add untested Single LogOut support

1 files changed, 353 insertions, 343 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/storage/AuthenticationSessionStoreage.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/storage/AuthenticationSessionStoreage.java
index 6437a4cac..74a5e01ad 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/storage/AuthenticationSessionStoreage.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/storage/AuthenticationSessionStoreage.java
@@ -69,21 +69,6 @@ public class AuthenticationSessionStoreage {
 		}
 	}
 
-	public static void setAuthenticated(String moaSessionID, boolean value) {
-		
-		AuthenticatedSessionStore session;
-		
-		try {
-			session = searchInDatabase(moaSessionID);
-			session.setAuthenticated(value);
-			MOASessionDBUtils.saveOrUpdate(session);
-
-			
-		} catch (MOADatabaseException e) {
-			Logger.warn("isAuthenticated can not be stored in MOASession " + moaSessionID, e);
-		}
-	}
-	
 	public static AuthenticationSession createSession() throws MOADatabaseException {
 		String id = Random.nextRandom();
 		AuthenticationSession session = new AuthenticationSession(id);
@@ -110,108 +95,39 @@ public class AuthenticationSessionStoreage {
 		
 		return session;
 	}
-	
-	public static String createInterfederatedSession(IRequest req, boolean isAuthenticated) throws MOADatabaseException, AssertionAttributeExtractorExeption {
-		String id = Random.nextRandom();
-		AuthenticationSession session = new AuthenticationSession(id);
-		session.setAuthenticated(true);
-		session.setAuthenticatedUsed(false);
-		
-		AuthenticatedSessionStore dbsession = new AuthenticatedSessionStore();
-		dbsession.setSessionid(id);
-		dbsession.setAuthenticated(isAuthenticated);
-		dbsession.setInterfederatedSSOSession(true);
-		
-		//set Timestamp in this state, because automated timestamp generation is buggy in Hibernate 4.2.1
-		Date now = new Date();
-		dbsession.setCreated(now);
-		dbsession.setUpdated(now);
-		
-		dbsession.setSession(SerializationUtils.serialize(session));
-		
-		//add interfederation information
-		List<InterfederationSessionStore> idpList = dbsession.getInderfederation();
-		InterfederationSessionStore idp = null;
-		if (idpList == null) {
-			idpList = new ArrayList<InterfederationSessionStore>();
-			dbsession.setInderfederation(idpList);
-			
-		} else {
-			for (InterfederationSessionStore el : idpList) {
-				//resue old entry if interfederation IDP is reused for authentication
-				if (el.getIdpurlprefix().equals(req.getInterfederationResponse().getEntityID()))
-					idp = el;
-				
-			}			
-		}
 
-		//create new interfederation IDP entry
-		if (idp == null) {
-			idp = new InterfederationSessionStore();
-			idp.setCreated(now);
-			idp.setIdpurlprefix(req.getInterfederationResponse().getEntityID());
-			
-		}
-		
-		AssertionAttributeExtractor extract = new AssertionAttributeExtractor(req.getInterfederationResponse().getResponse());		
-		idp.setSessionIndex(extract.getSessionIndex());
-		idp.setUserNameID(extract.getNameID());
-		idp.setAttributesRequested(false);
-		idp.setQAALevel(extract.getQAALevel());
-		idp.setMoasession(dbsession);
-		idpList.add(idp);
-		
+	public static AuthenticationSession getSession(String sessionID) throws MOADatabaseException {
 		
-		//store AssertionStore element to Database
 		try {
-			MOASessionDBUtils.saveOrUpdate(dbsession);
-			Logger.info("MOASession with sessionID=" + id + " is stored in Database");
-			
+			AuthenticatedSessionStore dbsession = searchInDatabase(sessionID);
+			return decryptSession(dbsession);
+								
 		} catch (MOADatabaseException e) {
-			Logger.warn("MOASession could not be created.");
-			throw new MOADatabaseException(e);
+			Logger.info("No MOA Session with id: " + sessionID);
+			throw new MOADatabaseException("No MOA Session with id: " + sessionID);
+			
+		} catch (Throwable e) {
+			Logger.warn("MOASession deserialization-exception by using MOASessionID=" + sessionID, e);
+			throw new MOADatabaseException("MOASession deserialization-exception");
 		}
-		
-		return id;
 	}
-		
+	
 	public static void storeSession(AuthenticationSession session) throws MOADatabaseException, BuildException {
-		
-		try {
-			AuthenticatedSessionStore dbsession = searchInDatabase(session.getSessionID());
-			dbsession.setAuthenticated(session.isAuthenticated());
-			byte[] serialized = SerializationUtils.serialize(session);
-			
-			EncryptedData encdata = SessionEncrytionUtil.encrypt(serialized);
-			dbsession.setSession(encdata.getEncData());
-			dbsession.setIv(encdata.getIv());
-			
-			//set Timestamp in this state, because automated timestamp generation is buggy in Hibernate 4.2.1
-			dbsession.setUpdated(new Date());
-			
-			MOASessionDBUtils.saveOrUpdate(dbsession);
-			Logger.debug("MOASession with sessionID=" + session.getSessionID() + " is stored in Database");
-			
-		} catch (MOADatabaseException e) {
-			Logger.warn("MOASession could not be stored.");
-			throw new MOADatabaseException(e);
-		} 	
+		storeSession(session, null);
 	}
 	
 	public static void storeSession(AuthenticationSession session, String pendingRequestID) throws MOADatabaseException, BuildException {
 		
 		try {
 			AuthenticatedSessionStore dbsession = searchInDatabase(session.getSessionID());
-			dbsession.setPendingRequestID(pendingRequestID);
 			
-			dbsession.setAuthenticated(session.isAuthenticated());
-			byte[] serialized = SerializationUtils.serialize(session);
-			
-			EncryptedData encdata = SessionEncrytionUtil.encrypt(serialized);
-			dbsession.setSession(encdata.getEncData());
-			dbsession.setIv(encdata.getIv());
+			if (MiscUtil.isNotEmpty(pendingRequestID))
+				dbsession.setPendingRequestID(pendingRequestID);
+						
+			encryptSession(session, dbsession);
 			
 			//set Timestamp in this state, because automated timestamp generation is buggy in Hibernate 4.2.1
+			dbsession.setAuthenticated(session.isAuthenticated());
 			dbsession.setUpdated(new Date());
 			
 			MOASessionDBUtils.saveOrUpdate(dbsession);
@@ -223,7 +139,6 @@ public class AuthenticationSessionStoreage {
 		} 	
 	}
 	
-	
 	public static void destroySession(String moaSessionID) throws MOADatabaseException {
 		
 		Session session = MOASessionDBUtils.getCurrentSession();
@@ -246,10 +161,8 @@ public class AuthenticationSessionStoreage {
 			   	throw new MOADatabaseException("No session found with this sessionID");
 			  }
 			  
-			 AuthenticatedSessionStore dbsession = (AuthenticatedSessionStore) result.get(0);
-			 
-			 session.getTransaction().commit();
-			  
+			 AuthenticatedSessionStore dbsession = (AuthenticatedSessionStore) result.get(0);			 
+			 session.getTransaction().commit();			  
 			 cleanDelete(dbsession);			
 		  }
 				
@@ -267,16 +180,11 @@ public class AuthenticationSessionStoreage {
 					+ "to " + id);
 			
 			session.setSessionID(id);
+			encryptSession(session, dbsession);
 			
 			dbsession.setSessionid(id);
 			dbsession.setAuthenticated(session.isAuthenticated());
-			
-			byte[] serialized = SerializationUtils.serialize(session);
-			
-			EncryptedData encdata = SessionEncrytionUtil.encrypt(serialized);
-			dbsession.setSession(encdata.getEncData());
-			dbsession.setIv(encdata.getIv());
-			
+						
 			//set Timestamp in this state, because automated timestamp generation is buggy in Hibernate 4.2.1
 			dbsession.setUpdated(new Date());
 			
@@ -290,7 +198,92 @@ public class AuthenticationSessionStoreage {
 			throw new AuthenticationException("TODO!", null);
 		}
 	}
+		
+	public static void setAuthenticated(String moaSessionID, boolean value) {
+		
+		AuthenticatedSessionStore session;
+		
+		try {
+			session = searchInDatabase(moaSessionID);
+			session.setAuthenticated(value);
+			MOASessionDBUtils.saveOrUpdate(session);
 
+			
+		} catch (MOADatabaseException e) {
+			Logger.warn("isAuthenticated can not be stored in MOASession " + moaSessionID, e);
+		}
+	}
+	
+	public static String getMOASessionSSOID(String SSOSessionID) {
+		  MiscUtil.assertNotNull(SSOSessionID, "moasessionID");	  
+		  Logger.trace("Get authenticated session with SSOID " + SSOSessionID + " from database.");
+		  Session session = MOASessionDBUtils.getCurrentSession();
+		  
+		  List<AuthenticatedSessionStore> result;
+		  
+		  synchronized (session) {
+			  session.beginTransaction();
+			  Query query = session.getNamedQuery("getSessionWithSSOID");
+			  query.setParameter("sessionid", SSOSessionID);
+			  result = query.list();
+			  
+			  //send transaction
+			  session.getTransaction().commit();
+		  }
+		  
+		  Logger.trace("Found entries: " + result.size());
+		  
+		  //Assertion requires an unique artifact
+		  if (result.size() != 1) {
+			 Logger.trace("No entries found.");
+			 return null;
+					 
+		  } else {
+			  return result.get(0).getSessionid();
+			 
+		  }		  
+	}
+	
+	public static boolean isSSOSession(String sessionID) throws MOADatabaseException {
+		try {
+			AuthenticatedSessionStore dbsession = searchInDatabase(sessionID);
+			return dbsession.isSSOSession();
+			
+		} catch (MOADatabaseException e) {
+			Logger.info("No MOA Session with id: " + sessionID);
+			throw new MOADatabaseException("No MOA Session with id: " + sessionID);
+		}				
+	}
+	
+	public static AuthenticatedSessionStore isValidSessionWithSSOID(String SSOId, String moaSessionId) {		
+		  MiscUtil.assertNotNull(SSOId, "SSOSessionID");	  
+		  Logger.trace("Get authenticated session with SSOID " + SSOId + " from database.");
+		  Session session = MOASessionDBUtils.getCurrentSession();
+		  
+		  List<AuthenticatedSessionStore> result;
+		  
+		  synchronized (session) {
+			  session.beginTransaction();
+			  Query query = session.getNamedQuery("getSessionWithSSOID");
+			  query.setParameter("sessionid", SSOId);
+			  result = query.list();
+			  
+			  //send transaction
+			  session.getTransaction().commit();
+		  }
+		  
+		  Logger.trace("Found entries: " + result.size());
+		  
+		  //Assertion requires an unique artifact
+		  if (result.size() != 1) {
+			 Logger.trace("No entries found.");
+			 return null;
+					 
+		  } else {
+			  return result.get(0);
+		  }		
+	}
+	
 	public static void addSSOInformation(String moaSessionID, String SSOSessionID, 
 			SLOInformationInterface SLOInfo, String OAUrl) throws AuthenticationException {
 		
@@ -390,56 +383,36 @@ public class AuthenticationSessionStoreage {
 	  		 throw new AuthenticationException("SSO Session information can not be stored!  --> SSO is deactivated", null);	
 	  	 }
 	}
-	
-	
-	public static AuthenticationSession getSession(String sessionID) throws MOADatabaseException {
+
+	public static List<OASessionStore> getAllActiveOAFromMOASession(AuthenticationSession moaSession) {
+		MiscUtil.assertNotNull(moaSession, "MOASession");
 		
 		try {
-			AuthenticatedSessionStore dbsession = searchInDatabase(sessionID);
+			AuthenticatedSessionStore dbsession = searchInDatabase(moaSession.getSessionID());
+			return dbsession.getActiveOAsessions();
 			
-			//decrypt Session
-			EncryptedData encdata = new EncryptedData(dbsession.getSession(),
-					dbsession.getIv());
-			byte[] decrypted = SessionEncrytionUtil.decrypt(encdata);
-					
-			AuthenticationSession session = (AuthenticationSession) SerializationUtils.deserialize(decrypted);
-
-			return session;
-								
 		} catch (MOADatabaseException e) {
-			Logger.info("No MOA Session with id: " + sessionID);
-			throw new MOADatabaseException("No MOA Session with id: " + sessionID);
-			
-		} catch (Throwable e) {
-			Logger.warn("MOASession deserialization-exception by using MOASessionID=" + sessionID, e);
-			throw new MOADatabaseException("MOASession deserialization-exception");
-		}
-	}
-	
-	public static boolean isSSOSession(String sessionID) throws MOADatabaseException {
-		try {
-			AuthenticatedSessionStore dbsession = searchInDatabase(sessionID);
-			return dbsession.isSSOSession();
+			Logger.warn("NO session information found for sessionID " + moaSession.getSessionID(), e);
 			
-		} catch (MOADatabaseException e) {
-			Logger.info("No MOA Session with id: " + sessionID);
-			throw new MOADatabaseException("No MOA Session with id: " + sessionID);
 		}
-		
-		
+				
+		return null;
 	}
 	
-	public static String getMOASessionSSOID(String SSOSessionID) {
-		  MiscUtil.assertNotNull(SSOSessionID, "moasessionID");	  
-		  Logger.trace("Get authenticated session with SSOID " + SSOSessionID + " from database.");
+	public static AuthenticationSession searchMOASessionWithNameIDandOAID(String oaID, String userNameID) {	  
+		  MiscUtil.assertNotNull(oaID, "OnlineApplicationIdentifier");
+		  MiscUtil.assertNotNull(userNameID, "userNameID");
+		  Logger.trace("Get moaSession for userNameID " + userNameID + " and OA " 
+				  + oaID + " from database.");
 		  Session session = MOASessionDBUtils.getCurrentSession();
-		  
+
 		  List<AuthenticatedSessionStore> result;
 		  
 		  synchronized (session) {
 			  session.beginTransaction();
-			  Query query = session.getNamedQuery("getSessionWithSSOID");
-			  query.setParameter("sessionid", SSOSessionID);
+			  Query query = session.getNamedQuery("getMOASessionWithNameIDandOAID");
+			  query.setParameter("oaID", oaID);
+			  query.setParameter("nameID", userNameID);
 			  result = query.list();
 			  
 			  //send transaction
@@ -450,28 +423,35 @@ public class AuthenticationSessionStoreage {
 		  
 		  //Assertion requires an unique artifact
 		  if (result.size() != 1) {
-			 Logger.trace("No entries found.");
-			 return null;
-					 
-		  } else {
-			  return result.get(0).getSessionid();
-			 
+			 Logger.trace("No unique entry found.");
+		   	 return null;
+		   	
 		  }
-		  
+		try {  		  
+			return  decryptSession(result.get(0));
+			
+		} catch (BuildException e) {
+			Logger.warn("MOASession deserialization-exception by using MOASessionID=" + result.get(0).getSessionid(), e);
+			return null;
+		}
 	}
 	
-	public static AuthenticatedSessionStore isValidSessionWithSSOID(String SSOId, String moaSessionId) {
-		
-		  MiscUtil.assertNotNull(SSOId, "SSOSessionID");	  
-		  Logger.trace("Get authenticated session with SSOID " + SSOId + " from database.");
+	public static OASessionStore searchActiveOASSOSession(AuthenticationSession moaSession, String oaID, String protocolType) {
+		  MiscUtil.assertNotNull(moaSession, "MOASession");	  
+		  MiscUtil.assertNotNull(oaID, "OnlineApplicationIdentifier");
+		  MiscUtil.assertNotNull(protocolType, "usedProtocol");
+		  Logger.trace("Get active OnlineApplication for sessionID " + moaSession.getSessionID() + " with OAID "
+				  + oaID + " from database.");
 		  Session session = MOASessionDBUtils.getCurrentSession();
 		  
 		  List<AuthenticatedSessionStore> result;
 		  
 		  synchronized (session) {
 			  session.beginTransaction();
-			  Query query = session.getNamedQuery("getSessionWithSSOID");
-			  query.setParameter("sessionid", SSOId);
+			  Query query = session.getNamedQuery("getActiveOAWithSessionIDandOAIDandProtocol");
+			  query.setParameter("sessionID", moaSession.getSessionID());
+			  query.setParameter("oaID", oaID);
+			  query.setParameter("protocol", protocolType);
 			  result = query.list();
 			  
 			  //send transaction
@@ -481,14 +461,58 @@ public class AuthenticationSessionStoreage {
 		  Logger.trace("Found entries: " + result.size());
 		  
 		  //Assertion requires an unique artifact
-		  if (result.size() != 1) {
+		  if (result.size() == 0) {
 			 Logger.trace("No entries found.");
-			 return null;
-					 
-		  } else {
-			  return result.get(0);
+		   	 return null;
+		   	
 		  }
-		
+		  
+		  return  result.get(0).getActiveOAsessions().get(0);
+	}
+	
+	public static String getPendingRequestID(String sessionID) {
+		try {
+			AuthenticatedSessionStore dbsession = searchInDatabase(sessionID);
+			return dbsession.getPendingRequestID();
+			
+		} catch (MOADatabaseException e) {
+			Logger.warn("MOASession with ID " + sessionID + " not found");
+			return "";
+		}
+	}
+	
+	public static AuthenticationSession getSessionWithPendingRequestID(String pedingRequestID) {
+		try {
+			  MiscUtil.assertNotNull(pedingRequestID, "pedingRequestID");	  
+			  Logger.trace("Get authenticated session with pedingRequestID " + pedingRequestID + " from database.");
+			  Session session = MOASessionDBUtils.getCurrentSession();
+			  
+			  List<AuthenticatedSessionStore> result;
+			  
+			  synchronized (session) {
+				  session.beginTransaction();
+				  Query query = session.getNamedQuery("getSessionWithPendingRequestID");
+				  query.setParameter("sessionid", pedingRequestID);
+				  result = query.list();
+				  
+				  //send transaction
+				  session.getTransaction().commit();
+			  }
+			  
+			  Logger.trace("Found entries: " + result.size());
+			  
+			  //Assertion requires an unique artifact
+			  if (result.size() != 1) {
+				 Logger.trace("No entries found.");
+			   	return null;
+			  }
+			
+			  return decryptSession(result.get(0));
+			  								
+		} catch (Throwable e) {
+			Logger.warn("MOASession deserialization-exception by using MOASessionID=" + pedingRequestID);
+			return null;
+		}
 	}
 	
 	public static boolean deleteSessionWithPendingRequestID(String id) {
@@ -522,20 +546,7 @@ public class AuthenticationSessionStoreage {
 		
 		
 	}
-	
-	public static String getPendingRequestID(String sessionID) {
-		try {
-			AuthenticatedSessionStore dbsession = searchInDatabase(sessionID);
-			return dbsession.getPendingRequestID();
 			
-		} catch (MOADatabaseException e) {
-			Logger.warn("MOASession with ID " + sessionID + " not found");
-			return "";
-		}
-		
-	}
-	
-	
 	public static AuthenticationSession getSessionWithUserNameID(String nameID) {
 		
 		try {
@@ -558,149 +569,20 @@ public class AuthenticationSessionStoreage {
 			  Logger.trace("Found entries: " + result.size());
 			  
 			  //Assertion requires an unique artifact
-			  if (result.size() != 1) {
+			  if (result.size() == 0) {
 				 Logger.trace("No entries found.");
 			   	return null;
 			  }
 			
-			//decrypt Session
-			EncryptedData encdata = new EncryptedData(result.get(0).getSession(),
-						result.get(0).getIv());
-			byte[] decrypted = SessionEncrytionUtil.decrypt(encdata);			  					
-			return (AuthenticationSession) SerializationUtils.deserialize(decrypted);
-			
-								
+			  return decryptSession(result.get(0));
+											
 		} catch (Throwable e) {
 			Logger.warn("MOASession deserialization-exception by using MOASessionID=" + nameID);
 			return null;
 		}
 		
 	}
-	
-	public static AuthenticationSession getSessionWithPendingRequestID(String pedingRequestID) {
-		
-		try {
-			  MiscUtil.assertNotNull(pedingRequestID, "pedingRequestID");	  
-			  Logger.trace("Get authenticated session with pedingRequestID " + pedingRequestID + " from database.");
-			  Session session = MOASessionDBUtils.getCurrentSession();
-			  
-			  List<AuthenticatedSessionStore> result;
-			  
-			  synchronized (session) {
-				  session.beginTransaction();
-				  Query query = session.getNamedQuery("getSessionWithPendingRequestID");
-				  query.setParameter("sessionid", pedingRequestID);
-				  result = query.list();
-				  
-				  //send transaction
-				  session.getTransaction().commit();
-			  }
-			  
-			  Logger.trace("Found entries: " + result.size());
-			  
-			  //Assertion requires an unique artifact
-			  if (result.size() != 1) {
-				 Logger.trace("No entries found.");
-			   	return null;
-			  }
-			
-			//decrypt Session
-			EncryptedData encdata = new EncryptedData(result.get(0).getSession(),
-						result.get(0).getIv());
-			byte[] decrypted = SessionEncrytionUtil.decrypt(encdata);			  					
-			return (AuthenticationSession) SerializationUtils.deserialize(decrypted);
-			
-								
-		} catch (Throwable e) {
-			Logger.warn("MOASession deserialization-exception by using MOASessionID=" + pedingRequestID);
-			return null;
-		}
-	}
-	
-	public static void clean(long now, long authDataTimeOutCreated, long authDataTimeOutUpdated) {
-		Date expioredatecreate = new Date(now - authDataTimeOutCreated);		
-		Date expioredateupdate = new Date(now - authDataTimeOutUpdated);
-		
-		List<AuthenticatedSessionStore> results;
-		Session session = MOASessionDBUtils.getCurrentSession();
-		
-		synchronized (session) {			
-			session.beginTransaction();
-			Query query = session.getNamedQuery("getMOAISessionsWithTimeOut");
-			query.setTimestamp("timeoutcreate", expioredatecreate);
-			query.setTimestamp("timeoutupdate", expioredateupdate);
-			results = query.list();
-			session.getTransaction().commit();
-		}
-		
-		if (results.size() != 0) {
-			for(AuthenticatedSessionStore result : results) {
-				try { 
-					cleanDelete(result);
-					Logger.info("Authenticated session with sessionID=" + result.getSessionid() 
-							+ " after session timeout.");
 				
-				} catch (HibernateException e){
-					Logger.warn("Authenticated session with sessionID=" + result.getSessionid() 
-							+ " not removed after timeout! (Error during Database communication)", e);
-				}
-
-			}	
-		}	
-	}
-	
-	private static void cleanDelete(AuthenticatedSessionStore result) {		
-		try {
-			result.setSession(new byte[] {});
-			MOASessionDBUtils.saveOrUpdate(result);
-			
-		} catch (MOADatabaseException e) {
-			Logger.warn("Blank authenticated session with sessionID=" + result.getSessionid() + " FAILED.", e);
-			
-		} finally {
-			if (!MOASessionDBUtils.delete(result))
-				Logger.error("Authenticated session with sessionID=" + result.getSessionid() 
-							+ " not removed! (Error during Database communication)");
-			
-		}
-		
-		
-	}
-	
-	public static OASessionStore searchActiveOASSOSession(AuthenticationSession moaSession, String oaID, String protocolType) {
-		  MiscUtil.assertNotNull(moaSession, "MOASession");	  
-		  MiscUtil.assertNotNull(oaID, "OnlineApplicationIdentifier");
-		  MiscUtil.assertNotNull(protocolType, "usedProtocol");
-		  Logger.trace("Get active OnlineApplication for sessionID " + moaSession.getSessionID() + " with OAID "
-				  + oaID + " from database.");
-		  Session session = MOASessionDBUtils.getCurrentSession();
-		  
-		  List<AuthenticatedSessionStore> result;
-		  
-		  synchronized (session) {
-			  session.beginTransaction();
-			  Query query = session.getNamedQuery("getActiveOAWithSessionIDandOAIDandProtocol");
-			  query.setParameter("sessionID", moaSession.getSessionID());
-			  query.setParameter("oaID", oaID);
-			  query.setParameter("protocol", protocolType);
-			  result = query.list();
-			  
-			  //send transaction
-			  session.getTransaction().commit();
-		  }
-		  
-		  Logger.trace("Found entries: " + result.size());
-		  
-		  //Assertion requires an unique artifact
-		  if (result.size() == 0) {
-			 Logger.trace("No entries found.");
-		   	 return null;
-		   	
-		  }
-		  
-		  return  result.get(0).getActiveOAsessions().get(0);
-	}
-	
 	public static InterfederationSessionStore searchInterfederatedIDPFORSSOWithMOASession(String sessionID) {
 		  MiscUtil.assertNotNull(sessionID, "MOASession");	  
 		  Logger.trace("Get interfederated IDP for SSO with sessionID " + sessionID + " from database.");
@@ -761,6 +643,70 @@ public class AuthenticationSessionStoreage {
 		  return result.get(0).getInderfederation().get(0);
 	}
 	
+	public static String createInterfederatedSession(IRequest req, boolean isAuthenticated) throws MOADatabaseException, AssertionAttributeExtractorExeption {
+		String id = Random.nextRandom();
+		AuthenticationSession session = new AuthenticationSession(id);
+		session.setAuthenticated(true);
+		session.setAuthenticatedUsed(false);
+		
+		AuthenticatedSessionStore dbsession = new AuthenticatedSessionStore();
+		dbsession.setSessionid(id);
+		dbsession.setAuthenticated(isAuthenticated);
+		dbsession.setInterfederatedSSOSession(true);
+		
+		//set Timestamp in this state, because automated timestamp generation is buggy in Hibernate 4.2.1
+		Date now = new Date();
+		dbsession.setCreated(now);
+		dbsession.setUpdated(now);
+		
+		dbsession.setSession(SerializationUtils.serialize(session));
+		
+		//add interfederation information
+		List<InterfederationSessionStore> idpList = dbsession.getInderfederation();
+		InterfederationSessionStore idp = null;
+		if (idpList == null) {
+			idpList = new ArrayList<InterfederationSessionStore>();
+			dbsession.setInderfederation(idpList);
+			
+		} else {
+			for (InterfederationSessionStore el : idpList) {
+				//resue old entry if interfederation IDP is reused for authentication
+				if (el.getIdpurlprefix().equals(req.getInterfederationResponse().getEntityID()))
+					idp = el;
+				
+			}			
+		}
+
+		//create new interfederation IDP entry
+		if (idp == null) {
+			idp = new InterfederationSessionStore();
+			idp.setCreated(now);
+			idp.setIdpurlprefix(req.getInterfederationResponse().getEntityID());
+			
+		}
+		
+		AssertionAttributeExtractor extract = new AssertionAttributeExtractor(req.getInterfederationResponse().getResponse());		
+		idp.setSessionIndex(extract.getSessionIndex());
+		idp.setUserNameID(extract.getNameID());
+		idp.setAttributesRequested(false);
+		idp.setQAALevel(extract.getQAALevel());
+		idp.setMoasession(dbsession);
+		idpList.add(idp);
+		
+		
+		//store AssertionStore element to Database
+		try {
+			MOASessionDBUtils.saveOrUpdate(dbsession);
+			Logger.info("MOASession with sessionID=" + id + " is stored in Database");
+			
+		} catch (MOADatabaseException e) {
+			Logger.warn("MOASession could not be created.");
+			throw new MOADatabaseException(e);
+		}
+		
+		return id;
+	}
+	
 	public static InterfederationSessionStore searchInterfederatedIDPFORAttributeQueryWithSessionID(AuthenticationSession moaSession) {
 		  MiscUtil.assertNotNull(moaSession, "MOASession");	  
 		  Logger.trace("Get interfederated IDP for AttributeQuery with sessionID " + moaSession.getSessionID() + " from database.");
@@ -790,35 +736,6 @@ public class AuthenticationSessionStoreage {
 		  return result.get(0).getInderfederation().get(0);
 	}
 	
-	@SuppressWarnings("rawtypes")
-	private static AuthenticatedSessionStore searchInDatabase(String sessionID) throws MOADatabaseException {
-		  MiscUtil.assertNotNull(sessionID, "moasessionID");	  
-		  Logger.trace("Get authenticated session with sessionID " + sessionID + " from database.");
-		  Session session = MOASessionDBUtils.getCurrentSession();
-		  
-		  List result;
-		  
-		  synchronized (session) {
-			  session.beginTransaction();
-			  Query query = session.getNamedQuery("getSessionWithID");
-			  query.setParameter("sessionid", sessionID);
-			  result = query.list();
-			  
-			  //send transaction
-			  session.getTransaction().commit();
-		  }
-		  
-		  Logger.trace("Found entries: " + result.size());
-		  
-		  //Assertion requires an unique artifact
-		  if (result.size() != 1) {
-			 Logger.trace("No entries found.");
-		   	throw new MOADatabaseException("No session found with this sessionID");
-		  }
-		  
-		  return (AuthenticatedSessionStore) result.get(0);
-	}
-
 	/**
 	 * @param entityID
 	 * @param requestID
@@ -872,4 +789,97 @@ public class AuthenticationSessionStoreage {
 			return false;
 		}		
 	}
+	
+	public static void clean(long now, long authDataTimeOutCreated, long authDataTimeOutUpdated) {
+		Date expioredatecreate = new Date(now - authDataTimeOutCreated);		
+		Date expioredateupdate = new Date(now - authDataTimeOutUpdated);
+		
+		List<AuthenticatedSessionStore> results;
+		Session session = MOASessionDBUtils.getCurrentSession();
+		
+		synchronized (session) {			
+			session.beginTransaction();
+			Query query = session.getNamedQuery("getMOAISessionsWithTimeOut");
+			query.setTimestamp("timeoutcreate", expioredatecreate);
+			query.setTimestamp("timeoutupdate", expioredateupdate);
+			results = query.list();
+			session.getTransaction().commit();
+		}
+		
+		if (results.size() != 0) {
+			for(AuthenticatedSessionStore result : results) {
+				try { 
+					cleanDelete(result);
+					Logger.info("Authenticated session with sessionID=" + result.getSessionid() 
+							+ " after session timeout.");
+				
+				} catch (HibernateException e){
+					Logger.warn("Authenticated session with sessionID=" + result.getSessionid() 
+							+ " not removed after timeout! (Error during Database communication)", e);
+				}
+			}	
+		}	
+	}
+	
+	private static void encryptSession(AuthenticationSession session, AuthenticatedSessionStore dbsession) throws BuildException {
+		byte[] serialized = SerializationUtils.serialize(session);
+		
+		EncryptedData encdata = SessionEncrytionUtil.encrypt(serialized);
+		dbsession.setSession(encdata.getEncData());
+		dbsession.setIv(encdata.getIv());
+	}
+	
+	private static AuthenticationSession decryptSession(AuthenticatedSessionStore dbsession) throws BuildException {
+		EncryptedData encdata = new EncryptedData(dbsession.getSession(),
+				dbsession.getIv());
+		byte[] decrypted = SessionEncrytionUtil.decrypt(encdata);
+				
+		return (AuthenticationSession) SerializationUtils.deserialize(decrypted);
+		
+	}
+	
+	private static void cleanDelete(AuthenticatedSessionStore result) {		
+		try {
+			result.setSession(new byte[] {});
+			MOASessionDBUtils.saveOrUpdate(result);
+			
+		} catch (MOADatabaseException e) {
+			Logger.warn("Blank authenticated session with sessionID=" + result.getSessionid() + " FAILED.", e);
+			
+		} finally {
+			if (!MOASessionDBUtils.delete(result))
+				Logger.error("Authenticated session with sessionID=" + result.getSessionid() 
+							+ " not removed! (Error during Database communication)");
+			
+		}
+	}
+	
+	@SuppressWarnings("rawtypes")
+	private static AuthenticatedSessionStore searchInDatabase(String sessionID) throws MOADatabaseException {
+		  MiscUtil.assertNotNull(sessionID, "moasessionID");	  
+		  Logger.trace("Get authenticated session with sessionID " + sessionID + " from database.");
+		  Session session = MOASessionDBUtils.getCurrentSession();
+		  
+		  List result;
+		  
+		  synchronized (session) {
+			  session.beginTransaction();
+			  Query query = session.getNamedQuery("getSessionWithID");
+			  query.setParameter("sessionid", sessionID);
+			  result = query.list();
+			  
+			  //send transaction
+			  session.getTransaction().commit();
+		  }
+		  
+		  Logger.trace("Found entries: " + result.size());
+		  
+		  //Assertion requires an unique artifact
+		  if (result.size() != 1) {
+			 Logger.trace("No entries found.");
+		   	throw new MOADatabaseException("No session found with this sessionID");
+		  }
+		  
+		  return (AuthenticatedSessionStore) result.get(0);
+	}
 }