MOA-IDSPSS Release 1.5.1.tags/1.5.1

git-svn-id: https://joinup.ec.europa.eu/svn/moa-idspss/tags/1.5.1@1271 d688527b-c9ab-4aba-bd8d-4036d912da1d

19 files changed, 3089 insertions, 0 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationAssertionBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationAssertionBuilder.java
new file mode 100644
index 000000000..bcad65eed
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationAssertionBuilder.java
@@ -0,0 +1,118 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import java.io.IOException;
+import java.text.MessageFormat;
+import java.util.Iterator;
+import java.util.List;
+
+import javax.xml.transform.TransformerException;
+
+import org.w3c.dom.Element;
+
+import at.gv.egovernment.moa.id.ParseException;
+import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttribute;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.DOMUtils;
+import at.gv.egovernment.moa.util.StringUtils;
+
+/**
+ * Base class for building authentication the AUTHBlock and final OA data SAML assertions.
+ * Encapsulates methods used by the two specific builders 
+ * {@link at.gv.egovernment.moa.id.auth.builder.AuthenticationBlockAssertionBuilder AuthenticationBlockAssertionBuilder}
+ * and
+ * {@link at.gv.egovernment.moa.id.auth.builder.AuthenticationDataAssertionBuilder AuthenticationDataAssertionBuilder}
+ * 
+ * @author Harald Bratko
+ */
+public class AuthenticationAssertionBuilder {
+  
+  /** the NewLine representation in Java*/
+  protected static String NL = "\n";
+  
+  protected static String SAML_ATTRIBUTE =
+  "   <saml:Attribute AttributeName=''{0}'' AttributeNamespace=''{1}''>" + NL +
+  "     <saml:AttributeValue>{2}</saml:AttributeValue>" + NL +
+  "   </saml:Attribute>"+ NL;
+  
+  protected static String SAML_ATTRIBUTE_NO_NAMESPACE =
+	  "   <saml:Attribute AttributeName=''{0}''>" + NL +
+	  "     <saml:AttributeValue>{1}</saml:AttributeValue>" + NL +
+	  "   </saml:Attribute>"+ NL;
+
+  /**
+   * Empty constructor
+   */
+  public AuthenticationAssertionBuilder() {
+  }
+  
+  /**
+   * Builds the SAML attributes to be appended to the AUTHBlock or to the SAML assertion 
+   * delivered to the online application.
+   * The method traverses through the list of given SAML attribute objects and builds an 
+   * XML structure (String representation) for each of the attributes. 
+   * 
+   * @param extendedSAMLAttributes The SAML attributes to be appended to the AUTHBlock or  
+   *                               to the SAML assertion delivered to the online application.
+   * @return                       A string representation including the XML structures of
+   *                               the SAML attributes.
+   *                               
+   * @throws ParseException        If an error occurs on serializing an SAML attribute.
+   */
+  protected String buildExtendedSAMLAttributes(List extendedSAMLAttributes) throws ParseException
+  {
+    StringBuffer sb = new StringBuffer();
+    if (extendedSAMLAttributes!=null) {
+      Iterator it = extendedSAMLAttributes.iterator();
+      while (it.hasNext()) {
+        ExtendedSAMLAttribute extendedSAMLAttribute = (ExtendedSAMLAttribute)it.next();
+        Object value = extendedSAMLAttribute.getValue();
+        String name = extendedSAMLAttribute.getName();
+        String namespace = extendedSAMLAttribute.getNameSpace();
+        if (value instanceof String) {
+          sb.append(MessageFormat.format( SAML_ATTRIBUTE, new Object[] {name, namespace, value}));
+        } else if (value instanceof Element) {
+          try {
+            String serializedValue = DOMUtils.serializeNode((Element)(value));
+            serializedValue = StringUtils.removeXMLDeclaration(serializedValue);
+            sb.append(MessageFormat.format( SAML_ATTRIBUTE, new Object[] {name, namespace, serializedValue}));
+          } catch (TransformerException e) {
+            Logger.error("Error on serializing SAML attribute \"" + name + 
+              " (namespace: \"" + namespace + "\".");
+            throw new ParseException("parser.05", new Object[] { name, namespace});
+          } catch (IOException e) {
+            Logger.error("Error on serializing SAML attribute \"" + name + 
+              " (namespace: \"" + namespace + "\".");
+            throw new ParseException("parser.05", new Object[] { name, namespace});
+          }
+        }
+      }
+    }
+   return sb.toString();
+  }
+  
+ 
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationBlockAssertionBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationBlockAssertionBuilder.java
new file mode 100644
index 000000000..53c1168c5
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationBlockAssertionBuilder.java
@@ -0,0 +1,424 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import java.io.StringWriter;
+import java.text.MessageFormat;
+import java.util.List;
+
+import javax.xml.transform.Result;
+import javax.xml.transform.Source;
+import javax.xml.transform.Transformer;
+import javax.xml.transform.TransformerConfigurationException;
+import javax.xml.transform.TransformerException;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.dom.DOMSource;
+import javax.xml.transform.stream.StreamResult;
+
+import org.w3c.dom.Element;
+import org.w3c.dom.Node;
+
+import at.gv.egovernment.moa.id.BuildException;
+import at.gv.egovernment.moa.id.ParseException;
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttribute;
+import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttributeImpl;
+import at.gv.egovernment.moa.id.config.ConfigurationException;
+import at.gv.egovernment.moa.id.config.TargetToSectorNameMapper;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
+import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.id.util.Random;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.Constants;
+import at.gv.egovernment.moa.util.DOMUtils;
+import at.gv.egovernment.moa.util.StringUtils;
+
+/**
+ * Builder for the authentication block <code>&lt;saml:Assertion&gt;</code>
+ * to be included in a <code>&lt;CreateXMLSignatureResponse&gt;</code>.
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class AuthenticationBlockAssertionBuilder extends AuthenticationAssertionBuilder implements Constants {
+
+  /** template for the Auth-Block */
+  private static String AUTH_BLOCK = 
+    "<saml:Assertion xmlns:saml=''" + SAML_NS_URI + "''{0} MajorVersion=''1'' MinorVersion=''0'' AssertionID=''any'' Issuer=''{1}'' IssueInstant=''{2}''>" + NL +
+    " <saml:AttributeStatement>" + NL +
+    "   <saml:Subject>" + NL +
+    "     <saml:NameIdentifier>{3}</saml:NameIdentifier>" + NL +
+    "   </saml:Subject>" + NL +
+    "{4}" + 
+    "   <saml:Attribute AttributeName=''OA'' AttributeNamespace=''" + MOA_NS_URI + "''>" + NL +
+    "     <saml:AttributeValue>{5}</saml:AttributeValue>" + NL +
+    "   </saml:Attribute>" + NL +
+    "   <saml:Attribute AttributeName=''Geburtsdatum'' AttributeNamespace=''" + MOA_NS_URI + "''>" + NL +
+    "     <saml:AttributeValue>{6}</saml:AttributeValue>" + NL +
+    "   </saml:Attribute>" + NL +
+    "{7}" +
+    " </saml:AttributeStatement>" + NL +
+    "</saml:Assertion>";
+  
+  private static String GESCHAEFTS_BEREICH_ATTRIBUTE =
+    "   <saml:Attribute AttributeName=''Geschaeftsbereich'' AttributeNamespace=''" + MOA_NS_URI + "''>" + NL +
+    "     <saml:AttributeValue>{0}</saml:AttributeValue>" + NL +
+    "   </saml:Attribute>" + NL;
+  
+  private static String WBPK_ATTRIBUTE =
+    "   <saml:Attribute AttributeName=''wbPK'' AttributeNamespace=''" + MOA_NS_URI + "''>" + NL +
+    "     <saml:AttributeValue>" + NL +
+    "       <pr:Identification>" + NL +
+    "         <pr:Value>{0}</pr:Value>" + NL +
+    "         <pr:Type>{1}</pr:Type>" + NL +
+    "       </pr:Identification>" + NL +
+    "     </saml:AttributeValue>" + NL +
+    "   </saml:Attribute>" + NL;
+  
+  
+  private static String PR_IDENTIFICATION_ATTRIBUTE =     
+       "       <pr:Identification xmlns:pr=\"" + PD_NS_URI + "\">" + NL +
+       "         <pr:Value>{0}</pr:Value>" + NL +
+       "         <pr:Type>{1}</pr:Type>" + NL +
+       "       </pr:Identification>" + NL;
+  
+  /**
+   * The number of SAML attributes included in this AUTH-Block (without the extended SAML attributes).
+   */
+  public static final int NUM_OF_SAML_ATTRIBUTES = 3;
+  
+  /**
+   * Constructor for AuthenticationBlockAssertionBuilder.
+   */
+  public AuthenticationBlockAssertionBuilder() {
+    super();
+  }
+  
+  /**
+   * Builds the authentication block <code>&lt;saml:Assertion&gt;</code> 
+   * 
+   * @param issuer authentication block issuer; <code>"GivenName FamilyName"</code>
+   * @param issueInstant current timestamp
+   * @param authURL URL of MOA-ID authentication component
+   * @param target "Gesch&auml;ftsbereich"; maybe <code>null</code> if the application
+   *               is a business application
+   * @param identityLinkValue the content of the <code>&lt;pr:Value&gt;</code>
+   *                          child element of the <code>&lt;pr:Identification&gt;</code>
+   *                          element derived from the Identitylink; this is the
+   *                          value of the <code>wbPK</code>;
+   *                          maybe <code>null</code> if the application is a public service
+   * @param identityLinkType  the content of the <code>&lt;pr:Type&gt;</code>
+   *                          child element of the <code>&lt;pr:Identification&gt;</code>
+   *                          element derived from the Identitylink; this includes the
+   *                          URN prefix and the identification number of the business
+   *                          application used as input for wbPK computation;
+   *                          maybe <code>null</code> if the application is a public service
+   * @param oaURL public URL of online application requested
+   * @param gebDat The date of birth from the identity link.
+   * @param extendedSAMLAttributes The SAML attributes to be appended to the AUTHBlock.
+   * 
+   * @return String representation of authentication block 
+   *          <code>&lt;saml:Assertion&gt;</code> built
+   *          
+   * @throws BuildException If an error occurs on serializing an extended SAML attribute 
+   *                        to be appended to the AUTH-Block.
+   */
+  public String buildAuthBlock(
+    String issuer, 
+    String issueInstant, 
+    String authURL, 
+    String target,
+    String targetFriendlyName,
+    String identityLinkValue, 
+    String identityLinkType,
+    String oaURL, 
+    String gebDat,
+    List extendedSAMLAttributes,
+    AuthenticationSession session)
+  throws BuildException
+  {
+    session.setSAMLAttributeGebeORwbpk(true);
+    String gebeORwbpk = "";
+    String wbpkNSDeclaration = "";
+    
+    //reading OA parameters
+    OAAuthParameter oaParam;
+   try {
+      oaParam = AuthConfigurationProvider.getInstance().getOnlineApplicationParameter(
+           session.getPublicOAURLPrefix());
+   } catch (ConfigurationException e) {
+      Logger.error("Error on building AUTH-Block: " + e.getMessage());
+         throw new BuildException("builder.00", new Object[] { "AUTH-Block", e.toString()});
+   }
+    
+    
+    if (target == null) {
+      // OA is a business application
+      if (!Constants.URN_PREFIX_HPI.equals(identityLinkType)) {
+        // Only add wbPKs to AUTH-Block. HPIs can be added to the AUTH-Block by the corresponding Validator
+         gebeORwbpk = MessageFormat.format(WBPK_ATTRIBUTE, new Object[] { identityLinkValue, identityLinkType });
+         wbpkNSDeclaration = " xmlns:pr=\"" + PD_NS_URI + "\"";
+         
+         //adding type of wbPK domain identifier        
+        ExtendedSAMLAttribute idLinkDomainIdentifierTypeAttribute = 
+             new ExtendedSAMLAttributeImpl("IdentityLinkDomainIdentifierType", oaParam.getIdentityLinkDomainIdentifierType(), Constants.MOA_NS_URI, ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY);
+            
+        extendedSAMLAttributes.add(idLinkDomainIdentifierTypeAttribute);
+         
+      } else {
+        // We do not have a wbPK, therefore no SAML-Attribute is provided
+        session.setSAMLAttributeGebeORwbpk(false);
+      }
+    } else {
+      // OA is a govermental application
+      String sectorName = TargetToSectorNameMapper.getSectorNameViaTarget(target);
+      if (StringUtils.isEmpty(sectorName)) {
+    	  if (targetFriendlyName != null)
+    		  sectorName = targetFriendlyName; 
+      }
+      
+        
+      //gebeORwbpk = MessageFormat.format(GESCHAEFTS_BEREICH_ATTRIBUTE, new Object[] { target });
+      gebeORwbpk = MessageFormat.format(GESCHAEFTS_BEREICH_ATTRIBUTE, new Object[] { target + " (" + sectorName + ")" });
+      
+      //no business service, adding bPK
+      
+      Element bpkSamlValueElement;
+      try {
+         bpkSamlValueElement = DOMUtils.parseDocument(MessageFormat.format(PR_IDENTIFICATION_ATTRIBUTE, new Object[] { identityLinkValue, Constants.URN_PREFIX_BPK }), false, null, null).getDocumentElement();
+      } catch (Exception e) {
+         Logger.error("Error on building AUTH-Block: " + e.getMessage());
+          throw new BuildException("builder.00", new Object[] { "AUTH-Block", e.toString()});
+      } 
+      
+//      String s = xmlToString(bpkSamlValueElement);
+//      System.out.println("bpkSamlValueElement: " + s);
+      
+      ExtendedSAMLAttribute bpkAttribute = 
+    	  new ExtendedSAMLAttributeImpl("bPK", bpkSamlValueElement, Constants.MOA_NS_URI, ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY);
+      extendedSAMLAttributes.add(bpkAttribute);
+    	  
+      boolean useMandate = session.getUseMandate();
+      if (useMandate) {
+    	  String mandateReferenceValue = Random.nextRandom();
+    	  // remove leading "-"
+    	  if (mandateReferenceValue.startsWith("-"))
+    		  mandateReferenceValue = mandateReferenceValue.substring(1);
+    		 
+    	  session.setMandateReferenceValue(mandateReferenceValue);
+    		 
+    	  ExtendedSAMLAttribute mandateReferenceValueAttribute = 
+    		  new ExtendedSAMLAttributeImpl("mandateReferenceValue", mandateReferenceValue, Constants.MOA_NS_URI, ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK);
+    	            
+    	  extendedSAMLAttributes.add(mandateReferenceValueAttribute);
+      }
+    	
+      
+
+     //gebeORwbpk = gebeORwbpk  + MessageFormat.format(BPK_ATTRIBUTE, new Object[] { identityLinkValue, identityLinkType });
+     wbpkNSDeclaration = " xmlns:pr=\"" + PD_NS_URI + "\"";
+    }
+    
+    //adding friendly name of OA    
+    String oaFriendlyName = StringUtils.isEmpty(oaParam.getFriendlyName()) ? "" : oaParam.getFriendlyName(); 
+    
+    ExtendedSAMLAttribute oaFriendlyNameAttribute = 
+         new ExtendedSAMLAttributeImpl("oaFriendlyName", oaFriendlyName, Constants.MOA_NS_URI, ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY);
+    
+    extendedSAMLAttributes.add(oaFriendlyNameAttribute);
+    
+    String assertion;
+    try {    	
+      assertion = MessageFormat.format(
+        AUTH_BLOCK, new Object[] { 
+          wbpkNSDeclaration, 
+          issuer, 
+          issueInstant, 
+          authURL, 
+          gebeORwbpk, 
+          oaURL, 
+          gebDat,
+          buildExtendedSAMLAttributes(extendedSAMLAttributes)});
+    } catch (ParseException e) {
+      Logger.error("Error on building AUTH-Block: " + e.getMessage());
+      throw new BuildException("builder.00", new Object[] { "AUTH-Block", e.toString()});
+    }
+    
+    return assertion;
+    
+  }
+  
+  /**
+   * Builds the authentication block <code>&lt;saml:Assertion&gt;</code> 
+   * 
+   * @param issuer authentication block issuer; <code>"GivenName FamilyName"</code>
+   * @param issueInstant current timestamp
+   * @param authURL URL of MOA-ID authentication component
+   * @param target "Gesch&auml;ftsbereich"; maybe <code>null</code> if the application
+   *               is a business application
+   * @param identityLinkValue the content of the <code>&lt;pr:Value&gt;</code>
+   *                          child element of the <code>&lt;pr:Identification&gt;</code>
+   *                          element derived from the Identitylink; this is the
+   *                          value of the <code>wbPK</code>;
+   *                          maybe <code>null</code> if the application is a public service
+   * @param identityLinkType  the content of the <code>&lt;pr:Type&gt;</code>
+   *                          child element of the <code>&lt;pr:Identification&gt;</code>
+   *                          element derived from the Identitylink; this includes the
+   *                          URN prefix and the identification number of the business
+   *                          application used as input for wbPK computation;
+   *                          maybe <code>null</code> if the application is a public service
+   * @param oaURL public URL of online application requested
+   * @param gebDat The date of birth from the identity link.
+   * @param extendedSAMLAttributes The SAML attributes to be appended to the AUTHBlock.
+   * 
+   * @return String representation of authentication block 
+   *          <code>&lt;saml:Assertion&gt;</code> built
+   *          
+   * @throws BuildException If an error occurs on serializing an extended SAML attribute 
+   *                        to be appended to the AUTH-Block.
+   */
+  public String buildAuthBlockForeignID(
+    String issuer, 
+    String issueInstant, 
+    String authURL, 
+    String target,
+    String identityLinkValue, 
+    String identityLinkType,
+    String oaURL, 
+    String gebDat,
+    List extendedSAMLAttributes,
+    AuthenticationSession session)
+  throws BuildException
+  {
+    session.setSAMLAttributeGebeORwbpk(true);
+    String gebeORwbpk = "";
+    String wbpkNSDeclaration = "";
+    
+    //BZ.., reading OA parameters
+    OAAuthParameter oaParam;
+   try {
+      oaParam = AuthConfigurationProvider.getInstance().getOnlineApplicationParameter(
+           session.getPublicOAURLPrefix());
+   } catch (ConfigurationException e) {
+      Logger.error("Error on building AUTH-Block: " + e.getMessage());
+         throw new BuildException("builder.00", new Object[] { "AUTH-Block", e.toString()});
+   }
+   //..BZ
+    
+    
+    if (target == null) {
+      // OA is a business application
+      if (!Constants.URN_PREFIX_HPI.equals(identityLinkType)) {
+        // Only add wbPKs to AUTH-Block. HPIs can be added to the AUTH-Block by the corresponding Validator
+         gebeORwbpk = MessageFormat.format(WBPK_ATTRIBUTE, new Object[] { identityLinkValue, identityLinkType });
+         wbpkNSDeclaration = " xmlns:pr=\"" + PD_NS_URI + "\"";
+         
+         //BZ.., adding type of wbPK domain identifier        
+        ExtendedSAMLAttribute idLinkDomainIdentifierTypeAttribute = 
+             new ExtendedSAMLAttributeImpl("IdentityLinkDomainIdentifierType", oaParam.getIdentityLinkDomainIdentifierType(), Constants.MOA_NS_URI, ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY);
+            
+        extendedSAMLAttributes.add(idLinkDomainIdentifierTypeAttribute);
+        //..BZ
+         
+      } else {
+        // We do not have a wbPK, therefore no SAML-Attribute is provided
+        session.setSAMLAttributeGebeORwbpk(false);
+      }
+    } else {
+      // OA is a govermental application
+      //BZ..
+      String sectorName = TargetToSectorNameMapper.getSectorNameViaTarget(target);      
+      //gebeORwbpk = MessageFormat.format(GESCHAEFTS_BEREICH_ATTRIBUTE, new Object[] { target });
+      gebeORwbpk = MessageFormat.format(GESCHAEFTS_BEREICH_ATTRIBUTE, new Object[] { target + " (" + sectorName + ")" });
+      //..BZ
+      
+      //BZ.., no business service, adding bPK
+      
+      Element bpkSamlValueElement;
+      try {
+         bpkSamlValueElement = DOMUtils.parseDocument(MessageFormat.format(PR_IDENTIFICATION_ATTRIBUTE, new Object[] { identityLinkValue, Constants.URN_PREFIX_BPK }), false, null, null).getDocumentElement();
+      } catch (Exception e) {
+         Logger.error("Error on building AUTH-Block: " + e.getMessage());
+          throw new BuildException("builder.00", new Object[] { "AUTH-Block", e.toString()});
+      } 
+            
+      ExtendedSAMLAttribute bpkAttribute = 
+          new ExtendedSAMLAttributeImpl("bPK", bpkSamlValueElement, Constants.MOA_NS_URI, ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY);
+         
+     extendedSAMLAttributes.add(bpkAttribute);
+      //gebeORwbpk = gebeORwbpk  + MessageFormat.format(BPK_ATTRIBUTE, new Object[] { identityLinkValue, identityLinkType });
+     wbpkNSDeclaration = " xmlns:pr=\"" + PD_NS_URI + "\"";
+     //..BZ     
+    }
+    
+    //BZ.., adding friendly name of OA    
+    String oaFriendlyName = StringUtils.isEmpty(oaParam.getFriendlyName()) ? "" : oaParam.getFriendlyName(); 
+    
+    ExtendedSAMLAttribute oaFriendlyNameAttribute = 
+         new ExtendedSAMLAttributeImpl("oaFriendlyName", oaFriendlyName, Constants.MOA_NS_URI, ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY);
+    
+    extendedSAMLAttributes.add(oaFriendlyNameAttribute);
+    //..BZ
+    
+    String assertion;
+    try {
+      assertion = MessageFormat.format(
+        AUTH_BLOCK, new Object[] { 
+          wbpkNSDeclaration, 
+          issuer, 
+          issueInstant, 
+          authURL, 
+          gebeORwbpk, 
+          oaURL, 
+          gebDat,
+          buildExtendedSAMLAttributes(extendedSAMLAttributes)});
+    } catch (ParseException e) {
+      Logger.error("Error on building AUTH-Block: " + e.getMessage());
+      throw new BuildException("builder.00", new Object[] { "AUTH-Block", e.toString()});
+    }
+    
+    return assertion;
+    
+  }
+  
+  
+  public static String xmlToString(Node node) {
+      try {
+          Source source = new DOMSource(node);
+          StringWriter stringWriter = new StringWriter();
+          Result result = new StreamResult(stringWriter);
+          TransformerFactory factory = TransformerFactory.newInstance();
+          Transformer transformer = factory.newTransformer();
+          transformer.transform(source, result);
+          return stringWriter.getBuffer().toString();
+      } catch (TransformerConfigurationException e) {
+          e.printStackTrace();
+      } catch (TransformerException e) {
+          e.printStackTrace();
+      }
+      return null;
+  }
+  
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataAssertionBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataAssertionBuilder.java
new file mode 100644
index 000000000..b9e44544d
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataAssertionBuilder.java
@@ -0,0 +1,310 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import java.text.MessageFormat;
+import java.util.List;
+
+import at.gv.egovernment.moa.id.BuildException;
+import at.gv.egovernment.moa.id.ParseException;
+import at.gv.egovernment.moa.id.data.AuthenticationData;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.Constants;
+import at.gv.egovernment.moa.util.StringUtils;
+
+/**
+ * Builder for the authentication data <code>&lt;saml:Assertion&gt;</code>
+ * to be provided by the MOA ID Auth component.
+ *
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class AuthenticationDataAssertionBuilder extends AuthenticationAssertionBuilder implements Constants {
+  /** private static String NL contains the NewLine representation in Java*/
+	private static final String NL = "\n";
+	/**
+	 * XML template for the <code>&lt;saml:Assertion&gt;</code> to be built
+	 */
+	private static final String AUTH_DATA =
+		"<?xml version=\"1.0\" encoding=\"UTF-8\" ?>" + NL +
+	  "<saml:Assertion xmlns:saml=''" + SAML_NS_URI + "'' xmlns:pr=''" + PD_NS_URI + "'' xmlns:xsi=''" + XSI_NS_URI + "''" +
+	  " xmlns:si=''" +  XSI_NS_URI + "''" +
+    " MajorVersion=''1'' MinorVersion=''0'' AssertionID=''{0}'' Issuer=''{1}'' IssueInstant=''{2}''>" + NL +
+	  "	<saml:AttributeStatement>" + NL + 
+	  "		<saml:Subject>" + NL +
+	  "			<saml:NameIdentifier NameQualifier=''{3}''>{4}</saml:NameIdentifier>" + NL +
+	  "     <saml:SubjectConfirmation>" + NL +
+	  "       <saml:ConfirmationMethod>" + MOA_NS_URI + "cm</saml:ConfirmationMethod>" + NL +
+	  "       <saml:SubjectConfirmationData>{5}{6}</saml:SubjectConfirmationData>" + NL +
+	  "     </saml:SubjectConfirmation>" + NL +
+	  "		</saml:Subject>" + NL +
+	  "		<saml:Attribute AttributeName=''PersonData'' AttributeNamespace=''" + PD_NS_URI + "''>" + NL +
+	  "			<saml:AttributeValue>{7}</saml:AttributeValue>" + NL +
+	  "		</saml:Attribute>" + NL +
+	  "		<saml:Attribute AttributeName=''isQualifiedCertificate'' AttributeNamespace=''" + MOA_NS_URI + "''>" + NL +
+	  "			<saml:AttributeValue>{8}</saml:AttributeValue>" + NL +
+	  "		</saml:Attribute>" + NL +
+      "   <saml:Attribute AttributeName=''bkuURL'' AttributeNamespace=''" + MOA_NS_URI + "''>" + NL +
+      "     <saml:AttributeValue>{9}</saml:AttributeValue>" + NL +
+      "   </saml:Attribute>" + NL +
+      "{10}" +      
+	  "{11}" + 
+      "{12}" +
+	  "	</saml:AttributeStatement>" + NL +
+	  "</saml:Assertion>";
+	
+	/**
+	 * XML template for the <code>&lt;saml:Assertion&gt;</code> to be built
+	 */
+	private static final String AUTH_DATA_MANDATE =
+		"<?xml version=\"1.0\" encoding=\"UTF-8\" ?>" + NL +
+	  "<saml:Assertion xmlns:saml=''" + SAML_NS_URI + "'' xmlns:pr=''" + PD_NS_URI + "'' xmlns:xsi=''" + XSI_NS_URI + "''" +
+	  " xmlns:si=''" +  XSI_NS_URI + "''" +
+    " MajorVersion=''1'' MinorVersion=''0'' AssertionID=''{0}'' Issuer=''{1}'' IssueInstant=''{2}''>" + NL +
+	  "	<saml:AttributeStatement>" + NL + 
+	  "		<saml:Subject>" + NL +
+	  "			<saml:NameIdentifier NameQualifier=''{3}''>{4}</saml:NameIdentifier>" + NL +
+	  "     <saml:SubjectConfirmation>" + NL +
+	  "       <saml:ConfirmationMethod>" + MOA_NS_URI + "cm</saml:ConfirmationMethod>" + NL +
+	  "       <saml:SubjectConfirmationData>{5}{6}</saml:SubjectConfirmationData>" + NL +
+	  "     </saml:SubjectConfirmation>" + NL +
+	  "		</saml:Subject>" + NL +
+	  "		<saml:Attribute AttributeName=''PersonData'' AttributeNamespace=''" + PD_NS_URI + "''>" + NL +
+	  "			<saml:AttributeValue>{7}</saml:AttributeValue>" + NL +
+	  "		</saml:Attribute>" + NL +
+	  "		<saml:Attribute AttributeName=''MandateData'' AttributeNamespace=''" + PD_NS_URI + "''>" + NL +
+	  "			<saml:AttributeValue>{8}</saml:AttributeValue>" + NL +
+	  "		</saml:Attribute>" + NL +
+	  "		<saml:Attribute AttributeName=''isQualifiedCertificate'' AttributeNamespace=''" + MOA_NS_URI + "''>" + NL +
+	  "			<saml:AttributeValue>{9}</saml:AttributeValue>" + NL +
+	  "		</saml:Attribute>" + NL +
+      "   <saml:Attribute AttributeName=''bkuURL'' AttributeNamespace=''" + MOA_NS_URI + "''>" + NL +
+      "     <saml:AttributeValue>{10}</saml:AttributeValue>" + NL +
+      "   </saml:Attribute>" + NL +
+      "{11}" +
+	  "{12}" + 
+      "{13}" +
+	  "	</saml:AttributeStatement>" + NL +
+	  "</saml:Assertion>";
+	/**
+	 * XML template for the <code>&lt;saml:Attribute&gt;</code> named <code>"isPublicAuthority"</code>,
+	 * to be inserted into the <code>&lt;saml:Assertion&gt;</code>
+	 */
+	private static final String PUBLIC_AUTHORITY_ATT = 
+	  "		<saml:Attribute AttributeName=''isPublicAuthority'' AttributeNamespace=''urn:oid:1.2.40.0.10.1.1.1''>" + NL +
+	  "			<saml:AttributeValue>{0}</saml:AttributeValue>" + NL +
+	  "		</saml:Attribute>" + NL;
+  
+    private static final String SIGNER_CERTIFICATE_ATT = 
+      "     <saml:Attribute AttributeName=''SignerCertificate'' AttributeNamespace=''" + MOA_NS_URI + "''>" + NL +
+      "         <saml:AttributeValue>{0}</saml:AttributeValue>" + NL +
+      "     </saml:Attribute>" + NL;
+	  
+  /**
+   * Constructor for AuthenticationDataAssertionBuilder.
+   */
+  public AuthenticationDataAssertionBuilder() {
+    super();
+  }
+
+  /**
+   * Builds the authentication data <code>&lt;saml:Assertion&gt;</code>.
+   * 
+   * @param authData the <code>AuthenticationData</code> to build the 
+   * 				 <code>&lt;saml:Assertion&gt;</code> from
+   * @param xmlPersonData <code>lt;pr:Person&gt;</code> element as a String
+   * @param xmlAuthBlock authentication block to be included in a 
+   * 				 <code>lt;saml:SubjectConfirmationData&gt;</code> element; may include
+   * 				 the <code>"Stammzahl"</code> or not; may be empty
+   * @param xmlIdentityLink the IdentityLink
+   * @param signerCertificateBase64 Base64 encoded certificate of the signer. Maybe
+   *         an empty string if the signer certificate should not be provided. 
+   *         Will be ignored if the <code>businessService</code> parameter is
+   *         set to <code>false</code>.
+   * @param businessService <code>true</code> if the online application is a
+   *                        business service, otherwise <code>false</code>
+   * @return the <code>&lt;saml:Assertion&gt;</code>
+   * @throws BuildException if an error occurs during the build process
+   */
+  public String build(
+  	AuthenticationData authData, 
+  	String xmlPersonData, 
+  	String xmlAuthBlock, 
+  	String xmlIdentityLink,
+    String bkuURL,
+    String signerCertificateBase64,
+    boolean businessService,
+    List extendedSAMLAttributes) 
+  throws BuildException 
+  {
+  		
+  	String isQualifiedCertificate = authData.isQualifiedCertificate() ? "true" : "false";
+  	String publicAuthorityAttribute = "";
+  	if (authData.isPublicAuthority()) {
+  		String publicAuthorityIdentification = authData.getPublicAuthorityCode();
+  		if (publicAuthorityIdentification == null)
+  			publicAuthorityIdentification = "True";
+  		publicAuthorityAttribute = MessageFormat.format(
+  			PUBLIC_AUTHORITY_ATT, new Object[] { publicAuthorityIdentification });
+  	}
+    
+    
+    String signerCertificateAttribute = "";
+    if (signerCertificateBase64 != "") {
+      signerCertificateAttribute = MessageFormat.format(
+        SIGNER_CERTIFICATE_ATT, new Object[] { signerCertificateBase64 });
+    } 
+    
+    String pkType;
+    String pkValue;
+    if (businessService) {
+      pkType = authData.getIdentificationType();
+      pkValue = authData.getWBPK();
+           
+    } else {
+      // <saml:NameIdentifier NameQualifier> always has the bPK as type/value
+      pkType = URN_PREFIX_BPK;
+      pkValue = authData.getBPK();
+    }
+    
+//    System.out.println("pkType; " + pkType);
+//    System.out.println("pkValue; " + pkValue);
+    
+  	String assertion;
+    try {
+    	
+   	
+      assertion = MessageFormat.format(AUTH_DATA, new Object[] {
+        authData.getAssertionID(), 
+        authData.getIssuer(), 
+        authData.getIssueInstant(), 
+        pkType,
+        pkValue, 
+        StringUtils.removeXMLDeclaration(xmlAuthBlock), 
+        StringUtils.removeXMLDeclaration(xmlIdentityLink), 
+        StringUtils.removeXMLDeclaration(xmlPersonData), 
+        isQualifiedCertificate,
+        bkuURL,
+        publicAuthorityAttribute,
+        signerCertificateAttribute,
+        buildExtendedSAMLAttributes(extendedSAMLAttributes)});
+    } catch (ParseException e) {
+      Logger.error("Error on building Authentication Data Assertion: " + e.getMessage());
+      throw new BuildException("builder.00", new Object[] { "Authentication Data Assertion", e.toString()});
+    } 
+    return assertion;
+  }
+  
+  /**
+   * Builds the authentication data <code>&lt;saml:Assertion&gt;</code>.
+   * 
+   * @param authData the <code>AuthenticationData</code> to build the 
+   * 				 <code>&lt;saml:Assertion&gt;</code> from
+   * @param xmlPersonData <code>lt;pr:Person&gt;</code> element as a String
+   * @param xmlAuthBlock authentication block to be included in a 
+   * 				 <code>lt;saml:SubjectConfirmationData&gt;</code> element; may include
+   * 				 the <code>"Stammzahl"</code> or not; may be empty
+   * @param xmlIdentityLink the IdentityLink
+   * @param signerCertificateBase64 Base64 encoded certificate of the signer. Maybe
+   *         an empty string if the signer certificate should not be provided. 
+   *         Will be ignored if the <code>businessService</code> parameter is
+   *         set to <code>false</code>.
+   * @param businessService <code>true</code> if the online application is a
+   *                        business service, otherwise <code>false</code>
+   * @return the <code>&lt;saml:Assertion&gt;</code>
+   * @throws BuildException if an error occurs during the build process
+   */
+  public String buildMandate(
+  	AuthenticationData authData, 
+  	String xmlPersonData, 
+  	String xmlMandateData,
+  	String xmlAuthBlock, 
+  	String xmlIdentityLink,
+    String bkuURL,
+    String signerCertificateBase64,
+    boolean businessService,
+    String sourceID,
+    List extendedSAMLAttributes) 
+  throws BuildException 
+  {
+  		
+  	String isQualifiedCertificate = authData.isQualifiedCertificate() ? "true" : "false";
+  	String publicAuthorityAttribute = "";
+  	if (authData.isPublicAuthority()) {
+  		String publicAuthorityIdentification = authData.getPublicAuthorityCode();
+  		if (publicAuthorityIdentification == null)
+  			publicAuthorityIdentification = "True";
+  		publicAuthorityAttribute = MessageFormat.format(
+  			PUBLIC_AUTHORITY_ATT, new Object[] { publicAuthorityIdentification });
+  	}
+    
+    
+    String signerCertificateAttribute = "";
+    if (signerCertificateBase64 != "") {
+      signerCertificateAttribute = MessageFormat.format(
+        SIGNER_CERTIFICATE_ATT, new Object[] { signerCertificateBase64 });
+    } 
+    
+    String pkType;
+    String pkValue;
+    if (businessService) {
+      pkType = authData.getIdentificationType();
+      pkValue = authData.getWBPK();
+           
+    } else {
+      // <saml:NameIdentifier NameQualifier> always has the bPK as type/value
+      pkType = URN_PREFIX_BPK;
+      pkValue = authData.getBPK();
+    }
+    
+//    System.out.println("pkType; " + pkType);
+//    System.out.println("pkValue; " + pkValue);
+    
+  	String assertion;
+    try {
+    	
+      assertion = MessageFormat.format(AUTH_DATA_MANDATE, new Object[] {
+        authData.getAssertionID(), 
+        authData.getIssuer(), 
+        authData.getIssueInstant(), 
+        pkType,
+        pkValue, 
+        StringUtils.removeXMLDeclaration(xmlAuthBlock), 
+        StringUtils.removeXMLDeclaration(xmlIdentityLink), 
+        StringUtils.removeXMLDeclaration(xmlPersonData),
+        StringUtils.removeXMLDeclaration(xmlMandateData),
+        isQualifiedCertificate,
+        bkuURL,
+        publicAuthorityAttribute,
+        signerCertificateAttribute,
+        buildExtendedSAMLAttributes(extendedSAMLAttributes)});
+    } catch (ParseException e) {
+      Logger.error("Error on building Authentication Data Assertion: " + e.getMessage());
+      throw new BuildException("builder.00", new Object[] { "Authentication Data Assertion", e.toString()});
+    } 
+    return assertion;
+  }
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java
new file mode 100644
index 000000000..b6ba5871d
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java
@@ -0,0 +1,103 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import java.security.MessageDigest;
+
+import at.gv.egovernment.moa.id.BuildException;
+import at.gv.egovernment.moa.util.Base64Utils;
+import at.gv.egovernment.moa.util.Constants;
+
+/**
+ * Builder for the bPK, as defined in
+ * <code>&quot;Ableitung f&uml;r die bereichsspezifische Personenkennzeichnung&quot;</code>
+ * version <code>1.0.1</code> from <code>&quot;reference.e-government.gv.at&quot;</code>.
+ *  
+ * @author Paul Schamberger
+ * @version $Id$
+ */
+public class BPKBuilder {
+
+  /**
+   * Builds the bPK from the given parameters. 
+   * @param identificationValue Base64 encoded "Stammzahl" 
+   * @param target "Bereich lt. Verordnung des BKA"
+   * @return bPK in a BASE64 encoding
+   * @throws BuildException if an error occurs on building the bPK
+   */
+  public String buildBPK(String identificationValue, String target) 
+    throws BuildException {
+    
+    if ((identificationValue == null || 
+         identificationValue.length() == 0 ||
+    		 target == null || 
+         target.length() == 0)) 
+    {
+      throw new BuildException("builder.00", 
+      		                     new Object[] {"BPK", "Unvollständige Parameterangaben: identificationValue=" + 
+                                             identificationValue + ",target=" + target});
+    }
+    String basisbegriff = identificationValue + "+" + Constants.URN_PREFIX_CDID + "+" + target;
+    try {
+      MessageDigest md = MessageDigest.getInstance("SHA-1");
+      byte[] hash = md.digest(basisbegriff.getBytes("ISO-8859-1"));
+      String hashBase64 = Base64Utils.encode(hash);
+      return hashBase64;
+    } catch (Exception ex) {
+      throw new BuildException("builder.00", new Object[] {"bPK", ex.toString()}, ex);
+    }
+  }
+
+  /**
+   * Builds the wbPK from the given parameters. 
+   * @param identificationValue Base64 encoded "Stammzahl" 
+   * @param registerAndOrdNr type of register + "+" + number in register.
+   * @return wbPK in a BASE64 encoding
+   * @throws BuildException if an error occurs on building the wbPK
+   */
+  public String buildWBPK(String identificationValue, String registerAndOrdNr) 
+    throws BuildException {
+    
+    if ((identificationValue == null || 
+         identificationValue.length() == 0 ||
+         registerAndOrdNr == null || 
+         registerAndOrdNr.length() == 0)) 
+    {
+      throw new BuildException("builder.00", 
+          new Object[] {"wbPK", "Unvollständige Parameterangaben: identificationValue=" + 
+                        identificationValue + ",Register+Registernummer=" + registerAndOrdNr});
+    }
+    String basisbegriff = identificationValue + "+" + Constants.URN_PREFIX_WBPK + "+" + registerAndOrdNr;
+    try {
+      MessageDigest md = MessageDigest.getInstance("SHA-1");
+      byte[] hash = md.digest(basisbegriff.getBytes("ISO-8859-1"));
+      String hashBase64 = Base64Utils.encode(hash);
+      return hashBase64;
+    } catch (Exception ex) {
+      throw new BuildException("builder.00", new Object[] {"wbPK", ex.toString()}, ex);
+    }
+  }
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/Builder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/Builder.java
new file mode 100644
index 000000000..5757c398e
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/Builder.java
@@ -0,0 +1,83 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import at.gv.egovernment.moa.id.BuildException;
+import at.gv.egovernment.moa.util.StringUtils;
+
+/**
+ * Base class for HTML/XML builders providing commonly useful functions.
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class Builder {
+  
+  /**
+   * Replaces a given number of occurences of a special tag in an XML or HTML template by a value.
+   * @param template html template
+   * @param tag special tag
+   * @param value value replacing the tag
+   * @param expected specifies if the tag is expected to present; if <code>true</code> and the tag
+   *                 is not present, an exception is thrown; if <code>false</code> and the tag is
+   *                 not present, the original string is returned
+   * @param maxreplacements Set -1 to replace each occurence of tag, or limit replacements by a given positive number  
+   * @return XML or HTML code, the tag replaced
+   * @throws BuildException when template does not contain the tag
+   */
+  protected String replaceTag(
+    String template, 
+    String tag, 
+    String value, 
+    boolean expected, 
+    int maxreplacements) 
+  throws BuildException 
+  {
+    String result = template;
+    int index = result.indexOf(tag);
+    if (index < 0) {
+      if (expected) {
+    	// Substring not found but should
+        throw new BuildException(
+                "builder.01", 
+                new Object[] {"&lt;" + tag.substring(1, tag.length() - 1) + "&gt;"});
+      }
+    } else {
+       // replace each occurence
+       if (maxreplacements == -1) {
+         return StringUtils.replaceAll(template, tag, value);       
+       } else {
+         int found = 1;
+         while (index > -1 && (found <= maxreplacements)) {
+           result = result.substring(0, index) + value + result.substring(index + tag.length());
+           index = result.indexOf(tag);
+           if (index > -1) found += 1;
+         }
+       }
+    }
+    return result;
+  }
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CertInfoVerifyXMLSignatureRequestBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CertInfoVerifyXMLSignatureRequestBuilder.java
new file mode 100644
index 000000000..7528bc2e8
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CertInfoVerifyXMLSignatureRequestBuilder.java
@@ -0,0 +1,108 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import java.io.IOException;
+import java.text.MessageFormat;
+
+import at.gv.egovernment.moa.id.BuildException;
+import at.gv.egovernment.moa.util.Constants;
+import at.gv.egovernment.moa.util.FileUtils;
+
+/**
+ * Builder for the <code>&lt;VerifyXMLSignatureRequest&gt;</code> structure
+ * used for presenting certificate information in the secure viewer of the security layer implementation.
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class CertInfoVerifyXMLSignatureRequestBuilder extends Builder implements Constants {
+  
+  /** special tag in the VerifyXMLRequest template to be substituted for a <code>&lt;dsig:Signature&gt;</code> */
+  private static final String SIGNATURE_TAG = "<dsig:Signature/>";
+  
+  /** private static String nl contains the NewLine representation in Java*/
+  private static final String nl = "\n";
+
+  /**
+   * XML template for the CertInfoVerifyXMLSignatureRequest to be built
+   */ 
+  static final String CERTINFO_REQUEST =
+    "<?xml version=\"1.0\" encoding=\"UTF-8\"?>" + nl +                                                                  
+    "<{0}:VerifyXMLSignatureRequest {2} xmlns:dsig=\"" + DSIG_NS_URI +  "\">" + nl +
+    "  <{0}:SignatureInfo>" + nl +
+    "    <{0}:SignatureEnvironment>" + nl +
+    "      <{1}:XMLContent xml:space=\"preserve\"><dsig:Signature/></{1}:XMLContent>" + nl +
+    "    </{0}:SignatureEnvironment>" + nl +
+    "    <{0}:SignatureLocation>//dsig:Signature</{0}:SignatureLocation>" + nl +
+    "  </{0}:SignatureInfo>" + nl +
+    "</{0}:VerifyXMLSignatureRequest>";
+
+  /**
+   * Constructor
+   */
+  public CertInfoVerifyXMLSignatureRequestBuilder() {
+    super();
+  }
+  /**
+   * Builds the <code>&lt;VerifyXMLSignatureRequest&gt;</code> structure.
+   * @return the XML structure
+   * @throws BuildException
+   */
+  public String build(boolean slVersion12) throws BuildException {
+    
+    String sl10Prefix;
+    String sl11Prefix;
+    String slNsDeclaration;
+        
+    if (slVersion12) {
+            
+      sl10Prefix = SL12_PREFIX;
+      sl11Prefix = SL12_PREFIX;
+      slNsDeclaration = "xmlns:" + SL12_PREFIX + "=\"" + SL12_NS_URI + "\"";
+      
+    } else {
+      
+      sl10Prefix = SL10_PREFIX;
+      sl11Prefix = SL11_PREFIX;
+      slNsDeclaration = "xmlns:" + sl11Prefix + "=\"" + SL11_NS_URI + "\" xmlns:" + sl10Prefix + "=\"" + SL10_NS_URI + "\"";
+      
+    }
+    
+    String certInfoRequest = MessageFormat.format(CERTINFO_REQUEST, new Object[] {sl11Prefix, sl10Prefix, slNsDeclaration});
+    String resDsigSignature = "resources/xmldata/CertInfoDsigSignature.xml";
+    
+    
+    try {
+      String dsigSignature = FileUtils.readResource(resDsigSignature, "UTF-8");
+      certInfoRequest = replaceTag(certInfoRequest, SIGNATURE_TAG, dsigSignature, true, 1);
+      return certInfoRequest;
+    }
+    catch (IOException ex) {
+      throw new BuildException("auth.04", new Object[] {resDsigSignature, ex.toString()});
+    }
+  }
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java
new file mode 100644
index 000000000..9c696f245
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java
@@ -0,0 +1,279 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import java.text.MessageFormat;
+import java.util.Calendar;
+
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.config.TargetToSectorNameMapper;
+import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.util.Constants;
+import at.gv.egovernment.moa.util.DateTimeUtils;
+import at.gv.egovernment.moa.util.StringUtils;
+
+/**
+ * Builder for the <code>&lt;CreateXMLSignatureRequest&gt;</code> structure
+ * used for requesting a signature under the authentication block from the 
+ * security layer implementation.
+ *
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class CreateXMLSignatureRequestBuilder implements Constants {
+  /** private static String nl contains the NewLine representation in Java*/
+  private static final String nl = "\n";
+    /**
+   * XML template for the <code>&lt;moa:CreateXMLSignatureRequest&gt;</code> to be built
+   */     
+	private static final String CREATE_XML_SIGNATURE_REQUEST = 
+    "<?xml version=\"1.0\" encoding=\"UTF-8\" ?>" + nl +
+    "<{3}:CreateXMLSignatureRequest xmlns:dsig=''" + DSIG_NS_URI + "'' {5}>" + nl +
+    " <{3}:KeyboxIdentifier>{1}</{3}:KeyboxIdentifier>" + nl +
+    " <{3}:DataObjectInfo Structure=''detached''>" + nl +
+    "  <{4}:DataObject Reference=''''/>" + nl +
+    "{2}" +
+    " </{3}:DataObjectInfo>" + nl +
+    " <{3}:SignatureInfo>" + nl +
+    "  <{3}:SignatureEnvironment>" + nl +
+    "   <{4}:XMLContent>{0}</{4}:XMLContent>" + nl +
+    "  </{3}:SignatureEnvironment>" + nl +
+    "  <{3}:SignatureLocation xmlns:saml=''" + SAML_NS_URI + "'' Index=''2''>/saml:Assertion</{3}:SignatureLocation>" + nl +
+    " </{3}:SignatureInfo>" + nl +
+    "</{3}:CreateXMLSignatureRequest>";
+  
+
+  /**
+   * Constructor for CreateXMLSignatureRequestBuilder.
+   */
+  public CreateXMLSignatureRequestBuilder() {
+    super();
+  }
+
+	/**
+	 * Builds the <code>&lt;CreateXMLSignatureRequest&gt;</code>.
+	 * 
+	 * @param authBlock String representation of XML authentication block
+	 * @param keyBoxIdentifier the key box identifier which will be used (e.g. CertifiedKeypair)
+   * @param slVersion12 specifies whether the Security Layer version number is 1.2 or not
+	 * @return String representation of <code>&lt;CreateXMLSignatureRequest&gt;</code>
+	 */
+	public String build(String authBlock, String keyBoxIdentifier, String[] dsigTransformInfos, boolean slVersion12) {
+		
+    String sl10Prefix;
+    String sl11Prefix;
+    String slNsDeclaration;
+    
+    String dsigTransformInfosString = "";
+		for (int i = 0; i < dsigTransformInfos.length; i++) {
+      dsigTransformInfosString += dsigTransformInfos[i];
+    }
+    
+    if (slVersion12) {
+      
+      // replace the SecurityLayer namespace prefixes and URIs within the transforms
+      dsigTransformInfosString = StringUtils.changeSLVersion(dsigTransformInfosString,
+                                                             SL10_PREFIX, SL12_PREFIX,
+                                                             SL10_NS_URI, SL12_NS_URI);
+      sl10Prefix = SL12_PREFIX;
+      sl11Prefix = SL12_PREFIX;
+      slNsDeclaration = "xmlns:" + SL12_PREFIX + "='" + SL12_NS_URI + "'";
+      
+    } else {
+      
+      sl10Prefix = SL10_PREFIX;
+      sl11Prefix = SL11_PREFIX;
+      slNsDeclaration = "xmlns:" + sl10Prefix + "='" + SL10_NS_URI + "' xmlns:" + sl11Prefix + "='" + SL11_NS_URI + "'";
+      
+    }
+      
+		String request = MessageFormat.format(
+			CREATE_XML_SIGNATURE_REQUEST, new Object[] { authBlock, 
+                                                   keyBoxIdentifier, 
+                                                   dsigTransformInfosString, 
+                                                   sl11Prefix, 
+                                                   sl10Prefix, 
+                                                   slNsDeclaration });
+    
+		return request;
+	}
+	
+	/**
+	 * Builds the <code>&lt;CreateXMLSignatureRequest&gt;</code> for a foreign ID.
+	 * 
+	 * @param subject the subject of the foreign certificate
+	 * @param oaParam parameter for the OA
+	 * @param session current session
+	 * @return String representation of <code>&lt;CreateXMLSignatureRequest&gt;</code>
+	 */
+	public String buildForeignID(String subject, OAAuthParameter oaParam, AuthenticationSession session) {
+
+		String target = session.getTarget();		
+		String sectorName = TargetToSectorNameMapper.getSectorNameViaTarget(target);
+		
+		Calendar cal = Calendar.getInstance();
+		String date = DateTimeUtils.buildDate(cal);
+		String time = DateTimeUtils.buildTime(cal);
+		
+		String request = "";
+		request += "<sl:CreateXMLSignatureRequest xmlns:sl=\"http://www.buergerkarte.at/namespaces/securitylayer/1.2#\">"; 
+		request += "<sl:KeyboxIdentifier>SecureSignatureKeypair</sl:KeyboxIdentifier>";
+		request += "<sl:DataObjectInfo Structure=\"enveloping\">"; 
+		request += "<sl:DataObject>";
+		request += "<sl:XMLContent>";
+		
+		request += "<html xmlns=\"http://www.w3.org/1999/xhtml\">";
+		request += "<head>";
+		request += "<title>Signatur der Anmeldedaten</title>";
+		request += "<style type=\"text/css\" media=\"screen\">";
+		request += ".normalstyle { font-size: medium; }"; 
+		request += ".italicstyle { font-size: medium; font-style: italic; }";
+		request += ".titlestyle{ text-decoration:underline; font-weight:bold; font-family: Verdana;  font-size: medium; }"; 
+		request += ".h4style{ font-size: large; font-family: Verdana; }";
+		request += "</style>";
+		
+//		request += "<style type=\"text/css\" media=\"screen\">.boldstyle { font-weight: bold; } .italicstyle { font-style: italic; } .annotationstyle { font-size: small; } .graybground {background-color: #E0E0E0;}";
+//		request += ".titlestyle{ text-decoration:underline; font-weight:bold; font-family: Verdana;  font-size: x-small; }"; 
+//		request += ".h4style{ font-family: Verdana; }";
+//		request += "table.parameters { font-size: x-small; }";                                                                        
+//		request += "</style>";
+		request += "</head>";
+		request += "<body>";
+		request += "<h4 class=\"h4style\">Anmeldedaten für (Requesting Application Access for):</h4>";
+		request += "<p class=\"titlestyle\">Persönliche Daten (Personal Data)</p>";
+		request += "<table class=\"parameters\">";
+		request += "<tr>";
+		request += "<td class=\"italicstyle\">Name:</td>";
+		request += "<td class=\"normalstyle\">";
+		request += subject;
+		request += "</td>";
+		request += "</tr>";
+		request += "</table>";
+		request += "<p class=\"titlestyle\">Daten zur Anwendung (Application Data)</p>";
+		request += "<table class=\"parameters\">";
+		request += "<tr>";
+		request += "<td class=\"italicstyle\">Dienst (Service):</td>";
+		request += "<td class=\"normalstyle\">";
+		// friendlyname from OA
+		request += StringUtils.isEmpty(oaParam.getFriendlyName()) ? "" : oaParam.getFriendlyName();
+		request += "</td>";
+		request += "</tr>";
+		request += "<tr>";
+		request += "<td class=\"italicstyle\">Land (Country):</td>";
+		request += "<td class=\"normalstyle\">Österreich (Austria)</td>";
+		request += "</tr>";
+		request += "</table>";
+		request += "<p class=\"titlestyle\">Technische Parameter (Technical Parameters)</p>";
+		request += "<table class=\"parameters\">";
+		request += "<tr>";
+		request += "<td class=\"italicstyle\">URL:</td>";
+		request += "<td class=\"normalstyle\">";
+		//public URL prefix from OA
+		request += oaParam.getPublicURLPrefix();
+		request += "</td>";
+		request += "</tr>";
+		boolean business = oaParam.getBusinessService();
+		if (business) {
+			// OA is businessservice
+			String identifierType = oaParam.getIdentityLinkDomainIdentifierType();
+			String identifier = oaParam.getIdentityLinkDomainIdentifier();
+			request += "<tr>";
+			request += "<td class=\"italicstyle\">";
+			request += identifierType + ":";
+			request += "</td>";
+			request += "<td class=\"normalstyle\">";
+			request += identifier;
+			request += "</td>";
+			request += "</tr>";			
+		}
+		else {
+			// OA is publicservice
+			request += "<tr>";
+			request += "<td class=\"italicstyle\">";
+			request += "Sektor (Sector):</td>";
+			request += "<td class=\"normalstyle\">";
+			request += target + " (" + sectorName + ")";
+			request += "</td>";
+			request += "</tr>";
+
+		}
+		
+		request += "<tr>";
+		request += "<td class=\"italicstyle\">Datum (Date):</td>";
+		request += "<td class=\"normalstyle\">";   
+		request += date;
+		request += "</td>";
+		request += "</tr>";
+		request += "<tr>";
+		request += "<td class=\"italicstyle\">Zeit (Time):</td>";
+		request += "<td class=\"normalstyle\">";
+		request += time;
+		request += "</td>";
+		request += "</tr>";
+		request += "</table>";
+		
+		request += "<p class=\"normalstyle\">Mit der Anmeldung erfolgt eine Abfrage des Ergänzungsregister für " +  
+					"natürliche Personen (ERnP), damit ich meinen elektronischen " +  
+					"Identitätsnachweis (meine elektronische Identitätskarte) unmittelbar " +  
+					"als Österreichische Bürgerkarte verwenden kann. Ich bin nicht im " +  
+					"Zentralen Melderegister eingetragen und stimme, sofern ich nicht im " +  
+					"ERnP eingetragen bin, einer Eintragung ins ERnP zu. Ich nehme zur " + 
+					"Kenntnis, dass die Eintragung ins ERnP ausschließlich der Aufzeichnung " +  
+					"jener Daten, die für die eindeutige Identität notwendig sind, dient.</p>";
+
+		request += "<p class=\"normalstyle\">I affirm that I am not registered with the Austrian Central " + 
+					"Register of Residents or the Supplementary Register for Natural Persons. I therefore " + 
+					"apply for registration in the Supplementary Register for Natural Persons in order to use " +
+					"my electronic identity (my electronic ID card) as an Austrian citizen card. I take note " + 
+					"that registration in the Supplementary Register for Natural Persons solely serves keeping " + 
+					"records of those data that are used for validation of unique identity and that those data " +  
+					"is only used for e-government purposes.</p>";
+		
+		
+//		request += "<p class=\"normalstyle\">I hereby request to access this e-government application by using my " +
+//			"domestic electronic identity. <br/>" +
+//			"I further affirm that I am not yet registered with the Austrian Central " + 
+//			"Residents Registry and that I am not obliged to register with the Austrian " + 
+//			"Central Residents Registry according to Austrian law.<br/>" + 
+//			"In the event I am not yet registered with the Supplementary Register, I " + 
+//			"explicitly grant to do so according to §6 (5) E-Government Act (EGovG, idF: " +
+//			"BGBl. I Nr.  7/2008 und BGBl. I Nr. 59/2008).</p>";
+		
+		request += "</body>";
+		request += "</html>";
+
+		request += "</sl:XMLContent>";		
+		request += "</sl:DataObject>";
+		request += "<sl:TransformsInfo>";
+		request += "<sl:FinalDataMetaInfo>";
+		request += "<sl:MimeType>application/xhtml+xml</sl:MimeType>";
+		request += "</sl:FinalDataMetaInfo>";
+		request += "</sl:TransformsInfo>";
+		request += "</sl:DataObjectInfo>";
+		request += "</sl:CreateXMLSignatureRequest>";
+				
+		return request;
+	}
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilderForeign.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilderForeign.java
new file mode 100644
index 000000000..6368713db
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilderForeign.java
@@ -0,0 +1,150 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;

+

+import java.io.IOException;

+import java.io.StringReader;

+import java.io.StringWriter;

+

+import at.gv.egovernment.moa.id.BuildException;

+

+

+/**

+ * Builder for CreateXMLSignatureRequest to sign data from a foreign 

+ * eID card.

+ *  

+ */

+

+public class CreateXMLSignatureRequestBuilderForeign extends Builder {

+

+  /** special tag in the XML template to be substituted for the KeyboxIdentifier */

+  private static final String KEYBOXID_TAG = "<KEYBOXID>";

+  /** special tag in the XML template to be substituted for the content */

+  private static final String XMLCONTENT_TAG = "<XMLContent>";

+  /** private static int all contains the representation to replace all tags*/

+  private static final int ALL = -1;

+

+  /** default HTML template */

+  private static final String DEFAULT_XML_TEMPLATE = 

+	  "<?xml version=\"1.0\" encoding=\"UTF-8\"?>" + 

+	  "<sl:CreateXMLSignatureRequest xmlns:sl=\"http://www.buergerkarte.at/namespaces/securitylayer/1.2#\">" + 

+	  "<sl:KeyboxIdentifier>" + KEYBOXID_TAG + "</sl:KeyboxIdentifier>" + 

+	  "<sl:DataObjectInfo Structure=\"enveloping\">" + 

+	  "<sl:DataObject>" +

+	  "<sl:XMLContent>" + XMLCONTENT_TAG + "</sl:XMLContent>" +

+	  "</sl:DataObject>" + 

+	  "<sl:TransformsInfo>" + 

+	  "<sl:FinalDataMetaInfo>" + 

+	  "<sl:MimeType>text/plain</sl:MimeType>" + 

+	  "</sl:FinalDataMetaInfo>" + 

+	  "</sl:TransformsInfo>" + 

+	  "</sl:DataObjectInfo>" +

+	  "</sl:CreateXMLSignatureRequest>";

+  

+  /** default HTML template */

+  private static final String DEFAULT_XHTML_TEMPLATE = 

+	  "<?xml version=\"1.0\" encoding=\"UTF-8\"?>" + 

+	  "<sl:CreateXMLSignatureRequest xmlns:sl=\"http://www.buergerkarte.at/namespaces/securitylayer/1.2#\">" + 

+	  "<sl:KeyboxIdentifier>" + KEYBOXID_TAG + "</sl:KeyboxIdentifier>" + 

+	  "<sl:DataObjectInfo Structure=\"enveloping\">" + 

+	  "<sl:DataObject>" +

+	  "<sl:XMLContent>" + XMLCONTENT_TAG + "</sl:XMLContent>" +

+	  "</sl:DataObject>" + 

+	  "<sl:TransformsInfo>" + 

+	  "<sl:FinalDataMetaInfo>" + 

+	  "<sl:MimeType>application/xhtml+xml</sl:MimeType>" + 

+	  "</sl:FinalDataMetaInfo>" + 

+	  "</sl:TransformsInfo>" + 

+	  "</sl:DataObjectInfo>" +

+	  "</sl:CreateXMLSignatureRequest>";

+	  

+  /**

+   * Constructor for CreateXMLSignatureRequestBuilderForeign.

+   */

+  public CreateXMLSignatureRequestBuilderForeign() {

+    super();

+  }

+  /**

+   * Builds the XML request.

+   * 

+   * @param xmlRequest XML Request to be sent as a parameter in the form

+   * @param bkuURL URL of the "B&uuml;rgerkartenumgebung" the form will be submitted to;

+   *         may be <code>null</code>, in this case the default URL will be used

+   * @param dataURL DataURL to be sent as a parameter in the form

+   */

+  public String build(

+    String keyboxIdentifier, 

+    String xmlContent)

+  throws BuildException 

+  {      

+  	String xmlRequest = DEFAULT_XHTML_TEMPLATE;

+  	xmlRequest = replaceTag(xmlRequest, KEYBOXID_TAG, keyboxIdentifier, true, ALL);

+    //htmlForm = replaceTag(htmlForm, XMLREQUEST_TAG, encodeParameter(xmlRequest), true, ALL);

+    xmlRequest = replaceTag(xmlRequest, XMLCONTENT_TAG, xmlContent, true, ALL);

+  	return xmlRequest;

+  }

+  /**

+   * Encodes a string for inclusion as a parameter in the form.

+   * Double quotes are substituted by <code>"&amp;quot;"</code>.

+   * @param s the string to be encoded

+   * @return the string encoded

+   * @throws BuildException on any exception encountered

+   */

+  public static String encodeParameter(String s) throws BuildException {

+    StringReader in = new StringReader(s);

+    StringWriter out = new StringWriter();

+    try {

+      for (int ch = in.read(); ch >= 0; ch = in.read()) {

+        if (ch == '"')

+          out.write("&quot;");

+        else if (ch == '<')

+          out.write("&lt;");

+        else if (ch == '>')

+          out.write("&gt;");

+        else if (ch == 'ä')

+          out.write("&auml;");

+        else if (ch == 'ö')

+          out.write("&ouml;");

+        else if (ch == 'ü')

+          out.write("&uuml;");

+        else if (ch == 'Ä')

+          out.write("&Auml;");

+        else if (ch == 'Ö')

+          out.write("&Ouml;");

+        else if (ch == 'Ü')

+          out.write("&Uuml;");

+        else if (ch == 'ß')

+          out.write("&szlig;");

+        else

+          out.write(ch);

+      }

+    }

+    catch (IOException ex) {

+      throw new BuildException("builder.00", new Object[] {"GetIdentityLinkForm", ex.toString()});

+    }

+    return out.toString();

+  }

+

+}

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/DataURLBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/DataURLBuilder.java
new file mode 100644
index 000000000..4dd6ac78b
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/DataURLBuilder.java
@@ -0,0 +1,107 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import at.gv.egovernment.moa.id.auth.servlet.AuthServlet;
+import at.gv.egovernment.moa.id.config.ConfigurationException;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
+import at.gv.egovernment.moa.id.util.MOAIDMessageProvider;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * Builds a DataURL parameter meant for the security layer implementation
+ * to respond to.
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class DataURLBuilder {
+	
+  /**
+   * Constructor for DataURLBuilder.
+   */
+  public DataURLBuilder() {
+    super();
+  }
+
+  /**
+   * Constructs a data URL for <code>VerifyIdentityLink</code> or <code>VerifyAuthenticationBlock</code>, 
+   * including the <code>MOASessionID</code> as a parameter.
+   * 
+   * @param authBaseURL base URL (context path) of the MOA ID Authentication component,
+   * 				 including a trailing <code>'/'</code>
+   * @param authServletName request part of the data URL
+   * @param sessionID sessionID to be included in the dataURL
+   * @return String
+   */
+  public String buildDataURL(String authBaseURL, String authServletName, String sessionID) {
+
+		String individualDataURLPrefix = null;
+		String dataURL;
+		try {      
+      //check if an individual prefix is configured
+      individualDataURLPrefix = AuthConfigurationProvider.getInstance().
+      	getGenericConfigurationParameter(AuthConfigurationProvider.INDIVIDUAL_DATA_URL_PREFIX);
+			
+			if (null != individualDataURLPrefix) {
+				
+				//check individualDataURLPrefix
+				if(!individualDataURLPrefix.startsWith("http"))
+					throw(new ConfigurationException("config.13", new Object[] { individualDataURLPrefix}));
+
+				//when ok then use it
+				dataURL = individualDataURLPrefix + authServletName;
+			} else 
+				dataURL = authBaseURL + authServletName;
+			    	
+    } catch (ConfigurationException e) {
+      Logger.warn(e);
+      Logger.warn(MOAIDMessageProvider.getInstance().getMessage("config.12", new Object[] { authBaseURL } ));
+			dataURL = authBaseURL + authServletName;
+    }
+
+    dataURL = addParameter(dataURL, AuthServlet.PARAM_SESSIONID, sessionID);
+  	return dataURL;
+  }
+
+  /**
+   * Method addParameter.
+   * @param urlString represents the url 
+   * @param paramname is the parameter to be added
+   * @param value is the value of that parameter
+   * @return String
+   */
+  private String addParameter(String urlString, String paramname, String value) {
+    String url = urlString;
+    if (paramname != null) {
+      if (url.indexOf("?") < 0)
+        url += "?";
+      else
+        url += "&";
+      url += paramname + "=" + value;
+    }
+    return url;
+  }
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetIdentityLinkFormBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetIdentityLinkFormBuilder.java
new file mode 100644
index 000000000..d40cd1909
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetIdentityLinkFormBuilder.java
@@ -0,0 +1,181 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import java.io.IOException;
+import java.io.StringReader;
+import java.io.StringWriter;
+
+import at.gv.egovernment.moa.id.BuildException;
+
+/**
+ * Builder for HTML form requesting the security layer implementation
+ * to get the identity link from smartcard by a <code>&lt;InfoboxReadRequest&gt;</code>.
+ *  
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class GetIdentityLinkFormBuilder extends Builder {
+ /** private static String NL contains the NewLine representation in Java*/
+  private static final String nl = "\n";
+  /** special tag in the HTML template to be substituted for the BKU URL */
+  private static final String BKU_TAG = "<BKU>";
+  /** special tag in the HTML template to be substituted for the XML request */
+  private static final String XMLREQUEST_TAG = "<XMLRequest>";
+  /** special tag in the HTML template to be substituted for the data URL */
+  private static final String DATAURL_TAG = "<DataURL>";
+  /** special tag in the HTML template to be substituted for certificate info XML request */
+  private static final String CERTINFO_XMLREQUEST_TAG = "<CertInfoXMLRequest>";
+  /** special tag in the HTML template to be substituted for the certificate info data URL */
+  private static final String CERTINFO_DATAURL_TAG = "<CertInfoDataURL>";
+  /** special tag in the HTML template to be substituted for the infoboxes to be pushed from the BKU */
+  private static final String PUSHINFOBOX_TAG = "<PushInfobox>";
+  /** special tag in the HTML template to be substituted for the BKU URL */
+  private static final String MANDATE_TAG = "<Mandate>";
+  /** private static int all contains the representation to replace all tags*/
+  private static final int ALL = -1;
+
+  /** default HTML template */
+  private static final String DEFAULT_HTML_TEMPLATE = 
+    "<html>" + nl +
+    "<head>" + nl +
+    "<meta http-equiv=\"content-type\" content=\"text/html; charset=UTF-8\">" + nl +
+    "<title>Anmeldung mit B&uuml;rgerkarte</title>" + nl +
+    "</head>" + nl +
+    "<body>" + nl +
+    "<form name=\"GetIdentityLinkForm\"" + nl +
+    "      action=\"" + BKU_TAG + "\"" + nl +
+    "      method=\"post\">" + nl +
+    "  <input type=\"hidden\" " + nl +
+    "         name=\"XMLRequest\"" + nl +
+    "         value=\"" + XMLREQUEST_TAG + "\"/>" + nl +
+    "  <input type=\"hidden\" " + nl +
+    "         name=\"DataURL\"" + nl +
+    "         value=\"" + DATAURL_TAG + "\"/>" + nl +
+    "  <input type=\"hidden\" " + nl +
+    "         name=\"PushInfobox\"" + nl +
+    "         value=\"" + PUSHINFOBOX_TAG + "\"/>" + nl +
+    "  <input type=\"submit\" value=\"Anmeldung mit B&uuml;rgerkarte\"/>" + nl +
+    "</form>" + nl +
+    "<form name=\"CertificateInfoForm\"" + nl +
+    "      action=\"" + BKU_TAG + "\"" + nl +
+    "      method=\"post\">" + nl +
+    "  <input type=\"hidden\" " + nl +
+    "         name=\"XMLRequest\"" + nl +
+    "         value=\"" + CERTINFO_XMLREQUEST_TAG + "\"/>" + nl +
+    "  <input type=\"hidden\" " + nl +
+    "         name=\"DataURL\"" + nl +
+    "         value=\"" + CERTINFO_DATAURL_TAG + "\"/>" + nl +
+//	"  <input type=\"submit\" value=\"Information zu Wurzelzertifikaten\"/>" + nl +    
+    "  <input type=\"hidden\" value=\"Information zu Wurzelzertifikaten\"/>" + nl +
+    "</form>" + nl +
+    "</body>" + nl +
+    "</html>";
+  
+  
+  
+  
+    /**
+   * Constructor for GetIdentityLinkFormBuilder.
+   */
+  public GetIdentityLinkFormBuilder() {
+    super();
+  }
+  /**
+   * Builds the HTML form, including XML Request and data URL as parameters.
+   * 
+   * @param htmlTemplate template to be used for the HTML form;
+   *         may be <code>null</code>, in this case a default layout will be produced
+   * @param xmlRequest XML Request to be sent as a parameter in the form
+   * @param bkuURL URL of the "B&uuml;rgerkartenumgebung" the form will be submitted to;
+   *         may be <code>null</code>, in this case the default URL will be used
+   * @param dataURL DataURL to be sent as a parameter in the form
+   */
+  public String build(
+  	String htmlTemplate, 
+    String bkuURL, 
+    String xmlRequest, 
+    String dataURL, 
+    String certInfoXMLRequest, 
+    String certInfoDataURL, 
+    String pushInfobox)
+  throws BuildException 
+  {      
+  	String htmlForm = htmlTemplate == null ? DEFAULT_HTML_TEMPLATE : htmlTemplate;
+    htmlForm = replaceTag(htmlForm, BKU_TAG, bkuURL, true, ALL);
+    htmlForm = replaceTag(htmlForm, XMLREQUEST_TAG, encodeParameter(xmlRequest), true, ALL);
+    htmlForm = replaceTag(htmlForm, DATAURL_TAG, dataURL, true, ALL);
+    htmlForm = replaceTag(htmlForm, PUSHINFOBOX_TAG, pushInfobox, false, ALL);
+//new:wird oben mitreplaced    htmlForm = replaceTag(htmlForm, BKU_TAG, bkuURL);
+    htmlForm = replaceTag(htmlForm, CERTINFO_XMLREQUEST_TAG, encodeParameter(certInfoXMLRequest), true, ALL);
+    htmlForm = replaceTag(htmlForm, CERTINFO_DATAURL_TAG, certInfoDataURL, true, ALL);
+  	return htmlForm;
+  }
+  
+  
+ 
+  /**
+   * Encodes a string for inclusion as a parameter in the form.
+   * Double quotes are substituted by <code>"&amp;quot;"</code>.
+   * @param s the string to be encoded
+   * @return the string encoded
+   * @throws BuildException on any exception encountered
+   */
+  public static String encodeParameter(String s) throws BuildException {
+    StringReader in = new StringReader(s);
+    StringWriter out = new StringWriter();
+    try {
+      for (int ch = in.read(); ch >= 0; ch = in.read()) {
+        if (ch == '"')
+          out.write("&quot;");
+        else if (ch == '<')
+          out.write("&lt;");
+        else if (ch == '>')
+          out.write("&gt;");
+        else if (ch == 'ä')
+          out.write("&auml;");
+        else if (ch == 'ö')
+          out.write("&ouml;");
+        else if (ch == 'ü')
+          out.write("&uuml;");
+        else if (ch == 'Ä')
+          out.write("&Auml;");
+        else if (ch == 'Ö')
+          out.write("&Ouml;");
+        else if (ch == 'Ü')
+          out.write("&Uuml;");
+        else if (ch == 'ß')
+          out.write("&szlig;");
+        else
+          out.write(ch);
+      }
+    }
+    catch (IOException ex) {
+      throw new BuildException("builder.00", new Object[] {"GetIdentityLinkForm", ex.toString()});
+    }
+    return out.toString();
+  }
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetVerifyAuthBlockFormBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetVerifyAuthBlockFormBuilder.java
new file mode 100644
index 000000000..ea3d170eb
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetVerifyAuthBlockFormBuilder.java
@@ -0,0 +1,106 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;

+

+import at.gv.egovernment.moa.id.BuildException;
+

+/**

+ * Builder for HTML form requesting a security layer request

+ *  

+ * @author Peter Danner

+ * @version $Id: GetIdentityLinkFormBuilder.java 769 2007-01-10 15:37:52Z peter.danner $

+ */

+public class GetVerifyAuthBlockFormBuilder extends Builder {

+ /** private static String NL contains the NewLine representation in Java*/

+  private static final String nl = "\n";

+  /** special tag in the HTML template to be substituted for the BKU URL */

+  private static final String BKU_TAG = "<BKU>";

+  /** special tag in the HTML template to be substituted for the XML request */

+  private static final String XMLREQUEST_TAG = "<XMLRequest>";

+  /** special tag in the HTML template to be substituted for the data URL */

+  private static final String DATAURL_TAG = "<DataURL>";

+  /** special tag in the HTML template to be substituted for the infoboxes to be pushed from the BKU */

+  private static final String PUSHINFOBOX_TAG = "<PushInfobox>";

+  /** private static int all contains the representation to replace all tags*/

+  private static final int ALL = -1;

+

+  /** default HTML template */

+  private static final String DEFAULT_HTML_TEMPLATE = 

+    "<html>" + nl +

+    "  <head>" + nl +

+    "    <meta http-equiv=\"content-type\" content=\"text/html; charset=UTF-8\"/>" + nl +

+    "    <title>Signatur der Anmeldedaten</title>" + nl +

+    "  </head>" + nl +

+    "  <body onLoad=\"autoSubmit()\">" + nl +

+    "    <script type=\"text/javascript\">" + nl +

+    "      //<!-- "  +  nl +

+    "      function autoSubmit() { " +  nl +

+    "           document.VerifyAuthBlockForm.submitButton.disabled=true;" +  nl +

+    "           document.VerifyAuthBlockForm.submit(); " +  nl +

+    "      } //-->" + nl +

+    "    </script>" + nl +

+    "    <form name=\"VerifyAuthBlockForm\" action=\"" + BKU_TAG + "\" method=\"post\" enctype=\"application/x-www-form-urlencoded\">" + nl +

+    "      <input type=\"hidden\" name=\"XMLRequest\" value=\"" + XMLREQUEST_TAG + "\"/>" + nl +

+    "      <input type=\"hidden\" name=\"DataURL\" value=\"" + DATAURL_TAG + "\"/>" + nl +

+    "      <input type=\"hidden\" name=\"PushInfobox\" value=\"" + PUSHINFOBOX_TAG + "\"/>" + nl +

+    "      <input type=\"submit\" value=\"Signieren der Anmeldedaten\" id=\"submitButton\"/>" + nl +

+    "    </form>" + nl +

+    "  </body>" + nl +

+    "</html>";

+

+  /**

+   * Constructor for GetVerifyAuthBlockFormBuilder.

+   */

+  public GetVerifyAuthBlockFormBuilder() {

+    super();

+  }

+  /**

+   * Builds the HTML form, including XML Request and data URL as parameters.

+   * 

+   * @param htmlTemplate template to be used for the HTML form;

+   *         may be <code>null</code>, in this case a default layout will be produced

+   * @param xmlRequest XML Request to be sent as a parameter in the form

+   * @param bkuURL URL of the "B&uuml;rgerkartenumgebung" the form will be submitted to;

+   *         may be <code>null</code>, in this case the default URL will be used

+   * @param dataURL DataURL to be sent as a parameter in the form

+   */

+  public String build(

+  	String htmlTemplate, 

+    String bkuURL, 

+    String xmlRequest, 

+    String dataURL, 

+    String pushInfobox)

+  throws BuildException 

+  {      

+  	String htmlForm = htmlTemplate == null ? DEFAULT_HTML_TEMPLATE : htmlTemplate;

+    htmlForm = replaceTag(htmlForm, BKU_TAG, bkuURL, true, ALL);

+    htmlForm = replaceTag(htmlForm, XMLREQUEST_TAG, GetIdentityLinkFormBuilder.encodeParameter(xmlRequest), true, ALL);

+    htmlForm = replaceTag(htmlForm, DATAURL_TAG, dataURL, true, ALL);

+    if (null==pushInfobox) pushInfobox="";

+    htmlForm = replaceTag(htmlForm, PUSHINFOBOX_TAG, pushInfobox, false, ALL);

+  	return htmlForm;

+  }

+

+}

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/InfoboxReadRequestBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/InfoboxReadRequestBuilder.java
new file mode 100644
index 000000000..b2acf9f2d
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/InfoboxReadRequestBuilder.java
@@ -0,0 +1,110 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import at.gv.egovernment.moa.util.Constants;
+
+/**
+ * Builder for the <code>&lt;InfoboxReadRequest&gt;</code> structure
+ * used for requesting the identity link from the security layer implementation.
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class InfoboxReadRequestBuilder implements Constants {
+
+
+  /**
+   * Constructor for InfoboxReadRequestBuilder.
+   */
+  public InfoboxReadRequestBuilder() {
+  }
+   
+  
+  /**
+   * Builds an <code>&lt;InfoboxReadRequest&gt;</code>.
+   * 
+   * @param slVersion12           specifies whether the Security Layer version is
+   *                              version 1.2 or not
+   * @param businessService       specifies whether the online application is a
+   *                              business service or not
+   * @param identityLinkDomainIdentifier  the identification number of the business 
+   *                              company; maybe <code>null</code> if the OA
+   *                              is a public service; must not be <code>null</code>
+   *                              if the OA is a business service
+   * 
+   * @return <code>&lt;InfoboxReadRequest&gt;</code> as String
+   */
+  public String build(boolean slVersion12, boolean businessService, String identityLinkDomainIdentifier) {
+    
+    String slPrefix;
+    String slNsDeclaration;
+    
+    if (slVersion12) {
+      slPrefix = SL12_PREFIX;
+      slNsDeclaration = SL12_NS_URI;
+    } else {
+      slPrefix = SL10_PREFIX;
+      slNsDeclaration = SL10_NS_URI;
+    }
+        
+    StringBuffer sb = new StringBuffer("<?xml version=\"1.0\" encoding=\"UTF-8\" ?>");
+    sb.append("<");
+    sb.append(slPrefix);
+    sb.append(":InfoboxReadRequest xmlns:");
+    sb.append(slPrefix);
+    sb.append("=\"");
+    sb.append(slNsDeclaration);
+    sb.append("\">");
+    sb.append("<");
+    sb.append(slPrefix);
+    sb.append(":InfoboxIdentifier>IdentityLink</");
+    sb.append(slPrefix);
+    sb.append(":InfoboxIdentifier>");
+    sb.append("<");
+    sb.append(slPrefix);
+    sb.append(":BinaryFileParameters ContentIsXMLEntity=\"true\"/>");
+    if (businessService) {
+      sb.append("<");
+      sb.append(slPrefix);
+      sb.append(":BoxSpecificParameters>");
+      sb.append("<");
+      sb.append(slPrefix);
+      sb.append(":IdentityLinkDomainIdentifier>");
+      sb.append(identityLinkDomainIdentifier);
+      sb.append("</sl:IdentityLinkDomainIdentifier>");
+      sb.append("</");
+      sb.append(slPrefix);
+      sb.append(":BoxSpecificParameters>");
+    }
+    sb.append("</");
+    sb.append(slPrefix);
+    sb.append(":InfoboxReadRequest>");
+    
+    return sb.toString();
+       
+  }
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/InfoboxReadRequestBuilderCertificate.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/InfoboxReadRequestBuilderCertificate.java
new file mode 100644
index 000000000..e13101dbb
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/InfoboxReadRequestBuilderCertificate.java
@@ -0,0 +1,102 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import at.gv.egovernment.moa.util.Constants;
+
+/**
+ * Builder for the <code>&lt;InfoboxReadRequest&gt;</code> structure
+ * used for requesting the identity link from the security layer implementation.
+ * 
+ * @author Paul Ivancsics
+ * @version $Id: InfoboxReadRequestBuilder.java 1087 2008-08-28 07:55:59Z mcentner $
+ */
+public class InfoboxReadRequestBuilderCertificate implements Constants {
+
+
+  /**
+   * Constructor for InfoboxReadRequestBuilder.
+   */
+  public InfoboxReadRequestBuilderCertificate() {
+  }
+   
+  
+  /**
+   * Builds an <code>&lt;InfoboxReadRequest&gt;</code>.
+   * 
+   * @param slVersion12           specifies whether the Security Layer version is
+   *                              version 1.2 or not
+   * @param businessService       specifies whether the online application is a
+   *                              business service or not
+   * @param identityLinkDomainIdentifier  the identification number of the business 
+   *                              company; maybe <code>null</code> if the OA
+   *                              is a public service; must not be <code>null</code>
+   *                              if the OA is a business service
+   * 
+   * @return <code>&lt;InfoboxReadRequest&gt;</code> as String
+   */
+  public String build(boolean slVersion12) {
+    
+    String slPrefix;
+    String slNsDeclaration;
+    
+    if (slVersion12) {
+      slPrefix = SL12_PREFIX;
+      slNsDeclaration = SL12_NS_URI;
+    } else {
+      slPrefix = SL10_PREFIX;
+      slNsDeclaration = SL10_NS_URI;
+    }
+            
+    StringBuffer sb = new StringBuffer("<?xml version=\"1.0\" encoding=\"UTF-8\" ?>");
+    sb.append("<");
+    sb.append(slPrefix);
+    sb.append(":InfoboxReadRequest xmlns:");
+    sb.append(slPrefix);
+    sb.append("=\"");
+    sb.append(slNsDeclaration);
+    sb.append("\">");
+    sb.append("<");
+    sb.append(slPrefix);
+    sb.append(":InfoboxIdentifier>Certificates</");
+    sb.append(slPrefix);
+    sb.append(":InfoboxIdentifier>");
+    sb.append("<");
+    sb.append(slPrefix);
+    sb.append(":AssocArrayParameters>");
+    sb.append("<");
+    sb.append(slPrefix);
+    sb.append(":ReadValue Key=\"SecureSignatureKeypair\"/>");
+    sb.append("</");
+    sb.append(slPrefix);
+    sb.append(":AssocArrayParameters>");
+    sb.append("</");
+    sb.append(slPrefix);
+    sb.append(":InfoboxReadRequest>");
+    
+    return sb.toString();
+       
+  }
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/InfoboxValidatorParamsBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/InfoboxValidatorParamsBuilder.java
new file mode 100644
index 000000000..fa1de87de
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/InfoboxValidatorParamsBuilder.java
@@ -0,0 +1,106 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import java.util.List;
+
+import org.w3c.dom.Element;
+
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.data.IdentityLink;
+import at.gv.egovernment.moa.id.auth.data.InfoboxValidatorParams;
+import at.gv.egovernment.moa.id.auth.data.InfoboxValidatorParamsImpl;
+import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser;
+import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.id.config.auth.VerifyInfoboxParameter;
+import at.gv.egovernment.moa.util.XPathUtils;
+
+/**
+ * This class provides one method for building parameters needed for 
+ * validating an infobox token.
+ * 
+ * @author Harald Bratko
+ */
+public class InfoboxValidatorParamsBuilder {
+
+  // hide the default constructor
+  private InfoboxValidatorParamsBuilder() {
+  }
+  
+  /**
+   * Builds the parameters passed to the validator class for validating an infobox token.
+   * 
+   * @param session                 The actual Authentication session.
+   * @param verifyInfoboxParameter  The configuration parameters for the infobox.
+   * @param infoboxTokenList        Contains the infobox token to be validated.
+   * @param oaParam                 The configuration parameters of the online application 
+   * 
+   * @return Parameters for validating an infobox token.
+   */
+  public static InfoboxValidatorParams buildInfoboxValidatorParams(
+    AuthenticationSession session, 
+    VerifyInfoboxParameter verifyInfoboxParameter,
+    List infoboxTokenList,
+    OAAuthParameter oaParam)
+  {
+    InfoboxValidatorParamsImpl infoboxValidatorParams = new InfoboxValidatorParamsImpl();
+    IdentityLink identityLink = session.getIdentityLink(); 
+    
+    // the infobox token to validate
+    infoboxValidatorParams.setInfoboxTokenList(infoboxTokenList);
+    // configuration parameters
+    infoboxValidatorParams.setTrustProfileID(verifyInfoboxParameter.getTrustProfileID());
+    infoboxValidatorParams.setSchemaLocations(verifyInfoboxParameter.getSchemaLocations());
+    infoboxValidatorParams.setApplicationSpecificParams(verifyInfoboxParameter.getApplicationSpecificParams());
+    // authentication session parameters
+    infoboxValidatorParams.setBkuURL(session.getBkuURL());
+    infoboxValidatorParams.setTarget(session.getTarget());
+    infoboxValidatorParams.setDomainIdentifier(oaParam.getIdentityLinkDomainIdentifier());
+    infoboxValidatorParams.setBusinessApplication(session.getBusinessService());
+    // parameters from the identity link
+    infoboxValidatorParams.setFamilyName(identityLink.getFamilyName());
+    infoboxValidatorParams.setGivenName(identityLink.getGivenName());
+    infoboxValidatorParams.setDateOfBirth(identityLink.getDateOfBirth());
+    if (verifyInfoboxParameter.getProvideStammzahl()) {
+      infoboxValidatorParams.setIdentificationValue(identityLink.getIdentificationValue());
+    }
+    infoboxValidatorParams.setIdentificationType(identityLink.getIdentificationType());
+    infoboxValidatorParams.setPublicKeys(identityLink.getPublicKey());
+    if (verifyInfoboxParameter.getProvideIdentityLink()) {
+      Element identityLinkElem = (Element)identityLink.getSamlAssertion().cloneNode(true);
+      if (!verifyInfoboxParameter.getProvideStammzahl()) {
+        Element identificationValueElem = 
+          (Element)XPathUtils.selectSingleNode(identityLinkElem, IdentityLinkAssertionParser.PERSON_IDENT_VALUE_XPATH);
+        if (identificationValueElem != null) {
+          identificationValueElem.getFirstChild().setNodeValue("");
+        }
+      }
+      infoboxValidatorParams.setIdentityLink(identityLinkElem);
+    }
+    infoboxValidatorParams.setHideStammzahl(!oaParam.getProvideStammzahl());
+    return infoboxValidatorParams;
+  }
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/PersonDataBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/PersonDataBuilder.java
new file mode 100644
index 000000000..05a7cdbea
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/PersonDataBuilder.java
@@ -0,0 +1,83 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import org.w3c.dom.Element;
+import org.w3c.dom.Node;
+
+import at.gv.egovernment.moa.id.BuildException;
+import at.gv.egovernment.moa.id.auth.data.IdentityLink;
+import at.gv.egovernment.moa.util.DOMUtils;
+import at.gv.egovernment.moa.util.XPathUtils;
+
+/**
+ * Builder for the <code>lt;pr:Person&gt;</code> element to be inserted
+ * in the authentication data <code>lt;saml:Assertion&gt;</code>.
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class PersonDataBuilder {
+
+  /**
+   * Constructor for PersonDataBuilder.
+   */
+  public PersonDataBuilder() {
+    super();
+  }
+	/**
+	 * Builds the <code>&lt;pr:Person&gt;</code> element.<br/>
+	 * Utilizes the parsed <code>&lt;prPerson&gt;</code> from the identity link
+	 * and the information regarding inclusion of <code>"Stammzahl"</code> in the 
+	 * <code>&lt;pr:Person&gt;</code> data.
+	 * 
+	 * @param identityLink <code>IdentityLink</code> containing the
+	 * 				 attribute <code>prPerson</code>
+	 * @param provideStammzahl true if <code>"Stammzahl"</code> is to be included;
+	 * 				 false otherwise
+	 * @return the <code>&lt;pr:Person&gt;</code> element as a String
+   * @throws BuildException on any error
+	 */
+	public String build(IdentityLink identityLink, boolean provideStammzahl) 
+		throws BuildException {
+			
+    try {
+      Element prPerson = (Element)identityLink.getPrPerson().cloneNode(true);
+      if (! provideStammzahl) {
+        Node prIdentification = XPathUtils.selectSingleNode(prPerson, "pr:Identification/pr:Value");       
+        //remove IdentificationValue
+        prIdentification.getFirstChild().setNodeValue("");
+      }
+      String xmlString = DOMUtils.serializeNode(prPerson);
+      return xmlString;
+    }
+    catch (Exception ex) {
+    	throw new BuildException(
+    		"builder.00", 
+    		new Object[] {"PersonData", ex.toString()}, 
+    		ex);
+    }
+	}
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SAMLArtifactBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SAMLArtifactBuilder.java
new file mode 100644
index 000000000..a0fe0de1b
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SAMLArtifactBuilder.java
@@ -0,0 +1,145 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import java.io.ByteArrayOutputStream;
+import java.security.MessageDigest;
+
+import at.gv.egovernment.moa.id.BuildException;
+import at.gv.egovernment.moa.id.auth.validator.parep.ParepUtils;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.Base64Utils;
+
+/**
+ * Builder for the SAML artifact, as defined in the 
+ * Browser/Artifact profile of SAML.
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class SAMLArtifactBuilder {
+
+  /**
+   * The generic configuration parameter for an alternative SourceID.
+   */
+  private static final String GENERIC_CONFIG_PARAM_SOURCEID = "AuthenticationServer.SourceID";
+
+  /**
+   * Constructor for SAMLArtifactBuilder.
+   */
+  public SAMLArtifactBuilder() {
+    super();
+  }
+  
+  /**
+   * Builds the SAML artifact, encoded BASE64.
+   * <ul>
+   * <li><code>TypeCode</code>: <code>0x0001</code>.</li>
+   * <li><code>SourceID</code>: SHA-1 hash of the authURL</li>
+   * <li><code>AssertionHandle</code>: SHA-1 hash of the <code>MOASessionID</code></li>
+   * </ul>
+   * @param authURL URL auf the MOA-ID Auth component to be used for construction 
+   *                 of <code>SourceID</code>
+   * @param sessionID <code>MOASessionID</code> to be used for construction 
+   *                   of <code>AssertionHandle</code>
+   * @return the 42-byte SAML artifact, encoded BASE64
+   */
+  public String build(String authURL, String sessionID, String sourceIdParam) throws BuildException {
+    try {
+      MessageDigest md = MessageDigest.getInstance("SHA-1");
+      byte[] sourceID;
+      // alternative sourceId
+      String alternativeSourceID = AuthConfigurationProvider.getInstance().getGenericConfigurationParameter(GENERIC_CONFIG_PARAM_SOURCEID);
+      
+      // if sourceID is given in GET/POST param - use this as source id
+      if (!ParepUtils.isEmpty(sourceIdParam)) {
+          // if GET/POST parameter sourceID is set, use that sourceID instead of authURL;
+          //sourceID = md.digest(sourceIdParam.getBytes());
+    	  
+    	  // if sourceIdParam is too short (must have 20 characters) - add " "
+    	  int length = sourceIdParam.length();  			
+  			if (length < 20) {
+  				int l = 20 - length;
+  				for (int i = 0; i < l; i++) {
+  					sourceIdParam += " ";
+  				}			
+  			}
+  		
+    	  sourceID = sourceIdParam.getBytes();
+          Logger.info("Building SAMArtifact from sourceID \"" + sourceIdParam + "\" instead of authURL \"" + authURL + "\".");
+          
+          byte[] assertionHandle = md.digest(sessionID.getBytes());
+          ByteArrayOutputStream out = new ByteArrayOutputStream(42);
+          out.write(0);
+          out.write(1);
+          out.write(sourceID, 0, 20);
+          out.write(assertionHandle, 0, 20);
+          byte[] samlArtifact = out.toByteArray();
+          String samlArtifactBase64 = Base64Utils.encode(samlArtifact);
+          return samlArtifactBase64;          
+      }
+      
+      // if generic config parameter "AuthenticationServer.SourceID" is given, use that sourceID instead of authURL;
+      if (!ParepUtils.isEmpty(alternativeSourceID)) {
+          sourceID = md.digest(alternativeSourceID.getBytes());      
+          Logger.info("Building SAMArtifact from sourceID \"" + alternativeSourceID + "\" instead of authURL \"" + authURL + "\".");
+          
+          byte[] assertionHandle = md.digest(sessionID.getBytes());
+          ByteArrayOutputStream out = new ByteArrayOutputStream(42);
+          out.write(0);
+          out.write(1);
+          out.write(sourceID, 0, 20);
+          out.write(assertionHandle, 0, 20);
+          byte[] samlArtifact = out.toByteArray();
+          String samlArtifactBase64 = Base64Utils.encode(samlArtifact);
+          return samlArtifactBase64;          
+      }
+      
+      // default: sourecID from authURL
+      sourceID = md.digest(authURL.getBytes());
+      byte[] assertionHandle = md.digest(sessionID.getBytes());
+      ByteArrayOutputStream out = new ByteArrayOutputStream(42);
+      out.write(0);
+      out.write(1);
+      out.write(sourceID, 0, 20);
+      out.write(assertionHandle, 0, 20);
+      byte[] samlArtifact = out.toByteArray();
+      String samlArtifactBase64 = Base64Utils.encode(samlArtifact);
+      return samlArtifactBase64;
+      
+      //System.out.println("sourceID: " + new String(sourceID));
+      
+      
+    }
+    catch (Throwable ex) {
+      throw new BuildException(
+        "builder.00", 
+        new Object[] {"SAML Artifact, MOASessionID=" + sessionID, ex.toString()}, 
+        ex);
+    }
+  }
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SAMLResponseBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SAMLResponseBuilder.java
new file mode 100644
index 000000000..9d7ae1f46
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SAMLResponseBuilder.java
@@ -0,0 +1,115 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import java.text.MessageFormat;
+
+import org.w3c.dom.Element;
+
+import at.gv.egovernment.moa.id.BuildException;
+import at.gv.egovernment.moa.util.Constants;
+import at.gv.egovernment.moa.util.DOMUtils;
+import at.gv.egovernment.moa.util.StringUtils;
+
+/**
+ * Builder for the <code>lt;samlp:Response&gt;</code> used for passing
+ * result and status information from the <code>GetAuthenticationData</code>
+ * web service.
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class SAMLResponseBuilder implements Constants {
+	/** XML - Template for samlp:Response */
+	private static final String RESPONSE = 
+    "<?xml version=\"1.0\" encoding=\"UTF-8\" ?>" +
+    "<samlp:Response xmlns:samlp=\"" + SAMLP_NS_URI + "\" xmlns:saml=\"" + SAML_NS_URI + "\"" +
+    " ResponseID=\"{0}\" InResponseTo=\"{1}\" MajorVersion=\"1\" MinorVersion=\"0\" IssueInstant=\"{2}\">" +
+    "  <samlp:Status>" +
+    "    <samlp:StatusCode Value=\"{3}\">" +
+    "      {4}" +
+    "    </samlp:StatusCode>" +
+    "    <samlp:StatusMessage>{5}</samlp:StatusMessage>" +
+    "  </samlp:Status>" +
+    "  {6}" +
+    "</samlp:Response>";
+  /** XML - Template for samlp:StatusCode */  
+  private static final String SUB_STATUS_CODE = 
+    "<samlp:StatusCode Value=\"{0}\"></samlp:StatusCode>";
+	
+  /**
+   * Constructor for SAMLResponseBuilder.
+   */
+  public SAMLResponseBuilder() {
+    super();
+  }
+  /**
+   * Builds the SAML response.
+   * @param responseID response ID
+   * @param inResponseTo request ID of <code>lt;samlp:Request&gt;</code> responded to
+   * @param issueInstant current timestamp
+   * @param statusCode status code
+   * @param subStatusCode sub-status code refining the status code; may be <code>null</code>
+   * @param statusMessage status message
+   * @param samlAssertion SAML assertion representing authentication data
+   * @return SAML response as a DOM element
+	 */
+  public Element build(
+  	String responseID, 
+  	String inResponseTo, 
+  	String issueInstant, 
+  	String statusCode, 
+  	String subStatusCode, 
+  	String statusMessage, 
+  	String samlAssertion)
+  	throws BuildException {
+  	
+  	try {
+	  	String xmlSubStatusCode = 
+	  		subStatusCode == null ? 
+	  		"" : 
+	  		MessageFormat.format(SUB_STATUS_CODE, new Object[] {subStatusCode});
+	  	
+	  	String xmlResponse = MessageFormat.format(RESPONSE, new Object[] {
+  			responseID, 
+        inResponseTo, 
+        issueInstant, 
+        statusCode, 
+        xmlSubStatusCode, 
+        statusMessage, 
+        StringUtils.removeXMLDeclaration(samlAssertion) });
+  		Element domResponse = DOMUtils.parseDocument(xmlResponse, false, ALL_SCHEMA_LOCATIONS, null).getDocumentElement();
+		  return domResponse;
+  	}
+  	catch (Throwable ex) {
+  		throw new BuildException(
+  			"builder.00",
+  			new Object[] { "samlp:Response", ex.toString() },
+  			ex);
+  	}
+  }
+
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SelectBKUFormBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SelectBKUFormBuilder.java
new file mode 100644
index 000000000..bfc86d608
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SelectBKUFormBuilder.java
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import at.gv.egovernment.moa.id.BuildException;
+
+/**
+ * Builder for the BKU selection form requesting the user to choose
+ * a BKU from a list.
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class SelectBKUFormBuilder extends Builder {
+  /** private static String NL contains the NewLine representation in Java*/
+  private static final String nl = "\n";
+  /** special tag in the HTML template to be substituted for the form action which is
+   *  a URL of MOA-ID Auth */
+  private static final String ACTION_TAG = "<StartAuth>";
+  /** special tag in the HTML template to be substituted for the <code>&lt;select;gt;</code> tag
+   *  containing the BKU selection options */
+  private static final String SELECT_TAG = "<BKUSelect>";
+  /**
+   * Template for the default html-code to be returned as security-layer-selection to be built
+   */
+  private static final String DEFAULT_HTML_TEMPLATE = 
+  "<html>" + nl +
+  "<head>" + nl +
+  "<meta http-equiv=\"content-type\" content=\"text/html; charset=UTF-8\">" + nl +
+  "<title>Auswahl der B&uuml;rgerkartenumgebung</title>" + nl +
+  "</head>" + nl +
+  "<body>" + nl +
+  "<form name=\"BKUSelectionForm\"" + nl +
+  "      action=\"" + ACTION_TAG + "\"" + nl +
+  "      method=\"post\">" + nl +
+  SELECT_TAG + nl +
+  "  <input type=\"submit\" value=\"B&uuml;rgerkartenumgebung ausw&auml;hlen\"/>" + nl +
+  "</form>" + nl +
+  "</body>" + nl +
+  "</html>";
+  
+  /**
+   * Constructor
+   */
+  public SelectBKUFormBuilder() {
+    super();
+  }
+  /**
+   * Method build. Builds the form
+   * @param htmlTemplate to be used
+   * @param startAuthenticationURL the url where the startAuthenticationServlet can be found
+   * @param bkuSelectTag if a special bku should be used
+   * @return String
+   * @throws BuildException on any error
+   */
+  public String build(String htmlTemplate, String startAuthenticationURL, String bkuSelectTag) 
+    throws BuildException {
+    
+    String htmlForm = htmlTemplate == null ? DEFAULT_HTML_TEMPLATE : htmlTemplate;
+    htmlForm = replaceTag(htmlForm, ACTION_TAG, startAuthenticationURL, true, 1);
+    htmlForm = replaceTag(htmlForm, SELECT_TAG, bkuSelectTag, true, 1);
+    return htmlForm;
+  }
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/VerifyXMLSignatureRequestBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/VerifyXMLSignatureRequestBuilder.java
new file mode 100644
index 000000000..5e6d47bdf
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/VerifyXMLSignatureRequestBuilder.java
@@ -0,0 +1,372 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.auth.builder;
+
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+import org.w3c.dom.Node;
+
+import at.gv.egovernment.moa.id.BuildException;
+import at.gv.egovernment.moa.id.ParseException;
+import at.gv.egovernment.moa.id.auth.data.CreateXMLSignatureResponse;
+import at.gv.egovernment.moa.id.auth.data.IdentityLink;
+import at.gv.egovernment.moa.util.Base64Utils;
+import at.gv.egovernment.moa.util.Constants;
+
+/**
+ * Builder for the <code>&lt;VerifyXMLSignatureRequestBuilder&gt;</code> structure
+ * used for sending the DSIG-Signature of the Security Layer card for validating to MOA-SP.
+ * 
+ * @author Stefan Knirsch
+ * @version $Id$
+ */
+public class VerifyXMLSignatureRequestBuilder {
+  
+  /** shortcut for XMLNS namespace URI */
+  private static final String XMLNS_NS_URI = Constants.XMLNS_NS_URI;
+  /** shortcut for MOA namespace URI */
+  private static final String MOA_NS_URI = Constants.MOA_NS_URI;
+  /** The DSIG-Prefix */
+  private static final String DSIG = Constants.DSIG_PREFIX + ":";
+  
+  /** The document containing the <code>VerifyXMLsignatureRequest</code> */
+  private Document requestDoc_;
+  /** the <code>VerifyXMLsignatureRequest</code> root element */
+  private Element requestElem_;
+  
+  
+  /**
+   * Builds the body for a <code>VerifyXMLsignatureRequest</code> including the root
+   * element and namespace declarations.
+   * 
+   * @throws BuildException If an error occurs on building the document.
+   */
+  public VerifyXMLSignatureRequestBuilder() throws BuildException {
+    try {
+      DocumentBuilder docBuilder = DocumentBuilderFactory.newInstance().newDocumentBuilder();        
+      requestDoc_ = docBuilder.newDocument();
+      requestElem_ = requestDoc_.createElementNS(MOA_NS_URI, "VerifyXMLSignatureRequest");
+      requestElem_.setAttributeNS(XMLNS_NS_URI, "xmlns", MOA_NS_URI);
+      requestElem_.setAttributeNS(XMLNS_NS_URI, "xmlns:" + Constants.DSIG_PREFIX, Constants.DSIG_NS_URI);
+      requestDoc_.appendChild(requestElem_);       
+    } catch (Throwable t) {
+      throw new BuildException(
+        "builder.00", 
+        new Object[] {"VerifyXMLSignatureRequest", t.toString()}, 
+        t);
+    }
+  }
+  
+  
+  /**
+   * Builds a <code>&lt;VerifyXMLSignatureRequest&gt;</code>
+   * from an IdentityLink with a known trustProfileID which 
+   * has to exist in MOA-SP
+   * @param identityLink - The IdentityLink
+   * @param trustProfileID - a preconfigured TrustProfile at MOA-SP
+   * 
+   * @return Element - The complete request as Dom-Element
+   * 
+   * @throws ParseException
+   */
+  public Element build(IdentityLink identityLink, String trustProfileID)
+    throws ParseException 
+  { 
+    try {
+      // build the request
+      Element dateTimeElem = requestDoc_.createElementNS(MOA_NS_URI, "DateTime");
+      requestElem_.appendChild(dateTimeElem);
+      Node dateTime = requestDoc_.createTextNode(identityLink.getIssueInstant());
+      dateTimeElem.appendChild(dateTime);
+      Element verifiySignatureInfoElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureInfo");
+      requestElem_.appendChild(verifiySignatureInfoElem);
+      Element verifySignatureEnvironmentElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureEnvironment");
+      verifiySignatureInfoElem.appendChild(verifySignatureEnvironmentElem);
+      Element base64ContentElem = requestDoc_.createElementNS(MOA_NS_URI, "Base64Content");
+      verifySignatureEnvironmentElem.appendChild(base64ContentElem);
+      // insert the base64 encoded identity link SAML assertion
+      String serializedAssertion = identityLink.getSerializedSamlAssertion();
+      String base64EncodedAssertion = Base64Utils.encode(serializedAssertion.getBytes("UTF-8"));
+      //replace all '\r' characters by no char.
+      StringBuffer replaced = new StringBuffer();
+      for (int i = 0; i < base64EncodedAssertion.length(); i ++) {
+        char c = base64EncodedAssertion.charAt(i);
+        if (c != '\r') {
+          replaced.append(c);
+        }
+      }
+      base64EncodedAssertion = replaced.toString();
+      Node base64Content = requestDoc_.createTextNode(base64EncodedAssertion);
+      base64ContentElem.appendChild(base64Content);      
+      // specify the signature location
+      Element verifySignatureLocationElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureLocation");
+      verifiySignatureInfoElem.appendChild(verifySignatureLocationElem);
+      Node signatureLocation = requestDoc_.createTextNode(DSIG + "Signature");
+      verifySignatureLocationElem.appendChild(signatureLocation);      
+      // signature manifest params
+      Element signatureManifestCheckParamsElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "SignatureManifestCheckParams");
+      requestElem_.appendChild(signatureManifestCheckParamsElem);
+      signatureManifestCheckParamsElem.setAttribute("ReturnReferenceInputData", "false");
+      // add the transforms
+      Element referenceInfoElem = requestDoc_.createElementNS(MOA_NS_URI, "ReferenceInfo");
+      signatureManifestCheckParamsElem.appendChild(referenceInfoElem);
+      Element[] dsigTransforms = identityLink.getDsigReferenceTransforms();
+      
+      for (int i = 0; i < dsigTransforms.length; i++) {        
+        Element verifyTransformsInfoProfileElem = 
+          requestDoc_.createElementNS(MOA_NS_URI, "VerifyTransformsInfoProfile");
+        referenceInfoElem.appendChild(verifyTransformsInfoProfileElem);
+        verifyTransformsInfoProfileElem.appendChild(requestDoc_.importNode(dsigTransforms[i], true));        
+      }
+      Element returnHashInputDataElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "ReturnHashInputData");
+      requestElem_.appendChild(returnHashInputDataElem);
+      Element trustProfileIDElem = requestDoc_.createElementNS(MOA_NS_URI, "TrustProfileID");
+      trustProfileIDElem.appendChild(requestDoc_.createTextNode(trustProfileID));
+      requestElem_.appendChild(trustProfileIDElem);
+    } catch (Throwable t) {
+      throw new ParseException("builder.00", 
+        new Object[] { "VerifyXMLSignatureRequest (IdentityLink)" }, t);
+    }
+
+    return requestElem_;
+  }
+  
+  /**
+   * Builds a <code>&lt;VerifyXMLSignatureRequest&gt;</code>
+   * from an IdentityLink with a known trustProfileID which 
+   * has to exist in MOA-SP
+   * @param identityLink - The IdentityLink
+   * @param trustProfileID - a preconfigured TrustProfile at MOA-SP
+   * 
+   * @return Element - The complete request as Dom-Element
+   * 
+   * @throws ParseException
+   */
+  public Element build(byte[]mandate, String trustProfileID)
+    throws ParseException 
+  { 
+    try {
+      // build the request
+//      Element dateTimeElem = requestDoc_.createElementNS(MOA_NS_URI, "DateTime");
+//      requestElem_.appendChild(dateTimeElem);
+//      Node dateTime = requestDoc_.createTextNode(identityLink.getIssueInstant());
+//      dateTimeElem.appendChild(dateTime);
+      Element verifiySignatureInfoElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureInfo");
+      requestElem_.appendChild(verifiySignatureInfoElem);
+      Element verifySignatureEnvironmentElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureEnvironment");
+      verifiySignatureInfoElem.appendChild(verifySignatureEnvironmentElem);
+      Element base64ContentElem = requestDoc_.createElementNS(MOA_NS_URI, "Base64Content");
+      verifySignatureEnvironmentElem.appendChild(base64ContentElem);
+      // insert the base64 encoded identity link SAML assertion
+      //String serializedAssertion = identityLink.getSerializedSamlAssertion();
+      //String base64EncodedAssertion = Base64Utils.encode(mandate.getBytes("UTF-8"));
+      String base64EncodedAssertion = Base64Utils.encode(mandate);
+      //replace all '\r' characters by no char.
+      StringBuffer replaced = new StringBuffer();
+      for (int i = 0; i < base64EncodedAssertion.length(); i ++) {
+        char c = base64EncodedAssertion.charAt(i);
+        if (c != '\r') {
+          replaced.append(c);
+        }
+      }
+      base64EncodedAssertion = replaced.toString();
+      Node base64Content = requestDoc_.createTextNode(base64EncodedAssertion);
+      base64ContentElem.appendChild(base64Content);      
+      // specify the signature location
+      Element verifySignatureLocationElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureLocation");
+      verifiySignatureInfoElem.appendChild(verifySignatureLocationElem);
+      Node signatureLocation = requestDoc_.createTextNode(DSIG + "Signature");
+      verifySignatureLocationElem.appendChild(signatureLocation);      
+      // signature manifest params
+      Element signatureManifestCheckParamsElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "SignatureManifestCheckParams");
+      requestElem_.appendChild(signatureManifestCheckParamsElem);
+      signatureManifestCheckParamsElem.setAttribute("ReturnReferenceInputData", "false");
+//      // add the transforms
+//      Element referenceInfoElem = requestDoc_.createElementNS(MOA_NS_URI, "ReferenceInfo");
+//      signatureManifestCheckParamsElem.appendChild(referenceInfoElem);
+//      Element[] dsigTransforms = identityLink.getDsigReferenceTransforms();
+//      
+//      for (int i = 0; i < dsigTransforms.length; i++) {        
+//        Element verifyTransformsInfoProfileElem = 
+//          requestDoc_.createElementNS(MOA_NS_URI, "VerifyTransformsInfoProfile");
+//        referenceInfoElem.appendChild(verifyTransformsInfoProfileElem);
+//        verifyTransformsInfoProfileElem.appendChild(requestDoc_.importNode(dsigTransforms[i], true));        
+//      }
+      Element returnHashInputDataElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "ReturnHashInputData");
+      requestElem_.appendChild(returnHashInputDataElem);
+      Element trustProfileIDElem = requestDoc_.createElementNS(MOA_NS_URI, "TrustProfileID");
+      trustProfileIDElem.appendChild(requestDoc_.createTextNode(trustProfileID));
+      requestElem_.appendChild(trustProfileIDElem);
+    } catch (Throwable t) {
+      throw new ParseException("builder.00", 
+        new Object[] { "VerifyXMLSignatureRequest (IdentityLink)" }, t);
+    }
+
+    return requestElem_;
+  }
+  
+  
+  /**
+   * Builds a <code>&lt;VerifyXMLSignatureRequest&gt;</code>
+   * from the signed AUTH-Block with a known trustProfileID which 
+   * has to exist in MOA-SP
+   * @param csr - signed AUTH-Block
+   * @param verifyTransformsInfoProfileID - allowed verifyTransformsInfoProfileID 
+   * @param trustProfileID - a preconfigured TrustProfile at MOA-SP
+   * @return Element - The complete request as Dom-Element
+   * @throws ParseException
+   */
+  public Element build(
+    CreateXMLSignatureResponse csr,
+    String[] verifyTransformsInfoProfileID,
+    String trustProfileID)
+    throws BuildException { //samlAssertionObject
+    
+    try {
+      // build the request
+//      requestElem_.setAttributeNS(Constants.XMLNS_NS_URI, "xmlns:" 
+//        + Constants.XML_PREFIX, Constants.XMLNS_NS_URI);
+      Element verifiySignatureInfoElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureInfo");
+      requestElem_.appendChild(verifiySignatureInfoElem);
+      Element verifySignatureEnvironmentElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureEnvironment");
+      verifiySignatureInfoElem.appendChild(verifySignatureEnvironmentElem);
+      Element xmlContentElem = requestDoc_.createElementNS(MOA_NS_URI, "XMLContent");
+      verifySignatureEnvironmentElem.appendChild(xmlContentElem);
+      xmlContentElem.setAttribute(Constants.XML_PREFIX + ":space", "preserve");
+      // insert the SAML assertion
+      xmlContentElem.appendChild(requestDoc_.importNode(csr.getSamlAssertion(), true));          
+      // specify the signature location
+      Element verifySignatureLocationElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureLocation");
+      verifiySignatureInfoElem.appendChild(verifySignatureLocationElem);
+      Node signatureLocation = requestDoc_.createTextNode(DSIG + "Signature");
+      verifySignatureLocationElem.appendChild(signatureLocation);      
+      // signature manifest params
+      Element signatureManifestCheckParamsElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "SignatureManifestCheckParams");
+      requestElem_.appendChild(signatureManifestCheckParamsElem);
+      signatureManifestCheckParamsElem.setAttribute("ReturnReferenceInputData", "true");
+      // add the transform profile IDs
+      Element referenceInfoElem = requestDoc_.createElementNS(MOA_NS_URI, "ReferenceInfo");
+        signatureManifestCheckParamsElem.appendChild(referenceInfoElem);
+      for (int i = 0; i < verifyTransformsInfoProfileID.length; i++) {
+        Element verifyTransformsInfoProfileIDElem = 
+          requestDoc_.createElementNS(MOA_NS_URI, "VerifyTransformsInfoProfileID");
+        referenceInfoElem.appendChild(verifyTransformsInfoProfileIDElem);
+        verifyTransformsInfoProfileIDElem.appendChild(
+          requestDoc_.createTextNode(verifyTransformsInfoProfileID[i]));        
+      }
+      Element returnHashInputDataElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "ReturnHashInputData");
+      requestElem_.appendChild(returnHashInputDataElem);
+      Element trustProfileIDElem = requestDoc_.createElementNS(MOA_NS_URI, "TrustProfileID");
+      trustProfileIDElem.appendChild(requestDoc_.createTextNode(trustProfileID));
+      requestElem_.appendChild(trustProfileIDElem);
+
+    } catch (Throwable t) {
+      throw new BuildException("builder.00", new Object[] { "VerifyXMLSignatureRequest" }, t);
+    }
+
+    return requestElem_;
+  }
+  
+  /**
+   * Builds a <code>&lt;VerifyXMLSignatureRequest&gt;</code>
+   * from the signed data with a known trustProfileID which 
+   * has to exist in MOA-SP
+   * @param csr - signed AUTH-Block
+   * @param trustProfileID - a preconfigured TrustProfile at MOA-SP
+   * @return Element - The complete request as Dom-Element
+   * @throws ParseException
+   */
+  public Element buildDsig(
+    CreateXMLSignatureResponse csr,
+    String trustProfileID)
+    throws BuildException { //samlAssertionObject
+    
+    try {
+      // build the request
+//      requestElem_.setAttributeNS(Constants.XMLNS_NS_URI, "xmlns:" 
+//        + Constants.XML_PREFIX, Constants.XMLNS_NS_URI);
+     
+      Element verifiySignatureInfoElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureInfo");
+      requestElem_.appendChild(verifiySignatureInfoElem);
+      Element verifySignatureEnvironmentElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureEnvironment");
+      verifiySignatureInfoElem.appendChild(verifySignatureEnvironmentElem);
+      
+      Element xmlContentElem = requestDoc_.createElementNS(MOA_NS_URI, "XMLContent");
+      verifySignatureEnvironmentElem.appendChild(xmlContentElem);
+      xmlContentElem.setAttribute(Constants.XML_PREFIX + ":space", "preserve");
+      
+      // insert the dsig:Signature
+      xmlContentElem.appendChild(requestDoc_.importNode(csr.getDsigSignature(), true));          
+      // specify the signature location
+      Element verifySignatureLocationElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureLocation");
+      verifiySignatureInfoElem.appendChild(verifySignatureLocationElem);
+      Node signatureLocation = requestDoc_.createTextNode("/"+ DSIG + "Signature");
+      verifySignatureLocationElem.appendChild(signatureLocation);      
+      // signature manifest params
+      Element signatureManifestCheckParamsElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "SignatureManifestCheckParams");
+      requestElem_.appendChild(signatureManifestCheckParamsElem);
+      signatureManifestCheckParamsElem.setAttribute("ReturnReferenceInputData", "true");
+      // add the transform profile IDs
+      Element referenceInfoElem = requestDoc_.createElementNS(MOA_NS_URI, "ReferenceInfo");
+        signatureManifestCheckParamsElem.appendChild(referenceInfoElem);
+        
+      Element returnHashInputDataElem = 
+        requestDoc_.createElementNS(MOA_NS_URI, "ReturnHashInputData");
+      requestElem_.appendChild(returnHashInputDataElem);
+      Element trustProfileIDElem = requestDoc_.createElementNS(MOA_NS_URI, "TrustProfileID");
+      
+      trustProfileIDElem.appendChild(requestDoc_.createTextNode(trustProfileID));
+      requestElem_.appendChild(trustProfileIDElem);
+
+    } catch (Throwable t) {
+      throw new BuildException("builder.00", new Object[] { "VerifyXMLSignatureRequest" }, t);
+    }
+
+    return requestElem_;
+  }
+
+}