aboutsummaryrefslogtreecommitdiff
path: root/id/server/idserverlib/src/main/java/at/gv
diff options
context:
space:
mode:
authorThomas Lenz <tlenz@iaik.tugraz.at>2017-10-13 13:18:11 +0200
committerThomas Lenz <tlenz@iaik.tugraz.at>2017-10-13 13:18:11 +0200
commitd703b4201def4ea55bc865da87010972d13a434e (patch)
treed9be30af066c7cf6281a15954318d40bf37131b5 /id/server/idserverlib/src/main/java/at/gv
parent1a80e310ed77110a8757b78b750a6a000495b16f (diff)
downloadmoa-id-spss-d703b4201def4ea55bc865da87010972d13a434e.tar.gz
moa-id-spss-d703b4201def4ea55bc865da87010972d13a434e.tar.bz2
moa-id-spss-d703b4201def4ea55bc865da87010972d13a434e.zip
enable mandates for eIDAS nodes
Diffstat (limited to 'id/server/idserverlib/src/main/java/at/gv')
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/advancedlogging/StatisticLogger.java33
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java168
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java281
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java34
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/DynamicOAAuthParameterBuilder.java26
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java134
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/TargetToSectorNameMapper.java4
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java115
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java4
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/data/DynamicOAAuthParameters.java149
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java17
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java5
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePIN.java2
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePINType.java3
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonBPKAttributeBuilder.java22
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonSourcePinAttributeBuilder.java5
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java4
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/AttributQueryBuilder.java15
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java37
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java7
20 files changed, 597 insertions, 468 deletions
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/advancedlogging/StatisticLogger.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/advancedlogging/StatisticLogger.java
index 15900cc7c..72aef5fed 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/advancedlogging/StatisticLogger.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/advancedlogging/StatisticLogger.java
@@ -116,16 +116,18 @@ public class StatisticLogger implements IStatisticLogger{
//set actual date and time
dblog.setTimestamp(new Date());
-
- //set OA databaseID
- //dblog.setOaID(dbOA.getHjid());
-
+
//log basic AuthInformation
dblog.setOaurlprefix(getMessageWithMaxLength(dbOA.getPublicURLPrefix(), MAXOAIDENTIFIER_LENGTH));
dblog.setOafriendlyName(dbOA.getFriendlyName());
- boolean isbusinessservice = isBusinessService(dbOA);
- dblog.setBusinessservice(isbusinessservice);
+ try {
+ dblog.setBusinessservice(dbOA.hasBaseIdTransferRestriction());
+
+ } catch (Exception e) {
+ Logger.warn("Can not extract some information for StatisticLogger.", e);
+ }
+
dblog.setOatarget(authData.getBPKType());
@@ -266,9 +268,14 @@ public class StatisticLogger implements IStatisticLogger{
if (dbOA != null) {
dblog.setOaurlprefix(getMessageWithMaxLength(dbOA.getPublicURLPrefix(), MAXOAIDENTIFIER_LENGTH));
dblog.setOafriendlyName(dbOA.getFriendlyName());
- dblog.setOatarget(dbOA.getTarget());
- //dblog.setOaID(dbOA.getHjid());
- dblog.setBusinessservice(isBusinessService(dbOA));
+
+ try {
+ dblog.setOatarget(dbOA.getAreaSpecificTargetIdentifier());
+ dblog.setBusinessservice(dbOA.hasBaseIdTransferRestriction());
+ } catch (Exception e) {
+ Logger.warn("Can not extract some information for StatisticLogger.", e);
+
+ }
IAuthenticationSession moasession = null;
if (MiscUtil.isNotEmpty(errorRequest.getInternalSSOSessionIdentifier())) {
@@ -314,15 +321,7 @@ public class StatisticLogger implements IStatisticLogger{
}
}
-
- private boolean isBusinessService(IOAAuthParameters dbOA) {
- if (dbOA.getOaType().equals("businessService"))
- return true;
- else
- return false;
- }
-
private String getMessageWithMaxLength(String msg, int maxlength) {
return getErrorMessageWithMaxLength(msg, maxlength);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
index 9e586b0f4..5a5d0bcf6 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
@@ -267,9 +267,9 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants {
//####################################################
//set general authData info's
authData.setIssuer(protocolRequest.getAuthURL());
- authData.setSsoSession(protocolRequest.needSingleSignOnFunctionality());
- authData.setIsBusinessService(oaParam.getBusinessService());
-
+ authData.setSsoSession(protocolRequest.needSingleSignOnFunctionality());
+ authData.setBaseIDTransferRestrication(oaParam.hasBaseIdTransferRestriction());
+
//####################################################
//parse user info's from identityLink
@@ -816,21 +816,11 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants {
* @param oaParam Service-Provider configuration, never null
* @param bPKType bPK-Type to check
* @return true, if bPK-Type matchs to Service-Provider configuration, otherwise false
+ * @throws ConfigurationException
*/
- private boolean matchsReceivedbPKToOnlineApplication(IOAAuthParameters oaParam, String bPKType) {
- String oaTarget = null;
- if (oaParam.getBusinessService()) {
- oaTarget = oaParam.getIdentityLinkDomainIdentifier();
-
- } else {
- oaTarget = Constants.URN_PREFIX_CDID + "+" + oaParam.getTarget();
-
- }
-
- if (oaTarget.equals(bPKType))
- return true;
- else
- return false;
+ private boolean matchsReceivedbPKToOnlineApplication(IOAAuthParameters oaParam, String bPKType) throws ConfigurationException {
+ return oaParam.getAreaSpecificTargetIdentifier().equals(bPKType);
+
}
private void parseBasicUserInfosFromIDL(AuthenticationData authData, IIdentityLink identityLink, Collection<String> includedGenericSessionData) {
@@ -918,9 +908,10 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants {
*
* @return Pair<bPK, bPKType> which was received by PVP-Attribute and could be decrypted for this Service Provider,
* or <code>null</code> if no attribute exists or can not decrypted
+ * @throws ConfigurationException
*/
private Pair<String, String> getEncryptedbPKFromPVPAttribute(IAuthenticationSession session,
- AuthenticationData authData, IOAAuthParameters spConfig) {
+ AuthenticationData authData, IOAAuthParameters spConfig) throws ConfigurationException {
//set List of encrypted bPKs to authData DAO
String pvpEncbPKListAttr = session.getGenericDataFromSession(PVPConstants.ENC_BPK_LIST_NAME, String.class);
if (MiscUtil.isNotEmpty(pvpEncbPKListAttr)) {
@@ -935,35 +926,44 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants {
String second = fullEncbPK.substring(0, index);
int secIndex = second.indexOf("+");
if (secIndex >= 0) {
- if (spConfig.getTarget().equals(second.substring(secIndex+1))) {
- Logger.debug("Found encrypted bPK for online-application "
- + spConfig.getPublicURLPrefix()
- + " Start decryption process ...");
- PrivateKey privKey = spConfig.getBPKDecBpkDecryptionKey();
- if (privKey != null) {
- try {
- String bPK = BPKBuilder.decryptBPK(encbPK, spConfig.getTarget(), privKey);
- if (MiscUtil.isNotEmpty(bPK)) {
- Logger.info("bPK decryption process finished successfully.");
- return Pair.newInstance(bPK, Constants.URN_PREFIX_CDID + "+" + spConfig.getTarget());
-
- } else {
- Logger.error("bPK decryption FAILED.");
-
+ String oaTargetId = spConfig.getAreaSpecificTargetIdentifier();
+ if (oaTargetId.startsWith(MOAIDAuthConstants.PREFIX_CDID)) {
+ String publicServiceShortTarget = oaTargetId.substring(MOAIDAuthConstants.PREFIX_CDID.length());
+ if (publicServiceShortTarget.equals(second.substring(secIndex+1))) {
+ Logger.debug("Found encrypted bPK for online-application "
+ + spConfig.getPublicURLPrefix()
+ + " Start decryption process ...");
+ PrivateKey privKey = spConfig.getBPKDecBpkDecryptionKey();
+ if (privKey != null) {
+ try {
+ String bPK = BPKBuilder.decryptBPK(encbPK, publicServiceShortTarget, privKey);
+ if (MiscUtil.isNotEmpty(bPK)) {
+ Logger.info("bPK decryption process finished successfully.");
+ return Pair.newInstance(bPK, oaTargetId);
+
+ } else {
+ Logger.error("bPK decryption FAILED.");
+
+ }
+ } catch (BuildException e) {
+ Logger.error("bPK decryption FAILED.", e);
+
}
- } catch (BuildException e) {
- Logger.error("bPK decryption FAILED.", e);
- }
+ } else {
+ Logger.info("bPK decryption FAILED, because no valid decryption key is found.");
+
+ }
} else {
- Logger.info("bPK decryption FAILED, because no valid decryption key is found.");
+ Logger.info("Found encrypted bPK but " +
+ "encrypted bPK target does not match to online-application target");
- }
+ }
} else {
- Logger.info("Found encrypted bPK but " +
- "encrypted bPK target does not match to online-application target");
+ Logger.info("Encrypted bPKs are only allowed for public services with prefix: " + MOAIDAuthConstants.PREFIX_CDID
+ + " BUT oaTarget is " + oaTargetId);
}
}
@@ -1066,7 +1066,7 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants {
}
private IIdentityLink buildOAspecificIdentityLink(IOAAuthParameters oaParam, IIdentityLink idl, String bPK, String bPKType) throws MOAIDException {
- if (oaParam.getBusinessService()) {
+ if (oaParam.hasBaseIdTransferRestriction()) {
Element idlassertion = idl.getSamlAssertion();
//set bpk/wpbk;
Node prIdentification = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_IDENT_VALUE_XPATH);
@@ -1097,69 +1097,45 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants {
}
- private Pair<String, String> buildOAspecificbPK(IRequest pendingReq, IOAAuthParameters oaParam, AuthenticationData authData) throws BuildException {
+ private Pair<String, String> buildOAspecificbPK(IRequest pendingReq, IOAAuthParameters oaParam, AuthenticationData authData) throws BuildException, ConfigurationException {
- String bPK;
- String bPKType;
-
String baseID = authData.getIdentificationValue();
- String baseIDType = authData.getIdentificationType();
-
- if (Constants.URN_PREFIX_BASEID.equals(baseIDType)) {
- //Calculate eIDAS identifier
- if (oaParam.getBusinessService() &&
- oaParam.getIdentityLinkDomainIdentifier().startsWith(Constants.URN_PREFIX_EIDAS)) {
- String[] splittedTarget = oaParam.getIdentityLinkDomainIdentifier().split("\\+");
- String cititzenCountryCode = splittedTarget[1];
- String eIDASOutboundCountry = splittedTarget[2];
-
- if (cititzenCountryCode.equalsIgnoreCase(eIDASOutboundCountry)) {
- Logger.warn("Suspect configuration FOUND!!! CitizenCountry equals DestinationCountry");
-
- }
-
- Pair<String, String> eIDASID = new BPKBuilder().buildeIDASIdentifer(baseID, baseIDType,
- cititzenCountryCode, eIDASOutboundCountry);
- Logger.debug("Authenticate user with bPK:" + eIDASID.getFirst() + " Type:" + eIDASID.getSecond());
- return eIDASID;
-
- } else if (oaParam.getBusinessService()) {
- //is Austrian private-service application
- String registerAndOrdNr = oaParam.getIdentityLinkDomainIdentifier();
- bPK = new BPKBuilder().buildbPKorwbPK(baseID, registerAndOrdNr);
- bPKType = registerAndOrdNr;
-
- } else {
- // only compute bPK if online application is a public service and we have the Stammzahl
- String target = null;
- Class<?> saml1RequstTemplate = null;
- try {
- saml1RequstTemplate = Class.forName("at.gv.egovernment.moa.id.protocols.saml1.SAML1RequestImpl");
- if (saml1RequstTemplate != null &&
- saml1RequstTemplate.isInstance(pendingReq)) {
- target = (String) pendingReq.getClass().getMethod("getTarget").invoke(pendingReq);
+ String baseIDType = authData.getIdentificationType();
+ Pair<String, String> sectorSpecId = null;
+
+ if (Constants.URN_PREFIX_BASEID.equals(baseIDType)) {
+ //SAML1 legacy target parameter work-around
+ String oaTargetId = null;
+ Class<?> saml1RequstTemplate = null;
+ try {
+ saml1RequstTemplate = Class.forName("at.gv.egovernment.moa.id.protocols.saml1.SAML1RequestImpl");
+ if (saml1RequstTemplate != null &&
+ saml1RequstTemplate.isInstance(pendingReq)) {
+ oaTargetId = (String) pendingReq.getClass().getMethod("getTarget").invoke(pendingReq);
- }
+ }
- } catch (ClassNotFoundException | IllegalAccessException | IllegalArgumentException | java.lang.SecurityException | InvocationTargetException | NoSuchMethodException ex) { }
+ } catch (ClassNotFoundException | IllegalAccessException | IllegalArgumentException | java.lang.SecurityException | InvocationTargetException | NoSuchMethodException ex) { }
+
+ if (MiscUtil.isEmpty(oaTargetId)) {
+ oaTargetId = oaParam.getAreaSpecificTargetIdentifier();
+ Logger.debug("Use OA target identifier '" + oaTargetId + "' from configuration");
- if (MiscUtil.isEmpty(target))
- target = oaParam.getTarget();
-
- bPK = new BPKBuilder().buildBPK(baseID, target);
- bPKType = Constants.URN_PREFIX_CDID + "+" + target;
-
- }
-
+ } else
+ Logger.info("Use OA target identifier '" + oaTargetId + "' from SAML1 request for bPK calculation");
+
+ //calculate sector specific unique identifier
+ sectorSpecId = new BPKBuilder().generateAreaSpecificPersonIdentifier(baseID, oaTargetId);
+
+
} else {
- Logger.warn("!!!baseID-element does not include a baseID. This should not be happen any more!!!");
- bPK = baseID;
- bPKType = baseIDType;
-
+ Logger.fatal("!!!baseID-element does not include a baseID. This should not be happen any more!!!");
+ sectorSpecId = Pair.newInstance(baseID, baseIDType);
+
}
- Logger.trace("Authenticate user with bPK:" + bPK + " Type:" + bPKType);
- return Pair.newInstance(bPK, bPKType);
+ Logger.trace("Authenticate user with bPK:" + sectorSpecId.getFirst() + " Type:" + sectorSpecId.getSecond());
+ return sectorSpecId;
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java
index 32ac8ad68..a7f6e873f 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java
@@ -60,6 +60,7 @@ import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import at.gv.egovernment.moa.id.auth.exception.BuildException;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
import at.gv.egovernment.moa.id.data.Pair;
import at.gv.egovernment.moa.logging.Logger;
import at.gv.egovernment.moa.util.Base64Utils;
@@ -76,77 +77,192 @@ import at.gv.egovernment.moa.util.MiscUtil;
*/
public class BPKBuilder {
- /**
- * Builds the bPK from the given parameters.
- *
- * @param identificationValue Base64 encoded "Stammzahl"
- * @param target "Bereich lt. Verordnung des BKA"
- * @return bPK in a BASE64 encoding
- * @throws BuildException if an error occurs on building the bPK
- */
- public String buildBPK(String identificationValue, String target)
- throws BuildException {
-
- if ((identificationValue == null ||
- identificationValue.length() == 0 ||
- target == null ||
- target.length() == 0)) {
- throw new BuildException("builder.00",
- new Object[]{"BPK", "Unvollständige Parameterangaben: identificationValue=" +
- identificationValue + ",target=" + target});
- }
- String basisbegriff;
- if (target.startsWith(Constants.URN_PREFIX_CDID + "+"))
- basisbegriff = identificationValue + "+" + target;
- else
- basisbegriff = identificationValue + "+" + Constants.URN_PREFIX_CDID + "+" + target;
+ /**
+ * Calculates an area specific unique person-identifier from a baseID
+ *
+ * @param baseID baseId from user but never null
+ * @param targetIdentifier target identifier for area specific identifier calculation but never null
+ * @return Pair<unique person identifier for this target, targetArea> but never null
+ * @throws BuildException if some input data are not valid
+ */
+ public Pair<String, String> generateAreaSpecificPersonIdentifier(String baseID, String targetIdentifier) throws BuildException{
+ return generateAreaSpecificPersonIdentifier(baseID, Constants.URN_PREFIX_BASEID, targetIdentifier);
+
+ }
+
+ /**
+ * Calculates an area specific unique person-identifier from an unique identifier with a specific type
+ *
+ * @param baseID baseId from user but never null
+ * @param baseIdType Type of the baseID but never null
+ * @param targetIdentifier target identifier for area specific identifier calculation but never null
+ * @return Pair<unique person identifier for this target, targetArea> but never null
+ * @throws BuildException if some input data are not valid
+ */
+ public Pair<String, String> generateAreaSpecificPersonIdentifier(String baseID, String baseIdType, String targetIdentifier) throws BuildException{
+ if (MiscUtil.isEmpty(baseID))
+ throw new BuildException("builder.00", new Object[]{"baseID is empty or null"});
- return calculatebPKwbPK(basisbegriff);
- }
+ if (MiscUtil.isEmpty(baseIdType))
+ throw new BuildException("builder.00", new Object[]{"the type of baseID is empty or null"});
+
+ if (MiscUtil.isEmpty(targetIdentifier))
+ throw new BuildException("builder.00", new Object[]{"OA specific target identifier is empty or null"});
+ if (baseIdType.equals(Constants.URN_PREFIX_BASEID)) {
+ Logger.trace("Find baseID. Starting unique identifier caluclation for this target");
+
+ if (targetIdentifier.startsWith(MOAIDAuthConstants.PREFIX_CDID) ||
+ targetIdentifier.startsWith(MOAIDAuthConstants.PREFIX_WPBK) ||
+ targetIdentifier.startsWith(MOAIDAuthConstants.PREFIX_STORK)) {
+ Logger.trace("Calculate bPK, wbPK, or STORK identifier for target: " + targetIdentifier);
+ return Pair.newInstance(calculatebPKwbPK(baseID + "+" + targetIdentifier), targetIdentifier);
+
+ } else if (targetIdentifier.startsWith(MOAIDAuthConstants.PREFIX_EIDAS)) {
+ Logger.trace("Calculate eIDAS identifier for target: " + targetIdentifier);
+ String[] splittedTarget = targetIdentifier.split("\\+");
+ String cititzenCountryCode = splittedTarget[1];
+ String eIDASOutboundCountry = splittedTarget[2];
+
+ if (cititzenCountryCode.equalsIgnoreCase(eIDASOutboundCountry)) {
+ Logger.warn("Suspect configuration FOUND!!! CitizenCountry equals DestinationCountry");
+
+ }
+ return buildeIDASIdentifer(baseID, baseIdType, cititzenCountryCode, eIDASOutboundCountry);
+
+
+ } else
+ throw new BuildException("builder.00",
+ new Object[]{"Target identifier: " + targetIdentifier + " is NOT allowed or unknown"});
+
+ } else {
+ Logger.trace("BaseID is not of type " + Constants.URN_PREFIX_BASEID + ". Check type against requested target ...");
+ if (baseIdType.equals(targetIdentifier)) {
+ Logger.debug("Unique identifier is already area specific. Is nothing todo");
+ return Pair.newInstance(baseID, targetIdentifier);
+
+ } else {
+ Logger.warn("Get unique identifier for target: " + baseIdType + " but target: " + targetIdentifier + " is required!");
+ throw new BuildException("builder.00",
+ new Object[]{"Get unique identifier for target: " + baseIdType + " but target: " + targetIdentifier + " is required"});
+
+ }
+ }
+ }
+
+
/**
- * Builds the wbPK from the given parameters.
+ * Builds the storkeid from the given parameters.
*
- * @param identificationValue Base64 encoded "Stammzahl"
- * @param registerAndOrdNr type of register + "+" + number in register.
- * @return wbPK in a BASE64 encoding
+ * @param baseID baseID of the citizen
+ * @param baseIDType Type of the baseID
+ * @param sourceCountry CountryCode of that country, which build the eIDAs ID
+ * @param destinationCountry CountryCode of that country, which receives the eIDAs ID
+ *
+ * @return Pair<eIDAs, bPKType> in a BASE64 encoding
* @throws BuildException if an error occurs on building the wbPK
*/
- public String buildWBPK(String identificationValue, String registerAndOrdNr)
- throws BuildException {
+ private Pair<String, String> buildeIDASIdentifer(String baseID, String baseIDType, String sourceCountry, String destinationCountry)
+ throws BuildException {
+ String bPK = null;
+ String bPKType = null;
+
+ // check if we have been called by public sector application
+ if (baseIDType.startsWith(Constants.URN_PREFIX_BASEID)) {
+ bPKType = Constants.URN_PREFIX_EIDAS + "+" + sourceCountry + "+" + destinationCountry;
+ Logger.debug("Building eIDAS identification from: [identValue]+" + bPKType);
+ bPK = calculatebPKwbPK(baseID + "+" + bPKType);
+
+ } else { // if not, sector identification value is already calculated by BKU
+ Logger.debug("eIDAS eIdentifier already provided by BKU");
+ bPK = baseID;
+ }
- if ((identificationValue == null ||
- identificationValue.length() == 0 ||
- registerAndOrdNr == null ||
- registerAndOrdNr.length() == 0)) {
+ if ((MiscUtil.isEmpty(bPK) ||
+ MiscUtil.isEmpty(sourceCountry) ||
+ MiscUtil.isEmpty(destinationCountry))) {
throw new BuildException("builder.00",
- new Object[]{"wbPK", "Unvollständige Parameterangaben: identificationValue=" +
- identificationValue + ",Register+Registernummer=" + registerAndOrdNr});
+ new Object[]{"eIDAS-ID", "Unvollständige Parameterangaben: identificationValue=" +
+ bPK + ", Zielland=" + destinationCountry + ", Ursprungsland=" + sourceCountry});
}
-
- String basisbegriff;
- if (registerAndOrdNr.startsWith(Constants.URN_PREFIX_WBPK + "+"))
- basisbegriff = identificationValue + "+" + registerAndOrdNr;
- else
- basisbegriff = identificationValue + "+" + Constants.URN_PREFIX_WBPK + "+" + registerAndOrdNr;
-
- return calculatebPKwbPK(basisbegriff);
- }
-
- public String buildbPKorwbPK(String baseID, String bPKorwbPKTarget) throws BuildException {
- if (MiscUtil.isEmpty(baseID) ||
- !(bPKorwbPKTarget.startsWith(Constants.URN_PREFIX_CDID + "+") ||
- bPKorwbPKTarget.startsWith(Constants.URN_PREFIX_WBPK + "+") ||
- bPKorwbPKTarget.startsWith(Constants.URN_PREFIX_STORK + "+")) ) {
- throw new BuildException("builder.00",
- new Object[]{"bPK/wbPK", "bPK or wbPK target " + bPKorwbPKTarget
- + " has an unkown prefix."});
-
- }
-
- return calculatebPKwbPK(baseID + "+" + bPKorwbPKTarget);
-
+
+ Logger.debug("Building eIDAS identification from: " + sourceCountry+"/"+destinationCountry+"/" + "[identValue]");
+ String eIdentifier = sourceCountry + "/" + destinationCountry + "/" + bPK;
+
+ return Pair.newInstance(eIdentifier, bPKType);
}
+
+// /**
+// * Builds the bPK from the given parameters.
+// *
+// * @param identificationValue Base64 encoded "Stammzahl"
+// * @param target "Bereich lt. Verordnung des BKA"
+// * @return bPK in a BASE64 encoding
+// * @throws BuildException if an error occurs on building the bPK
+// */
+// private String buildBPK(String identificationValue, String target)
+// throws BuildException {
+//
+// if ((identificationValue == null ||
+// identificationValue.length() == 0 ||
+// target == null ||
+// target.length() == 0)) {
+// throw new BuildException("builder.00",
+// new Object[]{"BPK", "Unvollständige Parameterangaben: identificationValue=" +
+// identificationValue + ",target=" + target});
+// }
+// String basisbegriff;
+// if (target.startsWith(Constants.URN_PREFIX_CDID + "+"))
+// basisbegriff = identificationValue + "+" + target;
+// else
+// basisbegriff = identificationValue + "+" + Constants.URN_PREFIX_CDID + "+" + target;
+//
+// return calculatebPKwbPK(basisbegriff);
+// }
+//
+// /**
+// * Builds the wbPK from the given parameters.
+// *
+// * @param identificationValue Base64 encoded "Stammzahl"
+// * @param registerAndOrdNr type of register + "+" + number in register.
+// * @return wbPK in a BASE64 encoding
+// * @throws BuildException if an error occurs on building the wbPK
+// */
+// private String buildWBPK(String identificationValue, String registerAndOrdNr)
+// throws BuildException {
+//
+// if ((identificationValue == null ||
+// identificationValue.length() == 0 ||
+// registerAndOrdNr == null ||
+// registerAndOrdNr.length() == 0)) {
+// throw new BuildException("builder.00",
+// new Object[]{"wbPK", "Unvollständige Parameterangaben: identificationValue=" +
+// identificationValue + ",Register+Registernummer=" + registerAndOrdNr});
+// }
+//
+// String basisbegriff;
+// if (registerAndOrdNr.startsWith(Constants.URN_PREFIX_WBPK + "+"))
+// basisbegriff = identificationValue + "+" + registerAndOrdNr;
+// else
+// basisbegriff = identificationValue + "+" + Constants.URN_PREFIX_WBPK + "+" + registerAndOrdNr;
+//
+// return calculatebPKwbPK(basisbegriff);
+// }
+//
+// private String buildbPKorwbPK(String baseID, String bPKorwbPKTarget) throws BuildException {
+// if (MiscUtil.isEmpty(baseID) ||
+// !(bPKorwbPKTarget.startsWith(Constants.URN_PREFIX_CDID + "+") ||
+// bPKorwbPKTarget.startsWith(Constants.URN_PREFIX_WBPK + "+") ||
+// bPKorwbPKTarget.startsWith(Constants.URN_PREFIX_STORK + "+")) ) {
+// throw new BuildException("builder.00",
+// new Object[]{"bPK/wbPK", "bPK or wbPK target " + bPKorwbPKTarget
+// + " has an unkown prefix."});
+//
+// }
+//
+// return calculatebPKwbPK(baseID + "+" + bPKorwbPKTarget);
+//
+// }
public static String encryptBPK(String bpk, String target, PublicKey publicKey) throws BuildException {
MiscUtil.assertNotNull(bpk, "BPK");
@@ -199,48 +315,7 @@ public class BPKBuilder {
return null;
}
}
-
- /**
- * Builds the storkeid from the given parameters.
- *
- * @param baseID baseID of the citizen
- * @param baseIDType Type of the baseID
- * @param sourceCountry CountryCode of that country, which build the eIDAs ID
- * @param destinationCountry CountryCode of that country, which receives the eIDAs ID
- *
- * @return Pair<eIDAs, bPKType> in a BASE64 encoding
- * @throws BuildException if an error occurs on building the wbPK
- */
- public Pair<String, String> buildeIDASIdentifer(String baseID, String baseIDType, String sourceCountry, String destinationCountry)
- throws BuildException {
- String bPK = null;
- String bPKType = null;
-
- // check if we have been called by public sector application
- if (baseIDType.startsWith(Constants.URN_PREFIX_BASEID)) {
- bPKType = Constants.URN_PREFIX_EIDAS + "+" + sourceCountry + "+" + destinationCountry;
- Logger.debug("Building eIDAS identification from: [identValue]+" + bPKType);
- bPK = calculatebPKwbPK(baseID + "+" + bPKType);
-
- } else { // if not, sector identification value is already calculated by BKU
- Logger.debug("eIDAS eIdentifier already provided by BKU");
- bPK = baseID;
- }
-
- if ((MiscUtil.isEmpty(bPK) ||
- MiscUtil.isEmpty(sourceCountry) ||
- MiscUtil.isEmpty(destinationCountry))) {
- throw new BuildException("builder.00",
- new Object[]{"eIDAS-ID", "Unvollständige Parameterangaben: identificationValue=" +
- bPK + ", Zielland=" + destinationCountry + ", Ursprungsland=" + sourceCountry});
- }
-
- Logger.debug("Building eIDAS identification from: " + sourceCountry+"/"+destinationCountry+"/" + "[identValue]");
- String eIdentifier = sourceCountry + "/" + destinationCountry + "/" + bPK;
- return Pair.newInstance(eIdentifier, bPKType);
- }
-
private String calculatebPKwbPK(String basisbegriff) throws BuildException {
try {
MessageDigest md = MessageDigest.getInstance("SHA-1");
@@ -281,6 +356,4 @@ public class BPKBuilder {
result = cipher.doFinal(encryptedBytes);
return result;
}
-
-
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java
index 73fe961eb..4c4af4239 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java
@@ -53,9 +53,11 @@ import java.util.List;
import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
import at.gv.egovernment.moa.id.config.TargetToSectorNameMapper;
import at.gv.egovernment.moa.util.Constants;
import at.gv.egovernment.moa.util.DateTimeUtils;
+import at.gv.egovernment.moa.util.MiscUtil;
import at.gv.egovernment.moa.util.StringUtils;
/**
@@ -156,8 +158,9 @@ public class CreateXMLSignatureRequestBuilder implements Constants {
* @param oaParam parameter for the OA
* @param session current session
* @return String representation of <code>&lt;CreateXMLSignatureRequest&gt;</code>
+ * @throws ConfigurationException
*/
- public String buildForeignID(String subject, IRequest pendingReq) {
+ public String buildForeignID(String subject, IRequest pendingReq) throws ConfigurationException {
String request = "";
request += "<sl:CreateXMLSignatureRequest xmlns:sl=\"http://www.buergerkarte.at/namespaces/securitylayer/1.2#\">";
@@ -181,11 +184,22 @@ public class CreateXMLSignatureRequestBuilder implements Constants {
return request;
}
- public static String buildForeignIDTextToBeSigned(String subject, IRequest pendingReq) {
+ public static String buildForeignIDTextToBeSigned(String subject, IRequest pendingReq) throws ConfigurationException {
IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
- String target = pendingReq.getGenericData(
- MOAIDAuthConstants.AUTHPROCESS_DATA_TARGET, String.class);
- String sectorName = TargetToSectorNameMapper.getSectorNameViaTarget(target);
+ String target = null;
+ String sectorName = null;
+
+
+ String saml1Target = pendingReq.getGenericData(
+ MOAIDAuthConstants.AUTHPROCESS_DATA_TARGET, String.class);
+ if (MiscUtil.isNotEmpty(saml1Target)) {
+ target = saml1Target;
+ sectorName = TargetToSectorNameMapper.getSectorNameViaTarget(saml1Target);
+
+ } else {
+ target = oaParam.getAreaSpecificTargetIdentifier();
+ sectorName = oaParam.getAreaSpecificTargetIdentifierFriendlyName();
+ }
Calendar cal = Calendar.getInstance();
String date = DateTimeUtils.buildDate(cal);
@@ -243,11 +257,11 @@ public class CreateXMLSignatureRequestBuilder implements Constants {
request += oaParam.getPublicURLPrefix();
request += "</td>";
request += "</tr>";
- boolean business = oaParam.getBusinessService();
- if (business) {
+
+ if (!target.startsWith(MOAIDAuthConstants.PREFIX_CDID)) {
// OA is businessservice
- String identifierType = oaParam.getIdentityLinkDomainIdentifierType();
- String identifier = oaParam.getIdentityLinkDomainIdentifier();
+ String identifierType = oaParam.getAreaSpecificTargetIdentifierFriendlyName();
+ String identifier = oaParam.getAreaSpecificTargetIdentifier();
request += "<tr>";
request += "<td class=\"italicstyle\">";
request += identifierType + ":";
@@ -263,7 +277,7 @@ public class CreateXMLSignatureRequestBuilder implements Constants {
request += "<td class=\"italicstyle\">";
request += "Sektor (Sector):</td>";
request += "<td class=\"normalstyle\">";
- request += target + " (" + sectorName + ")";
+ request += target.substring(MOAIDAuthConstants.PREFIX_CDID.length()) + " (" + sectorName + ")";
request += "</td>";
request += "</tr>";
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/DynamicOAAuthParameterBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/DynamicOAAuthParameterBuilder.java
index f4f6e82ba..fc5489673 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/DynamicOAAuthParameterBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/DynamicOAAuthParameterBuilder.java
@@ -31,14 +31,10 @@ import at.gv.egovernment.moa.id.auth.exception.DynamicOABuildException;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
import at.gv.egovernment.moa.id.commons.api.IRequest;
import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
-import at.gv.egovernment.moa.id.commons.db.dao.session.InterfederationSessionStore;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
import at.gv.egovernment.moa.id.config.auth.data.DynamicOAAuthParameters;
import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
import at.gv.egovernment.moa.logging.Logger;
import at.gv.egovernment.moa.util.Constants;
-import at.gv.egovernment.moa.util.MiscUtil;
/**
* @author tlenz
@@ -57,13 +53,14 @@ public class DynamicOAAuthParameterBuilder {
if (attr.getName().equals(PVPConstants.EID_SECTOR_FOR_IDENTIFIER_NAME)) {
String attrValue = attr.getAttributeValues().get(0).getDOM().getTextContent();
if (attrValue.startsWith(Constants.URN_PREFIX_CDID)) {
- dynamicOA.setBusinessService(false);
- dynamicOA.setTarget(attrValue.substring((Constants.URN_PREFIX_CDID + "+").length()));
+ //dynamicOA.setBusinessService(false);
+ dynamicOA.setAreaSpecificTargetIdentifier(attrValue);
} else if( attrValue.startsWith(Constants.URN_PREFIX_WBPK) ||
- attrValue.startsWith(Constants.URN_PREFIX_STORK) ) {
- dynamicOA.setBusinessService(true);
- dynamicOA.setTarget(attrValue);
+ attrValue.startsWith(Constants.URN_PREFIX_STORK) ||
+ attrValue.startsWith(Constants.URN_PREFIX_EIDAS)) {
+ //dynamicOA.setBusinessService(true);
+ dynamicOA.setAreaSpecificTargetIdentifier(attrValue);
} else {
Logger.error("Sector identification " + attrValue + " is not a valid Target or BusinessServiceArea");
@@ -84,13 +81,16 @@ public class DynamicOAAuthParameterBuilder {
* @param oaParam
* @param protocolRequest
* @return
+ * @throws ConfigurationException
*/
public static IOAAuthParameters buildFromAuthnRequest(
- IOAAuthParameters oaParam, IRequest protocolRequest) {
+ IOAAuthParameters oaParam, IRequest protocolRequest) throws ConfigurationException {
DynamicOAAuthParameters dynOAParams = new DynamicOAAuthParameters();
dynOAParams.setApplicationID(oaParam.getPublicURLPrefix());
- dynOAParams.setBusinessService(oaParam.getBusinessService());
+
+ dynOAParams.setHasBaseIdProcessingRestriction(oaParam.hasBaseIdInternalProcessingRestriction());
+ dynOAParams.setHasBaseIdTransfergRestriction(oaParam.hasBaseIdTransferRestriction());
Object storkRequst = null;
try {
@@ -98,9 +98,9 @@ public class DynamicOAAuthParameterBuilder {
if (storkRequst != null &&
protocolRequest.getClass().isInstance(storkRequst)) {
- dynOAParams.setBusinessTarget(Constants.URN_PREFIX_STORK + "+" + "AT" + "+"
+ dynOAParams.setAreaSpecificTargetIdentifier(Constants.URN_PREFIX_STORK + "+" + "AT" + "+"
+ protocolRequest.getClass().getMethod("getSpCountry", null).invoke(protocolRequest, null));
- dynOAParams.setBusinessService(true);
+ //dynOAParams.setBusinessService(true);
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java
index cfe075520..b2db8d5a2 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java
@@ -33,7 +33,6 @@ import org.springframework.stereotype.Service;
import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
-import at.gv.egovernment.moa.id.commons.MOAIDConstants;
import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
import at.gv.egovernment.moa.id.commons.api.IRequest;
@@ -53,7 +52,7 @@ public class StartAuthentificationParameterParser extends MOAIDAuthConstants{
@Autowired AuthConfiguration authConfig;
public void parse(IAuthenticationSession moasession,
- String target,
+ String reqTarget,
String oaURL,
String bkuURL,
String templateURL,
@@ -62,10 +61,11 @@ public class StartAuthentificationParameterParser extends MOAIDAuthConstants{
HttpServletRequest req,
IRequest protocolReq) throws WrongParametersException, MOAIDException {
- String targetFriendlyName = null;
-
+ String resultTargetFriendlyName = null;
+ String resultTarget = null;
+
// escape parameter strings
- target = StringEscapeUtils.escapeHtml(target);
+ reqTarget = StringEscapeUtils.escapeHtml(reqTarget);
bkuURL = StringEscapeUtils.escapeHtml(bkuURL);
templateURL = StringEscapeUtils.escapeHtml(templateURL);
useMandate = StringEscapeUtils.escapeHtml(useMandate);
@@ -103,70 +103,70 @@ public class StartAuthentificationParameterParser extends MOAIDAuthConstants{
// get target and target friendly name from config
- String targetConfig = oaParam.getTarget();
- String targetFriendlyNameConfig = oaParam.getTargetFriendlyName();
+ String targetConfig = oaParam.getAreaSpecificTargetIdentifier();
+ String targetFriendlyNameConfig = oaParam.getAreaSpecificTargetIdentifierFriendlyName();
+
+ //SAML1 legacy work-around for public area targets in request
+ if (protocolReq.requestedModule().equals("at.gv.egovernment.moa.id.protocols.saml1.SAML1Protocol") &&
+ !StringUtils.isEmpty(reqTarget)) {
+ //INFO: ONLY SAML1 legacy mode
+ // if SAML1 is used and target attribute is given in request
+ // use requested target
+ // check target parameter
+ if (!ParamValidatorUtils.isValidTarget(reqTarget)) {
+ Logger.error("Selected target is invalid. Used target: " + reqTarget);
+ throw new WrongParametersException("StartAuthentication", PARAM_TARGET, "auth.12");
+ }
+ resultTarget = MOAIDAuthConstants.PREFIX_CDID + reqTarget;
- if (!oaParam.getBusinessService()) {
- if (StringUtils.isEmpty(targetConfig)
- || (protocolReq.requestedModule().equals("at.gv.egovernment.moa.id.protocols.saml1.SAML1Protocol") &&
- !StringUtils.isEmpty(target))
- ) {
- //INFO: ONLY SAML1 legacy mode
- // if SAML1 is used and target attribute is given in request
- // use requested target
- // check target parameter
- if (!ParamValidatorUtils.isValidTarget(target)) {
- Logger.error("Selected target is invalid. Using target: " + target);
- throw new WrongParametersException("StartAuthentication", PARAM_TARGET, "auth.12");
- }
- if (MiscUtil.isNotEmpty(targetConfig))
- targetFriendlyName = targetFriendlyNameConfig;
+ String sectorName = TargetToSectorNameMapper.getSectorNameViaTarget(reqTarget);
+ if (MiscUtil.isNotEmpty(sectorName))
+ resultTargetFriendlyName = sectorName;
+
+ else {
+ //check target contains subSector
+ int delimiter = reqTarget.indexOf("-");
+ if (delimiter > 0) {
+ resultTargetFriendlyName =
+ TargetToSectorNameMapper.getSectorNameViaTarget(reqTarget.substring(0, delimiter));
- else {
- String sectorName = TargetToSectorNameMapper.getSectorNameViaTarget(target);
- if (MiscUtil.isNotEmpty(sectorName))
- targetFriendlyName = sectorName;
-
- else {
- //check target contains subSector
- int delimiter = target.indexOf("-");
- if (delimiter > 0) {
- targetFriendlyName =
- TargetToSectorNameMapper.getSectorNameViaTarget(target.substring(0, delimiter));
-
- }
- }
- }
-
- } else {
- // use target from config
- target = targetConfig;
- targetFriendlyName = targetFriendlyNameConfig;
+ }
}
- if (isEmpty(target))
- throw new WrongParametersException("StartAuthentication",
- PARAM_TARGET, "auth.05");
-
- protocolReq.setGenericDataToSession(MOAIDAuthConstants.AUTHPROCESS_DATA_TARGET, target);
+ if (MiscUtil.isNotEmpty(targetConfig) && MiscUtil.isEmpty(resultTargetFriendlyName))
+ resultTargetFriendlyName = targetFriendlyNameConfig;
+
+ //set info's into request-context. (It's required to support SAML1 requested target parameters)
+ protocolReq.setGenericDataToSession(MOAIDAuthConstants.AUTHPROCESS_DATA_TARGET, resultTarget);
protocolReq.setGenericDataToSession(
- MOAIDAuthConstants.AUTHPROCESS_DATA_TARGETFRIENDLYNAME, targetFriendlyName);
- Logger.debug("Service-Provider is of type 'PublicService' with DomainIdentifier:" + target);
-
+ MOAIDAuthConstants.AUTHPROCESS_DATA_TARGETFRIENDLYNAME, resultTargetFriendlyName);
+
} else {
- Logger.debug("Service-Provider is of type 'PrivateService' with DomainIdentifier:" + oaParam.getIdentityLinkDomainIdentifier());
+ Logger.trace("Use oa sector-identifier from configuration");
+ resultTarget = targetConfig;
+ resultTargetFriendlyName = targetFriendlyNameConfig;
- /*eIDAS SPs have the same policies regarding Austrian baseIDs as Austrian business services,
- * but mandates are allowed for these
- */
- if (useMandateBoolean &&
- !oaParam.getIdentityLinkDomainIdentifier().startsWith(MOAIDConstants.PREFIX_EIDAS)) {
- Logger.error("Online-Mandate Mode for business application not supported.");
- throw new AuthenticationException("auth.17", null);
-
- }
}
-
+
+ //check if target is found
+ if (MiscUtil.isEmpty(resultTarget))
+ throw new WrongParametersException("StartAuthentication",
+ PARAM_TARGET, "auth.05");
+
+ //check if mandates are allowed
+ if (useMandateBoolean && oaParam.hasBaseIdInternalProcessingRestriction()) {
+ Logger.error("Online-Mandate Mode for business application not supported.");
+ throw new AuthenticationException("auth.17", null);
+
+ }
+
+ if (resultTarget.startsWith(MOAIDAuthConstants.PREFIX_CDID))
+ Logger.debug("Service-Provider is of type 'PublicService' with DomainIdentifier:" + resultTarget);
+ else
+ Logger.debug("Service-Provider is of type 'PrivateService' with DomainIdentifier:" + resultTarget);
+
+
+
//Validate BKU URI
List<String> allowedbkus = oaParam.getBKUURL();
allowedbkus.addAll(authConfig.getDefaultBKUURLs());
@@ -252,16 +252,4 @@ public class StartAuthentificationParameterParser extends MOAIDAuthConstants{
parse(moasession, target, oaURL, bkuURL, templateURL, useMandate, ccc, req, pendingReq);
}
-
- /**
- * Checks a parameter.
- *
- * @param param
- * parameter
- * @return true if the parameter is null or empty
- */
- private boolean isEmpty(String param) {
- return param == null || param.length() == 0;
- }
-
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/TargetToSectorNameMapper.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/TargetToSectorNameMapper.java
index c31666bbb..fc5cc0495 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/TargetToSectorNameMapper.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/TargetToSectorNameMapper.java
@@ -52,6 +52,8 @@ package at.gv.egovernment.moa.id.config;
import java.util.HashMap;
import java.util.Map;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+
/**
* @author bzwattendorfer
*
@@ -106,6 +108,8 @@ public class TargetToSectorNameMapper implements TargetsAndSectorNames {
}
public static String getSectorNameViaTarget(String target) {
+ if (target.startsWith(MOAIDAuthConstants.PREFIX_CDID))
+ target = target.substring(MOAIDAuthConstants.PREFIX_CDID.length());
return targetMap.get(target) != null ? (String) targetMap.get(target) : "";
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java
index e96169688..3d04a142e 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java
@@ -60,7 +60,9 @@ import java.util.Set;
import org.apache.commons.lang.SerializationUtils;
import at.gv.egovernment.moa.id.auth.exception.BuildException;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
import at.gv.egovernment.moa.id.commons.MOAIDConstants;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
import at.gv.egovernment.moa.id.commons.api.IStorkConfig;
import at.gv.egovernment.moa.id.commons.api.data.BPKDecryptionParameters;
@@ -96,10 +98,31 @@ public class OAAuthParameter implements IOAAuthParameters, Serializable{
final public static String DEFAULT_KEYBOXIDENTIFIER = "SecureSignatureKeypair";
private Map<String, String> oaConfiguration;
+ private List<String> targetAreasWithNoInteralBaseIdRestriction = new ArrayList<String>();
+ private List<String> targetAreasWithNoBaseIdTransmissionRestriction = new ArrayList<String>();
-
- public OAAuthParameter(final Map<String, String> oa) {
+ public OAAuthParameter(final Map<String, String> oa, AuthConfiguration authConfig) {
this.oaConfiguration = oa;
+
+ //set oa specific restrictions
+ targetAreasWithNoInteralBaseIdRestriction = KeyValueUtils.getListOfCSVValues(
+ authConfig.getBasicMOAIDConfiguration(
+ CONFIG_KEY_RESTRICTIONS_BASEID_INTERNAL,
+ MOAIDAuthConstants.PREFIX_CDID));
+
+ targetAreasWithNoBaseIdTransmissionRestriction = KeyValueUtils.getListOfCSVValues(
+ authConfig.getBasicMOAIDConfiguration(
+ CONFIG_KEY_RESTRICTIONS_BASEID_TRANSMISSION,
+ MOAIDAuthConstants.PREFIX_CDID));
+
+ if (Logger.isTraceEnabled()) {
+ Logger.trace("Internal policy for OA: " + getPublicURLPrefix());
+ for (String el : targetAreasWithNoInteralBaseIdRestriction)
+ Logger.trace(" Allow baseID processing for prefix " + el);
+ for (String el : targetAreasWithNoBaseIdTransmissionRestriction)
+ Logger.trace(" Allow baseID transfer for prefix " + el);
+
+ }
}
@@ -111,12 +134,54 @@ public class OAAuthParameter implements IOAAuthParameters, Serializable{
return this.oaConfiguration.get(key);
}
+ @Override
+ public boolean hasBaseIdInternalProcessingRestriction() throws ConfigurationException {
+ String targetAreaIdentifier = getAreaSpecificTargetIdentifier();
+ for (String el : targetAreasWithNoInteralBaseIdRestriction) {
+ if (targetAreaIdentifier.startsWith(el))
+ return false;
+
+ }
+ return true;
+
+ }
+
+ @Override
+ public boolean hasBaseIdTransferRestriction() throws ConfigurationException {
+ String targetAreaIdentifier = getAreaSpecificTargetIdentifier();
+ for (String el : targetAreasWithNoBaseIdTransmissionRestriction) {
+ if (targetAreaIdentifier.startsWith(el))
+ return false;
+
+ }
+ return true;
+
+ }
+
+ @Override
+ public String getAreaSpecificTargetIdentifier() throws ConfigurationException {
+ if (getBusinessService())
+ return getIdentityLinkDomainIdentifier();
+ else
+ return MOAIDAuthConstants.PREFIX_CDID + getTarget();
+
+ }
+
+ @Override
+ public String getAreaSpecificTargetIdentifierFriendlyName() throws ConfigurationException{
+ if (getBusinessService())
+ return getIdentityLinkDomainIdentifierType();
+ else
+ return getTargetFriendlyName();
+
+ }
+
/* (non-Javadoc)
* @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getIdentityLinkDomainIdentifier()
*/
-@Override
-public String getIdentityLinkDomainIdentifier() {
+//@Override
+private String getIdentityLinkDomainIdentifier() {
String type = oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_TYPE);
String value = oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_VALUE);
if (MiscUtil.isNotEmpty(type) && MiscUtil.isNotEmpty(value)) {
@@ -138,8 +203,8 @@ public String getIdentityLinkDomainIdentifier() {
/* (non-Javadoc)
* @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getIdentityLinkDomainIdentifierType()
*/
-@Override
-public String getIdentityLinkDomainIdentifierType() {
+//@Override
+private String getIdentityLinkDomainIdentifierType() {
String value = oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_TYPE);
if (MiscUtil.isNotEmpty(value))
return MOAIDConfigurationConstants.BUSINESSSERVICENAMES.get(value);
@@ -151,8 +216,8 @@ public String getIdentityLinkDomainIdentifierType() {
/* (non-Javadoc)
* @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getTarget()
*/
-@Override
-public String getTarget() {
+//@Override
+private String getTarget() {
if (Boolean.parseBoolean(oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_PUBLIC_USE_OWN)))
return oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_PUBLIC_OWN_TARGET);
@@ -171,8 +236,8 @@ public String getTarget() {
/* (non-Javadoc)
* @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getTargetFriendlyName()
*/
-@Override
-public String getTargetFriendlyName() {
+//@Override
+private String getTargetFriendlyName() {
if (Boolean.parseBoolean(oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_PUBLIC_USE_OWN)))
return oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_PUBLIC_OWN_NAME);
@@ -653,8 +718,8 @@ public boolean isInterfederationSSOStorageAllowed() {
return false;
}
-public boolean isIDPPublicService() {
- return !getBusinessService();
+public boolean isIDPPublicService() throws ConfigurationException {
+ return !hasBaseIdTransferRestriction();
}
@@ -740,11 +805,7 @@ public String getPublicURLPrefix() {
}
-/* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getBusinessService()
- */
-@Override
-public boolean getBusinessService() {
+private boolean getBusinessService() {
String value = oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_BUSINESSSERVICE);
if (MiscUtil.isNotEmpty(value))
return Boolean.parseBoolean(value);
@@ -785,16 +846,16 @@ public String getFriendlyName() {
}
-/* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getOaType()
- */
-@Override
-public String getOaType() {
- if (getBusinessService())
- return "businessService";
- else
- return "publicService";
-}
+///* (non-Javadoc)
+// * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getOaType()
+// */
+//@Override
+//public String getOaType() {
+// if (getBusinessService())
+// return "businessService";
+// else
+// return "publicService";
+//}
/**
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java
index b1fc12f26..332604257 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java
@@ -412,7 +412,7 @@ public class PropertyBasedAuthConfigurationProvider extends ConfigurationProvide
return null;
}
- return new OAAuthParameter(oa);
+ return new OAAuthParameter(oa, this);
}
/**
@@ -817,7 +817,7 @@ public class PropertyBasedAuthConfigurationProvider extends ConfigurationProvide
public String getSSOFriendlyName() {
try {
return configuration.getStringValue(
- MOAIDConfigurationConstants.GENERAL_AUTH_SSO_TARGET, "Default MOA-ID friendly name for SSO");
+ MOAIDConfigurationConstants.GENERAL_AUTH_SSO_SERVICENAME, "Default MOA-ID friendly name for SSO");
} catch (at.gv.egiz.components.configuration.api.ConfigurationException e) {
Logger.warn("Single Sign-On FriendlyName can not be read from configuration.", e);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/data/DynamicOAAuthParameters.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/data/DynamicOAAuthParameters.java
index 9fd58b5c7..f3db82315 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/data/DynamicOAAuthParameters.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/data/DynamicOAAuthParameters.java
@@ -32,6 +32,7 @@ import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
import at.gv.egovernment.moa.id.commons.api.data.SAML1ConfigurationParameters;
import at.gv.egovernment.moa.id.commons.api.data.StorkAttribute;
import at.gv.egovernment.moa.id.commons.api.data.StorkAttributeProviderPlugin;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
/**
* @author tlenz
@@ -45,33 +46,84 @@ public class DynamicOAAuthParameters implements IOAAuthParameters, Serializable{
private static final long serialVersionUID = 1648437815185614566L;
private String publicURLPrefix;
-
- private String businessTarget;
-
- private boolean businessService;
-
+
private boolean isInderfederationIDP;
-
private String IDPQueryURL;
- private String target;
-
+ private boolean hasBaseIdProcessingRestriction;
+ private boolean hasBaseIdTransfergRestriction;
+ private String oaTargetAreaIdentifier;
+
+
/* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getTarget()
+ * @see at.gv.egovernment.moa.id.commons.api.IOAAuthParameters#hasBaseIdInternalProcessingRestriction()
*/
@Override
- public String getTarget() {
- return this.target;
+ public boolean hasBaseIdInternalProcessingRestriction() throws ConfigurationException {
+ return this.hasBaseIdProcessingRestriction;
+ }
+
+ /* (non-Javadoc)
+ * @see at.gv.egovernment.moa.id.commons.api.IOAAuthParameters#hasBaseIdTransferRestriction()
+ */
+ @Override
+ public boolean hasBaseIdTransferRestriction() throws ConfigurationException {
+ return this.hasBaseIdTransfergRestriction;
}
/* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getIdentityLinkDomainIdentifier()
+ * @see at.gv.egovernment.moa.id.commons.api.IOAAuthParameters#getAreaSpecificTargetIdentifier()
+ */
+ @Override
+ public String getAreaSpecificTargetIdentifier() throws ConfigurationException {
+ return this.oaTargetAreaIdentifier;
+ }
+
+ /**
+ * @param hasBaseIdProcessingRestriction the hasBaseIdProcessingRestriction to set
+ */
+ public void setHasBaseIdProcessingRestriction(boolean hasBaseIdProcessingRestriction) {
+ this.hasBaseIdProcessingRestriction = hasBaseIdProcessingRestriction;
+ }
+
+ /**
+ * @param hasBaseIdTransfergRestriction the hasBaseIdTransfergRestriction to set
+ */
+ public void setHasBaseIdTransfergRestriction(boolean hasBaseIdTransfergRestriction) {
+ this.hasBaseIdTransfergRestriction = hasBaseIdTransfergRestriction;
+ }
+
+ /**
+ * @param oaTargetAreaIdentifier the oaTargetAreaIdentifier to set
+ */
+ public void setAreaSpecificTargetIdentifier(String oaTargetAreaIdentifier) {
+ this.oaTargetAreaIdentifier = oaTargetAreaIdentifier;
+ }
+
+ /* (non-Javadoc)
+ * @see at.gv.egovernment.moa.id.commons.api.IOAAuthParameters#getAreaSpecificTargetIdentifierFriendlyName()
*/
@Override
- public String getIdentityLinkDomainIdentifier() {
- return this.businessTarget;
+ public String getAreaSpecificTargetIdentifierFriendlyName() throws ConfigurationException {
+ return null;
}
+// /* (non-Javadoc)
+// * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getTarget()
+// */
+// //@Override
+// public String getTarget() {
+// return this.target;
+// }
+//
+// /* (non-Javadoc)
+// * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getIdentityLinkDomainIdentifier()
+// */
+// //@Override
+// public String getIdentityLinkDomainIdentifier() {
+// return this.businessTarget;
+// }
+
/* (non-Javadoc)
* @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getIDPAttributQueryServiceURL()
*/
@@ -164,7 +216,7 @@ public class DynamicOAAuthParameters implements IOAAuthParameters, Serializable{
/* (non-Javadoc)
* @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getIdentityLinkDomainIdentifierType()
*/
- @Override
+ //@Override
public String getIdentityLinkDomainIdentifierType() {
// TODO Auto-generated method stub
return null;
@@ -251,26 +303,26 @@ public class DynamicOAAuthParameters implements IOAAuthParameters, Serializable{
return null;
}
- /**
- * @param isBusinessService the isBusinessService to set
- */
- public void setBusinessService(boolean isBusinessService) {
- businessService = isBusinessService;
- }
-
- /**
- * @param target the target to set
- */
- public void setTarget(String target) {
- this.target = target;
- }
-
- /**
- * @param businessTarget the businessTarget to set
- */
- public void setBusinessTarget(String businessTarget) {
- this.businessTarget = businessTarget;
- }
+// /**
+// * @param isBusinessService the isBusinessService to set
+// */
+// public void setBusinessService(boolean isBusinessService) {
+// businessService = isBusinessService;
+// }
+
+// /**
+// * @param target the target to set
+// */
+// public void setTarget(String target) {
+// this.target = target;
+// }
+//
+// /**
+// * @param businessTarget the businessTarget to set
+// */
+// public void setBusinessTarget(String businessTarget) {
+// this.businessTarget = businessTarget;
+// }
/**
* @param inderfederatedIDP the inderfederatedIDP to set
@@ -400,27 +452,18 @@ public class DynamicOAAuthParameters implements IOAAuthParameters, Serializable{
return this.publicURLPrefix;
}
- /* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getOaType()
- */
- @Override
- public String getOaType() {
- // TODO Auto-generated method stub
- return null;
- }
-
- /* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getBusinessService()
- */
- @Override
- public boolean getBusinessService() {
- return this.businessService;
- }
+// /* (non-Javadoc)
+// * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getBusinessService()
+// */
+// //@Override
+// public boolean getBusinessService() {
+// return this.businessService;
+// }
/* (non-Javadoc)
* @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getTargetFriendlyName()
*/
- @Override
+ //@Override
public String getTargetFriendlyName() {
// TODO Auto-generated method stub
return null;
@@ -487,4 +530,6 @@ public class DynamicOAAuthParameters implements IOAAuthParameters, Serializable{
// TODO Auto-generated method stub
return false;
}
+
+
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java
index f5f056ccc..7f56f519b 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java
@@ -120,7 +120,8 @@ public class AuthenticationData implements IAuthData, Serializable {
* the corresponding <code>lt;saml:Assertion&gt;</code>
*/
- private boolean businessService;
+ private boolean isBaseIDTransferRestrication = true;
+
/**
* STORK attributes from response
@@ -742,13 +743,15 @@ public class AuthenticationData implements IAuthData, Serializable {
* @see at.gv.egovernment.moa.id.data.IAuthData#isBusinessService()
*/
@Override
- public boolean isBusinessService() {
- return this.businessService;
+ public boolean isBaseIDTransferRestrication() {
+ return isBaseIDTransferRestrication;
}
-
- public void setIsBusinessService(boolean flag) {
- this.businessService = flag;
-
+
+ /**
+ * @param isBaseIDTransmittionAllowed the isBaseIDTransmittionAllowed to set
+ */
+ public void setBaseIDTransferRestrication(boolean isBaseIDTransferRestrication) {
+ this.isBaseIDTransferRestrication = isBaseIDTransferRestrication;
}
/**
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java
index 4c15cd3d1..e9fef4676 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java
@@ -38,8 +38,8 @@ public interface IAuthData {
Date getIssueInstant();
String getIssuer();
-
- boolean isBusinessService();
+ boolean isBaseIDTransferRestrication();
+
boolean isSsoSession();
//boolean isInterfederatedSSOSession();
boolean isUseMandate();
@@ -90,5 +90,6 @@ public interface IAuthData {
String getCcc();
public <T> T getGenericData(String key, final Class<T> clazz);
+
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePIN.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePIN.java
index a6a5f1dd4..b4846db12 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePIN.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePIN.java
@@ -38,7 +38,7 @@ public class EIDSourcePIN implements IPVPAttributeBuilder {
public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
IAttributeGenerator<ATT> g) throws AttributeException {
- if (authData.isBusinessService())
+ if (authData.isBaseIDTransferRestrication())
throw new AttributePolicyException(EID_SOURCE_PIN_NAME);
else {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePINType.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePINType.java
index 1d836802a..ccaecb3b6 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePINType.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePINType.java
@@ -23,7 +23,6 @@
package at.gv.egovernment.moa.id.protocols.builder.attributes;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
import at.gv.egovernment.moa.id.data.IAuthData;
import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.UnavailableAttributeException;
@@ -37,7 +36,7 @@ public class EIDSourcePINType implements IPVPAttributeBuilder {
public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
IAttributeGenerator<ATT> g) throws AttributeException {
- if (authData.isBusinessService())
+ if (authData.isBaseIDTransferRestrication())
throw new UnavailableAttributeException(EID_SOURCE_PIN_TYPE_NAME);
else {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonBPKAttributeBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonBPKAttributeBuilder.java
index f4e69749c..a74ed4af5 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonBPKAttributeBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonBPKAttributeBuilder.java
@@ -30,7 +30,9 @@ import at.gv.e_government.reference.namespace.persondata._20020228_.PhysicalPers
import at.gv.egovernment.moa.id.auth.builder.BPKBuilder;
import at.gv.egovernment.moa.id.auth.exception.BuildException;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
import at.gv.egovernment.moa.id.data.IAuthData;
+import at.gv.egovernment.moa.id.data.Pair;
import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.NoMandateDataAttributeException;
import at.gv.egovernment.moa.id.util.MandateBuilder;
@@ -74,24 +76,16 @@ public class MandateNaturalPersonBPKAttributeBuilder implements IPVPAttributeBui
}
try {
- if (id.getType().equals(Constants.URN_PREFIX_BASEID)) {
-
- /*TODO: some updates are required if we support bPKs in eIDAS context, because
- * BPKBuilder().buildWBPK only supports Austrian wbPKs
- */
- if (oaParam.getBusinessService()) {
- bpk = new BPKBuilder().buildWBPK(id.getValue().getValue(), oaParam.getIdentityLinkDomainIdentifier());
-
- } else {
- bpk = new BPKBuilder().buildBPK(id.getValue().getValue(), oaParam.getTarget());
-
- }
-
+ if (id.getType().equals(Constants.URN_PREFIX_BASEID)) {
+ Pair<String, String> calcResult = new BPKBuilder().generateAreaSpecificPersonIdentifier(id.getValue().getValue(),
+ oaParam.getAreaSpecificTargetIdentifier());
+ bpk = calcResult.getFirst();
+
} else
bpk = id.getValue().getValue();
}
- catch (BuildException e) {
+ catch (BuildException | ConfigurationException e) {
Logger.error("Failed to generate IdentificationType");
throw new NoMandateDataAttributeException();
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonSourcePinAttributeBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonSourcePinAttributeBuilder.java
index 69a731e53..82ebbb2b5 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonSourcePinAttributeBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonSourcePinAttributeBuilder.java
@@ -27,10 +27,7 @@ import org.w3c.dom.Element;
import at.gv.e_government.reference.namespace.mandates._20040701_.Mandate;
import at.gv.e_government.reference.namespace.persondata._20020228_.IdentificationType;
import at.gv.e_government.reference.namespace.persondata._20020228_.PhysicalPersonType;
-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.AuthenticationData;
import at.gv.egovernment.moa.id.data.IAuthData;
import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributePolicyException;
@@ -64,7 +61,7 @@ public class MandateNaturalPersonSourcePinAttributeBuilder implements IPVPAttri
IdentificationType id = null;
id = physicalPerson.getIdentification().get(0);
- if(oaParam.getBusinessService()) {
+ if(authData.isBaseIDTransferRestrication()) {
throw new AttributePolicyException(this.getName());
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java
index 643e30ac9..72691a034 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java
@@ -227,9 +227,9 @@ public class AttributQueryAction implements IAction {
}
//check next IDP service area policy. BusinessService IDPs can only request wbPKs
- if (!spConfig.getBusinessService() && !idp.isIDPPublicService()) {
+ if (!spConfig.hasBaseIdTransferRestriction() && !idp.isIDPPublicService()) {
Logger.error("Interfederated IDP " + idp.getPublicURLPrefix()
- + " has a BusinessService-IDP but requests PublicService attributes.");
+ + " is a BusinessService-IDP but requests PublicService attributes.");
throw new MOAIDException("auth.34", new Object[]{nextIDPInformation.getIdpurlprefix()});
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/AttributQueryBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/AttributQueryBuilder.java
index 2df72637d..4aa4f7419 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/AttributQueryBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/AttributQueryBuilder.java
@@ -59,7 +59,6 @@ import at.gv.egovernment.moa.id.protocols.pvp2x.signer.CredentialsNotAvailableEx
import at.gv.egovernment.moa.id.protocols.pvp2x.signer.IDPCredentialProvider;
import at.gv.egovernment.moa.id.protocols.pvp2x.utils.SAML2Utils;
import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.Constants;
/**
* @author tlenz
@@ -70,7 +69,7 @@ public class AttributQueryBuilder {
@Autowired IDPCredentialProvider credentialProvider;
- public List<Attribute> buildSAML2AttributeList(IOAAuthParameters oa, Iterator<String> iterator) {
+ public List<Attribute> buildSAML2AttributeList(IOAAuthParameters oa, Iterator<String> iterator) throws ConfigurationException {
Logger.debug("Build OA specific Attributes for AttributQuery request");
@@ -87,17 +86,13 @@ public class AttributQueryBuilder {
} else {
//add OA specific information
if (rA.equals(PVPConstants.EID_SECTOR_FOR_IDENTIFIER_NAME)) {
- if (oa.getBusinessService())
- attr = generator.buildStringAttribute(attr.getFriendlyName(),
- attr.getName(), oa.getIdentityLinkDomainIdentifier());
- else
- attr = generator.buildStringAttribute(attr.getFriendlyName(),
- attr.getName(), Constants.URN_PREFIX_CDID + "+" + oa.getTarget());
+ attr = generator.buildStringAttribute(attr.getFriendlyName(),
+ attr.getName(), oa.getAreaSpecificTargetIdentifier());
+
}
//TODO: add attribute values for SSO with mandates (ProfileList)
-
-
+
attrList.add(attr);
}
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java
index 55d8fa1ff..45539da3f 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java
@@ -60,11 +60,11 @@ import at.gv.e_government.reference.namespace.persondata._20020228_.CorporateBod
import at.gv.e_government.reference.namespace.persondata._20020228_.IdentificationType;
import at.gv.e_government.reference.namespace.persondata._20020228_.PhysicalPersonType;
import at.gv.egovernment.moa.id.auth.builder.BPKBuilder;
-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
import at.gv.egovernment.moa.id.data.IAuthData;
+import at.gv.egovernment.moa.id.data.Pair;
import at.gv.egovernment.moa.id.data.SLOInformationImpl;
import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
import at.gv.egovernment.moa.id.protocols.pvp2x.PVPTargetConfiguration;
@@ -338,20 +338,8 @@ public class PVP2AssertionBuilder implements PVPConstants {
}
//set bPK-Type from configuration, because it MUST be equal to service-provider type
- if (oaParam.getBusinessService()) {
- if (oaParam.getIdentityLinkDomainIdentifier().startsWith(AuthenticationSession.REGISTERANDORDNR_PREFIX_))
- bpktype = oaParam.getIdentityLinkDomainIdentifier();
- else
- bpktype = Constants.URN_PREFIX_WBPK + "+" + oaParam.getIdentityLinkDomainIdentifier();
-
- } else {
- if (oaParam.getTarget().startsWith(Constants.URN_PREFIX_CDID + "+"))
- bpktype = oaParam.getTarget();
- else
- bpktype = Constants.URN_PREFIX_CDID + "+" + oaParam.getTarget();
-
- }
-
+ bpktype = oaParam.getAreaSpecificTargetIdentifier();
+
} else {
//sourcePin is include --> check sourcePinType
if (MiscUtil.isEmpty(bpktype))
@@ -365,21 +353,10 @@ public class PVP2AssertionBuilder implements PVPConstants {
}
- if (bpktype.equals(Constants.URN_PREFIX_BASEID)) {
- if (oaParam.getBusinessService()) {
- subjectNameID.setValue(new BPKBuilder().buildWBPK(bpk, oaParam.getIdentityLinkDomainIdentifier()));
- if (oaParam.getIdentityLinkDomainIdentifier().startsWith(AuthenticationSession.REGISTERANDORDNR_PREFIX_))
- subjectNameID.setNameQualifier(oaParam.getIdentityLinkDomainIdentifier());
- else
- subjectNameID.setNameQualifier(Constants.URN_PREFIX_WBPK + "+" + oaParam.getIdentityLinkDomainIdentifier());
-
- } else {
- subjectNameID.setValue(new BPKBuilder().buildBPK(bpk, oaParam.getTarget()));
- if (oaParam.getTarget().startsWith(Constants.URN_PREFIX_CDID + "+"))
- subjectNameID.setNameQualifier(oaParam.getTarget());
- else
- subjectNameID.setNameQualifier(Constants.URN_PREFIX_CDID + "+" + oaParam.getTarget());
- }
+ if (bpktype.equals(Constants.URN_PREFIX_BASEID)) {
+ Pair<String, String> calcbPK = new BPKBuilder().generateAreaSpecificPersonIdentifier(bpk, oaParam.getAreaSpecificTargetIdentifier());
+ subjectNameID.setValue(calcbPK.getFirst());
+ subjectNameID.setNameQualifier(calcbPK.getSecond());
} else {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
index 5380d7f53..ab355646c 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
@@ -217,6 +217,9 @@ public class MOAMetadataProvider extends SimpleMOAMetadataProvider
Logger.warn("Refresh PVP2X metadata for onlineApplication: "
+ entityID + " FAILED.", e);
+ } catch (ConfigurationException e) {
+ Logger.warn("Refresh PVP2X metadata for onlineApplication: "
+ + entityID + " FAILED.", e);
}
return false;
@@ -484,13 +487,13 @@ public class MOAMetadataProvider extends SimpleMOAMetadataProvider
}
- private PVPMetadataFilterChain buildMetadataFilterChain(IOAAuthParameters oaParam, String metadataURL, byte[] certificate) throws CertificateException {
+ private PVPMetadataFilterChain buildMetadataFilterChain(IOAAuthParameters oaParam, String metadataURL, byte[] certificate) throws CertificateException, ConfigurationException {
PVPMetadataFilterChain filterChain = new PVPMetadataFilterChain(metadataURL, certificate);
filterChain.getFilters().add(new SchemaValidationFilter());
if (oaParam.isInderfederationIDP()) {
Logger.info("Online-Application is an interfederated IDP. Add addional Metadata policies");
- filterChain.getFilters().add(new InterfederatedIDPPublicServiceFilter(metadataURL, oaParam.getBusinessService()));
+ filterChain.getFilters().add(new InterfederatedIDPPublicServiceFilter(metadataURL, oaParam.hasBaseIdTransferRestriction()));
}