BUGFIX: RedirectBinding validate signatures which exists, but signature is not required

changes for WKO:
Allow Metadata with no AttributeConsumerService
Allow AuthnRequest with no RequestedAuthnContext
Allow AuthnRequest with no AssertionConsumerServiceIndex
Use Metadata->AssertionConsumerService->isDefaut flag

6 files changed, 130 insertions, 70 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java
index bef58ab59..dc2330f40 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java
@@ -124,7 +124,6 @@ public class PVP2XProtocol implements IModulInfo, MOAIDAuthConstants {
 			RequestAbstractType samlReq =  moaRequest.getSamlRequest();
 
 			//String xml = PrettyPrinter.prettyPrint(SAML2Utils.asDOMDocument(samlReq));
-			
 			//Logger.info("SAML : " + xml);
 			
 			if(!moaRequest.isVerified()) {
@@ -137,6 +136,12 @@ public class PVP2XProtocol implements IModulInfo, MOAIDAuthConstants {
 				throw new MOAIDException("Unsupported request", new Object[] {});
 			}
 			
+			EntityDescriptor metadata = moaRequest.getEntityMetadata();
+			if(metadata == null) {
+				throw new NoMetadataInformationException();
+			}
+			SPSSODescriptor spSSODescriptor = metadata.getSPSSODescriptor(SAMLConstants.SAML20P_NS);
+			
 			AuthnRequest authnRequest = (AuthnRequest)samlReq;
 			
 			Integer aIdx = authnRequest.getAssertionConsumerServiceIndex();
@@ -144,6 +149,9 @@ public class PVP2XProtocol implements IModulInfo, MOAIDAuthConstants {
 			
 			if(aIdx != null) {
 				assertionidx = aIdx.intValue();
+				
+			} else {				
+				assertionidx = SAML2Utils.getDefaultAssertionConsumerServiceIndex(spSSODescriptor);
 			}
 			
 			aIdx = authnRequest.getAttributeConsumingServiceIndex();
@@ -153,13 +161,14 @@ public class PVP2XProtocol implements IModulInfo, MOAIDAuthConstants {
 				attributeIdx = aIdx.intValue();
 			}
 			
-			EntityDescriptor metadata = moaRequest.getEntityMetadata();
-			if(metadata == null) {
-				throw new NoMetadataInformationException();
-			}
-			SPSSODescriptor spSSODescriptor = metadata.getSPSSODescriptor(SAMLConstants.SAML20P_NS);
 			AssertionConsumerService consumerService  = spSSODescriptor.getAssertionConsumerServices().get(assertionidx);
-			AttributeConsumingService attributeConsumer  = spSSODescriptor.getAttributeConsumingServices().get(attributeIdx);
+			
+			AttributeConsumingService attributeConsumer = null;
+			
+			if (spSSODescriptor.getAttributeConsumingServices() != null  && 
+					spSSODescriptor.getAttributeConsumingServices().size() > 0) {
+				attributeConsumer  = spSSODescriptor.getAttributeConsumingServices().get(attributeIdx);
+			} 
 			
 			String oaURL = moaRequest.getEntityMetadata().getEntityID();
 			String binding = consumerService.getBinding();
@@ -176,7 +185,7 @@ public class PVP2XProtocol implements IModulInfo, MOAIDAuthConstants {
 						
 			String useMandate = request.getParameter(PARAM_USEMANDATE);
 			if(useMandate != null) {
-				if(useMandate.equals("true")) {
+				if(useMandate.equals("true") && attributeConsumer != null) {
 					if(!CheckMandateAttributes.canHandleMandate(attributeConsumer)) {
 						throw new MandateAttributesNotHandleAbleException();
 					}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/RedirectBinding.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/RedirectBinding.java
index 418c4a60c..9b43fb999 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/RedirectBinding.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/RedirectBinding.java
@@ -3,11 +3,13 @@ package at.gv.egovernment.moa.id.protocols.pvp2x.binding;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.jcp.xml.dsig.internal.dom.DOMURIDereferencer;
 import org.opensaml.common.SAMLObject;
 import org.opensaml.common.binding.BasicSAMLMessageContext;
 import org.opensaml.common.xml.SAMLConstants;
 import org.opensaml.saml2.binding.decoding.HTTPRedirectDeflateDecoder;
 import org.opensaml.saml2.binding.encoding.HTTPRedirectDeflateEncoder;
+import org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule;
 import org.opensaml.saml2.binding.security.SAML2HTTPRedirectDeflateSignatureRule;
 import org.opensaml.saml2.core.RequestAbstractType;
 import org.opensaml.saml2.core.Response;
@@ -31,6 +33,7 @@ import at.gv.egovernment.moa.id.protocols.pvp2x.metadata.MOAMetadataProvider;
 import at.gv.egovernment.moa.id.protocols.pvp2x.signer.CredentialProvider;
 import at.gv.egovernment.moa.id.protocols.pvp2x.signer.CredentialsNotAvailableException;
 import at.gv.egovernment.moa.id.protocols.pvp2x.verification.TrustEngineFactory;
+import at.gv.egovernment.moa.util.DOMUtils;
 
 public class RedirectBinding implements IDecoder, IEncoder {
 
@@ -84,13 +87,18 @@ public class RedirectBinding implements IDecoder, IEncoder {
 		SAML2HTTPRedirectDeflateSignatureRule signatureRule = new SAML2HTTPRedirectDeflateSignatureRule(
 				TrustEngineFactory.getSignatureKnownKeysTrustEngine());
 
+		SAML2AuthnRequestsSignedRule signedRole = new SAML2AuthnRequestsSignedRule();
+		
+		
 		BasicSecurityPolicy policy = new BasicSecurityPolicy();
 		policy.getPolicyRules().add(signatureRule);
+		policy.getPolicyRules().add(signedRole);
+		
 		SecurityPolicyResolver resolver = new StaticSecurityPolicyResolver(
 				policy);
 		messageContext.setPeerEntityRole(SPSSODescriptor.DEFAULT_ELEMENT_NAME);
 		messageContext.setSecurityPolicyResolver(resolver);
-
+		
 		decode.decode(messageContext);
 
 		signatureRule.evaluate(messageContext);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java
index eaa570ab1..d1d79373c 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java
@@ -64,46 +64,48 @@ public class PVP2AssertionBuilder implements PVPConstants {
 		RequestedAuthnContext reqAuthnContext = authnRequest
 				.getRequestedAuthnContext();
 
-		if (reqAuthnContext == null) {
-			throw new NoAuthContextException();
-		}
-
-		boolean stork_qaa_1_4_found = false;
-
 		AuthnContextClassRef authnContextClassRef = SAML2Utils
 				.createSAMLObject(AuthnContextClassRef.class);
-
-		 List<AuthnContextClassRef> reqAuthnContextClassRefIt = reqAuthnContext
-				.getAuthnContextClassRefs();
 		
-		 if (reqAuthnContextClassRefIt.size() == 0) {
-			 stork_qaa_1_4_found = true;
+		if (reqAuthnContext == null) {
 			 authnContextClassRef.setAuthnContextClassRef(STORK_QAA_1_4);
-			 
-		 } else {
-			 for (AuthnContextClassRef authnClassRef : reqAuthnContextClassRefIt) {
-				 String qaa_uri = authnClassRef.getAuthnContextClassRef();
-				 if (qaa_uri.trim().equals(STORK_QAA_1_4)
-						 || qaa_uri.trim().equals(STORK_QAA_1_3)
-						 || qaa_uri.trim().equals(STORK_QAA_1_2)
-						 || qaa_uri.trim().equals(STORK_QAA_1_1)) {
-					
-					 if (authSession.isForeigner()) {
-						 //TODO: insert QAA check
-					
-						 stork_qaa_1_4_found = false;
-					
-					 } else {
-						 stork_qaa_1_4_found = true;
-						 authnContextClassRef.setAuthnContextClassRef(STORK_QAA_1_4);
+			
+		} else {
+
+			boolean stork_qaa_1_4_found = false;
+		
+			 List<AuthnContextClassRef> reqAuthnContextClassRefIt = reqAuthnContext
+					.getAuthnContextClassRefs();
+			
+			 if (reqAuthnContextClassRefIt.size() == 0) {
+				 stork_qaa_1_4_found = true;
+				 authnContextClassRef.setAuthnContextClassRef(STORK_QAA_1_4);
+				 
+			 } else {
+				 for (AuthnContextClassRef authnClassRef : reqAuthnContextClassRefIt) {
+					 String qaa_uri = authnClassRef.getAuthnContextClassRef();
+					 if (qaa_uri.trim().equals(STORK_QAA_1_4)
+							 || qaa_uri.trim().equals(STORK_QAA_1_3)
+							 || qaa_uri.trim().equals(STORK_QAA_1_2)
+							 || qaa_uri.trim().equals(STORK_QAA_1_1)) {
+						
+						 if (authSession.isForeigner()) {
+							 //TODO: insert QAA check
+						
+							 stork_qaa_1_4_found = false;
+						
+						 } else {
+							 stork_qaa_1_4_found = true;
+							 authnContextClassRef.setAuthnContextClassRef(STORK_QAA_1_4);
+						 }
+						 break;
 					 }
-					 break;
 				 }
 			 }
-		 }
-
-		if (!stork_qaa_1_4_found) {
-			throw new QAANotSupportedException(STORK_QAA_1_4);
+	
+			if (!stork_qaa_1_4_found) {
+				throw new QAANotSupportedException(STORK_QAA_1_4);
+			}
 		}
 
 //		reqAuthnContextClassRefIt = reqAuthnContext.getAuthnContextClassRefs()
@@ -150,10 +152,8 @@ public class PVP2AssertionBuilder implements PVPConstants {
 
 		if (aIdx != null) {
 			idx = aIdx.intValue();
-		}
-
-		AttributeConsumingService attributeConsumingService = spSSODescriptor
-				.getAttributeConsumingServices().get(idx);
+			
+		} 
 
 		AttributeStatement attributeStatement = SAML2Utils
 				.createSAMLObject(AttributeStatement.class);
@@ -197,32 +197,38 @@ public class PVP2AssertionBuilder implements PVPConstants {
 				.buildAuthenticationData(authSession, oaParam,
 						oaParam.getTarget());
 
-		Iterator<RequestedAttribute> it = attributeConsumingService
-				.getRequestAttributes().iterator();
-		while (it.hasNext()) {
-			RequestedAttribute reqAttribut = it.next();
-			try {
-				Attribute attr = PVPAttributeBuilder.buildAttribute(
-						reqAttribut.getName(), authSession, oaParam, authData);
-				if (attr == null) {
+		if (spSSODescriptor.getAttributeConsumingServices() != null && 
+				spSSODescriptor.getAttributeConsumingServices().size() > 0) {
+		
+			AttributeConsumingService attributeConsumingService = spSSODescriptor
+					.getAttributeConsumingServices().get(idx);
+			
+			Iterator<RequestedAttribute> it = attributeConsumingService
+					.getRequestAttributes().iterator();
+			while (it.hasNext()) {
+				RequestedAttribute reqAttribut = it.next();
+				try {
+					Attribute attr = PVPAttributeBuilder.buildAttribute(
+							reqAttribut.getName(), authSession, oaParam, authData);
+					if (attr == null) {
+						if (reqAttribut.isRequired()) {
+							throw new UnprovideableAttributeException(
+									reqAttribut.getName());
+						}
+					} else {
+						attributeStatement.getAttributes().add(attr);
+					}
+				} catch (PVP2Exception e) {
+					Logger.error(
+							"Attribute generation failed! for "
+									+ reqAttribut.getFriendlyName(), e);
 					if (reqAttribut.isRequired()) {
 						throw new UnprovideableAttributeException(
 								reqAttribut.getName());
 					}
-				} else {
-					attributeStatement.getAttributes().add(attr);
-				}
-			} catch (PVP2Exception e) {
-				Logger.error(
-						"Attribute generation failed! for "
-								+ reqAttribut.getFriendlyName(), e);
-				if (reqAttribut.isRequired()) {
-					throw new UnprovideableAttributeException(
-							reqAttribut.getName());
 				}
 			}
 		}
-
 		if (attributeStatement.getAttributes().size() > 0) {
 			assertion.getAttributeStatements().add(attributeStatement);
 		}
@@ -294,7 +300,7 @@ public class PVP2AssertionBuilder implements PVPConstants {
 		SubjectConfirmationData subjectConfirmationData = SAML2Utils
 				.createSAMLObject(SubjectConfirmationData.class);
 		subjectConfirmationData.setInResponseTo(authnRequest.getID());
-		subjectConfirmationData.setNotOnOrAfter(new DateTime().plusMinutes(20));
+		subjectConfirmationData.setNotOnOrAfter(new DateTime().plusMinutes(5));
 		
 		//TL: change from entityID to destination URL 
 		AssertionConsumerService consumerService = spSSODescriptor
@@ -319,7 +325,7 @@ public class PVP2AssertionBuilder implements PVPConstants {
 		audienceRestriction.getAudiences().add(audience);
 		conditions.setNotBefore(new DateTime());
 		
-		conditions.setNotOnOrAfter(new DateTime().plusMinutes(20));
+		conditions.setNotOnOrAfter(new DateTime().plusMinutes(5));
 //		conditions.setNotOnOrAfter(new DateTime());
 		
 		conditions.getAudienceRestrictions().add(audienceRestriction);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/requestHandler/AuthnRequestHandler.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/requestHandler/AuthnRequestHandler.java
index c3884f9d8..4128a406b 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/requestHandler/AuthnRequestHandler.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/requestHandler/AuthnRequestHandler.java
@@ -1,11 +1,13 @@
 package at.gv.egovernment.moa.id.protocols.pvp2x.requestHandler;
 
+import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import javax.xml.transform.TransformerException;
 
 import org.joda.time.DateTime;
 import org.opensaml.Configuration;
@@ -30,6 +32,7 @@ import org.opensaml.xml.encryption.EncryptionConstants;
 import org.opensaml.xml.encryption.EncryptionException;
 import org.opensaml.xml.encryption.EncryptionParameters;
 import org.opensaml.xml.encryption.KeyEncryptionParameters;
+import org.opensaml.xml.io.MarshallingException;
 import org.opensaml.xml.security.CriteriaSet;
 import org.opensaml.xml.security.SecurityException;
 import org.opensaml.xml.security.credential.Credential;
@@ -55,6 +58,7 @@ import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.BindingNotSupportedEx
 import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.InvalidAssertionConsumerServiceException;
 import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.InvalidAssertionEncryptionException;
 import at.gv.egovernment.moa.id.protocols.pvp2x.metadata.MOAMetadataProvider;
+import at.gv.egovernment.moa.id.protocols.pvp2x.utils.PrettyPrinter;
 import at.gv.egovernment.moa.id.protocols.pvp2x.utils.SAML2Utils;
 import at.gv.egovernment.moa.logging.Logger;
 
@@ -93,15 +97,18 @@ public class AuthnRequestHandler implements IRequestHandler, PVPConstants {
 		
 		authResponse.setStatus(SAML2Utils.getSuccessStatus());
 
+		SPSSODescriptor spSSODescriptor = peerEntity
+				.getSPSSODescriptor(SAMLConstants.SAML20P_NS);
+		
 		Integer aIdx = authnRequest.getAssertionConsumerServiceIndex();
 		int idx = 0;
 
 		if (aIdx != null) {
 			idx = aIdx.intValue();
+			
+		} else {				
+			idx = SAML2Utils.getDefaultAssertionConsumerServiceIndex(spSSODescriptor);
 		}
-		
-		SPSSODescriptor spSSODescriptor = peerEntity
-				.getSPSSODescriptor(SAMLConstants.SAML20P_NS);
 
 		AssertionConsumerService consumerService = spSSODescriptor
 				.getAssertionConsumerServices().get(idx);
@@ -201,6 +208,10 @@ public class AuthnRequestHandler implements IRequestHandler, PVPConstants {
 			binding.encodeRespone(req, resp, authResponse, oaURL);
 			// TODO add remoteSessionID to AuthSession ExternalPVPSessionStore
 			
+//			Logger logger = new Logger();
+//			logger.debug("Redirect Binding Request = " + PrettyPrinter.prettyPrint(SAML2Utils.asDOMDocument(authResponse)));
+			
+
 			return assertion.getID();
 			
 		} catch (MessageEncodingException e) {
@@ -209,6 +220,15 @@ public class AuthnRequestHandler implements IRequestHandler, PVPConstants {
 		} catch (SecurityException e) {
 			Logger.error("Security exception", e);
 			throw new MOAIDException("pvp2.01", null, e);
+//		} catch (TransformerException e) {
+//			Logger.error("Security exception", e);
+//			throw new MOAIDException("pvp2.01", null, e);
+//		} catch (IOException e) {
+//			Logger.error("Security exception", e);
+//			throw new MOAIDException("pvp2.01", null, e);
+//		} catch (MarshallingException e) {
+//			Logger.error("Security exception", e);
+//			throw new MOAIDException("pvp2.01", null, e);
 		}
 	}
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/utils/SAML2Utils.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/utils/SAML2Utils.java
index 7bb5b052f..373bca902 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/utils/SAML2Utils.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/utils/SAML2Utils.java
@@ -2,6 +2,7 @@ package at.gv.egovernment.moa.id.protocols.pvp2x.utils;
 
 import java.io.IOException;
 import java.security.NoSuchAlgorithmException;
+import java.util.List;
 
 import javax.xml.namespace.QName;
 import javax.xml.parsers.DocumentBuilder;
@@ -13,6 +14,8 @@ import org.opensaml.Configuration;
 import org.opensaml.common.impl.SecureRandomIdentifierGenerator;
 import org.opensaml.saml2.core.Status;
 import org.opensaml.saml2.core.StatusCode;
+import org.opensaml.saml2.metadata.AssertionConsumerService;
+import org.opensaml.saml2.metadata.SPSSODescriptor;
 import org.opensaml.xml.XMLObject;
 import org.opensaml.xml.XMLObjectBuilderFactory;
 import org.opensaml.xml.io.Marshaller;
@@ -77,4 +80,17 @@ public class SAML2Utils {
 		status.setStatusCode(statusCode);
 		return status;
 	}
+	
+	public static int getDefaultAssertionConsumerServiceIndex(SPSSODescriptor spSSODescriptor) {
+		
+		List<AssertionConsumerService> assertionConsumerList = spSSODescriptor.getAssertionConsumerServices();
+		
+		for (AssertionConsumerService el : assertionConsumerList) {
+			if (el.isDefault())
+				return el.getIndex();
+			
+		}
+		
+		return 0;
+	}
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/SAMLVerificationEngine.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/SAMLVerificationEngine.java
index 628da6773..4823d7629 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/SAMLVerificationEngine.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/SAMLVerificationEngine.java
@@ -41,6 +41,7 @@ public class SAMLVerificationEngine {
 	
 	public void verifyRequest(RequestAbstractType samlObj, SignatureTrustEngine sigTrustEngine ) throws org.opensaml.xml.security.SecurityException, Exception {
 		SAMLSignatureProfileValidator profileValidator = new SAMLSignatureProfileValidator();
+		
 		try {
 		    profileValidator.validate(samlObj.getSignature());
 		} catch (ValidationException e) {