ -97,7 +98,7 @@ public class AlternativeSearchTask extends AbstractAuthServletTask { try { final SimpleEidasData altEidasData = convertEidasAttrToSimpleData(); final SimpleEidasData initialEidasData = MatchingTaskUtils.getInitialEidasData(pendingReq); - // TODO Verify that altEidasData and initialEidasData "match"? + verifyAlternativeEidasData(altEidasData, initialEidasData); step11RegisterSearchWithPersonIdentifier(executionContext, altEidasData, initialEidasData); } catch (WorkflowException e) { throw new TaskExecutionException(pendingReq, "Initial search failed", e); @@ -107,6 +108,19 @@ public class AlternativeSearchTask extends AbstractAuthServletTask { } } + private void verifyAlternativeEidasData(SimpleEidasData altEidasData, SimpleEidasData initialEidasData) + throws WorkflowException { + if (initialEidasData == null) { + throw new WorkflowException("step11", "No initial eIDAS authn data"); + } + if (!Objects.equals(altEidasData.getCitizenCountryCode(), initialEidasData.getCitizenCountryCode())) { + throw new WorkflowException("step11", "Country Code of alternative eIDAS authn not matching", true); + } + if (!altEidasData.equalsMds(initialEidasData)) { + throw new WorkflowException("step11", "MDS of alternative eIDAS authn does not match initial authn", true); + } + } + private void step11RegisterSearchWithPersonIdentifier( ExecutionContext executionContext, SimpleEidasData initialEidasData, SimpleEidasData altEidasData) throws WorkflowException, EaafStorageException { |