Merge branch 'moa2_0_tlenz' of gitlab.iaik.tugraz.at:afitzek/moa-idspss into moa2_0_tlenz_bs_2

46 files changed, 1102 insertions, 178 deletions

diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java
index e0c6a69b7..b963890af 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java
@@ -51,7 +51,9 @@ public class Constants {
 	public static final String SESSION_PVP2REQUESTID = "pvp2requestid";
 	public static final String SESSION_RETURNAREA = "returnarea";
 	public static final String SESSION_BKUFORMPREVIEW = "bkuformpreview";
-	public static final String SESSION_OAUTH20SECRET = "oauth20secret";
+	public static final String SESSION_OAUTH20SECRET = "oauth20secret";	
+	public static final String SESSION_BKUSELECTIONTEMPLATE = "bkuSelectionTemplate";
+	public static final String SESSION_SENDASSERTIONTEMPLATE = "sendAssertionTemplate";
 	
 	
 	public static enum STRUTS_RETURNAREA_VALUES {adminRequestsInit, main, usermanagementInit}; 
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/BuildMetadata.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/BuildMetadata.java
index 56f593ce7..9a0f73a1f 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/BuildMetadata.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/BuildMetadata.java
@@ -45,6 +45,7 @@ import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamResult;
 
 import org.apache.log4j.Logger;
+import org.joda.time.DateTime;
 import org.opensaml.Configuration;
 import org.opensaml.common.impl.SecureRandomIdentifierGenerator;
 import org.opensaml.common.xml.SAMLConstants;
@@ -87,6 +88,8 @@ public class BuildMetadata extends HttpServlet {
 	
 	private static final Logger log = Logger.getLogger(BuildMetadata.class);
 
+	private static final int VALIDUNTIL_IN_HOURS = 24;
+	
 	/**
 	 * @see HttpServlet#HttpServlet()
 	 */
@@ -118,6 +121,9 @@ public class BuildMetadata extends HttpServlet {
 			EntitiesDescriptor spEntitiesDescriptor = SAML2Utils.
 					createSAMLObject(EntitiesDescriptor.class);
 			
+			DateTime date = new DateTime();	
+			spEntitiesDescriptor.setValidUntil(date.plusHours(VALIDUNTIL_IN_HOURS));
+			
 			String name = config.getPVP2MetadataEntitiesName();
 			if (MiscUtil.isEmpty(name)) {
 				log.info("NO Metadata EntitiesName configurated");
@@ -130,6 +136,8 @@ public class BuildMetadata extends HttpServlet {
 			EntityDescriptor spEntityDescriptor = SAML2Utils
 					.createSAMLObject(EntityDescriptor.class);
 
+			spEntityDescriptor.setValidUntil(date.plusDays(VALIDUNTIL_IN_HOURS));
+			
 			spEntitiesDescriptor.getEntityDescriptors().add(spEntityDescriptor);
 			
 			String serviceURL = config.getPublicUrlPreFix(request);
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/FormularCustomization.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/FormularCustomization.java
index 49d556ba4..687925c18 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/FormularCustomization.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/FormularCustomization.java
@@ -49,7 +49,10 @@ public class FormularCustomization {
 	private String button_BackGroundColor = null;
 	private String button_BackGroundColorFocus = null;
 	private String button_FrontColor = null;
-
+	private String applet_height = null;
+	private String applet_width = null;
+	
+	
 	private String appletRedirectTarget = null;
 	public static List<String> appletRedirectTargetList = null;
 	
@@ -79,6 +82,14 @@ public class FormularCustomization {
 						onlyMandateAllowed = formcustom.isOnlyMandateLoginAllowed();
 					}
 					
+					if (formcustom.getAppletHeight() != null) {
+						applet_height = formcustom.getAppletHeight();
+					}
+					
+					if (formcustom.getAppletHeight() != null) {
+						applet_width = formcustom.getAppletWidth();
+					}
+					
 					if (MiscUtil.isNotEmpty(formcustom.getAppletRedirectTarget()))
 						appletRedirectTarget = formcustom.getAppletRedirectTarget();
 					
@@ -351,6 +362,35 @@ public class FormularCustomization {
 		this.fontTypeListValue = fontTypeListValue;
 	}
 
+	/**
+	 * @return the applet_height
+	 */
+	public String getApplet_height() {
+		return applet_height;
+	}
+
+	/**
+	 * @param applet_height the applet_height to set
+	 */
+	public void setApplet_height(String applet_height) {
+		this.applet_height = applet_height;
+	}
+
+	/**
+	 * @return the applet_width
+	 */
+	public String getApplet_width() {
+		return applet_width;
+	}
+
+	/**
+	 * @param applet_width the applet_width to set
+	 */
+	public void setApplet_width(String applet_width) {
+		this.applet_width = applet_width;
+	}
+
+	
 	
 	
 	
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OAGeneralConfig.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OAGeneralConfig.java
index 334124cfd..079e6807e 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OAGeneralConfig.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OAGeneralConfig.java
@@ -22,6 +22,7 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.configuration.data.oa;
 
+import java.io.File;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
@@ -87,6 +88,16 @@ public class OAGeneralConfig {
 	
 	private Map<String, byte[]> transformations;
 	
+	private List<File> bkuSelectionFileUpload = null;
+	private List<String> bkuSelectionFileUploadContentType = null;
+	private List<String> bkuSelectionFileUploadFileName = new ArrayList<String>();
+	
+	private List<File> sendAssertionFileUpload = null;
+	private List<String> sendAssertionFileUploadContentType = null;
+	private List<String> sendAssertionFileUploadFileName  = new ArrayList<String>();;
+	
+	private boolean deleteBKUTemplate = false;
+	private boolean deleteSendAssertionTemplate = false;
 
 	
 	public OAGeneralConfig() {
@@ -225,6 +236,16 @@ public class OAGeneralConfig {
 						SLTemplates.add(el.getURL());
 					}
 				}
+				
+				TransformsInfoType bkuSelectTemplate = templates.getBKUSelectionTemplate();
+				if (bkuSelectTemplate != null && MiscUtil.isNotEmpty(bkuSelectTemplate.getFilename())) {
+					bkuSelectionFileUploadFileName.add(bkuSelectTemplate.getFilename());					
+				}
+				
+				TransformsInfoType sendAssertionTemplate = templates.getSendAssertionTemplate();
+				if (sendAssertionTemplate != null && MiscUtil.isNotEmpty(sendAssertionTemplate.getFilename())) {
+					sendAssertionFileUploadFileName.add(sendAssertionTemplate.getFilename());					
+				}
 			}
 		
 			if (SLTemplates != null && SLTemplates.size() > 0)
@@ -602,7 +623,140 @@ public class OAGeneralConfig {
 	 */
 	public void setUseMandates(boolean useMandates) {
 		this.useMandates = useMandates;
+	}
+
+
+	/**
+	 * @return the bkuSelectionFileUpload
+	 */
+	public List<File> getBkuSelectionFileUpload() {
+		return bkuSelectionFileUpload;
+	}
+
+
+	/**
+	 * @param bkuSelectionFileUpload the bkuSelectionFileUpload to set
+	 */
+	public void setBkuSelectionFileUpload(List<File> bkuSelectionFileUpload) {
+		this.bkuSelectionFileUpload = bkuSelectionFileUpload;
+	}
+
+
+	/**
+	 * @return the bkuSelectionFileUploadContentType
+	 */
+	public List<String> getBkuSelectionFileUploadContentType() {
+		return bkuSelectionFileUploadContentType;
+	}
+
+
+	/**
+	 * @param bkuSelectionFileUploadContentType the bkuSelectionFileUploadContentType to set
+	 */
+	public void setBkuSelectionFileUploadContentType(
+			List<String> bkuSelectionFileUploadContentType) {
+		this.bkuSelectionFileUploadContentType = bkuSelectionFileUploadContentType;
+	}
+
+
+	/**
+	 * @return the bkuSelectionFileUploadFileName
+	 */
+	public List<String> getBkuSelectionFileUploadFileName() {
+		return bkuSelectionFileUploadFileName;
+	}
+
+
+	/**
+	 * @param bkuSelectionFileUploadFileName the bkuSelectionFileUploadFileName to set
+	 */
+	public void setBkuSelectionFileUploadFileName(
+			List<String> bkuSelectionFileUploadFileName) {
+		this.bkuSelectionFileUploadFileName = bkuSelectionFileUploadFileName;
+	}
+
+
+	/**
+	 * @return the sendAssertionFileUpload
+	 */
+	public List<File> getSendAssertionFileUpload() {
+		return sendAssertionFileUpload;
+	}
+
+
+	/**
+	 * @param sendAssertionFileUpload the sendAssertionFileUpload to set
+	 */
+	public void setSendAssertionFileUpload(List<File> sendAssertionFileUpload) {
+		this.sendAssertionFileUpload = sendAssertionFileUpload;
+	}
+
+
+	/**
+	 * @return the sendAssertionFileUploadContentType
+	 */
+	public List<String> getSendAssertionFileUploadContentType() {
+		return sendAssertionFileUploadContentType;
+	}
+
+
+	/**
+	 * @param sendAssertionFileUploadContentType the sendAssertionFileUploadContentType to set
+	 */
+	public void setSendAssertionFileUploadContentType(
+			List<String> sendAssertionFileUploadContentType) {
+		this.sendAssertionFileUploadContentType = sendAssertionFileUploadContentType;
+	}
+
+
+	/**
+	 * @return the sendAssertionFileUploadFileName
+	 */
+	public List<String> getSendAssertionFileUploadFileName() {
+		return sendAssertionFileUploadFileName;
+	}
+
+
+	/**
+	 * @param sendAssertionFileUploadFileName the sendAssertionFileUploadFileName to set
+	 */
+	public void setSendAssertionFileUploadFileName(
+			List<String> sendAssertionFileUploadFileName) {
+		this.sendAssertionFileUploadFileName = sendAssertionFileUploadFileName;
+	}
+
+
+	/**
+	 * @return the deleteBKUTemplate
+	 */
+	public boolean isDeleteBKUTemplate() {
+		return deleteBKUTemplate;
+	}
+
+
+	/**
+	 * @param deleteBKUTemplate the deleteBKUTemplate to set
+	 */
+	public void setDeleteBKUTemplate(boolean deleteBKUTemplate) {
+		this.deleteBKUTemplate = deleteBKUTemplate;
+	}
+
+
+	/**
+	 * @return the deleteSendAssertionTemplate
+	 */
+	public boolean isDeleteSendAssertionTemplate() {
+		return deleteSendAssertionTemplate;
+	}
+
+
+	/**
+	 * @param deleteSendAssertionTemplate the deleteSendAssertionTemplate to set
+	 */
+	public void setDeleteSendAssertionTemplate(boolean deleteSendAssertionTemplate) {
+		this.deleteSendAssertionTemplate = deleteSendAssertionTemplate;
 	}	
 	
 	
+	
 }
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OAPVP2Config.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OAPVP2Config.java
index 0a03ac77b..843844e22 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OAPVP2Config.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OAPVP2Config.java
@@ -42,6 +42,8 @@ public class OAPVP2Config {
 	
 	private final Logger log = Logger.getLogger(OAPVP2Config.class);
 	
+	private boolean reLoad = false;
+	
 	private String metaDataURL = null;
 	private String certificateDN = null;
 	
@@ -139,6 +141,20 @@ public class OAPVP2Config {
 	public void setFileUploadFileName(String fileUploadFileName) {
 		this.fileUploadFileName = fileUploadFileName;
 	}
+
+	/**
+	 * @return the reLoad
+	 */
+	public boolean isReLoad() {
+		return reLoad;
+	}
+
+	/**
+	 * @param reLoad the reLoad to set
+	 */
+	public void setReLoad(boolean reLoad) {
+		this.reLoad = reLoad;
+	}
 	
 	
 }
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java
index 25c3f24b9..b0de196ca 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java
@@ -34,6 +34,7 @@ import java.security.cert.CertificateException;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.HashMap;
+import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
 
@@ -63,7 +64,6 @@ import at.gv.egovernment.moa.id.commons.db.dao.config.OASSO;
 import at.gv.egovernment.moa.id.commons.db.dao.config.OASTORK;
 import at.gv.egovernment.moa.id.commons.db.dao.config.OnlineApplication;
 import at.gv.egovernment.moa.id.commons.db.dao.config.OnlineApplicationType;
-import at.gv.egovernment.moa.id.commons.db.dao.config.STORK;
 import at.gv.egovernment.moa.id.commons.db.dao.config.TemplateType;
 import at.gv.egovernment.moa.id.commons.db.dao.config.TemplatesType;
 import at.gv.egovernment.moa.id.commons.db.dao.config.TransformsInfoType;
@@ -85,6 +85,7 @@ import at.gv.egovernment.moa.id.configuration.helper.MailHelper;
 import at.gv.egovernment.moa.id.configuration.validation.FormularCustomizationValitator;
 import at.gv.egovernment.moa.id.configuration.validation.TargetValidator;
 import at.gv.egovernment.moa.id.configuration.validation.ValidationHelper;
+import at.gv.egovernment.moa.id.configuration.validation.oa.OAFileUploadValidation;
 import at.gv.egovernment.moa.id.configuration.validation.oa.OAGeneralConfigValidation;
 import at.gv.egovernment.moa.id.configuration.validation.oa.OAOAUTH20ConfigValidation;
 import at.gv.egovernment.moa.id.configuration.validation.oa.OAPVP2ConfigValidation;
@@ -126,9 +127,12 @@ public class EditOAAction extends ActionSupport implements ServletRequestAware,
 	private OAOAuth20Config oauth20OA = new OAOAuth20Config();
 	private OASTORKConfig storkOA = new OASTORKConfig();
 	private FormularCustomization formOA = new FormularCustomization();
-	
+		
 	private InputStream stream;
 	
+	private Map<String, byte[]> sendAssertionForm = new HashMap<String, byte[]>();
+	private Map<String, byte[]> bkuSelectionForm = new HashMap<String, byte[]>();
+	
 	// STRUTS actions
 	public String inital() {
 		HttpSession session = request.getSession();
@@ -365,6 +369,7 @@ public class EditOAAction extends ActionSupport implements ServletRequestAware,
 		OASTORKConfigValidation validator_stork = new OASTORKConfigValidation();
 		FormularCustomizationValitator validator_form = new FormularCustomizationValitator();
 		OAOAUTH20ConfigValidation validatior_oauth20 = new OAOAUTH20ConfigValidation();
+		OAFileUploadValidation valiator_fileUpload = new OAFileUploadValidation();
 		
 		errors.addAll(validatior_general.validate(generalOA, authUser.isAdmin()));
 		errors.addAll(validatior_pvp2.validate(pvp2OA));
@@ -374,6 +379,37 @@ public class EditOAAction extends ActionSupport implements ServletRequestAware,
 		errors.addAll(validator_form.validate(formOA));
 		errors.addAll(validatior_oauth20.validate(oauth20OA));
 		
+		//validate BKU-selection template		
+		List<String> templateError = valiator_fileUpload.validate(generalOA.getBkuSelectionFileUploadFileName()
+				, generalOA.getBkuSelectionFileUpload(), "validation.general.bkuselection", bkuSelectionForm);
+		if (templateError != null && templateError.size() == 0) {
+			if (bkuSelectionForm != null && bkuSelectionForm.size() > 0)
+				session.setAttribute(Constants.SESSION_BKUSELECTIONTEMPLATE, bkuSelectionForm);
+			
+			else
+				bkuSelectionForm = (Map<String, byte[]>) session.getAttribute(Constants.SESSION_BKUSELECTIONTEMPLATE);
+
+		} else {
+			errors.addAll(templateError);
+			
+		}
+		
+		//validate send-assertion template
+		templateError = valiator_fileUpload.validate(generalOA.getSendAssertionFileUploadFileName()
+				, generalOA.getSendAssertionFileUpload(), "validation.general.sendassertion", sendAssertionForm);
+		if (templateError != null && templateError.size() == 0) {			
+			if (sendAssertionForm != null && sendAssertionForm.size() > 0)
+				session.setAttribute(Constants.SESSION_SENDASSERTIONTEMPLATE, sendAssertionForm);
+			
+			else
+				sendAssertionForm = (Map<String, byte[]>) session.getAttribute(Constants.SESSION_SENDASSERTIONTEMPLATE);
+
+		} else {
+			errors.addAll(templateError);
+			
+		}
+		
+		
 		// Do not allow SSO in combination with special BKUSelection features
 		if (ssoOA.isUseSSO() && (formOA.isOnlyMandateAllowed() || !formOA.isShowMandateLoginButton())) {
 			log.warn("Special BKUSelection features can not be used in combination with SSO");
@@ -432,12 +468,26 @@ public class EditOAAction extends ActionSupport implements ServletRequestAware,
 					}
 				}
 			}
+
+			//save OA configuration
+			String error = saveOAConfigToDatabase(onlineapplication, newentry);
+			if (MiscUtil.isNotEmpty(error)) {
+				log.warn("OA configuration can not be stored!");
+				addActionError(error);
+				
+				formID = Random.nextRandom();
+				session.setAttribute(Constants.SESSION_FORMID, formID);
+				return Constants.STRUTS_ERROR_VALIDATION;
+			}
 			
+			//set metadata reload flag if reload is required 
 			if (pvp2OA.getMetaDataURL() != null) {
 				
 				try {
 					if (isMetaDataRefreshRequired
-							|| !pvp2OA.getMetaDataURL().equals(onlineapplication.getAuthComponentOA().getOAPVP2().getMetadataURL())) {
+							|| !pvp2OA.getMetaDataURL().equals(onlineapplication.getAuthComponentOA().getOAPVP2().getMetadataURL())
+							|| pvp2OA.getFileUpload() != null
+							|| pvp2OA.isReLoad()) {
 						
 						log.debug("Set PVP2 Metadata refresh flag.");
 						MOAIDConfiguration moaconfig = ConfigurationDBRead.getMOAIDConfiguration();
@@ -451,16 +501,6 @@ public class EditOAAction extends ActionSupport implements ServletRequestAware,
 				}
 				
 			}
-			
-			String error = saveOAConfigToDatabase(onlineapplication, newentry);
-			if (MiscUtil.isNotEmpty(error)) {
-				log.warn("OA configuration can not be stored!");
-				addActionError(error);
-				
-				formID = Random.nextRandom();
-				session.setAttribute(Constants.SESSION_FORMID, formID);
-				return Constants.STRUTS_ERROR_VALIDATION;
-			}
 		}
 		
 		Object nextPageAttr = session.getAttribute(Constants.SESSION_RETURNAREA);
@@ -495,9 +535,12 @@ public class EditOAAction extends ActionSupport implements ServletRequestAware,
 		} else
 			addActionMessage(LanguageHelper.getGUIString("webpages.oaconfig.success", generalOA.getIdentifier(), request));
 		
-		request.getSession().setAttribute(Constants.SESSION_OAID, null);
-		ConfigurationDBUtils.closeSession();
+		//remove session attributes
+		session.setAttribute(Constants.SESSION_OAID, null);
+		session.removeAttribute(Constants.SESSION_BKUSELECTIONTEMPLATE);
+		session.removeAttribute(Constants.SESSION_SENDASSERTIONTEMPLATE);
 		
+		ConfigurationDBUtils.closeSession();
 		return Constants.STRUTS_SUCCESS;
 	}
 	
@@ -808,6 +851,7 @@ public class EditOAAction extends ActionSupport implements ServletRequestAware,
 			}
 		}
 		
+		//store BKU-URLs
 		BKUURLS bkuruls = new BKUURLS();
 		authoa.setBKUURLS(bkuruls);
 		if (authUser.isAdmin()) {
@@ -822,6 +866,41 @@ public class EditOAAction extends ActionSupport implements ServletRequestAware,
 			authoa.setTemplates(templates);
 		}
 		
+		//store BKU-selection and send-assertion templates
+		if (authUser.isAdmin()) {
+			
+			if(generalOA.isDeleteBKUTemplate())
+				templates.setBKUSelectionTemplate(null);
+			
+			if (generalOA.isDeleteSendAssertionTemplate())
+				templates.setSendAssertionTemplate(null);
+			
+			
+			if (bkuSelectionForm != null && bkuSelectionForm.size() > 0) {
+				TransformsInfoType template = new TransformsInfoType();
+				
+				Iterator<String> interator = bkuSelectionForm.keySet().iterator();
+				template.setFilename(interator.next());
+				template.setTransformation(bkuSelectionForm.get(
+						template.getFilename()));
+				
+				templates.setBKUSelectionTemplate(template);					
+			}
+			
+			if (sendAssertionForm != null && sendAssertionForm.size() > 0) {
+				TransformsInfoType template = new TransformsInfoType();
+				
+				Iterator<String> interator = sendAssertionForm.keySet().iterator();
+				template.setFilename(interator.next());
+				template.setTransformation(sendAssertionForm.get(
+						template.getFilename()));
+				
+				templates.setSendAssertionTemplate(template);					
+			}	
+		}
+		
+		
+		//store BKU-selection customization
 		BKUSelectionCustomizationType bkuselectioncustom = templates.getBKUSelectionCustomization();
 		if (bkuselectioncustom == null) {
 			bkuselectioncustom = new BKUSelectionCustomizationType();
@@ -887,6 +966,9 @@ public class EditOAAction extends ActionSupport implements ServletRequestAware,
 			
 			bkuselectioncustom.setFontType(formOA.getFontType());
 			
+			bkuselectioncustom.setAppletHeight(formOA.getApplet_height());
+			bkuselectioncustom.setAppletWidth(formOA.getApplet_width());
+			
 		}
 		
 		// set default transformation if it is empty
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/IndexAction.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/IndexAction.java
index a488d919d..ee9b38f74 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/IndexAction.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/IndexAction.java
@@ -138,7 +138,19 @@ public class IndexAction extends ActionSupport implements ServletRequestAware,
 	
 	public String authenticate() {
 		
-		String key = null;
+		ConfigurationProvider config;
+		try {
+			config = ConfigurationProvider.getInstance();
+			pvp2LoginActiv = config.isPVP2LoginActive();
+						
+		} catch (ConfigurationException e1) {
+			log.warn("An internal error occurs.", e1);
+			pvp2LoginActiv = false;
+		}
+
+		
+		
+		String key = null;		
 		
 		if (MiscUtil.isNotEmpty(username)) {
 			if (ValidationHelper.containsPotentialCSSCharacter(username, false)) {
@@ -247,7 +259,8 @@ public class IndexAction extends ActionSupport implements ServletRequestAware,
 		
 			try {
 				ConfigurationProvider config = ConfigurationProvider.getInstance();
-				
+				pvp2LoginActiv = config.isPVP2LoginActive();
+								
 				//Decode with HttpPost Binding
 				HTTPPostDecoder decode = new HTTPPostDecoder(new BasicParserPool());
 				BasicSAMLMessageContext<Response, ?, ?> messageContext = new BasicSAMLMessageContext<Response, SAMLObject, SAMLObject>();
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/FormularCustomizationValitator.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/FormularCustomizationValitator.java
index 6a1eddb14..758aa7dc7 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/FormularCustomizationValitator.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/FormularCustomizationValitator.java
@@ -148,6 +148,24 @@ public class FormularCustomizationValitator {
 			}
 		}
 		
+		check = form.getApplet_height();
+		if (MiscUtil.isNotEmpty(check)) {
+			if (!ValidationHelper.validateNumber(check)) {
+				log.warn("Applet height "+ check + " is no valid number");
+				errors.add(LanguageHelper.getErrorString("validation.general.form.applet.height", 
+						new Object[] {ValidationHelper.getPotentialCSSCharacter(true)} ));
+			}			
+		}
+		
+		check = form.getApplet_width();
+		if (MiscUtil.isNotEmpty(check)) {
+			if (!ValidationHelper.validateNumber(check)) {
+				log.warn("Applet width "+ check + " is no valid number");
+				errors.add(LanguageHelper.getErrorString("validation.general.form.applet.width", 
+						new Object[] {ValidationHelper.getPotentialCSSCharacter(true)} ));
+			}			
+		}
+		
 		return errors;
 		
 	}
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/oa/OAFileUploadValidation.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/oa/OAFileUploadValidation.java
new file mode 100644
index 000000000..8887aeaad
--- /dev/null
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/oa/OAFileUploadValidation.java
@@ -0,0 +1,90 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.configuration.validation.oa;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.commons.io.IOUtils;
+import org.apache.log4j.Logger;
+
+import at.gv.egovernment.moa.id.configuration.data.oa.OAGeneralConfig;
+import at.gv.egovernment.moa.id.configuration.helper.LanguageHelper;
+import at.gv.egovernment.moa.id.configuration.validation.ValidationHelper;
+import at.gv.egovernment.moa.util.Base64Utils;
+import at.gv.egovernment.moa.util.MiscUtil;
+
+/**
+ * @author tlenz
+ *
+ */
+public class OAFileUploadValidation {
+
+	private static final Logger log = Logger.getLogger(OASSOConfigValidation.class);
+	
+	public List<String> validate(List<String> fileName, List<File> files, String errorMsgPreFix, Map<String, byte[]> output) {
+		
+		List<String> errors = new ArrayList<String>();
+		
+		if (fileName != null) {
+			
+			if (fileName.size() > 1) {
+				log.info("Only one BKU-selecten template file can be stored");
+				errors.add(LanguageHelper.getErrorString(errorMsgPreFix + ".file.selected"));
+			}
+			
+			for (int i=0; i<fileName.size(); i++) {
+				String filename = fileName.get(i);
+				
+				if (MiscUtil.isNotEmpty(filename)) {
+					if (ValidationHelper.containsPotentialCSSCharacter(filename, false)) {
+						log.info("Filename is not valid");
+						errors.add(LanguageHelper.getErrorString(errorMsgPreFix + ".filename.valid"));
+						
+					} else {
+						try {
+							File file = files.get(i);
+							InputStream stream = new FileInputStream(file);
+							output.put(filename, IOUtils.toByteArray(stream));
+							stream.close();
+							
+						} catch (IOException e) {
+							log.info("File with FileName "
+									+ filename +" can not be loaded." , e);
+							errors.add(LanguageHelper.getErrorString(errorMsgPreFix + ".file.valid", 
+									new Object[] {filename} ));
+						}	
+					}
+				}
+			}
+		}
+		
+		return errors;
+	}
+}
diff --git a/id/ConfigWebTool/src/main/resources/applicationResources.properties b/id/ConfigWebTool/src/main/resources/applicationResources.properties
index 50fa8168e..ab61b8d0d 100644
--- a/id/ConfigWebTool/src/main/resources/applicationResources.properties
+++ b/id/ConfigWebTool/src/main/resources/applicationResources.properties
@@ -166,9 +166,18 @@ webpages.oaconfig.general.bku.handy=Handy BKU
 webpages.oaconfig.general.bku.slversion=SecurityLayer Version
 webpages.oaconfig.general.bku.keyboxidentifier=KeyBoxIdentifier
 webpages.oaconfig.general.bku.legacy=SecurityLayerTemplates (Legacy Request)
-webpages.oaconfig.general.bku.sltemplate.first=1. SecurityLayer Template
-webpages.oaconfig.general.bku.sltemplate.second=2. SecurityLayer Template
-webpages.oaconfig.general.bku.sltemplate.third=3. SecurityLayer Template
+webpages.oaconfig.general.bku.sltemplate.first=SecurityLayer Template
+webpages.oaconfig.general.bku.sltemplate.second=SecurityLayer Template (WhiteList)
+webpages.oaconfig.general.bku.sltemplate.third=SecurityLayer Template (WhiteList)
+
+webpages.oaconfig.general.bku.delete=L\u00F6schen
+webpages.oaconfig.general.bku.bkuselection.header=BKU-Selection Template
+webpages.oaconfig.general.bku.bkuselection.filename=Dateiname
+webpages.oaconfig.general.bku.bkuselection.upload=Neues Template hochladen
+webpages.oaconfig.general.bku.sendassertion.header=Send-Assertion Template
+webpages.oaconfig.general.bku.sendassertion.filename=Dateiname
+webpages.oaconfig.general.bku.sendassertion.upload=Neues Template hochladen
+
 webpages.oaconfig.general.identification=Eindeutiger Identifikatior (PublicURLPrefix)
 webpages.oaconfig.general.mandate.header=Vollmachten
 webpages.oaconfig.general.mandate.profiles=Profile
@@ -221,6 +230,8 @@ webpages.oaconfig.general.BKUSelection.header.button.front=Vordergrundfarbe der
 webpages.oaconfig.general.BKUSelection.redirectTarget=Targetparameter
 webpages.oaconfig.general.BKUSelection.fonttype=Formularschrifttyp
 webpages.oaconfig.general.BKUSelection.fonttype.list=Formularschrifttypen
+webpages.oaconfig.general.BKUSelection.header.applet.height=Appleth\u00F6he
+webpages.oaconfig.general.BKUSelection.header.applet.width=Appletbreite
 
 webpages.oaconfig.sso.header=Single Sign-On
 webpages.oaconfig.sso.singlelogouturl=Single Log-Out URL
@@ -251,6 +262,7 @@ webpages.oaconfig.saml1.useCondition=Usecondition
 webpages.oaconfig.saml1.conditionLength=ConditionLength
 
 webpages.oaconfig.protocols.pvp2.header=PVP2.x Konfiguration
+webpages.oaconfig.pvp2.reload=PVP2.x konfiguration neu laden
 webpages.oaconfig.pvp2.metaDataURL=URL zu den Metadaten
 webpages.oaconfig.pvp2.certifcate=Zertifikat hochladen
 webpages.oaconfig.pvp2.certifcate.info=Infos zum Zertifikat
@@ -382,6 +394,14 @@ validation.general.oaidentifier.empty=Es wurde kein eindeutiger Identifier f\u00
 validation.general.oaidentifier.valid=Der eindeutige Identifier f\u00FCr die Online-Applikation ist keine g\u00FCltige URL.
 validation.general.oaidentifier.notunique=Der gew\u00E4hlte eindeutige Identifier ist bereits vorhanden. Eine Eintragung der Online-Applikation ist nicht m\u00F6glich.
 
+validation.general.bkuselection.filename.valid=Der Dateiname des BKU-Selektion Templates enth\u00E4lt nicht erlaubte Zeichen. Folgende Zeichen sind nicht erlaubt\: {0}
+validation.general.bkuselection.file.valid=Das BKU-Selektion Templates konnte nicht geladen werden.
+validation.general.bkuselection.file.selected=Es kann nur EIN BKU-Selektion Template angegeben werden.
+validation.general.sendassertion.filename.valid=Der Dateiname des Send-Assertion Templates enth\u00E4lt nicht erlaubte Zeichen. Folgende Zeichen sind nicht erlaubt\: {0}
+validation.general.sendassertion.file.valid=Das Send-Assertion Templates konnte nicht geladen werden.
+validation.general.sendassertion.file.selected=Es kann nur EIN Send-Assertion Template angegeben werden.
+
+
 validation.stork.cpeps.cc=CPEPS L\u00E4ndercode folgt nicht ISO 3166-2
 validation.stork.cpeps.empty=CPEPS Konfiguration ist unvollst\u00E4ndig
 validation.stork.cpeps.url=CPEPS URL ist ung\u00FCltig
@@ -413,3 +433,5 @@ validation.general.form.button.color.back=Die Hintergrundfarbe der BKU-Auswahlbu
 validation.general.form.button.color.front=Die Vordergrundfarbe der BKU-Auswahlbuttons enth\\u00E4lt keinen g\\u00FCltigen Hexadezimalwert. (z.B. \\\#FFFFFF)
 validation.general.form.appletredirecttarget=Der RedirectTarget beinhaltet einen ung\\u00FCltiten Wert.
 validation.general.form.fonttype=Der BKU-Auswahl Schrifttyp enth\u00E4lt nicht erlaubte Zeichen. Folgende Zeichen sind nicht erlaubt\: {0}
+validation.general.form.applet.width=Die Appleth\u00F6he ist keine g\\u00FCltige Zahl.
+validation.general.form.applet.height=Die Appletbreite ist keine g\\u00FCltige Zahl.
diff --git a/id/ConfigWebTool/src/main/webapp/css/index.css b/id/ConfigWebTool/src/main/webapp/css/index.css
index 79f8b4e72..e3d2763c2 100644
--- a/id/ConfigWebTool/src/main/webapp/css/index.css
+++ b/id/ConfigWebTool/src/main/webapp/css/index.css
@@ -168,8 +168,15 @@ body {
 .oa_protocol_area {
     clear: both;
     margin-left: 25px;
-    padding-top: 20px;
-    display: none;
+    padding-top: 20px; 
+}
+
+.hidden {
+	display: none;
+}
+
+.floatClass > .wwgrp {
+	clear: none;
 }
 
 .oa_protocol_area >h4 {
diff --git a/id/ConfigWebTool/src/main/webapp/jsp/editMOAConfig.jsp b/id/ConfigWebTool/src/main/webapp/jsp/editMOAConfig.jsp
index 2e0e5ea2a..1bb429afa 100644
--- a/id/ConfigWebTool/src/main/webapp/jsp/editMOAConfig.jsp
+++ b/id/ConfigWebTool/src/main/webapp/jsp/editMOAConfig.jsp
@@ -399,6 +399,7 @@
 									<s:file name="moaconfig.fileUpload" key="webpages.moaconfig.sl.transormations.upload" cssClass="textfield_long"></s:file>
 								</div>
 							</s:iterator>
+							
 							<s:if test="moaconfig.fileUploadFileName.size() == 0">
 									<div id="pvp2_certificate_upload">
 									<s:file name="moaconfig.fileUpload" key="webpages.moaconfig.sl.transormations.upload" cssClass="textfield_long"></s:file>
diff --git a/id/ConfigWebTool/src/main/webapp/jsp/editOAGeneral.jsp b/id/ConfigWebTool/src/main/webapp/jsp/editOAGeneral.jsp
index 4e8dfc259..fadf528d1 100644
--- a/id/ConfigWebTool/src/main/webapp/jsp/editOAGeneral.jsp
+++ b/id/ConfigWebTool/src/main/webapp/jsp/editOAGeneral.jsp
@@ -240,6 +240,49 @@
 									cssClass="textfield_long">
 								</s:textfield>
 							</div>
+							
+							<div class="oa_protocol_area">
+								<h4><%=LanguageHelper.getGUIString("webpages.oaconfig.general.bku.bkuselection.header", request) %></h4>
+								<s:iterator value="%{generalOA.bkuSelectionFileUploadFileName}" var="fileNameBKU">
+									<div class="floatClass">
+										<s:label key="webpages.oaconfig.general.bku.bkuselection.filename" value="%{fileNameBKU}"/>
+										<s:checkbox key="webpages.oaconfig.general.bku.delete"
+																labelposition="left"														
+																cssClass="checkbox"
+																name="generalOA.deleteBKUTemplate"></s:checkbox>
+									</div>
+									<div id="pvp2_certificate_upload">
+										<s:file name="generalOA.bkuSelectionFileUpload" key="webpages.oaconfig.general.bku.bkuselection.upload" cssClass="textfield_long"></s:file>
+									</div>
+								</s:iterator>
+								<s:if test="generalOA.bkuSelectionFileUploadFileName.size() == 0">
+										<div id="pvp2_certificate_upload">
+										<s:file name="generalOA.bkuSelectionFileUpload" key="webpages.oaconfig.general.bku.bkuselection.upload" cssClass="textfield_long"></s:file>
+									</div>
+								</s:if>
+							</div>
+							<div class="oa_protocol_area">
+								<h4><%=LanguageHelper.getGUIString("webpages.oaconfig.general.bku.sendassertion.header", request) %></h4>
+								<s:iterator value="%{generalOA.sendAssertionFileUploadFileName}" var="fileNameBKU">
+									<div class="floatClass">
+										<s:label 	key="webpages.oaconfig.general.bku.sendassertion.filename" 
+															value="%{fileNameBKU}"/>
+										<s:checkbox key="webpages.oaconfig.general.bku.delete"
+																labelposition="left"														
+																cssClass="checkbox"
+																name="generalOA.deleteSendAssertionTemplate"></s:checkbox>
+									</div>
+									<div id="pvp2_certificate_upload">
+										<s:file name="generalOA.sendAssertionFileUpload" key="webpages.oaconfig.general.bku.sendassertion.upload" cssClass="textfield_long"></s:file>
+									</div>
+								</s:iterator>
+								<s:if test="generalOA.sendAssertionFileUploadFileName.size() == 0">
+										<div id="pvp2_certificate_upload">
+										<s:file name="generalOA.sendAssertionFileUpload" key="webpages.oaconfig.general.bku.sendassertion.upload" cssClass="textfield_long"></s:file>
+									</div>
+								</s:if>
+							</div>
+							
 						</div>
 					</s:if>
 					
@@ -271,7 +314,7 @@
 					</div>
 
 					<div class="oa_config_block">
-						<p><strong><%=LanguageHelper.getGUIString("webpages.oaconfig.sso.header", request) %></strong></p>
+						<h3><%=LanguageHelper.getGUIString("webpages.oaconfig.sso.header", request) %></h3>
 						
 						<s:checkbox name="ssoOA.useSSO" 
 							value="%{ssoOA.useSSO}"
@@ -356,7 +399,7 @@
 								<%=LanguageHelper.getGUIString("webpages.oaconfig.menu.oauth20.hidden", request) %>
 						  </button>
 						  						
-						<div id="oa_saml1_area" class="oa_protocol_area">
+						<div id="oa_saml1_area" class="oa_protocol_area hidden">
 							<h4><%=LanguageHelper.getGUIString("webpages.oaconfig.protocols.saml1.header", request) %></h4>
 							
 							<s:if test="authUser.isAdmin()">
@@ -416,9 +459,14 @@
 							
 						</div>
 						
-						<div id="oa_pvp2_area" class="oa_protocol_area">
+						<div id="oa_pvp2_area" class="oa_protocol_area hidden">
 							<h4><%=LanguageHelper.getGUIString("webpages.oaconfig.protocols.pvp2.header", request) %></h4>
 						
+							<s:checkbox 	key="webpages.oaconfig.pvp2.reload"
+														labelposition="left"														
+														cssClass="checkbox"
+														name="pvp2OA.reLoad"></s:checkbox>
+						
 						  <s:textfield name="pvp2OA.metaDataURL" 
 								value="%{pvp2OA.metaDataURL}" 
 								labelposition="left"
@@ -433,7 +481,7 @@
 							</div>
 						</div>
 						
-						<div id="oa_oauth20_area" class="oa_protocol_area">
+						<div id="oa_oauth20_area" class="oa_protocol_area hidden">
 							<h4><%=LanguageHelper.getGUIString("webpages.oaconfig.protocols.oauth20.header", request) %></h4>
 						
 							<s:label key="webpages.oaconfig.oauth20.clientId" value="%{oauth20OA.clientId}"/>
@@ -483,7 +531,7 @@
 								<%=LanguageHelper.getGUIString("webpages.oaconfig.general.BKUSelection.button.hidden", request) %>
 						  </button>
 						  						
-							<div id="formcustom_area" class="oa_protocol_area">
+							<div id="formcustom_area" class="oa_protocol_area hidden">
 								<h4><%=LanguageHelper.getGUIString("webpages.oaconfig.general.BKUSelection.header", request) %></h4>
 																
 								<div id="formCustomValues">													
@@ -562,6 +610,22 @@
 														name="formOA.appletRedirectTarget">
 									</s:select>
 									
+									<s:textfield name="formOA.applet_height" 
+										value="%{formOA.applet_height}" 
+										labelposition="left"
+										key="webpages.oaconfig.general.BKUSelection.header.applet.height"
+										cssClass="textfield_middle"
+										id="HEADER_HEIGHT">
+									</s:textfield>
+									
+									<s:textfield name="formOA.applet_width" 
+										value="%{formOA.applet_width}" 
+										labelposition="left"
+										key="webpages.oaconfig.general.BKUSelection.header.applet.width"
+										cssClass="textfield_middle"
+										id="HEADER_WIDTH">
+									</s:textfield>
+									
 									<s:select list="formOA.fontTypeList"
 														key="webpages.oaconfig.general.BKUSelection.fonttype.list"
 														labelposition="left"
diff --git a/id/oa/src/main/java/at/gv/egovernment/moa/id/demoOA/servlet/pvp2/BuildMetadata.java b/id/oa/src/main/java/at/gv/egovernment/moa/id/demoOA/servlet/pvp2/BuildMetadata.java
index 652960bbc..4c9bc6d76 100644
--- a/id/oa/src/main/java/at/gv/egovernment/moa/id/demoOA/servlet/pvp2/BuildMetadata.java
+++ b/id/oa/src/main/java/at/gv/egovernment/moa/id/demoOA/servlet/pvp2/BuildMetadata.java
@@ -82,6 +82,8 @@ import at.iaik.commons.util.MiscUtil;
 public class BuildMetadata extends HttpServlet {
 	private static final long serialVersionUID = 1L;
 	
+	private static final int VALIDUNTIL_IN_HOURS = 24;
+	
 	/**
 	 * @see HttpServlet#HttpServlet()
 	 */
@@ -111,6 +113,9 @@ public class BuildMetadata extends HttpServlet {
 			EntitiesDescriptor spEntitiesDescriptor = SAML2Utils.
 					createSAMLObject(EntitiesDescriptor.class);
 			
+			DateTime date = new DateTime();	
+			spEntitiesDescriptor.setValidUntil(date.plusHours(VALIDUNTIL_IN_HOURS));
+			
 			String name = config.getPVP2MetadataEntitiesName();
 			if (MiscUtil.isEmpty(name)) {
 				Logger.info("NO Metadata EntitiesName configurated");
@@ -128,6 +133,8 @@ public class BuildMetadata extends HttpServlet {
 			EntityDescriptor spEntityDescriptor = SAML2Utils
 					.createSAMLObject(EntityDescriptor.class);
 
+			spEntityDescriptor.setValidUntil(date.plusDays(VALIDUNTIL_IN_HOURS));
+			
 			spEntitiesDescriptor.getEntityDescriptors().add(spEntityDescriptor);
 			
 			//set OA-ID (PublicURL Prefix) as identifier
diff --git a/id/oa/src/main/java/at/gv/egovernment/moa/id/demoOA/servlet/pvp2/DemoApplication.java b/id/oa/src/main/java/at/gv/egovernment/moa/id/demoOA/servlet/pvp2/DemoApplication.java
index 0b30d7d86..dcd478864 100644
--- a/id/oa/src/main/java/at/gv/egovernment/moa/id/demoOA/servlet/pvp2/DemoApplication.java
+++ b/id/oa/src/main/java/at/gv/egovernment/moa/id/demoOA/servlet/pvp2/DemoApplication.java
@@ -23,6 +23,7 @@
 package at.gv.egovernment.moa.id.demoOA.servlet.pvp2;
 
 import java.io.IOException;
+import java.security.Key;
 import java.security.KeyStore;
 import java.util.ArrayList;
 import java.util.List;
@@ -55,6 +56,7 @@ import org.opensaml.xml.encryption.InlineEncryptedKeyResolver;
 import org.opensaml.xml.encryption.SimpleRetrievalMethodEncryptedKeyResolver;
 import org.opensaml.xml.parse.BasicParserPool;
 import org.opensaml.xml.security.CriteriaSet;
+import org.opensaml.xml.security.SecurityHelper;
 import org.opensaml.xml.security.credential.UsageType;
 import org.opensaml.xml.security.criteria.EntityIDCriteria;
 import org.opensaml.xml.security.criteria.UsageCriteria;
@@ -149,6 +151,11 @@ public class DemoApplication extends HttpServlet {
 				
 				Logger.info("PVP2 Assertion is valid");
 				
+				//set assertion
+				org.w3c.dom.Document doc = SAML2Utils.asDOMDocument(samlResponse);
+				String assertion = DOMUtils.serializeNode(doc);				
+				bean.setAssertion(assertion);
+				
 				if (samlResponse.getStatus().getStatusCode().getValue().equals(StatusCode.SUCCESS_URI)) {
 			
 					List<org.opensaml.saml2.core.Assertion> saml2assertions = new ArrayList<org.opensaml.saml2.core.Assertion>();
@@ -177,7 +184,7 @@ public class DemoApplication extends HttpServlet {
 						encryptedKeyResolver.getResolverChain().add( new SimpleRetrievalMethodEncryptedKeyResolver() );
 						
 						Decrypter samlDecrypter =
-								  new Decrypter(null, skicr, encryptedKeyResolver);
+								new Decrypter(null, skicr, encryptedKeyResolver);
 						
 						for (EncryptedAssertion encAssertion : encryAssertionList) {							
 							saml2assertions.add(samlDecrypter.decrypt(encAssertion));
@@ -219,10 +226,6 @@ public class DemoApplication extends HttpServlet {
 						}
 					}
 					
-					org.w3c.dom.Document doc = SAML2Utils.asDOMDocument(samlResponse);
-					String assertion = DOMUtils.serializeNode(doc);
-					
-					bean.setAssertion(assertion);
 					bean.setDateOfBirth(birthday);
 					bean.setFamilyName(familyName);
 					bean.setGivenName(givenName);
diff --git a/id/readme_2.0.0.txt b/id/readme_2.0.0.txt
new file mode 100644
index 000000000..7078cabf7
--- /dev/null
+++ b/id/readme_2.0.0.txt
@@ -0,0 +1,114 @@
+===============================================================================
+MOA ID Version Pre-Release 2.0.0 - Wichtige Informationen zur Installation
+===============================================================================
+
+-------------------------------------------------------------------------------
+A. Neuerungen/Änderungen
+-------------------------------------------------------------------------------
+
+Mit MOA ID Version Pre-Release 2.0.0 wurden folgende Neuerungen eingeführt, die jetzt 
+erstmals in der Veröffentlichung enthalten sind (siehe auch history.txt im 
+gleichen Verzeichnis):
+
+- Fixed Bug #556 (https://egovlabs.gv.at/tracker/index.php?func=detail&aid=556&group_id=6&atid=105) 
+- Fixed Bug #557 (https://egovlabs.gv.at/tracker/index.php?func=detail&aid=557&group_id=6&atid=105)
+- Update Einbindung Online-Vollmachten (Vor Auswahl der Vollmacht werden die Signaturdaten signiert)
+- Update Transformationen (für Online-Vollmachten)
+- Änderung der Konfiguration 
+	- für Online-Vollmachten
+	- Fixer Target-Parameter für Online-Applikation konfigurierbar
+	- Optionaler Parameter zur Angabe der IssueInstant im UTC Format in der SAML-Assertion
+- Update der Standard Trustprofile
+- Zusätzlicher optionaler Parameter sourceID beim MOA-ID Aufruf
+- Libraries aktualisiert:
+	iaik-moa:           Version 1.32
+	iaik-ixsil:			Version 1.2.2.5 
+	Axis:				Version 1.0_IAIK	
+
+-------------------------------------------------------------------------------
+B. Durchführung eines Updates
+-------------------------------------------------------------------------------
+
+Es wird generell eine Neuinstallation lt. Handbuch empfohlen! Dennoch ist auch
+eine Aktualisierung bestehender Installationen möglich.
+
+
+...............................................................................
+B.1 Durchführung eines Updates von Version 1.5.1 
+...............................................................................
+
+1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA ID Auth (moa-id-auth-1.5.1.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+   Für MOA ID Proxy:
+   Entpacken Sie die Distribution von MOA ID Proxy (moa-id-proxy-1.5.1.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_PROXY_INST 
+   bezeichnet.    
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Datei moa-id-auth.war als 
+   auch das komplette Verzeichnis moa-id-auth.
+   Für MOA ID Proxy:
+   Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Proxy
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/
+   webappsProxy, wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Datei moa-id-proxy.war als 
+   auch das komplette Verzeichnis moa-id-proxy.
+
+4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   Für MOA ID Proxy:
+   Kopieren Sie die Datei MOA_ID_PROXY_INST/moa-id-proxy.war nach
+   CATALINA_HOME_ID/webappsProxy.
+
+5. Update des Cert-Stores.
+   Kopieren Sie den Inhalt des Verzeichnisses
+   MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis
+   CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie 
+   vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann 
+   bejahen sie das.
+
+6. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen 
+   wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile 
+   beibehalten wollen, dann gehen Sie vor, wie in Punkt b).
+
+   a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen:
+
+    1)  Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles.
+    2)  Kopieren Sie das Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis 
+        CATALINA_HOME\conf\moa-spss.
+
+   b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie 
+      folgt vor, um die Profile auf den aktuellen Stand zu bringen:
+
+    1)  Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den 
+        entsprechenden Profilen im Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren 
+        Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt 
+        der einzelnen Profile aus der Distribution 
+        (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden 
+        Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) 
+        kopieren und dabei die vorhandenen gleichnamigen Zertifikate 
+        überschreiben), also z.B: Kopieren des Inhalts von 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach 
+        CATALINA_HOME\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw.
+   
+7. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+   Logging von MOA ID beim Einlesen der Konfiguration.
+   
+...............................................................................
+B.2 Durchführung eines Updates von Version <= 1.5.0
+...............................................................................
+
+Bitte führen Sie eine Neuinstallation von MOA ID laut Handbuch durch und passen
+Sie die mitgelieferte Musterkonfiguration entsprechend Ihren Bedürfnissen unter 
+Zuhilfenahme Ihrer bisherigen Konfiguration an.
+
diff --git a/id/server/data/deploy/conf/moa-id-configuration/moa-id.properties b/id/server/data/deploy/conf/moa-id-configuration/moa-id-configtool.properties
index 2bb9cb005..2bb9cb005 100644
--- a/id/server/data/deploy/conf/moa-id-configuration/moa-id.properties
+++ b/id/server/data/deploy/conf/moa-id-configuration/moa-id-configtool.properties
diff --git a/id/server/data/deploy/errorpages/errorpage-auth_debug.jsp b/id/server/data/deploy/conf/moa-id-proxy/errorpages/errorpage-auth_debug.jsp
index 8e1e331d6..8e1e331d6 100644
--- a/id/server/data/deploy/errorpages/errorpage-auth_debug.jsp
+++ b/id/server/data/deploy/conf/moa-id-proxy/errorpages/errorpage-auth_debug.jsp
diff --git a/id/server/data/deploy/errorpages/errorpage-auth_empty.jsp b/id/server/data/deploy/conf/moa-id-proxy/errorpages/errorpage-auth_empty.jsp
index 40739efea..40739efea 100644
--- a/id/server/data/deploy/errorpages/errorpage-auth_empty.jsp
+++ b/id/server/data/deploy/conf/moa-id-proxy/errorpages/errorpage-auth_empty.jsp
diff --git a/id/server/data/deploy/errorpages/errorpage-proxy_debug.jsp b/id/server/data/deploy/conf/moa-id-proxy/errorpages/errorpage-proxy_debug.jsp
index 8e1e331d6..8e1e331d6 100644
--- a/id/server/data/deploy/errorpages/errorpage-proxy_debug.jsp
+++ b/id/server/data/deploy/conf/moa-id-proxy/errorpages/errorpage-proxy_debug.jsp
diff --git a/id/server/data/deploy/errorpages/errorpage-proxy_empty.jsp b/id/server/data/deploy/conf/moa-id-proxy/errorpages/errorpage-proxy_empty.jsp
index 40739efea..40739efea 100644
--- a/id/server/data/deploy/errorpages/errorpage-proxy_empty.jsp
+++ b/id/server/data/deploy/conf/moa-id-proxy/errorpages/errorpage-proxy_empty.jsp
diff --git a/id/server/data/deploy/tomcat/unix/tomcat-start.sh b/id/server/data/deploy/tomcat/unix/tomcat-start.sh
index 6310b1070..10bade1bd 100644
--- a/id/server/data/deploy/tomcat/unix/tomcat-start.sh
+++ b/id/server/data/deploy/tomcat/unix/tomcat-start.sh
@@ -8,15 +8,17 @@ LOGGING_OPT=-Dlog4j.configuration=file:$CATALINA_BASE/conf/moa-id/log4j.properti
 

 CONFIG_OPT=-Dmoa.id.configuration=$CATALINA_BASE/conf/moa-id/moa-id.properties

 SPSS_OPT=-Dmoa.spss.server.configuration=$CATALINA_BASE/conf/moa-spss/SampleMOASPSSConfiguration.xml

-CONFIGTOOL_OPT=-Dmoa.id.webconfig=$CATALINA_BASE/conf/moa-id-configuration/moa-id.properties

+CONFIGTOOL_OPT=-Dmoa.id.webconfig=$CATALINA_BASE/conf/moa-id-configuration/moa-id-configtool.properties

 DEMOOA_OPT=-Dmoa.id.demoOA=$CATALINA_BASE/conf/moa-id-oa/oa.properties

 STORK_OPT=-Deu.stork.samlengine.config.location=$CATALINA_BASE/conf/moa-id/stork/

 

+PROXY_OPT=-Dmoa.id.proxy.configuration=$CATALINA_BASE/conf/moa-id-proxy/MOAIDConfiguration.xml

+

 #TRUST_STORE_OPT=-Djavax.net.ssl.trustStore=$CATALINA_BASE/conf/moa-spss/keys/clients/trustedMOAClients-password=changeit.keystore

 #TRUST_STORE_PASS_OPT=-Djavax.net.ssl.trustStorePassword=changeit

 #TRUST_STORE_TYPE_OPT=-Djavax.net.ssl.trustStoreType=jks

 

-export CATALINA_OPTS="$CONFIG_OPT $LOGGING_OPT $SPSS_OPT $TRUST_STORE_OPT $TRUST_STORE_PASS_OPT $TRUST_STORE_TYPE_OPT $CONFIGTOOL_OPT $DEMOOA_OPT $STORK_OPT"

+export CATALINA_OPTS="$CONFIG_OPT $LOGGING_OPT $SPSS_OPT $TRUST_STORE_OPT $TRUST_STORE_PASS_OPT $TRUST_STORE_TYPE_OPT $CONFIGTOOL_OPT $DEMOOA_OPT $STORK_OPT $PROXY_OPT"

 

 echo CATALINA_HOME: $CATALINA_HOME

 echo CATALINA_BASE: $CATALINA_BASE

diff --git a/id/server/data/deploy/tomcat/win32/startTomcat.bat b/id/server/data/deploy/tomcat/win32/startTomcat.bat
index 65b2bef23..7730137c5 100644
--- a/id/server/data/deploy/tomcat/win32/startTomcat.bat
+++ b/id/server/data/deploy/tomcat/win32/startTomcat.bat
@@ -13,11 +13,12 @@ set LOGGING_OPT=-Dlog4j.configuration=file:%CATALINA_HOME%/conf/moa-id/log4j.pro
 

 set CONFIG_OPT_SPSS=-Dmoa.spss.server.configuration=%CATALINA_HOME%/conf/moa-spss/SampleMOASPSSConfiguration.xml

 set CONFIG_OPT_ID=-Dmoa.id.configuration=%CATALINA_HOME%/conf/moa-id/moa-id.properties

-set CONFIGTOOL_OPT=-Dmoa.id.webconfig=%CATALINA_HOME%/conf/moa-id-configuration/moa-id.properties

+set CONFIGTOOL_OPT=-Dmoa.id.webconfig=%CATALINA_HOME%/conf/moa-id-configuration/moa-id-configtool.properties

 set DEMOOA_OPT=-Dmoa.id.demoOA=%CATALINA_HOME%/conf/moa-id-oa/oa.properties

 set STORK_OPT=-Deu.stork.samlengine.config.location=%CATALINA_HOME%/conf/moa-id/stork/

+set PROXY_OPT=-Dmoa.id.proxy.configuration=%CATALINA_HOME%/conf/moa-id-proxy/MOAIDConfiguration.xml

 

-set PARAMS_MOA=%CONFIG_OPT_SPSS% %CONFIG_OPT_ID% %LOGGING_OPT% %CONFIGTOOL_OPT% %DEMOOA_OPT% %STORK_OPT%

+set PARAMS_MOA=%CONFIG_OPT_SPSS% %CONFIG_OPT_ID% %LOGGING_OPT% %CONFIGTOOL_OPT% %DEMOOA_OPT% %STORK_OPT% %PROXY_OPT%

 

 rem set PARAM_TRUST_STORE=-Djavax.net.ssl.trustStore=truststore.jks

 rem set PARAM_TRUST_STORE_PASS=-Djavax.net.ssl.trustStorePassword=changeit

diff --git a/id/server/doc/MOA-ID PreRelease-1.9.98.pdf b/id/server/doc/MOA-ID PreRelease-1.9.98.pdf
index 527251961..4ee41f513 100644
--- a/id/server/doc/MOA-ID PreRelease-1.9.98.pdf
+++ b/id/server/doc/MOA-ID PreRelease-1.9.98.pdf
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
index 3d38efa9f..003fdfbe9 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
@@ -265,10 +265,10 @@ public class AuthenticationServer implements MOAIDAuthConstants {
 						
 			if (domainIdentifier.startsWith(PREFIX_WPBK)) {
 				
-				isbuisness = false;
+				isbuisness = true;
 				
 			} else {
-				isbuisness = true;
+				isbuisness = false;
 				
 			}
 			
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetIdentityLinkFormBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetIdentityLinkFormBuilder.java
index 70aa1a160..2e08fad6b 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetIdentityLinkFormBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetIdentityLinkFormBuilder.java
@@ -167,8 +167,10 @@ public class GetIdentityLinkFormBuilder extends Builder {
     htmlForm = replaceTag(htmlForm, CERTINFO_XMLREQUEST_TAG, encodeParameter(certInfoXMLRequest), true, ALL);
     htmlForm = replaceTag(htmlForm, CERTINFO_DATAURL_TAG, certInfoDataURL, true, ALL);
     
+    Map<String, String> map = null;
+    
     if (oaParam != null) {
-    	Map<String, String> map = oaParam.getFormCustomizaten();
+    	map = oaParam.getFormCustomizaten();
     	htmlForm = replaceTag(htmlForm, COLOR_TAG, map.get(FormBuildUtils.MAIN_BACKGROUNDCOLOR), false, ALL);
     	htmlForm = replaceTag(htmlForm, REDIRECTTARGETTAG, map.get(FormBuildUtils.REDIRECTTARGET), false, ALL);
     	    	
@@ -179,11 +181,15 @@ public class GetIdentityLinkFormBuilder extends Builder {
     
     if (MiscUtil.isNotEmpty(appletheigth))
     	htmlForm = replaceTag(htmlForm, APPLETHEIGHT_TAG, appletheigth, false, ALL);
+    else if (map != null && MiscUtil.isNotEmpty(map.get(FormBuildUtils.APPLET_HEIGHT)))
+    	htmlForm = replaceTag(htmlForm, APPLETHEIGHT_TAG, map.get(FormBuildUtils.APPLET_HEIGHT), false, ALL);
     else
     	htmlForm = replaceTag(htmlForm, APPLETHEIGHT_TAG, "160", false, ALL);
     
     if (MiscUtil.isNotEmpty(appletwidth))
     	htmlForm = replaceTag(htmlForm, APPLETWIDTH_TAG, appletwidth, false, ALL);
+    else if (map != null && MiscUtil.isNotEmpty(map.get(FormBuildUtils.APPLET_WIDTH)))
+    	htmlForm = replaceTag(htmlForm, APPLETWIDTH_TAG, map.get(FormBuildUtils.APPLET_WIDTH), false, ALL);
     else
     	htmlForm = replaceTag(htmlForm, APPLETWIDTH_TAG, "250", false, ALL);
 
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/LoginFormBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/LoginFormBuilder.java
index 90ad3cf42..ff3b7b170 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/LoginFormBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/LoginFormBuilder.java
@@ -22,6 +22,7 @@
  ******************************************************************************/
 package at.gv.egovernment.moa.id.auth.builder;
 
+import java.io.ByteArrayInputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileNotFoundException;
@@ -58,7 +59,7 @@ public class LoginFormBuilder {
 		
 	private static String SERVLET = CONTEXTPATH+"/GenerateIframeTemplate";
 	
-	public static String getTemplate() {
+	private static String getTemplate() {
 		String pathLocation ="";
 		InputStream input = null;
 		
@@ -118,8 +119,21 @@ public class LoginFormBuilder {
 	}
 	
 	public static String buildLoginForm(String modul, String action, OAAuthParameter oaParam, String contextpath, String moaSessionID) {
-		String value = getTemplate();
 		
+		String value = null;
+		
+		byte[] oatemplate = oaParam.getBKUSelectionTemplate();
+		// OA specific template requires a size of 8 bits minimum
+		if (oatemplate != null && oatemplate.length > 7) {
+			InputStream is = new ByteArrayInputStream(oatemplate);
+			value = getTemplate(is);
+			
+		} else {
+			//load default BKU-selection template
+			value = getTemplate();
+			
+		}
+			
 		if(value != null) {
 			if(modul == null) {
 				modul = SAML1Protocol.PATH;
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SendAssertionFormBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SendAssertionFormBuilder.java
index f65a3c011..24b848176 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SendAssertionFormBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SendAssertionFormBuilder.java
@@ -22,6 +22,7 @@
  ******************************************************************************/
 package at.gv.egovernment.moa.id.auth.builder;
 
+import java.io.ByteArrayInputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileNotFoundException;
@@ -58,32 +59,50 @@ public class SendAssertionFormBuilder {
 	private static String SERVLET = CONTEXTPATH+"/SSOSendAssertionServlet";
 	
 	private static String getTemplate() {
-
-			String template = null;
-			InputStream input = null;
 		
-			try {				
-				String pathLocation;
-					
-				String rootconfigdir = AuthConfigurationProvider.getInstance().getRootConfigFileDir();	
-				pathLocation = rootconfigdir + HTMLTEMPLATESDIR + HTMLTEMPLATEFULL;
+		String pathLocation;
+		InputStream input = null;
+		try {
+			String rootconfigdir = AuthConfigurationProvider.getInstance().getRootConfigFileDir();	
+			pathLocation = rootconfigdir + HTMLTEMPLATESDIR + HTMLTEMPLATEFULL;
+		
+			try {
+				File file = new File(new URI(pathLocation));
+				input = new  FileInputStream(file);
+			
+			} catch (FileNotFoundException e)  {
 				
-				try {
-					File file = new File(new URI(pathLocation));
-					input = new  FileInputStream(file);
-					
-				} catch (FileNotFoundException e)  {
-					
-					Logger.warn("No LoginFormTempaltes found. Use Generic Templates from package.");
-					
-					pathLocation = "resources/templates/" + HTMLTEMPLATEFULL;
-					
-					input = Thread.currentThread()
-							.getContextClassLoader()
-							.getResourceAsStream(pathLocation);
-					
-				}
+				Logger.warn("No LoginFormTempaltes found. Use Generic Templates from package.");
+			
+				pathLocation = "resources/templates/" + HTMLTEMPLATEFULL;
+			
+				input = Thread.currentThread()
+						.getContextClassLoader()
+						.getResourceAsStream(pathLocation);
+			
+			}
+			
+			return getTemplate(input);
+			
+		} catch (Exception e) {
+			try {
+				input.close();
 				
+			} catch (IOException e1) {
+				Logger.warn("SendAssertionTemplate inputstream can not be closed.", e);
+			}
+			
+			return null;
+		}
+		
+	}
+	
+	private static String getTemplate(InputStream input) {
+
+			String template = null;
+			
+			try {				
+	
 				StringWriter writer = new StringWriter();
 				IOUtils.copy(input, writer);
 				template = writer.toString();
@@ -105,7 +124,19 @@ public class SendAssertionFormBuilder {
 	}
 
 	public static String buildForm(String modul, String action, String id, OAAuthParameter oaParam, String contextpath) {
-		String value = getTemplate();
+		String value = null;
+		
+		byte[] oatemplate = oaParam.getSendAssertionTemplate();
+		// OA specific template requires a size of 8 bits minimum
+		if (oatemplate != null && oatemplate.length > 7) {
+			InputStream is = new ByteArrayInputStream(oatemplate);
+			value = getTemplate(is);
+			
+		} else {
+			//load default BKU-selection template
+			value = getTemplate();
+			
+		}
 		
 		if(value != null) {
 			if(modul == null) {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GenerateIFrameTemplateServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GenerateIFrameTemplateServlet.java
index c66e19eb0..d2d458e74 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GenerateIFrameTemplateServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GenerateIFrameTemplateServlet.java
@@ -82,9 +82,12 @@ public class GenerateIFrameTemplateServlet extends AuthServlet {
 	    	
 	    	AuthenticationSession moasession = null;
 
-	    	try {
-	    	    //moasessionid = (String) req.getSession().getAttribute(AuthenticationManager.MOA_SESSION);
-	    		
+	    	if (MiscUtil.isEmpty(bkuid) || MiscUtil.isEmpty(moasessionid)) {
+	    		Logger.warn("MOASessionID or BKU-type is empty. Maybe an old BKU-selection template is in use.");
+	    		throw new MOAIDException("auth.23", new Object[] {});
+	    	}
+	    	
+	    	try {	    		
 	    	    pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(moasessionid);
 			
 	    	    moasession = AuthenticationSessionStoreage.getSession(moasessionid);
@@ -112,7 +115,7 @@ public class GenerateIFrameTemplateServlet extends AuthServlet {
 	    	
 				//load Parameters from config
 		    	String target = oaParam.getTarget();
-		    			    	
+		    	
 		    	String bkuURL = oaParam.getBKUURL(bkuid);
 		    	if (MiscUtil.isEmpty(bkuURL)) {
 		    		Logger.info("No OA specific BKU defined. Use BKU from default configuration");
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfigurationProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfigurationProvider.java
index 304b63de0..c0f47d781 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfigurationProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfigurationProvider.java
@@ -110,6 +110,7 @@ import at.gv.egovernment.moa.id.config.auth.data.ProtocolAllowed;
 import at.gv.egovernment.moa.id.config.legacy.BuildFromLegacyConfig;
 import at.gv.egovernment.moa.id.config.stork.STORKConfig;
 import at.gv.egovernment.moa.id.data.IssuerAndSerial;
+import at.gv.egovernment.moa.id.protocols.pvp2x.config.MOADefaultBootstrap;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.MiscUtil;
 
@@ -365,7 +366,8 @@ public class AuthConfigurationProvider extends ConfigurationProvider {
 				
 		//Initialize OpenSAML for STORK
 		Logger.info("Starting initialization of OpenSAML...");
-		DefaultBootstrap.bootstrap();
+		MOADefaultBootstrap.bootstrap();
+		//DefaultBootstrap.bootstrap();
 		Logger.debug("OpenSAML successfully initialized");
 
 
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java
index 7a38e2afd..8e7ca0779 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java
@@ -320,6 +320,12 @@ public Map<String, String> getFormCustomizaten() {
 			if (MiscUtil.isNotEmpty(bkuselection.getAppletRedirectTarget()))
 				map.put(FormBuildUtils.REDIRECTTARGET, bkuselection.getAppletRedirectTarget());
 			
+			if (MiscUtil.isNotEmpty(bkuselection.getAppletHeight()))
+				map.put(FormBuildUtils.APPLET_HEIGHT, bkuselection.getAppletHeight());
+			
+			if (MiscUtil.isNotEmpty(bkuselection.getAppletWidth()))
+				map.put(FormBuildUtils.APPLET_WIDTH, bkuselection.getAppletWidth());
+			
 		}
 	}
 	
@@ -343,6 +349,27 @@ public List<OAStorkAttribute> getRequestedAttributes() {
 }
 
 
+public byte[] getBKUSelectionTemplate() {
+	
+	TemplatesType templates = oa_auth.getTemplates();
+	if (templates != null && templates.getBKUSelectionTemplate() != null) {
+		return templates.getBKUSelectionTemplate().getTransformation();
+
+	}
+	
+	return null;	
+}
+
+public byte[] getSendAssertionTemplate() {
+	
+	TemplatesType templates = oa_auth.getTemplates();
+	if (templates != null && templates.getSendAssertionTemplate() != null) {
+		return templates.getSendAssertionTemplate().getTransformation();
+
+	}
+	
+	return null;	
+}
   
     
   
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/proxy/ProxyConfigurationProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/proxy/ProxyConfigurationProvider.java
index 93de902ef..66d330d20 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/proxy/ProxyConfigurationProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/proxy/ProxyConfigurationProvider.java
@@ -118,7 +118,7 @@ public class ProxyConfigurationProvider extends ConfigurationProvider {
     throws ConfigurationException {
     String fileName = System.getProperty(PROXY_CONFIG_PROPERTY_NAME);
     if (fileName == null) {
-      throw new ConfigurationException("config.01", null);
+      throw new ConfigurationException("config.20", null);
     }
     Logger.info("Loading MOA-ID-PROXY configuration " + fileName);
 
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/entrypoints/DispatcherServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/entrypoints/DispatcherServlet.java
index 01b80a93f..6cc17231c 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/entrypoints/DispatcherServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/entrypoints/DispatcherServlet.java
@@ -22,14 +22,8 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.entrypoints;
 
-
-
-import iaik.security.ecc.provider.ECCProvider;
-import iaik.security.provider.IAIK;
-
 import java.io.IOException;
-import java.io.PrintWriter;
-import java.security.Security;
+
 import java.util.Iterator;
 import java.util.Map;
 import java.util.Set;
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/MetadataAction.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/MetadataAction.java
index 78fe43daa..1668c31ce 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/MetadataAction.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/MetadataAction.java
@@ -66,7 +66,7 @@ import at.gv.egovernment.moa.logging.Logger;
 
 public class MetadataAction implements IAction {
 
-	private static final int VALIDUNTIL_IN_DAYES = 30;
+	private static final int VALIDUNTIL_IN_HOURS = 24;
 		
 	public String processRequest(IRequest req, HttpServletRequest httpReq,
 			HttpServletResponse httpResp, AuthenticationSession moasession) throws MOAIDException {
@@ -81,7 +81,7 @@ public class MetadataAction implements IAction {
 			
 			DateTime date = new DateTime();
 			
-			idpEntitiesDescriptor.setValidUntil(date.plusDays(VALIDUNTIL_IN_DAYES));
+			idpEntitiesDescriptor.setValidUntil(date.plusHours(VALIDUNTIL_IN_HOURS));
 				
 			EntityDescriptor idpEntityDescriptor = SAML2Utils
 					.createSAMLObject(EntityDescriptor.class);
@@ -95,7 +95,7 @@ public class MetadataAction implements IAction {
 			idpEntityDescriptor
 			.setEntityID(PVPConfiguration.getInstance().getIDPPublicPath());
 			
-			idpEntityDescriptor.setValidUntil(date.plusDays(VALIDUNTIL_IN_DAYES));
+			idpEntityDescriptor.setValidUntil(date.plusDays(VALIDUNTIL_IN_HOURS));
 			
 			List<ContactPerson> persons = PVPConfiguration.getInstance()
 					.getIDPContacts();
@@ -114,13 +114,31 @@ public class MetadataAction implements IAction {
 			Credential metadataSigningCredential = CredentialProvider.getIDPMetaDataSigningCredential();
 			Signature signature = CredentialProvider
 					.getIDPSignature(metadataSigningCredential);
+						
+			idpEntitiesDescriptor.setSignature(signature);
+			
+//			//set SignatureMethode
+//			signature.setSignatureAlgorithm(PVPConstants.DEFAULT_SIGNING_METHODE);
+//			
+//			//set DigestMethode
+//			List<ContentReference> contentList = signature.getContentReferences();
+//			for (ContentReference content : contentList) {
+//				
+//				if (content instanceof SAMLObjectContentReference) {
+//					
+//					SAMLObjectContentReference el = (SAMLObjectContentReference) content;
+//					el.setDigestAlgorithm(PVPConstants.DEFAULT_DIGESTMETHODE);
+//					
+//				}
+//			}
+			
 			
 //			KeyInfoBuilder metadataKeyInfoBuilder = new KeyInfoBuilder();
 //			KeyInfo metadataKeyInfo = metadataKeyInfoBuilder.buildObject();
 //			//KeyInfoHelper.addCertificate(metadataKeyInfo, metadataSigningCredential.);
 //			signature.setKeyInfo(metadataKeyInfo );
 			
-			idpEntitiesDescriptor.setSignature(signature);
+
 
 			IDPSSODescriptor idpSSODescriptor = SAML2Utils
 					.createSAMLObject(IDPSSODescriptor.class);
@@ -222,7 +240,7 @@ public class MetadataAction implements IAction {
 
 			String metadataXML = sw.toString();
 
-			//System.out.println("METADATA: " + metadataXML);
+			System.out.println("METADATA: " + metadataXML);
 
 			httpResp.setContentType("text/xml");
 			httpResp.getOutputStream().write(metadataXML.getBytes());
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVPConstants.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVPConstants.java
index 0172cce2d..7946c7596 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVPConstants.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVPConstants.java
@@ -22,8 +22,17 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.protocols.pvp2x;
 
+import org.opensaml.xml.encryption.EncryptionConstants;
+import org.opensaml.xml.signature.SignatureConstants;
+
 public interface PVPConstants {
 	
+	public static final String DEFAULT_SIGNING_METHODE = SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256;
+	public static final String DEFAULT_DIGESTMETHODE = SignatureConstants.ALGO_ID_DIGEST_SHA256;
+	public static final String DEFAULT_SYM_ENCRYPTION_METHODE = EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128;
+	public static final String DEFAULT_ASYM_ENCRYPTION_METHODE = EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP;
+	
+	
 	public static final String STORK_QAA_PREFIX = "http://www.stork.gov.eu/1.0/citizenQAALevel/";
 	public static final String STORK_QAA_1_1 = "http://www.stork.gov.eu/1.0/citizenQAALevel/1";
 	public static final String STORK_QAA_1_2 = "http://www.stork.gov.eu/1.0/citizenQAALevel/2";
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/config/MOADefaultBootstrap.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/config/MOADefaultBootstrap.java
new file mode 100644
index 000000000..80789cd12
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/config/MOADefaultBootstrap.java
@@ -0,0 +1,61 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.protocols.pvp2x.config;
+
+import org.opensaml.Configuration;
+import org.opensaml.DefaultBootstrap;
+import org.opensaml.common.binding.BasicSAMLMessageContext;
+import org.opensaml.saml2.binding.encoding.BaseSAML2MessageEncoder;
+import org.opensaml.xml.ConfigurationException;
+
+/**
+ * @author tlenz
+ *
+ */
+public class MOADefaultBootstrap extends DefaultBootstrap {
+
+    public static synchronized void bootstrap() throws ConfigurationException {
+
+        initializeXMLSecurity();
+
+        initializeXMLTooling();
+
+        initializeArtifactBuilderFactories();
+
+        initializeGlobalSecurityConfiguration();
+        
+        initializeParserPool();
+        
+        initializeESAPI();
+        
+    }
+  
+    
+    
+    /**
+     * Initializes the default global security configuration.
+     */
+    protected static void initializeGlobalSecurityConfiguration() {
+        Configuration.setGlobalSecurityConfiguration(MOADefaultSecurityConfigurationBootstrap.buildDefaultConfig());
+    }
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/config/MOADefaultSecurityConfigurationBootstrap.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/config/MOADefaultSecurityConfigurationBootstrap.java
new file mode 100644
index 000000000..1563ba9be
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/config/MOADefaultSecurityConfigurationBootstrap.java
@@ -0,0 +1,129 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.protocols.pvp2x.config;
+
+import org.opensaml.xml.encryption.EncryptionConstants;
+import org.opensaml.xml.security.BasicSecurityConfiguration;
+import org.opensaml.xml.security.DefaultSecurityConfigurationBootstrap;
+import org.opensaml.xml.signature.SignatureConstants;
+
+/**
+ * @author tlenz
+ *
+ */
+public class MOADefaultSecurityConfigurationBootstrap extends
+		DefaultSecurityConfigurationBootstrap {
+	
+	public static BasicSecurityConfiguration buildDefaultConfig() {
+		BasicSecurityConfiguration config = new BasicSecurityConfiguration();
+
+		populateSignatureParams(config);
+		populateEncryptionParams(config);
+		populateKeyInfoCredentialResolverParams(config);
+		populateKeyInfoGeneratorManager(config);
+		populateKeyParams(config);
+
+		return config;
+	}
+
+	protected static void populateSignatureParams(
+			BasicSecurityConfiguration config) {
+		
+		//use SHA256 instead of SHA1
+		config.registerSignatureAlgorithmURI("RSA",
+				SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
+	
+		config.registerSignatureAlgorithmURI("DSA",
+				"http://www.w3.org/2000/09/xmldsig#dsa-sha1");
+		
+		//use SHA256 instead of SHA1
+		config.registerSignatureAlgorithmURI("EC",
+				SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA256);
+
+		//use SHA256 instead of SHA1
+		config.registerSignatureAlgorithmURI("AES",
+				SignatureConstants.ALGO_ID_MAC_HMAC_SHA256);
+		
+		
+		config.registerSignatureAlgorithmURI("DESede",
+				SignatureConstants.ALGO_ID_MAC_HMAC_SHA256);
+
+		config.setSignatureCanonicalizationAlgorithm("http://www.w3.org/2001/10/xml-exc-c14n#");
+		config.setSignatureHMACOutputLength(null);
+		
+		//use SHA256 instead of SHA1
+		config.setSignatureReferenceDigestMethod(SignatureConstants.ALGO_ID_DIGEST_SHA256);
+	}
+
+	protected static void populateEncryptionParams(
+			BasicSecurityConfiguration config) {
+		config.registerDataEncryptionAlgorithmURI("AES", Integer.valueOf(128),
+				"http://www.w3.org/2001/04/xmlenc#aes128-cbc");
+		config.registerDataEncryptionAlgorithmURI("AES", Integer.valueOf(192),
+				"http://www.w3.org/2001/04/xmlenc#aes192-cbc");
+		config.registerDataEncryptionAlgorithmURI("AES", Integer.valueOf(256),
+				"http://www.w3.org/2001/04/xmlenc#aes256-cbc");
+		
+		//support GCM mode
+		config.registerDataEncryptionAlgorithmURI("AES", Integer.valueOf(128), 
+				EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM);
+		
+		config.registerDataEncryptionAlgorithmURI("AES", Integer.valueOf(192), 
+				EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192_GCM);
+		
+		config.registerDataEncryptionAlgorithmURI("AES", Integer.valueOf(256), 
+				EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256_GCM);
+		
+		
+		config.registerDataEncryptionAlgorithmURI("DESede",
+				Integer.valueOf(168),
+				"http://www.w3.org/2001/04/xmlenc#tripledes-cbc");
+		config.registerDataEncryptionAlgorithmURI("DESede",
+				Integer.valueOf(192),
+				"http://www.w3.org/2001/04/xmlenc#tripledes-cbc");
+
+		config.registerKeyTransportEncryptionAlgorithmURI("RSA", null, "AES",
+				"http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p");
+		
+		config.registerKeyTransportEncryptionAlgorithmURI("RSA", null,
+				"DESede", "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p");
+
+		config.registerKeyTransportEncryptionAlgorithmURI("AES",
+				Integer.valueOf(128), null,
+				"http://www.w3.org/2001/04/xmlenc#kw-aes128");
+		config.registerKeyTransportEncryptionAlgorithmURI("AES",
+				Integer.valueOf(192), null,
+				"http://www.w3.org/2001/04/xmlenc#kw-aes192");
+		config.registerKeyTransportEncryptionAlgorithmURI("AES",
+				Integer.valueOf(256), null,
+				"http://www.w3.org/2001/04/xmlenc#kw-aes256");
+		config.registerKeyTransportEncryptionAlgorithmURI("DESede",
+				Integer.valueOf(168), null,
+				"http://www.w3.org/2001/04/xmlenc#kw-tripledes");
+		config.registerKeyTransportEncryptionAlgorithmURI("DESede",
+				Integer.valueOf(192), null,
+				"http://www.w3.org/2001/04/xmlenc#kw-tripledes");
+
+		config.setAutoGeneratedDataEncryptionKeyAlgorithmURI("http://www.w3.org/2001/04/xmlenc#aes128-cbc");
+	}
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/config/PVPConfiguration.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/config/PVPConfiguration.java
index 5d71b915f..bf82efb79 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/config/PVPConfiguration.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/config/PVPConfiguration.java
@@ -33,6 +33,7 @@ import java.util.Properties;
 import java.util.jar.Attributes;
 import java.util.jar.Manifest;
 
+import org.opensaml.Configuration;
 import org.opensaml.saml2.metadata.Company;
 import org.opensaml.saml2.metadata.ContactPerson;
 import org.opensaml.saml2.metadata.ContactPersonTypeEnumeration;
@@ -45,6 +46,7 @@ import org.opensaml.saml2.metadata.OrganizationName;
 import org.opensaml.saml2.metadata.OrganizationURL;
 import org.opensaml.saml2.metadata.SurName;
 import org.opensaml.saml2.metadata.TelephoneNumber;
+import org.opensaml.xml.security.SecurityConfiguration;
 
 import at.gv.egovernment.moa.id.commons.db.dao.config.Contact;
 import at.gv.egovernment.moa.id.commons.db.dao.config.OAPVP2;
@@ -115,7 +117,7 @@ public class PVPConfiguration {
 		 try {
 			//generalpvpconfigdb = AuthConfigurationProvider.getInstance().getGeneralPVP2DBConfig();
 			props = AuthConfigurationProvider.getInstance().getGeneralPVP2ProperiesConfig();
-			
+						
 		} catch (ConfigurationException e) {
 			e.printStackTrace();
 		}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/requestHandler/AuthnRequestHandler.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/requestHandler/AuthnRequestHandler.java
index 21c0d85a1..229158778 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/requestHandler/AuthnRequestHandler.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/requestHandler/AuthnRequestHandler.java
@@ -24,7 +24,6 @@ package at.gv.egovernment.moa.id.protocols.pvp2x.requestHandler;
 
 import java.util.ArrayList;
 import java.util.List;
-
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
@@ -45,7 +44,6 @@ import org.opensaml.saml2.metadata.SPSSODescriptor;
 import org.opensaml.security.MetadataCredentialResolver;
 import org.opensaml.security.MetadataCriteria;
 import org.opensaml.ws.message.encoder.MessageEncodingException;
-import org.opensaml.xml.encryption.EncryptionConstants;
 import org.opensaml.xml.encryption.EncryptionException;
 import org.opensaml.xml.encryption.EncryptionParameters;
 import org.opensaml.xml.encryption.KeyEncryptionParameters;
@@ -57,6 +55,7 @@ import org.opensaml.xml.security.criteria.UsageCriteria;
 import org.opensaml.xml.security.keyinfo.KeyInfoGeneratorFactory;
 import org.opensaml.xml.security.x509.X509Credential;
 
+
 import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
 import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
@@ -125,12 +124,11 @@ public class AuthnRequestHandler implements IRequestHandler, PVPConstants {
 		AssertionConsumerService consumerService = spSSODescriptor
 				.getAssertionConsumerServices().get(idx);
 
-		if (consumerService == null) {
-			//TODO: maybe use default ConsumerService
-			
+		if (consumerService == null) {			
 			throw new InvalidAssertionConsumerServiceException(idx);
 			
 		}
+		
 		String oaURL = consumerService.getLocation();
 
 		//check, if metadata includes an encryption key				
@@ -158,19 +156,19 @@ public class AuthnRequestHandler implements IRequestHandler, PVPConstants {
 			try {
 				
 				EncryptionParameters dataEncParams = new EncryptionParameters();
-				dataEncParams.setAlgorithm(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128);
-			
+				dataEncParams.setAlgorithm(PVPConstants.DEFAULT_SYM_ENCRYPTION_METHODE);
+								
 				List<KeyEncryptionParameters> keyEncParamList = new ArrayList<KeyEncryptionParameters>();
 				KeyEncryptionParameters  keyEncParam = new KeyEncryptionParameters();
 			
 				keyEncParam.setEncryptionCredential(encryptionCredentials);
-				keyEncParam.setAlgorithm(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP);
+				keyEncParam.setAlgorithm(PVPConstants.DEFAULT_ASYM_ENCRYPTION_METHODE);
 				KeyInfoGeneratorFactory kigf = Configuration.getGlobalSecurityConfiguration()
 						.getKeyInfoGeneratorManager().getDefaultManager()
 						.getFactory(encryptionCredentials);
 				keyEncParam.setKeyInfoGenerator(kigf.newInstance());
 				keyEncParamList.add(keyEncParam);
-			
+											
 				Encrypter samlEncrypter = new Encrypter(dataEncParams, keyEncParamList); 
 				//samlEncrypter.setKeyPlacement(KeyPlacement.INLINE);
 				samlEncrypter.setKeyPlacement(KeyPlacement.PEER);
@@ -178,7 +176,7 @@ public class AuthnRequestHandler implements IRequestHandler, PVPConstants {
 				EncryptedAssertion encryptAssertion = null;
 				
 				encryptAssertion = samlEncrypter.encrypt(assertion);
-
+				
 				authResponse.getEncryptedAssertions().add(encryptAssertion);
 				
 				} catch (EncryptionException e1) {
@@ -191,10 +189,7 @@ public class AuthnRequestHandler implements IRequestHandler, PVPConstants {
 				authResponse.getAssertions().add(assertion);
 				
 			}
-			
-
-
-		
+					
 		IEncoder binding = null;
 
 		if (consumerService.getBinding().equals(
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/EntityVerifier.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/EntityVerifier.java
index 4ef9919ca..550643da1 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/EntityVerifier.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/EntityVerifier.java
@@ -22,7 +22,6 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.protocols.pvp2x.verification;
 
-import java.util.Iterator;
 import java.util.List;
 
 import org.opensaml.saml2.metadata.EntitiesDescriptor;
@@ -44,18 +43,25 @@ import at.gv.egovernment.moa.logging.Logger;
 public class EntityVerifier {
 
 	public static byte[] fetchSavedCredential(String entityID) {
-		List<OnlineApplication> oaList = ConfigurationDBRead
-				.getAllActiveOnlineApplications();
-		Iterator<OnlineApplication> oaIt = oaList.iterator();
-		while (oaIt.hasNext()) {
-			OnlineApplication oa = oaIt.next();
-			if (oa.getPublicURLPrefix().equals(entityID)) {
+//		List<OnlineApplication> oaList = ConfigurationDBRead
+//				.getAllActiveOnlineApplications();
+		
+		OnlineApplication oa = ConfigurationDBRead
+				.getActiveOnlineApplication(entityID);
+		
+//		Iterator<OnlineApplication> oaIt = oaList.iterator();
+//		while (oaIt.hasNext()) {
+//			OnlineApplication oa = oaIt.next();
+//			if (oa.getPublicURLPrefix().equals(entityID)) {
+		
+			if (oa != null && oa.getAuthComponentOA() != null) {
+		
 				OAPVP2 pvp2Config = oa.getAuthComponentOA().getOAPVP2();
 				if (pvp2Config != null) {
 					return pvp2Config.getCertificate();
 				}
 			}
-		}
+//		}
 		return null;
 	}
 
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/MetadataSignatureFilter.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/MetadataSignatureFilter.java
index f0ae6f446..ed0cf9c62 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/MetadataSignatureFilter.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/MetadataSignatureFilter.java
@@ -25,7 +25,9 @@ package at.gv.egovernment.moa.id.protocols.pvp2x.verification;
 import iaik.x509.X509Certificate;
 
 import java.security.cert.CertificateException;
+import java.util.ArrayList;
 import java.util.Iterator;
+import java.util.List;
 
 import org.opensaml.saml2.metadata.EntitiesDescriptor;
 import org.opensaml.saml2.metadata.EntityDescriptor;
@@ -69,13 +71,17 @@ public class MetadataSignatureFilter implements MetadataFilter {
 		while(entID.hasNext()) {
 			processEntitiesDescriptor(entID.next());
 		}
-		
+				
 		Iterator<EntityDescriptor> entIT = desc.getEntityDescriptors().iterator();
-	
-		//check every Entity 
+
+		List<EntityDescriptor> verifiedEntIT = new ArrayList<EntityDescriptor>();
+		
+		//check every Entity
+		
 		while(entIT.hasNext()) {
 			
 			EntityDescriptor entity = entIT.next();
+			
 			String entityID = entity.getEntityID();
 			
 			//CHECK if Entity also match MetaData signature.
@@ -92,17 +98,31 @@ public class MetadataSignatureFilter implements MetadataFilter {
 	
 					EntityVerifier.verify(desc, entityCrendential);
 					
+					//add entity to verified entity-list
+					verifiedEntIT.add(entity);
+					
 				} catch (Exception e) {
-					throw new MOAIDException("The App", null, e);
+
+					//remove entity of signature can not be verified.
+					Logger.info("Entity " + entityID + " is removed from metadata " 
+							+ desc.getName() + ". Entity verification error: " + e.getMessage());
+//					throw new MOAIDException("The App", null, e);
 				}
 				
 			} else {
-				throw new NoCredentialsException("NO Certificate found for OA " + entityID);
+				//remove entity if it is not registrated as OA
+				Logger.info("Entity " + entityID + " is removed from metadata " 
+						+ desc.getName() + ". Entity is not registrated or no certificate is found!");				
+//				throw new NoCredentialsException("NO Certificate found for OA " + entityID);
 			}
-
+			
 			//TODO: insert to support signed Entity-Elements
 			//processEntityDescriptorr(entIT.next());
-		}
+		}		
+		
+		//set only verified entity elements
+		desc.getEntityDescriptors().clear();
+		desc.getEntityDescriptors().addAll(verifiedEntIT);
 	}
 	
 	public void doFilter(XMLObject metadata) throws FilterException {
@@ -114,6 +134,13 @@ public class MetadataSignatureFilter implements MetadataFilter {
 				}
 				processEntitiesDescriptor(entitiesDescriptor);
 				
+				
+				if (entitiesDescriptor.getEntityDescriptors().size() == 0) {
+					throw new MOAIDException("No valid entity in metadata "
+							+ entitiesDescriptor.getName() + ". Metadata is not loaded.", null);
+				}
+				
+				
 			} else if (metadata instanceof EntityDescriptor) {
 				EntityDescriptor entityDescriptor = (EntityDescriptor) metadata;
 				processEntityDescriptorr(entityDescriptor);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/FormBuildUtils.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/FormBuildUtils.java
index 37ead5cff..d3ac574f8 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/FormBuildUtils.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/FormBuildUtils.java
@@ -43,6 +43,8 @@ public class FormBuildUtils {
 	public static String FONTFAMILY = "#FONTTYPE#";
 	public static String HEADER_TEXT = "#HEADER_TEXT#";
 	public static String REDIRECTTARGET = "#REDIRECTTARGET#";
+	public static String APPLET_HEIGHT = "#APPLETHEIGHT#";
+	public static String APPLET_WIDTH = "#APPLETWIDTH#";
 	
 	private static String MANDATEVISIBLE = "#MANDATEVISIBLE#";
 	private static String MANDATECHECKED = "#MANDATECHECKED#";
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java
index 327170054..bd6514c5c 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java
@@ -513,8 +513,8 @@ public class ParamValidatorUtils implements MOAIDAuthConstants{
 				throw new WrongParametersException("StartAuthentication", PARAM_OA, "auth.12");

 		    if (MiscUtil.isEmpty(bkuURL))

 		       throw new WrongParametersException("StartAuthentication", PARAM_BKU, "auth.12");

-		    if (MiscUtil.isEmpty(templateURL))

-		       throw new WrongParametersException("StartAuthentication", PARAM_TEMPLATE, "auth.12");

+//		    if (MiscUtil.isEmpty(templateURL))

+//		       throw new WrongParametersException("StartAuthentication", PARAM_TEMPLATE, "auth.12");

 		    if (!ParamValidatorUtils.isValidUseMandate(useMandate))

 	           throw new WrongParametersException("StartAuthentication", PARAM_USEMANDATE, "auth.12");		    

 		    if (!ParamValidatorUtils.isValidCCC(ccc))

diff --git a/id/server/idserverlib/src/main/resources/resources/properties/id_messages_de.properties b/id/server/idserverlib/src/main/resources/resources/properties/id_messages_de.properties
index a6c0601e4..93e8cdb99 100644
--- a/id/server/idserverlib/src/main/resources/resources/properties/id_messages_de.properties
+++ b/id/server/idserverlib/src/main/resources/resources/properties/id_messages_de.properties
@@ -41,6 +41,8 @@ auth.19=Die Authentifizierung kann nicht passiv durchgef\u00FChrt werden.
 auth.20=No valid MOA session found. Authentification process is abourted.

 auth.21=Der Anmeldevorgang wurde durch den Benutzer abgebrochen.

 auth.22=Das Protokoll {0} ist deaktiviert.

+auth.23=Das BKU-Selektion Template entspricht nicht der Spezifikation von MOA-ID 2.x.

+auth.24=Das Send-Assertion Template entspricht nicht der Spezifikation von MOA-ID 2.x.

 

 init.00=MOA ID Authentisierung wurde erfolgreich gestartet

 init.01=Fehler beim Aktivieren des IAIK-JCE/JSSE/JDK1.3 Workaround\: SSL ist m\u00F6glicherweise nicht verf\u00FCgbar

@@ -67,7 +69,8 @@ config.15=Das Personenbindungs-Trust-Profil (TrustProfileID \= {0}) darf nicht f
 config.16=MOA ID Proxy konnte nicht gestartet werden. Das Element ConnnectionParameter im allgemeinen Konfigurationsteil der MOA-ID-PROXY Konfigurationsdatei fehlt. 

 config.17=Fehler beim initialisieren von Hibernate

 config.18=Keine MOA-ID 2.x Konfiguration gefunden.

-config.19=Kein Schl?ssel f\u00FCr die Resignierung der Personenbindung gefunden. 

+config.19=Kein Schl?ssel f\u00FCr die Resignierung der Personenbindung gefunden.

+config.20=Umgebungsvariable "moa.id.proxy.configuration" nicht gesetzt 

 

 parser.00=Leichter Fehler beim Parsen: {0}

 parser.01=Fehler beim Parsen: {0}

diff --git a/id/server/moa-id-commons/src/main/resources/config/moaid_config_2.0.xsd b/id/server/moa-id-commons/src/main/resources/config/moaid_config_2.0.xsd
index 7944a7321..2461e1274 100644
--- a/id/server/moa-id-commons/src/main/resources/config/moaid_config_2.0.xsd
+++ b/id/server/moa-id-commons/src/main/resources/config/moaid_config_2.0.xsd
@@ -160,36 +160,6 @@
 						</xsd:complexContent>
 					</xsd:complexType>
 				</xsd:element>
-				<xsd:element name="ProxyComponent_General" minOccurs="0">
-					<xsd:annotation>
-						<xsd:documentation>enthält Konfigurationsparameter der
-							Proxy-Komponente
-						</xsd:documentation>
-					</xsd:annotation>
-					<xsd:complexType>
-						<xsd:sequence>
-							<xsd:element name="AuthComponent">
-								<xsd:annotation>
-									<xsd:documentation>enthält Parameter für die Kommunikation zw.
-										Proxykomponente und Authenttisierungskomponente
-									</xsd:documentation>
-								</xsd:annotation>
-								<xsd:complexType>
-									<xsd:sequence>
-										<xsd:element name="ConnectionParameter_Proxy" type="ConnectionParameterClientAuthType" minOccurs="0">
-											<xsd:annotation>
-												<xsd:documentation>enthält Parameter für die SOAP-Verbindung
-													von der Proxy-Komponente zur Auth-Komponente (vgl.
-													AuthComponent/MOA-SP/ConnectionParameter)
-												</xsd:documentation>
-											</xsd:annotation>
-										</xsd:element>
-									</xsd:sequence>
-								</xsd:complexType>
-							</xsd:element>
-						</xsd:sequence>
-					</xsd:complexType>
-				</xsd:element>
 				<xsd:element name="OnlineApplication" type="OnlineApplication" maxOccurs="unbounded">
 					<xsd:annotation>
 						<xsd:documentation>enthält Parameter für die OA
@@ -463,6 +433,8 @@
 			<xsd:element name="Template" type="TemplateType" minOccurs="0" maxOccurs="3"/>
 			<xsd:element name="AditionalAuthBlockText" type="xsd:string" minOccurs="0"/>
 			<xsd:element name="BKUSelectionCustomization" type="BKUSelectionCustomizationType" minOccurs="0" maxOccurs="1"/>
+			<xsd:element name="BKUSelectionTemplate" type="TransformsInfoType" minOccurs="0" maxOccurs="1"/>
+			<xsd:element name="SendAssertionTemplate" type="TransformsInfoType" minOccurs="0" maxOccurs="1"/>
 		</xsd:sequence>
 	</xsd:complexType>
 	<xsd:complexType name="TemplateType">
@@ -507,7 +479,6 @@
 			</xsd:element>
 		</xsd:sequence>
 	</xsd:complexType>
-	<xsd:complexType name="ProxyComponentType"/>
 	<xsd:complexType name="OnlineApplicationType">
 		<xsd:sequence>
 			<xsd:element name="isActive" type="xsd:boolean" default="false" minOccurs="1" maxOccurs="1"/>
@@ -557,29 +528,6 @@
 						maxOccurs="1"/ -->
 				</xsd:complexType>
 			</xsd:element>
-			<xsd:element name="ProxyComponent_OA" minOccurs="0">
-				<xsd:annotation>
-					<xsd:documentation>enthält Parameter über die OA, die die
-						Proxy-Komponente betreffen
-					</xsd:documentation>
-				</xsd:annotation>
-				<xsd:complexType>
-					<xsd:sequence>
-						<xsd:element name="ConnectionParameter" type="ConnectionParameterClientAuthType">
-							<xsd:annotation>
-								<xsd:documentation>enthält Parameter über die OA, die die
-									Proxy-Komponente betreffen
-								</xsd:documentation>
-							</xsd:annotation>
-						</xsd:element>
-					</xsd:sequence>
-					<xsd:attribute name="configFileURL" type="xsd:anyURI" use="optional"/>
-					<xsd:attribute name="sessionTimeOut" type="xsd:int" use="optional"/>
-					<xsd:attribute name="loginParameterResolverImpl" type="xsd:string" use="optional"/>
-					<xsd:attribute name="loginParameterResolverConfiguration" type="xsd:string" use="optional"/>
-					<xsd:attribute name="connectionBuilderImpl" type="xsd:string" use="optional"/>
-				</xsd:complexType>
-			</xsd:element>
 		</xsd:sequence>
 	</xsd:complexType>
 	<xsd:complexType name="ConnectionParameterServerAuthType">
@@ -995,6 +943,8 @@
 			<xsd:element name="ButtonBackGroundColorFocus" type="xsd:string" minOccurs="0" maxOccurs="1"/>
 			<xsd:element name="ButtonFontColor" type="xsd:string" minOccurs="0" maxOccurs="1"/>
 			<xsd:element name="AppletRedirectTarget" type="xsd:string" minOccurs="0" maxOccurs="1"/>
+			<xsd:element name="AppletHeight" type="xsd:string" minOccurs="0" maxOccurs="1"/>
+			<xsd:element name="AppletWidth" type="xsd:string" minOccurs="0" maxOccurs="1"/>
 			<xsd:element name="MandateLoginButton" type="xsd:boolean" default="true" minOccurs="0" maxOccurs="1"/>
 			<xsd:element name="OnlyMandateLoginAllowed" type="xsd:boolean" default="false" minOccurs="0" maxOccurs="1"/>
 		</xsd:sequence>
diff --git a/id/server/stork2-saml-engine/src/main/java/eu/stork/peps/auth/engine/SAMLEngine.java b/id/server/stork2-saml-engine/src/main/java/eu/stork/peps/auth/engine/SAMLEngine.java
index 48718242b..e993c0e46 100644
--- a/id/server/stork2-saml-engine/src/main/java/eu/stork/peps/auth/engine/SAMLEngine.java
+++ b/id/server/stork2-saml-engine/src/main/java/eu/stork/peps/auth/engine/SAMLEngine.java
@@ -143,12 +143,13 @@ public class SAMLEngine {
 

 	LOG.info("SAMLEngine: Initialize OpenSAML");

 

-	try {

-	    DefaultBootstrap.bootstrap();

-	} catch (ConfigurationException e) {

-	    LOG.error("Problem initializing the OpenSAML library.");

-	    throw new STORKSAMLEngineRuntimeException(e);

-	}

+	//TLenz: MOA-ID uses an own Bootstrap

+//	try {

+//	    DefaultBootstrap.bootstrap();

+//	} catch (ConfigurationException e) {

+//	    LOG.error("Problem initializing the OpenSAML library.");

+//	    throw new STORKSAMLEngineRuntimeException(e);

+//	}

 

 	LOG.debug("Read all file configurations. (instances of SAMLEngine)");

 	try {