Pre-Release Version 1.5.0tags/1.5.0-Pre-Release

git-svn-id: https://joinup.ec.europa.eu/svn/moa-idspss/tags/1.5.0-Pre-Release@1205 d688527b-c9ab-4aba-bd8d-4036d912da1d

11 files changed, 2247 insertions, 0 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java
new file mode 100644
index 000000000..109d17d11
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java
@@ -0,0 +1,249 @@
+/*
+* Copyright 2003 Federal Chancellery Austria
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egovernment.moa.id.auth.servlet;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Enumeration;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import javax.servlet.RequestDispatcher;
+import javax.servlet.ServletConfig;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.fileupload.FileItem;
+import org.apache.commons.fileupload.FileItemFactory;
+import org.apache.commons.fileupload.FileUploadException;
+import org.apache.commons.fileupload.disk.DiskFileItemFactory;
+import org.apache.commons.fileupload.servlet.ServletFileUpload;
+
+import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.auth.WrongParametersException;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.URLDecoder;
+
+/**
+ * Base class for MOA-ID Auth Servlets, providing standard error handling
+ * and constant names.
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class AuthServlet extends HttpServlet implements MOAIDAuthConstants {
+
+
+  /**
+   * Handles an error. <br>>
+   * <ul>
+   * <li>Logs the error</li>
+   * <li>Places error message and exception thrown into the request 
+   * 		 as request attributes (to be used by <code>"/errorpage-auth.jsp"</code>)</li>
+   * <li>Sets HTTP status 500 (internal server error)</li>
+   * </ul>
+   * 
+   * @param errorMessage error message
+   * @param exceptionThrown exception thrown
+   * @param req servlet request
+   * @param resp servlet response
+   */
+	protected void handleError(
+		String errorMessage, Throwable exceptionThrown, HttpServletRequest req, HttpServletResponse resp) {
+
+		
+		if(null != errorMessage) {
+			Logger.error(errorMessage);
+			req.setAttribute("ErrorMessage", errorMessage	);	
+		}
+		
+		
+		if (null != exceptionThrown) {
+			if(null == errorMessage) errorMessage = exceptionThrown.getMessage();
+			Logger.error(errorMessage, exceptionThrown);
+			req.setAttribute("ExceptionThrown", exceptionThrown);
+		}
+		
+		if (Logger.isDebugEnabled()) {
+		   req.setAttribute("LogLevel", "debug");
+		}
+				
+		//forward this to errorpage-auth.jsp where the HTML error page is generated
+		ServletContext context = getServletContext();
+		RequestDispatcher dispatcher = context.getRequestDispatcher("/errorpage-auth.jsp");
+		try		{
+			
+			 resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);
+				resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);
+				resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
+				resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);
+			
+      dispatcher.forward(req, resp);
+    } catch (ServletException e) {
+      Logger.error(e);
+    } catch (IOException e) {
+			Logger.error(e);
+    }
+		
+	}
+  /**
+   * Handles a <code>WrongParametersException</code>.
+   * @param req servlet request
+   * @param resp servlet response
+   */
+  protected void handleWrongParameters(WrongParametersException ex, HttpServletRequest req, HttpServletResponse resp) {
+    Logger.error(ex.toString());
+    req.setAttribute("WrongParameters", ex.getMessage());
+
+    //	forward this to errorpage-auth.jsp where the HTML error page is generated 
+    ServletContext context = getServletContext();
+    RequestDispatcher dispatcher = context.getRequestDispatcher("/errorpage-auth.jsp");
+    try {
+    	resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);
+		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);
+		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
+		resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);
+		
+      dispatcher.forward(req, resp);
+    } catch (ServletException e) {
+      Logger.error(e);
+    } catch (IOException e) {
+      Logger.error(e);
+    }
+  }
+  
+  /**
+   * Logs all servlet parameters for debugging purposes.
+   */
+  protected void logParameters(HttpServletRequest req) {
+    for (Enumeration params = req.getParameterNames(); params.hasMoreElements(); ) {
+      String parname = (String)params.nextElement();
+      Logger.debug("Parameter " + parname + req.getParameter(parname));    
+    }
+  }
+  
+  /**
+     * Parses the request input stream for parameters, assuming parameters are encoded UTF-8
+     * (no standard exists how browsers should encode them).
+     * 
+     * @param req servlet request
+     * 
+     * @return mapping parameter name -> value
+     * 
+     * @throws IOException if parsing request parameters fails.
+     * 
+     * @throws FileUploadException if parsing request parameters fails.
+     */
+  protected Map getParameters(HttpServletRequest req) 
+    throws IOException, FileUploadException {
+    
+    Map parameters = new HashMap();
+
+ 
+    if (ServletFileUpload.isMultipartContent(req))
+    {
+      // request is encoded as mulitpart/form-data
+      FileItemFactory factory = new DiskFileItemFactory();
+      ServletFileUpload upload = null;
+      upload = new ServletFileUpload(factory);
+      List items = null;
+      items = upload.parseRequest(req);
+      for (int i = 0; i < items.size(); i++)
+      {
+        FileItem item = (FileItem) items.get(i);
+        if (item.isFormField())
+        {
+          // Process only form fields - no file upload items
+          String logString =  item.getString("UTF-8");
+       
+          // TODO use RegExp
+          String startS = "<pr:Identification><pr:Value>";
+          String endS = "</pr:Value><pr:Type>urn:publicid:gv.at:baseid</pr:Type>";
+          String logWithMaskedBaseid = logString;
+          int start = logString.indexOf(startS);
+          if (start > -1) {
+             int end = logString.indexOf(endS);
+             if (end > -1) {
+                logWithMaskedBaseid = logString.substring(0, start);
+                logWithMaskedBaseid += startS;
+                logWithMaskedBaseid += "xxxxxxxxxxxxxxxxxxxxxxxx";
+                logWithMaskedBaseid += logString.substring(end, logString.length());
+             }
+          }
+          parameters.put(item.getFieldName(), item.getString("UTF-8"));
+          Logger.debug("Processed multipart/form-data request parameter: \nName: " +
+              item.getFieldName() + "\nValue: " + 
+              logWithMaskedBaseid);
+        }
+      }
+    }
+    
+    else
+    {
+      // request is encoded as application/x-www-urlencoded
+      InputStream in = req.getInputStream();
+
+      String paramName;
+      String paramValueURLEncoded;
+      do {
+        paramName = new String(readBytesUpTo(in, '='));
+        if (paramName.length() > 0) {
+          paramValueURLEncoded = readBytesUpTo(in, '&');
+          String paramValue = URLDecoder.decode(paramValueURLEncoded, "UTF-8");
+          parameters.put(paramName, paramValue);
+        }
+      }
+      while (paramName.length() > 0);
+      in.close();
+    }
+
+    return parameters;
+  }
+  
+  /**
+     * Reads bytes up to a delimiter, consuming the delimiter.
+     * @param in input stream
+     * @param delimiter delimiter character
+     * @return String constructed from the read bytes
+     * @throws IOException
+     */
+  protected String readBytesUpTo(InputStream in, char delimiter) throws IOException {
+    ByteArrayOutputStream bout = new ByteArrayOutputStream();
+    boolean done = false;
+    int b;
+    while (! done && (b = in.read()) >= 0) {
+      if (b == delimiter)
+        done = true;
+      else
+        bout.write(b);
+    }
+    return bout.toString();
+  }
+	
+	/**
+	 * Calls the web application initializer.
+	 * 
+	 * @see javax.servlet.Servlet#init(ServletConfig)
+	 */
+	public void init(ServletConfig servletConfig) throws ServletException {
+		super.init(servletConfig);
+	}
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ConfigurationServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ConfigurationServlet.java
new file mode 100644
index 000000000..a9082dd8e
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ConfigurationServlet.java
@@ -0,0 +1,97 @@
+/*
+* Copyright 2003 Federal Chancellery Austria
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egovernment.moa.id.auth.servlet;
+
+import java.io.IOException;
+import java.text.DateFormat;
+import java.util.Date;
+import java.util.Locale;
+
+import javax.servlet.ServletConfig;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.auth.MOAIDAuthInitializer;
+import at.gv.egovernment.moa.id.util.HTTPRequestJSPForwarder;
+import at.gv.egovernment.moa.id.util.MOAIDMessageProvider;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * Servlet requested for updating the MOA-ID Auth configuration from configuration file
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class ConfigurationServlet extends HttpServlet {
+
+  /**
+   * Handle a HTTP GET request, used to indicated that the MOA
+   * configuration needs to be updated (reloaded).
+   * 
+   * @see javax.servlet.http.HttpServlet#doGet(HttpServletRequest, HttpServletResponse)
+   */
+  public void doGet(HttpServletRequest request, HttpServletResponse response)
+    throws ServletException, IOException {
+
+	  	  
+	  response.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);
+	  response.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);
+	  response.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
+	  response.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);
+	  
+    MOAIDMessageProvider msg = MOAIDMessageProvider.getInstance();
+
+    try {
+      MOAIDAuthInitializer.initialized=false;
+      MOAIDAuthInitializer.initialize();
+      String message = msg.getMessage("config.00", new Object[] 
+      	{ DateFormat.getTimeInstance(DateFormat.MEDIUM, Locale.GERMAN).format(new Date())} );
+            
+      Logger.info(message);
+			HTTPRequestJSPForwarder.forwardNamed(message, "/message-auth.jsp", getServletContext(), request, response);
+			
+    } catch (Throwable t) {
+      String errorMessage = msg.getMessage("config.04", null);
+      Logger.error(errorMessage, t);
+			HTTPRequestJSPForwarder.forwardNamed(errorMessage, "/message-auth.jsp", getServletContext(), request, response);
+    }
+  }
+
+  /**
+   * Do the same as <code>doGet</code>.
+   * 
+   * @see javax.servlet.http.HttpServlet#doPost(HttpServletRequest, HttpServletResponse)
+   */
+  public void doPost(HttpServletRequest request, HttpServletResponse response)
+    throws ServletException, IOException {
+    doGet(request, response);
+  }
+	
+	/**
+	 * Calls the web application initializer.
+	 * 
+	 * @see javax.servlet.Servlet#init(ServletConfig)
+	 */
+	public void init(ServletConfig servletConfig) throws ServletException {
+		super.init(servletConfig);
+	}
+
+}
+
+
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetAuthenticationDataService.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetAuthenticationDataService.java
new file mode 100644
index 000000000..0e3aae185
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetAuthenticationDataService.java
@@ -0,0 +1,150 @@
+/*
+* Copyright 2003 Federal Chancellery Austria
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egovernment.moa.id.auth.servlet;
+
+import java.util.Calendar;
+
+import org.apache.axis.AxisFault;
+import org.w3c.dom.Element;
+
+import org.w3c.dom.NodeList;
+
+import at.gv.egovernment.moa.id.AuthenticationException;
+import at.gv.egovernment.moa.id.MOAIDException;
+import at.gv.egovernment.moa.id.auth.AuthenticationServer;
+import at.gv.egovernment.moa.id.auth.builder.SAMLResponseBuilder;
+import at.gv.egovernment.moa.id.data.AuthenticationData;
+import at.gv.egovernment.moa.id.util.MOAIDMessageProvider;
+import at.gv.egovernment.moa.id.util.Random;
+import at.gv.egovernment.moa.util.Constants;
+import at.gv.egovernment.moa.util.DOMUtils;
+import at.gv.egovernment.moa.util.DateTimeUtils;
+import at.gv.egovernment.moa.util.XPathUtils;
+
+/**
+ * Web service for picking up authentication data created in the MOA-ID Auth component.
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ * @see at.gv.egovernment.moa.id.auth.AuthenticationServer#getAuthenticationData
+ */
+public class GetAuthenticationDataService implements Constants {
+
+  /**
+   * Constructor for GetAuthenticationDataService.
+   */
+  public GetAuthenticationDataService() {
+    super();
+  }
+
+	/**
+	 * Takes a <code>lt;samlp:Request&gt;</code> containing a 
+	 * <code>SAML artifact</code> and returns the corresponding 
+	 * authentication data <code>lt;saml:Assertion&gt;</code> 
+	 * (obtained from the <code>AuthenticationServer</code>),
+	 * enclosed in a <code>lt;samlp:Response&gt;</code>.
+	 * <br/>Bad requests are mapped into various <code>lt;samlp:StatusCode&gt;</code>s,
+	 * possibly containing enclosed sub-<code>lt;samlp:StatusCode&gt;</code>s.
+	 * The status codes are defined in the SAML specification.
+	 * 
+	 * @param requests request elements of type <code>lt;samlp:Request&gt;</code>;
+	 * 				 only 1 request element is allowed
+	 * @return response element of type <code>lt;samlp:Response&gt;</code>,
+	 * 				  packed into an <code>Element[]</code>
+	 * @throws AxisFault thrown when an error occurs in assembling the 
+	 * 					<code>lt;samlp:Response&gt;</code>
+	 */
+  public Element[] Request(Element[] requests) 
+  	throws AxisFault {
+  		
+		Element request = requests[0];
+    Element[] responses = new Element[1];
+		String requestID = "";
+		String statusCode = "";
+		String subStatusCode = null;
+		String statusMessageCode = null;
+    String statusMessage = null;
+		String samlAssertion = "";
+		if (requests.length > 1) {
+			// more than 1 request given as parameter
+			statusCode = "samlp:Requester";
+			subStatusCode = "samlp:TooManyResponses";
+			statusMessageCode = "1201";
+		}
+		else {
+			try {
+				DOMUtils.validateElement(request, ALL_SCHEMA_LOCATIONS, null);
+				NodeList samlArtifactList = XPathUtils.selectNodeList(request, "samlp:AssertionArtifact");
+				if (samlArtifactList.getLength() == 0) {
+					// no SAML artifact given in request
+					statusCode = "samlp:Requester";
+					statusMessageCode = "1202";
+				}
+				else if (samlArtifactList.getLength() > 1) {
+					// too many SAML artifacts given in request
+					statusCode = "samlp:Requester";
+					subStatusCode = "samlp:TooManyResponses";
+					statusMessageCode = "1203";
+				}
+				else {
+					Element samlArtifactElem = (Element)samlArtifactList.item(0);
+                    requestID = request.getAttribute("RequestID");
+					String samlArtifact = DOMUtils.getText(samlArtifactElem);
+					try {
+            AuthenticationData authData = AuthenticationServer.getInstance().
+  						getAuthenticationData(samlArtifact);
+            // success
+            samlAssertion = authData.getSamlAssertion();
+            statusCode = "samlp:Success";
+            statusMessageCode = "1200";
+          }
+          catch (AuthenticationException ex) {
+						// no authentication data for given SAML artifact
+						statusCode = "samlp:Requester";
+						subStatusCode = "samlp:ResourceNotRecognized";
+						statusMessage = ex.toString();
+					}
+				}
+			}
+	    catch (Throwable t) {
+	    	// invalid request format
+				statusCode = "samlp:Requester";
+				statusMessageCode = "1204";
+	    }
+		}
+    try {
+			String responseID = Random.nextRandom();
+			String issueInstant = DateTimeUtils.buildDateTime(Calendar.getInstance());
+      if (statusMessage == null)
+			  statusMessage = MOAIDMessageProvider.getInstance().getMessage(statusMessageCode, null);
+	    responses[0] = new SAMLResponseBuilder().build(
+	    	responseID, requestID, issueInstant, statusCode, subStatusCode, statusMessage, samlAssertion);
+  	}
+    catch (MOAIDException e) {
+	    AxisFault fault = AxisFault.makeFault(e);
+	    fault.setFaultDetail(new Element[] { e.toErrorResponse()});
+	    throw fault;
+    } 
+    catch (Throwable t) {
+	    MOAIDException e = new MOAIDException("1299", null, t);
+	    AxisFault fault = AxisFault.makeFault(e);
+	    fault.setFaultDetail(new Element[] { e.toErrorResponse()});
+	    throw fault;
+    }
+    return responses;
+  }
+  	
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetForeignIDServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetForeignIDServlet.java
new file mode 100644
index 000000000..9a6670617
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetForeignIDServlet.java
@@ -0,0 +1,309 @@
+package at.gv.egovernment.moa.id.auth.servlet;

+

+import iaik.pki.PKIException;

+

+import java.io.IOException;

+import java.security.GeneralSecurityException;

+import java.util.Map;

+

+import javax.servlet.ServletException;

+import javax.servlet.http.HttpServletRequest;

+import javax.servlet.http.HttpServletResponse;

+import javax.xml.transform.TransformerException;

+

+import org.apache.commons.fileupload.FileUploadException;

+import org.apache.commons.lang.StringEscapeUtils;

+import org.w3c.dom.Document;

+import org.w3c.dom.Element;

+

+import at.gv.egovernment.moa.id.MOAIDException;

+import at.gv.egovernment.moa.id.auth.AuthenticationServer;

+import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;

+import at.gv.egovernment.moa.id.auth.WrongParametersException;

+import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;

+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

+import at.gv.egovernment.moa.id.auth.data.CreateXMLSignatureResponse;

+import at.gv.egovernment.moa.id.auth.data.IdentityLink;

+import at.gv.egovernment.moa.id.auth.parser.CreateXMLSignatureResponseParser;

+import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser;

+import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.CreateIdentityLinkResponse;

+import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWClient;

+import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWClientException;

+import at.gv.egovernment.moa.id.config.ConfigurationException;

+import at.gv.egovernment.moa.id.config.ConnectionParameter;

+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;

+import at.gv.egovernment.moa.id.util.MOAIDMessageProvider;

+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;

+import at.gv.egovernment.moa.id.util.SSLUtils;

+import at.gv.egovernment.moa.logging.Logger;

+import at.gv.egovernment.moa.util.DOMUtils;

+import at.gv.egovernment.moa.util.URLEncoder;

+

+/**

+ * Servlet requested for getting the foreign eID

+ * provided by the security layer implementation.

+ * Utilizes the {@link AuthenticationServer}.

+ *

+ */

+public class GetForeignIDServlet extends AuthServlet {

+

+  /**

+   * Constructor for GetForeignIDServlet.

+   */

+  public GetForeignIDServlet() {

+    super();

+  }

+

+  /**

+   * GET requested by security layer implementation to verify

+   * that data URL resource is available.

+   * @see javax.servlet.http.HttpServlet#doGet(HttpServletRequest, HttpServletResponse)

+   */

+  protected void doGet(HttpServletRequest req, HttpServletResponse resp)

+    throws ServletException, IOException { 

+    	

+		Logger.debug("GET GetForeignIDServlet");

+

+		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);

+		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);

+		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);

+		resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);

+

+		

+  }

+

+  /**

+   * Verifies the identity link and responds with a new 

+   * <code>CreateXMLSignatureRequest</code>.

+   * <br>

+   * Request parameters:

+   * <ul>

+   * <li>MOASessionID: ID of associated authentication session</li>

+   * <li>XMLResponse: <code>&lt;InfoboxReadResponse&gt;</code></li>

+   * </ul>

+   * Response:

+   * <ul>

+   * <li>Content type: <code>"text/xml"</code></li>

+   * <li>Content: see return value of {@link AuthenticationServer#verifyIdentityLink}</li>

+   * <li>Error status: <code>500</code>

+   * </ul>

+   * @see javax.servlet.http.HttpServlet#doPost(HttpServletRequest, HttpServletResponse)

+   */

+  protected void doPost(HttpServletRequest req, HttpServletResponse resp)

+    throws ServletException, IOException {

+

+		Logger.debug("POST GetForeignIDServlet");

+		

+		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);

+		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);

+		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);

+		resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);

+		

+		Map parameters;

+	    try 

+	    {

+	      parameters = getParameters(req);

+	    } catch (FileUploadException e) 

+	    {

+	      Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());

+	      throw new IOException(e.getMessage());

+	     	}

+	    String sessionID = req.getParameter(PARAM_SESSIONID);

+	    

+	    // escape parameter strings

+	    sessionID = StringEscapeUtils.escapeHtml(sessionID);

+	    

+	    String redirectURL = null;

+	    AuthenticationSession session = null;

+	    try {

+	    	String xmlCreateXMLSignatureResponse = (String)parameters.get(PARAM_XMLRESPONSE);

+	    	

+          // check parameter

+          if (!ParamValidatorUtils.isValidSessionID(sessionID))

+             throw new WrongParametersException("GetForeignID", PARAM_SESSIONID, "auth.12");

+          if (!ParamValidatorUtils.isValidXMLDocument(xmlCreateXMLSignatureResponse))

+              throw new WrongParametersException("GetForeignID", PARAM_XMLRESPONSE, "auth.12");

+

+	    	session = AuthenticationServer.getSession(sessionID);

+	    	

+	    	

+	    	

+	    	Logger.debug(xmlCreateXMLSignatureResponse);

+	    	

+	    	CreateXMLSignatureResponse csresp =

+	    	      new CreateXMLSignatureResponseParser(xmlCreateXMLSignatureResponse).parseResponseDsig();

+

+	    	Element signature = csresp.getDsigSignature();

+	    	

+	    	// make SZR request to the identity link

+	    	CreateIdentityLinkResponse response = getIdentityLink(signature);

+	    	

+	   	    	

+	    	if (response.isError()) {	    		

+	    		throw new SZRGWClientException(response.getError());

+	    	}

+	    	else {

+	    		

+	    		Element samlAssertion = response.getAssertion();

+	    		

+//	    		try {

+//					System.out.println(DOMUtils.serializeNode(samlAssertion));

+//				} catch (TransformerException e) {

+//					// TODO Auto-generated catch block

+//					e.printStackTrace();

+//				}

+		    	

+		    	IdentityLinkAssertionParser ilParser = new IdentityLinkAssertionParser(samlAssertion);

+		    	IdentityLink identitylink = ilParser.parseIdentityLink();

+		    	session.setIdentityLink(identitylink);

+	  	   	

+		    	String samlArtifactBase64 = 

+		    		AuthenticationServer.getInstance().getForeignAuthenticationData(sessionID);

+		    	if (!samlArtifactBase64.equals("Redirect to Input Processor")) {

+		    		redirectURL = session.getOAURLRequested();

+		    		if (!session.getBusinessService()) {

+		    			redirectURL = addURLParameter(redirectURL, PARAM_TARGET, URLEncoder.encode(session.getTarget(), "UTF-8"));

+		    		}

+		    		redirectURL = addURLParameter(redirectURL, PARAM_SAMLARTIFACT, URLEncoder.encode(samlArtifactBase64, "UTF-8"));

+		    		redirectURL = resp.encodeRedirectURL(redirectURL);

+		    	} else {

+		    		redirectURL = new DataURLBuilder().buildDataURL(session.getAuthURL(), AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, session.getSessionID());

+		    	}

+		    	resp.setContentType("text/html");

+		    	resp.setStatus(302);

+		    	resp.addHeader("Location", redirectURL);

+		    	Logger.debug("REDIRECT TO: " + redirectURL);

+	    	}

+	    	    		      

+	    }

+	    catch (MOAIDException ex) {

+	      handleError(null, ex, req, resp);

+	    } 

+	    catch (SZRGWClientException ex) {

+	       handleError(null, ex, req, resp);

+		}

+  }

+    

+  /**

+   * Adds a parameter to a URL.

+   * @param url the URL

+   * @param paramname parameter name

+   * @param paramvalue parameter value

+   * @return the URL with parameter added

+   */

+  private static String addURLParameter(String url, String paramname, String paramvalue) {

+		String param = paramname + "=" + paramvalue;

+  	if (url.indexOf("?") < 0)

+	  	return url + "?" + param;

+  	else

+  		return url + "&" + param;

+  }

+  

+  /**

+   * Does the request to the SZR-GW

+   * @param signature XMLDSIG signature

+   * @return Identity link assertion

+ * @throws SZRGWClientException 

+   */

+     private CreateIdentityLinkResponse getIdentityLink(Element signature) throws SZRGWClientException {

+

+	    SZRGWClient client = new SZRGWClient();

+	 

+	    try {

+	    	AuthConfigurationProvider authConf = AuthConfigurationProvider.getInstance();

+	    	ConnectionParameter connectionParameters = authConf.getForeignIDConnectionParameter();

+

+	    	client.setAddress(connectionParameters.getUrl());

+	    	if (connectionParameters.getUrl().toLowerCase().startsWith("https:")) {

+	    		Logger.debug("Initialisiere SSL Verbindung");

+	    		try {

+	    			client.setSSLSocketFactory(SSLUtils.getSSLSocketFactory(AuthConfigurationProvider.getInstance(), connectionParameters));

+	    		} catch (IOException e) {

+	    			Logger.error("Could not initialize SSL Factory", e);

+	    			throw new SZRGWClientException("Could not initialize SSL Factory");

+	    		} catch (GeneralSecurityException e) {

+	    			Logger.error("Could not initialize SSL Factory", e);

+	    			throw new SZRGWClientException("Could not initialize SSL Factory");

+	    		} catch (PKIException e) {

+	    			Logger.error("Could not initialize SSL Factory", e);

+	    			throw new SZRGWClientException("Could not initialize SSL Factory");

+	    		} 

+	    	}

+	    	Logger.info("Starte Kommunikation mit dem Stammzahlenregister Gateway(" + connectionParameters.getUrl() + ")...");

+	    }

+	    catch (ConfigurationException e) {

+	    	Logger.warn(e);

+	    	Logger.warn(MOAIDMessageProvider.getInstance().getMessage("config.12", null ));

+	    }

+	    

+	    // create request

+	    CreateIdentityLinkResponse response = null;

+	    Element request = null;

+	    try {

+	    	Document doc = client.buildGetIdentityLinkRequest(null, null, null, null, signature);

+	    	request = doc.getDocumentElement();

+	    	

+	    	// send request

+	    	response = client.createIdentityLinkResponse(request);

+	    } catch (SZRGWClientException e) {

+	    	// 	give him a second try - Nach dem Starten des Tomcat wird beim ersten Mal das Client-Zertifikat offenbar vom HTTPClient nicht mitgeschickt.

+	    	try {

+	    		response = client.createIdentityLinkResponse(request);

+	    	} 

+	    	catch (SZRGWClientException e1) {

+	    		throw new SZRGWClientException(e1);

+	    	}

+	    }

+        

+	    

+	    return response;

+	

+  }

+  

+  /**

+   * Builds the szrgw:GetIdentityLinkRequest für the SZR-GW

+   * @param givenname

+   * @param familyname

+   * @param birthday

+   * @return

+   */

+//  private static Document buildGetIdentityLinkRequest(X509Certificate cert) {

+//	  

+//	  try {

+//		  	byte[] certbyte = cert.getEncoded();

+//		  	String certstring = Base64.encode(certbyte); 

+//	      

+//			DocumentBuilderFactory factory =DocumentBuilderFactory.newInstance();

+//			factory.setNamespaceAware(true);

+//	        DocumentBuilder builder = factory.newDocumentBuilder();

+//	        Document doc = builder.newDocument();

+//	        

+//	        Element getIdentityLink = doc.createElementNS(SZRGWConstants.SZRGW_REQUEST_NS, "szrgw:GetIdentityLinkRequest");

+//	        getIdentityLink.setAttributeNS("http://www.w3.org/2000/xmlns/", "xmlns:szrgw", SZRGWConstants.SZRGW_REQUEST_NS);

+//	        doc.appendChild(getIdentityLink);

+//	        

+//	        Element x509certificate = doc.createElementNS(SZRGWConstants.SZRGW_REQUEST_NS, "szrgw:X509Certificate");

+//	        getIdentityLink.appendChild(x509certificate);

+//	        Text certbase64 = doc.createTextNode(certstring);

+//	        x509certificate.appendChild(certbase64);

+//	                          

+//	        return doc;

+//	    } catch (ParserConfigurationException e) {

+//	    	e.printStackTrace();

+//	    } catch (CertificateEncodingException e) {

+//			e.printStackTrace();

+//		}

+//	    return null;

+//	

+//	}

+//  

+//    /**

+//   * Checks a parameter.

+//   * @param param parameter

+//   * @return true if the parameter is null or empty

+//   */

+//  private boolean isEmpty(String param) {

+//    return param == null || param.length() == 0;

+//  }

+ 

+}

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java
new file mode 100644
index 000000000..4c0abdb0f
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java
@@ -0,0 +1,174 @@
+package at.gv.egovernment.moa.id.auth.servlet;

+

+import iaik.pki.PKIException;

+

+import java.io.IOException;

+import java.io.PrintWriter;

+import java.security.GeneralSecurityException;

+import java.util.List;

+import java.util.Map;

+

+import javax.net.ssl.SSLSocketFactory;

+import javax.servlet.ServletException;

+import javax.servlet.http.HttpServletRequest;

+import javax.servlet.http.HttpServletResponse;

+

+import org.apache.commons.fileupload.FileUploadException;

+import org.apache.commons.lang.StringEscapeUtils;

+

+import at.gv.egovernment.moa.id.BuildException;

+import at.gv.egovernment.moa.id.MOAIDException;

+import at.gv.egovernment.moa.id.auth.AuthenticationServer;

+import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;

+import at.gv.egovernment.moa.id.auth.WrongParametersException;

+import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;

+import at.gv.egovernment.moa.id.auth.builder.GetIdentityLinkFormBuilder;

+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

+import at.gv.egovernment.moa.id.config.ConnectionParameter;

+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;

+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;

+import at.gv.egovernment.moa.id.util.SSLUtils;

+import at.gv.egovernment.moa.id.util.client.mis.simple.MISMandate;

+import at.gv.egovernment.moa.id.util.client.mis.simple.MISSimpleClient;

+import at.gv.egovernment.moa.id.util.client.mis.simple.MISSimpleClientException;

+import at.gv.egovernment.moa.logging.Logger;

+

+/**

+ * Servlet requested for getting the foreign eID

+ * provided by the security layer implementation.

+ * Utilizes the {@link AuthenticationServer}.

+ *

+ */

+public class GetMISSessionIDServlet extends AuthServlet {

+

+  /**

+   * Constructor for GetMISSessionIDServlet.

+   */

+  public GetMISSessionIDServlet() {

+    super();

+  }

+

+  /**

+   * GET requested by security layer implementation to verify

+   * that data URL resource is available.

+   * @see javax.servlet.http.HttpServlet#doGet(HttpServletRequest, HttpServletResponse)

+   */

+  protected void doGet(HttpServletRequest req, HttpServletResponse resp)

+    throws ServletException, IOException { 

+    	

+	  doPost(req, resp);

+	  

+//		Logger.debug("GET GetMISSessionIDServlet");

+//		

+//		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);

+//		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);

+//		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);

+//		resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);

+  }

+

+  /**

+   * Gets the signer certificate from the InfoboxReadRequest and 

+   * responds with a new 

+   * <code>CreateXMLSignatureRequest</code>.

+   * <br>

+   * Request parameters:

+   * <ul>

+   * <li>MOASessionID: ID of associated authentication session</li>

+   * <li>XMLResponse: <code>&lt;InfoboxReadResponse&gt;</code></li>

+   * </ul>

+   * @see javax.servlet.http.HttpServlet#doPost(HttpServletRequest, HttpServletResponse)

+   */

+  protected void doPost(HttpServletRequest req, HttpServletResponse resp)

+    throws ServletException, IOException {

+

+		Logger.debug("POST GetMISSessionIDServlet");

+		

+		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);

+		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);

+		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);

+		resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);

+		

+//		Map parameters;

+//	    try 

+//	    {

+//	      parameters = getParameters(req);

+//	    } catch (FileUploadException e) 

+//	    {

+//	      Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());

+//	      throw new IOException(e.getMessage());

+//	     	}

+		

+	    String sessionID = req.getParameter(PARAM_SESSIONID);

+	    

+	    // escape parameter strings

+		sessionID = StringEscapeUtils.escapeHtml(sessionID);

+		

+	    AuthenticationSession session = null;

+	    try {

+	       // check parameter

+	       if (!ParamValidatorUtils.isValidSessionID(sessionID))

+	          throw new WrongParametersException("VerifyCertificate", PARAM_SESSIONID, "auth.12");

+	       

+	       session = AuthenticationServer.getSession(sessionID);

+	    	

+	    	String misSessionID = session.getMISSessionID();

+	    	

+	    	//System.out.println("MIS Session ID (GetMISServlet): " + misSessionID);

+	    	

+	    	AuthConfigurationProvider authConf= AuthConfigurationProvider.getInstance();

+	    	ConnectionParameter connectionParameters = authConf.getOnlineMandatesConnectionParameter();	

+	    	SSLSocketFactory sslFactory = SSLUtils.getSSLSocketFactory(AuthConfigurationProvider.getInstance(), connectionParameters);

+

+	    	List list = MISSimpleClient.sendGetMandatesRequest(connectionParameters.getUrl(), misSessionID, sslFactory);

+	    	

+	    	if (list == null) {

+	    		Logger.error("Keine Vollmacht gefunden.");

+	    		throw new MISSimpleClientException("Keine Vollmacht gefunden");

+	    	}

+	    	if (list.size() == 0) {

+	    		Logger.error("Keine Vollmacht gefunden.");

+	    		throw new MISSimpleClientException("Keine Vollmacht gefunden");

+	    	}

+	    	

+	    	// for now: list contains only one element

+	    	MISMandate mandate = (MISMandate)list.get(0);	    	

+   	

+	    	// verify mandate signature

+	    	String createXMLSignatureRequestOrRedirect = AuthenticationServer.getInstance().verifyMandate(sessionID, mandate);

+	    	

+	    	String dataurl =

+	             new DataURLBuilder().buildDataURL(

+	               session.getAuthURL(),

+	               REQ_VERIFY_AUTH_BLOCK,

+	               session.getSessionID());

+	    	

+	    	Logger.debug(createXMLSignatureRequestOrRedirect);

+	    	

+	    	String request = getHTMLForm(createXMLSignatureRequestOrRedirect, session.getBkuURL(), dataurl);

+

+	    	resp.setContentType("text/html;charset=UTF-8");

+			PrintWriter out = new PrintWriter(resp.getOutputStream());

+			out.print(request);

+			out.flush();

+	    	

+			    		      

+	    }

+	    catch (MOAIDException ex) {

+	      handleError(null, ex, req, resp);

+	    } catch (GeneralSecurityException ex) {

+	    	handleError(null, ex, req, resp);

+		} catch (PKIException e) {

+			handleError(null, e, req, resp);

+		} catch (MISSimpleClientException e) {

+			handleError(null, e, req, resp);

+		} 

+  }

+  

+  private static String getHTMLForm(String request, String bkuURI, String dataURL) throws BuildException {

+	  return new GetIdentityLinkFormBuilder().buildCreateSignature(bkuURI, request, dataURL);

+	  

+  }

+  

+  

+ 

+ }

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ProcessValidatorInputServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ProcessValidatorInputServlet.java
new file mode 100644
index 000000000..b50a1edde
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ProcessValidatorInputServlet.java
@@ -0,0 +1,249 @@
+/*
+* Copyright 2003 Federal Chancellery Austria
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egovernment.moa.id.auth.servlet;

+

+import java.io.IOException;

+import java.io.OutputStream;

+import java.util.Map;

+

+import javax.servlet.ServletException;

+import javax.servlet.http.HttpServletRequest;

+import javax.servlet.http.HttpServletResponse;

+

+import org.apache.commons.fileupload.FileUploadException;

+import org.apache.commons.lang.StringEscapeUtils;
+

+import at.gv.egovernment.moa.id.AuthenticationException;

+import at.gv.egovernment.moa.id.MOAIDException;

+import at.gv.egovernment.moa.id.auth.AuthenticationServer;

+import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.auth.WrongParametersException;
+import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;

+import at.gv.egovernment.moa.id.auth.builder.GetVerifyAuthBlockFormBuilder;

+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

+import at.gv.egovernment.moa.id.auth.validator.InfoboxValidator;

+import at.gv.egovernment.moa.id.auth.validator.ValidateException;

+import at.gv.egovernment.moa.id.auth.validator.parep.ParepUtils;

+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;

+import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;

+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
+import at.gv.egovernment.moa.logging.Logger;

+import at.gv.egovernment.moa.util.FileUtils;

+

+/**

+ * Servlet requested for processing user input forms of infobox validators

+ * 

+ * Utilizes the {@link AuthenticationServer}.

+ *

+ * @author <a href="mailto:peter.danner@egiz.gv.at">Peter Danner

+ * @version $Id: ProcessValidatorInputServlet.java 769 2007-01-10 15:37:52Z peter.danner $

+ */

+public class ProcessValidatorInputServlet extends AuthServlet {

+

+  public static final long serialVersionUID = 1;

+  

+  /**

+   * Constructor for VerifyIdentityLinkServlet.

+   */

+  public ProcessValidatorInputServlet() {

+    super();

+  }

+

+  /**

+   * Shows the user input forms of infobox validators

+   *  

+   * @see javax.servlet.http.HttpServlet#doGet(HttpServletRequest, HttpServletResponse)

+   */

+  protected void doGet(HttpServletRequest req, HttpServletResponse resp)

+    throws ServletException, IOException { 
+	  
+    Logger.debug("GET ProcessInput");
+    resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);
+	resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);
+	resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
+	resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);
+	  

+    Map parameters;

+    try {

+      parameters = getParameters(req);

+    } catch (FileUploadException e) {

+      Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());

+      throw new IOException(e.getMessage());

+    }
+    String sessionID = req.getParameter(PARAM_SESSIONID);

+    if (sessionID==null) sessionID = (String) req.getAttribute(PARAM_SESSIONID);

+    if (sessionID==null) sessionID = (String) parameters.get(PARAM_SESSIONID);

+    if (sessionID==null) sessionID = (String) parameters.get(PARAM_SESSIONID+"_");

+    
+    // escape parameter strings
+    sessionID = StringEscapeUtils.escapeHtml(sessionID);
+    

+    try {
+    	
+    	if (!ParamValidatorUtils.isValidSessionID(sessionID))
+            throw new WrongParametersException("ProcessInput", PARAM_SESSIONID, "auth.12");
+    	

+      AuthenticationSession session = AuthenticationServer.getSession(sessionID);

+      InfoboxValidator infoboxvalidator = session.getFirstPendingValidator();

+      String outputStream;

+      String dataURL = new DataURLBuilder().buildDataURL(

+          session.getAuthURL(), AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, sessionID);

+      if (infoboxvalidator!=null) {

+        outputStream = infoboxvalidator.getForm();

+        // replace strings the validators can not know

+        outputStream = ParepUtils.replaceAll(outputStream, "<BASE_href>", session.getAuthURL());

+        outputStream = ParepUtils.replaceAll(outputStream, "<MOASessionID>", sessionID);

+        outputStream = ParepUtils.replaceAll(outputStream, "<BKU>", session.getBkuURL());

+        outputStream = ParepUtils.replaceAll(outputStream, "<DataURL>", dataURL);

+        outputStream = ParepUtils.replaceAll(outputStream, "<PushInfobox>", session.getPushInfobox());

+      } else {

+        throw new ValidateException("validator.65", null);

+      }

+      //resp.setStatus(200);

+      resp.setContentType("text/html;charset=UTF-8");

+      OutputStream out = resp.getOutputStream();

+      out.write(outputStream.getBytes("UTF-8"));

+      out.flush();

+      out.close();

+      Logger.debug("Finished GET ProcessInput");

+    }
+    catch (WrongParametersException ex) {
+        handleWrongParameters(ex, req, resp);
+      }

+    catch (MOAIDException ex) {

+      handleError(null, ex, req, resp);

+    }

+  }

+

+  /**

+   * Verifies the user input forms of infobox validators 

+   *

+   * @see javax.servlet.http.HttpServlet#doPost(HttpServletRequest, HttpServletResponse)

+   */

+  protected void doPost(HttpServletRequest req, HttpServletResponse resp)

+    throws ServletException, IOException {

+

+		Logger.debug("POST ProcessInput");
+		
+		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);
+		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);
+		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
+		resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);
+		

+    Map parameters;

+    try {

+      parameters = getParameters(req);

+    } catch (FileUploadException e) {

+      Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());

+      throw new IOException(e.getMessage());

+    }
+
+    String sessionID = req.getParameter(PARAM_SESSIONID);

+    if (sessionID==null) sessionID = (String) req.getAttribute(PARAM_SESSIONID);

+    if (sessionID==null) sessionID = (String) parameters.get(PARAM_SESSIONID);

+    if (sessionID==null) sessionID = (String) parameters.get(PARAM_SESSIONID+"_");

+        
+    // escape parameter strings
+    sessionID = StringEscapeUtils.escapeHtml(sessionID);
+    

+    try {
+    	
+    	if (!ParamValidatorUtils.isValidSessionID(sessionID))
+            throw new WrongParametersException("ProcessInput", PARAM_SESSIONID, "auth.12");
+		    

+      AuthenticationSession session = AuthenticationServer.getSession(sessionID);

+      AuthenticationServer.processInput(session, parameters);

+      String createXMLSignatureRequestOrRedirect = AuthenticationServer.getInstance().getCreateXMLSignatureRequestAuthBlockOrRedirect(session, null, null);

+      if (!createXMLSignatureRequestOrRedirect.startsWith("Redirect")) {

+        // Now sign the AUTH Block

+        String dataURL = new DataURLBuilder().buildDataURL(

+            session.getAuthURL(), AuthenticationServer.REQ_VERIFY_AUTH_BLOCK, sessionID);

+        

+        String htmlForm = null;

+        

+        boolean doInputProcessorSign = false; // If sign process should be within an extra form, provide a parameter. Otherwise transport through security layer is assumed 

+
+        String inputProcessorSignForm = req.getParameter("Sign_Form");

+        if (inputProcessorSignForm==null) inputProcessorSignForm = (String) req.getAttribute("Sign_Form");

+        if (inputProcessorSignForm==null) inputProcessorSignForm = (String) parameters.get("Sign_Form");

+        if (inputProcessorSignForm==null) inputProcessorSignForm = (String) parameters.get("Sign_Form_");
+        // escape parameter strings
+        inputProcessorSignForm = StringEscapeUtils.escapeHtml(inputProcessorSignForm);

+        if (!ParepUtils.isEmpty(inputProcessorSignForm)) doInputProcessorSign = inputProcessorSignForm.equalsIgnoreCase("true");

+        if (doInputProcessorSign) {

+          // Test if we have a user input form sign template
+         

+          String inputProcessorSignTemplateURL = req.getParameter(PARAM_INPUT_PROCESSOR_SIGN_TEMPLATE);
+          
+          if (!ParamValidatorUtils.isValidSignUrl(inputProcessorSignTemplateURL))
+              throw new WrongParametersException("ProcessInput", PARAM_INPUT_PROCESSOR_SIGN_TEMPLATE, "auth.12");
+          

+          String inputProcessorSignTemplate = null;

+          OAAuthParameter oaParam =

+            AuthConfigurationProvider.getInstance().getOnlineApplicationParameter(session.getOAURLRequested());

+          // override template url by url from configuration file

+          if (oaParam.getInputProcessorSignTemplateURL() != null) {

+            inputProcessorSignTemplateURL = oaParam.getInputProcessorSignTemplateURL();

+          }       

+          if (inputProcessorSignTemplateURL != null) {

+            try {

+              inputProcessorSignTemplate = new String(FileUtils.readURL(inputProcessorSignTemplateURL));

+            } catch (IOException ex) {

+              throw new AuthenticationException(

+                "auth.03",

+                new Object[] { inputProcessorSignTemplateURL, ex.toString()},

+                ex);

+            }

+          }

+          

+          htmlForm = new GetVerifyAuthBlockFormBuilder().build(

+              inputProcessorSignTemplate, session.getBkuURL(), createXMLSignatureRequestOrRedirect, dataURL, session.getPushInfobox());

+          htmlForm = ParepUtils.replaceAll(htmlForm, "<BASE_href>", session.getAuthURL());

+          htmlForm = ParepUtils.replaceAll(htmlForm, "<MOASessionID>", sessionID);

+          htmlForm = ParepUtils.replaceAll(htmlForm, "<BKU>", session.getBkuURL());

+          htmlForm = ParepUtils.replaceAll(htmlForm, "<DataURL>", dataURL);

+          htmlForm = ParepUtils.replaceAll(htmlForm, "<PushInfobox>", session.getPushInfobox());

+          resp.setContentType("text/html;charset=UTF-8");

+        } else {

+          htmlForm = createXMLSignatureRequestOrRedirect;

+          resp.setStatus(307);

+          resp.addHeader("Location", dataURL);

+          //TODO test impact of explicit setting charset with older versions of BKUs (HotSign)

+          resp.setContentType("text/xml;charset=UTF-8");

+        }

+        

+        OutputStream out = resp.getOutputStream();

+        out.write(htmlForm.getBytes("UTF-8"));

+        out.flush();

+        out.close();

+        Logger.debug("Finished POST ProcessInput");

+      } else {

+        String redirectURL = new DataURLBuilder().buildDataURL(session.getAuthURL(), AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, session.getSessionID());

+        resp.setContentType("text/html");

+        resp.setStatus(302);

+        resp.addHeader("Location", redirectURL);

+        Logger.debug("REDIRECT TO: " + redirectURL);

+      }

+    }
+    catch (WrongParametersException ex) {
+        handleWrongParameters(ex, req, resp);
+      }

+    catch (MOAIDException ex) {

+      handleError(null, ex, req, resp);

+    }

+  }

+

+}

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/SelectBKUServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/SelectBKUServlet.java
new file mode 100644
index 000000000..6e285a2c0
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/SelectBKUServlet.java
@@ -0,0 +1,145 @@
+/*
+* Copyright 2003 Federal Chancellery Austria
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egovernment.moa.id.auth.servlet;
+
+import java.io.IOException;
+import java.io.OutputStreamWriter;
+import java.io.Writer;
+
+import javax.servlet.ServletConfig;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.lang.StringEscapeUtils;
+
+import at.gv.egovernment.moa.id.auth.AuthenticationServer;
+import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.auth.MOAIDAuthInitializer;
+import at.gv.egovernment.moa.id.auth.WrongParametersException;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
+import at.gv.egovernment.moa.id.util.MOAIDMessageProvider;
+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * Servlet requested for selecting a BKU.
+ * <br>In case of {@link AuthConfigurationProvider#getBKUSelectionType}==HTMLComplete,
+ * the browser is redirected to the configured "BKU-Auswahl-URL".
+ * <br>In case of {@link AuthConfigurationProvider#getBKUSelectionType}==HTMLSelect,
+ * the list of available BKU's is fetched from a BKU-Auswahl server, and presented
+ * to the user in an HTML form.
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class SelectBKUServlet extends AuthServlet {
+
+  /**
+   * Calls the web application initializer.
+   * 
+   * @see javax.servlet.Servlet#init(ServletConfig)
+   */
+  public void init(ServletConfig servletConfig) throws ServletException {
+    try {
+      super.init(servletConfig);
+      MOAIDAuthInitializer.initialize();
+      Logger.debug("default platform file.encoding: " + System.getProperty("file.encoding"));
+      Logger.info(MOAIDMessageProvider.getInstance().getMessage("init.00", null));
+    }
+    catch (Exception ex) {
+      Logger.fatal(MOAIDMessageProvider.getInstance().getMessage("init.02", null), ex);
+      throw new ServletException(ex);
+    }
+  }
+  
+  /**
+   * Responds with an HTML form which requests the user to choose a BKU.
+   */
+  protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+    throws ServletException, IOException {
+
+    Logger.debug("GET SelectBKU");
+    
+    resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);
+    resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);
+	resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
+	resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);
+    
+    String authURL = req.getScheme() + "://" + req.getServerName();
+    if ((req.getScheme().equalsIgnoreCase("https") && req.getServerPort()!=443) || (req.getScheme().equalsIgnoreCase("http") && req.getServerPort()!=80)) { 
+      authURL = authURL.concat(":" + req.getServerPort());
+    }
+    authURL = authURL.concat(req.getContextPath() + "/");
+
+    String target = req.getParameter(PARAM_TARGET);
+    String oaURL = req.getParameter(PARAM_OA);
+    String bkuSelectionTemplateURL = req.getParameter(PARAM_BKUTEMPLATE);
+    String templateURL = req.getParameter(PARAM_TEMPLATE);
+    
+    // escape parameter strings
+    target = StringEscapeUtils.escapeHtml(target);
+    oaURL = StringEscapeUtils.escapeHtml(oaURL);    
+    templateURL = StringEscapeUtils.escapeHtml(templateURL);
+    bkuSelectionTemplateURL = StringEscapeUtils.escapeHtml(bkuSelectionTemplateURL);
+    
+    
+    resp.setHeader(HEADER_EXPIRES,HEADER_VALUE_EXPIRES);
+    resp.setHeader(HEADER_PRAGMA,HEADER_VALUE_PRAGMA);
+    resp.setHeader(HEADER_CACHE_CONTROL,HEADER_VALUE_CACHE_CONTROL);
+    resp.addHeader(HEADER_CACHE_CONTROL,HEADER_VALUE_CACHE_CONTROL_IE);
+
+    try {
+       
+       // check parameter
+       if (!ParamValidatorUtils.isValidTarget(target))
+          throw new WrongParametersException("SelectBKU", PARAM_TARGET, "auth.12");
+       if (!ParamValidatorUtils.isValidOA(oaURL))
+          throw new WrongParametersException("SelectBKU", PARAM_OA, "auth.12");
+       if (!ParamValidatorUtils.isValidTemplate(req, templateURL))
+          throw new WrongParametersException("SelectBKU", PARAM_TEMPLATE, "auth.12");
+       if (!ParamValidatorUtils.isValidTemplate(req, bkuSelectionTemplateURL))
+           throw new WrongParametersException("SelectBKU", PARAM_TEMPLATE, "auth.12");
+
+       
+      String returnValue = AuthenticationServer.getInstance().selectBKU(
+        authURL, target, oaURL, bkuSelectionTemplateURL, templateURL);
+      String bkuSelectionType = AuthConfigurationProvider.getInstance().getBKUSelectionType();
+      if (bkuSelectionType.equals(AuthConfigurationProvider.BKU_SELECTION_TYPE_HTMLCOMPLETE)) {
+        // bkuSelectionType==HTMLComplete
+        String redirectURL = returnValue;               
+				resp.setContentType("text/html");
+        resp.sendRedirect(redirectURL);
+        Logger.info("REDIRECT TO: " + redirectURL);
+      } else {
+        // bkuSelectionType==HTMLSelect
+        String htmlForm = returnValue;
+        resp.setContentType("text/html;charset=UTF-8");
+        Logger.debug("HTML-Form: " + htmlForm);
+        Writer out = new OutputStreamWriter(resp.getOutputStream(), "UTF8");
+        out.write(htmlForm);
+        out.flush();
+        Logger.debug("Finished GET SelectBKU");
+      }
+    }
+    catch (WrongParametersException ex) {
+      handleWrongParameters(ex, req, resp);
+    }
+    catch (Throwable ex) {
+      handleError(null, ex, req, resp);
+    }
+  }
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/StartAuthenticationServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/StartAuthenticationServlet.java
new file mode 100644
index 000000000..2e7d59fde
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/StartAuthenticationServlet.java
@@ -0,0 +1,165 @@
+/*
+* Copyright 2003 Federal Chancellery Austria
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egovernment.moa.id.auth.servlet;
+
+import iaik.pki.PKIException;
+
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.security.GeneralSecurityException;
+import java.util.List;
+
+import javax.net.ssl.SSLSocketFactory;
+import javax.servlet.ServletConfig;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.lang.StringEscapeUtils;
+
+import at.gv.egovernment.moa.id.MOAIDException;
+import at.gv.egovernment.moa.id.auth.AuthenticationServer;
+import at.gv.egovernment.moa.id.auth.MOAIDAuthInitializer;
+import at.gv.egovernment.moa.id.auth.WrongParametersException;
+import at.gv.egovernment.moa.id.config.ConfigurationException;
+import at.gv.egovernment.moa.id.config.ConnectionParameter;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
+import at.gv.egovernment.moa.id.util.MOAIDMessageProvider;
+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
+import at.gv.egovernment.moa.id.util.SSLUtils;
+import at.gv.egovernment.moa.id.util.client.mis.simple.MISSimpleClient;
+import at.gv.egovernment.moa.id.util.client.mis.simple.MISSimpleClientException;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * Servlet requested for starting a MOA ID authentication session.
+ * Utilizes the {@link AuthenticationServer}.
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ * @see AuthenticationServer#startAuthentication
+ */
+public class StartAuthenticationServlet extends AuthServlet {
+
+  /**
+   * Responds with an HTML form which upon submit requests the identity link
+   * from the security layer implementation.
+   * <br>
+   * Response:
+   * <ul>
+   * <li>Content type: <code>"text/html"</code></li>
+   * <li>Content: see return value of {@link AuthenticationServer#startAuthentication}</li>
+   * <li>Error status: <code>500</code>
+   * </ul>
+   * @see javax.servlet.http.HttpServlet#doGet(HttpServletRequest, HttpServletResponse)
+   */
+  protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+    throws ServletException, IOException {
+
+		Logger.debug("GET StartAuthentication");
+    String authURL = req.getScheme() + "://" + req.getServerName();
+    if ((req.getScheme().equalsIgnoreCase("https") && req.getServerPort()!=443) || (req.getScheme().equalsIgnoreCase("http") && req.getServerPort()!=80)) { 
+      authURL = authURL.concat(":" + req.getServerPort());
+    }
+    authURL = authURL.concat(req.getContextPath() + "/");
+
+    String target = req.getParameter(PARAM_TARGET);
+    String oaURL = req.getParameter(PARAM_OA);
+    String bkuURL = req.getParameter(PARAM_BKU);
+    String templateURL = req.getParameter(PARAM_TEMPLATE);
+    String sessionID = req.getParameter(PARAM_SESSIONID);
+    String useMandate = req.getParameter(PARAM_USEMANDATE);
+    
+    
+    // escape parameter strings
+    target = StringEscapeUtils.escapeHtml(target);
+    oaURL = StringEscapeUtils.escapeHtml(oaURL);
+    bkuURL = StringEscapeUtils.escapeHtml(bkuURL);
+    templateURL = StringEscapeUtils.escapeHtml(templateURL);
+    sessionID = StringEscapeUtils.escapeHtml(sessionID);
+    useMandate = StringEscapeUtils.escapeHtml(useMandate);
+       
+    resp.setHeader(HEADER_EXPIRES,HEADER_VALUE_EXPIRES);
+    resp.setHeader(HEADER_PRAGMA,HEADER_VALUE_PRAGMA);
+    resp.setHeader(HEADER_CACHE_CONTROL,HEADER_VALUE_CACHE_CONTROL);
+    resp.addHeader(HEADER_CACHE_CONTROL,HEADER_VALUE_CACHE_CONTROL_IE);
+    
+ 	
+    	try {
+		      // check parameter
+		    if (!ParamValidatorUtils.isValidTarget(target))
+		       throw new WrongParametersException("StartAuthentication", PARAM_TARGET, "auth.12");
+		    if (!ParamValidatorUtils.isValidOA(oaURL))
+             throw new WrongParametersException("StartAuthentication", PARAM_OA, "auth.12");
+		    if (!ParamValidatorUtils.isValidBKUURI(bkuURL))
+		       throw new WrongParametersException("StartAuthentication", PARAM_BKU, "auth.12");
+		    if (!ParamValidatorUtils.isValidTemplate(req, templateURL))
+		       throw new WrongParametersException("StartAuthentication", PARAM_TEMPLATE, "auth.12");
+		    if (!ParamValidatorUtils.isValidSessionID(sessionID))
+             throw new WrongParametersException("StartAuthentication", PARAM_SESSIONID, "auth.12");
+		    if (!ParamValidatorUtils.isValidUseMandate(useMandate))
+	             throw new WrongParametersException("StartAuthentication", PARAM_USEMANDATE, "auth.12");
+		    
+		    
+		    
+		    
+			String getIdentityLinkForm =
+				AuthenticationServer.getInstance().startAuthentication(authURL, target, oaURL, templateURL, bkuURL, useMandate, sessionID, req.getScheme());
+		
+			resp.setContentType("text/html;charset=UTF-8");
+			PrintWriter out = new PrintWriter(resp.getOutputStream());
+			out.print(getIdentityLinkForm);
+			out.flush();
+			Logger.debug("Finished GET StartAuthentication");
+		
+		}
+    catch (WrongParametersException ex) {
+      handleWrongParameters(ex, req, resp);
+    }
+		catch (MOAIDException ex) {
+			handleError(null, ex, req, resp);
+		}
+  }
+
+
+  /**
+   * @see javax.servlet.http.HttpServlet#doPost(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
+   */
+  protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+    throws ServletException, IOException {
+    
+    doGet(req, resp);
+  }
+  
+
+  /**
+   * Calls the web application initializer.
+   * 
+   * @see javax.servlet.Servlet#init(ServletConfig)
+   */
+  public void init(ServletConfig servletConfig) throws ServletException {
+  	try {
+      super.init(servletConfig);
+      MOAIDAuthInitializer.initialize();
+  		Logger.info(MOAIDMessageProvider.getInstance().getMessage("init.00", null));
+  	}
+  	catch (Exception ex) {
+  		Logger.fatal(MOAIDMessageProvider.getInstance().getMessage("init.02", null), ex);
+  		throw new ServletException(ex);
+  	}
+  }  
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyAuthenticationBlockServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyAuthenticationBlockServlet.java
new file mode 100644
index 000000000..f1fb15be0
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyAuthenticationBlockServlet.java
@@ -0,0 +1,169 @@
+/*
+* Copyright 2003 Federal Chancellery Austria
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egovernment.moa.id.auth.servlet;
+
+import java.io.IOException;
+import java.util.Map;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.fileupload.FileUploadException;
+import org.apache.commons.lang.StringEscapeUtils;
+
+import at.gv.egovernment.moa.id.MOAIDException;
+import at.gv.egovernment.moa.id.auth.AuthenticationServer;
+import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.auth.WrongParametersException;
+import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.URLEncoder;
+
+/**
+ * Servlet requested for verifying the signed authentication block
+ * provided by the security layer implementation.
+ * Utilizes the {@link AuthenticationServer}.
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class VerifyAuthenticationBlockServlet extends AuthServlet {
+	
+
+  /**
+   * Constructor for VerifyAuthenticationBlockServlet.
+   */
+  public VerifyAuthenticationBlockServlet() {
+    super();
+  }
+
+  /**
+   * GET requested by security layer implementation to verify
+   * that data URL resource is available.
+   * @see javax.servlet.http.HttpServlet#doGet(HttpServletRequest, HttpServletResponse)
+   */
+  protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+    throws ServletException, IOException { 
+    
+	  //doPost(req, resp);
+	  
+		Logger.debug("GET VerifyAuthenticationBlock");
+		
+		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);
+		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);
+		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
+		resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);
+		
+  }
+
+  /**
+   * Verifies the signed authentication block and redirects the browser
+   * to the online application requested, adding a parameter needed for
+   * retrieving the authentication data.
+   * <br>
+   * Request parameters:
+   * <ul>
+   * <li>MOASessionID: ID of associated authentication session</li>
+   * <li>XMLResponse: <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
+   * </ul>
+   * Response:
+   * <ul>
+   * <li>Status: <code>302</code></li>
+   * <li>Header <code>"Location"</code>: URL of the online application requested, with
+   * 						parameters <code>"Target"</code>(only if the online application is
+   *            a public service) and <code>"SAMLArtifact"</code> added</li>
+   * <li>Error status: <code>500</code>
+   * </ul>
+   * @see AuthenticationServer#verifyAuthenticationBlock
+   * @see javax.servlet.http.HttpServlet#doPost(HttpServletRequest, HttpServletResponse)
+   */
+  protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+    throws ServletException, IOException {
+
+		Logger.debug("POST VerifyAuthenticationBlock");
+		
+		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);
+		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);
+		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
+		resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);
+		  
+    Map parameters;
+    try 
+    {
+      parameters = getParameters(req);
+    } catch (FileUploadException e) 
+    {
+      Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());
+      throw new IOException(e.getMessage());
+    }
+		String sessionID = req.getParameter(PARAM_SESSIONID);
+		String createXMLSignatureResponse = (String)parameters.get(PARAM_XMLRESPONSE);
+
+		// escape parameter strings
+		sessionID = StringEscapeUtils.escapeHtml(sessionID);
+
+		String redirectURL = null;
+		try {
+         // check parameter
+         if (!ParamValidatorUtils.isValidSessionID(sessionID))
+            throw new WrongParametersException("VerifyAuthenticationBlock", PARAM_SESSIONID, "auth.12");
+         if (!ParamValidatorUtils.isValidXMLDocument(createXMLSignatureResponse))
+            throw new WrongParametersException("VerifyAuthenticationBlock", PARAM_XMLRESPONSE, "auth.12");
+
+         
+			AuthenticationSession session = AuthenticationServer.getSession(sessionID);
+			String samlArtifactBase64 = 
+				AuthenticationServer.getInstance().verifyAuthenticationBlock(sessionID, createXMLSignatureResponse);
+			if (!samlArtifactBase64.equals("Redirect to Input Processor")) {
+			  redirectURL = session.getOAURLRequested();
+  			if (!session.getBusinessService()) {
+          redirectURL = addURLParameter(redirectURL, PARAM_TARGET, URLEncoder.encode(session.getTarget(), "UTF-8"));
+        }
+  			redirectURL = addURLParameter(redirectURL, PARAM_SAMLARTIFACT, URLEncoder.encode(samlArtifactBase64, "UTF-8"));
+  			redirectURL = resp.encodeRedirectURL(redirectURL);
+			} else {
+	      redirectURL = new DataURLBuilder().buildDataURL(session.getAuthURL(), AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, session.getSessionID());
+			}
+			resp.setContentType("text/html");
+			resp.setStatus(302);
+			resp.addHeader("Location", redirectURL);
+			Logger.debug("REDIRECT TO: " + redirectURL);
+		}
+    
+		catch (MOAIDException ex) {
+			handleError(null, ex, req, resp);
+		}
+
+  }
+  /**
+   * Adds a parameter to a URL.
+   * @param url the URL
+   * @param paramname parameter name
+   * @param paramvalue parameter value
+   * @return the URL with parameter added
+   */
+  private static String addURLParameter(String url, String paramname, String paramvalue) {
+		String param = paramname + "=" + paramvalue;
+  	if (url.indexOf("?") < 0)
+	  	return url + "?" + param;
+  	else
+  		return url + "&" + param;
+  }
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyCertificateServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyCertificateServlet.java
new file mode 100644
index 000000000..0014d2647
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyCertificateServlet.java
@@ -0,0 +1,337 @@
+package at.gv.egovernment.moa.id.auth.servlet;

+

+import iaik.pki.PKIException;

+import iaik.x509.X509Certificate;

+

+import java.io.IOException;

+import java.security.GeneralSecurityException;

+import java.security.cert.CertificateEncodingException;

+import java.util.Map;

+

+import javax.net.ssl.SSLSocketFactory;

+import javax.servlet.ServletException;

+import javax.servlet.http.HttpServletRequest;

+import javax.servlet.http.HttpServletResponse;

+import javax.xml.parsers.DocumentBuilder;

+import javax.xml.parsers.DocumentBuilderFactory;

+import javax.xml.parsers.ParserConfigurationException;

+import javax.xml.transform.TransformerException;

+

+import org.apache.axis.encoding.Base64;

+import org.apache.commons.fileupload.FileUploadException;

+import org.apache.commons.lang.StringEscapeUtils;

+import org.w3c.dom.Document;

+import org.w3c.dom.Element;

+import org.w3c.dom.Text;

+

+import at.gv.egovernment.moa.id.AuthenticationException;

+import at.gv.egovernment.moa.id.MOAIDException;

+import at.gv.egovernment.moa.id.auth.AuthenticationServer;

+import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;

+import at.gv.egovernment.moa.id.auth.WrongParametersException;

+import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;

+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

+import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWConstants;

+import at.gv.egovernment.moa.id.config.ConnectionParameter;

+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;

+import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;

+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;

+import at.gv.egovernment.moa.id.util.SSLUtils;

+import at.gv.egovernment.moa.id.util.ServletUtils;

+import at.gv.egovernment.moa.id.util.client.mis.simple.MISSessionId;

+import at.gv.egovernment.moa.id.util.client.mis.simple.MISSimpleClient;

+import at.gv.egovernment.moa.id.util.client.mis.simple.MISSimpleClientException;

+import at.gv.egovernment.moa.logging.Logger;

+import at.gv.egovernment.moa.util.DOMUtils;

+

+/**

+ * Servlet requested for getting the foreign eID

+ * provided by the security layer implementation.

+ * Utilizes the {@link AuthenticationServer}.

+ *

+ */

+public class VerifyCertificateServlet extends AuthServlet {

+

+  /**

+   * Constructor for VerifyCertificateServlet.

+   */

+  public VerifyCertificateServlet() {

+    super();

+  }

+

+  /**

+   * GET requested by security layer implementation to verify

+   * that data URL resource is available.

+   * @see javax.servlet.http.HttpServlet#doGet(HttpServletRequest, HttpServletResponse)

+   */

+  protected void doGet(HttpServletRequest req, HttpServletResponse resp)

+    throws ServletException, IOException { 

+    	

+		Logger.debug("GET VerifyCertificateServlet");

+		

+		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);

+		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);

+		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);

+		resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);

+  }

+

+  /**

+   * Gets the signer certificate from the InfoboxReadRequest and 

+   * responds with a new 

+   * <code>CreateXMLSignatureRequest</code>.

+   * <br>

+   * Request parameters:

+   * <ul>

+   * <li>MOASessionID: ID of associated authentication session</li>

+   * <li>XMLResponse: <code>&lt;InfoboxReadResponse&gt;</code></li>

+   * </ul>

+   * @see javax.servlet.http.HttpServlet#doPost(HttpServletRequest, HttpServletResponse)

+   */

+  protected void doPost(HttpServletRequest req, HttpServletResponse resp)

+    throws ServletException, IOException {

+

+		Logger.debug("POST VerifyCertificateServlet");

+		

+		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);

+		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);

+		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);

+		resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);

+		

+		Map parameters;

+	    try 

+	    {

+	      parameters = getParameters(req);

+	    } catch (FileUploadException e) 

+	    {

+	      Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());

+	      throw new IOException(e.getMessage());

+	     	}

+	    String sessionID = req.getParameter(PARAM_SESSIONID);

+	    

+	    // escape parameter strings

+		sessionID = StringEscapeUtils.escapeHtml(sessionID);

+				

+	    AuthenticationSession session = null;

+	    try {

+	       // check parameter

+	       if (!ParamValidatorUtils.isValidSessionID(sessionID))

+	          throw new WrongParametersException("VerifyCertificate", PARAM_SESSIONID, "auth.12");

+	       

+	    	session = AuthenticationServer.getSession(sessionID);

+	    	

+	    	

+    		X509Certificate cert = AuthenticationServer.getInstance().getCertificate(sessionID, parameters);

+    		if (cert == null) {

+    			Logger.error("Certificate could not be read.");

+    			throw new AuthenticationException("auth.14", null);    		

+    		}

+    		

+	    	boolean useMandate = session.getUseMandate();

+	    	if (useMandate) {

+	    		// Mandate Modus	    	

+	    		// make request to MIS

+	    		

+	    		AuthConfigurationProvider authConf= AuthConfigurationProvider.getInstance();

+    			ConnectionParameter connectionParameters = authConf.getOnlineMandatesConnectionParameter();	

+    			SSLSocketFactory sslFactory = SSLUtils.getSSLSocketFactory(AuthConfigurationProvider.getInstance(), connectionParameters);

+    			

+    			// get identitity link as byte[]

+    			Element elem = session.getIdentityLink().getSamlAssertion();

+    			String s = DOMUtils.serializeNode(elem);

+//    			byte[] idl = DOMUtils.nodeToByteArray(elem);

+//    			String s = new String(idl);

+    			byte[] idl = s.getBytes();

+    			

+    			// redirect url

+    			// build redirect(to the GetMISSessionIdSerlvet)

+    	          String redirectURL =

+    	                new DataURLBuilder().buildDataURL(

+    	                  session.getAuthURL(),

+    	                  GET_MIS_SESSIONID,

+    	                  session.getSessionID());

+    			

+    	          String oaURL = session.getOAURLRequested();

+    	          OAAuthParameter oaParam = authConf.getOnlineApplicationParameter(oaURL);

+    	          String profiles = oaParam.getMandateProfiles();

+

+    	          if (profiles == null) {

+    	        	  Logger.error("No Mandate/Profile for OA configured.");

+    	        	  throw new AuthenticationException("auth.16", new Object[] { GET_MIS_SESSIONID});

+    	          }

+    	          

+    	          String profilesArray[] = profiles.split(",");  	 		 

+    	          for(int i = 0; i < profilesArray.length; i++) {

+    	        	  profilesArray[i] = profilesArray[i].trim();

+    	          }

+    	          

+    	          MISSessionId misSessionID = MISSimpleClient.sendSessionIdRequest(connectionParameters.getUrl(), idl, cert.getEncoded(), redirectURL, profilesArray, sslFactory);

+    	          String redirectMISGUI = misSessionID.getRedirectURL();

+    	          

+    	          if (misSessionID == null) {

+    	        	  Logger.error("Fehler bei Anfrage an Vollmachten Service. MIS Session ID ist null.");

+    	        	  throw new MISSimpleClientException("Fehler bei Anfrage an Vollmachten Service.");

+    	          }

+    	          

+    	          session.setMISSessionID(misSessionID.getSessiondId());

+    		

+    	          resp.setStatus(302);

+  		    	  resp.addHeader("Location", redirectMISGUI);

+  		    	  Logger.debug("REDIRECT TO: " + redirectURL);

+    	          

+	    	}

+	    	else {

+	    		// Foreign Identities Modus	

+		    	

+		    	String createXMLSignatureRequest = AuthenticationServer.getInstance().createXMLSignatureRequestForeignID(sessionID, cert);

+		      // build dataurl (to the GetForeignIDSerlvet)

+		    	String dataurl =

+	             new DataURLBuilder().buildDataURL(

+	               session.getAuthURL(),

+	               REQ_GET_FOREIGN_ID,

+	               session.getSessionID());

+	       

+		    	ServletUtils.writeCreateXMLSignatureRequest(resp, session, createXMLSignatureRequest, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "GetForeignID", dataurl);

+		    	

+		    	

+		    	Logger.debug("Send CreateXMLSignatureRequest to BKU");

+	    	}

+	    	

+			    		      

+	    }

+	    catch (MOAIDException ex) {

+	      handleError(null, ex, req, resp);

+	    } catch (GeneralSecurityException ex) {

+	    	handleError(null, ex, req, resp);

+		} catch (PKIException e) {

+			handleError(null, e, req, resp);

+		} catch (MISSimpleClientException e) {

+			handleError(null, e, req, resp);

+		} catch (TransformerException e) {

+			handleError(null, e, req, resp);

+		} 

+  }

+    

+  /**

+   * Adds a parameter to a URL.

+   * @param url the URL

+   * @param paramname parameter name

+   * @param paramvalue parameter value

+   * @return the URL with parameter added

+   */

+  private static String addURLParameter(String url, String paramname, String paramvalue) {

+		String param = paramname + "=" + paramvalue;

+  	if (url.indexOf("?") < 0)

+	  	return url + "?" + param;

+  	else

+  		return url + "&" + param;

+  }

+  

+  /**

+   * Does the request to the SZR-GW

+   * @param givenname

+   * @param familyname

+   * @param dateofbirth

+   * @return Identity link assertion

+ * @throws SZRGWClientException 

+   */

+  /*private Element getIdentityLink(Element signature) throws SZRGWClientException {*/

+//     private Element getIdentityLink(X509Certificate cert) throws SZRGWClientException {

+//

+//    SZRGWClient client = new SZRGWClient();

+//      

+//    try {

+//    	AuthConfigurationProvider authConf = AuthConfigurationProvider.getInstance();

+//    	 ConnectionParameter connectionParameters = authConf.getForeignIDConnectionParameter();

+//     	//url = "http://localhost:8081/szr-gateway/services/IdentityLinkCreation";

+//    	Logger.debug("Connection Parameters: " + connectionParameters);

+//      client.setAddress(connectionParameters.getUrl());

+//      if (connectionParameters.getUrl().toLowerCase().startsWith("https:")) {

+//         Logger.debug("Initialisiere SSL Verbindung");

+//         try {

+//            client.setSSLSocketFactory(SSLUtils.getSSLSocketFactory(AuthConfigurationProvider.getInstance(), connectionParameters));

+//         } catch (IOException e) {

+//            // TODO Auto-generated catch block

+//            e.printStackTrace();

+//         } catch (GeneralSecurityException e) {

+//            // TODO Auto-generated catch block

+//            e.printStackTrace();

+//         } catch (PKIException e) {

+//            // TODO Auto-generated catch block

+//            e.printStackTrace();

+//         }

+//       }

+//       

+//       Logger.info("Starte Kommunikation mit dem Stammzahlenregister Gateway(" + connectionParameters.getUrl() + ")...");

+//      

+//   

+//    }

+//   catch (ConfigurationException e) {

+//      Logger.warn(e);

+//      Logger.warn(MOAIDMessageProvider.getInstance().getMessage("config.12", null ));

+//

+//    }

+//    	// create request

+//    	Document doc = buildGetIdentityLinkRequest(cert);

+//    	Element request = doc.getDocumentElement();

+//    	CreateIdentityLinkResponse response = null;

+//   

+//    //try {

+//        response = client.createIdentityLinkResponse(request);

+//    //} catch (SZRGWClientException e) {

+//        // give him a second try - Nach dem Starten des Tomcat wird beim ersten Mal das Client-Zertifikat offenbar vom HTTPClient nicht mitgeschickt.

+//      //  client = new SZRGWClient(url);

+//      //  response = client.createIdentityLinkResponse(request);

+//   // }

+//   	 

+//        

+//	return response.getAssertion();

+//	

+//  }

+  

+  /**

+   * Builds the szrgw:GetIdentityLinkRequest für the SZR-GW

+   * @param givenname

+   * @param familyname

+   * @param birthday

+   * @return

+   */

+  private static Document buildGetIdentityLinkRequest(X509Certificate cert) {

+	  

+	  try {

+		  	byte[] certbyte = cert.getEncoded();

+		  	String certstring = Base64.encode(certbyte); 

+	      

+			DocumentBuilderFactory factory =DocumentBuilderFactory.newInstance();

+			factory.setNamespaceAware(true);

+	        DocumentBuilder builder = factory.newDocumentBuilder();

+	        Document doc = builder.newDocument();

+	        

+	        Element getIdentityLink = doc.createElementNS(SZRGWConstants.SZRGW_REQUEST_NS, "szrgw:GetIdentityLinkRequest");

+	        getIdentityLink.setAttributeNS("http://www.w3.org/2000/xmlns/", "xmlns:szrgw", SZRGWConstants.SZRGW_REQUEST_NS);

+	        doc.appendChild(getIdentityLink);

+	        

+	        Element x509certificate = doc.createElementNS(SZRGWConstants.SZRGW_REQUEST_NS, "szrgw:X509Certificate");

+	        getIdentityLink.appendChild(x509certificate);

+	        Text certbase64 = doc.createTextNode(certstring);

+	        x509certificate.appendChild(certbase64);

+	                          

+	        return doc;

+	    } catch (ParserConfigurationException e) {

+	    	e.printStackTrace();

+	    } catch (CertificateEncodingException e) {

+			e.printStackTrace();

+		}

+	    return null;

+	

+	}

+  

+    /**

+   * Checks a parameter.

+   * @param param parameter

+   * @return true if the parameter is null or empty

+   */

+  private boolean isEmpty(String param) {

+    return param == null || param.length() == 0;

+  }

+ 

+}

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyIdentityLinkServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyIdentityLinkServlet.java
new file mode 100644
index 000000000..740c85942
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyIdentityLinkServlet.java
@@ -0,0 +1,203 @@
+/*
+* Copyright 2003 Federal Chancellery Austria
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egovernment.moa.id.auth.servlet;
+
+import java.io.IOException;
+import java.util.Map;
+
+import javax.net.ssl.SSLSocketFactory;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.fileupload.FileUploadException;
+import org.apache.commons.lang.StringEscapeUtils;
+
+import at.gv.egovernment.moa.id.AuthenticationException;
+import at.gv.egovernment.moa.id.MOAIDException;
+import at.gv.egovernment.moa.id.ParseException;
+import at.gv.egovernment.moa.id.auth.AuthenticationServer;
+import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.auth.WrongParametersException;
+import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;
+import at.gv.egovernment.moa.id.auth.builder.InfoboxReadRequestBuilderCertificate;
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.config.ConnectionParameter;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
+import at.gv.egovernment.moa.id.util.SSLUtils;
+import at.gv.egovernment.moa.id.util.ServletUtils;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * Servlet requested for verifying the identity link
+ * provided by the security layer implementation.
+ * Utilizes the {@link AuthenticationServer}.
+ *
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class VerifyIdentityLinkServlet extends AuthServlet {
+
+  /**
+   * Constructor for VerifyIdentityLinkServlet.
+   */
+  public VerifyIdentityLinkServlet() {
+    super();
+  }
+
+  /**
+   * GET requested by security layer implementation to verify
+   * that data URL resource is available.
+   * @see javax.servlet.http.HttpServlet#doGet(HttpServletRequest, HttpServletResponse)
+   */
+  protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+    throws ServletException, IOException { 
+    	
+		Logger.debug("GET VerifyIdentityLink");
+		
+		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);
+		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);
+		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
+		resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);
+  }
+
+  /**
+   * Verifies the identity link and responds with a new 
+   * <code>CreateXMLSignatureRequest</code> or a new <code>
+   * InfoboxReadRequest</code> (in case of a foreign eID card).
+   * <br>
+   * Request parameters:
+   * <ul>
+   * <li>MOASessionID: ID of associated authentication session</li>
+   * <li>XMLResponse: <code>&lt;InfoboxReadResponse&gt;</code></li>
+   * </ul>
+   * Response:
+   * <ul>
+   * <li>Content type: <code>"text/xml"</code></li>
+   * <li>Content: see return value of {@link AuthenticationServer#verifyIdentityLink}</li>
+   * <li>Error status: <code>500</code>
+   * </ul>
+   * @see javax.servlet.http.HttpServlet#doPost(HttpServletRequest, HttpServletResponse)
+   */
+  protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+    throws ServletException, IOException {
+
+		Logger.debug("POST VerifyIdentityLink");
+		  
+    Map parameters;
+    try 
+    {
+      parameters = getParameters(req);
+    } catch (FileUploadException e) 
+    {
+      Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());
+      throw new IOException(e.getMessage());
+    }
+    String sessionID = req.getParameter(PARAM_SESSIONID);
+       
+
+    // escape parameter strings
+	sessionID = StringEscapeUtils.escapeHtml(sessionID);
+    
+    resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);
+	resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);
+	resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
+	resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);
+
+	
+    try {
+    // check parameter
+       if (!ParamValidatorUtils.isValidSessionID(sessionID))
+          throw new WrongParametersException("VerifyIdentityLink", PARAM_SESSIONID, "auth.12");
+       
+    	AuthenticationSession session = AuthenticationServer.getSession(sessionID);  
+    	String createXMLSignatureRequestOrRedirect = AuthenticationServer.getInstance().verifyIdentityLink(sessionID, parameters);
+
+    	Logger.debug(createXMLSignatureRequestOrRedirect);
+    	
+    	if (createXMLSignatureRequestOrRedirect == null) {
+    	   // no identity link found
+    		
+    		boolean useMandate = session.getUseMandate();
+    		if (useMandate) {
+    			Logger.error("Online-Mandate Mode for foreign citizencs not supported.");
+    			throw new AuthenticationException("auth.13", null);
+    		}
+    		
+    		try {
+    		
+    		   Logger.debug("Send InfoboxReadRequest to BKU to get signer certificate.");
+    		   
+    		   // create the InfoboxReadRequest to get the certificate
+    		   String infoboxReadRequest = new InfoboxReadRequestBuilderCertificate().build(true);
+
+    		   // build dataurl (to the GetForeignIDSerlvet)
+          String dataurl =
+                new DataURLBuilder().buildDataURL(
+                  session.getAuthURL(),
+                  REQ_VERIFY_CERTIFICATE,
+                  session.getSessionID());
+          
+         
+          ServletUtils.writeCreateXMLSignatureRequest(resp, session, infoboxReadRequest, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "VerifyIdentityLink", dataurl);
+          
+    	    	
+    	    }
+    	    catch(Exception e) {
+    	    	handleError(null, e, req, resp);
+    	    }
+    	    
+    	}
+    	else {
+    		boolean useMandate = session.getUseMandate();
+    		if (useMandate) { // Mandate modus
+    			// read certificate and set dataurl to VerifyCertificateForMandatesServlet
+    			
+    			Logger.debug("Send InfoboxReadRequest to BKU to get signer certificate.");
+    			
+     		   String infoboxReadRequest = new InfoboxReadRequestBuilderCertificate().build(true);
+
+     		   // build dataurl (to the GetForeignIDSerlvet)
+     		   String dataurl =
+                 new DataURLBuilder().buildDataURL(
+                   session.getAuthURL(),
+                   REQ_VERIFY_CERTIFICATE,
+                   session.getSessionID());
+           
+          
+     		  //Logger.debug("ContentType set to: application/x-www-form-urlencoded (ServletUtils)");
+     		  //ServletUtils.writeCreateXMLSignatureRequestURLEncoded(resp, session, infoboxReadRequest, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "VerifyIdentityLink", dataurl);
+     		  Logger.debug("ContentType set to: text/xml;charset=UTF-8 (ServletUtils)");
+     		  ServletUtils.writeCreateXMLSignatureRequest(resp, session, infoboxReadRequest, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "VerifyIdentityLink", dataurl);
+    			
+    		}
+    		else {
+    			ServletUtils.writeCreateXMLSignatureRequestOrRedirect(resp, session, createXMLSignatureRequestOrRedirect, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "VerifyIdentityLink");
+    		}
+    	}
+      
+    }
+    catch (ParseException ex) {
+    	handleError(null, ex, req, resp);
+    }
+    
+    catch (MOAIDException ex) {
+      handleError(null, ex, req, resp);
+    }
+  }
+
+}