--use differend keys for SAML2 metadata signing and SAML2 assertion signing

-- move oAuth idToken generation to OAuth20AuthAction, because MOASession does not exits anymore in OAuth20TokenAction if no SSO is used.

1 files changed, 49 insertions, 9 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/signer/CredentialProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/signer/CredentialProvider.java
index cf0f48f1c..511caa908 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/signer/CredentialProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/signer/CredentialProvider.java
@@ -1,6 +1,8 @@
 package at.gv.egovernment.moa.id.protocols.pvp2x.signer;
 
 import java.security.KeyStore;
+import java.security.PrivateKey;
+import java.security.interfaces.RSAPrivateKey;
 
 import org.opensaml.xml.security.credential.Credential;
 import org.opensaml.xml.security.credential.UsageType;
@@ -13,35 +15,73 @@ import at.gv.egovernment.moa.id.protocols.pvp2x.config.PVPConfiguration;
 import at.gv.egovernment.moa.id.protocols.pvp2x.utils.SAML2Utils;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.KeyStoreUtils;
+import at.gv.egovernment.moa.util.MiscUtil;
 
 public class CredentialProvider {
-	public static Credential getIDPSigningCredential()
+	
+	private static KeyStore keyStore = null;
+	
+	public static Credential getIDPMetaDataSigningCredential()
 			throws CredentialsNotAvailableException {
-		KeyStore keyStore;
 		PVPConfiguration config = PVPConfiguration.getInstance();
 		try {
-			keyStore = KeyStoreUtils.loadKeyStore(config.getIDPKeyStoreFilename(), 
-					config.getIDPKeyStorePassword());
+			
+			if (keyStore == null)
+				keyStore = KeyStoreUtils.loadKeyStore(config.getIDPKeyStoreFilename(), 
+						config.getIDPKeyStorePassword());
 
 			KeyStoreX509CredentialAdapter credentials = new KeyStoreX509CredentialAdapter(
-					keyStore, config.getIDPKeyAlias(), config
-							.getIDPKeyPassword().toCharArray());
+					keyStore, config.getIDPKeyAliasMetadata(), config
+							.getIDPKeyPasswordMetadata().toCharArray());
 
 			credentials.setUsageType(UsageType.SIGNING);
 			return credentials;
 		} catch (Exception e) {
-			Logger.error("Failed to generate IDP Signing credentials");
+			Logger.error("Failed to generate IDP Metadata Signing credentials");
 			e.printStackTrace();
 			throw new CredentialsNotAvailableException(e.getMessage(), null);
 		}
 	}
 
+	public static Credential getIDPAssertionSigningCredential()
+			throws CredentialsNotAvailableException {
+		PVPConfiguration config = PVPConfiguration.getInstance();
+		try {
+			if (keyStore == null)
+				keyStore = KeyStoreUtils.loadKeyStore(config.getIDPKeyStoreFilename(), 
+						config.getIDPKeyStorePassword());
+
+			KeyStoreX509CredentialAdapter credentials = new KeyStoreX509CredentialAdapter(
+					keyStore, config.getIDPKeyAliasAssertionSign(), config
+							.getIDPKeyPasswordAssertionSign().toCharArray());
+
+			credentials.setUsageType(UsageType.SIGNING);
+			return credentials;
+		} catch (Exception e) {
+			Logger.error("Failed to generate IDP Assertion Signing credentials");
+			e.printStackTrace();
+			throw new CredentialsNotAvailableException(e.getMessage(), null);
+		}
+	}
+		
 	public static Signature getIDPSignature(Credential credentials) {
+		
+		PrivateKey privatekey = credentials.getPrivateKey();
+		
 		Signature signer = SAML2Utils.createSAMLObject(Signature.class);
-		signer.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
-		signer.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);
+		
+		if (privatekey instanceof RSAPrivateKey) {
+			signer.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
+			
+		} else if (privatekey instanceof iaik.security.ecc.ecdsa.ECPrivateKey) {
+			signer.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA1);
+
+		}
+
+		signer.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);		
 		signer.setSigningCredential(credentials);
 		return signer;
+		
 	}
 
 	public static Credential getSPTrustedCredential(String entityID)