Features:

-- Add additional parameters to customize BKUSelectionForm and SendAssertionForm
-- change Target configuration
-- insert some logging

Bugfixes:
-- Nullpointerexceptions in combination of an old userdatabase entry and a actual configuration tool version

13 files changed, 419 insertions, 165 deletions

diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java
index 2705659cb..915ddf8ff 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java
@@ -46,5 +46,8 @@ public class Constants {
 	public static final String IDENIFICATIONTYPE_ZVR = "ZVR";
 	public static final String IDENIFICATIONTYPE_BASEID = "urn:publicid:gv.at:baseid+";
 	
+	public static final String IDENIFICATIONTYPE_BASEID_FN = IDENIFICATIONTYPE_BASEID + "X" + IDENIFICATIONTYPE_FN;
+	public static final String IDENIFICATIONTYPE_BASEID_ZVR = IDENIFICATIONTYPE_BASEID + "X" + IDENIFICATIONTYPE_ZVR;
+			
 	public static final String PREFIX_WPBK = "urn:publicid:gv.at:wbpk+";
 }
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/Authenticate.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/Authenticate.java
index ed496ae16..8b775f692 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/Authenticate.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/Authenticate.java
@@ -83,8 +83,8 @@ public class Authenticate extends HttpServlet {
 		try {
 			builder = factory.newDocumentBuilder();
 		} catch (ParserConfigurationException e) {
-			// TODO Auto-generated catch block
-			e.printStackTrace();
+			log.warn("PVP2 AuthenticationServlet can not be initialized.", e);
+			
 		}
 	}
 
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java
index f08632d83..39d276701 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java
@@ -100,7 +100,6 @@ public class ConfigurationProvider {
 			DefaultBootstrap.bootstrap();
 			log.info("OPENSAML initialized");
 
-			//TODO: start CleanUP Thread
 			UserRequestCleaner.start();
 			
 							
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OAGeneralConfig.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OAGeneralConfig.java
index 2b4ea53c1..90c02e0e4 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OAGeneralConfig.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OAGeneralConfig.java
@@ -5,10 +5,10 @@ import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Set;
 
 import at.gv.egovernment.moa.id.commons.db.ConfigurationDBRead;
 import at.gv.egovernment.moa.id.commons.db.dao.config.AuthComponentOA;
+import at.gv.egovernment.moa.id.commons.db.dao.config.BKUSelectionCustomizationType;
 import at.gv.egovernment.moa.id.commons.db.dao.config.BKUURLS;
 import at.gv.egovernment.moa.id.commons.db.dao.config.DefaultBKUs;
 import at.gv.egovernment.moa.id.commons.db.dao.config.IdentificationNumber;
@@ -63,6 +63,10 @@ public class OAGeneralConfig {
 		
 	private boolean isHideBPKAuthBlock = false;
 	
+	private boolean showMandateLoginButton = true;
+	private boolean onlyMandateAllowed = false;
+	private String bkuSelectionBackGroundColor = null;
+	
 	private Map<String, byte[]> transformations;
 	
 
@@ -98,16 +102,13 @@ public class OAGeneralConfig {
 		identifier = dbOAConfig.getPublicURLPrefix();
 		
 		String target_full = dbOAConfig.getTarget();
-		
 		if (MiscUtil.isNotEmpty(target_full)) {
-			String[] target_split = target_full.split("-");
-
 			if (TargetValidator.isValidTarget(target_full)) {
-				target = dbOAConfig.getTarget();
-				if (target_split.length > 1)
-					target_subsector = target_split[1];
-				
+				target = target_full;
+								
 			} else {
+				String[] target_split = target_full.split("-");
+				
 				if (TargetValidator.isValidTarget(target_split[0])) {
 					target = target_split[0];
 					if (target_split.length > 1)
@@ -196,6 +197,19 @@ public class OAGeneralConfig {
 						SLTemplates.add(el.getURL());
 					}
 				}
+				
+				BKUSelectionCustomizationType bkuselectioncustom = templates.getBKUSelectionCustomization();
+				if (bkuselectioncustom != null) {
+					
+					if (MiscUtil.isNotEmpty(bkuselectioncustom.getBackGroundColor()))
+						bkuSelectionBackGroundColor = bkuselectioncustom.getBackGroundColor();
+					
+					if (bkuselectioncustom.isMandateLoginButton() != null)
+						showMandateLoginButton = bkuselectioncustom.isMandateLoginButton();
+					
+					if (bkuselectioncustom.isOnlyMandateLoginAllowed() != null)
+						onlyMandateAllowed = bkuselectioncustom.isOnlyMandateLoginAllowed();
+				}
 			}
 		
 			if (SLTemplates != null && SLTemplates.size() > 0)
@@ -211,7 +225,6 @@ public class OAGeneralConfig {
 		
 		isHideBPKAuthBlock = dbOAConfig.isRemoveBPKFromAuthBlock();
 		
-		
 	}
 
 	public String getIdentifier() {
@@ -559,5 +572,54 @@ public class OAGeneralConfig {
 	public void setHideBPKAuthBlock(boolean isHideBPKAuthBlock) {
 		this.isHideBPKAuthBlock = isHideBPKAuthBlock;
 	}
+
+
+	/**
+	 * @return the showMandateLoginButton
+	 */
+	public boolean isShowMandateLoginButton() {
+		return showMandateLoginButton;
+	}
+
+
+	/**
+	 * @param showMandateLoginButton the showMandateLoginButton to set
+	 */
+	public void setShowMandateLoginButton(boolean showMandateLoginButton) {
+		this.showMandateLoginButton = showMandateLoginButton;
+	}
+
+
+	/**
+	 * @return the onlyMandateAllowed
+	 */
+	public boolean isOnlyMandateAllowed() {
+		return onlyMandateAllowed;
+	}
+
+
+	/**
+	 * @param onlyMandateAllowed the onlyMandateAllowed to set
+	 */
+	public void setOnlyMandateAllowed(boolean onlyMandateAllowed) {
+		this.onlyMandateAllowed = onlyMandateAllowed;
+	}
+
+
+	/**
+	 * @return the bkuSelectionBackGroundColor
+	 */
+	public String getBkuSelectionBackGroundColor() {
+		return bkuSelectionBackGroundColor;
+	}
+
+
+	/**
+	 * @param bkuSelectionBackGroundColor the bkuSelectionBackGroundColor to set
+	 */
+	public void setBkuSelectionBackGroundColor(String bkuSelectionBackGroundColor) {
+		this.bkuSelectionBackGroundColor = bkuSelectionBackGroundColor;
+	}
+	
 	
 }
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/filter/AuthenticationFilter.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/filter/AuthenticationFilter.java
index 9f81e1212..e7e1beb45 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/filter/AuthenticationFilter.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/filter/AuthenticationFilter.java
@@ -147,24 +147,14 @@ public class AuthenticationFilter implements Filter{
 	              }
 				
 			} else {
-				//check login Daten
-				
-				//loginPageForward = true;
-				
-				
 	            if (MiscUtil.isNotEmpty(getAuthenticatedPage())) {
 	                log.debug("Unable to find authentication data. Authenticated page is given so there is no need to save original request url. " + (loginPageForward ? "Forwarding" : "Redirecting") + " to login page \"" + loginPage + "\".");
 	                
-	                
-	                
 	            } 
 	            else {
 	            	log.debug("Unable to find authentication data. Storing request url and " + (loginPageForward ? "forwarding" : "redirecting") + " to login page \"" + loginPage + "\".");
-	                   // TODO: save HttpServletRequest
-	                   // log.debug("new CustomHttpServletRequest(request).toString() =
-	                   // {}", new
-	                   // CustomHttpServletRequest(httpServletRequest).toString());
 	                   session.setAttribute(STORED_REQUEST_URL_ID, requestURL);
+	                   
 	            }
 	            
 	            if (loginPageForward) {
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java
index e07a0ba77..1a8e0048b 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java
@@ -18,6 +18,7 @@ import org.apache.struts2.interceptor.ServletResponseAware;
 import at.gv.egovernment.moa.id.commons.db.ConfigurationDBRead;
 import at.gv.egovernment.moa.id.commons.db.ConfigurationDBUtils;
 import at.gv.egovernment.moa.id.commons.db.dao.config.AuthComponentOA;
+import at.gv.egovernment.moa.id.commons.db.dao.config.BKUSelectionCustomizationType;
 import at.gv.egovernment.moa.id.commons.db.dao.config.BKUURLS;
 import at.gv.egovernment.moa.id.commons.db.dao.config.IdentificationNumber;
 import at.gv.egovernment.moa.id.commons.db.dao.config.MOAIDConfiguration;
@@ -72,8 +73,13 @@ ServletResponseAware {
 	private boolean newOA;
 	private String formID;
 	
-	private String nextPage;
+	private boolean onlyBusinessService = false;
+	private boolean subTargetSet = false;
+	private boolean deaktivededBusinessService = false;
+	private boolean isMetaDataRefreshRequired = false;
 	
+	private String nextPage;
+
 	private OAGeneralConfig generalOA = new OAGeneralConfig();
 	private OAPVP2Config pvp2OA = new OAPVP2Config();
 	private OASAML1Config saml1OA = new OASAML1Config();
@@ -99,13 +105,15 @@ ServletResponseAware {
 			return Constants.STRUTS_ERROR;
 		}
 		oaid = Long.valueOf(oaidobj);
-			
+		
+		UserDatabase userdb = null;
 		OnlineApplication onlineapplication = null;;
+		
 		if (authUser.isAdmin())
 			onlineapplication = ConfigurationDBRead.getOnlineApplication(oaid);
 		
 		else {
-			UserDatabase userdb = ConfigurationDBRead.getUserWithID(authUser.getUserID());
+			userdb = ConfigurationDBRead.getUserWithID(authUser.getUserID());
 
 			if (!authUser.isAdmin() && userdb.isIsMailAddressVerified() != null
 					&& !userdb.isIsMailAddressVerified()) {
@@ -113,6 +121,8 @@ ServletResponseAware {
 				addActionError(LanguageHelper.getErrorString("error.editoa.mailverification"));
 			}
 			
+			
+			//TODO: change to direct Database operation
 			List<OnlineApplication> oas = userdb.getOnlineApplication();
 			for (OnlineApplication oa : oas) {
 				if (oa.getHjid() == oaid) {
@@ -129,6 +139,7 @@ ServletResponseAware {
 		generalOA.parse(onlineapplication);
 		ssoOA.parse(onlineapplication);
 		saml1OA.parse(onlineapplication);
+		
 		List<String> errors = pvp2OA.parse(onlineapplication);
 		
 		if (errors.size() > 0) {
@@ -136,8 +147,13 @@ ServletResponseAware {
 				addActionError(el);	
 		}
 		
+		subTargetSet = MiscUtil.isNotEmpty(generalOA.getTarget_subsector());
+		
+		//set UserSpezific OA Parameters
+		if (!authUser.isAdmin())
+			generateUserSpecificConfigurationOptions(userdb);
+		
 		ConfigurationDBUtils.closeSession();
-	
 		session.setAttribute(Constants.SESSION_OAID, oaid);
 		
 		formID = Random.nextRandom();
@@ -165,14 +181,18 @@ ServletResponseAware {
 		authUser = (AuthenticatedUser) authUserObj;
 	
 		UserDatabase userdb = ConfigurationDBRead.getUserWithID(authUser.getUserID());
+		
 		if (!authUser.isAdmin() && userdb.isIsMailAddressVerified() != null 
 				&& !userdb.isIsMailAddressVerified()) {
 			log.info("Online-Applikation managemant disabled. Mail address is not verified.");
 			addActionError(LanguageHelper.getErrorString("error.editoa.mailverification"));
 		}
+				
+		//set UserSpezific OA Parameters
+		if (!authUser.isAdmin())
+			generateUserSpecificConfigurationOptions(userdb);
 		
 		newOA = true;
-		
 		formID = Random.nextRandom();
 		session.setAttribute(Constants.SESSION_FORMID, formID);
 		
@@ -205,7 +225,8 @@ ServletResponseAware {
 		session.setAttribute(Constants.SESSION_FORMID, null);
 		
 		UserDatabase userdb = ConfigurationDBRead.getUserWithID(authUser.getUserID());
-		if (!authUser.isAdmin() && !userdb.isIsMailAddressVerified()) {
+		if (!authUser.isAdmin() && 
+				userdb.isIsMailAddressVerified() != null && !userdb.isIsMailAddressVerified()) {
 			log.info("Online-Applikation managemant disabled. Mail address is not verified.");
 			addActionError(LanguageHelper.getErrorString("error.editoa.mailverification"));
 			return Constants.STRUTS_SUCCESS;
@@ -265,7 +286,11 @@ ServletResponseAware {
 				}
 			}
 		}
-							
+		
+		//set UserSpezific OA Parameters
+		if (!authUser.isAdmin())
+			generateUserSpecificConfigurationOptions(userdb);
+		
 		//check form
 		OAGeneralConfigValidation validatior_general = new OAGeneralConfigValidation();
 		OAPVP2ConfigValidation validatior_pvp2 = new OAPVP2ConfigValidation();
@@ -279,6 +304,13 @@ ServletResponseAware {
 		errors.addAll(validatior_sso.validate(ssoOA, authUser.isAdmin()));
 		errors.addAll(validator_stork.validate(storkOA)); 
 		
+		//Do not allow SSO in combination with special BKUSelection features
+		if (ssoOA.isUseSSO() && 
+				( generalOA.isOnlyMandateAllowed() || !generalOA.isShowMandateLoginButton()) ) {
+			log.warn("Special BKUSelection features can not be used in combination with SSO");
+			errors.add(LanguageHelper.getErrorString("validation.general.bkuselection.specialfeatures.valid"));			
+		}
+		
 		if (errors.size() > 0) {
 			log.info("OAConfiguration with ID " + generalOA.getIdentifier() + " has some errors.");
 			for (String el : errors)
@@ -289,7 +321,7 @@ ServletResponseAware {
 			return Constants.STRUTS_ERROR_VALIDATION;
 			
 		} else {
-			
+						
 			boolean newentry = false;
 			
 			if (onlineapplication == null) {
@@ -300,7 +332,8 @@ ServletResponseAware {
 				if (!authUser.isAdmin()) {
 					onlineapplication.setIsAdminRequired(true);
 					
-				}
+				} else
+					isMetaDataRefreshRequired = true;
 					
 				
 			} else {
@@ -321,6 +354,7 @@ ServletResponseAware {
 										&& onlineapplication.isIsAdminRequired()) ) {
 				
 				onlineapplication.setIsAdminRequired(false);
+				isMetaDataRefreshRequired = true;
 				
 				if (onlineapplication.getHjid() != null)
 					userdb = ConfigurationDBRead.getUsersWithOADBID(onlineapplication.getHjid());
@@ -342,9 +376,10 @@ ServletResponseAware {
 			if (pvp2OA.getMetaDataURL() != null) {
 				
 				try {
-					if (newentry ||	!pvp2OA.getMetaDataURL()
-							.equals(onlineapplication.getAuthComponentOA().getOAPVP2().getMetadataURL())) {
+					if (isMetaDataRefreshRequired || !pvp2OA.getMetaDataURL().
+							equals(onlineapplication.getAuthComponentOA().getOAPVP2().getMetadataURL())) {
 					
+						log.debug("Set PVP2 Metadata refresh flag.");
 						MOAIDConfiguration moaconfig = ConfigurationDBRead.getMOAIDConfiguration();
 						moaconfig.setPvp2RefreshItem(new Date());
 						ConfigurationDBUtils.saveOrUpdate(moaconfig);
@@ -576,7 +611,8 @@ ServletResponseAware {
 		
 		dboa.setPublicURLPrefix(generalOA.getIdentifier());
 		
-		if (generalOA.isBusinessService()) {
+		if (generalOA.isBusinessService() || onlyBusinessService) {
+			
 			dboa.setType(Constants.MOA_CONFIG_BUSINESSSERVICE);
 			
 			String num = generalOA.getIdentificationNumber().replaceAll(" ", "");
@@ -609,37 +645,36 @@ ServletResponseAware {
 					dboa.setTargetFriendlyName(generalOA.getTargetFriendlyName());
 					
 				} else {
-					String target_full = generalOA.getTarget();
-					String[] target_split = target_full.split("-");
-					if (MiscUtil.isNotEmpty(generalOA.getTarget_subsector()))
-						dboa.setTarget(target_split[0] + "-" + generalOA.getTarget_subsector());
+					
+					String target = generalOA.getTarget();
+
+					if (MiscUtil.isNotEmpty(generalOA.getTarget_subsector()) && subTargetSet)
+						dboa.setTarget(target + "-" + generalOA.getTarget_subsector());
 					else
-						dboa.setTarget(target_full);
+						dboa.setTarget(target);
 					
-					String targetname = TargetValidator.getTargetFriendlyName(target_full);
+					String targetname = TargetValidator.getTargetFriendlyName(target);
 					if (MiscUtil.isNotEmpty(targetname))
 						dboa.setTargetFriendlyName(targetname);
-					else 
-						dboa.setTargetFriendlyName(TargetValidator.getTargetFriendlyName(target_split[0]));							
+					
 				}
 				
 			} else {
+				
 				if (MiscUtil.isNotEmpty(generalOA.getTarget())) {
-					String target_full = generalOA.getTarget();
-					String[] target_split = target_full.split("-");
-					dboa.setTarget(target_split[0] + "-" + generalOA.getTarget_subsector());
 					
-					if (MiscUtil.isNotEmpty(generalOA.getTarget_subsector()))
-						dboa.setTarget(target_split[0] + "-" + generalOA.getTarget_subsector());
+					String target = generalOA.getTarget();
+										
+					if (MiscUtil.isNotEmpty(generalOA.getTarget_subsector()) && subTargetSet)
+						dboa.setTarget(target + "-" + generalOA.getTarget_subsector());
 					
 					else
-						dboa.setTarget(target_full);
+						dboa.setTarget(target);
 					
-					String targetname = TargetValidator.getTargetFriendlyName(target_full);
+					String targetname = TargetValidator.getTargetFriendlyName(target);
 					if (MiscUtil.isNotEmpty(targetname))
 						dboa.setTargetFriendlyName(targetname);
-					else 
-						dboa.setTargetFriendlyName(TargetValidator.getTargetFriendlyName(target_split[0]));
+					
 				}
 			}			
 		}
@@ -693,6 +728,30 @@ ServletResponseAware {
 				if (template != null && template.size() > 0)
 					template.clear();
 			}
+			
+			
+			BKUSelectionCustomizationType bkuselectioncustom = templates.getBKUSelectionCustomization();
+			if (bkuselectioncustom == null) {
+				bkuselectioncustom = new BKUSelectionCustomizationType();
+				templates.setBKUSelectionCustomization(bkuselectioncustom);
+			}
+				
+			if (MiscUtil.isNotEmpty(generalOA.getBkuSelectionBackGroundColor())) {
+				String value;
+				if (!generalOA.getBkuSelectionBackGroundColor().startsWith("#"))
+					value = "#" + generalOA.getBkuSelectionBackGroundColor();
+				else
+					value = generalOA.getBkuSelectionBackGroundColor();
+				
+				bkuselectioncustom.setBackGroundColor(value);
+				
+			} else {
+				bkuselectioncustom.setBackGroundColor("");
+			}
+				
+			bkuselectioncustom.setMandateLoginButton(generalOA.isShowMandateLoginButton());
+			bkuselectioncustom.setOnlyMandateLoginAllowed(generalOA.isOnlyMandateAllowed());
+			
 		}
 				
 		//set default transformation if it is empty
@@ -784,6 +843,29 @@ ServletResponseAware {
 		return null;
 	}
 	
+	private void generateUserSpecificConfigurationOptions(UserDatabase userdb) {
+		
+		if (userdb.isIsMandateUser() != null && userdb.isIsMandateUser()) {
+			String bpk = userdb.getBpk();  
+			if (bpk.startsWith(Constants.IDENIFICATIONTYPE_BASEID_FN) ||
+					bpk.startsWith(Constants.IDENIFICATIONTYPE_BASEID_ZVR)) {
+				
+				onlyBusinessService = true;
+				generalOA.setBusinessService(true);
+				
+			}
+			
+			deaktivededBusinessService = true;
+			String[] split = bpk.split("\\+");
+			generalOA.setIdentificationType(split[1].substring(1));
+			generalOA.setIdentificationNumber(split[2]);
+			
+		}
+		
+		
+				
+	}
+	
 	public String setGeneralOAConfig() {
 		
 		return Constants.STRUTS_SUCCESS;
@@ -925,8 +1007,46 @@ ServletResponseAware {
 	public void setFormID(String formID) {
 		this.formID = formID;
 	}
-	
-	
-	
 
+	/**
+	 * @return the onlyBusinessService
+	 */
+	public boolean isOnlyBusinessService() {
+		return onlyBusinessService;
+	}
+
+	/**
+	 * @param onlyBusinessService the onlyBusinessService to set
+	 */
+	public void setOnlyBusinessService(boolean onlyBusinessService) {
+		this.onlyBusinessService = onlyBusinessService;
+	}
+
+	/**
+	 * @return the subTargetSet
+	 */
+	public boolean isSubTargetSet() {
+		return subTargetSet;
+	}
+
+	/**
+	 * @param subTargetSet the subTargetSet to set
+	 */
+	public void setSubTargetSet(boolean subTargetSet) {
+		this.subTargetSet = subTargetSet;
+	}
+
+	/**
+	 * @return the deaktivededBusinessService
+	 */
+	public boolean isDeaktivededBusinessService() {
+		return deaktivededBusinessService;
+	}
+
+	/**
+	 * @param deaktivededBusinessService the deaktivededBusinessService to set
+	 */
+	public void setDeaktivededBusinessService(boolean deaktivededBusinessService) {
+		this.deaktivededBusinessService = deaktivededBusinessService;
+	}
 }
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/IndexAction.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/IndexAction.java
index 5a88b1324..f07022394 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/IndexAction.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/IndexAction.java
@@ -379,6 +379,11 @@ public class IndexAction extends ActionSupport implements ServletRequestAware,
 								return Constants.STRUTS_ERROR;
 							}
 							
+							//TODO: maybe remove this default value in a later version 
+							boolean ismandateuser = false;
+							if (dbuser.isIsMandateUser() != null)
+								ismandateuser = dbuser.isIsMandateUser();
+							
 							authUser = new AuthenticatedUser(
 									dbuser.getHjid(), 
 									dbuser.getGivenname(), 
@@ -387,7 +392,7 @@ public class IndexAction extends ActionSupport implements ServletRequestAware,
 									dbuser.getUsername(), 
 									true, 
 									dbuser.isIsAdmin(),
-									dbuser.isIsMandateUser(),
+									ismandateuser,
 									true);
 							
 							Date date = DateTimeHelper.parseDateTime(dbuser.getLastLogin());
@@ -414,23 +419,24 @@ public class IndexAction extends ActionSupport implements ServletRequestAware,
 					}
 					
 					log.info("PVP2 Assertion was maybe not well formed, because no Assertion element could be found.");
-					addActionError(LanguageHelper.getErrorString("error.login"));
+					addActionError(LanguageHelper.getErrorString("error.login.internal"));
 					return Constants.STRUTS_ERROR;
 					
 				} else {
 					log.info("Receive Error Assertion.");
+					addActionError(LanguageHelper.getErrorString("error.login"));
 					return Constants.STRUTS_ERROR;
 				}
 				
 			} catch (Exception e) {
-				log.warn("Only http POST Requests can be used", e);
-				addActionError(LanguageHelper.getErrorString("error.login"));
+				log.warn("An internal error occurs.", e);
+				addActionError(LanguageHelper.getErrorString("error.login.internal"));
 				return Constants.STRUTS_ERROR;
 			}
 			
 		} else {
 			log.info("Only http POST Requests can be used");
-			addActionError(LanguageHelper.getErrorString("error.login"));
+			addActionError(LanguageHelper.getErrorString("error.login.internal"));
 			return Constants.STRUTS_ERROR;
 		}
 	}
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/TargetValidator.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/TargetValidator.java
index 65e8a549e..c30ee46b7 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/TargetValidator.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/TargetValidator.java
@@ -25,7 +25,7 @@ public class TargetValidator {
 		targetList.put("EF", "Ein- und Ausfuhr");
 		targetList.put("GH", "Gesundheit");
 		targetList.put("GS", "Gesellschaft und Soziales");
-		targetList.put("GS-RE", "Restitution");
+//		targetList.put("GS-RE", "Restitution");
 		targetList.put("JR", "Justiz/Zivilrechtswesen");
 		targetList.put("KL", "Kultus");
 		targetList.put("KU", "Kunst und Kultur");
@@ -35,8 +35,8 @@ public class TargetValidator {
 		targetList.put("SA", "Steuern und Abgaben");
 		targetList.put("SA", "Sport und Freizeit");
 		targetList.put("SO", "Sicherheit und Ordnung");
-		targetList.put("SO-VR", "Vereinsregister");
-		targetList.put("SR-RG", "Strafregister");
+//		targetList.put("SO-VR", "Vereinsregister");
+//		targetList.put("SR-RG", "Strafregister");
 		targetList.put("SV", "Sozialversicherung");
 		targetList.put("UW", "Umwelt");
 		targetList.put("VT", "Verkehr und Technik");
@@ -50,7 +50,7 @@ public class TargetValidator {
 		targetList.put("PV", "Personalverwaltung");
 		targetList.put("RD", "Zentraler Rechtsdienst");
 		targetList.put("VS", "Zentrale Durchführung von Verwaltungsstrafverfahren");
-		targetList.put("VS-RG", "Zentrales Verwaltungsstrafregister");
+//		targetList.put("VS-RG", "Zentrales Verwaltungsstrafregister");
 		targetList.put("ZU", "Zustellungen");
 	}
 	
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/ValidationHelper.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/ValidationHelper.java
index eadf15f84..17da83286 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/ValidationHelper.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/ValidationHelper.java
@@ -35,6 +35,9 @@ public class ValidationHelper {
 
 	private static final Logger log = Logger.getLogger(ValidationHelper.class);
 	
+	private static final String TEMPLATE_DATEFORMAT = "dd.MM.yyyy";
+	
+	
 	public static boolean isPublicServiceAllowed(String identifier) {
 		
 		SSLSocket socket = null;
@@ -216,7 +219,10 @@ public class ValidationHelper {
 	}
 	
 	public static boolean isDateFormat(String dateString) {
-		SimpleDateFormat sdf = new SimpleDateFormat("dd.MM.yyyy");
+		if (dateString.length() > TEMPLATE_DATEFORMAT.length())
+			return false;
+		
+		SimpleDateFormat sdf = new SimpleDateFormat(TEMPLATE_DATEFORMAT);
 		try {
 			sdf.parse(dateString);
 			return true;
@@ -300,4 +306,20 @@ public class ValidationHelper {
 		
 		return "; % \" ' ` < >";
 	}
+	
+	public static boolean isValidHexValue(String param) {
+		
+		try {
+			if (param.startsWith("#") && param.length() <= 7) {			
+				Long test = Long.decode(param);
+				return true;
+			}
+			
+		} catch (Exception e) {
+			
+		}
+		return false;
+		
+	}
+	
 }
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/oa/OAGeneralConfigValidation.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/oa/OAGeneralConfigValidation.java
index 99371a0e7..8ef7c44cf 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/oa/OAGeneralConfigValidation.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/oa/OAGeneralConfigValidation.java
@@ -6,11 +6,8 @@ import java.util.Map;
 
 import org.apache.log4j.Logger;
 
-import at.gv.egovernment.moa.id.commons.db.dao.config.MOAKeyBoxSelector;
 import at.gv.egovernment.moa.id.configuration.Constants;
-import at.gv.egovernment.moa.id.configuration.config.ConfigurationProvider;
 import at.gv.egovernment.moa.id.configuration.data.oa.OAGeneralConfig;
-import at.gv.egovernment.moa.id.configuration.exception.ConfigurationException;
 import at.gv.egovernment.moa.id.configuration.helper.LanguageHelper;
 import at.gv.egovernment.moa.id.configuration.validation.CompanyNumberValidator;
 import at.gv.egovernment.moa.id.configuration.validation.ValidationHelper;
@@ -35,6 +32,23 @@ public class OAGeneralConfigValidation {
 							new Object[] {ValidationHelper.getPotentialCSSCharacter(false)} ));
 				}
 			}
+			
+			check = form.getBkuSelectionBackGroundColor();
+			if (MiscUtil.isNotEmpty(check)) {
+				if (!check.startsWith("#"))
+					check = "#" + check;
+				
+				if (!ValidationHelper.isValidHexValue(check)) {
+					log.warn("BKUSelectionBackGroundColor is not a valid hex value " + check);
+					errors.add(LanguageHelper.getErrorString("validation.general.bkuselectioncolor.valid"));
+				}
+				
+			}
+			
+			if (form.isOnlyMandateAllowed() && !form.isShowMandateLoginButton()) {
+				log.warn("OnlyMandateAllowed in combination with hidden MandateLoginCheckbox is not possible.");
+				errors.add(LanguageHelper.getErrorString("validation.general.bkuselection.specialfeatures.combination"));
+			}
 		}
 		
 		//Check BKU URLs
diff --git a/id/ConfigWebTool/src/main/resources/applicationResources.properties b/id/ConfigWebTool/src/main/resources/applicationResources.properties
index eaa9b981a..5e337c7a5 100644
--- a/id/ConfigWebTool/src/main/resources/applicationResources.properties
+++ b/id/ConfigWebTool/src/main/resources/applicationResources.properties
@@ -22,7 +22,7 @@ errors.importexport.export.noconfig=Die Konfiguration kann nicht exportiert werd
 errors.edit.user.userid=Es wurde keine g\u00FCtige User ID \u00FCbergeben.
 errors.edit.user.save=Der Benutzer konnte nicht in die Datenbank eingetragen werden.
 errors.edit.user.notallowed=Das Bearbeiten fremder Benutzereinstellungen ist nur dem Admin erlaubt.
-error.login=Der Anmeldevorgang durch einen internen Fehler unterbrochen. Bitte Versuchen sie es noch einmal.
+error.login=Der Anmeldevorgang wurde abgebrochen. Bitte Versuchen sie es noch einmal.
 error.mail.send=An die angegebene Mailadresse konnte keine Nachticht versendet werden.
 error.mail.verification=Der Verifikationsvorgang wurde durch einen internen Fehler unterbrochen. Bitte Versuchen sie es noch einmal. 
 error.editoa.mailverification=Die Verwaltung von Online-Applikationen ist vor\u00FCbergehend deaktiviert, da die Mailadresse des Benutzeraccounts noch nicht verifiziert wurde.
@@ -172,6 +172,7 @@ webpages.oaconfig.general.target.friendlyname.disabled=Bezeichnung des Bereichs
 webpages.oaconfig.general.target.admin.disabled=Bereich (vom Administrator eingestellt)
 webpages.oaconfig.general.target=Bereich (Target)
 webpages.oaconfig.general.target.subsector=Sub-Bereich
+webpages.oaconfig.general.target.subsector.checkbox=Target verfeinern
 webpages.oaconfig.general.business.header=Privatwirtschaftlicher Bereich
 webpages.oaconfig.general.business.value=Identifikationsnummer
 webpages.oaconfig.general.business.type=Type der Identifikationsnummer
@@ -181,6 +182,9 @@ webpages.oaconfig.general.aditional.iframe=B\u00FCrgerkartenauswahl im IFrame
 webpages.oaconfig.general.aditional.useUTC=UTC Zeit verwenden
 webpages.oaconfig.general.aditional.calculateHPI="TODO!"
 webpages.oaconfig.general.isHideBPKAuthBlock=bPK/wbPK im AuthBlock ausblenden
+webpages.oaconfig.general.BKUSelection.isMandateLoginCheckboxVisible=Vollmachtenanmeldung anzeigen
+webpages.oaconfig.general.BKUSelection.isOnlyMandateLoginAllowed=Nur Vollmachtenanmeldung erlauben
+webpages.oaconfig.general.BKUSelection.backgroundcolor=Hintergrundfarbe der BKU-Auswahl
 
 webpages.oaconfig.menu.saml1.show=SAML1 Konfiguration einblenden
 webpages.oaconfig.menu.saml1.hidden=SAML1 Konfiguration ausblenden
@@ -299,6 +303,9 @@ validation.general.slrequest.filename.valid=Der Dateiname der angegebenen Securt
 validation.general.slrequest.file.valid=Die angegebenen SecurtityLayer Transformation konnte nicht geladen werden.
 
 validation.general.aditionalauthblocktext=Der Zusatztext f\u00FCr den AuthBlock enth\u00E4lt nicht erlaubte Zeichen. Folgende Zeichen sind nicht erlaubt\: {0}
+validation.general.bkuselectioncolor.valid=Die Hintergrundfarbe f\u00FCr die BKU Auswahl enth\u00E4lt keinen g\u00FCltigen Hexadezimalwert. (z.B. \#FFFFFF)
+validation.general.bkuselection.specialfeatures.valid=Die speziellen Einstellungen f\u00FCr die BKU Auswahl (Vollmachtsanmeldung ausblenden / zwingend voraussetzen) k\u00F6nnen nicht in Kombination mit SSO verwendet werden.
+validation.general.bkuselection.specialfeatures.combination=Eine zwingend erforderliche Vollmachtenanmeldung in Kombination mit einer ausgeblendeten Vollmachtenauswahlcheckbox ist nicht m\u00F6glich.
 validation.general.bku.handy.empty=Die URL f\u00FCr die Handy-BKU ist leer.
 validation.general.bku.handy.valid=Die URL f\u00FCr die Handy-BKU hat kein g\u00FCltiges Format.
 validation.general.bku.local.empty=Die URL f\u00FCr die lokale BKU ist leer.
diff --git a/id/ConfigWebTool/src/main/webapp/js/common.js b/id/ConfigWebTool/src/main/webapp/js/common.js
index 0b69854da..ce2e51863 100644
--- a/id/ConfigWebTool/src/main/webapp/js/common.js
+++ b/id/ConfigWebTool/src/main/webapp/js/common.js
@@ -78,6 +78,17 @@ function HideAdminTarget() {
 	$('#adminTarget').removeAttr("checked");
 	$('#admin_target_area').css('display', "none");
 }
+function oaTargetSubSector() {
+	if ($('#OAisTargetSubSector').attr('checked') == 'checked') {
+		
+		$('#wwgrp_OAtarget_subsector').css('display', "block");
+		
+	} else {
+		
+		$('#wwgrp_OAtarget_subsector').css('display', "none");
+		
+	}
+}
 function UseUserNamePassword() {
 	if ($('#isusernamepasswordallowed').size() == 0) {
 		$('#usernamepassword_area').css('display', "none");
@@ -122,5 +133,6 @@ function oaOnLoad() {
 	oaSSOService();
 	oaLegacyService();
 	AdminTarget();
+	oaTargetSubSector();
 	return true;
 }
\ No newline at end of file
diff --git a/id/ConfigWebTool/src/main/webapp/jsp/editOAGeneral.jsp b/id/ConfigWebTool/src/main/webapp/jsp/editOAGeneral.jsp
index 68d47d6b8..6bca21435 100644
--- a/id/ConfigWebTool/src/main/webapp/jsp/editOAGeneral.jsp
+++ b/id/ConfigWebTool/src/main/webapp/jsp/editOAGeneral.jsp
@@ -64,121 +64,119 @@
 							key="webpages.oaconfig.general.isbusinessservice"
 							cssClass="checkbox"
 							onclick="oaBusinessService();"
-							id="OAisbusinessservice">
+							id="OAisbusinessservice"
+							disabled="%{isOnlyBusinessService()}">
 						</s:checkbox>
 					</div>
 					
  					<div id="oa_config_businessservice" class="oa_config_block">
 						<h3><%=LanguageHelper.getGUIString("webpages.oaconfig.general.business.header", request) %></h3>
 						
-<%-- 						<s:select list="generalOA.identificationTypeList"
-											key="webpages.oaconfig.general.business.type"
-											labelposition="left"
-											cssClass="selectfield"
-											value="%{generalOA.identificationType}"
-											name="generalOA.identificationType">
-						</s:select> --%>
-						
 						<s:select list="generalOA.identificationTypeList"
 											key="webpages.oaconfig.general.business.value"
 											labelposition="left"
 											cssClass="selectfield"
 											value="%{generalOA.identificationType}"
-											name="generalOA.identificationType">
+											name="generalOA.identificationType"
+											disabled="%{isDeaktivededBusinessService()}">
 						</s:select>
 						
-<%-- 						<s:textfield name="generalOA.identificationNumber" 
-							value="%{generalOA.identificationNumber}" 
-							labelposition="left"
-							key="webpages.oaconfig.general.business.value"
-							cssClass="selectfield">
-						</s:textfield>		 --%>
-						
 						<s:textfield name="generalOA.identificationNumber" 
 							value="%{generalOA.identificationNumber}" 
-							cssClass="textfield_middle">
+							cssClass="textfield_middle"
+							disabled="%{isDeaktivededBusinessService()}">
 						</s:textfield>		
 					</div>
 					
-					<div id="oa_config_publicservice" class="oa_config_block">
-						<h3><%=LanguageHelper.getGUIString("webpages.oaconfig.general.public.header", request) %></h3>
-						
-						<s:if test="authUser.isAdmin()">
-							<s:select list="generalOA.targetList"
-												key="webpages.oaconfig.general.target"
-												labelposition="left"
-												cssClass="selectfield"
-												value="%{generalOA.target}"
-												name="generalOA.target"
-												onchange="HideAdminTarget();">
-							</s:select>						
-						</s:if>
-						<s:else>
-							<s:select list="generalOA.targetList"
-												key="webpages.oaconfig.general.target"
-												labelposition="left"
-												cssClass="selectfield"
-												value="%{generalOA.target}"
-												name="generalOA.target">
-							</s:select>
-						</s:else>
-						
-						<s:textfield name="generalOA.target_subsector" 
-							value="%{generalOA.target_subsector}" 
-							labelposition="left"
-							key="webpages.oaconfig.general.target.subsector"
-							cssClass="selectfield">
-						</s:textfield>
-						
-						
- 						<s:if test="authUser.isAdmin()">
- 							<s:checkbox
-	 							name="generalOA.AdminTarget" 
-								value="%{generalOA.AdminTarget}"
-								cssClass="checkbox"
- 								onclick="AdminTarget();"
- 								labelposition="left"
-								key="webpages.oaconfig.general.target.admin.checkbox"
-								id="adminTarget">
- 							</s:checkbox>
- 							
- 							<div id="admin_target_area">
-								<s:textfield name="generalOA.target_admin" 
-									value="%{generalOA.target_admin}" 
-									labelposition="left"
-									key="webpages.oaconfig.general.target.admin"
-									cssClass="textfield_short">
-								</s:textfield>
-								<s:textfield name="generalOA.targetFriendlyName" 
-									value="%{generalOA.targetFriendlyName}" 
-									labelposition="left"
-									key="webpages.oaconfig.general.target.friendlyname"
-									cssClass="textfield_long">
-								</s:textfield>
-							</div>
- 						</s:if>
- 						<s:else>
- 							<s:if test="generalOA.target_admin neq null">
- 								<s:textfield name="generalOA.target_admin" 
-									value="%{generalOA.target_admin}" 
-									labelposition="left"
-									key="webpages.oaconfig.general.target.admin.disabled"
-									cssClass="textfield_short"
-									disabled="true">
-								</s:textfield>
+					<s:if test="!isOnlyBusinessService()">
+						<div id="oa_config_publicservice" class="oa_config_block">
+							<h3><%=LanguageHelper.getGUIString("webpages.oaconfig.general.public.header", request) %></h3>
+							
+							<s:if test="authUser.isAdmin()">
+								<s:select list="generalOA.targetList"
+													key="webpages.oaconfig.general.target"
+													labelposition="left"
+													cssClass="selectfield"
+													value="%{generalOA.target}"
+													name="generalOA.target"
+													onchange="HideAdminTarget();">
+								</s:select>						
 							</s:if>
-<%-- 							<s:if test="generalOA.targetFriendlyName neq null">
-								<s:textfield name="generalOA.targetFriendlyName" 
-									value="%{generalOA.targetFriendlyName}" 
-									labelposition="left"
-									key="webpages.oaconfig.general.target.friendlyname.disabled"
-									cssClass="textfield_long">
-								</s:textfield>
-							</s:if> --%>
- 						</s:else>
-
-
-					</div>
+							<s:else>
+								<s:select list="generalOA.targetList"
+													key="webpages.oaconfig.general.target"
+													labelposition="left"
+													cssClass="selectfield"
+													value="%{generalOA.target}"
+													name="generalOA.target">
+								</s:select>
+							</s:else>
+							
+							<s:checkbox name="subTargetSet" 
+								value="%{subTargetSet}"
+								labelposition="left"
+								key="webpages.oaconfig.general.target.subsector.checkbox"
+								cssClass="checkbox"
+								onclick="oaTargetSubSector();"
+								id="OAisTargetSubSector">
+							</s:checkbox>
+							
+							<s:textfield name="generalOA.target_subsector" 
+								value="%{generalOA.target_subsector}" 
+								labelposition="left"
+								key="webpages.oaconfig.general.target.subsector"
+								cssClass="selectfield"
+								id="OAtarget_subsector">
+							</s:textfield>
+							
+							
+	 						<s:if test="authUser.isAdmin()">
+	 							<s:checkbox
+		 							name="generalOA.AdminTarget" 
+									value="%{generalOA.AdminTarget}"
+									cssClass="checkbox"
+	 								onclick="AdminTarget();"
+	 								labelposition="left"
+									key="webpages.oaconfig.general.target.admin.checkbox"
+									id="adminTarget">
+	 							</s:checkbox>
+	 							
+	 							<div id="admin_target_area">
+									<s:textfield name="generalOA.target_admin" 
+										value="%{generalOA.target_admin}" 
+										labelposition="left"
+										key="webpages.oaconfig.general.target.admin"
+										cssClass="textfield_short">
+									</s:textfield>
+									<s:textfield name="generalOA.targetFriendlyName" 
+										value="%{generalOA.targetFriendlyName}" 
+										labelposition="left"
+										key="webpages.oaconfig.general.target.friendlyname"
+										cssClass="textfield_long">
+									</s:textfield>
+								</div>
+	 						</s:if>
+	 						<s:else>
+	 							<s:if test="generalOA.target_admin neq null">
+	 								<s:textfield name="generalOA.target_admin" 
+										value="%{generalOA.target_admin}" 
+										labelposition="left"
+										key="webpages.oaconfig.general.target.admin.disabled"
+										cssClass="textfield_short"
+										disabled="true">
+									</s:textfield>
+								</s:if>
+	<%-- 							<s:if test="generalOA.targetFriendlyName neq null">
+									<s:textfield name="generalOA.targetFriendlyName" 
+										value="%{generalOA.targetFriendlyName}" 
+										labelposition="left"
+										key="webpages.oaconfig.general.target.friendlyname.disabled"
+										cssClass="textfield_long">
+									</s:textfield>
+								</s:if> --%>
+	 						</s:else>
+						</div>
+					</s:if>
 					
 					<s:if test="authUser.isAdmin()">
 						<div class="oa_config_block">
@@ -396,6 +394,27 @@
 								key="webpages.oaconfig.general.aditional.authblocktext"
 								cssClass="textfield_large">
 							</s:textarea>
+							
+							<s:textfield name="generalOA.bkuSelectionBackGroundColor" 
+								value="%{generalOA.bkuSelectionBackGroundColor}" 
+								labelposition="left"
+								key="webpages.oaconfig.general.BKUSelection.backgroundcolor"
+								cssClass="textfield_middle">
+							</s:textfield>
+							
+							<s:checkbox name="generalOA.showMandateLoginButton" 
+								value="%{generalOA.showMandateLoginButton}"
+								labelposition="left"
+								key="webpages.oaconfig.general.BKUSelection.isMandateLoginCheckboxVisible"
+								cssClass="checkbox">
+							</s:checkbox>
+						
+							<s:checkbox name="generalOA.onlyMandateAllowed" 
+								value="%{generalOA.onlyMandateAllowed}"
+								labelposition="left"
+								key="webpages.oaconfig.general.BKUSelection.isOnlyMandateLoginAllowed"
+								cssClass="checkbox">
+							</s:checkbox>
 						</s:if>
 							
 					</div>