optimize authentication process in respect to session-transaction and transaction-store read/write operations

13 files changed, 139 insertions, 178 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/AbstractAuthServletTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/AbstractAuthServletTask.java
index 559d4fd4f..8c7583855 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/AbstractAuthServletTask.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/AbstractAuthServletTask.java
@@ -1,7 +1,5 @@
 package at.gv.egovernment.moa.id.auth.modules;

 

-import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID;

-

 import java.io.ByteArrayOutputStream;

 import java.io.IOException;

 import java.io.InputStream;

@@ -19,13 +17,10 @@ import org.apache.commons.fileupload.FileItemFactory;
 import org.apache.commons.fileupload.FileUploadException;

 import org.apache.commons.fileupload.disk.DiskFileItemFactory;

 import org.apache.commons.fileupload.servlet.ServletFileUpload;

-import org.apache.commons.lang.StringEscapeUtils;

 import org.apache.commons.lang3.ArrayUtils;

-import org.apache.commons.lang3.ObjectUtils;

 import org.springframework.beans.factory.annotation.Autowired;

 

 import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;

-import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;

 import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;

 import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

 import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

@@ -56,31 +51,40 @@ public abstract class AbstractAuthServletTask extends MoaIdTask {
 	protected IRequest pendingReq = null;

 	protected AuthenticationSession moasession = null;

 	

-	protected void defaultTaskInitialization(HttpServletRequest req, ExecutionContext executionContext) throws MOAIDException, MOADatabaseException {

-		String pendingRequestID = StringEscapeUtils.escapeHtml(

-				ObjectUtils.defaultIfNull(

-						(String) executionContext.get(PARAM_TARGET_PENDINGREQUESTID),

-						req.getParameter(PARAM_TARGET_PENDINGREQUESTID)));

+	public abstract void execute(ExecutionContext executionContext, HttpServletRequest request,

+			HttpServletResponse response) throws TaskExecutionException;

+	

+	

+	protected final IRequest internalExecute(IRequest pendingReq, ExecutionContext executionContext, HttpServletRequest request,

+			HttpServletResponse response) throws TaskExecutionException {

+		//set pending-request object

+		this.pendingReq = pendingReq;

 		

-		if (MiscUtil.isEmpty(pendingRequestID)) {				

-			Logger.info("No PendingRequestID received");

-			throw new MOAIDException("auth.10", new Object[]{"VerifyIdentityLink", "pendingRequestID"});

-		}

+		//execute task specific action

+		execute(executionContext, request, response);

 		

-		pendingReq = requestStoreage.getPendingRequest(pendingRequestID);	

+		//return pending-request object

+		return this.pendingReq;

+	}

 	

-		if (pendingReq == null) {

-			Logger.info("No PendingRequest with Id: " + pendingRequestID + " Maybe, a transaction timeout occure.");

-			throw new MOAIDException("auth.28", new Object[]{pendingRequestID});

-			

+	

+	/**

+	 * Default initialization loads the MOASession object from database

+	 * 

+	 * @param req

+	 * @param executionContext

+	 * @throws MOAIDException

+	 * @throws MOADatabaseException

+	 */

+	protected void defaultTaskInitialization(HttpServletRequest req, ExecutionContext executionContext) throws MOAIDException, MOADatabaseException {								

+		String moasessionid = pendingReq.getMOASessionIdentifier();			

+		if (MiscUtil.isEmpty(moasessionid)) {

+			Logger.warn("MOASessionID is empty.");

+			throw new MOAIDException("auth.18", new Object[] {});

 		}

-					

-		//change pending-request ID

-		String newPendingRequestID = requestStoreage.changePendingRequestID(pendingReq);

-		executionContext.put(MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID, newPendingRequestID);

-								

+		

 		try {			

-			moasession  = authenticatedSessionStorage.getSession(pendingReq.getMOASessionIdentifier());

+			moasession  = authenticatedSessionStorage.getSession(moasessionid);

 		

 			if (moasession == null) {

 				Logger.warn("MOASessionID is empty.");

@@ -88,8 +92,8 @@ public abstract class AbstractAuthServletTask extends MoaIdTask {
 			}

 			

 		} catch (MOADatabaseException e) {

-			Logger.info("MOASession with SessionID=" + pendingReq.getMOASessionIdentifier() + " is not found in Database");

-			throw new MOAIDException("init.04", new Object[] { pendingReq.getMOASessionIdentifier() });

+			Logger.info("MOASession with SessionID=" + moasessionid + " is not found in Database");

+			throw new MOAIDException("init.04", new Object[] { moasessionid });

 

 		} catch (Throwable e) {

 			Logger.info("No HTTP Session found!");

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateInterfedeartionRequestTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateInterfedeartionRequestTask.java
index d0c12a6f3..951a04cf6 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateInterfedeartionRequestTask.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateInterfedeartionRequestTask.java
@@ -55,7 +55,6 @@ import at.gv.egovernment.moa.id.config.ConfigurationException;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
 import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
 import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.moduls.IRequest;
 import at.gv.egovernment.moa.id.moduls.RequestImpl;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
 import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
@@ -85,9 +84,6 @@ public class CreateInterfedeartionRequestTask extends AbstractAuthServletTask {
 			throws TaskExecutionException {
 		boolean requiredLocalAuthentication = true;
 		
-		IRequest pendingReq = requestStoreage.getPendingRequest(
-				(String) executionContext.get(MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID));	
-
 		String idpEntityID = 
 				(String) executionContext.get(MOAIDAuthConstants.PROCESSCONTEXT_INTERFEDERATION_ENTITYID);
 				
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/EvaluateBKUSelectionTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/EvaluateBKUSelectionTask.java
index 3b18959a5..2f6137244 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/EvaluateBKUSelectionTask.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/EvaluateBKUSelectionTask.java
@@ -31,10 +31,8 @@ import org.apache.commons.lang.StringEscapeUtils;
 import org.springframework.stereotype.Service;
 
 import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
-import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.MiscUtil;
@@ -53,60 +51,19 @@ public class EvaluateBKUSelectionTask extends AbstractAuthServletTask {
 	public void execute(ExecutionContext executionContext, HttpServletRequest request, HttpServletResponse response)
 			throws TaskExecutionException {		
 		try {
-			//load pending request
-			String pendingReqID = request.getParameter(MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID);	    		    
-			pendingReqID = StringEscapeUtils.escapeHtml(pendingReqID);						
-			pendingReq = requestStoreage.getPendingRequest(pendingReqID);
-			
-			if (pendingReq == null) {
-				Logger.info("No PendingRequest with Id: " + executionContext.get("pendingRequestID") + " Maybe, a transaction timeout occure.");
-				throw new MOAIDException("auth.28", new Object[]{executionContext.get("pendingRequestID")});
-				
-			}
-			
-			//change pending-request ID
-			String newPendingRequestID = requestStoreage.changePendingRequestID(pendingReq);
-			executionContext.put(MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID, newPendingRequestID);
-	    	
-	    	String moaSessionID = pendingReq.getMOASessionIdentifier();
-	    	try {
-	    	    moasession = authenticatedSessionStorage.getSession(moaSessionID);
-	    	    
-	    	    if (moasession == null) {
-					Logger.info("MOASession with SessionID="+ moaSessionID + " is not found in Database");
-					throw new MOAIDException("init.04", new Object[] {
-							moaSessionID});
-	    	    	
-	    	    }
-	    	   	    	    
-				// set parameter execution context			
-				Enumeration<String> reqParamNames = request.getParameterNames();
-				while(reqParamNames.hasMoreElements()) {
-					String paramName = reqParamNames.nextElement();
-					if (MiscUtil.isNotEmpty(paramName) && 
-							!MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID.equalsIgnoreCase(paramName))
-						executionContext.put(paramName, request.getParameter(paramName));
-					
-				}
-	    	    
-				Logger.info("BKU is selected finished -> Start BKU communication ...");
-	    	    
-			} catch (MOADatabaseException e) {
-				Logger.info("MOASession with SessionID="+ moaSessionID + " is not found in Database");
-				throw new MOAIDException("init.04", new Object[] {
-						moaSessionID});
+			// set parameter execution context			
+			Enumeration<String> reqParamNames = request.getParameterNames();
+			while(reqParamNames.hasMoreElements()) {
+				String paramName = reqParamNames.nextElement();
+				if (MiscUtil.isNotEmpty(paramName) && 
+						!MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID.equalsIgnoreCase(paramName))
+					executionContext.put(paramName, 
+							StringEscapeUtils.escapeHtml(request.getParameter(paramName)));
 				
-			} catch (Throwable e) {
-				Logger.info("No HTTP Session found!");
-				throw new MOAIDException("auth.18", new Object[] {});
 			}
-	    	
-	    	
-			
-			
-		} catch (MOAIDException e) {
-			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
-			
+    	    
+			Logger.info("BKU is selected finished -> Start BKU selection evaluation ...");
+	    	    			
 		} catch (Exception e) {
 			Logger.warn("EvaluateBKUSelectionTask has an internal error", e);
 			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/FinalizeAuthenticationTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/FinalizeAuthenticationTask.java
index d1d2cdca8..816c05eab 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/FinalizeAuthenticationTask.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/FinalizeAuthenticationTask.java
@@ -31,11 +31,9 @@ import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
 import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
-import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
 import at.gv.egovernment.moa.id.moduls.RequestImpl;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
 import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.MiscUtil;
 
 /**
  * @author tlenz
@@ -53,44 +51,8 @@ public class FinalizeAuthenticationTask extends AbstractAuthServletTask {
 			throws TaskExecutionException {
 		
 		try {
-			pendingReq = requestStoreage.getPendingRequest(
-					(String) executionContext.get(MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID));	
-		
-			if (pendingReq == null) {
-				Logger.info("No PendingRequest with Id: " + executionContext.get("pendingRequestID") + " Maybe, a transaction timeout occure.");
-				throw new MOAIDException("auth.28", new Object[]{executionContext.get("pendingRequestID")});
-				
-			}
-			
-			//get Session from context
-			String moasessionid = pendingReq.getMOASessionIdentifier();			
-			if (MiscUtil.isEmpty(moasessionid)) {
-				Logger.warn("MOASessionID is empty.");
-				throw new MOAIDException("auth.18", new Object[] {});
-			}
-			
-			try {			
-				moasession = authenticatedSessionStorage.getSession(moasessionid);
-				if (moasession == null) {
-					Logger.info("MOASession with SessionID=" + moasessionid + " is not found in Database");
-					throw new MOAIDException("init.04", new Object[] { moasessionid });
-					
-				}
-					
-				
-			} catch (MOADatabaseException e) {
-				Logger.info("MOASession with SessionID=" + moasessionid + " is not found in Database");
-				throw new MOAIDException("init.04", new Object[] { moasessionid });
-
-			} catch (Throwable e) {
-				Logger.info("No HTTP Session found!");
-				throw new MOAIDException("auth.18", new Object[] {});
-			
-			} finally {
-				executionContext.remove(MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID);
-			
-			}
-		
+			defaultTaskInitialization(request, executionContext);
+								
 			//set MOASession to authenticated and store MOASession
 			moasession.setAuthenticated(true);
 			String newMOASessionID = authenticatedSessionStorage.changeSessionID(moasession);
@@ -110,8 +72,11 @@ public class FinalizeAuthenticationTask extends AbstractAuthServletTask {
 			Logger.warn("FinalizeAuthenticationTask has an internal error", e);
 			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
 			
+		} finally {
+			executionContext.remove(MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID);
+			
 		}
-
+	
 	}
 
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateBKUSelectionFrameTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateBKUSelectionFrameTask.java
index 47b68bc51..6ff730898 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateBKUSelectionFrameTask.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateBKUSelectionFrameTask.java
@@ -30,7 +30,6 @@ import javax.servlet.http.HttpServletResponse;
 import org.springframework.stereotype.Service;
 
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
-import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
 import at.gv.egovernment.moa.id.auth.builder.LoginFormBuilder;
 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
 import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
@@ -53,16 +52,7 @@ public class GenerateBKUSelectionFrameTask extends AbstractAuthServletTask {
 	@Override
 	public void execute(ExecutionContext executionContext, HttpServletRequest request, HttpServletResponse response)
 			throws TaskExecutionException {
-		try {
-			pendingReq = requestStoreage.getPendingRequest(
-					(String) executionContext.get(MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID));
-			
-			if (pendingReq == null) {
-				Logger.info("No PendingRequest with Id: " + executionContext.get("pendingRequestID") + " Maybe, a transaction timeout occure.");
-				throw new MOAIDException("auth.28", new Object[]{executionContext.get("pendingRequestID")});
-				
-			}
-			
+		try {			
 			revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 					pendingReq, MOAIDEventConstants.AUTHPROCESS_BKUSELECTION_INIT);
 							
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/RestartAuthProzessManagement.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/RestartAuthProzessManagement.java
index d7859dd8b..920b0e2b4 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/RestartAuthProzessManagement.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/RestartAuthProzessManagement.java
@@ -30,12 +30,10 @@ import javax.servlet.http.HttpServletResponse;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
-import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
 import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
 import at.gv.egovernment.moa.id.auth.modules.registration.ModuleRegistration;
-import at.gv.egovernment.moa.id.moduls.IRequest;
 import at.gv.egovernment.moa.id.moduls.RequestImpl;
 import at.gv.egovernment.moa.id.process.ExecutionContextImpl;
 import at.gv.egovernment.moa.id.process.ProcessEngine;
@@ -57,17 +55,7 @@ public class RestartAuthProzessManagement  extends AbstractAuthServletTask {
 	@Override
 	public void execute(ExecutionContext executionContext, HttpServletRequest request, HttpServletResponse response)
 			throws TaskExecutionException {
-		IRequest pendingReq = null;
-		try {
-			pendingReq = requestStoreage.getPendingRequest(
-					(String) executionContext.get(MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID));
-			
-			if (pendingReq == null) {
-				Logger.info("No PendingRequest with Id: " + executionContext.get("pendingRequestID") + " Maybe, a transaction timeout occure.");
-				throw new MOAIDException("auth.28", new Object[]{executionContext.get("pendingRequestID")});
-				
-			}
-			
+		try {			
 			//create a new execution context and copy all elements to new context
 			ExecutionContext newec = new ExecutionContextImpl(); 
 			Set<String> entries = executionContext.keySet();
@@ -107,7 +95,7 @@ public class RestartAuthProzessManagement  extends AbstractAuthServletTask {
 			Logger.info("BKU is selected -> Start BKU communication ...");
 			
 			// start process
-			processEngine.start(processInstanceId);
+			processEngine.start(pendingReq);
 			
 			
 		} catch (MOAIDException e) {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java
index 3699633bd..b7e95785b 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java
@@ -199,6 +199,7 @@ public class StartAuthentificationParameterParser extends MOAIDAuthConstants{
 		
 	    if (!ParamValidatorUtils.isValidTemplate(req, templateURL, oaParam.getTemplateURL()))
 		       throw new WrongParametersException("StartAuthentication", PARAM_TEMPLATE, "auth.12");
+	    
 	    protocolReq.setGenericDataToSession(
 	    		MOAIDAuthConstants.AUTHPROCESS_DATA_SECURITYLAYERTEMPLATE, 
 	    		templateURL);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractProcessEngineSignalController.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractProcessEngineSignalController.java
index 2abe1582d..8b96b884e 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractProcessEngineSignalController.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractProcessEngineSignalController.java
@@ -40,6 +40,9 @@ public abstract class AbstractProcessEngineSignalController extends AbstractCont
 				

 			}

 			

+			//change pending-request ID

+			requestStorage.changePendingRequestID(pendingReq);

+			

 			//add transactionID and unique sessionID to Logger

 			TransactionIDUtils.setSessionId(pendingReq.getUniqueSessionIdentifier());

 			TransactionIDUtils.setTransactionId(pendingReq.getUniqueTransactionIdentifier());

@@ -50,9 +53,7 @@ public abstract class AbstractProcessEngineSignalController extends AbstractCont
 			}

 

 			// wake up next task

-			processEngine.signal(pendingReq.getProcessInstanceId());

-

-			//TODO:

+			processEngine.signal(pendingReq);

 			

 		} catch (Exception ex) {

 			handleError(null, ex, req, resp, pendingRequestID);

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java
index 7863c684e..f77042bc5 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java
@@ -34,6 +34,7 @@ import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.apache.commons.lang.StringEscapeUtils;
 import org.apache.velocity.VelocityContext;
 import org.opensaml.saml2.core.LogoutRequest;
 import org.opensaml.saml2.core.LogoutResponse;
@@ -364,7 +365,8 @@ public class AuthenticationManager extends MOAIDAuthConstants {
 				String paramName = reqParamNames.nextElement();
 				if (MiscUtil.isNotEmpty(paramName) && 
 						MOAIDAuthConstants.LEGACYPARAMETERWHITELIST.contains(paramName))
-					executionContext.put(paramName, httpReq.getParameter(paramName));
+					executionContext.put(paramName, 
+							StringEscapeUtils.escapeHtml(httpReq.getParameter(paramName)));
 				
 			}			
 		}
@@ -415,7 +417,7 @@ public class AuthenticationManager extends MOAIDAuthConstants {
 			requestStoreage.storePendingRequest(pendingReq);
 									
 	    	// start process
-			processEngine.start(processInstanceId);
+			processEngine.start(pendingReq);
 			
 		} catch (ProcessExecutionException e) {
 			Throwable cause = e.getCause();
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/ProcessEngine.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/ProcessEngine.java
index 26301d664..b68f170c8 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/ProcessEngine.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/ProcessEngine.java
@@ -3,6 +3,7 @@ package at.gv.egovernment.moa.id.process;
 
 import java.io.InputStream;
 
+import at.gv.egovernment.moa.id.moduls.IRequest;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
 import at.gv.egovernment.moa.id.process.model.ProcessDefinition;
 
@@ -86,24 +87,24 @@ public interface ProcessEngine {
 	ProcessInstance getProcessInstance(String processInstanceId);
 
 	/**
-	 * Starts the process using the given {@code processInstanceId}.
+	 * Starts the process using the given {@code pendingReq}.
 	 * 
-	 * @param processInstanceId
-	 *            The process instance id.
+	 * @param pendingReq
+	 *            The protocol request for which a process should be started.
 	 * @throws ProcessExecutionException
 	 *             Thrown in case of error.
 	 */
-	void start(String processInstanceId) throws ProcessExecutionException;
+	void start(IRequest pendingReq) throws ProcessExecutionException;
 
 
 	/**
 	 * Resumes process execution after an asynchronous task has been executed.
 	 * 
-	 * @param processInstanceId
+	 * @param pendingReq
 	 *            The process instance id.
 	 * @throws ProcessExecutionException
 	 *             Thrown in case of error.
 	 */
-	void signal(String processInstanceId) throws ProcessExecutionException;
+	void signal(IRequest pendingReq) throws ProcessExecutionException;
 
 }
\ No newline at end of file
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/ProcessEngineImpl.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/ProcessEngineImpl.java
index 6da695d75..437eee63c 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/ProcessEngineImpl.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/ProcessEngineImpl.java
@@ -15,7 +15,9 @@ import org.slf4j.MDC;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.ApplicationContext;
 
+import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
+import at.gv.egovernment.moa.id.moduls.IRequest;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
 import at.gv.egovernment.moa.id.process.api.ExpressionEvaluationContext;
 import at.gv.egovernment.moa.id.process.api.ExpressionEvaluator;
@@ -116,10 +118,16 @@ public class ProcessEngineImpl implements ProcessEngine {
 	}
 
 	@Override
-	public void start(String processInstanceId) throws ProcessExecutionException {
-
+	public void start(IRequest pendingReq) throws ProcessExecutionException {
 		try {
-			ProcessInstance pi = loadProcessInstance(processInstanceId);
+			if (MiscUtil.isEmpty(pendingReq.getProcessInstanceId())) {
+				log.error("Pending-request with id:" + pendingReq.getRequestID() 
+					+ " includes NO 'ProcessInstanceId'");
+				throw new ProcessExecutionException("Pending-request with id:" + pendingReq.getRequestID() 
+					+ " includes NO 'ProcessInstanceId'");
+			}
+			
+			ProcessInstance pi = loadProcessInstance(pendingReq.getProcessInstanceId());
 
 			MDC.put(MDC_CTX_PI_NAME, pi.getId());
 
@@ -129,9 +137,12 @@ public class ProcessEngineImpl implements ProcessEngine {
 			log.info("Starting process instance '{}'.", pi.getId());
 			// execute process
 			pi.setState(ProcessInstanceState.STARTED);
-			execute(pi);
+			execute(pi, pendingReq);
 
-			saveOrUpdateProcessInstance(pi);
+			//store ProcessInstance if it is not already ended
+			if (!ProcessInstanceState.ENDED.equals(pi.getState()))
+				saveOrUpdateProcessInstance(pi);
+				
 		} catch (MOADatabaseException e) {
 			throw new ProcessExecutionException("Unable to load/save process instance.", e);
 
@@ -141,10 +152,17 @@ public class ProcessEngineImpl implements ProcessEngine {
 	}
 	
 	@Override
-	public void signal(String processInstanceId) throws ProcessExecutionException {
+	public void signal(IRequest pendingReq) throws ProcessExecutionException {
 
 		try {
-			ProcessInstance pi = loadProcessInstance(processInstanceId);
+			if (MiscUtil.isEmpty(pendingReq.getProcessInstanceId())) {
+				log.error("Pending-request with id:" + pendingReq.getRequestID() 
+					+ " includes NO 'ProcessInstanceId'");
+				throw new ProcessExecutionException("Pending-request with id:" + pendingReq.getRequestID() 
+					+ " includes NO 'ProcessInstanceId'");
+			}
+			
+			ProcessInstance pi = loadProcessInstance(pendingReq.getProcessInstanceId());
 
 			MDC.put(MDC_CTX_PI_NAME, pi.getId());
 
@@ -154,9 +172,16 @@ public class ProcessEngineImpl implements ProcessEngine {
 
 			log.info("Waking up process instance '{}'.", pi.getId());
 			pi.setState(ProcessInstanceState.STARTED);
-			execute(pi);
 
-			saveOrUpdateProcessInstance(pi);
+			//put pending-request ID on execution-context because it could be changed
+			pi.getExecutionContext().put(MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID, pendingReq.getRequestID());
+			
+			execute(pi, pendingReq);
+
+			//store ProcessInstance if it is not already ended
+			if (!ProcessInstanceState.ENDED.equals(pi.getState()))
+				saveOrUpdateProcessInstance(pi);
+						
 		} catch (MOADatabaseException e) {
 			throw new ProcessExecutionException("Unable to load/save process instance.", e);
 
@@ -204,9 +229,10 @@ public class ProcessEngineImpl implements ProcessEngine {
 	/**
 	 * Starts/executes a given process instance.
 	 * @param pi The process instance.
+	 * @param pendingReq 
 	 * @throws ProcessExecutionException Thrown in case of error.
 	 */
-	private void execute(final ProcessInstance pi) throws ProcessExecutionException {
+	private void execute(final ProcessInstance pi, IRequest pendingReq) throws ProcessExecutionException {
 		if (ProcessInstanceState.ENDED.equals(pi.getState())) {
 			throw new ProcessExecutionException("Process for instance '" + pi.getId() + "' has already been ended.");
 		}
@@ -227,7 +253,7 @@ public class ProcessEngineImpl implements ProcessEngine {
 					try {
 						log.info("Executing task implementation for task '{}'.", ti.getId());
 						log.debug("Execution context before task execution: {}", pi.getExecutionContext().keySet());
-						task.execute(pi.getExecutionContext());
+						pendingReq = task.execute(pendingReq, pi.getExecutionContext());
 						log.info("Returned from execution of task '{}'.", ti.getId());
 						log.debug("Execution context after task execution: {}", pi.getExecutionContext().keySet());
 					} catch (Throwable t) {
@@ -245,8 +271,10 @@ public class ProcessEngineImpl implements ProcessEngine {
 
 			try {
 				piStoreDao.remove(pi.getId());
+				
 			} catch (MOADatabaseException e) {
 				throw new ProcessExecutionException("Unable to remove process instance.", e);
+				
 			}
 			pi.setState(ProcessInstanceState.ENDED);
 			log.debug("Final process context: {}", pi.getExecutionContext().keySet());
@@ -284,7 +312,7 @@ public class ProcessEngineImpl implements ProcessEngine {
 		
 		// continue execution in case of StartEvent or Task
 		if (processNode instanceof StartEvent || processNode instanceof TaskInfo) {
-			execute(pi);
+			execute(pi, pendingReq);
 		}
 	}
 
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/api/Task.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/api/Task.java
index 343b8fe0c..88048d23e 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/api/Task.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/api/Task.java
@@ -1,6 +1,7 @@
 package at.gv.egovernment.moa.id.process.api;
 
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
+import at.gv.egovernment.moa.id.moduls.IRequest;
 
 
 /**
@@ -13,11 +14,13 @@ public interface Task {
 
 	/**
 	 * Executes this task.
-	 * 
+	 * @param pendingReq 
+	 * 			  Provides the current processed protocol request
 	 * @param executionContext
 	 *            Provides execution related information.
+	 * @return The pending-request object, because Process-management works recursive
 	 * @throws Exception An exception upon task execution.
 	 */
-	void execute(ExecutionContext executionContext) throws TaskExecutionException;
+	IRequest execute(IRequest pendingReq, ExecutionContext executionContext) throws TaskExecutionException;
 
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/springweb/MoaIdTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/springweb/MoaIdTask.java
index fb75fc8d7..b60434b2a 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/springweb/MoaIdTask.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/springweb/MoaIdTask.java
@@ -9,6 +9,7 @@ import org.springframework.web.context.request.ServletRequestAttributes;
 import org.springframework.web.filter.RequestContextFilter;
 
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
+import at.gv.egovernment.moa.id.moduls.IRequest;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
 import at.gv.egovernment.moa.id.process.api.Task;
 
@@ -32,6 +33,7 @@ import at.gv.egovernment.moa.id.process.api.Task;
  * </pre>
  * 
  * @author tknall
+ * @author tlenz
  * 
  */
 public abstract class MoaIdTask implements Task {
@@ -55,8 +57,31 @@ public abstract class MoaIdTask implements Task {
 	public abstract void execute(ExecutionContext executionContext, HttpServletRequest request,
 			HttpServletResponse response) throws TaskExecutionException;
 
+	/**
+	 * Executes the task providing the underlying {@link ExecutionContext} {@code executionContext} 
+	 * and the {@link IRequest} {@code pendingReq }as well as the
+	 * respective {@link HttpServletRequest} and {@link HttpServletResponse}.
+	 * 
+	 * This method sets the pending-request object of the task implementation and starts the 
+	 * {@code execute} method of the task
+	 * 
+	 * @param pendingReq The pending-request object (never {@code null}).
+	 * @param executionContext The execution context (never {@code null}).
+	 * @param request The HttpServletRequest (never {@code null}).
+	 * @param response The HttpServletResponse (never {@code null}).
+	 * @return The pending-request object, because Process-management works recursive
+	 * 
+	 * @throws IllegalStateException
+	 *             Thrown in case the task is being run within the required environment. Refer to javadoc for
+	 *             further information.
+	 * @throws Exception
+	 *             Thrown in case of error executing the task.
+	 */
+	protected abstract IRequest internalExecute(IRequest pendingReq, ExecutionContext executionContext, HttpServletRequest request,
+			HttpServletResponse response) throws TaskExecutionException;
+	
 	@Override
-	public void execute(ExecutionContext executionContext) throws TaskExecutionException {
+	public IRequest execute(IRequest pendingReq, ExecutionContext executionContext) throws TaskExecutionException {
 		RequestAttributes requestAttributes = RequestContextHolder.getRequestAttributes();
 		if (requestAttributes != null && requestAttributes instanceof ServletRequestAttributes) {
 			HttpServletRequest request = ((ServletRequestAttributes) requestAttributes).getRequest();
@@ -65,7 +90,7 @@ public abstract class MoaIdTask implements Task {
 				throw new IllegalStateException(
 						"Spring's RequestContextHolder did not provide HttpServletResponse. Did you forget to set the required org.springframework.web.filter.RequestContextFilter in your web.xml.");
 			}
-			execute(executionContext, request, response);
+			return internalExecute(pendingReq, executionContext, request, response);
 		} else {
 			throw new IllegalStateException("Task needs to be executed within a Spring web environment.");
 		}