1 files changed, 34 insertions, 17 deletions
diff --git a/modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/validator/EidasResponseValidator.java b/modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/validator/EidasResponseValidator.java
index d1962654..b3c5dac1 100644
--- a/modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/validator/EidasResponseValidator.java
+++ b/modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/validator/EidasResponseValidator.java
@@ -26,8 +26,6 @@ package at.asitplus.eidas.specific.modules.auth.eidas.v2.validator;
 import java.util.List;
 
 import org.apache.commons.lang3.StringUtils;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import com.google.common.collect.ImmutableSet;
 
@@ -40,7 +38,10 @@ import at.gv.egiz.eaaf.core.impl.data.Triple;
 import eu.eidas.auth.commons.attribute.AttributeDefinition;
 import eu.eidas.auth.commons.attribute.AttributeValue;
 import eu.eidas.auth.commons.light.ILightResponse;
-import eu.eidas.auth.commons.protocol.eidas.LevelOfAssurance;
+import eu.eidas.auth.commons.light.LevelOfAssuranceType;
+import eu.eidas.auth.commons.light.impl.LevelOfAssurance;
+import eu.eidas.auth.commons.protocol.eidas.NotifiedLevelOfAssurance;
+import lombok.extern.slf4j.Slf4j;
 
 /**
  * eIDAS Response validator implementation.
@@ -48,8 +49,8 @@ import eu.eidas.auth.commons.protocol.eidas.LevelOfAssurance;
  * @author tlenz
  *
  */
+@Slf4j
 public class EidasResponseValidator {
-  private static final Logger log = LoggerFactory.getLogger(EidasResponseValidator.class);
 
   /**
    * Validate an eIDAS Response according to internal state.
@@ -67,24 +68,39 @@ public class EidasResponseValidator {
     /*-----------------------------------------------------|
      * validate received LoA against minimum required LoA  |
      *_____________________________________________________|
-     */
-    final LevelOfAssurance respLoA = LevelOfAssurance.fromString(eidasResponse.getLevelOfAssurance());
+     */            
+    final LevelOfAssurance respLoA = LevelOfAssurance.build(eidasResponse.getLevelOfAssurance());    
     final List<String> allowedLoAs = pendingReq.getServiceProviderConfiguration().getRequiredLoA();
     boolean loaValid = false;
     for (final String allowedLoaString : allowedLoAs) {
-      final LevelOfAssurance allowedLoa = LevelOfAssurance.fromString(allowedLoaString);
-      if (respLoA.numericValue() >= allowedLoa.numericValue()) {
-        log.debug("Response contains valid LoA. Resume process ... ");
-        loaValid = true;
-        break;
-
+      final LevelOfAssurance allowedLoa = LevelOfAssurance.build(allowedLoaString);
+      if (LevelOfAssuranceType.NOTIFIED.stringValue().equals(respLoA.getType())) {        
+        NotifiedLevelOfAssurance notifiedLoa = NotifiedLevelOfAssurance.fromString(respLoA.getValue());
+        NotifiedLevelOfAssurance notifiedAllowedLoa = NotifiedLevelOfAssurance.fromString(allowedLoa.getValue());
+        if (notifiedLoa.numericValue() >= notifiedAllowedLoa.numericValue()) {
+          log.debug("Response contains valid LoA. Resume process ... ");
+          loaValid = true;
+          break;
+
+        } else {
+          log.trace("Allowed LoA: " + allowedLoaString + " DOES NOT match response LoA: " + eidasResponse
+              .getLevelOfAssurance());
+        }
+                        
       } else {
-        log.trace("Allowed LoA: " + allowedLoaString + " DOES NOT match response LoA: " + eidasResponse
-            .getLevelOfAssurance());
-      }
-
+        if (respLoA.equals(allowedLoa)) {
+          log.info("Find not-notified LoA: {}. Use it as it is ... ", respLoA.getValue());
+          loaValid = true;
+          break;
+          
+        } else {
+          log.trace("Allowed LoA: " + allowedLoaString + " DOES NOT match response LoA: " + eidasResponse
+              .getLevelOfAssurance());
+          
+        }
+      }           
     }
-
+    
     if (!loaValid) {
       log.error("eIDAS Response LevelOfAssurance is lower than the required! "
           + "(Resp-LoA:{} Req-LoA:{} )", respLoA.getValue(), allowedLoAs.toArray());
@@ -92,6 +108,7 @@ public class EidasResponseValidator {
 
     }
 
+
     /*-----------------------------------------------------|
      *     validate 'PersonalIdentifier' attribute         |
      *_____________________________________________________|