1 files changed, 147 insertions, 0 deletions
diff --git a/modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/tasks/GenerateMobilePhoneSignatureRequestTask.java b/modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/tasks/GenerateMobilePhoneSignatureRequestTask.java
new file mode 100644
index 00000000..715d3672
--- /dev/null
+++ b/modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/tasks/GenerateMobilePhoneSignatureRequestTask.java
@@ -0,0 +1,147 @@
+/*
+ * Copyright 2021 A-SIT Plus GmbH
+ * AT-specific eIDAS Connector has been developed in a cooperation between EGIZ,
+ * A-SIT Plus GmbH, A-SIT, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.2 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "License");
+ * You may not use this work except in compliance with the License.
+ * You may obtain a copy of the License at:
+ * https://joinup.ec.europa.eu/news/understanding-eupl-v12
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+package at.asitplus.eidas.specific.modules.auth.eidas.v2.tasks;
+
+import java.text.MessageFormat;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.lang3.StringUtils;
+import org.jetbrains.annotations.NotNull;
+import org.opensaml.saml.saml2.metadata.EntityDescriptor;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import at.asitplus.eidas.specific.modules.auth.eidas.v2.Constants;
+import at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient.IdAustriaClientAuthConstants;
+import at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient.IdAustriaClientAuthRequestBuilderConfiguration;
+import at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient.provider.IdAustriaClientAuthCredentialProvider;
+import at.asitplus.eidas.specific.modules.auth.eidas.v2.idaustriaclient.provider.IdAustriaClientAuthMetadataProvider;
+import at.gv.egiz.eaaf.core.api.idp.IConfiguration;
+import at.gv.egiz.eaaf.core.api.idp.process.ExecutionContext;
+import at.gv.egiz.eaaf.core.api.storage.ITransactionStorage;
+import at.gv.egiz.eaaf.core.exceptions.EaafConfigurationException;
+import at.gv.egiz.eaaf.core.exceptions.EaafException;
+import at.gv.egiz.eaaf.core.exceptions.TaskExecutionException;
+import at.gv.egiz.eaaf.core.impl.idp.auth.modules.AbstractAuthServletTask;
+import at.gv.egiz.eaaf.core.impl.utils.Random;
+import at.gv.egiz.eaaf.modules.pvp2.exception.CredentialsNotAvailableException;
+import at.gv.egiz.eaaf.modules.pvp2.sp.impl.PvpAuthnRequestBuilder;
+import lombok.extern.slf4j.Slf4j;
+import net.shibboleth.utilities.java.support.resolver.ResolverException;
+import net.shibboleth.utilities.java.support.security.impl.SecureRandomIdentifierGenerationStrategy;
+
+/**
+ * Generate a SAML2 AuthnRequest to authenticate the user at ID Austria system.
+ * This corresponds to Step 15A in the eIDAS Matching Concept.
+ *
+ * @author tlenz
+ */
+@Slf4j
+@Component("GenerateMobilePhoneSignatureRequestTask")
+public class GenerateMobilePhoneSignatureRequestTask extends AbstractAuthServletTask {
+
+  private static final String ERROR_MSG_1 =
+      "Requested 'ms-specific eIDAS node' {0} has no valid metadata or metadata is not found";
+
+  @Autowired
+  PvpAuthnRequestBuilder authnReqBuilder;
+  @Autowired
+  IdAustriaClientAuthCredentialProvider credential;
+  @Autowired
+  IdAustriaClientAuthMetadataProvider metadataService;
+  @Autowired
+  private IConfiguration basicConfig;
+  @Autowired
+  protected ITransactionStorage transactionStorage;
+
+  @Override
+  public void execute(ExecutionContext executionContext, HttpServletRequest request, HttpServletResponse response)
+      throws TaskExecutionException {
+    try {
+      log.trace("Starting GenerateMobilePhoneSignatureRequestTask");
+      final String entityId = loadEntityId();
+      final EntityDescriptor entityDesc = loadEntityDescriptor(entityId);
+      final IdAustriaClientAuthRequestBuilderConfiguration authnReqConfig = buildAuthnRequestConfig(entityDesc);
+      final String relayState = buildRelayState();
+      authnReqBuilder.buildAuthnRequest(pendingReq, authnReqConfig, relayState, response); // also transmits!
+    } catch (final Exception e) {
+      throw new TaskExecutionException(pendingReq, "Generation of SAML2 AuthnRequest to ID Austria System FAILED", e);
+    }
+  }
+
+  @NotNull
+  private String loadEntityId() throws EaafConfigurationException {
+    final String msNodeEntityID = basicConfig.getBasicConfiguration(
+        IdAustriaClientAuthConstants.CONFIG_PROPS_ID_AUSTRIA_ENTITYID);
+    if (StringUtils.isEmpty(msNodeEntityID)) {
+      log.warn("ID Austria authentication not possible -> NO EntityID for ID Austria System FOUND!");
+      throw new EaafConfigurationException(Constants.ERRORCODE_00,
+          new Object[]{IdAustriaClientAuthConstants.CONFIG_PROPS_ID_AUSTRIA_ENTITYID});
+    }
+    return msNodeEntityID;
+  }
+
+  /**
+   * Build relayState for session synchronization, because SAML2 only allows RelayState with 80 characters
+   * but encrypted PendingRequestId is much longer.
+   */
+  @NotNull
+  private String buildRelayState() throws EaafException {
+    String relayState = Random.nextProcessReferenceValue();
+    transactionStorage.put(relayState, pendingReq.getPendingRequestId(), -1);
+    return relayState;
+  }
+
+  @NotNull
+  private EntityDescriptor loadEntityDescriptor(String msNodeEntityID)
+      throws ResolverException, EaafConfigurationException {
+    final EntityDescriptor entityDesc = metadataService.getEntityDescriptor(msNodeEntityID);
+    if (entityDesc == null) {
+      throw new EaafConfigurationException(IdAustriaClientAuthConstants.ERRORCODE_02,
+          new Object[]{MessageFormat.format(ERROR_MSG_1, msNodeEntityID)});
+
+    }
+    return entityDesc;
+  }
+
+  @NotNull
+  private IdAustriaClientAuthRequestBuilderConfiguration buildAuthnRequestConfig(EntityDescriptor entityDesc)
+      throws CredentialsNotAvailableException {
+    final IdAustriaClientAuthRequestBuilderConfiguration authnReqConfig =
+        new IdAustriaClientAuthRequestBuilderConfiguration();
+    final SecureRandomIdentifierGenerationStrategy gen = new SecureRandomIdentifierGenerationStrategy();
+    authnReqConfig.setRequestId(gen.generateIdentifier());
+    authnReqConfig.setIdpEntity(entityDesc);
+    authnReqConfig.setPassive(false);
+    authnReqConfig.setSignCred(credential.getMessageSigningCredential());
+    authnReqConfig.setSpEntityID(
+        pendingReq.getAuthUrlWithOutSlash() + IdAustriaClientAuthConstants.ENDPOINT_METADATA);
+    authnReqConfig.setRequestedLoA(authConfig.getBasicConfiguration(
+        IdAustriaClientAuthConstants.CONFIG_PROPS_REQUIRED_LOA,
+        IdAustriaClientAuthConstants.CONFIG_DEFAULT_LOA_EIDAS_LEVEL));
+    return authnReqConfig;
+  }
+}