refactor authentication process to use service-provider configuration from pending-request

4 files changed, 57 insertions, 4 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/AbstractAuthServletTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/AbstractAuthServletTask.java
index a73fd6858..66f91266f 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/AbstractAuthServletTask.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/AbstractAuthServletTask.java
@@ -7,6 +7,7 @@ import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.HEADER_VALUE_CACH
 import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE;

 import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.HEADER_VALUE_EXPIRES;

 import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.HEADER_VALUE_PRAGMA;

+import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID;

 

 import java.io.ByteArrayOutputStream;

 import java.io.IOException;

@@ -29,19 +30,24 @@ import org.apache.commons.fileupload.FileItemFactory;
 import org.apache.commons.fileupload.FileUploadException;

 import org.apache.commons.fileupload.disk.DiskFileItemFactory;

 import org.apache.commons.fileupload.servlet.ServletFileUpload;

+import org.apache.commons.lang.StringEscapeUtils;

 import org.apache.commons.lang3.ArrayUtils;

+import org.apache.commons.lang3.ObjectUtils;

 import org.springframework.beans.factory.annotation.Autowired;

 

 import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;

 import at.gv.egovernment.moa.id.advancedlogging.StatisticLogger;

 import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;

+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;

 import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

 import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;

 import at.gv.egovernment.moa.id.config.ConfigurationException;

 import at.gv.egovernment.moa.id.config.auth.AuthConfiguration;

+import at.gv.egovernment.moa.id.moduls.IRequest;

 import at.gv.egovernment.moa.id.moduls.IRequestStorage;

+import at.gv.egovernment.moa.id.process.api.ExecutionContext;

 import at.gv.egovernment.moa.id.process.springweb.MoaIdTask;

 import at.gv.egovernment.moa.id.protocols.AbstractProtocolModulController;

 import at.gv.egovernment.moa.id.storage.IAuthenticationSessionStoreage;

@@ -66,6 +72,51 @@ public abstract class AbstractAuthServletTask extends MoaIdTask {
 	

 	protected static final String ERROR_CODE_PARAM = "errorid";

 

+	protected IRequest pendingReq = null;

+	protected AuthenticationSession moasession = null;

+	

+	protected void defaultTaskInitialization(HttpServletRequest req, ExecutionContext executionContext) throws MOAIDException, MOADatabaseException {

+		String pendingRequestID = StringEscapeUtils.escapeHtml(

+				ObjectUtils.defaultIfNull(

+						(String) executionContext.get(PARAM_TARGET_PENDINGREQUESTID),

+						req.getParameter(PARAM_TARGET_PENDINGREQUESTID)));

+		

+		if (MiscUtil.isEmpty(pendingRequestID)) {				

+			Logger.info("No PendingRequestID received");

+			throw new MOAIDException("auth.10", new Object[]{"VerifyIdentityLink", "pendingRequestID"});

+		}

+		

+		pendingReq = requestStoreage.getPendingRequest(pendingRequestID);	

+	

+		if (pendingReq == null) {

+			Logger.info("No PendingRequest with Id: " + pendingRequestID + " Maybe, a transaction timeout occure.");

+			throw new MOAIDException("auth.28", new Object[]{pendingRequestID});

+			

+		}

+					

+		//change pending-request ID

+		String newPendingRequestID = requestStoreage.changePendingRequestID(pendingReq);

+		executionContext.put(MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID, newPendingRequestID);

+								

+		try {			

+			moasession  = authenticatedSessionStorage.getSession(pendingReq.getMOASessionIdentifier());

+		

+			if (moasession == null) {

+				Logger.warn("MOASessionID is empty.");

+				throw new MOAIDException("auth.18", new Object[] {});

+			}

+			

+		} catch (MOADatabaseException e) {

+			Logger.info("MOASession with SessionID=" + pendingReq.getMOASessionIdentifier() + " is not found in Database");

+			throw new MOAIDException("init.04", new Object[] { pendingReq.getMOASessionIdentifier() });

+

+		} catch (Throwable e) {

+			Logger.info("No HTTP Session found!");

+			throw new MOAIDException("auth.18", new Object[] {});

+		}

+		

+	}

+	

 	protected void handleErrorNoRedirect(String errorMessage, Throwable exceptionThrown,

 			HttpServletRequest req, HttpServletResponse resp) {

 

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateInterfedeartionRequestTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateInterfedeartionRequestTask.java
index f1ab58ee0..053f5d7ff 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateInterfedeartionRequestTask.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateInterfedeartionRequestTask.java
@@ -53,6 +53,7 @@ import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
 import at.gv.egovernment.moa.id.config.ConfigurationException;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
+import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
 import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
 import at.gv.egovernment.moa.id.moduls.IRequest;
 import at.gv.egovernment.moa.id.moduls.RequestImpl;
@@ -103,7 +104,7 @@ public class CreateInterfedeartionRequestTask extends AbstractAuthServletTask {
 		
 		try {
 			OAAuthParameter idp = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(idpEntityID);
-			OAAuthParameter sp = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(pendingReq.getOAURL());
+			IOAAuthParameters sp = pendingReq.getOnlineApplicationConfiguration();
 		
 			String requestedIDP = pendingReq.getGenericData(RequestImpl.DATAID_INTERFEDERATIOIDP_URL, String.class);
 			
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/EvaluateBKUSelectionTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/EvaluateBKUSelectionTask.java
index fe3e8680c..9db5baeab 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/EvaluateBKUSelectionTask.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/EvaluateBKUSelectionTask.java
@@ -56,7 +56,7 @@ public class EvaluateBKUSelectionTask extends AbstractAuthServletTask {
 			throws TaskExecutionException {		
 		try {
 			//load pending request
-			String pendingReqID = request.getParameter(MOAIDAuthConstants.PARAM_SESSIONID);	    		    
+			String pendingReqID = request.getParameter(MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID);	    		    
 			pendingReqID = StringEscapeUtils.escapeHtml(pendingReqID);						
 			IRequest pendingReq = requestStoreage.getPendingRequest(pendingReqID);
 			
@@ -86,7 +86,8 @@ public class EvaluateBKUSelectionTask extends AbstractAuthServletTask {
 				Enumeration<String> reqParamNames = request.getParameterNames();
 				while(reqParamNames.hasMoreElements()) {
 					String paramName = reqParamNames.nextElement();
-					if (MiscUtil.isNotEmpty(paramName))
+					if (MiscUtil.isNotEmpty(paramName) && 
+							!MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID.equalsIgnoreCase(paramName))
 						executionContext.put(paramName, request.getParameter(paramName));
 					
 				}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateBKUSelectionFrameTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateBKUSelectionFrameTask.java
index 1bdc132d9..cb0b63276 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateBKUSelectionFrameTask.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateBKUSelectionFrameTask.java
@@ -80,7 +80,7 @@ public class GenerateBKUSelectionFrameTask extends AbstractAuthServletTask {
 			if (publicURLPreFix.endsWith("/"))
 				publicURLPreFix = publicURLPreFix.substring(0, publicURLPreFix.length() - 1);
 			String loginForm = LoginFormBuilder.buildLoginForm(pendingReq.requestedModule(), 
-					pendingReq.requestedAction(), oaParam, publicURLPreFix, MOAIDAuthConstants.PARAM_SESSIONID);
+					pendingReq.requestedAction(), oaParam, publicURLPreFix, pendingReq.getRequestID());
 						
 			response.setContentType("text/html;charset=UTF-8");
 			PrintWriter out = new PrintWriter(response.getOutputStream());