add metadata schema validation filters

4 files changed, 21 insertions, 4 deletions

diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/MetaDataVerificationFilter.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/MetaDataVerificationFilter.java
index 332adaa80..7bf2cf93f 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/MetaDataVerificationFilter.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/MetaDataVerificationFilter.java
@@ -46,7 +46,6 @@ public class MetaDataVerificationFilter implements MetadataFilter {
 	public void doFilter(XMLObject metadata) throws FilterException {
 		if (metadata instanceof EntitiesDescriptor) {
 			EntitiesDescriptor entitiesDescriptor = (EntitiesDescriptor) metadata;
-			
 			if(entitiesDescriptor.getSignature() == null) {
 				throw new FilterException("Root element of metadata file has to be signed", null);
 			}
@@ -57,7 +56,7 @@ public class MetaDataVerificationFilter implements MetadataFilter {
 				throw new FilterException("Invalid Metadata file Root element is no EntitiesDescriptor", null);
 			}
 			
-		} if (metadata instanceof EntityDescriptor) {
+		} if (metadata instanceof EntityDescriptor) {									
 			try {
 				EntityDescriptor entity = (EntityDescriptor) metadata;
 				if (entity.getSignature() != null)
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/oa/OAPVP2ConfigValidation.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/oa/OAPVP2ConfigValidation.java
index 40e243d0b..a64a0eaf1 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/oa/OAPVP2ConfigValidation.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/oa/OAPVP2ConfigValidation.java
@@ -36,8 +36,10 @@ import javax.servlet.http.HttpServletRequest;
 import org.apache.commons.httpclient.MOAHttpClient;
 import org.apache.log4j.Logger;
 import org.opensaml.Configuration;
+import org.opensaml.common.xml.SAMLSchemaBuilder;
 import org.opensaml.saml2.metadata.provider.HTTPMetadataProvider;
 import org.opensaml.saml2.metadata.provider.MetadataFilter;
+import org.opensaml.saml2.metadata.provider.MetadataFilterChain;
 import org.opensaml.saml2.metadata.provider.MetadataProviderException;
 import org.opensaml.xml.io.Marshaller;
 import org.opensaml.xml.io.MarshallerFactory;
@@ -58,6 +60,7 @@ import at.gv.egovernment.moa.id.configuration.config.ConfigurationProvider;
 import at.gv.egovernment.moa.id.configuration.data.oa.OAPVP2Config;
 import at.gv.egovernment.moa.id.configuration.exception.ConfigurationException;
 import at.gv.egovernment.moa.id.configuration.helper.LanguageHelper;
+import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.SchemaValidationFilter;
 import at.gv.egovernment.moa.util.MiscUtil;
 
 public class OAPVP2ConfigValidation {
@@ -127,16 +130,28 @@ public class OAPVP2ConfigValidation {
 								log.info("No MOA specific SSL-TrustStore configured. Use default Java TrustStore.", e);
 								
 							}
+
+						List<MetadataFilter> filterList = new ArrayList<MetadataFilter>();
+						filterList.add(new MetaDataVerificationFilter(credential));
+						filterList.add(new SchemaValidationFilter());
+						MetadataFilterChain filter = new MetadataFilterChain();
+						filter.setFilters(filterList);
 						
 						httpProvider = 
 								new HTTPMetadataProvider(timer, httpClient, form.getMetaDataURL());
 						httpProvider.setParserPool(new BasicParserPool());
 						httpProvider.setRequireValidMetadata(true); 
-						httpProvider.setMetadataFilter(new MetaDataVerificationFilter(credential));
+						httpProvider.setMetadataFilter(filter);
 						httpProvider.setMinRefreshDelay(1000*60*15); //15 minutes
 						httpProvider.setMaxRefreshDelay(1000*60*60*24); //24 hours
+						
+						httpProvider.setRequireValidMetadata(true);
+						
 						httpProvider.initialize();
 						
+						
+						
+						
 						if (httpProvider.getMetadata() == null) {
 							log.info("Metadata could be received but validation FAILED.");
 							errors.add(LanguageHelper.getErrorString("validation.pvp2.metadata.validation", request));
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
index cba64e080..12afa14bc 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
@@ -57,6 +57,7 @@ import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
 import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
 import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.InterfederatedIDPPublicServiceFilter;
 import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.MetadataFilterChain;
+import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.SchemaValidationFilter;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.MiscUtil;
 
@@ -324,6 +325,7 @@ public class MOAMetadataProvider implements MetadataProvider {
 	
 	private MetadataFilterChain buildMetadataFilterChain(OnlineApplication oa, String metadataURL, byte[] certificate) throws CertificateException {
 		MetadataFilterChain filterChain = new MetadataFilterChain(metadataURL, certificate);
+		filterChain.getFilters().add(new SchemaValidationFilter());
 		
 		if (oa.isIsInterfederationIDP() != null && oa.isIsInterfederationIDP()) {
 			Logger.info("Online-Application is an interfederated IDP. Add addional Metadata policies");
@@ -374,6 +376,8 @@ public class MOAMetadataProvider implements MetadataProvider {
 			httpProvider.setMetadataFilter(filter);
 			httpProvider.initialize();
 			
+			httpProvider.setRequireValidMetadata(true);
+			
 			return httpProvider;
 						
 		} catch (Throwable e) {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/metadata/InterfederatedIDPPublicServiceFilter.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/metadata/InterfederatedIDPPublicServiceFilter.java
index 3d608fd6d..4d9b97a52 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/metadata/InterfederatedIDPPublicServiceFilter.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/metadata/InterfederatedIDPPublicServiceFilter.java
@@ -26,7 +26,6 @@ import org.opensaml.saml2.metadata.provider.FilterException;
 import org.opensaml.saml2.metadata.provider.MetadataFilter;
 import org.opensaml.xml.XMLObject;
 
-import at.gv.egovernment.moa.id.commons.db.dao.config.InterfederationIDPType;
 import at.gv.egovernment.moa.id.commons.validation.ValidationHelper;
 import at.gv.egovernment.moa.logging.Logger;