add MOA-ID AuthnRequest generation

1 files changed, 185 insertions, 28 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java
index 03a61d08f..b76863602 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java
@@ -24,12 +24,37 @@ package at.gv.egovernment.moa.id.moduls;
 
 import java.io.IOException;
 import java.io.PrintWriter;
+import java.security.NoSuchAlgorithmException;
 import java.util.List;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.joda.time.DateTime;
+import org.opensaml.common.impl.SecureRandomIdentifierGenerator;
+import org.opensaml.common.xml.SAMLConstants;
+import org.opensaml.saml2.core.AuthnContextClassRef;
+import org.opensaml.saml2.core.AuthnContextComparisonTypeEnumeration;
+import org.opensaml.saml2.core.AuthnRequest;
+import org.opensaml.saml2.core.Issuer;
+import org.opensaml.saml2.core.NameID;
+import org.opensaml.saml2.core.NameIDPolicy;
+import org.opensaml.saml2.core.NameIDType;
+import org.opensaml.saml2.core.RequestedAuthnContext;
+import org.opensaml.saml2.core.Subject;
+import org.opensaml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml2.metadata.IDPSSODescriptor;
+import org.opensaml.saml2.metadata.SingleSignOnService;
+import org.opensaml.saml2.metadata.provider.MetadataProviderException;
+import org.opensaml.security.MetadataCredentialResolver;
+import org.opensaml.security.MetadataCredentialResolverFactory;
+import org.opensaml.security.MetadataCriteria;
+import org.opensaml.ws.message.encoder.MessageEncodingException;
+import org.opensaml.xml.security.CriteriaSet;
+import org.opensaml.xml.security.SecurityException;
+import org.opensaml.xml.security.criteria.EntityIDCriteria;
+
 import at.gv.egovernment.moa.id.auth.builder.LoginFormBuilder;
 import at.gv.egovernment.moa.id.auth.builder.SendAssertionFormBuilder;
 import at.gv.egovernment.moa.id.auth.builder.StartAuthenticationBuilder;
@@ -42,9 +67,17 @@ import at.gv.egovernment.moa.id.auth.servlet.AuthServlet;
 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
 import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.id.protocols.pvp2x.binding.ArtifactBinding;
+import at.gv.egovernment.moa.id.protocols.pvp2x.binding.IEncoder;
+import at.gv.egovernment.moa.id.protocols.pvp2x.binding.PostBinding;
+import at.gv.egovernment.moa.id.protocols.pvp2x.binding.RedirectBinding;
+import at.gv.egovernment.moa.id.protocols.pvp2x.config.PVPConfiguration;
+import at.gv.egovernment.moa.id.protocols.pvp2x.metadata.MOAMetadataProvider;
+import at.gv.egovernment.moa.id.protocols.pvp2x.utils.SAML2Utils;
 import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;
 import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
 import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.MiscUtil;
 import at.gv.egovernment.moa.util.StringUtils;
 
 public class AuthenticationManager extends AuthServlet {
@@ -148,16 +181,158 @@ public class AuthenticationManager extends AuthServlet {
 	public void doAuthentication(HttpServletRequest request,
 			HttpServletResponse response, IRequest target)
 			throws ServletException, IOException, MOAIDException {
+		
 		Logger.info("Starting authentication ...");
+		
+		if (MiscUtil.isEmpty(target.getRequestedIDP())) {
+			perfomLocalAuthentication(request, response, target);
+			
+		} else {
+			Logger.info("Use IDP " + target.getRequestedIDP() + " for authentication ...");
+			buildPVP21AuthenticationRequest(request, response, target);
+						
+		}		
+	}
+			
+	public void sendTransmitAssertionQuestion(HttpServletRequest request,
+			HttpServletResponse response, IRequest target, OAAuthParameter oaParam)
+			throws ServletException, IOException, MOAIDException { 
+		
+			String form = SendAssertionFormBuilder.buildForm(target.requestedModule(), 
+					target.requestedAction(), target.getRequestID(), oaParam, request.getContextPath());
+						
+			response.setContentType("text/html;charset=UTF-8");
+			PrintWriter out = new PrintWriter(response.getOutputStream()); 
+			out.print(form);
+			out.flush(); 
+	}
+	
+	private void buildPVP21AuthenticationRequest(HttpServletRequest request,
+			HttpServletResponse response, IRequest target)
+			throws ServletException, IOException, MOAIDException {
+		
+		boolean requiredLocalAuthentication = true;
+		
+		Logger.debug("Build PVP 2.1 authentication request");
+		
+		//get IDP metadata
+		try {
+			EntityDescriptor idpEntity = MOAMetadataProvider.getInstance().
+					getEntityDescriptor(target.getRequestedIDP());
+			
+			if (idpEntity != null ) {
+				
+				//fetch endpoint from IDP metadata
+				SingleSignOnService redirectEndpoint = null;  
+				for (SingleSignOnService sss : 
+						idpEntity.getIDPSSODescriptor(SAMLConstants.SAML20P_NS).getSingleSignOnServices()) {
+					
+					// use POST binding as default if it exists 
+					if (sss.getBinding().equals(SAMLConstants.SAML2_POST_BINDING_URI)) { 
+						redirectEndpoint = sss;
+						
+					} else if ( sss.getBinding().equals(SAMLConstants.SAML2_REDIRECT_BINDING_URI) &&
+							redirectEndpoint == null )
+						redirectEndpoint = sss;
+				}
+				
+				if (redirectEndpoint != null) {
+					
+					AuthnRequest authReq = SAML2Utils
+							.createSAMLObject(AuthnRequest.class);
+					SecureRandomIdentifierGenerator gen = new SecureRandomIdentifierGenerator();
+					authReq.setID(gen.generateIdentifier());
+
+					//send passive AuthnRequest
+					authReq.setIsPassive(true);
 
-//		if (!ParamValidatorUtils.isValidOA(target.getOAURL()))
-//			throw new WrongParametersException("StartAuthentication", PARAM_OA,
-//					"auth.12");
-//
-//		if (target.getOAURL() == null) {
-//			throw new WrongParametersException("StartAuthentication", PARAM_OA,
-//					"auth.12");
-//		}
+					authReq.setAssertionConsumerServiceIndex(0);
+					authReq.setIssueInstant(new DateTime());
+					Subject subject = SAML2Utils.createSAMLObject(Subject.class);
+					NameID name = SAML2Utils.createSAMLObject(NameID.class);
+					Issuer issuer = SAML2Utils.createSAMLObject(Issuer.class);
+					
+					String serviceURL = PVPConfiguration.getInstance().getIDPPublicPath();
+					name.setValue(serviceURL);
+					issuer.setValue(serviceURL);
+
+					subject.setNameID(name);
+					authReq.setSubject(subject);
+					issuer.setFormat(NameIDType.ENTITY);
+					authReq.setIssuer(issuer);
+					NameIDPolicy policy = SAML2Utils
+							.createSAMLObject(NameIDPolicy.class);
+					policy.setAllowCreate(true);
+					policy.setFormat(NameID.TRANSIENT);
+					authReq.setNameIDPolicy(policy);
+					
+					authReq.setDestination(redirectEndpoint.getLocation());
+					
+					RequestedAuthnContext reqAuthContext = 
+							SAML2Utils.createSAMLObject(RequestedAuthnContext.class);
+					
+					AuthnContextClassRef authnClassRef = 
+							SAML2Utils.createSAMLObject(AuthnContextClassRef.class);					
+					authnClassRef.setAuthnContextClassRef("http://www.stork.gov.eu/1.0/citizenQAALevel/4");
+					reqAuthContext.setComparison(AuthnContextComparisonTypeEnumeration.MINIMUM);					
+					reqAuthContext.getAuthnContextClassRefs().add(authnClassRef);					
+					authReq.setRequestedAuthnContext(reqAuthContext);
+					
+					
+					IEncoder binding = null;
+					if (redirectEndpoint.getBinding().equals(
+							SAMLConstants.SAML2_REDIRECT_BINDING_URI)) {
+						binding = new RedirectBinding();
+																	
+					} else if (redirectEndpoint.getBinding().equals(
+							SAMLConstants.SAML2_POST_BINDING_URI)) {
+						binding = new PostBinding();
+						
+					}
+					
+					binding.encodeRequest(request, response, authReq, 
+							redirectEndpoint.getLocation(), target.getRequestID());
+					
+					//build and send request without an error
+					requiredLocalAuthentication = false;
+					
+				} else {
+					Logger.warn("Requested IDP " + target.getRequestedIDP() 
+						+ " does not support POST or Redirect Binding.");
+					
+				}
+												
+			} else {
+				Logger.warn("Requested IDP " + target.getRequestedIDP() 
+						+ " is not found in InterFederation configuration");
+				
+			}
+						
+		} catch (MetadataProviderException e) {
+			Logger.error("IDP metadata error." , e);			
+			
+		} catch (NoSuchAlgorithmException e) {
+			Logger.error("Build IDP authentication request FAILED.", e);
+			
+		} catch (MessageEncodingException e) {
+			Logger.error("Build IDP authentication request FAILED.", e);
+			
+		} catch (SecurityException e) {
+			Logger.error("Build IDP authentication request FAILED.", e);
+			
+		}
+		
+		if (requiredLocalAuthentication) {
+			Logger.info("Switch to local authentication on this IDP ... ");
+			perfomLocalAuthentication(request, response, target);
+		}
+	}
+	
+	
+	private void perfomLocalAuthentication(HttpServletRequest request,
+			HttpServletResponse response, IRequest target)
+			throws ServletException, IOException, MOAIDException {
+		Logger.debug("Starting authentication on this IDP ...");
 
 		setNoCachingHeadersInHttpRespone(request, response);
 		
@@ -183,17 +358,12 @@ public class AuthenticationManager extends AuthServlet {
 		
 		if (legacyallowed && legacyparamavail) {
 			
-			//parse request parameter into MOASession
-			
+			//parse request parameter into MOASession			
 			StartAuthentificationParameterParser.parse(request, response, moasession, target);
 							
 		    Logger.info("Start Authentication Module: " + moasession.getModul() 
 		    		+ " Action: " + moasession.getAction());
-			
-			//start authentication process
-//			session.getServletContext().getNamedDispatcher("StartAuthentication")
-//				.forward(request, response);
-		    
+					    
 		    StartAuthenticationBuilder startauth = StartAuthenticationBuilder.getInstance();
 			
 		    String getIdentityLinkForm = startauth.build(moasession, request, response);
@@ -260,17 +430,4 @@ public class AuthenticationManager extends AuthServlet {
 			out.flush(); 
 		}
 	}
-	
-	public void sendTransmitAssertionQuestion(HttpServletRequest request,
-			HttpServletResponse response, IRequest target, OAAuthParameter oaParam)
-			throws ServletException, IOException, MOAIDException { 
-		
-			String form = SendAssertionFormBuilder.buildForm(target.requestedModule(), 
-					target.requestedAction(), target.getRequestID(), oaParam, request.getContextPath());
-						
-			response.setContentType("text/html;charset=UTF-8");
-			PrintWriter out = new PrintWriter(response.getOutputStream()); 
-			out.print(form);
-			out.flush(); 
-	}	
 }