add new OA specific configuration for bPK decryption

9 files changed, 590 insertions, 3 deletions

diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java
index 567978cae..2f4d700a2 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java
@@ -60,6 +60,7 @@ public class Constants {
 	public static final String SESSION_BKUSELECTIONTEMPLATE = "bkuSelectionTemplate";
 	public static final String SESSION_SENDASSERTIONTEMPLATE = "sendAssertionTemplate";
 	public static final String SESSION_SLTRANSFORMATION = "slTransformation";
+	public static final String SESSION_BPKENCRYPTIONDECRYPTION = "bPKEncDec";
 	
 	public static final String SESSION_SLOERROR = "sloerrormessage";
 	public static final String SESSION_SLOSUCCESS = "slosuccessmessage";
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java
index bea6220ff..957479b29 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java
@@ -457,6 +457,11 @@ public class ConfigurationProvider {
 		
 	}
 	
+	public String getConfigurationEncryptionKey() {
+		return props.getProperty("general.moaconfig.key");
+				
+	}
+	
 	private void initalPVP2Login() throws ConfigurationException {
 		try {
 					
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OABPKEncryption.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OABPKEncryption.java
new file mode 100644
index 000000000..6782987e5
--- /dev/null
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OABPKEncryption.java
@@ -0,0 +1,370 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.configuration.data.oa;
+
+import java.io.File;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpSession;
+
+import org.apache.commons.lang.SerializationUtils;
+import org.apache.log4j.Logger;
+
+import at.gv.egovernment.moa.id.auth.exception.BuildException;
+import at.gv.egovernment.moa.id.commons.db.dao.config.AuthComponentOA;
+import at.gv.egovernment.moa.id.commons.db.dao.config.BPKDecryption;
+import at.gv.egovernment.moa.id.commons.db.dao.config.EncBPKInformation;
+import at.gv.egovernment.moa.id.commons.db.dao.config.OnlineApplication;
+import at.gv.egovernment.moa.id.commons.validation.ValidationHelper;
+import at.gv.egovernment.moa.id.config.auth.data.BPKDecryptionParameters;
+import at.gv.egovernment.moa.id.configuration.Constants;
+import at.gv.egovernment.moa.id.configuration.auth.AuthenticatedUser;
+import at.gv.egovernment.moa.id.configuration.helper.LanguageHelper;
+import at.gv.egovernment.moa.id.configuration.utils.ConfigurationEncryptionUtils;
+import at.gv.egovernment.moa.id.configuration.validation.oa.OAFileUploadValidation;
+import at.gv.egovernment.moa.id.data.EncryptedData;
+import at.gv.egovernment.moa.util.MiscUtil;
+
+/**
+ * @author tlenz
+ *
+ */
+public class OABPKEncryption implements IOnlineApplicationData {
+
+	private static final Logger log = Logger.getLogger(OABPKEncryption.class);
+	
+	private static final String MODULENAME = "bPKEncryptionDecryption";
+	
+	private String keyStorePassword = null;
+	private String keyAlias = null;
+	private String keyPassword = null;
+	
+	private Map<String, byte[]> keyStoreForm = new HashMap<String, byte[]>();
+	
+	private List<File> keyStoreFileUpload = null;
+	private List<String> keyStoreFileUploadContentType = null;
+	private List<String> keyStoreFileUploadFileName  = new ArrayList<String>();;
+	private boolean deletekeyStore = false;
+	private boolean validationError = false;
+	
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.configuration.data.oa.IOnlineApplicationData#getName()
+	 */
+	@Override
+	public String getName() {
+		// TODO Auto-generated method stub
+		return MODULENAME;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.configuration.data.oa.IOnlineApplicationData#parse(at.gv.egovernment.moa.id.commons.db.dao.config.OnlineApplication, at.gv.egovernment.moa.id.configuration.auth.AuthenticatedUser, javax.servlet.http.HttpServletRequest)
+	 */
+	@Override
+	public List<String> parse(OnlineApplication dbOA,
+			AuthenticatedUser authUser, HttpServletRequest request) {
+		AuthComponentOA oaAuth = dbOA.getAuthComponentOA();
+		if (oaAuth != null) {
+			EncBPKInformation bPKEncDec = oaAuth.getEncBPKInformation();
+			if (bPKEncDec != null) {
+				BPKDecryption bPKDec = bPKEncDec.getBPKDecryption();
+				if (bPKDec != null) {
+					keyAlias = bPKDec.getKeyAlias();
+					if (bPKDec.getKeyStoreFileName() != null)
+						keyStoreFileUploadFileName.add(bPKDec.getKeyStoreFileName());
+					
+				}				
+			}						
+		}
+				
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.configuration.data.oa.IOnlineApplicationData#store(at.gv.egovernment.moa.id.commons.db.dao.config.OnlineApplication, at.gv.egovernment.moa.id.configuration.auth.AuthenticatedUser, javax.servlet.http.HttpServletRequest)
+	 */
+	@Override
+	public String store(OnlineApplication dbOA, AuthenticatedUser authUser,
+			HttpServletRequest request) {
+		AuthComponentOA oaAuth = dbOA.getAuthComponentOA();
+		if (oaAuth == null) {
+			oaAuth = new AuthComponentOA();
+			dbOA.setAuthComponentOA(oaAuth);
+			
+		}		
+		EncBPKInformation bPKEncDec = oaAuth.getEncBPKInformation();
+		if (bPKEncDec == null) {
+			bPKEncDec = new EncBPKInformation();
+			oaAuth.setEncBPKInformation(bPKEncDec);
+			
+		}
+				
+		BPKDecryption bPKDec = bPKEncDec.getBPKDecryption();
+		if (bPKDec == null) {
+			bPKDec = new BPKDecryption();
+			bPKEncDec.setBPKDecryption(bPKDec);
+		}
+		
+		if (isDeletekeyStore()) {
+			bPKDec.setIv(null);
+			bPKDec.setKeyAlias(null);
+			bPKDec.setKeyInformation(null);
+			bPKDec.setKeyStoreFileName(null);
+			
+		}
+		
+		BPKDecryptionParameters keyInfo = new BPKDecryptionParameters();
+		if (keyStoreForm != null && keyStoreForm.size() > 0) {			
+			keyInfo.setKeyAlias(keyAlias);
+			keyInfo.setKeyPassword(keyPassword);
+			keyInfo.setKeyStorePassword(keyStorePassword);
+			
+            Iterator<String> interator = keyStoreForm.keySet().iterator();
+            bPKDec.setKeyStoreFileName(interator.next());
+            bPKDec.setKeyAlias(keyAlias);            
+            keyInfo.setKeyStore(keyStoreForm.get(
+                    bPKDec.getKeyStoreFileName()));
+
+            //encrypt key information
+            byte[] serKeyInfo = SerializationUtils.serialize(keyInfo);            
+            try {
+				EncryptedData encryptkeyInfo = ConfigurationEncryptionUtils.getInstance().encrypt(serKeyInfo);
+				bPKDec.setIv(encryptkeyInfo.getIv());
+				bPKDec.setKeyInformation(encryptkeyInfo.getEncData());				
+				
+			} catch (BuildException e) {
+				log.error("Configuration encryption FAILED.", e);
+				return LanguageHelper.getErrorString("error.general.text", request);
+				
+			}
+		}
+		
+		request.getSession().setAttribute(Constants.SESSION_BPKENCRYPTIONDECRYPTION, null);
+		
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.configuration.data.oa.IOnlineApplicationData#validate(at.gv.egovernment.moa.id.configuration.data.oa.OAGeneralConfig, at.gv.egovernment.moa.id.configuration.auth.AuthenticatedUser, javax.servlet.http.HttpServletRequest)
+	 */
+	@Override
+	public List<String> validate(OAGeneralConfig general,
+			AuthenticatedUser authUser, HttpServletRequest request) {
+		HttpSession session = request.getSession();
+		List<String> errors = new ArrayList<String>();		
+		
+		String check = null;
+		
+		OAFileUploadValidation valiator_fileUpload = new OAFileUploadValidation();		
+        //validate BKU-selection template
+        List<String> templateError = valiator_fileUpload.validate(getKeyStoreFileUploadFileName()
+                , getKeyStoreFileUpload(), "validation.bPKDec.keyStore", keyStoreForm, request);
+        if (templateError != null && templateError.size() == 0) {
+            if (keyStoreForm != null && keyStoreForm.size() > 0) {
+                session.setAttribute(Constants.SESSION_BPKENCRYPTIONDECRYPTION, keyStoreForm);
+                
+            } else
+            	keyStoreForm = (Map<String, byte[]>) session.getAttribute(Constants.SESSION_BPKENCRYPTIONDECRYPTION);
+
+        } else {
+            errors.addAll(templateError);
+
+        }
+        
+        if (keyStoreForm != null && keyStoreForm.size() > 0) {
+    		check = getKeyStorePassword();
+    		if (MiscUtil.isEmpty(check)) {
+    			log.info("bPK decryption keystore password is empty");
+    			errors.add(LanguageHelper.getErrorString("validation.bPKDec.keyStorePassword.empty", request));
+    			
+    		} else {
+    			if (ValidationHelper.containsPotentialCSSCharacter(check, false)) {
+    				log.warn("bPK decryption keystore password contains potentail XSS characters: " + check);
+    				errors.add(LanguageHelper.getErrorString("validation.bPKDec.keyStorePassword.valid", 
+    						new Object[] {ValidationHelper.getPotentialCSSCharacter(false)}, request ));
+    				
+    			}			
+    		}
+    		
+    		check = getKeyAlias();
+    		if (MiscUtil.isEmpty(check)) {
+    			log.info("bPK decryption key alias is empty");
+    			errors.add(LanguageHelper.getErrorString("validation.bPKDec.keyAlias.empty", request));
+    			
+    		} else {
+    			if (ValidationHelper.containsPotentialCSSCharacter(check, false)) {
+    				log.warn("bPK decryption key alias contains potentail XSS characters: " + check);
+    				errors.add(LanguageHelper.getErrorString("validation.bPKDec.keyAlias.valid", 
+    						new Object[] {ValidationHelper.getPotentialCSSCharacter(false)}, request ));
+    				
+    			}			
+    		}
+    		
+    		check = getKeyPassword();
+    		if (MiscUtil.isNotEmpty(check)) {
+    			if (ValidationHelper.containsPotentialCSSCharacter(check, false)) {
+    				log.warn("bPK decryption key password contains potentail XSS characters: " + check);
+    				errors.add(LanguageHelper.getErrorString("validation.bPKDec.keyPassword.valid", 
+    						new Object[] {ValidationHelper.getPotentialCSSCharacter(false)}, request ));
+    				
+    			}			
+    		}
+        	        	
+        	BPKDecryptionParameters keyInfo = new BPKDecryptionParameters();
+        	keyInfo.setKeyAlias(keyAlias);
+        	keyInfo.setKeyPassword(keyPassword);
+        	keyInfo.setKeyStorePassword(keyStorePassword);    			
+        	Iterator<String> interator = keyStoreForm.keySet().iterator();
+        	String fileName = interator.next();            
+        	keyInfo.setKeyStore(keyStoreForm.get(fileName));                
+        	if (keyInfo.getPrivateKey() == null) {
+        		log.info("Open keyStore FAILED.");
+        		errors.add(LanguageHelper.getErrorString("validation.bPKDec.keyStore.file.valid", request));
+        	
+        	}        	
+        }
+		
+        if (errors.size() > 0) {
+        	validationError = true;
+        	
+        }
+        
+		return errors;
+		
+	}
+
+	/**
+	 * @return the keyStorePassword
+	 */
+	public String getKeyStorePassword() {
+		return keyStorePassword;
+	}
+
+	/**
+	 * @param keyStorePassword the keyStorePassword to set
+	 */
+	public void setKeyStorePassword(String keyStorePassword) {
+		this.keyStorePassword = keyStorePassword;
+	}
+
+	/**
+	 * @return the keyAlias
+	 */
+	public String getKeyAlias() {
+		return keyAlias;
+	}
+
+	/**
+	 * @param keyAlias the keyAlias to set
+	 */
+	public void setKeyAlias(String keyAlias) {
+		this.keyAlias = keyAlias;
+	}
+
+	/**
+	 * @return the keyPassword
+	 */
+	public String getKeyPassword() {
+		return keyPassword;
+	}
+
+	/**
+	 * @param keyPassword the keyPassword to set
+	 */
+	public void setKeyPassword(String keyPassword) {
+		this.keyPassword = keyPassword;
+	}
+
+	/**
+	 * @return the keyStoreFileUpload
+	 */
+	public List<File> getKeyStoreFileUpload() {
+		return keyStoreFileUpload;
+	}
+
+	/**
+	 * @param keyStoreFileUpload the keyStoreFileUpload to set
+	 */
+	public void setKeyStoreFileUpload(List<File> keyStoreFileUpload) {
+		this.keyStoreFileUpload = keyStoreFileUpload;
+	}
+
+	/**
+	 * @return the keyStoreFileUploadContentType
+	 */
+	public List<String> getKeyStoreFileUploadContentType() {
+		return keyStoreFileUploadContentType;
+	}
+
+	/**
+	 * @param keyStoreFileUploadContentType the keyStoreFileUploadContentType to set
+	 */
+	public void setKeyStoreFileUploadContentType(
+			List<String> keyStoreFileUploadContentType) {
+		this.keyStoreFileUploadContentType = keyStoreFileUploadContentType;
+	}
+
+	/**
+	 * @return the keyStoreFileUploadFileName
+	 */
+	public List<String> getKeyStoreFileUploadFileName() {
+		return keyStoreFileUploadFileName;
+	}
+
+	/**
+	 * @param keyStoreFileUploadFileName the keyStoreFileUploadFileName to set
+	 */
+	public void setKeyStoreFileUploadFileName(
+			List<String> keyStoreFileUploadFileName) {
+		this.keyStoreFileUploadFileName = keyStoreFileUploadFileName;
+	}
+
+	/**
+	 * @return the deletekeyStore
+	 */
+	public boolean isDeletekeyStore() {
+		return deletekeyStore;
+	}
+
+	/**
+	 * @param deletekeyStore the deletekeyStore to set
+	 */
+	public void setDeletekeyStore(boolean deletekeyStore) {
+		this.deletekeyStore = deletekeyStore;
+	}
+
+	/**
+	 * @return the validationError
+	 */
+	public boolean isValidationError() {
+		return validationError;
+	}
+	
+	
+
+}
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java
index 9509f9712..3d96cc1e5 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java
@@ -57,6 +57,9 @@ public class EditOAAction extends BasicOAAction {
 		OAAuthenticationData authOA = new OAAuthenticationData();
 		formList.put(authOA.getName(), authOA);
 
+		OABPKEncryption bPKEncDec = new OABPKEncryption();
+		formList.put(bPKEncDec.getName(), bPKEncDec);
+		
 		OASSOConfig ssoOA = new OASSOConfig();
 		formList.put(ssoOA.getName(), ssoOA);
 
@@ -472,4 +475,19 @@ public class EditOAAction extends BasicOAAction {
 		formList.put(formOA.getName(), formOA);
 	}
 
+	/**
+	 * @return the bPK encryption/decryption form
+	 */
+	public OABPKEncryption getBPKEncDecr() {
+		return (OABPKEncryption) formList.get(new OABPKEncryption().getName());
+	}
+
+	/**
+	 * @param bPK encryption/decryption form
+	 *            the bPK encryption/decryption form to set
+	 */
+	public void setBPKEncDecr(OABPKEncryption formOA) {
+		formList.put(formOA.getName(), formOA);
+	}
+	
 }
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/utils/ConfigurationEncryptionUtils.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/utils/ConfigurationEncryptionUtils.java
new file mode 100644
index 000000000..08cd7c59d
--- /dev/null
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/utils/ConfigurationEncryptionUtils.java
@@ -0,0 +1,79 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.configuration.utils;
+
+import at.gv.egovernment.moa.id.auth.exception.DatabaseEncryptionException;
+import at.gv.egovernment.moa.id.configuration.config.ConfigurationProvider;
+import at.gv.egovernment.moa.id.util.AbstractEncrytionUtil;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+public class ConfigurationEncryptionUtils extends AbstractEncrytionUtil {
+
+	private static ConfigurationEncryptionUtils instance = null;	
+	private static String key = null;
+	
+	public static ConfigurationEncryptionUtils getInstance() {
+		if (instance == null) {
+			try {
+				key = ConfigurationProvider.getInstance().getConfigurationEncryptionKey();
+				instance =  new ConfigurationEncryptionUtils();
+								
+			} catch (Exception e) {
+				Logger.warn("MOAConfiguration encryption initialization FAILED.", e);
+				
+			}					
+		}
+		return instance;
+	}
+	
+	/**
+	 * @throws DatabaseEncryptionException
+	 */
+	public ConfigurationEncryptionUtils() throws DatabaseEncryptionException {
+		super();
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.util.AbstractEncrytionUtil#getSalt()
+	 */
+	@Override
+	protected String getSalt() {
+		return "Configuration-Salt";
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.util.AbstractEncrytionUtil#getKey()
+	 */
+	@Override
+	protected String getKey() {
+		return key;
+		
+	}
+
+}
diff --git a/id/ConfigWebTool/src/main/resources/applicationResources_de.properties b/id/ConfigWebTool/src/main/resources/applicationResources_de.properties
index 2c71d86a5..35ae19f90 100644
--- a/id/ConfigWebTool/src/main/resources/applicationResources_de.properties
+++ b/id/ConfigWebTool/src/main/resources/applicationResources_de.properties
@@ -200,6 +200,15 @@ webpages.oaconfig.general.bku.sendassertion.header=Send-Assertion Template
 webpages.oaconfig.general.bku.sendassertion.filename=Dateiname
 webpages.oaconfig.general.bku.sendassertion.upload=Neues Template hochladen
 
+webpages.oaconfig.bPKEncDec.header=Fremd-bPK Konfiguration
+webpages.oaconfig.bPKEncDec.keystore.header=KeyStore Konfiguration
+webpages.oaconfig.bPKEncDec.filename=Dateiname
+webpages.oaconfig.bPKEncDec.delete=L\u00F6schen
+webpages.oaconfig.bPKEncDec.upload=KeyStore hochladen
+webpages.oaconfig.bPKEncDec.keyStorePassword=KeyStore Password
+webpages.oaconfig.bPKEncDec.keyAlias=Schl\u00FCsselname
+webpages.oaconfig.bPKEncDec.keyPassword=Schl\u00FCsselpassword
+
 webpages.oaconfig.general.identification=Eindeutiger Identifikatior (PublicURLPrefix)
 webpages.oaconfig.general.mandate.header=Vollmachten
 webpages.oaconfig.general.mandate.profiles=Profile
@@ -449,6 +458,15 @@ validation.general.sendassertion.file.valid=Das Send-Assertion Templates konnte
 validation.general.sendassertion.file.selected=Es kann nur EIN Send-Assertion Template angegeben werden.
 validation.general.testcredentials.oid.valid=Die Testdaten OID {0} ist ung\u00FCltig.
 
+validation.bPKDec.keyStorePassword.empty=Das Password f\u00FCr den KeyStore ist leer.
+validation.bPKDec.keyStorePassword.valid=Das Password f\u00FCr den KeyStore enth\u00E4lt nicht erlaubte Zeichen. Folgende Zeichen sind nicht erlaubt\: {0}
+validation.bPKDec.keyAlias.empty=Der Schl\u00FCsselname ist leer.
+validation.bPKDec.keyAlias.valid=Der Schl\u00FCsselname enth\u00E4lt nicht erlaubte Zeichen. Folgende Zeichen sind nicht erlaubt\: {0}
+validation.bPKDec.keyPassword.empty=Das Password f\u00FCr den privaten Schl\u00FCssel ist leer.
+validation.bPKDec.keyPassword.valid=Das Password f\u00FCr den privaten Schl\u00FCssel enth\u00E4lt nicht erlaubte Zeichen. Folgende Zeichen sind nicht erlaubt\: {0}
+validation.bPKDec.keyStore.filename.valid=Der Dateiname des KeyStores enth\u00E4lt nicht erlaubte Zeichen. Folgende Zeichen sind nicht erlaubt\: {0}
+validation.bPKDec.keyStore.file.valid=Der KeyStore konnte nicht geladen oder ge\u00F6ffnet werden. Eventuell sind das Passwort oder der Schl\u00FCsselname nicht korrekt.
+validation.bPKDec.keyStore.file.selected=Es kann nur EIN KeyStore angegeben werden.
 
 validation.stork.cpeps.cc=CPEPS L\u00E4ndercode folgt nicht ISO 3166-2
 validation.stork.cpeps.empty=CPEPS Konfiguration ist unvollst\u00E4ndig
diff --git a/id/ConfigWebTool/src/main/resources/applicationResources_en.properties b/id/ConfigWebTool/src/main/resources/applicationResources_en.properties
index a494ef089..22b063099 100644
--- a/id/ConfigWebTool/src/main/resources/applicationResources_en.properties
+++ b/id/ConfigWebTool/src/main/resources/applicationResources_en.properties
@@ -196,12 +196,21 @@ webpages.oaconfig.general.testing.oids=Use special test credential OIDs
 
 webpages.oaconfig.general.bku.delete=Remove
 webpages.oaconfig.general.bku.bkuselection.header=CCE-Selection Template
-webpages.oaconfig.general.bku.bkuselection.filename=File name
+webpages.oaconfig.general.bku.bkuselection.filename=Filename
 webpages.oaconfig.general.bku.bkuselection.upload=Upload new template
 webpages.oaconfig.general.bku.sendassertion.header=Send-Assertion Template
-webpages.oaconfig.general.bku.sendassertion.filename=File name
+webpages.oaconfig.general.bku.sendassertion.filename=Filename
 webpages.oaconfig.general.bku.sendassertion.upload=Upload new template
 
+webpages.oaconfig.bPKEncDec.header=Foreign-bPK Configuration
+webpages.oaconfig.bPKEncDec.keystore.header=Keystore configuration
+webpages.oaconfig.bPKEncDec.filename=Filename
+webpages.oaconfig.bPKEncDec.delete=Remove
+webpages.oaconfig.bPKEncDec.upload=Upload new keystore
+webpages.oaconfig.bPKEncDec.keyStorePassword=Keystore password
+webpages.oaconfig.bPKEncDec.keyAlias=Key alias
+webpages.oaconfig.bPKEncDec.keyPassword=Key password
+
 webpages.oaconfig.general.identification=Unique identifier (PublicURLPrefix)
 webpages.oaconfig.general.mandate.header=Mandates
 webpages.oaconfig.general.mandate.profiles=Profile
@@ -447,6 +456,16 @@ validation.general.sendassertion.file.valid=Send-Assertion Templates could not b
 validation.general.sendassertion.file.selected=Only one Send-Assertion Template can be provided.
 validation.general.testcredentials.oid.valid=The OID {0} for test credentials is not a valid.
 
+validation.bPKDec.keyStorePassword.empty=KeyStore password is blank.
+validation.bPKDec.keyStorePassword.valid=The keyStore password contains forbidden characters. The following characters are not allowed\: {0}
+validation.bPKDec.keyAlias.empty=Key alias is blank.
+validation.bPKDec.keyAlias.valid=The key alias contains forbidden characters. The following characters are not allowed\: {0}
+validation.bPKDec.keyPassword.empty=Key password is blank.
+validation.bPKDec.keyPassword.valid=The key password contains forbidden characters. The following characters are not allowed\: {0}
+validation.bPKDec.keyStore.filename.valid=The keyStore filename contains forbidden characters. The following characters are not allowed\: {0}
+validation.bPKDec.keyStore.file.valid=KeyStore can not loaded. Maybe keyStore password or key alias are wrong. 
+validation.bPKDec.keyStore.file.selected=Only one keyStore can be provided.
+
 validation.stork.cpeps.cc=CPEPS country code is not based on 3166-2
 validation.stork.cpeps.empty=CPEPS configuration is incomplete
 validation.stork.cpeps.url=CPEPS URL is invalid
diff --git a/id/ConfigWebTool/src/main/webapp/jsp/editOAGeneral.jsp b/id/ConfigWebTool/src/main/webapp/jsp/editOAGeneral.jsp
index a3541c9a7..c56ad4847 100644
--- a/id/ConfigWebTool/src/main/webapp/jsp/editOAGeneral.jsp
+++ b/id/ConfigWebTool/src/main/webapp/jsp/editOAGeneral.jsp
@@ -39,6 +39,8 @@
 					<s:include value="snippets/OA/targetConfiguration.jsp"></s:include>
 		
 					<s:include value="snippets/OA/authentication.jsp"></s:include>
+		
+					<s:include value="snippets/OA/bPKDecryption.jsp"></s:include>
 					
 					<s:include value="snippets/OA/sso.jsp"></s:include>
 					
@@ -82,7 +84,7 @@
 					</div>
 
 					<s:include value="snippets/OA/formCustomization.jsp"></s:include>
-					
+										
 					<s:hidden name="formID" 
 							value="%{formID}"></s:hidden>
 					
diff --git a/id/ConfigWebTool/src/main/webapp/jsp/snippets/OA/bPKDecryption.jsp b/id/ConfigWebTool/src/main/webapp/jsp/snippets/OA/bPKDecryption.jsp
new file mode 100644
index 000000000..9f506e7da
--- /dev/null
+++ b/id/ConfigWebTool/src/main/webapp/jsp/snippets/OA/bPKDecryption.jsp
@@ -0,0 +1,75 @@
+<%@page import="at.gv.egovernment.moa.id.configuration.helper.LanguageHelper"%>
+<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
+<%@ taglib prefix="s" uri="/struts-tags" %>
+
+<html>
+	<div class="oa_config_block">
+		<h3><%=LanguageHelper.getGUIString("webpages.oaconfig.bPKEncDec.header", request) %></h3>
+				
+<!-- 		<div class="oa_protocol_area"> -->
+			<%-- <h4><%=LanguageHelper.getGUIString("webpages.oaconfig.bPKEncDec.keystore.header", request) %></h4> --%>
+			<s:iterator value="%{BPKEncDecr.keyStoreFileUploadFileName}" var="fileNameBKU">
+				<div class="floatClass">
+					<s:label 	key="webpages.oaconfig.bPKEncDec.filename" 
+										value="%{fileNameBKU}"/>									
+					<s:label 	key="webpages.oaconfig.bPKEncDec.keyAlias" 
+										value="%{BPKEncDecr.keyAlias}"/>									
+					<s:checkbox key="webpages.oaconfig.bPKEncDec.delete"
+											labelposition="left"														
+											cssClass="checkbox"
+											name="BPKEncDecr.deletekeyStore"></s:checkbox>
+				</div>
+				<s:if test="BPKEncDecr.validationError">
+ 				<div id="pvp2_certificate_upload">
+					<s:file name="BPKEncDecr.keyStoreFileUpload" key="webpages.oaconfig.bPKEncDec.upload" cssClass="textfield_long"></s:file>					
+						<s:password 	name="BPKEncDecr.keyStorePassword" 												 
+													labelposition="left"
+													key="webpages.oaconfig.bPKEncDec.keyStorePassword"
+													cssClass="textfield_long"
+													showPassword="false">
+						</s:password>
+		
+						<s:textfield 	name="BPKEncDecr.keyAlias" 
+													value="%{BPKEncDecr.keyAlias}" 
+													labelposition="left"
+													key="webpages.oaconfig.bPKEncDec.keyAlias"
+													cssClass="textfield_long">
+						</s:textfield>
+		
+						<s:password 	name="BPKEncDecr.keyPassword" 													 
+													labelposition="left"
+													key="webpages.oaconfig.bPKEncDec.keyPassword"
+													cssClass="textfield_long"
+													showPassword="false">
+						</s:password>
+					</div>
+				</s:if>
+			</s:iterator>
+			<s:if test="BPKEncDecr.keyStoreFileUploadFileName.size() == 0">
+					<div id="pvp2_certificate_upload">
+					<s:file name="BPKEncDecr.keyStoreFileUpload" key="webpages.oaconfig.bPKEncDec.upload" cssClass="textfield_long"></s:file>
+										
+					<s:password 	name="BPKEncDecr.keyStorePassword"  
+												labelposition="left"
+												key="webpages.oaconfig.bPKEncDec.keyStorePassword"
+												cssClass="textfield_long">
+					</s:password>
+		
+					<s:textfield name="BPKEncDecr.keyAlias" 
+												value="%{BPKEncDecr.keyAlias}" 
+												labelposition="left"
+												key="webpages.oaconfig.bPKEncDec.keyAlias"
+												cssClass="textfield_long">
+					</s:textfield>
+		
+					<s:password 	name="BPKEncDecr.keyPassword" 
+												labelposition="left"
+												key="webpages.oaconfig.bPKEncDec.keyPassword"
+												cssClass="textfield_long">
+					</s:password>
+				</div>
+			</s:if>
+<!-- 		</div> -->
+				
+	</div>				
+</html>
\ No newline at end of file