Merge branch 'moa-2.1-Snapshot'

Conflicts:
	id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OATargetConfiguration.java
	pom.xml

21 files changed, 676 insertions, 111 deletions

diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java
index 567978cae..f549db9f3 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java
@@ -60,6 +60,7 @@ public class Constants {
 	public static final String SESSION_BKUSELECTIONTEMPLATE = "bkuSelectionTemplate";
 	public static final String SESSION_SENDASSERTIONTEMPLATE = "sendAssertionTemplate";
 	public static final String SESSION_SLTRANSFORMATION = "slTransformation";
+	public static final String SESSION_BPKENCRYPTIONDECRYPTION = "bPKEncDec";
 	
 	public static final String SESSION_SLOERROR = "sloerrormessage";
 	public static final String SESSION_SLOSUCCESS = "slosuccessmessage";
@@ -115,4 +116,6 @@ public class Constants {
 
         BUSINESSSERVICENAMES = Collections.unmodifiableMap(tmp);
 	}
+	
+	public static final long ONE_MINUTE_IN_MILLIS=60000;//millisecs
 }
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/AuthenticatedUser.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/AuthenticatedUser.java
index 036acf1f6..3bfe409c0 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/AuthenticatedUser.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/AuthenticatedUser.java
@@ -42,6 +42,7 @@ public class AuthenticatedUser {
 	private String institute;
 	private String userName;
 	private Date lastLogin;
+	private Date sessionExpired; 
 	
 	private boolean onlyBusinessService = false;
 	private String businessServiceType;
@@ -54,7 +55,7 @@ public class AuthenticatedUser {
 		
 	}
 	
-	public static AuthenticatedUser generateDefaultUser() {
+	public static AuthenticatedUser generateDefaultUser(Date sessionExpired) {
 		
 		AuthenticatedUser user = new AuthenticatedUser();		
 		user.familyName = "TestUser";
@@ -67,12 +68,13 @@ public class AuthenticatedUser {
 		user.isMandateUser = false;
 		user.isPVP2Login = false;
 		user.lastLogin = new Date();
+		user.sessionExpired = sessionExpired;
 		
 		return user;
 	}
 	
 	public static AuthenticatedUser generateUserRequestUser(UserDatabaseFrom form, 
-			String nameID, String nameIDFormat) {
+			String nameID, String nameIDFormat, Date sessionExpired) {
 		
 		AuthenticatedUser user = new AuthenticatedUser();		
 		user.familyName = form.getFamilyName();
@@ -85,6 +87,7 @@ public class AuthenticatedUser {
 		user.isMandateUser = form.isIsmandateuser();
 		user.isPVP2Login = form.isPVPGenerated();
 		user.lastLogin = new Date();
+		user.sessionExpired = sessionExpired;
 		
 		user.nameID = nameID;
 		user.nameIDFormat = nameIDFormat;
@@ -93,7 +96,7 @@ public class AuthenticatedUser {
 	}
 	
 	public AuthenticatedUser(UserDatabase userdb, boolean isAuthenticated, boolean isMandateUser, 
-			boolean isPVP2Login, String nameID, String nameIDFormat) {
+			boolean isPVP2Login, String nameID, String nameIDFormat, Date sessionExpired) {
 		
 		this.familyName = userdb.getFamilyname();
 		this.givenName = userdb.getGivenname();
@@ -105,6 +108,7 @@ public class AuthenticatedUser {
 		this.isMandateUser = isMandateUser;
 		this.isPVP2Login = isPVP2Login;
 		this.lastLogin = new Date();
+		this.sessionExpired = sessionExpired;
 		
 		this.nameID = nameID;
 		this.nameIDFormat = nameIDFormat;
@@ -250,10 +254,13 @@ public class AuthenticatedUser {
 	public String getNameIDFormat() {
 		return nameIDFormat;
 	}
-	
-	
-	
-	
-	
+
+	/**
+	 * @return the sessionExpired
+	 */
+	public Date getSessionExpired() {
+		return sessionExpired;
+	}
+
 
 }
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/AuthenticationManager.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/AuthenticationManager.java
index 6d3afffc9..58142b398 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/AuthenticationManager.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/AuthenticationManager.java
@@ -22,6 +22,9 @@
  */
 package at.gv.egovernment.moa.id.configuration.auth;
 
+import java.util.Date;
+import java.util.Iterator;
+
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -81,4 +84,16 @@ public class AuthenticationManager {
 		activeUsers.removeUser(authUser.getNameID());
 		
 	}
+	
+	public void removeAllUsersAfterTimeOut() {
+		Iterator<AuthenticatedUser> expiredUsers = activeUsers.getUserWithSessionTimeOut(new Date());
+		while (expiredUsers.hasNext()) {
+			AuthenticatedUser user = expiredUsers.next();
+			activeUsers.removeUser(user.getNameID());
+			log.info("LogOut user with ID" + user.getNameID() + " after SessionTimeOut.");
+			
+		}
+		
+	}
+
 }
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/IActiveUserStorage.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/IActiveUserStorage.java
index c52fee140..80730c6e0 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/IActiveUserStorage.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/IActiveUserStorage.java
@@ -22,6 +22,9 @@
  */
 package at.gv.egovernment.moa.id.configuration.auth;
 
+import java.util.Date;
+import java.util.Iterator;
+
 /**
  * @author tlenz
  *
@@ -31,5 +34,6 @@ public interface IActiveUserStorage {
 	public AuthenticatedUser getUser(String nameID);
 	public void setUser(String nameID, AuthenticatedUser authUser);
 	public void removeUser(String nameID);
+	public Iterator<AuthenticatedUser> getUserWithSessionTimeOut(Date date);
 	
 }
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/MemoryActiveUserStorageImpl.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/MemoryActiveUserStorageImpl.java
index 145da2c35..186a2b931 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/MemoryActiveUserStorageImpl.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/MemoryActiveUserStorageImpl.java
@@ -22,7 +22,12 @@
  */
 package at.gv.egovernment.moa.id.configuration.auth;
 
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Date;
 import java.util.HashMap;
+import java.util.Iterator;
+import java.util.List;
 import java.util.Map;
 
 /**
@@ -68,4 +73,18 @@ public class MemoryActiveUserStorageImpl implements IActiveUserStorage {
 
 	}
 
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.configuration.auth.IActiveUserStorage#getUserWithSessionTimeOut(java.util.Date)
+	 */
+	@Override
+	public Iterator<AuthenticatedUser> getUserWithSessionTimeOut(Date date) {
+		List<AuthenticatedUser> expiredUsers =  new ArrayList<AuthenticatedUser>();
+		for (AuthenticatedUser user : store.values()) {
+			if (date.after(user.getSessionExpired()))
+				expiredUsers.add(user);
+			
+		}				
+		return expiredUsers.iterator();
+	}
+
 }
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/servlets/SLOBasicServlet.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/servlets/SLOBasicServlet.java
index 38c858918..dfcde4624 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/servlets/SLOBasicServlet.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/servlets/SLOBasicServlet.java
@@ -127,7 +127,6 @@ public class SLOBasicServlet extends HttpServlet {
 			HttpSession session = request.getSession(false);
 			if (session != null)
 				session.invalidate();
-			
 			return createSLOResponse(sloReq, StatusCode.SUCCESS_URI, request);
 			
 		} else {
@@ -198,11 +197,20 @@ public class SLOBasicServlet extends HttpServlet {
 			
 			
 		} else if (sloResp.getStatus().getStatusCode().getValue().equals(StatusCode.SUCCESS_URI)) {
-			log.info("Single LogOut process complete.");
-			request.getSession().setAttribute(Constants.SESSION_SLOSUCCESS, 
-					LanguageHelper.getErrorString("webpages.slo.success", request));
 			
-
+			if (sloResp.getStatus().getStatusCode().getStatusCode() != null && 
+					!sloResp.getStatus().getStatusCode().getStatusCode().equals(StatusCode.PARTIAL_LOGOUT_URI)) {			
+				log.info("Single LogOut process complete.");
+				request.getSession().setAttribute(Constants.SESSION_SLOSUCCESS, 
+						LanguageHelper.getErrorString("webpages.slo.success", request));
+				
+			} else {
+				log.warn("Single LogOut process is not completed.");
+				request.getSession().setAttribute(Constants.SESSION_SLOERROR, 
+						LanguageHelper.getErrorString("webpages.slo.error", request));
+				
+			}
+			
 		} else {
 			log.warn("Single LogOut response sends an unsupported statustype " + sloResp.getStatus().getStatusCode().getValue());
 			request.getSession().setAttribute(Constants.SESSION_SLOERROR, 
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java
index bea6220ff..957479b29 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java
@@ -457,6 +457,11 @@ public class ConfigurationProvider {
 		
 	}
 	
+	public String getConfigurationEncryptionKey() {
+		return props.getProperty("general.moaconfig.key");
+				
+	}
+	
 	private void initalPVP2Login() throws ConfigurationException {
 		try {
 					
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/GeneralStorkConfig.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/GeneralStorkConfig.java
index 9e5ba684c..5e177655d 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/GeneralStorkConfig.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/GeneralStorkConfig.java
@@ -25,12 +25,14 @@ package at.gv.egovernment.moa.id.configuration.data;
 import java.util.ArrayList;
 import java.util.List;
 
+import at.gv.egovernment.moa.id.commons.db.ConfigurationDBRead;
 import at.gv.egovernment.moa.id.commons.db.dao.config.AuthComponentGeneral;
 import at.gv.egovernment.moa.id.commons.db.dao.config.CPEPS;
 import at.gv.egovernment.moa.id.commons.db.dao.config.ForeignIdentities;
 import at.gv.egovernment.moa.id.commons.db.dao.config.MOAIDConfiguration;
 import at.gv.egovernment.moa.id.commons.db.dao.config.STORK;
 import at.gv.egovernment.moa.id.commons.db.dao.config.StorkAttribute;
+
 import org.apache.log4j.Logger;
 
 public class GeneralStorkConfig {
@@ -78,7 +80,7 @@ public class GeneralStorkConfig {
 					}
 					
 					if (cpepslist.isEmpty())
-						cpepslist.add(new CPEPS());
+						cpepslist = null;
 					
 					if(attributes.isEmpty())
 						attributes.add(new StorkAttribute());
@@ -88,7 +90,34 @@ public class GeneralStorkConfig {
 	}
 
 	public List<CPEPS> getCpepslist() {
-		return cpepslist;
+		if (null == cpepslist)
+			return null;
+
+		MOAIDConfiguration dbconfig = ConfigurationDBRead.getMOAIDConfiguration();
+		
+		try {
+			List<CPEPS> cpepss = dbconfig.getAuthComponentGeneral().getForeignIdentities().getSTORK().getCPEPS();
+
+			if (cpepss != null) {
+				// make CountryCode "readonly"
+				for (CPEPS newone : cpepslist) {
+					for (CPEPS current : cpepss) {
+						if (null != newone)
+							if (current.getHjid().equals(newone.getHjid())) {
+								newone.setCountryCode(current.getCountryCode());
+								break;
+							}
+					}
+				}
+			}
+
+			return cpepslist;
+			
+		} catch (NullPointerException e) {
+			return null;
+			
+		}
+			
 	}
 
 	public void setCpepslist(List<CPEPS> list) {
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OABPKEncryption.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OABPKEncryption.java
new file mode 100644
index 000000000..6782987e5
--- /dev/null
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OABPKEncryption.java
@@ -0,0 +1,370 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.configuration.data.oa;
+
+import java.io.File;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpSession;
+
+import org.apache.commons.lang.SerializationUtils;
+import org.apache.log4j.Logger;
+
+import at.gv.egovernment.moa.id.auth.exception.BuildException;
+import at.gv.egovernment.moa.id.commons.db.dao.config.AuthComponentOA;
+import at.gv.egovernment.moa.id.commons.db.dao.config.BPKDecryption;
+import at.gv.egovernment.moa.id.commons.db.dao.config.EncBPKInformation;
+import at.gv.egovernment.moa.id.commons.db.dao.config.OnlineApplication;
+import at.gv.egovernment.moa.id.commons.validation.ValidationHelper;
+import at.gv.egovernment.moa.id.config.auth.data.BPKDecryptionParameters;
+import at.gv.egovernment.moa.id.configuration.Constants;
+import at.gv.egovernment.moa.id.configuration.auth.AuthenticatedUser;
+import at.gv.egovernment.moa.id.configuration.helper.LanguageHelper;
+import at.gv.egovernment.moa.id.configuration.utils.ConfigurationEncryptionUtils;
+import at.gv.egovernment.moa.id.configuration.validation.oa.OAFileUploadValidation;
+import at.gv.egovernment.moa.id.data.EncryptedData;
+import at.gv.egovernment.moa.util.MiscUtil;
+
+/**
+ * @author tlenz
+ *
+ */
+public class OABPKEncryption implements IOnlineApplicationData {
+
+	private static final Logger log = Logger.getLogger(OABPKEncryption.class);
+	
+	private static final String MODULENAME = "bPKEncryptionDecryption";
+	
+	private String keyStorePassword = null;
+	private String keyAlias = null;
+	private String keyPassword = null;
+	
+	private Map<String, byte[]> keyStoreForm = new HashMap<String, byte[]>();
+	
+	private List<File> keyStoreFileUpload = null;
+	private List<String> keyStoreFileUploadContentType = null;
+	private List<String> keyStoreFileUploadFileName  = new ArrayList<String>();;
+	private boolean deletekeyStore = false;
+	private boolean validationError = false;
+	
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.configuration.data.oa.IOnlineApplicationData#getName()
+	 */
+	@Override
+	public String getName() {
+		// TODO Auto-generated method stub
+		return MODULENAME;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.configuration.data.oa.IOnlineApplicationData#parse(at.gv.egovernment.moa.id.commons.db.dao.config.OnlineApplication, at.gv.egovernment.moa.id.configuration.auth.AuthenticatedUser, javax.servlet.http.HttpServletRequest)
+	 */
+	@Override
+	public List<String> parse(OnlineApplication dbOA,
+			AuthenticatedUser authUser, HttpServletRequest request) {
+		AuthComponentOA oaAuth = dbOA.getAuthComponentOA();
+		if (oaAuth != null) {
+			EncBPKInformation bPKEncDec = oaAuth.getEncBPKInformation();
+			if (bPKEncDec != null) {
+				BPKDecryption bPKDec = bPKEncDec.getBPKDecryption();
+				if (bPKDec != null) {
+					keyAlias = bPKDec.getKeyAlias();
+					if (bPKDec.getKeyStoreFileName() != null)
+						keyStoreFileUploadFileName.add(bPKDec.getKeyStoreFileName());
+					
+				}				
+			}						
+		}
+				
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.configuration.data.oa.IOnlineApplicationData#store(at.gv.egovernment.moa.id.commons.db.dao.config.OnlineApplication, at.gv.egovernment.moa.id.configuration.auth.AuthenticatedUser, javax.servlet.http.HttpServletRequest)
+	 */
+	@Override
+	public String store(OnlineApplication dbOA, AuthenticatedUser authUser,
+			HttpServletRequest request) {
+		AuthComponentOA oaAuth = dbOA.getAuthComponentOA();
+		if (oaAuth == null) {
+			oaAuth = new AuthComponentOA();
+			dbOA.setAuthComponentOA(oaAuth);
+			
+		}		
+		EncBPKInformation bPKEncDec = oaAuth.getEncBPKInformation();
+		if (bPKEncDec == null) {
+			bPKEncDec = new EncBPKInformation();
+			oaAuth.setEncBPKInformation(bPKEncDec);
+			
+		}
+				
+		BPKDecryption bPKDec = bPKEncDec.getBPKDecryption();
+		if (bPKDec == null) {
+			bPKDec = new BPKDecryption();
+			bPKEncDec.setBPKDecryption(bPKDec);
+		}
+		
+		if (isDeletekeyStore()) {
+			bPKDec.setIv(null);
+			bPKDec.setKeyAlias(null);
+			bPKDec.setKeyInformation(null);
+			bPKDec.setKeyStoreFileName(null);
+			
+		}
+		
+		BPKDecryptionParameters keyInfo = new BPKDecryptionParameters();
+		if (keyStoreForm != null && keyStoreForm.size() > 0) {			
+			keyInfo.setKeyAlias(keyAlias);
+			keyInfo.setKeyPassword(keyPassword);
+			keyInfo.setKeyStorePassword(keyStorePassword);
+			
+            Iterator<String> interator = keyStoreForm.keySet().iterator();
+            bPKDec.setKeyStoreFileName(interator.next());
+            bPKDec.setKeyAlias(keyAlias);            
+            keyInfo.setKeyStore(keyStoreForm.get(
+                    bPKDec.getKeyStoreFileName()));
+
+            //encrypt key information
+            byte[] serKeyInfo = SerializationUtils.serialize(keyInfo);            
+            try {
+				EncryptedData encryptkeyInfo = ConfigurationEncryptionUtils.getInstance().encrypt(serKeyInfo);
+				bPKDec.setIv(encryptkeyInfo.getIv());
+				bPKDec.setKeyInformation(encryptkeyInfo.getEncData());				
+				
+			} catch (BuildException e) {
+				log.error("Configuration encryption FAILED.", e);
+				return LanguageHelper.getErrorString("error.general.text", request);
+				
+			}
+		}
+		
+		request.getSession().setAttribute(Constants.SESSION_BPKENCRYPTIONDECRYPTION, null);
+		
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.configuration.data.oa.IOnlineApplicationData#validate(at.gv.egovernment.moa.id.configuration.data.oa.OAGeneralConfig, at.gv.egovernment.moa.id.configuration.auth.AuthenticatedUser, javax.servlet.http.HttpServletRequest)
+	 */
+	@Override
+	public List<String> validate(OAGeneralConfig general,
+			AuthenticatedUser authUser, HttpServletRequest request) {
+		HttpSession session = request.getSession();
+		List<String> errors = new ArrayList<String>();		
+		
+		String check = null;
+		
+		OAFileUploadValidation valiator_fileUpload = new OAFileUploadValidation();		
+        //validate BKU-selection template
+        List<String> templateError = valiator_fileUpload.validate(getKeyStoreFileUploadFileName()
+                , getKeyStoreFileUpload(), "validation.bPKDec.keyStore", keyStoreForm, request);
+        if (templateError != null && templateError.size() == 0) {
+            if (keyStoreForm != null && keyStoreForm.size() > 0) {
+                session.setAttribute(Constants.SESSION_BPKENCRYPTIONDECRYPTION, keyStoreForm);
+                
+            } else
+            	keyStoreForm = (Map<String, byte[]>) session.getAttribute(Constants.SESSION_BPKENCRYPTIONDECRYPTION);
+
+        } else {
+            errors.addAll(templateError);
+
+        }
+        
+        if (keyStoreForm != null && keyStoreForm.size() > 0) {
+    		check = getKeyStorePassword();
+    		if (MiscUtil.isEmpty(check)) {
+    			log.info("bPK decryption keystore password is empty");
+    			errors.add(LanguageHelper.getErrorString("validation.bPKDec.keyStorePassword.empty", request));
+    			
+    		} else {
+    			if (ValidationHelper.containsPotentialCSSCharacter(check, false)) {
+    				log.warn("bPK decryption keystore password contains potentail XSS characters: " + check);
+    				errors.add(LanguageHelper.getErrorString("validation.bPKDec.keyStorePassword.valid", 
+    						new Object[] {ValidationHelper.getPotentialCSSCharacter(false)}, request ));
+    				
+    			}			
+    		}
+    		
+    		check = getKeyAlias();
+    		if (MiscUtil.isEmpty(check)) {
+    			log.info("bPK decryption key alias is empty");
+    			errors.add(LanguageHelper.getErrorString("validation.bPKDec.keyAlias.empty", request));
+    			
+    		} else {
+    			if (ValidationHelper.containsPotentialCSSCharacter(check, false)) {
+    				log.warn("bPK decryption key alias contains potentail XSS characters: " + check);
+    				errors.add(LanguageHelper.getErrorString("validation.bPKDec.keyAlias.valid", 
+    						new Object[] {ValidationHelper.getPotentialCSSCharacter(false)}, request ));
+    				
+    			}			
+    		}
+    		
+    		check = getKeyPassword();
+    		if (MiscUtil.isNotEmpty(check)) {
+    			if (ValidationHelper.containsPotentialCSSCharacter(check, false)) {
+    				log.warn("bPK decryption key password contains potentail XSS characters: " + check);
+    				errors.add(LanguageHelper.getErrorString("validation.bPKDec.keyPassword.valid", 
+    						new Object[] {ValidationHelper.getPotentialCSSCharacter(false)}, request ));
+    				
+    			}			
+    		}
+        	        	
+        	BPKDecryptionParameters keyInfo = new BPKDecryptionParameters();
+        	keyInfo.setKeyAlias(keyAlias);
+        	keyInfo.setKeyPassword(keyPassword);
+        	keyInfo.setKeyStorePassword(keyStorePassword);    			
+        	Iterator<String> interator = keyStoreForm.keySet().iterator();
+        	String fileName = interator.next();            
+        	keyInfo.setKeyStore(keyStoreForm.get(fileName));                
+        	if (keyInfo.getPrivateKey() == null) {
+        		log.info("Open keyStore FAILED.");
+        		errors.add(LanguageHelper.getErrorString("validation.bPKDec.keyStore.file.valid", request));
+        	
+        	}        	
+        }
+		
+        if (errors.size() > 0) {
+        	validationError = true;
+        	
+        }
+        
+		return errors;
+		
+	}
+
+	/**
+	 * @return the keyStorePassword
+	 */
+	public String getKeyStorePassword() {
+		return keyStorePassword;
+	}
+
+	/**
+	 * @param keyStorePassword the keyStorePassword to set
+	 */
+	public void setKeyStorePassword(String keyStorePassword) {
+		this.keyStorePassword = keyStorePassword;
+	}
+
+	/**
+	 * @return the keyAlias
+	 */
+	public String getKeyAlias() {
+		return keyAlias;
+	}
+
+	/**
+	 * @param keyAlias the keyAlias to set
+	 */
+	public void setKeyAlias(String keyAlias) {
+		this.keyAlias = keyAlias;
+	}
+
+	/**
+	 * @return the keyPassword
+	 */
+	public String getKeyPassword() {
+		return keyPassword;
+	}
+
+	/**
+	 * @param keyPassword the keyPassword to set
+	 */
+	public void setKeyPassword(String keyPassword) {
+		this.keyPassword = keyPassword;
+	}
+
+	/**
+	 * @return the keyStoreFileUpload
+	 */
+	public List<File> getKeyStoreFileUpload() {
+		return keyStoreFileUpload;
+	}
+
+	/**
+	 * @param keyStoreFileUpload the keyStoreFileUpload to set
+	 */
+	public void setKeyStoreFileUpload(List<File> keyStoreFileUpload) {
+		this.keyStoreFileUpload = keyStoreFileUpload;
+	}
+
+	/**
+	 * @return the keyStoreFileUploadContentType
+	 */
+	public List<String> getKeyStoreFileUploadContentType() {
+		return keyStoreFileUploadContentType;
+	}
+
+	/**
+	 * @param keyStoreFileUploadContentType the keyStoreFileUploadContentType to set
+	 */
+	public void setKeyStoreFileUploadContentType(
+			List<String> keyStoreFileUploadContentType) {
+		this.keyStoreFileUploadContentType = keyStoreFileUploadContentType;
+	}
+
+	/**
+	 * @return the keyStoreFileUploadFileName
+	 */
+	public List<String> getKeyStoreFileUploadFileName() {
+		return keyStoreFileUploadFileName;
+	}
+
+	/**
+	 * @param keyStoreFileUploadFileName the keyStoreFileUploadFileName to set
+	 */
+	public void setKeyStoreFileUploadFileName(
+			List<String> keyStoreFileUploadFileName) {
+		this.keyStoreFileUploadFileName = keyStoreFileUploadFileName;
+	}
+
+	/**
+	 * @return the deletekeyStore
+	 */
+	public boolean isDeletekeyStore() {
+		return deletekeyStore;
+	}
+
+	/**
+	 * @param deletekeyStore the deletekeyStore to set
+	 */
+	public void setDeletekeyStore(boolean deletekeyStore) {
+		this.deletekeyStore = deletekeyStore;
+	}
+
+	/**
+	 * @return the validationError
+	 */
+	public boolean isValidationError() {
+		return validationError;
+	}
+	
+	
+
+}
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OAMOAIDPInterfederationConfig.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OAMOAIDPInterfederationConfig.java
index 5db9029bd..9431cc1fd 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OAMOAIDPInterfederationConfig.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OAMOAIDPInterfederationConfig.java
@@ -117,10 +117,10 @@ public class OAMOAIDPInterfederationConfig implements IOnlineApplicationData {
 			}			
 		}
 		
-		if (inboundSSO && MiscUtil.isEmpty(queryURL)) {
-			log.info("Inbound Single Sign-On requires AttributQueryURL configuration.");
-			errors.add(LanguageHelper.getErrorString("validation.interfederation.moaidp.queryurl.empty", request));
-		}
+//		if (inboundSSO && MiscUtil.isEmpty(queryURL)) {
+//			log.info("Inbound Single Sign-On requires AttributQueryURL configuration.");
+//			errors.add(LanguageHelper.getErrorString("validation.interfederation.moaidp.queryurl.empty", request));
+//		}
 		
 		return errors;
 	}
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OATargetConfiguration.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OATargetConfiguration.java
index 550844700..bb7bac4f8 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OATargetConfiguration.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OATargetConfiguration.java
@@ -83,7 +83,6 @@ public class OATargetConfiguration implements IOnlineApplicationData {
 	@Override
 	public List<String> parse(OnlineApplication dbOA,
 			AuthenticatedUser authUser, HttpServletRequest request) {
-		
 		String target_full = dbOA.getTarget();
 		if (MiscUtil.isNotEmpty(target_full)) {
 			if (TargetValidator.isValidTarget(target_full)) {
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/filter/AuthenticationFilter.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/filter/AuthenticationFilter.java
index 1f631afea..d13696d51 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/filter/AuthenticationFilter.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/filter/AuthenticationFilter.java
@@ -24,6 +24,7 @@ package at.gv.egovernment.moa.id.configuration.filter;
 
 import java.io.IOException;
 import java.util.ArrayList;
+import java.util.Date;
 import java.util.StringTokenizer;
 import java.util.regex.Pattern;
 
@@ -153,8 +154,11 @@ public class AuthenticationFilter implements Filter{
 				log.warn("Authentication is deaktivated. Dummy authentication-information are used!");
 							
 				if (authuser == null) {
-
-					authuser = AuthenticatedUser.generateDefaultUser();
+					int sessionTimeOut = session.getMaxInactiveInterval();
+					Date sessionExpired = new Date(new Date().getTime() + 
+							(sessionTimeOut * Constants.ONE_MINUTE_IN_MILLIS)); 
+					
+					authuser = AuthenticatedUser.generateDefaultUser(sessionExpired);
 					authManager.setActiveUser(authuser);
 					
 					//authuser = new AuthenticatedUser(1, "Max", "TestUser", true, false);
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/helper/FormDataHelper.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/helper/FormDataHelper.java
index cd6c699b9..dc97dd2c8 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/helper/FormDataHelper.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/helper/FormDataHelper.java
@@ -23,6 +23,7 @@
 package at.gv.egovernment.moa.id.configuration.helper;
 
 import java.util.ArrayList;
+import java.util.Date;
 import java.util.List;
 
 import at.gv.egovernment.moa.id.commons.db.dao.config.OnlineApplication;
@@ -88,7 +89,8 @@ public class FormDataHelper {
 			userlist.add(new AuthenticatedUser(dbuser, 
 					dbuser.isIsActive(), 
 					ismandate,
-					false, null, null));
+					false, null, null, new Date())
+					);
 		}
 		return userlist;
 	}
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/helper/MailHelper.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/helper/MailHelper.java
index caed3e469..3c1c2f141 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/helper/MailHelper.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/helper/MailHelper.java
@@ -22,8 +22,6 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.configuration.helper;
 
-import java.io.File;
-import java.io.FileInputStream;
 import java.io.InputStream;
 import java.io.StringWriter;
 import java.io.UnsupportedEncodingException;
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditGeneralConfigAction.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditGeneralConfigAction.java
index 0a308a354..32ffd2ba3 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditGeneralConfigAction.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditGeneralConfigAction.java
@@ -237,20 +237,8 @@ public class EditGeneralConfigAction extends BasicAction {
         } catch (Exception ex) {
             ex.printStackTrace();
         }
-
-		MOAIDConfiguration oldconfig = ConfigurationDBRead.getMOAIDConfiguration();
-		AuthComponentGeneral oldauth = null;
-		if (oldconfig != null) {
-			oldauth = oldconfig.getAuthComponentGeneral();
-		}
-		
-//		MOAIDConfiguration dbconfig = ConfigurationDBRead.getMOAIDConfiguration();	
-//		if (dbconfig == null) {
-//			dbconfig = new MOAIDConfiguration();
-//			isnewconfig = true;
-//		}
 		
-		MOAIDConfiguration dbconfig = new MOAIDConfiguration();
+		MOAIDConfiguration dbconfig = ConfigurationDBRead.getMOAIDConfiguration();
 		
 		AuthComponentGeneral dbauth = dbconfig.getAuthComponentGeneral();
 		if (dbauth == null) {
@@ -320,14 +308,36 @@ public class EditGeneralConfigAction extends BasicAction {
 			legprot = new LegacyAllowed();
 			dbprotocols.setLegacyAllowed(legprot);
 		}
-				
-		List<String> el = new ArrayList<String>();
-		if (moaconfig.isLegacy_pvp2())
-			el.add(Constants.MOA_CONFIG_PROTOCOL_PVP2);
-		if (moaconfig.isLegacy_saml1())
-			el.add(Constants.MOA_CONFIG_PROTOCOL_SAML1);
-		legprot.setProtocolName(el);
 		
+		List<String> el = legprot.getProtocolName();
+		if (el == null) {
+			el = new ArrayList<String>();
+			legprot.setProtocolName(el);
+			
+		}
+
+		//Workaround for DB cleaning is only needed for one or the releases (insert in 2.1.1) 
+		if (el.size() > 2)
+			el.clear();
+		
+		if (el.contains(Constants.MOA_CONFIG_PROTOCOL_PVP2)) {		
+			if (!moaconfig.isLegacy_pvp2())
+				el.remove(Constants.MOA_CONFIG_PROTOCOL_PVP2);
+			
+		} else {
+			if (moaconfig.isLegacy_pvp2())
+				el.add(Constants.MOA_CONFIG_PROTOCOL_PVP2);
+		}
+		
+		if (el.contains(Constants.MOA_CONFIG_PROTOCOL_SAML1)) {		
+			if (!moaconfig.isLegacy_saml1())
+				el.remove(Constants.MOA_CONFIG_PROTOCOL_SAML1);
+			
+		} else {
+			if (moaconfig.isLegacy_saml1())
+				el.add(Constants.MOA_CONFIG_PROTOCOL_SAML1);
+		}
+				
 		SAML1 saml1= dbprotocols.getSAML1();
 		if (saml1 == null) {
 			saml1 = new SAML1();
@@ -397,15 +407,17 @@ public class EditGeneralConfigAction extends BasicAction {
 			cont.setGivenName(StringHelper.getUTF8String(
 					moaconfig.getPvp2Contact().getGivenname()));
 		
-		//TODO: change to list if required
-		if (MiscUtil.isNotEmpty(moaconfig.getPvp2Contact().getMail()))
+		if (cont.getMail() != null && cont.getMail().size() > 0)
+			cont.getMail().set(0, moaconfig.getPvp2Contact().getMail());			
+		else
 			cont.setMail(Arrays.asList(moaconfig.getPvp2Contact().getMail()));
-		if (MiscUtil.isNotEmpty(moaconfig.getPvp2Contact().getPhone()))
+			
+		if (cont.getPhone() != null && cont.getPhone().size() > 0)
+			cont.getPhone().set(0, moaconfig.getPvp2Contact().getPhone());			
+		else
 			cont.setPhone(Arrays.asList(moaconfig.getPvp2Contact().getPhone()));
-		
-		if (MiscUtil.isNotEmpty(moaconfig.getPvp2Contact().getSurname()))
-			cont.setSurName(StringHelper.getUTF8String(
-					moaconfig.getPvp2Contact().getSurname()));
+			
+		cont.setSurName(StringHelper.getUTF8String(moaconfig.getPvp2Contact().getSurname()));
 		if (MiscUtil.isNotEmpty(moaconfig.getPvp2Contact().getType()))
 			cont.setType(moaconfig.getPvp2Contact().getType());
 		
@@ -486,23 +498,6 @@ public class EditGeneralConfigAction extends BasicAction {
 		
 		dbchainingmodes.setSystemDefaultMode(
 				ChainingModeType.fromValue(moaconfig.getDefaultchainigmode()));
-		if (oldconfig != null) {
-			ChainingModes oldchainigmodes = oldconfig.getChainingModes();
-			if (oldchainigmodes != null) {
-				List<TrustAnchor> oldtrustanchor = oldchainigmodes.getTrustAnchor();
-				if (oldtrustanchor != null) {
-					List<TrustAnchor> trustanchor = new ArrayList<TrustAnchor>();
-					for (TrustAnchor oldel : oldtrustanchor) {
-						TrustAnchor TAel = new TrustAnchor();
-						TAel.setX509IssuerName(oldel.getX509IssuerName());
-						TAel.setX509SerialNumber(oldel.getX509SerialNumber());
-						TAel.setMode(oldel.getMode());
-						trustanchor.add(TAel);
-					}
-					dbchainingmodes.setTrustAnchor(trustanchor);
-				}
-			}
-		}
 		
 		IdentityLinkSigners idlsigners = dbauth.getIdentityLinkSigners();
 		if (idlsigners == null) {
@@ -525,43 +520,39 @@ public class EditGeneralConfigAction extends BasicAction {
 			forcon.setURL(moaconfig.getSzrgwURL());
 		}
 		
-		//TODO: Set STORK Config!!!
-		if (oldauth != null) {
-            ForeignIdentities oldforeign = oldauth.getForeignIdentities();
-			if (oldforeign != null) {
-				STORK oldstork = oldforeign.getSTORK();
-				if (oldstork == null)
-					oldstork = new STORK();
+            ForeignIdentities foreign = dbauth.getForeignIdentities();
+			if (foreign != null) {
+				STORK stork = foreign.getSTORK();
+				if (stork == null)
+					stork = new STORK();
 
                 try {
                 log.error("QAAAA " + storkconfig.getDefaultQaa());
-				oldstork.setQualityAuthenticationAssuranceLevel(storkconfig.getDefaultQaa());
+				stork.setQualityAuthenticationAssuranceLevel(storkconfig.getDefaultQaa());
 				
 				if (storkconfig.getAttributes() != null)
-					oldstork.setAttributes(storkconfig.getAttributes());
+					stork.setAttributes(storkconfig.getAttributes());
 				
 				else
-					oldstork.setAttributes((List<StorkAttribute>) (new ArrayList<StorkAttribute>()));
+					stork.setAttributes((List<StorkAttribute>) (new ArrayList<StorkAttribute>()));
 				
 				if (storkconfig.getCpepslist() != null)
-					oldstork.setCPEPS(storkconfig.getCpepslist());
-				
+
+					stork.setCPEPS(storkconfig.getCpepslist());
 				else
-					oldstork.setCPEPS((List<CPEPS>) (new ArrayList<CPEPS>()));
+					stork.setCPEPS((List<CPEPS>) (new ArrayList<CPEPS>()));
 				
-				dbforeign.setSTORK(oldstork);
                 } catch (Exception e) {
                     e.printStackTrace();
                 }
 
                 try{
-                   log.error("CPEPS LIST: " + storkconfig.getCpepslist().size() );
-                    log.error("CPEPS 1:" + storkconfig.getCpepslist().get(0).getCountryCode() +storkconfig.getCpepslist().get(0).getURL());
+                   log.info("CPEPS LIST: " + storkconfig.getCpepslist().size() );
+                    log.trace("CPEPS 1:" + storkconfig.getCpepslist().get(0).getCountryCode() +storkconfig.getCpepslist().get(0).getURL());
                 }   catch (Exception ex) {
-                    ex.printStackTrace();
+                    log.info("CPEPS LIST is null");
                 }
 			}
-		}
 
 		if (MiscUtil.isNotEmpty(moaconfig.getMandateURL())) {
 			OnlineMandates dbmandate = dbauth.getOnlineMandates();
@@ -604,7 +595,7 @@ public class EditGeneralConfigAction extends BasicAction {
 		}
 		moaauth.setTrustProfileID(moaconfig.getMoaspssAuthTrustProfile());
 			
-		moaauth.setVerifyTransformsInfoProfileID(moaconfig.getAuthTransformList());
+		moaauth.getVerifyTransformsInfoProfileID().set(0, moaconfig.getAuthTransformList().get(0));
 		
 		SecurityLayer seclayertrans = dbauth.getSecurityLayer();
 		if (seclayertrans == null) {
@@ -621,19 +612,6 @@ public class EditGeneralConfigAction extends BasicAction {
 				elem.setTransformation(moatrans.get(key));
 				trans.add(elem);
 			}
-		} else {
-			if (oldauth != null) {
-				SecurityLayer oldsectrans = oldauth.getSecurityLayer();
-				if (oldsectrans != null) {
-					List<TransformsInfoType> oldtranslist = oldsectrans.getTransformsInfo();
-					for (TransformsInfoType oldel : oldtranslist) {
-						TransformsInfoType elem = new TransformsInfoType();
-						elem.setFilename(oldel.getFilename());
-						elem.setTransformation(oldel.getTransformation());
-						trans.add(elem);
-					}	
-				}
-			}
 		}
 		if (trans.size() > 0)
 			seclayertrans.setTransformsInfo(trans);
@@ -660,9 +638,6 @@ public class EditGeneralConfigAction extends BasicAction {
 			
 			ConfigurationDBUtils.save(dbconfig);
 			
-			if (oldconfig != null)
-				ConfigurationDBUtils.delete(oldconfig);			
-			
 		} catch (MOADatabaseException e) {
 			log.warn("MOAID Configuration can not be stored in Database", e);
 			return LanguageHelper.getErrorString("error.db.oa.store", request);
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java
index 9509f9712..3d96cc1e5 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java
@@ -57,6 +57,9 @@ public class EditOAAction extends BasicOAAction {
 		OAAuthenticationData authOA = new OAAuthenticationData();
 		formList.put(authOA.getName(), authOA);
 
+		OABPKEncryption bPKEncDec = new OABPKEncryption();
+		formList.put(bPKEncDec.getName(), bPKEncDec);
+		
 		OASSOConfig ssoOA = new OASSOConfig();
 		formList.put(ssoOA.getName(), ssoOA);
 
@@ -472,4 +475,19 @@ public class EditOAAction extends BasicOAAction {
 		formList.put(formOA.getName(), formOA);
 	}
 
+	/**
+	 * @return the bPK encryption/decryption form
+	 */
+	public OABPKEncryption getBPKEncDecr() {
+		return (OABPKEncryption) formList.get(new OABPKEncryption().getName());
+	}
+
+	/**
+	 * @param bPK encryption/decryption form
+	 *            the bPK encryption/decryption form to set
+	 */
+	public void setBPKEncDecr(OABPKEncryption formOA) {
+		formList.put(formOA.getName(), formOA);
+	}
+	
 }
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/IndexAction.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/IndexAction.java
index 4762f1518..f4a3d0c75 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/IndexAction.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/IndexAction.java
@@ -215,12 +215,17 @@ public class IndexAction extends BasicAction {
 			if (dbuser.isIsMandateUser() != null)
 				ismandateuser = dbuser.isIsMandateUser();
 			
+			int sessionTimeOut = session.getMaxInactiveInterval();
+			Date sessionExpired = new Date(new Date().getTime() + 
+					(sessionTimeOut * Constants.ONE_MINUTE_IN_MILLIS));
+			
 			AuthenticatedUser authuser = new AuthenticatedUser(dbuser, 
 					true, 
 					ismandateuser,
 					false,
 					dbuser.getHjid()+"dbID",
-					"username/password");
+					"username/password",
+					sessionExpired);
 			
 			//store user as authenticated user
 			AuthenticationManager authManager = AuthenticationManager.getInstance();
@@ -390,6 +395,10 @@ public class IndexAction extends BasicAction {
 						
 						String bpkwbpk = nameID.getNameQualifier() + "+" + nameID.getValue();
 						
+						int sessionTimeOut = session.getMaxInactiveInterval();
+						Date sessionExpired = new Date(new Date().getTime() + 
+								(sessionTimeOut * Constants.ONE_MINUTE_IN_MILLIS));
+						
 						//search user
 						UserDatabase dbuser = ConfigurationDBRead.getUserWithUserBPKWBPK(bpkwbpk);
 						if (dbuser == null) {
@@ -434,7 +443,8 @@ public class IndexAction extends BasicAction {
 							//create AuthUser data element
 							authUser = AuthenticatedUser.generateUserRequestUser(user,
 									nameID.getValue(), 
-									nameID.getFormat());
+									nameID.getFormat(),
+									sessionExpired);
 							
 							//store user as authenticated user
 							AuthenticationManager authManager = AuthenticationManager.getInstance();
@@ -464,7 +474,8 @@ public class IndexAction extends BasicAction {
 											dbuser.isIsMandateUser(),
 											true,
 											nameID.getValue(),
-											nameID.getFormat());
+											nameID.getFormat(),
+											sessionExpired);
 									
 									//store user as authenticated user
 									AuthenticationManager authManager = AuthenticationManager.getInstance();
@@ -491,7 +502,8 @@ public class IndexAction extends BasicAction {
 									ismandateuser,
 									true,
 									nameID.getValue(),
-									nameID.getFormat());
+									nameID.getFormat(),
+									sessionExpired);
 							
 							//store user as authenticated user
 							AuthenticationManager authManager = AuthenticationManager.getInstance();
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/UserManagementAction.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/UserManagementAction.java
index 5799c88b2..8e0f0b7f8 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/UserManagementAction.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/UserManagementAction.java
@@ -449,7 +449,7 @@ public class UserManagementAction extends BasicAction {
 			
 		}
 		
-		String message = new String();
+		String message = LanguageHelper.getErrorString("error.mail.send", request);
 		
 		if (authUser != null) {
 			UserDatabase dbuser = ConfigurationDBRead.getUserWithID(authUser.getUserID());
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/utils/ConfigurationEncryptionUtils.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/utils/ConfigurationEncryptionUtils.java
new file mode 100644
index 000000000..08cd7c59d
--- /dev/null
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/utils/ConfigurationEncryptionUtils.java
@@ -0,0 +1,79 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.configuration.utils;
+
+import at.gv.egovernment.moa.id.auth.exception.DatabaseEncryptionException;
+import at.gv.egovernment.moa.id.configuration.config.ConfigurationProvider;
+import at.gv.egovernment.moa.id.util.AbstractEncrytionUtil;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+public class ConfigurationEncryptionUtils extends AbstractEncrytionUtil {
+
+	private static ConfigurationEncryptionUtils instance = null;	
+	private static String key = null;
+	
+	public static ConfigurationEncryptionUtils getInstance() {
+		if (instance == null) {
+			try {
+				key = ConfigurationProvider.getInstance().getConfigurationEncryptionKey();
+				instance =  new ConfigurationEncryptionUtils();
+								
+			} catch (Exception e) {
+				Logger.warn("MOAConfiguration encryption initialization FAILED.", e);
+				
+			}					
+		}
+		return instance;
+	}
+	
+	/**
+	 * @throws DatabaseEncryptionException
+	 */
+	public ConfigurationEncryptionUtils() throws DatabaseEncryptionException {
+		super();
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.util.AbstractEncrytionUtil#getSalt()
+	 */
+	@Override
+	protected String getSalt() {
+		return "Configuration-Salt";
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.util.AbstractEncrytionUtil#getKey()
+	 */
+	@Override
+	protected String getKey() {
+		return key;
+		
+	}
+
+}
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/utils/UserRequestCleaner.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/utils/UserRequestCleaner.java
index 9ec8db858..a75f8307d 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/utils/UserRequestCleaner.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/utils/UserRequestCleaner.java
@@ -31,6 +31,7 @@ import org.apache.log4j.Logger;
 import at.gv.egovernment.moa.id.commons.db.ConfigurationDBRead;
 import at.gv.egovernment.moa.id.commons.db.ConfigurationDBUtils;
 import at.gv.egovernment.moa.id.commons.db.dao.config.UserDatabase;
+import at.gv.egovernment.moa.id.configuration.auth.AuthenticationManager;
 import at.gv.egovernment.moa.id.configuration.config.ConfigurationProvider;
 import at.gv.egovernment.moa.id.configuration.exception.ConfigurationException;
 import at.gv.egovernment.moa.id.configuration.helper.DateTimeHelper;
@@ -40,13 +41,14 @@ public class UserRequestCleaner implements Runnable {
 
 	private static final Logger log = Logger.getLogger(UserRequestCleaner.class);
 	
-	private static final long SESSION_CLEANUP_INTERVAL = 60 * 60; // 60 min
+	private static final long SESSION_CLEANUP_INTERVAL = 5 * 60; // 5 min
 		
 	public void run() {
 		 while (true) {
 			 try {
 				ConfigurationProvider config = ConfigurationProvider.getInstance();
 				
+				//clean up user request storage
 				List<UserDatabase> userrequests = ConfigurationDBRead.getAllOpenUsersRequests();
 				if (userrequests != null) {
 					Calendar cal = Calendar.getInstance();
@@ -63,6 +65,9 @@ public class UserRequestCleaner implements Runnable {
 					
 					}					
 				}
+				
+				//clean up active user storage
+				AuthenticationManager.getInstance().removeAllUsersAfterTimeOut();
 
 				Thread.sleep(SESSION_CLEANUP_INTERVAL * 1000);
 				
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/moaconfig/StorkConfigValidator.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/moaconfig/StorkConfigValidator.java
index 8bc916e5a..f7d61653d 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/moaconfig/StorkConfigValidator.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/moaconfig/StorkConfigValidator.java
@@ -28,6 +28,10 @@ public class StorkConfigValidator {
 		
 		if (form.getCpepslist() != null) {
 			for(CPEPS current : form.getCpepslist()) {
+				// if an existing record got deleted
+				if(null == current)
+					continue;
+				
 				// check country code
 				String check = current.getCountryCode();
 				if (MiscUtil.isNotEmpty(check)) {
@@ -46,7 +50,7 @@ public class StorkConfigValidator {
 					errors.add(LanguageHelper.getErrorString("validation.stork.cpeps.empty",
 							new Object[] {check}, request ));
 				}
-	
+
 				// check url
 				check = current.getURL();
 				if (MiscUtil.isNotEmpty(check)) {
@@ -60,6 +64,15 @@ public class StorkConfigValidator {
 							new Object[] {check}, request ));
 				}
 			}
+
+			// ensure uniqueness of country code
+			for (CPEPS one : form.getCpepslist())
+				for (CPEPS another : form.getCpepslist())
+					if (null != one && null != another)
+						if (!one.equals(another) && one.getCountryCode().equals(another.getCountryCode())) {
+							errors.add(LanguageHelper.getErrorString("validation.stork.cpeps.duplicate", request));
+							break;
+						}
 		}
 
 		// check qaa