refactor metadataprovider to Spring implementation

10 files changed, 158 insertions, 92 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java
index 98c6632f1..6375f26a3 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java
@@ -81,6 +81,7 @@ public class AttributQueryAction implements IAction {
 	@Autowired private IDPCredentialProvider pvpCredentials;
 	@Autowired private AuthConfiguration authConfig;
 	@Autowired private MOASessionDBUtils moaSessionDBUtils;
+	@Autowired(required=true) private MOAMetadataProvider metadataProvider;
 	
 	private final static List<String> DEFAULTSTORKATTRIBUTES = Arrays.asList(
 			new String[]{PVPConstants.EID_STORK_TOKEN_NAME});	
@@ -140,7 +141,7 @@ public class AttributQueryAction implements IAction {
 				
 				//build PVP 2.1 response
 				Response authResponse = AuthResponseBuilder.buildResponse(
-						MOAMetadataProvider.getInstance(), issuerEntityID, attrQuery, date, 
+						metadataProvider, issuerEntityID, attrQuery, date, 
 						assertion, authConfig.isPVP2AssertionEncryptionActive());
 									
 				SoapBinding decoder = new SoapBinding();				
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AuthenticationAction.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AuthenticationAction.java
index 8de44a2e8..aac49844e 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AuthenticationAction.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AuthenticationAction.java
@@ -61,6 +61,7 @@ import at.gv.egovernment.moa.logging.Logger;
 public class AuthenticationAction implements IAction {
 	@Autowired IDPCredentialProvider pvpCredentials;
 	@Autowired AuthConfiguration authConfig;
+	@Autowired(required=true) private MOAMetadataProvider metadataProvider;
 	
 	public SLOInformationInterface processRequest(IRequest req, HttpServletRequest httpReq,
 			HttpServletResponse httpResp, IAuthData authData) throws MOAIDException {
@@ -70,7 +71,7 @@ public class AuthenticationAction implements IAction {
 		//get basic information
 		MOARequest moaRequest = (MOARequest) pvpRequest.getRequest();
 		AuthnRequest authnRequest = (AuthnRequest) moaRequest.getSamlRequest();
-		EntityDescriptor peerEntity = moaRequest.getEntityMetadata();		
+		EntityDescriptor peerEntity = moaRequest.getEntityMetadata(metadataProvider);		
 		
 		AssertionConsumerService consumerService = 
 				SAML2Utils.createSAMLObject(AssertionConsumerService.class);
@@ -94,7 +95,7 @@ public class AuthenticationAction implements IAction {
 				peerEntity, date, consumerService, sloInformation);
 		
 		Response authResponse = AuthResponseBuilder.buildResponse(
-				MOAMetadataProvider.getInstance(), issuerEntityID, authnRequest, 
+				metadataProvider, issuerEntityID, authnRequest, 
 				date, assertion, authConfig.isPVP2AssertionEncryptionActive());
 							
 		IEncoder binding = null;
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java
index 82e46b6ce..127284ae0 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java
@@ -104,6 +104,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController  {
 
 	@Autowired IDPCredentialProvider pvpCredentials;
 	@Autowired SAMLVerificationEngineSP samlVerificationEngine;
+	@Autowired(required=true) private MOAMetadataProvider metadataProvider;
 	
 	public static final String NAME = PVP2XProtocol.class.getName();
 	public static final String PATH = "id_pvp2x";
@@ -187,7 +188,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController  {
 			
 			//get POST-Binding decoder implementation
 			InboundMessage msg = (InboundMessage) new PostBinding().decode(
-					req, resp, MOAMetadataProvider.getInstance(), false,
+					req, resp, metadataProvider, false,
 					new MOAURICompare(PVPConfiguration.getInstance().getIDPSSOPostService(pendingReq.getAuthURL())));
 			pendingReq.setRequest(msg);
 						
@@ -240,7 +241,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController  {
 			
 			//get POST-Binding decoder implementation
 			InboundMessage msg = (InboundMessage) new RedirectBinding().decode(
-					req, resp, MOAMetadataProvider.getInstance(), false,
+					req, resp, metadataProvider, false,
 					new MOAURICompare(PVPConfiguration.getInstance().getIDPSSORedirectService(pendingReq.getAuthURL())));
 			pendingReq.setRequest(msg);
 			
@@ -294,7 +295,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController  {
 			
 			//get POST-Binding decoder implementation
 			InboundMessage msg = (InboundMessage) new SoapBinding().decode(
-					req, resp, MOAMetadataProvider.getInstance(), false,
+					req, resp, metadataProvider, false,
 					new MOAURICompare(PVPConfiguration.getInstance().getIDPSSOPostService(pendingReq.getAuthURL())));
 			pendingReq.setRequest(msg);
 			
@@ -336,7 +337,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController  {
 			
 			if(!msg.isVerified()) {
 				samlVerificationEngine.verify(msg, 
-						TrustEngineFactory.getSignatureKnownKeysTrustEngine(MOAMetadataProvider.getInstance()));
+						TrustEngineFactory.getSignatureKnownKeysTrustEngine(metadataProvider));
 				msg.setVerified(true);
 								
 			}
@@ -493,7 +494,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController  {
 			
 			msg = (MOARequest) inMsg;
 			
-			EntityDescriptor metadata = msg.getEntityMetadata();
+			EntityDescriptor metadata = msg.getEntityMetadata(metadataProvider);
 			if(metadata == null) {
 				throw new NoMetadataInformationException();
 			}
@@ -643,7 +644,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController  {
 			throw new MOAIDException("Unsupported request", new Object[] {});
 		}
 				
-		EntityDescriptor metadata = moaRequest.getEntityMetadata();
+		EntityDescriptor metadata = moaRequest.getEntityMetadata(metadataProvider);
 		if(metadata == null) {
 			throw new NoMetadataInformationException();
 		}
@@ -735,7 +736,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController  {
 			}
 		}
 						
-		String oaURL = moaRequest.getEntityMetadata().getEntityID();
+		String oaURL = moaRequest.getEntityMetadata(metadataProvider).getEntityID();
 		oaURL = StringEscapeUtils.escapeHtml(oaURL);
 		IOAAuthParameters oa = authConfig.getOnlineApplicationParameter(oaURL);
 		
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVPTargetConfiguration.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVPTargetConfiguration.java
index e7f2a7d4b..caf66942e 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVPTargetConfiguration.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVPTargetConfiguration.java
@@ -32,6 +32,7 @@ import org.opensaml.saml2.core.impl.AuthnRequestImpl;
 import org.opensaml.saml2.metadata.AttributeConsumingService;
 import org.opensaml.saml2.metadata.RequestedAttribute;
 import org.opensaml.saml2.metadata.SPSSODescriptor;
+import org.opensaml.saml2.metadata.provider.MetadataProvider;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Scope;
 import org.springframework.stereotype.Component;
@@ -54,7 +55,6 @@ public class PVPTargetConfiguration extends RequestImpl {
 	
 	private static final long serialVersionUID = 4889919265919638188L;
 	
-	
 	InboundMessage request;
 	String binding;
 	String consumerURL;
@@ -88,14 +88,14 @@ public class PVPTargetConfiguration extends RequestImpl {
 	 * @see at.gv.egovernment.moa.id.moduls.RequestImpl#getRequestedAttributes()
 	 */
 	@Override
-	public Collection<String> getRequestedAttributes() {
+	public Collection<String> getRequestedAttributes(MetadataProvider metadataProvider) {
 
 		Map<String, String> reqAttr = new HashMap<String, String>();
 		for (String el : PVP2XProtocol.DEFAULTREQUESTEDATTRFORINTERFEDERATION)
 			reqAttr.put(el, "");
 						
 		try {			
-			SPSSODescriptor spSSODescriptor = getRequest().getEntityMetadata().getSPSSODescriptor(SAMLConstants.SAML20P_NS);
+			SPSSODescriptor spSSODescriptor = getRequest().getEntityMetadata(metadataProvider).getSPSSODescriptor(SAMLConstants.SAML20P_NS);
 			if (spSSODescriptor.getAttributeConsumingServices() != null && 
 					spSSODescriptor.getAttributeConsumingServices().size() > 0) {
 							
@@ -139,5 +139,6 @@ public class PVPTargetConfiguration extends RequestImpl {
 					
 		}
 		
-	}	
+	}
+
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java
index 25b22f0ad..94d91694a 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java
@@ -62,6 +62,7 @@ import at.gv.egovernment.moa.util.MiscUtil;
 
 public class SoapBinding implements IDecoder, IEncoder {
 
+	@Autowired(required=true) private MOAMetadataProvider metadataProvider;
 	@Autowired private IDPCredentialProvider credentialProvider;
 	
 	public InboundMessageInterface decode(HttpServletRequest req,
@@ -109,7 +110,7 @@ public class SoapBinding implements IDecoder, IEncoder {
 					RequestAbstractType attributeRequest = (RequestAbstractType) attrReq;
 					try {						
 						if (MiscUtil.isNotEmpty(attributeRequest.getIssuer().getValue()) && 
-								MOAMetadataProvider.getInstance().getRole(
+								metadataProvider.getRole(
 										attributeRequest.getIssuer().getValue(), 
 										SPSSODescriptor.DEFAULT_ELEMENT_NAME) != null)
 							request.setEntityID(attributeRequest.getIssuer().getValue());
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/SingleLogOutBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/SingleLogOutBuilder.java
index e5c897aa6..de59e6055 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/SingleLogOutBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/SingleLogOutBuilder.java
@@ -94,8 +94,9 @@ import at.gv.egovernment.moa.logging.Logger;
 @Service("PVP_SingleLogOutBuilder")
 public class SingleLogOutBuilder {
 
+	@Autowired(required=true) private MOAMetadataProvider metadataProvider;
 	@Autowired private IDPCredentialProvider credentialProvider;
-	
+		
 	public void checkStatusCode(ISLOInformationContainer sloContainer, LogoutResponse logOutResp) {
 		Status status = logOutResp.getStatus();				
 		if (!status.getStatusCode().getValue().equals(StatusCode.SUCCESS_URI)) {
@@ -353,7 +354,7 @@ public class SingleLogOutBuilder {
 	
 	public SingleLogoutService getRequestSLODescriptor(String entityID) throws NOSLOServiceDescriptorException {
 		try {
-			EntityDescriptor entity = MOAMetadataProvider.getInstance().getEntityDescriptor(entityID);
+			EntityDescriptor entity = metadataProvider.getEntityDescriptor(entityID);
 			SSODescriptor spsso = entity.getSPSSODescriptor(SAMLConstants.SAML20P_NS);
 			
 			SingleLogoutService sloService = null;			
@@ -394,7 +395,7 @@ public class SingleLogOutBuilder {
 	
 	public SingleLogoutService getResponseSLODescriptor(PVPTargetConfiguration spRequest) throws NoMetadataInformationException, NOSLOServiceDescriptorException {
 		MOARequest moaReq = (MOARequest) spRequest.getRequest();
-		EntityDescriptor metadata = moaReq.getEntityMetadata();
+		EntityDescriptor metadata = moaReq.getEntityMetadata(metadataProvider);
 		SSODescriptor ssodesc = metadata.getSPSSODescriptor(SAMLConstants.SAML20P_NS);
 		
 		if (ssodesc == null) {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/messages/InboundMessage.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/messages/InboundMessage.java
index 332caf967..8c8345bbf 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/messages/InboundMessage.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/messages/InboundMessage.java
@@ -25,11 +25,11 @@ package at.gv.egovernment.moa.id.protocols.pvp2x.messages;
 import java.io.Serializable;
 
 import org.opensaml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml2.metadata.provider.MetadataProvider;
 import org.opensaml.saml2.metadata.provider.MetadataProviderException;
 import org.w3c.dom.Element;
 
 import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.NoMetadataInformationException;
-import at.gv.egovernment.moa.id.protocols.pvp2x.metadata.MOAMetadataProvider;
 import at.gv.egovernment.moa.logging.Logger;
 
 /**
@@ -46,10 +46,12 @@ public class InboundMessage implements InboundMessageInterface, Serializable{
 	private String relayState = null;
 	
 	
-	public EntityDescriptor getEntityMetadata() throws NoMetadataInformationException {
-		
+	public EntityDescriptor getEntityMetadata(MetadataProvider metadataProvider) throws NoMetadataInformationException {
 		try {
-			return MOAMetadataProvider.getInstance().getEntityDescriptor(this.entityID);
+			if (metadataProvider == null)
+				throw new NullPointerException("No PVP MetadataProvider found.");
+			
+			return metadataProvider.getEntityDescriptor(this.entityID);
 			
 		} catch (MetadataProviderException e) {
 			Logger.warn("No Metadata for EntitiyID " + entityID);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
index 3002ca179..19adfe4c4 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
@@ -44,13 +44,14 @@ import org.opensaml.saml2.metadata.provider.MetadataProvider;
 import org.opensaml.saml2.metadata.provider.MetadataProviderException;
 import org.opensaml.saml2.metadata.provider.ObservableMetadataProvider;
 import org.opensaml.xml.XMLObject;
+import org.springframework.stereotype.Service;
 
+import at.gv.egovernment.moa.id.auth.IDestroyableObject;
+import at.gv.egovernment.moa.id.auth.IGarbageCollectorProcessing;
 import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
 import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 import at.gv.egovernment.moa.id.commons.config.MOAIDConfigurationConstants;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.IGarbageCollectorProcessing;
-import at.gv.egovernment.moa.id.config.auth.MOAGarbageCollector;
 import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.InterfederatedIDPPublicServiceFilter;
 import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.PVPMetadataFilterChain;
 import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.SchemaValidationFilter;
@@ -58,65 +59,85 @@ import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.Base64Utils;
 import at.gv.egovernment.moa.util.MiscUtil;
 
+@Service("PVPMetadataProvider")
 public class MOAMetadataProvider extends SimpleMOAMetadataProvider
-	implements ObservableMetadataProvider, IGarbageCollectorProcessing, IMOARefreshableMetadataProvider {
+	implements ObservableMetadataProvider, IGarbageCollectorProcessing, 
+	IMOARefreshableMetadataProvider, IDestroyableObject {
 
-	private static MOAMetadataProvider instance = null;
+	//private static final int METADATA_GARBAGE_TIMEOUT_SEC = 604800;  //7 days   
+	
+//	private static MOAMetadataProvider instance = null;
+	MetadataProvider internalProvider = null;
 	private static Object mutex = new Object();
+	//private Map<String, Date> lastAccess = null;
 	
 	
-	public static MOAMetadataProvider getInstance() {
-		if (instance == null) {
-			synchronized (mutex) {
-				if (instance == null) {
-					instance = new MOAMetadataProvider();
-					
-					//add this to MOA garbage collector
-					MOAGarbageCollector.addModulForGarbageCollection(instance);
-										
-				}
-			}
-		}
-		return instance;
+	public MOAMetadataProvider() {
+		internalProvider = new ChainingMetadataProvider();	
+		//lastAccess = new HashMap<String, Date>();
+		
 	}
 	
+//	public static MOAMetadataProvider getInstance() {
+//		if (instance == null) {
+//			synchronized (mutex) {
+//				if (instance == null) {
+//					instance = new MOAMetadataProvider();
+//					
+//					//add this to MOA garbage collector
+//					MOAGarbageCollector.addModulForGarbageCollection(instance);
+//										
+//				}
+//			}
+//		}
+//		return instance;
+//	}
+	
 	/* (non-Javadoc)
 	 * @see at.gv.egovernment.moa.id.config.auth.IGarbageCollectorProcessing#runGarbageCollector()
 	 */
 	@Override
 	public void runGarbageCollector() {
-		reInitialize();
-		
-	}
-	
-	private static void reInitialize() {
 		synchronized (mutex) {
 			
 			/**add new Metadataprovider or remove Metadataprovider which are not in use any more.**/
-			if (instance != null)
-				try {
-					Logger.trace("Check consistence of PVP2X metadata");	
-					instance.addAndRemoveMetadataProvider();
+			try {
+				Logger.trace("Check consistence of PVP2X metadata");	
+				addAndRemoveMetadataProvider();
 					
-				} catch (ConfigurationException e) {
-					Logger.error("Access to MOA-ID configuration FAILED.", e);
+			} catch (ConfigurationException e) {
+				Logger.error("Access to MOA-ID configuration FAILED.", e);
 					
-				}
-			else
-				Logger.info("MOAMetadataProvider is not loaded.");
+			}
 		}
+		
 	}
 	
-	public static void destroy() {
-		if (instance != null) {
-			instance.internalDestroy();
+	
+//	private static void reInitialize() {
+//		synchronized (mutex) {
+//			
+//			/**add new Metadataprovider or remove Metadataprovider which are not in use any more.**/
+//			if (instance != null)
+//				try {
+//					Logger.trace("Check consistence of PVP2X metadata");	
+//					instance.addAndRemoveMetadataProvider();
+//					
+//				} catch (ConfigurationException e) {
+//					Logger.error("Access to MOA-ID configuration FAILED.", e);
+//					
+//				}
+//			else
+//				Logger.info("MOAMetadataProvider is not loaded.");
+//		}
+//	}
+	
+	public void fullyDestroy() {
+		internalDestroy();
 			
-		} else {
-			Logger.info("MOAMetadataProvider is not loaded. Accordingly it can not be destroyed");
-		}
 	}
 	
-	MetadataProvider internalProvider;
+
 
 	@Override
 	public boolean refreshMetadataProvider(String entityID) {
@@ -208,7 +229,7 @@ public class MOAMetadataProvider extends SimpleMOAMetadataProvider
 	
 	private void addAndRemoveMetadataProvider() throws ConfigurationException {
 		if (internalProvider != null && internalProvider instanceof ChainingMetadataProvider) {
-			Logger.info("Relaod MOAMetaDataProvider.");
+			Logger.info("Reload MOAMetaDataProvider.");
 			
 			/*OpenSAML ChainingMetadataProvider can not remove a MetadataProvider (UnsupportedOperationException)
 			 *The ChainingMetadataProvider use internal a unmodifiableList to hold all registrated MetadataProviders.*/ 
@@ -217,7 +238,19 @@ public class MOAMetadataProvider extends SimpleMOAMetadataProvider
 			
 			//get all actually loaded metadata providers
 			Map<String, HTTPMetadataProvider> loadedproviders = getAllActuallyLoadedProviders();
-			
+						
+			/* TODO: maybe add metadata provider destroy after timeout.
+			 *       But could be a problem if one Metadataprovider load an EntitiesDescriptor 
+			 *       with more the multiple EntityDescriptors. If one of this EntityDesciptors 
+			 *       are expired the full EntitiesDescriptor is removed. 
+			 *       
+			 *       Timeout requires a better solution in this case! 
+			 */
+//			Date now = new Date();
+//			Date expioredate = new Date(now.getTime() - (METADATA_GARBAGE_TIMEOUT_SEC * 1000));
+//			Logger.debug("Starting PVP Metadata garbag collection (Expioredate:" 
+//					+ expioredate + ")");
+									
 			//load all PVP2 OAs form ConfigurationDatabase and 
 			//compare actually loaded Providers with configured PVP2 OAs
 			Map<String, String> allOAs = AuthConfigurationProviderFactory.getInstance().getConfigurationWithWildCard(
@@ -238,30 +271,31 @@ public class MOAMetadataProvider extends SimpleMOAMetadataProvider
 						HTTPMetadataProvider httpProvider = null;				
 						try {
 							if (MiscUtil.isNotEmpty(metadataurl)) {						
-								if (loadedproviders.containsKey(metadataurl)) {
+								if (loadedproviders.containsKey(metadataurl)) {									
 									//	PVP2 OA is actually loaded, to nothing
 									providersinuse.put(metadataurl, loadedproviders.get(metadataurl));
 									loadedproviders.remove(metadataurl);
 							
 							
-								} else if ( MiscUtil.isNotEmpty(metadataurl) &&
-										!providersinuse.containsKey(metadataurl) ) {
-									//PVP2 OA is new, add it to MOAMetadataProvider
-									String certBase64 = oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_PROTOCOLS_PVP2X_CERTIFICATE);
-									if (MiscUtil.isNotEmpty(certBase64)) {
-										byte[] cert = Base64Utils.decode(certBase64, false);
-										String oaFriendlyName = oaParam.getFriendlyName();
-									
-									
-										Logger.info("Loading metadata for: " + oaFriendlyName);
-										httpProvider = createNewHTTPMetaDataProvider(
-												metadataurl, 												
-												buildMetadataFilterChain(oaParam, metadataurl, cert),
-												oaFriendlyName);
-							
-										if (httpProvider != null)
-											providersinuse.put(metadataurl, httpProvider);
-									}
+									//INFO: load metadata dynamically if they are requested 
+//								} else if ( MiscUtil.isNotEmpty(metadataurl) &&
+//										!providersinuse.containsKey(metadataurl) ) {
+//									//PVP2 OA is new, add it to MOAMetadataProvider
+//									String certBase64 = oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_PROTOCOLS_PVP2X_CERTIFICATE);
+//									if (MiscUtil.isNotEmpty(certBase64)) {
+//										byte[] cert = Base64Utils.decode(certBase64, false);
+//										String oaFriendlyName = oaParam.getFriendlyName();
+//									
+//									
+//										Logger.info("Loading metadata for: " + oaFriendlyName);
+//										httpProvider = createNewHTTPMetaDataProvider(
+//												metadataurl, 												
+//												buildMetadataFilterChain(oaParam, metadataurl, cert),
+//												oaFriendlyName);
+//							
+//										if (httpProvider != null)
+//											providersinuse.put(metadataurl, httpProvider);
+//									}
 						
 								}
 							}
@@ -339,15 +373,21 @@ public class MOAMetadataProvider extends SimpleMOAMetadataProvider
 				}
 			}
 				
-			instance = null;
+			internalProvider = new ChainingMetadataProvider();
 		} else {
 			Logger.warn("ReInitalize MOAMetaDataProvider is not possible! MOA-ID Instance has to be restarted manualy");
 		}
 	}
 	
-	private MOAMetadataProvider() {
+	@Deprecated
+	/**
+	 * Load all PVP metadata from OA configuration
+	 * 
+	 * This method is deprecated because OA metadata should be loaded dynamically 
+	 * if the corresponding OA is requested.
+	 */
+	private void loadAllPVPMetadataFromKonfiguration() {
 		ChainingMetadataProvider chainProvider = new ChainingMetadataProvider();
-		
 		Logger.info("Loading metadata");		
 		Map<String, MetadataProvider> providersinuse = new HashMap<String, MetadataProvider>();
 		try {
@@ -417,14 +457,15 @@ public class MOAMetadataProvider extends SimpleMOAMetadataProvider
 								+ e.getMessage(), e);
 			}
 			
+			internalProvider = chainProvider;
+			
 		} catch (ConfigurationException e) {
 			Logger.error("Access MOA-ID configuration FAILED.", e);
 			
 		}
-		
-		internalProvider = chainProvider;
+				
 	}
-	
+		
 	private PVPMetadataFilterChain buildMetadataFilterChain(IOAAuthParameters oaParam, String metadataURL, byte[] certificate) throws CertificateException {
 		PVPMetadataFilterChain filterChain = new PVPMetadataFilterChain(metadataURL, certificate);
 		filterChain.getFilters().add(new SchemaValidationFilter());
@@ -505,17 +546,30 @@ public class MOAMetadataProvider extends SimpleMOAMetadataProvider
 			
 		}
 		
+//		if (entityDesc != null)
+//			lastAccess.put(entityID, new Date());
+		
 		return entityDesc;
 	}
 
 	public List<RoleDescriptor> getRole(String entityID, QName roleName)
-			throws MetadataProviderException {
-		return internalProvider.getRole(entityID, roleName);
+			throws MetadataProviderException {		
+		List<RoleDescriptor> result = internalProvider.getRole(entityID, roleName);
+		
+//		if (result != null)
+//			lastAccess.put(entityID, new Date());
+		
+		return result; 
 	}
 
 	public RoleDescriptor getRole(String entityID, QName roleName,
 			String supportedProtocol) throws MetadataProviderException {
-		return internalProvider.getRole(entityID, roleName, supportedProtocol);
+		RoleDescriptor result = internalProvider.getRole(entityID, roleName, supportedProtocol);
+		
+//		if (result != null)
+//			lastAccess.put(entityID, new Date());
+		
+		return result; 
 	}
 
 	/* (non-Javadoc)
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/SimpleMOAMetadataProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/SimpleMOAMetadataProvider.java
index 442455d4b..8261a86c1 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/SimpleMOAMetadataProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/SimpleMOAMetadataProvider.java
@@ -81,7 +81,7 @@ public abstract class SimpleMOAMetadataProvider implements MetadataProvider{
 				}
 			}
 			
-			timer = new Timer();
+			timer = new Timer(true);
 			httpProvider = new HTTPMetadataProvider(timer, httpClient, 
 					metadataURL);
 			httpProvider.setParserPool(new BasicParserPool());
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/SAMLVerificationEngine.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/SAMLVerificationEngine.java
index f384dd511..f6104bdeb 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/SAMLVerificationEngine.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/SAMLVerificationEngine.java
@@ -41,6 +41,7 @@ import org.opensaml.xml.security.criteria.EntityIDCriteria;
 import org.opensaml.xml.security.criteria.UsageCriteria;
 import org.opensaml.xml.signature.SignatureTrustEngine;
 import org.opensaml.xml.validation.ValidationException;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 import org.w3c.dom.Element;
 import org.xml.sax.SAXException;
@@ -56,6 +57,8 @@ import at.gv.egovernment.moa.util.MiscUtil;
 
 @Service("SAMLVerificationEngine")
 public class SAMLVerificationEngine {
+		
+	@Autowired(required=true) MOAMetadataProvider metadataProvider;
 	
 	public void verify(InboundMessage msg, SignatureTrustEngine sigTrustEngine ) throws org.opensaml.xml.security.SecurityException, Exception {
 		try {		
@@ -72,7 +75,8 @@ public class SAMLVerificationEngine {
 			
 			}			
 			Logger.debug("PVP2X message validation FAILED. Relead metadata for entityID: " + msg.getEntityID());
-			if (!MOAMetadataProvider.getInstance().refreshMetadataProvider(msg.getEntityID()))
+						
+			if (metadataProvider == null || !metadataProvider.refreshMetadataProvider(msg.getEntityID()))
 				throw e;
 			
 			else {