Merge remote-tracking branch 'remotes/origin/vidp' into moa2_0_tlenz

Conflicts:
	id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditGeneralConfigAction.java
	id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditOAAction.java
	id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
	id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java
	id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/stork/STORKConfig.java
	id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/entrypoints/DispatcherServlet.java
	id/server/idserverlib/src/main/resources/resources/properties/id_messages_de.properties
	id/server/moa-id-commons/pom.xml
	id/server/stork2-saml-engine/pom.xml
	pom.xml
	repository/iaik/iaik_tsl/1.0/iaik_tsl-1.0.jar
	repository/iaik/iaik_tsl/1.0/iaik_tsl-1.0.pom

33 files changed, 4383 insertions, 2128 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
index 1e4faed66..a8c4daad7 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
@@ -75,7 +75,6 @@ import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser;
 import at.gv.egovernment.moa.id.auth.parser.InfoboxReadResponseParser;
 import at.gv.egovernment.moa.id.auth.parser.VerifyXMLSignatureResponseParser;
 import at.gv.egovernment.moa.id.auth.servlet.PEPSConnectorServlet;
-import at.gv.egovernment.moa.id.auth.stork.VelocityProvider;
 import at.gv.egovernment.moa.id.auth.validator.CreateXMLSignatureResponseValidator;
 import at.gv.egovernment.moa.id.auth.validator.IdentityLinkValidator;
 import at.gv.egovernment.moa.id.auth.validator.InfoboxValidator;
@@ -87,7 +86,6 @@ import at.gv.egovernment.moa.id.auth.validator.parep.ParepUtils;
 import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWConstants;
 import at.gv.egovernment.moa.id.client.SZRGWClient;
 import at.gv.egovernment.moa.id.client.SZRGWClientException;
-import at.gv.egovernment.moa.id.commons.db.dao.config.IdentificationNumber;
 import at.gv.egovernment.moa.id.commons.db.dao.config.OAStorkAttribute;
 import at.gv.egovernment.moa.id.commons.db.dao.config.StorkAttribute;
 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
@@ -105,6 +103,7 @@ import at.gv.egovernment.moa.id.storage.DBExceptionStoreImpl;
 import at.gv.egovernment.moa.id.util.HTTPUtils;
 import at.gv.egovernment.moa.id.util.MOAIDMessageProvider;
 import at.gv.egovernment.moa.id.util.Random;
+import at.gv.egovernment.moa.id.util.VelocityProvider;
 import at.gv.egovernment.moa.id.util.XMLUtil;
 import at.gv.egovernment.moa.id.util.client.mis.simple.MISMandate;
 import at.gv.egovernment.moa.logging.LogMsg;
@@ -125,7 +124,7 @@ import at.gv.util.xsd.srzgw.MISType;
 import at.gv.util.xsd.srzgw.MISType.Filters;
 import eu.stork.oasisdss.api.AdditionalProfiles;
 import eu.stork.oasisdss.api.ApiUtils;
-import eu.stork.oasisdss.api.ApiUtilsException;
+import eu.stork.oasisdss.api.exceptions.ApiUtilsException;
 import eu.stork.oasisdss.api.Profiles;
 import eu.stork.oasisdss.api.QualityLevels;
 import eu.stork.oasisdss.api.SignatureTypes;
@@ -139,6 +138,11 @@ import eu.stork.peps.auth.commons.STORKAuthnRequest;
 import eu.stork.peps.auth.engine.STORKSAMLEngine;
 import eu.stork.peps.exceptions.STORKSAMLEngineException;
 
+//import java.security.cert.CertificateFactory;
+//import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.CreateIdentityLinkResponse;
+//import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWClient;
+//import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWClientException;
+
 /**
  * API for MOA ID Authentication Service.<br> {@link AuthenticationSession} is
  * stored in a session store and retrieved by giving the session ID.
@@ -149,148 +153,147 @@ import eu.stork.peps.exceptions.STORKSAMLEngineException;
  */
 public class AuthenticationServer implements MOAIDAuthConstants {
 
-	/** single instance */
-	private static AuthenticationServer instance;
-
-	/**
-	 * time out in milliseconds used by {@link cleanup} for session store
-	 */
-	private long sessionTimeOutCreated = 15 * 60  * 1000; // default 10 minutes
-	private long sessionTimeOutUpdated = 10 * 60  * 1000; // default 10 minutes
-	/**
-	 * time out in milliseconds used by {@link cleanup} for authentication data
-	 * store
-	 */
-	private long authDataTimeOut = 2 * 60  * 1000; // default 2 minutes
-
-	/**
-	 * Returns the single instance of <code>AuthenticationServer</code>.
-	 *
-	 * @return the single instance of <code>AuthenticationServer</code>
-	 */
-	public static AuthenticationServer getInstance() {
-		if (instance == null)
-			instance = new AuthenticationServer();
-		return instance;
-	}
-
-	/**
-	 * Constructor for AuthenticationServer.
-	 */
-	public AuthenticationServer() {
-		super();
-	}
-
-
-	/**
-	 * Processes the beginning of an authentication session.
-	 * <ul>
-	 * <li>Starts an authentication session</li>
-	 * <li>Creates an <code>&lt;InfoboxReadRequest&gt;</code></li>
-	 * <li>Creates an HTML form for querying the identity link from the security
-	 * layer implementation. <br>
-	 * Form parameters include
-	 * <ul>
-	 * <li>the <code>&lt;InfoboxReadRequest&gt;</code></li>
-	 * <li>the data URL where the security layer implementation sends it
-	 * response to</li>
-	 * </ul>
-	 * </ul>
-	 *
-	 * @param authURL
-	 *            URL of the servlet to be used as data URL
-	 * @param target
-	 *            "Gesch&auml;ftsbereich" of the online application requested
-	 * @param targetFriendlyName
-	 *            Friendly name of the target if the target is configured via
-	 *            configuration
-	 * @param oaURL
-	 *            online application URL requested
-	 * @param bkuURL
-	 *            URL of the "B&uuml;rgerkartenumgebung" to be used; may be
-	 *            <code>null</code>; in this case, the default location will be
-	 *            used
-	 * @param useMandate
-	 *            Indicates if mandate is used or not
-	 * @param templateURL
-	 *            URL providing an HTML template for the HTML form generated
-	 * @param templateMandteURL
-	 *            URL providing an HTML template for the HTML form generated
-	 *            (for signing in mandates mode)
-	 * @param req
-	 *            determines the protocol used
-	 * @param sourceID
-	 * @return HTML form
-	 * @throws AuthenticationException
-	 * @see GetIdentityLinkFormBuilder
-	 * @see InfoboxReadRequestBuilder
-	 */
-	public String startAuthentication(AuthenticationSession session, HttpServletRequest req) throws WrongParametersException,
-			AuthenticationException, ConfigurationException, BuildException {
-
-		if (session == null) {
-			throw new AuthenticationException("auth.18", new Object[] { });
-		}
-
-		//load OnlineApplication configuration
-	    OAAuthParameter oaParam =
-		          AuthConfigurationProvider.getInstance().getOnlineApplicationParameter(session.getPublicOAURLPrefix());
-		        if (oaParam == null)
-		          throw new AuthenticationException("auth.00", new Object[] { session.getPublicOAURLPrefix() });
-
-		//load Template
-		String template = null;
-		if (session.getTemplateURL() != null) {
-			try {
-				
-				template = new String(FileUtils.readURL(session.getTemplateURL()));
-			} catch (IOException ex) {
-				throw new AuthenticationException("auth.03", new Object[] {
-						session.getTemplateURL(), ex.toString() }, ex);
-			}
-		}
-
-		String infoboxReadRequest = "";
-
-		String domainIdentifier = AuthConfigurationProvider.getInstance().getSSOTagetIdentifier().trim();
-		if (MiscUtil.isEmpty(domainIdentifier) && session.isSsoRequested()) {
-			//do not use SSO if no Target is set
-			Log.warn("NO SSO-Target found in configuration. Single Sign-On is deaktivated!");
-			session.setSsoRequested(false);
-			
-		}
-		
-		if (session.isSsoRequested()) {
-			//load identityLink with SSO Target
-			boolean isbuisness = false;
-						
-			if (domainIdentifier.startsWith(PREFIX_WPBK)) {
-				
-				isbuisness = true;
-				
-			} else {
-				isbuisness = false;
-				
-			}
-			
-			//build ReadInfobox request
-			infoboxReadRequest = new InfoboxReadRequestBuilder().build(
-					isbuisness, domainIdentifier);
-
-		} else {
-			//build ReadInfobox request
-			infoboxReadRequest = new InfoboxReadRequestBuilder().build(
-					oaParam.getBusinessService(), oaParam
-						.getIdentityLinkDomainIdentifier());
-		}
-
-
-		String dataURL = new DataURLBuilder().buildDataURL(
-				session.getAuthURL(), REQ_VERIFY_IDENTITY_LINK, session
-						.getSessionID());
-
-		//removed in MOAID 2.0
-		String pushInfobox = "";
+    /**
+     * single instance
+     */
+    private static AuthenticationServer instance;
+
+    /**
+     * time out in milliseconds used by {@link cleanup} for session store
+     */
+    private long sessionTimeOutCreated = 15 * 60 * 1000; // default 10 minutes
+    private long sessionTimeOutUpdated = 10 * 60 * 1000; // default 10 minutes
+    /**
+     * time out in milliseconds used by {@link cleanup} for authentication data
+     * store
+     */
+    private long authDataTimeOut = 2 * 60 * 1000; // default 2 minutes
+
+    /**
+     * Returns the single instance of <code>AuthenticationServer</code>.
+     *
+     * @return the single instance of <code>AuthenticationServer</code>
+     */
+    public static AuthenticationServer getInstance() {
+        if (instance == null)
+            instance = new AuthenticationServer();
+        return instance;
+    }
+
+    /**
+     * Constructor for AuthenticationServer.
+     */
+    public AuthenticationServer() {
+        super();
+    }
+
+
+    /**
+     * Processes the beginning of an authentication session.
+     * <ul>
+     * <li>Starts an authentication session</li>
+     * <li>Creates an <code>&lt;InfoboxReadRequest&gt;</code></li>
+     * <li>Creates an HTML form for querying the identity link from the security
+     * layer implementation. <br>
+     * Form parameters include
+     * <ul>
+     * <li>the <code>&lt;InfoboxReadRequest&gt;</code></li>
+     * <li>the data URL where the security layer implementation sends it
+     * response to</li>
+     * </ul>
+     * </ul>
+     *
+     * @param authURL            URL of the servlet to be used as data URL
+     * @param target             "Gesch&auml;ftsbereich" of the online application requested
+     * @param targetFriendlyName Friendly name of the target if the target is configured via
+     *                           configuration
+     * @param oaURL              online application URL requested
+     * @param bkuURL             URL of the "B&uuml;rgerkartenumgebung" to be used; may be
+     *                           <code>null</code>; in this case, the default location will be
+     *                           used
+     * @param useMandate         Indicates if mandate is used or not
+     * @param templateURL        URL providing an HTML template for the HTML form generated
+     * @param templateMandteURL  URL providing an HTML template for the HTML form generated
+     *                           (for signing in mandates mode)
+     * @param req                determines the protocol used
+     * @param sourceID
+     * @return HTML form
+     * @throws AuthenticationException
+     * @see GetIdentityLinkFormBuilder
+     * @see InfoboxReadRequestBuilder
+     */
+    public String startAuthentication(AuthenticationSession session, HttpServletRequest req) throws WrongParametersException,
+            AuthenticationException, ConfigurationException, BuildException {
+
+        if (session == null) {
+            throw new AuthenticationException("auth.18", new Object[]{});
+        }
+
+        //load OnlineApplication configuration
+        OAAuthParameter oaParam =
+                AuthConfigurationProvider.getInstance().getOnlineApplicationParameter(session.getPublicOAURLPrefix());
+        if (oaParam == null)
+            throw new AuthenticationException("auth.00", new Object[]{session.getPublicOAURLPrefix()});
+
+        //load Template
+        String template = null;
+        if (session.getTemplateURL() != null) {
+            try {
+
+                template = new String(FileUtils.readURL(session.getTemplateURL()));
+            } catch (IOException ex) {
+                throw new AuthenticationException("auth.03", new Object[]{
+                        session.getTemplateURL(), ex.toString()}, ex);
+            }
+        }
+
+        String infoboxReadRequest = "";
+
+        String domainIdentifier = AuthConfigurationProvider.getInstance().getSSOTagetIdentifier().trim();
+        if (MiscUtil.isEmpty(domainIdentifier) && session.isSsoRequested()) {
+            //do not use SSO if no Target is set
+            Log.warn("NO SSO-Target found in configuration. Single Sign-On is deaktivated!");
+            session.setSsoRequested(false);
+
+        }
+
+        if (session.isSsoRequested()) {
+            //load identityLink with SSO Target
+            boolean isbuisness = false;
+
+            if (domainIdentifier.startsWith(PREFIX_WPBK)) {
+
+                isbuisness = true;
+
+            } else {
+                isbuisness = false;
+
+            }
+
+            //build ReadInfobox request
+            infoboxReadRequest = new InfoboxReadRequestBuilder().build(
+                    isbuisness, domainIdentifier);
+
+        } else {
+
+            if (oaParam.getStorkService())
+                // build stork request
+                infoboxReadRequest = new InfoboxReadRequestBuilder().buildStorkReadRequest(
+                        oaParam.getIdentityLinkDomainIdentifier());
+            else
+                //build ReadInfobox request
+                infoboxReadRequest = new InfoboxReadRequestBuilder().build(
+                        oaParam.getBusinessService(), oaParam
+                        .getIdentityLinkDomainIdentifier());
+        }
+
+
+        String dataURL = new DataURLBuilder().buildDataURL(
+                session.getAuthURL(), REQ_VERIFY_IDENTITY_LINK, session
+                .getSessionID());
+
+        //removed in MOAID 2.0
+        String pushInfobox = "";
 
 //		VerifyInfoboxParameters verifyInfoboxParameters = oaParam
 //				.getVerifyInfoboxParameters();
@@ -307,11 +310,11 @@ public class AuthenticationServer implements MOAIDAuthConstants {
 //				.buildDataURL(session.getAuthURL(), REQ_START_AUTHENTICATION,
 //						session.getSessionID());
 
-		//get Applet Parameters
-    	String appletwidth = req.getParameter(PARAM_APPLET_WIDTH);
-    	String appletheigth = req.getParameter(PARAM_APPLET_HEIGTH);
-    	appletheigth = StringEscapeUtils.escapeHtml(appletheigth);
-    	appletwidth = StringEscapeUtils.escapeHtml(appletwidth);
+        //get Applet Parameters
+        String appletwidth = req.getParameter(PARAM_APPLET_WIDTH);
+        String appletheigth = req.getParameter(PARAM_APPLET_HEIGTH);
+        appletheigth = StringEscapeUtils.escapeHtml(appletheigth);
+        appletwidth = StringEscapeUtils.escapeHtml(appletwidth);
 
     	
     	//TODO: cleanup before MOA-ID 2.1 release 
@@ -319,1158 +322,1120 @@ public class AuthenticationServer implements MOAIDAuthConstants {
 				session.getBkuURL(), infoboxReadRequest, dataURL, null,
 				null, pushInfobox, oaParam, appletheigth, appletwidth);
 
-		return htmlForm;
-	}
-
-	/**
-	 * Processes an <code>&lt;InfoboxReadResponse&gt;</code> sent by the
-	 * security layer implementation.<br>
-	 * <ul>
-	 * <li>Validates given <code>&lt;InfoboxReadResponse&gt;</code></li>
-	 * <li>Parses identity link enclosed in
-	 * <code>&lt;InfoboxReadResponse&gt;</code></li>
-	 * <li>Verifies identity link by calling the MOA SP component</li>
-	 * <li>Checks certificate authority of identity link</li>
-	 * <li>Stores identity link in the session</li>
-	 * <li>Verifies all additional infoboxes returned from the BKU</li>
-	 * <li>Creates an authentication block to be signed by the user</li>
-	 * <li>Creates and returns a <code>&lt;CreateXMLSignatureRequest&gt;</code>
-	 * containg the authentication block, meant to be returned to the security
-	 * layer implementation</li>
-	 * </ul>
-	 *
-	 * @param sessionID
-	 *            ID of associated authentication session data
-	 * @param infoboxReadResponseParameters
-	 *            The parameters from the response returned from the BKU
-	 *            including the <code>&lt;InfoboxReadResponse&gt;</code>
-	 * @return String representation of the
-	 *         <code>&lt;CreateXMLSignatureRequest&gt;</code>
-	 * @throws BKUException
-	 */
-	public String verifyIdentityLink(AuthenticationSession session,
-			Map<String, String> infoboxReadResponseParameters) throws AuthenticationException,
-			BuildException, ParseException, ConfigurationException,
-			ValidateException, ServiceException, BKUException {
-
-		if (session == null)
-			throw new AuthenticationException("auth.10", new Object[] {
-					REQ_VERIFY_IDENTITY_LINK, PARAM_SESSIONID });
-
-		String xmlInfoboxReadResponse = (String) infoboxReadResponseParameters
-				.get(PARAM_XMLRESPONSE);
-
-		if (isEmpty(xmlInfoboxReadResponse))
-			throw new AuthenticationException("auth.10", new Object[] {
-					REQ_VERIFY_IDENTITY_LINK, PARAM_XMLRESPONSE });
-
-		AuthConfigurationProvider authConf = AuthConfigurationProvider
-				.getInstance();
-
-		// check if an identity link was found
-		// Errorcode 2911 von Trustdesk BKU (nicht spezifikationskonform
-		// (SL1.2))
-		// CharSequence se = "ErrorCode>2911".substring(0);
-		// boolean b = xmlInfoboxReadResponse.contains(se);
-		String se = "ErrorCode>2911";
-		int b = xmlInfoboxReadResponse.indexOf(se);
-		if (b != -1) { // no identity link found
-			Logger
-					.info("Es konnte keine Personenbindung auf der Karte gefunden werden. Versuche Anmeldung als auslaendische eID.");
-			return null;
-		}
-		// spezifikationsgemaess (SL1.2) Errorcode
-		se = "ErrorCode>4002";
-		// b = xmlInfoboxReadResponse.contains(se);
-		b = xmlInfoboxReadResponse.indexOf(se);
-		if (b != -1) { // Unbekannter Infoboxbezeichner
-			Logger
-					.info("Unbekannter Infoboxbezeichner. Versuche Anmeldung als auslaendische eID.");
-			return null;
-		}
-
-		// parses the <InfoboxReadResponse>
-		IdentityLink identityLink = new InfoboxReadResponseParser(
-				xmlInfoboxReadResponse).parseIdentityLink();
-		// validates the identity link
-		IdentityLinkValidator.getInstance().validate(identityLink);
-		// builds a <VerifyXMLSignatureRequest> for a call of MOA-SP
-		Element domVerifyXMLSignatureRequest = new VerifyXMLSignatureRequestBuilder()
-				.build(identityLink, authConf
-						.getMoaSpIdentityLinkTrustProfileID());
-
-		// invokes the call
-		Element domVerifyXMLSignatureResponse = new SignatureVerificationInvoker()
-				.verifyXMLSignature(domVerifyXMLSignatureRequest);
-		// parses the <VerifyXMLSignatureResponse>
-		VerifyXMLSignatureResponse verifyXMLSignatureResponse = new VerifyXMLSignatureResponseParser(
-				domVerifyXMLSignatureResponse).parseData();
-
-		OAAuthParameter oaParam = AuthConfigurationProvider.getInstance()
-				.getOnlineApplicationParameter(session.getPublicOAURLPrefix());
-
-		// if OA is type is business service the manifest validation result has
-		// to be ignored
-		boolean ignoreManifestValidationResult = oaParam.getBusinessService() ? true
-				: false;
-
-		// validates the <VerifyXMLSignatureResponse>
-		VerifyXMLSignatureResponseValidator.getInstance().validate(
-				verifyXMLSignatureResponse,
-				authConf.getIdentityLinkX509SubjectNames(),
-				VerifyXMLSignatureResponseValidator.CHECK_IDENTITY_LINK,
-				ignoreManifestValidationResult);
-
-		session.setIdentityLink(identityLink);
-		// now validate the extended infoboxes
-
-		//Removed in MOA-ID 2.0
-		//verifyInfoboxes(session, infoboxReadResponseParameters, false);
-
-		return "found!";
-	}
-
-	/**
-	 * Processes an <code>&lt;InfoboxReadResponse&gt;</code> sent by the
-	 * security layer implementation.<br>
-	 * <ul>
-	 * <li>Validates given <code>&lt;InfoboxReadResponse&gt;</code></li>
-	 * <li>Parses identity link enclosed in
-	 * <code>&lt;InfoboxReadResponse&gt;</code></li>
-	 * <li>Verifies identity link by calling the MOA SP component</li>
-	 * <li>Checks certificate authority of identity link</li>
-	 * <li>Stores identity link in the session</li>
-	 * <li>Verifies all additional infoboxes returned from the BKU</li>
-	 * <li>Creates an authentication block to be signed by the user</li>
-	 * <li>Creates and returns a <code>&lt;CreateXMLSignatureRequest&gt;</code>
-	 * containg the authentication block, meant to be returned to the security
-	 * layer implementation</li>
-	 * </ul>
-	 *
-	 * @param sessionID
-	 *            ID of associated authentication session data
-	 * @param infoboxReadResponseParameters
-	 *            The parameters from the response returned from the BKU
-	 *            including the <code>&lt;InfoboxReadResponse&gt;</code>
-	 * @return String representation of the
-	 *         <code>&lt;CreateXMLSignatureRequest&gt;</code>
-	 */
-	public String verifyCertificate(AuthenticationSession session,
-			X509Certificate certificate) throws AuthenticationException,
-			BuildException, ParseException, ConfigurationException,
-			ValidateException, ServiceException, MOAIDException{
-
-		if (session == null)
-			throw new AuthenticationException("auth.10", new Object[] {
-					REQ_VERIFY_CERTIFICATE, PARAM_SESSIONID });
-
-		// check if person is a Organwalter
-		// if true - don't show bPK in AUTH Block
-		try {
-			for (ObjectID OWid : MOAIDAuthConstants.OW_LIST) {
-				if (certificate.getExtension(OWid) != null) {
-					session.setOW(true);
-				}
-
-			}
-
-		} catch (X509ExtensionInitException e) {
-			Logger.warn("Certificate extension is not readable.");
-			session.setOW(false);
-		}
-
-		AuthConfigurationProvider authConf = AuthConfigurationProvider
-				.getInstance();
-
-		OAAuthParameter oaParam = AuthConfigurationProvider.getInstance()
-				.getOnlineApplicationParameter(session.getPublicOAURLPrefix());
-
-		String returnvalue = getCreateXMLSignatureRequestAuthBlockOrRedirect(session,
-				authConf, oaParam);
-
-		return returnvalue;
-	}
-
-	/**
-	 * Processes an <code>Mandate</code> sent by the MIS.<br>
-	 * <ul>
-	 * <li>Validates given <code>Mandate</code></li>
-	 * <li>Verifies Mandate by calling the MOA SP component</li>
-	 * <li>Creates an authentication block to be signed by the user</li>
-	 * <li>Creates and returns a <code>&lt;CreateXMLSignatureRequest&gt;</code>
-	 * containg the authentication block, meant to be returned to the security
-	 * layer implementation</li>
-	 * </ul>
-	 *
-	 * @param sessionID
-	 *            ID of associated authentication session data
-	 * @param infoboxReadResponseParameters
-	 *            The parameters from the response returned from the BKU
-	 *            including the <code>&lt;InfoboxReadResponse&gt;</code>
-	 * @return String representation of the
-	 *         <code>&lt;CreateXMLSignatureRequest&gt;</code>
-	 */
-	public void verifyMandate(AuthenticationSession session, MISMandate mandate)
-			throws AuthenticationException, BuildException, ParseException,
-			ConfigurationException, ValidateException, ServiceException {
-
-		if (session == null)
-			throw new AuthenticationException("auth.10", new Object[] {
-					GET_MIS_SESSIONID, PARAM_SESSIONID });
-
-		OAAuthParameter oaParam = AuthConfigurationProvider.getInstance()
-				.getOnlineApplicationParameter(session.getPublicOAURLPrefix());
-
-		try {
-			// sets the extended SAML attributes for OID (Organwalter)
-			setExtendedSAMLAttributeForMandatesOID(session, mandate, oaParam
-					.getBusinessService());
-
-			validateExtendedSAMLAttributeForMandates(session, mandate, oaParam.getBusinessService());
-
-
-		} catch (SAXException e) {
-			throw new AuthenticationException("auth.16",
-					new Object[] { GET_MIS_SESSIONID }, e);
-		} catch (IOException e) {
-			throw new AuthenticationException("auth.16",
-					new Object[] { GET_MIS_SESSIONID }, e);
-		} catch (ParserConfigurationException e) {
-			throw new AuthenticationException("auth.16",
-					new Object[] { GET_MIS_SESSIONID }, e);
-		} catch (TransformerException e) {
-			throw new AuthenticationException("auth.16",
-					new Object[] { GET_MIS_SESSIONID }, e);
-		}
-
-	}
-
-	/**
-	 *
-	 * @param session
-	 * @param authConf
-	 * @param oaParam
-	 * @return
-	 * @throws ConfigurationException
-	 * @throws BuildException
-	 * @throws ValidateException
-	 */
-	public String getCreateXMLSignatureRequestAuthBlockOrRedirect(
-			AuthenticationSession session, AuthConfigurationProvider authConf,
-			OAAuthParameter oaParam) throws ConfigurationException,
-			BuildException, ValidateException {
-
-		// check for intermediate processing of the infoboxes
-		if (session.isValidatorInputPending())
-			return "Redirect to Input Processor";
-
-		if (authConf == null)
-			authConf = AuthConfigurationProvider.getInstance();
-		if (oaParam == null)
-			oaParam = AuthConfigurationProvider.getInstance()
-					.getOnlineApplicationParameter(
-							session.getPublicOAURLPrefix());
-
-		// builds the AUTH-block
-	String authBlock = buildAuthenticationBlock(session, oaParam);
-
-		// builds the <CreateXMLSignatureRequest>
-		List<String> transformsInfos = oaParam.getTransformsInfos();
-		if ((transformsInfos == null) || (transformsInfos.size() == 0)) {
-			// no OA specific transforms specified, use default ones
-			transformsInfos = authConf.getTransformsInfos();
-		}
-		String createXMLSignatureRequest = new CreateXMLSignatureRequestBuilder()
-				.build(authBlock, oaParam.getKeyBoxIdentifier(),
-						transformsInfos);
-		return createXMLSignatureRequest;
-	}
-
-	/**
-	 * Returns an CreateXMLSignatureRequest for signing the ERnP statement.<br>
-	 * <ul>
-	 * <li>Creates an CreateXMLSignatureRequest to be signed by the user</li>
-	 * </ul>
-	 *
-	 * @param sessionID
-	 *            ID of associated authentication session data
-	 * @param cert
-	 *            The certificate from the user
-	 * @return String representation of the
-	 *         <code>&lt;CreateXMLSignatureRequest&gt;</code>
-	 */
-	public String createXMLSignatureRequestForeignID(AuthenticationSession session,
-			X509Certificate cert) throws AuthenticationException,
-			BuildException, ParseException, ConfigurationException,
-			ValidateException, ServiceException {
-
-		if (session == null)
-			throw new AuthenticationException("auth.10", new Object[] {
-					REQ_VERIFY_CERTIFICATE, PARAM_SESSIONID });
-
-		AuthConfigurationProvider authConf = AuthConfigurationProvider
-				.getInstance();
-
-		OAAuthParameter oaParam = AuthConfigurationProvider.getInstance()
-				.getOnlineApplicationParameter(session.getPublicOAURLPrefix());
-
-		return getCreateXMLSignatureRequestForeigID(session, authConf, oaParam,
-				cert);
-	}
-
-	public String getCreateXMLSignatureRequestForeigID(
-			AuthenticationSession session, AuthConfigurationProvider authConf,
-			OAAuthParameter oaParam, X509Certificate cert)
-			throws ConfigurationException {
-
-		// check for intermediate processing of the infoboxes
-		if (session.isValidatorInputPending())
-			return "Redirect to Input Processor";
-
-		if (authConf == null)
-			authConf = AuthConfigurationProvider.getInstance();
-		if (oaParam == null)
-			oaParam = AuthConfigurationProvider.getInstance()
-					.getOnlineApplicationParameter(
-							session.getPublicOAURLPrefix());
-
-		Principal subject = cert.getSubjectDN();
-
-		String createXMLSignatureRequest = new CreateXMLSignatureRequestBuilder()
-				.buildForeignID(subject.toString(), oaParam, session);
-		return createXMLSignatureRequest;
-	}
-
-	/**
-	 * Processes an <code>&lt;CreateXMLSignatureResponse&gt;</code> sent by the
-	 * security layer implementation.<br>
-	 * <ul>
-	 * <li>Validates given <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
-	 * <li>Parses response enclosed in
-	 * <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
-	 * <li>Verifies signature by calling the MOA SP component</li>
-	 * <li>Returns the signer certificate</li>
-	 * </ul>
-	 *
-	 * @param sessionID
-	 *            ID of associated authentication session data
-	 * @param createXMLSignatureResponseParameters
-	 *            The parameters from the response returned from the BKU
-	 *            including the <code>&lt;CreateXMLSignatureResponse&gt;</code>
-	 * @throws BKUException
-	 */
-	public X509Certificate verifyXMLSignature(String sessionID,
-			Map<String, String> createXMLSignatureResponseParameters)
-			throws AuthenticationException, BuildException, ParseException,
-			ConfigurationException, ValidateException, ServiceException, BKUException {
-
-		if (isEmpty(sessionID))
-			throw new AuthenticationException("auth.10", new Object[] {
-					REQ_GET_FOREIGN_ID, PARAM_SESSIONID });
-
-		String xmlCreateXMLSignatureResponse = (String) createXMLSignatureResponseParameters
-				.get(PARAM_XMLRESPONSE);
-
-		if (isEmpty(xmlCreateXMLSignatureResponse))
-			throw new AuthenticationException("auth.10", new Object[] {
-					REQ_GET_FOREIGN_ID, PARAM_XMLRESPONSE });
-
-		AuthConfigurationProvider authConf = AuthConfigurationProvider
-				.getInstance();
-
-		// parses the <CreateXMLSignatureResponse>
-		CreateXMLSignatureResponseParser p = new CreateXMLSignatureResponseParser(
-				xmlCreateXMLSignatureResponse);
-		CreateXMLSignatureResponse createXMLSignatureResponse = p
-				.parseResponseDsig();
-
-		// builds a <VerifyXMLSignatureRequest> for a call of MOA-SP
-		Element domVerifyXMLSignatureRequest = new VerifyXMLSignatureRequestBuilder()
-				.buildDsig(createXMLSignatureResponse, authConf
-						.getMoaSpAuthBlockTrustProfileID());
-
-		// invokes the call
-		Element domVerifyXMLSignatureResponse = new SignatureVerificationInvoker()
-				.verifyXMLSignature(domVerifyXMLSignatureRequest);
-
-		// parses the <VerifyXMLSignatureResponse>
-		VerifyXMLSignatureResponse verifyXMLSignatureResponse = new VerifyXMLSignatureResponseParser(
-				domVerifyXMLSignatureResponse).parseData();
-
-		return verifyXMLSignatureResponse.getX509certificate();
-
-	}
-
-	/**
-	 * Processes an <code>&lt;CreateXMLSignatureResponse&gt;</code> sent by the
-	 * security layer implementation.<br>
-	 * <ul>
-	 * <li>Validates given <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
-	 * <li>Parses response enclosed in
-	 * <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
-	 * <li>Verifies signature by calling the MOA SP component</li>
-	 * <li>Returns the signer certificate</li>
-	 * </ul>
-	 *
-	 * @param sessionID
-	 *            ID of associated authentication session data
-	 * @param readInfoboxResponseParameters
-	 *            The parameters from the response returned from the BKU
-	 *            including the <code>&lt;ReadInfoboxResponse&gt;</code>
-	 * @throws BKUException
-	 */
-	public X509Certificate getCertificate(String sessionID,
-			Map<String, String> readInfoboxResponseParameters) throws AuthenticationException,
-			BuildException, ParseException, ConfigurationException,
-			ValidateException, ServiceException, BKUException {
-
-		if (isEmpty(sessionID))
-			throw new AuthenticationException("auth.10", new Object[] {
-					REQ_VERIFY_CERTIFICATE, PARAM_SESSIONID });
-
-		String xmlReadInfoboxResponse = (String) readInfoboxResponseParameters
-				.get(PARAM_XMLRESPONSE);
-
-		if (isEmpty(xmlReadInfoboxResponse))
-			throw new AuthenticationException("auth.10", new Object[] {
-					REQ_VERIFY_CERTIFICATE, PARAM_XMLRESPONSE });
-
-		// parses the <CreateXMLSignatureResponse>
-		InfoboxReadResponseParser p = new InfoboxReadResponseParser(
-				xmlReadInfoboxResponse);
-		X509Certificate cert = p.parseCertificate();
-
-		return cert;
-
-	}
-
-	/**
-	 * Builds an authentication block <code>&lt;saml:Assertion&gt;</code> from
-	 * given session data.
-	 *
-	 * @param session
-	 *            authentication session
-	 *
-	 * @return <code>&lt;saml:Assertion&gt;</code> as a String
-	 *
-	 * @throws BuildException
-	 *             If an error occurs on serializing an extended SAML attribute
-	 *             to be appended to the AUTH-Block.
-	 */
-	private String buildAuthenticationBlock(AuthenticationSession session,
-			OAAuthParameter oaParam) throws BuildException {
-
-		IdentityLink identityLink = session.getIdentityLink();
-		String issuer = identityLink.getName();
-		String gebDat = identityLink.getDateOfBirth();
-
-		String identificationValue = null;
-		String identificationType = null;
-
-		//set empty AuthBlock BPK in case of OW or SSO or bpk is not requested
-		if (session.isOW() || session.isSsoRequested() || oaParam.isRemovePBKFromAuthBlock()) {
-			identificationType = "";
-			identificationValue = "";
-
-		} else if (identityLink.getIdentificationType().equals(Constants.URN_PREFIX_BASEID)) {
-
-			if (oaParam.getBusinessService()) {
-
-				String bpkBase64 = new BPKBuilder().buildWBPK(identityLink
-							.getIdentificationValue(), oaParam.getIdentityLinkDomainIdentifier());
-				identificationValue = bpkBase64;
-
-			    if (oaParam.getIdentityLinkDomainIdentifier().startsWith(Constants.URN_PREFIX_WBPK + "+" ))
-			    	identificationType = oaParam.getIdentityLinkDomainIdentifier();
-			    else
-			    	identificationType = Constants.URN_PREFIX_WBPK + "+" + oaParam.getIdentityLinkDomainIdentifier();
-
-			} else {
-				String bpkBase64 = new BPKBuilder().buildBPK(identityLink
-							.getIdentificationValue(), session.getTarget());
-				identificationValue = bpkBase64;
-				identificationType = Constants.URN_PREFIX_CDID + "+" + session.getTarget();
-			}
-
-
-		} else {
-			identificationValue = identityLink.getIdentificationValue();
-			identificationType = identityLink.getIdentificationType();
-
-		}
-
-		String issueInstant = DateTimeUtils.buildDateTimeUTC(Calendar
-				.getInstance());
-		session.setIssueInstant(issueInstant);
-		String authURL = session.getAuthURL();
-		String target = session.getTarget();
-		String targetFriendlyName = session.getTargetFriendlyName();
-
-		// Bug #485
-		// (https://egovlabs.gv.at/tracker/index.php?func=detail&aid=485&group_id=6&atid=105)
-		// String oaURL = session.getPublicOAURLPrefix();
-
-		List<ExtendedSAMLAttribute> extendedSAMLAttributes = session.getExtendedSAMLAttributesAUTH();
-
-
-		if (session.isSsoRequested()) {
-			String oaURL = new String();
-			try {
-				oaURL = AuthConfigurationProvider.getInstance().getPublicURLPrefix();
-
-				if (MiscUtil.isNotEmpty(oaURL))
-					oaURL = oaURL.replaceAll("&", "&amp;");
-
-			} catch (ConfigurationException e) {
-			}
-			String authBlock = new AuthenticationBlockAssertionBuilder()
-				.buildAuthBlockSSO(issuer, issueInstant, authURL, target,
-						targetFriendlyName, identificationValue,
-						identificationType, oaURL, gebDat,
-						extendedSAMLAttributes, session, oaParam);
-			return authBlock;
-
-		} else {
-			String oaURL = session.getPublicOAURLPrefix().replaceAll("&", "&amp;");
-			String authBlock = new AuthenticationBlockAssertionBuilder()
-				.buildAuthBlock(issuer, issueInstant, authURL, target,
-						targetFriendlyName, identificationValue,
-						identificationType, oaURL, gebDat,
-						extendedSAMLAttributes, session, oaParam);
-			return authBlock;
-		}
-	}
-
-
-
-	/**
-	 * Verifies the infoboxes (except of the identity link infobox) returned by
-	 * the BKU by calling appropriate validator classes.
-	 *
-	 * @param session
-	 *            The actual authentication session.
-	 * @param mandate
-	 *            The Mandate from the MIS
-	 *
-	 * @throws AuthenticationException
-	 * @throws ConfigurationException
-	 * @throws TransformerException
-	 * @throws ParserConfigurationException
-	 * @throws IOException
-	 * @throws SAXException
-	 */
-	private void validateExtendedSAMLAttributeForMandates(
-			AuthenticationSession session, MISMandate mandate,
-			boolean business)
-			throws ValidateException, ConfigurationException, SAXException,
-			IOException, ParserConfigurationException, TransformerException {
-
-		ExtendedSAMLAttribute[] extendedSAMLAttributes = addExtendedSamlAttributes(
-				mandate, business, false);
-
-		int length = extendedSAMLAttributes.length;
-		for (int i = 0; i < length; i++) {
-			ExtendedSAMLAttribute samlAttribute = extendedSAMLAttributes[i];
-
-			verifySAMLAttribute(samlAttribute, i, "MISService",
-					"MISService");
-
-		}
-	}
-
-	/**
-	 * Verifies the infoboxes (except of the identity link infobox) returned by
-	 * the BKU by calling appropriate validator classes.
-	 *
-	 * @param session
-	 *            The actual authentication session.
-	 * @param mandate
-	 *            The Mandate from the MIS
-	 *
-	 * @throws AuthenticationException
-	 * @throws ConfigurationException
-	 * @throws TransformerException
-	 * @throws ParserConfigurationException
-	 * @throws IOException
-	 * @throws SAXException
-	 */
-	private void setExtendedSAMLAttributeForMandatesOID(
-			AuthenticationSession session, MISMandate mandate, boolean business)
-			throws ValidateException, ConfigurationException, SAXException,
-			IOException, ParserConfigurationException, TransformerException {
-
-		ExtendedSAMLAttribute[] extendedSamlAttributes = addExtendedSamlAttributesOID(
-				mandate, business);
-
-		AddAdditionalSAMLAttributes(session, extendedSamlAttributes,
-				"MISService", "MISService");
-
-	}
-
-	/**
-	 * Adds given SAML Attributes to the current session. They will be appended
-	 * to the final SAML Assertion or the AUTH block. If the attributes are
-	 * already in the list, they will be replaced.
-	 *
-	 * @param session
-	 *            The current session
-	 * @param extendedSAMLAttributes
-	 *            The SAML attributes to add
-	 * @param identifier
-	 *            The infobox identifier for debug purposes
-	 * @param friendlyNam
-	 *            The friendly name of the infobox for debug purposes
-	 */
-	private static void AddAdditionalSAMLAttributes(
-			AuthenticationSession session,
-			ExtendedSAMLAttribute[] extendedSAMLAttributes, String identifier,
-			String friendlyName) throws ValidateException {
-		if (extendedSAMLAttributes == null)
-			return;
-		List<ExtendedSAMLAttribute> oaAttributes = session.getExtendedSAMLAttributesOA();
-		if (oaAttributes == null)
-			oaAttributes = new Vector<ExtendedSAMLAttribute>();
-		List<ExtendedSAMLAttribute> authAttributes = session.getExtendedSAMLAttributesAUTH();
-		if (authAttributes == null)
-			authAttributes = new Vector<ExtendedSAMLAttribute>();
-		int length = extendedSAMLAttributes.length;
-		for (int i = 0; i < length; i++) {
-			ExtendedSAMLAttribute samlAttribute = extendedSAMLAttributes[i];
-
-			Object value = verifySAMLAttribute(samlAttribute, i, identifier,
-					friendlyName);
-
-			if ((value instanceof String) || (value instanceof Element)) {
-				switch (samlAttribute.getAddToAUTHBlock()) {
-				case ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY:
-					replaceExtendedSAMLAttribute(authAttributes, samlAttribute);
-					break;
-				case ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK:
-					replaceExtendedSAMLAttribute(authAttributes, samlAttribute);
-					replaceExtendedSAMLAttribute(oaAttributes, samlAttribute);
-					break;
-				case ExtendedSAMLAttribute.NOT_ADD_TO_AUTHBLOCK:
-					replaceExtendedSAMLAttribute(oaAttributes, samlAttribute);
-					break;
-				default:
-					Logger
-							.info("Invalid return value from method \"getAddToAUTHBlock()\" ("
-									+ samlAttribute.getAddToAUTHBlock()
-									+ ") in SAML attribute number "
-									+ (i + 1)
-									+ " for infobox " + identifier);
-					throw new ValidateException("validator.47", new Object[] {
-							friendlyName, String.valueOf((i + 1)) });
-				}
-			} else {
-				Logger
-						.info("The type of SAML-Attribute number "
-								+ (i + 1)
-								+ " returned from "
-								+ identifier
-								+ "-infobox validator is not valid. Must be either \"java.Lang.String\""
-								+ " or \"org.w3c.dom.Element\"");
-				throw new ValidateException("validator.46", new Object[] {
-						identifier, String.valueOf((i + 1)) });
-			}
-		}
-		session.setExtendedSAMLAttributesAUTH(authAttributes);
-		session.setExtendedSAMLAttributesOA(oaAttributes);
-	}
-
-	/**
-	 * Adds the AUTH block related SAML attributes to the validation result.
-	 * This is needed always before the AUTH block is to be signed, because the
-	 * name of the mandator has to be set
-	 *
-	 * @throws ParserConfigurationException
-	 * @throws IOException
-	 * @throws SAXException
-	 * @throws TransformerException
-	 */
-
-	protected static ExtendedSAMLAttribute[] addExtendedSamlAttributes(
-			MISMandate mandate, boolean business, boolean provideStammzahl)
-			throws SAXException, IOException, ParserConfigurationException,
-			TransformerException {
-		Vector<ExtendedSAMLAttribute> extendedSamlAttributes = new Vector<ExtendedSAMLAttribute>();
-
-		extendedSamlAttributes.clear();
-
-		// Name
-		Element domMandate = mandateToElement(mandate);
-		Element nameSpaceNode = domMandate.getOwnerDocument().createElement(
-				"NameSpaceNode");
-		nameSpaceNode.setAttribute("xmlns" + SZRGWConstants.PD_POSTFIX,
-				Constants.PD_NS_URI);
-		nameSpaceNode.setAttribute("xmlns" + SZRGWConstants.MANDATE_POSTFIX,
-				SZRGWConstants.MANDATE_NS);
-
-		Element mandator = (Element) XPathAPI.selectSingleNode(domMandate,
-				"//md:Mandate/md:Mandator", nameSpaceNode);
-
-		// Mandate
-		extendedSamlAttributes.add(new ExtendedSAMLAttributeImpl(
-				EXT_SAML_MANDATE_RAW, domMandate,
-				SZRGWConstants.MANDATE_NS,
-				ExtendedSAMLAttribute.NOT_ADD_TO_AUTHBLOCK));
-
-		// (w)bpk
-		String wbpk = ParepUtils.extractMandatorWbpk(mandator);
-		if (!ParepUtils.isEmpty(wbpk)) {
-			if (!ParepUtils.isPhysicalPerson(mandator)) {
-				String idType = ParepUtils
-						.extractMandatorIdentificationType(mandator);
-				if (!ParepUtils.isEmpty(idType)
-						&& idType.startsWith(Constants.URN_PREFIX_BASEID)) {
-					extendedSamlAttributes.add(new ExtendedSAMLAttributeImpl(
-							EXT_SAML_MANDATE_CB_BASE_ID,
-							ParepUtils.getRegisterString(idType) + ": " + wbpk,
-							SZRGWConstants.MANDATE_NS,
-							ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY));
-				}
-			} else if (business) {
-				extendedSamlAttributes.add(new ExtendedSAMLAttributeImpl(
-						EXT_SAML_MANDATE_WBPK, wbpk,
-						SZRGWConstants.MANDATE_NS,
-						ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY));
-			}
-		}
-
-		ExtendedSAMLAttribute[] ret = new ExtendedSAMLAttribute[extendedSamlAttributes
-				.size()];
-		extendedSamlAttributes.copyInto(ret);
-		Logger.debug("ExtendedSAML Attributes: " + ret.length);
-		return ret;
-
-	}
-
-	/**
-	 * Adds the AUTH block related SAML attributes to the validation result.
-	 * This is needed always before the AUTH block is to be signed, because the
-	 * name of the mandator has to be set
-	 *
-	 * @throws ParserConfigurationException
-	 * @throws IOException
-	 * @throws SAXException
-	 * @throws TransformerException
-	 */
-	private static ExtendedSAMLAttribute[] addExtendedSamlAttributesOID(
-			MISMandate mandate, boolean business) throws SAXException,
-			IOException, ParserConfigurationException, TransformerException {
-
-		Vector<ExtendedSAMLAttribute> extendedSamlAttributes = new Vector<ExtendedSAMLAttribute>();
-
-		extendedSamlAttributes.clear();
-
-		// RepresentationType
-		extendedSamlAttributes.add(new ExtendedSAMLAttributeImpl(
-				EXT_SAML_MANDATE_REPRESENTATIONTYPE,
-				EXT_SAML_MANDATE_REPRESENTATIONTEXT,
-				SZRGWConstants.MANDATE_NS,
-				ExtendedSAMLAttribute.NOT_ADD_TO_AUTHBLOCK));
-
-		String oid = mandate.getProfRep();
-
-		if (oid != null) {
-			extendedSamlAttributes.add(new ExtendedSAMLAttributeImpl(
-					EXT_SAML_MANDATE_OID, oid,
-					SZRGWConstants.MANDATE_NS,
-					ExtendedSAMLAttribute.NOT_ADD_TO_AUTHBLOCK));
-			String oidDescription = mandate.getTextualDescriptionOfOID();
-			extendedSamlAttributes.add(new ExtendedSAMLAttributeImpl(
-					EXT_SAML_MANDATE_OIDTEXTUALDESCRIPTION,
-					oidDescription, SZRGWConstants.MANDATE_NS,
-					ExtendedSAMLAttribute.NOT_ADD_TO_AUTHBLOCK));
-
-		}
-
-		ExtendedSAMLAttribute[] ret = new ExtendedSAMLAttribute[extendedSamlAttributes
-				.size()];
-		extendedSamlAttributes.copyInto(ret);
-		Logger.debug("ExtendedSAML Attributes: " + ret.length);
-		return ret;
-
-	}
-
-	/**
-	 *
-	 * @param mandate
-	 * @return
-	 * @throws ParserConfigurationException
-	 * @throws IOException
-	 * @throws SAXException
-	 */
-	private static Element mandateToElement(MISMandate mandate)
-			throws SAXException, IOException, ParserConfigurationException {
-		ByteArrayInputStream bais = new ByteArrayInputStream(mandate
-				.getMandate());
-		Document doc = DOMUtils.parseDocumentSimple(bais);
-		return doc.getDocumentElement();
-	}
-
-	protected static void replaceExtendedSAMLAttribute(List<ExtendedSAMLAttribute> attributes,
-			ExtendedSAMLAttribute samlAttribute) {
-		if (null == attributes) {
-			attributes = new Vector<ExtendedSAMLAttribute>();
-		} else {
-			String id = samlAttribute.getName();
-			int length = attributes.size();
-			for (int i = 0; i < length; i++) {
-				ExtendedSAMLAttribute att = (ExtendedSAMLAttribute) attributes
-						.get(i);
-				if (id.equals(att.getName())) {
-					// replace attribute
-					attributes.set(i, samlAttribute);
-					return;
-				}
-			}
-			attributes.add(samlAttribute);
-		}
-	}
-
-	/**
-	 * Processes a <code>&lt;CreateXMLSignatureResponse&gt;</code> sent by the
-	 * security layer implementation.<br>
-	 * <ul>
-	 * <li>Validates given <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
-	 * <li>Parses <code>&lt;CreateXMLSignatureResponse&gt;</code> for error
-	 * codes</li>
-	 * <li>Parses authentication block enclosed in
-	 * <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
-	 * <li>Verifies authentication block by calling the MOA SP component</li>
-	 * <li>Creates authentication data</li>
-	 * <li>Creates a corresponding SAML artifact</li>
-	 * <li>Stores authentication data in the authentication data store indexed
-	 * by the SAML artifact</li>
-	 * <li>Deletes authentication session</li>
-	 * <li>Returns the SAML artifact, encoded BASE64</li>
-	 * </ul>
-	 *
-	 * @param sessionID
-	 *            session ID of the running authentication session
-	 * @param xmlCreateXMLSignatureReadResponse
-	 *            String representation of the
-	 *            <code>&lt;CreateXMLSignatureResponse&gt;</code>
-	 * @return SAML artifact needed for retrieving authentication data, encoded
-	 *         BASE64
-	 * @throws BKUException
-	 */
-	public String verifyAuthenticationBlock(AuthenticationSession session,
-			String xmlCreateXMLSignatureReadResponse)
-			throws AuthenticationException, BuildException, ParseException,
-			ConfigurationException, ServiceException, ValidateException, BKUException {
-
-		if (session == null)
-			throw new AuthenticationException("auth.10", new Object[] {
-					REQ_VERIFY_AUTH_BLOCK, PARAM_SESSIONID });
-		if (isEmpty(xmlCreateXMLSignatureReadResponse))
-			throw new AuthenticationException("auth.10", new Object[] {
-					REQ_VERIFY_AUTH_BLOCK, PARAM_XMLRESPONSE });
-
-		AuthConfigurationProvider authConf = AuthConfigurationProvider
-				.getInstance();
-		// parses <CreateXMLSignatureResponse>
-		CreateXMLSignatureResponse csresp = new CreateXMLSignatureResponseParser(
-				xmlCreateXMLSignatureReadResponse).parseResponse();
-
-		try {
-			String serializedAssertion = DOMUtils.serializeNode(csresp
-					.getSamlAssertion());
-			session.setAuthBlock(serializedAssertion);
-		} catch (TransformerException e) {
-			throw new ParseException("parser.04", new Object[] {
-					REQ_VERIFY_AUTH_BLOCK, PARAM_XMLRESPONSE });
-		} catch (IOException e) {
-			throw new ParseException("parser.04", new Object[] {
-					REQ_VERIFY_AUTH_BLOCK, PARAM_XMLRESPONSE });
-		}
-		// validates <CreateXMLSignatureResponse>
-		if (session.isSsoRequested())
-			new CreateXMLSignatureResponseValidator().validateSSO(csresp, session);
-		else
-			new CreateXMLSignatureResponseValidator().validate(csresp, session);
-
-		// builds a <VerifyXMLSignatureRequest> for a MOA-SPSS call
-		List<String> vtids = authConf.getMoaSpAuthBlockVerifyTransformsInfoIDs();
-		String tpid = authConf.getMoaSpAuthBlockTrustProfileID();
-		Element domVsreq = new VerifyXMLSignatureRequestBuilder().build(csresp,
-				vtids, tpid);
-		// debug output
-
-		// invokes the call
-		Element domVsresp = new SignatureVerificationInvoker()
-				.verifyXMLSignature(domVsreq);
-		// debug output
-
-		// parses the <VerifyXMLSignatureResponse>
-		VerifyXMLSignatureResponse vsresp = new VerifyXMLSignatureResponseParser(
-				domVsresp).parseData();
-
-		if (Logger.isTraceEnabled()) {
-			if (domVsresp != null) {
-				try {
-					String xmlVerifyXMLSignatureResponse = DOMUtils
-							.serializeNode(domVsresp, true);
-					Logger.trace(new LogMsg(xmlCreateXMLSignatureReadResponse));
-					Logger.trace(new LogMsg(xmlVerifyXMLSignatureResponse));
-				} catch (Throwable t) {
-					t.printStackTrace();
-					Logger.info(new LogMsg(t.getStackTrace()));
-				}
-			}
-		}
-
-		// validates the <VerifyXMLSignatureResponse>
-		VerifyXMLSignatureResponseValidator.getInstance().validate(vsresp,
-				null, VerifyXMLSignatureResponseValidator.CHECK_AUTH_BLOCK,
-				false);
-
-		// Compare AuthBlock Data with information stored in session, especially
-		// date and time
-		CreateXMLSignatureResponseValidator.getInstance().validateSigningDateTime(csresp);
-
-		// compares the public keys from the identityLink with the AuthBlock
-		VerifyXMLSignatureResponseValidator.getInstance().validateCertificate(
-				vsresp, session.getIdentityLink());
-
-		// post processing of the infoboxes
-		Iterator iter = session.getInfoboxValidatorIterator();
-		boolean formpending = false;
-		if (iter != null) {
-			while (!formpending && iter.hasNext()) {
-				Vector infoboxValidatorVector = (Vector) iter.next();
-				String identifier = (String) infoboxValidatorVector.get(0);
-				String friendlyName = (String) infoboxValidatorVector.get(1);
-				InfoboxValidator infoboxvalidator = (InfoboxValidator) infoboxValidatorVector
-						.get(2);
-				InfoboxValidationResult infoboxValidationResult = null;
-				try {
-					infoboxValidationResult = infoboxvalidator.validate(csresp
-							.getSamlAssertion());
-				} catch (ValidateException e) {
-					Logger.error("Error validating " + identifier + " infobox:"
-							+ e.getMessage());
-					throw new ValidateException("validator.44",
-							new Object[] { friendlyName });
-				}
-				if (!infoboxValidationResult.isValid()) {
-					Logger.info("Validation of " + identifier
-							+ " infobox failed.");
-					throw new ValidateException("validator.40", new Object[] {
-							friendlyName,
-							infoboxValidationResult.getErrorMessage() });
-				}
-				String form = infoboxvalidator.getForm();
-				if (ParepUtils.isEmpty(form)) {
-					AddAdditionalSAMLAttributes(
-							session,
-							infoboxValidationResult.getExtendedSamlAttributes(),
-							identifier, friendlyName);
-				} else {
-					return "Redirect to Input Processor";
-				}
-			}
-		}
-
-		session.setXMLVerifySignatureResponse(vsresp);
-		session.setSignerCertificate(vsresp.getX509certificate());
-		vsresp.setX509certificate(null);
-		session.setForeigner(false);
-
-		if (session.getUseMandate()) {
-			// mandate mode
-			return null;
-
-		} else {
-
-			session.setAuthenticatedUsed(false);
-			session.setAuthenticated(true);
-			
-	    	//set QAA Level four in case of card authentifcation
-	    	session.setQAALevel(PVPConstants.STORK_QAA_1_4);
-			
-			
-			String oldsessionID = session.getSessionID();
-
-			//Session is implicte stored in changeSessionID!!!
-			String newMOASessionID = AuthenticationSessionStoreage.changeSessionID(session);
-
-			Logger.info("Changed MOASession " + oldsessionID + " to Session " + newMOASessionID);
-			Logger.info("Daten angelegt zu MOASession " + newMOASessionID);
-
-			return newMOASessionID;
-		}
-	}
-
-	/**
-	 * Processes a <code>&lt;CreateXMLSignatureResponse&gt;</code> sent by the
-	 * security layer implementation.<br>
-	 * <ul>
-	 * <li>Validates given <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
-	 * <li>Parses <code>&lt;CreateXMLSignatureResponse&gt;</code> for error
-	 * codes</li>
-	 * <li>Parses authentication block enclosed in
-	 * <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
-	 * <li>Verifies authentication block by calling the MOA SP component</li>
-	 * <li>Creates authentication data</li>
-	 * <li>Creates a corresponding SAML artifact</li>
-	 * <li>Stores authentication data in the authentication data store indexed
-	 * by the SAML artifact</li>
-	 * <li>Deletes authentication session</li>
-	 * <li>Returns the SAML artifact, encoded BASE64</li>
-	 * </ul>
-	 *
-	 * @param sessionID
-	 *            session ID of the running authentication session
-	 * @param xmlCreateXMLSignatureReadResponse
-	 *            String representation of the
-	 *            <code>&lt;CreateXMLSignatureResponse&gt;</code>
-	 * @return SAML artifact needed for retrieving authentication data, encoded
-	 *         BASE64
-	 */
-
-	protected Element createIdentificationBPK(Element mandatePerson,
-			String baseid, String target) throws BuildException {
-		Element identificationBpK = mandatePerson.getOwnerDocument()
-				.createElementNS(Constants.PD_NS_URI, "Identification");
-		Element valueBpK = mandatePerson.getOwnerDocument().createElementNS(
-				Constants.PD_NS_URI, "Value");
-
-		String bpkBase64 = new BPKBuilder().buildBPK(baseid, target);
-		valueBpK.appendChild(mandatePerson.getOwnerDocument().createTextNode(
-				bpkBase64));
-		Element typeBpK = mandatePerson.getOwnerDocument().createElementNS(
-				Constants.PD_NS_URI, "Type");
-		typeBpK.appendChild(mandatePerson.getOwnerDocument().createTextNode(
-				"urn:publicid:gv.at:cdid+bpk"));
-		identificationBpK.appendChild(valueBpK);
-		identificationBpK.appendChild(typeBpK);
-
-		return identificationBpK;
-
-	}
-
-	protected String getBaseId(Element mandatePerson)
-			throws TransformerException, IOException {
-		NodeList list = mandatePerson.getElementsByTagNameNS(
-				Constants.PD_NS_URI, "Identification");
-		for (int i = 0; i < list.getLength(); i++) {
-			Element identification = (Element) list.item(i);
-			Element type = (Element) identification.getElementsByTagNameNS(
-					Constants.PD_NS_URI, "Type").item(0);
-			if (type.getTextContent().compareToIgnoreCase(
-					"urn:publicid:gv.at:baseid") == 0) {
-				Element value = (Element) identification
-						.getElementsByTagNameNS(Constants.PD_NS_URI, "Value")
-						.item(0);
-				return value.getTextContent();
-			}
-		}
-		return null;
-
-	}
-
-	/**
-	 * Gets the foreign authentication data.<br>
-	 * <ul>
-	 * <li>Creates authentication data</li>
-	 * <li>Creates a corresponding SAML artifact</li>
-	 * <li>Stores authentication data in the authentication data store indexed
-	 * by the SAML artifact</li>
-	 * <li>Deletes authentication session</li>
-	 * <li>Returns the SAML artifact, encoded BASE64</li>
-	 * </ul>
-	 *
-	 * @param sessionID
-	 *            session ID of the running authentication session
-	 * @return SAML artifact needed for retrieving authentication data, encoded
-	 *         BASE64
-	 */
-	public String getForeignAuthenticationData(AuthenticationSession session)
-			throws AuthenticationException, BuildException, ParseException,
-			ConfigurationException, ServiceException, ValidateException {
-
-		if (session == null)
-			throw new AuthenticationException("auth.10", new Object[] {
-					REQ_VERIFY_AUTH_BLOCK, PARAM_SESSIONID });
-
-		// post processing of the infoboxes
-		Iterator iter = session.getInfoboxValidatorIterator();
-		boolean formpending = false;
-		if (iter != null) {
-			while (!formpending && iter.hasNext()) {
-				Vector infoboxValidatorVector = (Vector) iter.next();
-				String identifier = (String) infoboxValidatorVector.get(0);
-				String friendlyName = (String) infoboxValidatorVector.get(1);
-				InfoboxValidator infoboxvalidator = (InfoboxValidator) infoboxValidatorVector
-						.get(2);
-				InfoboxValidationResult infoboxValidationResult = null;
-				try {
-					infoboxValidationResult = infoboxvalidator.validate(session
-							.getIdentityLink().getSamlAssertion());
-				} catch (ValidateException e) {
-					Logger.error("Error validating " + identifier + " infobox:"
-							+ e.getMessage());
-					throw new ValidateException("validator.44",
-							new Object[] { friendlyName });
-				}
-				if (!infoboxValidationResult.isValid()) {
-					Logger.info("Validation of " + identifier
-							+ " infobox failed.");
-					throw new ValidateException("validator.40", new Object[] {
-							friendlyName,
-							infoboxValidationResult.getErrorMessage() });
-				}
-				String form = infoboxvalidator.getForm();
-				if (ParepUtils.isEmpty(form)) {
-					AddAdditionalSAMLAttributes(
-							session,
-							infoboxValidationResult.getExtendedSamlAttributes(),
-							identifier, friendlyName);
-				} else {
-					return "Redirect to Input Processor";
-				}
-			}
-		}
-
-		VerifyXMLSignatureResponse vsresp = new VerifyXMLSignatureResponse();
-		X509Certificate cert = session.getSignerCertificate();
-		vsresp.setX509certificate(cert);
-
-		session.setAuthenticatedUsed(false);
-		session.setAuthenticated(true);
-
-
-		session.setXMLVerifySignatureResponse(vsresp);
-		session.setSignerCertificate(vsresp.getX509certificate());
-		vsresp.setX509certificate(null);
-		session.setForeigner(true);
-
-		//TODO: regenerate MOASession ID!
-		return "new Session";
-	}
-
-	/**
-	 * Builds the AuthenticationData object together with the corresponding
-	 * <code>&lt;saml:Assertion&gt;</code>
-	 *
-	 * @param session
-	 *            authentication session
-	 * @param verifyXMLSigResp
-	 *            VerifyXMLSignatureResponse from MOA-SP
-	 * @param useUTC uses correct UTC time format
-	 * @param useUTC indicates that authenticated citizen is a foreigner
-	 * @param isForeigner indicates whether Austrian (false) or foreigner (true) authenticates
-	 * @return AuthenticationData object
-	 * @throws ConfigurationException
-	 *             while accessing configuration data
-	 * @throws BuildException
-	 *             while building the <code>&lt;saml:Assertion&gt;</code>
-	 */
-	public static AuthenticationData buildAuthenticationData(
-			AuthenticationSession session, OAAuthParameter oaParam, String target)
-			throws ConfigurationException, BuildException {
+        return htmlForm;
+    }
+
+    /**
+     * Processes an <code>&lt;InfoboxReadResponse&gt;</code> sent by the
+     * security layer implementation.<br>
+     * <ul>
+     * <li>Validates given <code>&lt;InfoboxReadResponse&gt;</code></li>
+     * <li>Parses identity link enclosed in
+     * <code>&lt;InfoboxReadResponse&gt;</code></li>
+     * <li>Verifies identity link by calling the MOA SP component</li>
+     * <li>Checks certificate authority of identity link</li>
+     * <li>Stores identity link in the session</li>
+     * <li>Verifies all additional infoboxes returned from the BKU</li>
+     * <li>Creates an authentication block to be signed by the user</li>
+     * <li>Creates and returns a <code>&lt;CreateXMLSignatureRequest&gt;</code>
+     * containg the authentication block, meant to be returned to the security
+     * layer implementation</li>
+     * </ul>
+     *
+     * @param sessionID                     ID of associated authentication session data
+     * @param infoboxReadResponseParameters The parameters from the response returned from the BKU
+     *                                      including the <code>&lt;InfoboxReadResponse&gt;</code>
+     * @return String representation of the
+     * <code>&lt;CreateXMLSignatureRequest&gt;</code>
+     * @throws BKUException
+     */
+    public String verifyIdentityLink(AuthenticationSession session,
+                                     Map<String, String> infoboxReadResponseParameters) throws AuthenticationException,
+            BuildException, ParseException, ConfigurationException,
+            ValidateException, ServiceException, BKUException {
+
+        if (session == null)
+            throw new AuthenticationException("auth.10", new Object[]{
+                    REQ_VERIFY_IDENTITY_LINK, PARAM_SESSIONID});
+
+        String xmlInfoboxReadResponse = (String) infoboxReadResponseParameters
+                .get(PARAM_XMLRESPONSE);
+
+        if (isEmpty(xmlInfoboxReadResponse))
+            throw new AuthenticationException("auth.10", new Object[]{
+                    REQ_VERIFY_IDENTITY_LINK, PARAM_XMLRESPONSE});
+
+        AuthConfigurationProvider authConf = AuthConfigurationProvider
+                .getInstance();
+
+        // check if an identity link was found
+        // Errorcode 2911 von Trustdesk BKU (nicht spezifikationskonform
+        // (SL1.2))
+        // CharSequence se = "ErrorCode>2911".substring(0);
+        // boolean b = xmlInfoboxReadResponse.contains(se);
+        String se = "ErrorCode>2911";
+        int b = xmlInfoboxReadResponse.indexOf(se);
+        if (b != -1) { // no identity link found
+            Logger
+                    .info("Es konnte keine Personenbindung auf der Karte gefunden werden. Versuche Anmeldung als auslaendische eID.");
+            return null;
+        }
+        // spezifikationsgemaess (SL1.2) Errorcode
+        se = "ErrorCode>4002";
+        // b = xmlInfoboxReadResponse.contains(se);
+        b = xmlInfoboxReadResponse.indexOf(se);
+        if (b != -1) { // Unbekannter Infoboxbezeichner
+            Logger
+                    .info("Unbekannter Infoboxbezeichner. Versuche Anmeldung als auslaendische eID.");
+            return null;
+        }
+
+        // parses the <InfoboxReadResponse>
+        IdentityLink identityLink = new InfoboxReadResponseParser(
+                xmlInfoboxReadResponse).parseIdentityLink();
+        // validates the identity link
+        IdentityLinkValidator.getInstance().validate(identityLink);
+        // builds a <VerifyXMLSignatureRequest> for a call of MOA-SP
+        Element domVerifyXMLSignatureRequest = new VerifyXMLSignatureRequestBuilder()
+                .build(identityLink, authConf
+                        .getMoaSpIdentityLinkTrustProfileID());
+
+        // invokes the call
+        Element domVerifyXMLSignatureResponse = new SignatureVerificationInvoker()
+                .verifyXMLSignature(domVerifyXMLSignatureRequest);
+        // parses the <VerifyXMLSignatureResponse>
+        VerifyXMLSignatureResponse verifyXMLSignatureResponse = new VerifyXMLSignatureResponseParser(
+                domVerifyXMLSignatureResponse).parseData();
+
+        OAAuthParameter oaParam = AuthConfigurationProvider.getInstance()
+                .getOnlineApplicationParameter(session.getPublicOAURLPrefix());
+
+        // if OA is type is business service the manifest validation result has
+        // to be ignored
+        boolean ignoreManifestValidationResult = (oaParam.getBusinessService() || oaParam.getStorkService()) ? true
+                : false;
+
+        // validates the <VerifyXMLSignatureResponse>
+        VerifyXMLSignatureResponseValidator.getInstance().validate(
+                verifyXMLSignatureResponse,
+                authConf.getIdentityLinkX509SubjectNames(),
+                VerifyXMLSignatureResponseValidator.CHECK_IDENTITY_LINK,
+                ignoreManifestValidationResult);
+
+        session.setIdentityLink(identityLink);
+        // now validate the extended infoboxes
+
+        //Removed in MOA-ID 2.0
+        //verifyInfoboxes(session, infoboxReadResponseParameters, false);
+
+        return "found!";
+    }
+
+    /**
+     * Processes an <code>&lt;InfoboxReadResponse&gt;</code> sent by the
+     * security layer implementation.<br>
+     * <ul>
+     * <li>Validates given <code>&lt;InfoboxReadResponse&gt;</code></li>
+     * <li>Parses identity link enclosed in
+     * <code>&lt;InfoboxReadResponse&gt;</code></li>
+     * <li>Verifies identity link by calling the MOA SP component</li>
+     * <li>Checks certificate authority of identity link</li>
+     * <li>Stores identity link in the session</li>
+     * <li>Verifies all additional infoboxes returned from the BKU</li>
+     * <li>Creates an authentication block to be signed by the user</li>
+     * <li>Creates and returns a <code>&lt;CreateXMLSignatureRequest&gt;</code>
+     * containg the authentication block, meant to be returned to the security
+     * layer implementation</li>
+     * </ul>
+     *
+     * @param sessionID                     ID of associated authentication session data
+     * @param infoboxReadResponseParameters The parameters from the response returned from the BKU
+     *                                      including the <code>&lt;InfoboxReadResponse&gt;</code>
+     * @return String representation of the
+     * <code>&lt;CreateXMLSignatureRequest&gt;</code>
+     */
+    public String verifyCertificate(AuthenticationSession session,
+                                    X509Certificate certificate) throws AuthenticationException,
+            BuildException, ParseException, ConfigurationException,
+            ValidateException, ServiceException, MOAIDException {
+
+        if (session == null)
+            throw new AuthenticationException("auth.10", new Object[]{
+                    REQ_VERIFY_CERTIFICATE, PARAM_SESSIONID});
+
+        // check if person is a Organwalter
+        // if true - don't show bPK in AUTH Block
+        try {
+            for (ObjectID OWid : MOAIDAuthConstants.OW_LIST) {
+                if (certificate.getExtension(OWid) != null) {
+                    session.setOW(true);
+                }
+
+            }
+
+        } catch (X509ExtensionInitException e) {
+            Logger.warn("Certificate extension is not readable.");
+            session.setOW(false);
+        }
+
+        AuthConfigurationProvider authConf = AuthConfigurationProvider
+                .getInstance();
+
+        OAAuthParameter oaParam = AuthConfigurationProvider.getInstance()
+                .getOnlineApplicationParameter(session.getPublicOAURLPrefix());
+
+        String returnvalue = getCreateXMLSignatureRequestAuthBlockOrRedirect(session,
+                authConf, oaParam);
+
+        return returnvalue;
+    }
+
+    /**
+     * Processes an <code>Mandate</code> sent by the MIS.<br>
+     * <ul>
+     * <li>Validates given <code>Mandate</code></li>
+     * <li>Verifies Mandate by calling the MOA SP component</li>
+     * <li>Creates an authentication block to be signed by the user</li>
+     * <li>Creates and returns a <code>&lt;CreateXMLSignatureRequest&gt;</code>
+     * containg the authentication block, meant to be returned to the security
+     * layer implementation</li>
+     * </ul>
+     *
+     * @param sessionID                     ID of associated authentication session data
+     * @param infoboxReadResponseParameters The parameters from the response returned from the BKU
+     *                                      including the <code>&lt;InfoboxReadResponse&gt;</code>
+     * @return String representation of the
+     * <code>&lt;CreateXMLSignatureRequest&gt;</code>
+     */
+    public void verifyMandate(AuthenticationSession session, MISMandate mandate)
+            throws AuthenticationException, BuildException, ParseException,
+            ConfigurationException, ValidateException, ServiceException {
+
+        if (session == null)
+            throw new AuthenticationException("auth.10", new Object[]{
+                    GET_MIS_SESSIONID, PARAM_SESSIONID});
+
+        OAAuthParameter oaParam = AuthConfigurationProvider.getInstance()
+                .getOnlineApplicationParameter(session.getPublicOAURLPrefix());
+
+        try {
+            // sets the extended SAML attributes for OID (Organwalter)
+            setExtendedSAMLAttributeForMandatesOID(session, mandate, oaParam
+                    .getBusinessService());
+
+            validateExtendedSAMLAttributeForMandates(session, mandate, oaParam.getBusinessService());
+
+
+        } catch (SAXException e) {
+            throw new AuthenticationException("auth.16",
+                    new Object[]{GET_MIS_SESSIONID}, e);
+        } catch (IOException e) {
+            throw new AuthenticationException("auth.16",
+                    new Object[]{GET_MIS_SESSIONID}, e);
+        } catch (ParserConfigurationException e) {
+            throw new AuthenticationException("auth.16",
+                    new Object[]{GET_MIS_SESSIONID}, e);
+        } catch (TransformerException e) {
+            throw new AuthenticationException("auth.16",
+                    new Object[]{GET_MIS_SESSIONID}, e);
+        }
+
+    }
+
+    /**
+     * @param session
+     * @param authConf
+     * @param oaParam
+     * @return
+     * @throws ConfigurationException
+     * @throws BuildException
+     * @throws ValidateException
+     */
+    public String getCreateXMLSignatureRequestAuthBlockOrRedirect(
+            AuthenticationSession session, AuthConfigurationProvider authConf,
+            OAAuthParameter oaParam) throws ConfigurationException,
+            BuildException, ValidateException {
+
+        // check for intermediate processing of the infoboxes
+        if (session.isValidatorInputPending())
+            return "Redirect to Input Processor";
+
+        if (authConf == null)
+            authConf = AuthConfigurationProvider.getInstance();
+        if (oaParam == null)
+            oaParam = AuthConfigurationProvider.getInstance()
+                    .getOnlineApplicationParameter(
+                            session.getPublicOAURLPrefix());
+
+        // builds the AUTH-block
+        String authBlock = buildAuthenticationBlock(session, oaParam);
+
+        // builds the <CreateXMLSignatureRequest>
+        List<String> transformsInfos = oaParam.getTransformsInfos();
+        if ((transformsInfos == null) || (transformsInfos.size() == 0)) {
+            // no OA specific transforms specified, use default ones
+            transformsInfos = authConf.getTransformsInfos();
+        }
+        String createXMLSignatureRequest = new CreateXMLSignatureRequestBuilder()
+                .build(authBlock, oaParam.getKeyBoxIdentifier(),
+                        transformsInfos);
+        return createXMLSignatureRequest;
+    }
+
+    /**
+     * Returns an CreateXMLSignatureRequest for signing the ERnP statement.<br>
+     * <ul>
+     * <li>Creates an CreateXMLSignatureRequest to be signed by the user</li>
+     * </ul>
+     *
+     * @param sessionID ID of associated authentication session data
+     * @param cert      The certificate from the user
+     * @return String representation of the
+     * <code>&lt;CreateXMLSignatureRequest&gt;</code>
+     */
+    public String createXMLSignatureRequestForeignID(AuthenticationSession session,
+                                                     X509Certificate cert) throws AuthenticationException,
+            BuildException, ParseException, ConfigurationException,
+            ValidateException, ServiceException {
+
+        if (session == null)
+            throw new AuthenticationException("auth.10", new Object[]{
+                    REQ_VERIFY_CERTIFICATE, PARAM_SESSIONID});
+
+        AuthConfigurationProvider authConf = AuthConfigurationProvider
+                .getInstance();
+
+        OAAuthParameter oaParam = AuthConfigurationProvider.getInstance()
+                .getOnlineApplicationParameter(session.getPublicOAURLPrefix());
+
+        return getCreateXMLSignatureRequestForeigID(session, authConf, oaParam,
+                cert);
+    }
+
+    public String getCreateXMLSignatureRequestForeigID(
+            AuthenticationSession session, AuthConfigurationProvider authConf,
+            OAAuthParameter oaParam, X509Certificate cert)
+            throws ConfigurationException {
+
+        // check for intermediate processing of the infoboxes
+        if (session.isValidatorInputPending())
+            return "Redirect to Input Processor";
+
+        if (authConf == null)
+            authConf = AuthConfigurationProvider.getInstance();
+        if (oaParam == null)
+            oaParam = AuthConfigurationProvider.getInstance()
+                    .getOnlineApplicationParameter(
+                            session.getPublicOAURLPrefix());
+
+        Principal subject = cert.getSubjectDN();
+
+        String createXMLSignatureRequest = new CreateXMLSignatureRequestBuilder()
+                .buildForeignID(subject.toString(), oaParam, session);
+        return createXMLSignatureRequest;
+    }
+
+    /**
+     * Processes an <code>&lt;CreateXMLSignatureResponse&gt;</code> sent by the
+     * security layer implementation.<br>
+     * <ul>
+     * <li>Validates given <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
+     * <li>Parses response enclosed in
+     * <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
+     * <li>Verifies signature by calling the MOA SP component</li>
+     * <li>Returns the signer certificate</li>
+     * </ul>
+     *
+     * @param sessionID                            ID of associated authentication session data
+     * @param createXMLSignatureResponseParameters The parameters from the response returned from the BKU
+     *                                             including the <code>&lt;CreateXMLSignatureResponse&gt;</code>
+     * @throws BKUException
+     */
+    public X509Certificate verifyXMLSignature(String sessionID,
+                                              Map<String, String> createXMLSignatureResponseParameters)
+            throws AuthenticationException, BuildException, ParseException,
+            ConfigurationException, ValidateException, ServiceException, BKUException {
+
+        if (isEmpty(sessionID))
+            throw new AuthenticationException("auth.10", new Object[]{
+                    REQ_GET_FOREIGN_ID, PARAM_SESSIONID});
+
+        String xmlCreateXMLSignatureResponse = (String) createXMLSignatureResponseParameters
+                .get(PARAM_XMLRESPONSE);
+
+        if (isEmpty(xmlCreateXMLSignatureResponse))
+            throw new AuthenticationException("auth.10", new Object[]{
+                    REQ_GET_FOREIGN_ID, PARAM_XMLRESPONSE});
+
+        AuthConfigurationProvider authConf = AuthConfigurationProvider
+                .getInstance();
+
+        // parses the <CreateXMLSignatureResponse>
+        CreateXMLSignatureResponseParser p = new CreateXMLSignatureResponseParser(
+                xmlCreateXMLSignatureResponse);
+        CreateXMLSignatureResponse createXMLSignatureResponse = p
+                .parseResponseDsig();
+
+        // builds a <VerifyXMLSignatureRequest> for a call of MOA-SP
+        Element domVerifyXMLSignatureRequest = new VerifyXMLSignatureRequestBuilder()
+                .buildDsig(createXMLSignatureResponse, authConf
+                        .getMoaSpAuthBlockTrustProfileID());
+
+        // invokes the call
+        Element domVerifyXMLSignatureResponse = new SignatureVerificationInvoker()
+                .verifyXMLSignature(domVerifyXMLSignatureRequest);
+
+        // parses the <VerifyXMLSignatureResponse>
+        VerifyXMLSignatureResponse verifyXMLSignatureResponse = new VerifyXMLSignatureResponseParser(
+                domVerifyXMLSignatureResponse).parseData();
+
+        return verifyXMLSignatureResponse.getX509certificate();
+
+    }
+
+    /**
+     * Processes an <code>&lt;CreateXMLSignatureResponse&gt;</code> sent by the
+     * security layer implementation.<br>
+     * <ul>
+     * <li>Validates given <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
+     * <li>Parses response enclosed in
+     * <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
+     * <li>Verifies signature by calling the MOA SP component</li>
+     * <li>Returns the signer certificate</li>
+     * </ul>
+     *
+     * @param sessionID                     ID of associated authentication session data
+     * @param readInfoboxResponseParameters The parameters from the response returned from the BKU
+     *                                      including the <code>&lt;ReadInfoboxResponse&gt;</code>
+     * @throws BKUException
+     */
+    public X509Certificate getCertificate(String sessionID,
+                                          Map<String, String> readInfoboxResponseParameters) throws AuthenticationException,
+            BuildException, ParseException, ConfigurationException,
+            ValidateException, ServiceException, BKUException {
+
+        if (isEmpty(sessionID))
+            throw new AuthenticationException("auth.10", new Object[]{
+                    REQ_VERIFY_CERTIFICATE, PARAM_SESSIONID});
+
+        String xmlReadInfoboxResponse = (String) readInfoboxResponseParameters
+                .get(PARAM_XMLRESPONSE);
+
+        if (isEmpty(xmlReadInfoboxResponse))
+            throw new AuthenticationException("auth.10", new Object[]{
+                    REQ_VERIFY_CERTIFICATE, PARAM_XMLRESPONSE});
+
+        // parses the <CreateXMLSignatureResponse>
+        InfoboxReadResponseParser p = new InfoboxReadResponseParser(
+                xmlReadInfoboxResponse);
+        X509Certificate cert = p.parseCertificate();
+
+        return cert;
+
+    }
+
+    /**
+     * Builds an authentication block <code>&lt;saml:Assertion&gt;</code> from
+     * given session data.
+     *
+     * @param session authentication session
+     * @return <code>&lt;saml:Assertion&gt;</code> as a String
+     * @throws BuildException If an error occurs on serializing an extended SAML attribute
+     *                        to be appended to the AUTH-Block.
+     */
+    private String buildAuthenticationBlock(AuthenticationSession session,
+                                            OAAuthParameter oaParam) throws BuildException {
+
+        IdentityLink identityLink = session.getIdentityLink();
+        String issuer = identityLink.getName();
+        String gebDat = identityLink.getDateOfBirth();
+
+        String identificationValue = null;
+        String identificationType = null;
+
+        //set empty AuthBlock BPK in case of OW or SSO or bpk is not requested
+        if (session.isOW() || session.isSsoRequested() || oaParam.isRemovePBKFromAuthBlock()) {
+            identificationType = "";
+            identificationValue = "";
+
+        } else if (identityLink.getIdentificationType().equals(Constants.URN_PREFIX_BASEID)) {
+
+            if (oaParam.getBusinessService()) {
+
+                String bpkBase64 = new BPKBuilder().buildWBPK(identityLink
+                        .getIdentificationValue(), oaParam.getIdentityLinkDomainIdentifier());
+                identificationValue = bpkBase64;
+
+                if (oaParam.getIdentityLinkDomainIdentifier().startsWith(Constants.URN_PREFIX_WBPK + "+"))
+                    identificationType = oaParam.getIdentityLinkDomainIdentifier();
+                else
+                    identificationType = Constants.URN_PREFIX_WBPK + "+" + oaParam.getIdentityLinkDomainIdentifier();
+
+            } else {
+                String bpkBase64 = new BPKBuilder().buildBPK(identityLink
+                        .getIdentificationValue(), session.getTarget());
+                identificationValue = bpkBase64;
+                identificationType = Constants.URN_PREFIX_CDID + "+" + session.getTarget();
+            }
+
+
+        } else {
+            identificationValue = identityLink.getIdentificationValue();
+            identificationType = identityLink.getIdentificationType();
+
+        }
+
+        String issueInstant = DateTimeUtils.buildDateTimeUTC(Calendar
+                .getInstance());
+        session.setIssueInstant(issueInstant);
+        String authURL = session.getAuthURL();
+        String target = session.getTarget();
+        String targetFriendlyName = session.getTargetFriendlyName();
+
+        // Bug #485
+        // (https://egovlabs.gv.at/tracker/index.php?func=detail&aid=485&group_id=6&atid=105)
+        // String oaURL = session.getPublicOAURLPrefix();
+
+        List<ExtendedSAMLAttribute> extendedSAMLAttributes = session.getExtendedSAMLAttributesAUTH();
+
+
+        if (session.isSsoRequested()) {
+            String oaURL = new String();
+            try {
+                oaURL = AuthConfigurationProvider.getInstance().getPublicURLPrefix();
+
+                if (MiscUtil.isNotEmpty(oaURL))
+                    oaURL = oaURL.replaceAll("&", "&amp;");
+
+            } catch (ConfigurationException e) {
+            }
+            String authBlock = new AuthenticationBlockAssertionBuilder()
+                    .buildAuthBlockSSO(issuer, issueInstant, authURL, target,
+                            targetFriendlyName, identificationValue,
+                            identificationType, oaURL, gebDat,
+                            extendedSAMLAttributes, session, oaParam);
+            return authBlock;
+
+        } else {
+            String oaURL = session.getPublicOAURLPrefix().replaceAll("&", "&amp;");
+            String authBlock = new AuthenticationBlockAssertionBuilder()
+                    .buildAuthBlock(issuer, issueInstant, authURL, target,
+                            targetFriendlyName, identificationValue,
+                            identificationType, oaURL, gebDat,
+                            extendedSAMLAttributes, session, oaParam);
+            return authBlock;
+        }
+    }
+
+
+    /**
+     * Verifies the infoboxes (except of the identity link infobox) returned by
+     * the BKU by calling appropriate validator classes.
+     *
+     * @param session The actual authentication session.
+     * @param mandate The Mandate from the MIS
+     * @throws AuthenticationException
+     * @throws ConfigurationException
+     * @throws TransformerException
+     * @throws ParserConfigurationException
+     * @throws IOException
+     * @throws SAXException
+     */
+    private void validateExtendedSAMLAttributeForMandates(
+            AuthenticationSession session, MISMandate mandate,
+            boolean business)
+            throws ValidateException, ConfigurationException, SAXException,
+            IOException, ParserConfigurationException, TransformerException {
+
+        ExtendedSAMLAttribute[] extendedSAMLAttributes = addExtendedSamlAttributes(
+                mandate, business, false);
+
+        int length = extendedSAMLAttributes.length;
+        for (int i = 0; i < length; i++) {
+            ExtendedSAMLAttribute samlAttribute = extendedSAMLAttributes[i];
+
+            verifySAMLAttribute(samlAttribute, i, "MISService",
+                    "MISService");
+
+        }
+    }
+
+    /**
+     * Verifies the infoboxes (except of the identity link infobox) returned by
+     * the BKU by calling appropriate validator classes.
+     *
+     * @param session The actual authentication session.
+     * @param mandate The Mandate from the MIS
+     * @throws AuthenticationException
+     * @throws ConfigurationException
+     * @throws TransformerException
+     * @throws ParserConfigurationException
+     * @throws IOException
+     * @throws SAXException
+     */
+    private void setExtendedSAMLAttributeForMandatesOID(
+            AuthenticationSession session, MISMandate mandate, boolean business)
+            throws ValidateException, ConfigurationException, SAXException,
+            IOException, ParserConfigurationException, TransformerException {
+
+        ExtendedSAMLAttribute[] extendedSamlAttributes = addExtendedSamlAttributesOID(
+                mandate, business);
+
+        AddAdditionalSAMLAttributes(session, extendedSamlAttributes,
+                "MISService", "MISService");
+
+    }
+
+    /**
+     * Adds given SAML Attributes to the current session. They will be appended
+     * to the final SAML Assertion or the AUTH block. If the attributes are
+     * already in the list, they will be replaced.
+     *
+     * @param session                The current session
+     * @param extendedSAMLAttributes The SAML attributes to add
+     * @param identifier             The infobox identifier for debug purposes
+     * @param friendlyNam            The friendly name of the infobox for debug purposes
+     */
+    private static void AddAdditionalSAMLAttributes(
+            AuthenticationSession session,
+            ExtendedSAMLAttribute[] extendedSAMLAttributes, String identifier,
+            String friendlyName) throws ValidateException {
+        if (extendedSAMLAttributes == null)
+            return;
+        List<ExtendedSAMLAttribute> oaAttributes = session.getExtendedSAMLAttributesOA();
+        if (oaAttributes == null)
+            oaAttributes = new Vector<ExtendedSAMLAttribute>();
+        List<ExtendedSAMLAttribute> authAttributes = session.getExtendedSAMLAttributesAUTH();
+        if (authAttributes == null)
+            authAttributes = new Vector<ExtendedSAMLAttribute>();
+        int length = extendedSAMLAttributes.length;
+        for (int i = 0; i < length; i++) {
+            ExtendedSAMLAttribute samlAttribute = extendedSAMLAttributes[i];
+
+            Object value = verifySAMLAttribute(samlAttribute, i, identifier,
+                    friendlyName);
+
+            if ((value instanceof String) || (value instanceof Element)) {
+                switch (samlAttribute.getAddToAUTHBlock()) {
+                    case ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY:
+                        replaceExtendedSAMLAttribute(authAttributes, samlAttribute);
+                        break;
+                    case ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK:
+                        replaceExtendedSAMLAttribute(authAttributes, samlAttribute);
+                        replaceExtendedSAMLAttribute(oaAttributes, samlAttribute);
+                        break;
+                    case ExtendedSAMLAttribute.NOT_ADD_TO_AUTHBLOCK:
+                        replaceExtendedSAMLAttribute(oaAttributes, samlAttribute);
+                        break;
+                    default:
+                        Logger
+                                .info("Invalid return value from method \"getAddToAUTHBlock()\" ("
+                                        + samlAttribute.getAddToAUTHBlock()
+                                        + ") in SAML attribute number "
+                                        + (i + 1)
+                                        + " for infobox " + identifier);
+                        throw new ValidateException("validator.47", new Object[]{
+                                friendlyName, String.valueOf((i + 1))});
+                }
+            } else {
+                Logger
+                        .info("The type of SAML-Attribute number "
+                                + (i + 1)
+                                + " returned from "
+                                + identifier
+                                + "-infobox validator is not valid. Must be either \"java.Lang.String\""
+                                + " or \"org.w3c.dom.Element\"");
+                throw new ValidateException("validator.46", new Object[]{
+                        identifier, String.valueOf((i + 1))});
+            }
+        }
+        session.setExtendedSAMLAttributesAUTH(authAttributes);
+        session.setExtendedSAMLAttributesOA(oaAttributes);
+    }
+
+    /**
+     * Adds the AUTH block related SAML attributes to the validation result.
+     * This is needed always before the AUTH block is to be signed, because the
+     * name of the mandator has to be set
+     *
+     * @throws ParserConfigurationException
+     * @throws IOException
+     * @throws SAXException
+     * @throws TransformerException
+     */
+
+    protected static ExtendedSAMLAttribute[] addExtendedSamlAttributes(
+            MISMandate mandate, boolean business, boolean provideStammzahl)
+            throws SAXException, IOException, ParserConfigurationException,
+            TransformerException {
+        Vector<ExtendedSAMLAttribute> extendedSamlAttributes = new Vector<ExtendedSAMLAttribute>();
+
+        extendedSamlAttributes.clear();
+
+        // Name
+        Element domMandate = mandateToElement(mandate);
+        Element nameSpaceNode = domMandate.getOwnerDocument().createElement(
+                "NameSpaceNode");
+        nameSpaceNode.setAttribute("xmlns" + SZRGWConstants.PD_POSTFIX,
+                Constants.PD_NS_URI);
+        nameSpaceNode.setAttribute("xmlns" + SZRGWConstants.MANDATE_POSTFIX,
+                SZRGWConstants.MANDATE_NS);
+
+        Element mandator = (Element) XPathAPI.selectSingleNode(domMandate,
+                "//md:Mandate/md:Mandator", nameSpaceNode);
+
+        // Mandate
+        extendedSamlAttributes.add(new ExtendedSAMLAttributeImpl(
+                EXT_SAML_MANDATE_RAW, domMandate,
+                SZRGWConstants.MANDATE_NS,
+                ExtendedSAMLAttribute.NOT_ADD_TO_AUTHBLOCK));
+
+        // (w)bpk
+        String wbpk = ParepUtils.extractMandatorWbpk(mandator);
+        if (!ParepUtils.isEmpty(wbpk)) {
+            if (!ParepUtils.isPhysicalPerson(mandator)) {
+                String idType = ParepUtils
+                        .extractMandatorIdentificationType(mandator);
+                if (!ParepUtils.isEmpty(idType)
+                        && idType.startsWith(Constants.URN_PREFIX_BASEID)) {
+                    extendedSamlAttributes.add(new ExtendedSAMLAttributeImpl(
+                            EXT_SAML_MANDATE_CB_BASE_ID,
+                            ParepUtils.getRegisterString(idType) + ": " + wbpk,
+                            SZRGWConstants.MANDATE_NS,
+                            ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY));
+                }
+            } else if (business) {
+                extendedSamlAttributes.add(new ExtendedSAMLAttributeImpl(
+                        EXT_SAML_MANDATE_WBPK, wbpk,
+                        SZRGWConstants.MANDATE_NS,
+                        ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY));
+            }
+        }
+
+        ExtendedSAMLAttribute[] ret = new ExtendedSAMLAttribute[extendedSamlAttributes
+                .size()];
+        extendedSamlAttributes.copyInto(ret);
+        Logger.debug("ExtendedSAML Attributes: " + ret.length);
+        return ret;
+
+    }
+
+    /**
+     * Adds the AUTH block related SAML attributes to the validation result.
+     * This is needed always before the AUTH block is to be signed, because the
+     * name of the mandator has to be set
+     *
+     * @throws ParserConfigurationException
+     * @throws IOException
+     * @throws SAXException
+     * @throws TransformerException
+     */
+    private static ExtendedSAMLAttribute[] addExtendedSamlAttributesOID(
+            MISMandate mandate, boolean business) throws SAXException,
+            IOException, ParserConfigurationException, TransformerException {
+
+        Vector<ExtendedSAMLAttribute> extendedSamlAttributes = new Vector<ExtendedSAMLAttribute>();
+
+        extendedSamlAttributes.clear();
+
+        // RepresentationType
+        extendedSamlAttributes.add(new ExtendedSAMLAttributeImpl(
+                EXT_SAML_MANDATE_REPRESENTATIONTYPE,
+                EXT_SAML_MANDATE_REPRESENTATIONTEXT,
+                SZRGWConstants.MANDATE_NS,
+                ExtendedSAMLAttribute.NOT_ADD_TO_AUTHBLOCK));
+
+        String oid = mandate.getProfRep();
+
+        if (oid != null) {
+            extendedSamlAttributes.add(new ExtendedSAMLAttributeImpl(
+                    EXT_SAML_MANDATE_OID, oid,
+                    SZRGWConstants.MANDATE_NS,
+                    ExtendedSAMLAttribute.NOT_ADD_TO_AUTHBLOCK));
+            String oidDescription = mandate.getTextualDescriptionOfOID();
+            extendedSamlAttributes.add(new ExtendedSAMLAttributeImpl(
+                    EXT_SAML_MANDATE_OIDTEXTUALDESCRIPTION,
+                    oidDescription, SZRGWConstants.MANDATE_NS,
+                    ExtendedSAMLAttribute.NOT_ADD_TO_AUTHBLOCK));
+
+        }
+
+        ExtendedSAMLAttribute[] ret = new ExtendedSAMLAttribute[extendedSamlAttributes
+                .size()];
+        extendedSamlAttributes.copyInto(ret);
+        Logger.debug("ExtendedSAML Attributes: " + ret.length);
+        return ret;
+
+    }
+
+    /**
+     * @param mandate
+     * @return
+     * @throws ParserConfigurationException
+     * @throws IOException
+     * @throws SAXException
+     */
+    private static Element mandateToElement(MISMandate mandate)
+            throws SAXException, IOException, ParserConfigurationException {
+        ByteArrayInputStream bais = new ByteArrayInputStream(mandate
+                .getMandate());
+        Document doc = DOMUtils.parseDocumentSimple(bais);
+        return doc.getDocumentElement();
+    }
+
+    protected static void replaceExtendedSAMLAttribute(List<ExtendedSAMLAttribute> attributes,
+                                                       ExtendedSAMLAttribute samlAttribute) {
+        if (null == attributes) {
+            attributes = new Vector<ExtendedSAMLAttribute>();
+        } else {
+            String id = samlAttribute.getName();
+            int length = attributes.size();
+            for (int i = 0; i < length; i++) {
+                ExtendedSAMLAttribute att = (ExtendedSAMLAttribute) attributes
+                        .get(i);
+                if (id.equals(att.getName())) {
+                    // replace attribute
+                    attributes.set(i, samlAttribute);
+                    return;
+                }
+            }
+            attributes.add(samlAttribute);
+        }
+    }
+
+    /**
+     * Processes a <code>&lt;CreateXMLSignatureResponse&gt;</code> sent by the
+     * security layer implementation.<br>
+     * <ul>
+     * <li>Validates given <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
+     * <li>Parses <code>&lt;CreateXMLSignatureResponse&gt;</code> for error
+     * codes</li>
+     * <li>Parses authentication block enclosed in
+     * <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
+     * <li>Verifies authentication block by calling the MOA SP component</li>
+     * <li>Creates authentication data</li>
+     * <li>Creates a corresponding SAML artifact</li>
+     * <li>Stores authentication data in the authentication data store indexed
+     * by the SAML artifact</li>
+     * <li>Deletes authentication session</li>
+     * <li>Returns the SAML artifact, encoded BASE64</li>
+     * </ul>
+     *
+     * @param sessionID                         session ID of the running authentication session
+     * @param xmlCreateXMLSignatureReadResponse String representation of the
+     *                                          <code>&lt;CreateXMLSignatureResponse&gt;</code>
+     * @return SAML artifact needed for retrieving authentication data, encoded
+     * BASE64
+     * @throws BKUException
+     */
+    public String verifyAuthenticationBlock(AuthenticationSession session,
+                                            String xmlCreateXMLSignatureReadResponse)
+            throws AuthenticationException, BuildException, ParseException,
+            ConfigurationException, ServiceException, ValidateException, BKUException {
+
+        if (session == null)
+            throw new AuthenticationException("auth.10", new Object[]{
+                    REQ_VERIFY_AUTH_BLOCK, PARAM_SESSIONID});
+        if (isEmpty(xmlCreateXMLSignatureReadResponse))
+            throw new AuthenticationException("auth.10", new Object[]{
+                    REQ_VERIFY_AUTH_BLOCK, PARAM_XMLRESPONSE});
+
+        AuthConfigurationProvider authConf = AuthConfigurationProvider
+                .getInstance();
+        // parses <CreateXMLSignatureResponse>
+        CreateXMLSignatureResponse csresp = new CreateXMLSignatureResponseParser(
+                xmlCreateXMLSignatureReadResponse).parseResponse();
+
+        try {
+            String serializedAssertion = DOMUtils.serializeNode(csresp
+                    .getSamlAssertion());
+            session.setAuthBlock(serializedAssertion);
+        } catch (TransformerException e) {
+            throw new ParseException("parser.04", new Object[]{
+                    REQ_VERIFY_AUTH_BLOCK, PARAM_XMLRESPONSE});
+        } catch (IOException e) {
+            throw new ParseException("parser.04", new Object[]{
+                    REQ_VERIFY_AUTH_BLOCK, PARAM_XMLRESPONSE});
+        }
+        // validates <CreateXMLSignatureResponse>
+        if (session.isSsoRequested())
+            new CreateXMLSignatureResponseValidator().validateSSO(csresp, session);
+        else
+            new CreateXMLSignatureResponseValidator().validate(csresp, session);
+
+        // builds a <VerifyXMLSignatureRequest> for a MOA-SPSS call
+        List<String> vtids = authConf.getMoaSpAuthBlockVerifyTransformsInfoIDs();
+        String tpid = authConf.getMoaSpAuthBlockTrustProfileID();
+        Element domVsreq = new VerifyXMLSignatureRequestBuilder().build(csresp,
+                vtids, tpid);
+        // debug output
+
+        // invokes the call
+        Element domVsresp = new SignatureVerificationInvoker()
+                .verifyXMLSignature(domVsreq);
+        // debug output
+
+        // parses the <VerifyXMLSignatureResponse>
+        VerifyXMLSignatureResponse vsresp = new VerifyXMLSignatureResponseParser(
+                domVsresp).parseData();
+
+        if (Logger.isTraceEnabled()) {
+            if (domVsresp != null) {
+                try {
+                    String xmlVerifyXMLSignatureResponse = DOMUtils
+                            .serializeNode(domVsresp, true);
+                    Logger.trace(new LogMsg(xmlCreateXMLSignatureReadResponse));
+                    Logger.trace(new LogMsg(xmlVerifyXMLSignatureResponse));
+                } catch (Throwable t) {
+                    t.printStackTrace();
+                    Logger.info(new LogMsg(t.getStackTrace()));
+                }
+            }
+        }
+
+        // validates the <VerifyXMLSignatureResponse>
+        VerifyXMLSignatureResponseValidator.getInstance().validate(vsresp,
+                null, VerifyXMLSignatureResponseValidator.CHECK_AUTH_BLOCK,
+                false);
+
+        // Compare AuthBlock Data with information stored in session, especially
+        // date and time
+        CreateXMLSignatureResponseValidator.getInstance().validateSigningDateTime(csresp);
+
+        // compares the public keys from the identityLink with the AuthBlock
+        VerifyXMLSignatureResponseValidator.getInstance().validateCertificate(
+                vsresp, session.getIdentityLink());
+
+        // post processing of the infoboxes
+        Iterator iter = session.getInfoboxValidatorIterator();
+        boolean formpending = false;
+        if (iter != null) {
+            while (!formpending && iter.hasNext()) {
+                Vector infoboxValidatorVector = (Vector) iter.next();
+                String identifier = (String) infoboxValidatorVector.get(0);
+                String friendlyName = (String) infoboxValidatorVector.get(1);
+                InfoboxValidator infoboxvalidator = (InfoboxValidator) infoboxValidatorVector
+                        .get(2);
+                InfoboxValidationResult infoboxValidationResult = null;
+                try {
+                    infoboxValidationResult = infoboxvalidator.validate(csresp
+                            .getSamlAssertion());
+                } catch (ValidateException e) {
+                    Logger.error("Error validating " + identifier + " infobox:"
+                            + e.getMessage());
+                    throw new ValidateException("validator.44",
+                            new Object[]{friendlyName});
+                }
+                if (!infoboxValidationResult.isValid()) {
+                    Logger.info("Validation of " + identifier
+                            + " infobox failed.");
+                    throw new ValidateException("validator.40", new Object[]{
+                            friendlyName,
+                            infoboxValidationResult.getErrorMessage()});
+                }
+                String form = infoboxvalidator.getForm();
+                if (ParepUtils.isEmpty(form)) {
+                    AddAdditionalSAMLAttributes(
+                            session,
+                            infoboxValidationResult.getExtendedSamlAttributes(),
+                            identifier, friendlyName);
+                } else {
+                    return "Redirect to Input Processor";
+                }
+            }
+        }
+
+        session.setXMLVerifySignatureResponse(vsresp);
+        session.setSignerCertificate(vsresp.getX509certificate());
+        vsresp.setX509certificate(null);
+        session.setForeigner(false);
+
+        if (session.getUseMandate()) {
+            // mandate mode
+            return null;
+
+        } else {
+
+            session.setAuthenticatedUsed(false);
+            session.setAuthenticated(true);
+
+            //set QAA Level four in case of card authentifcation
+            session.setQAALevel(PVPConstants.STORK_QAA_1_4);
+
+
+            String oldsessionID = session.getSessionID();
+
+            //Session is implicte stored in changeSessionID!!!
+            String newMOASessionID = AuthenticationSessionStoreage.changeSessionID(session);
+
+            Logger.info("Changed MOASession " + oldsessionID + " to Session " + newMOASessionID);
+            Logger.info("Daten angelegt zu MOASession " + newMOASessionID);
+
+            return newMOASessionID;
+        }
+    }
+
+    /**
+     * Processes a <code>&lt;CreateXMLSignatureResponse&gt;</code> sent by the
+     * security layer implementation.<br>
+     * <ul>
+     * <li>Validates given <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
+     * <li>Parses <code>&lt;CreateXMLSignatureResponse&gt;</code> for error
+     * codes</li>
+     * <li>Parses authentication block enclosed in
+     * <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
+     * <li>Verifies authentication block by calling the MOA SP component</li>
+     * <li>Creates authentication data</li>
+     * <li>Creates a corresponding SAML artifact</li>
+     * <li>Stores authentication data in the authentication data store indexed
+     * by the SAML artifact</li>
+     * <li>Deletes authentication session</li>
+     * <li>Returns the SAML artifact, encoded BASE64</li>
+     * </ul>
+     *
+     * @param sessionID                         session ID of the running authentication session
+     * @param xmlCreateXMLSignatureReadResponse String representation of the
+     *                                          <code>&lt;CreateXMLSignatureResponse&gt;</code>
+     * @return SAML artifact needed for retrieving authentication data, encoded
+     * BASE64
+     */
+
+    protected Element createIdentificationBPK(Element mandatePerson,
+                                              String baseid, String target) throws BuildException {
+        Element identificationBpK = mandatePerson.getOwnerDocument()
+                .createElementNS(Constants.PD_NS_URI, "Identification");
+        Element valueBpK = mandatePerson.getOwnerDocument().createElementNS(
+                Constants.PD_NS_URI, "Value");
+
+        String bpkBase64 = new BPKBuilder().buildBPK(baseid, target);
+        valueBpK.appendChild(mandatePerson.getOwnerDocument().createTextNode(
+                bpkBase64));
+        Element typeBpK = mandatePerson.getOwnerDocument().createElementNS(
+                Constants.PD_NS_URI, "Type");
+        typeBpK.appendChild(mandatePerson.getOwnerDocument().createTextNode(
+                "urn:publicid:gv.at:cdid+bpk"));
+        identificationBpK.appendChild(valueBpK);
+        identificationBpK.appendChild(typeBpK);
+
+        return identificationBpK;
+
+    }
+
+    protected String getBaseId(Element mandatePerson)
+            throws TransformerException, IOException {
+        NodeList list = mandatePerson.getElementsByTagNameNS(
+                Constants.PD_NS_URI, "Identification");
+        for (int i = 0; i < list.getLength(); i++) {
+            Element identification = (Element) list.item(i);
+            Element type = (Element) identification.getElementsByTagNameNS(
+                    Constants.PD_NS_URI, "Type").item(0);
+            if (type.getTextContent().compareToIgnoreCase(
+                    "urn:publicid:gv.at:baseid") == 0) {
+                Element value = (Element) identification
+                        .getElementsByTagNameNS(Constants.PD_NS_URI, "Value")
+                        .item(0);
+                return value.getTextContent();
+            }
+        }
+        return null;
+
+    }
+
+    /**
+     * Gets the foreign authentication data.<br>
+     * <ul>
+     * <li>Creates authentication data</li>
+     * <li>Creates a corresponding SAML artifact</li>
+     * <li>Stores authentication data in the authentication data store indexed
+     * by the SAML artifact</li>
+     * <li>Deletes authentication session</li>
+     * <li>Returns the SAML artifact, encoded BASE64</li>
+     * </ul>
+     *
+     * @param sessionID session ID of the running authentication session
+     * @return SAML artifact needed for retrieving authentication data, encoded
+     * BASE64
+     */
+    public String getForeignAuthenticationData(AuthenticationSession session)
+            throws AuthenticationException, BuildException, ParseException,
+            ConfigurationException, ServiceException, ValidateException {
+
+        if (session == null)
+            throw new AuthenticationException("auth.10", new Object[]{
+                    REQ_VERIFY_AUTH_BLOCK, PARAM_SESSIONID});
+
+        // post processing of the infoboxes
+        Iterator iter = session.getInfoboxValidatorIterator();
+        boolean formpending = false;
+        if (iter != null) {
+            while (!formpending && iter.hasNext()) {
+                Vector infoboxValidatorVector = (Vector) iter.next();
+                String identifier = (String) infoboxValidatorVector.get(0);
+                String friendlyName = (String) infoboxValidatorVector.get(1);
+                InfoboxValidator infoboxvalidator = (InfoboxValidator) infoboxValidatorVector
+                        .get(2);
+                InfoboxValidationResult infoboxValidationResult = null;
+                try {
+                    infoboxValidationResult = infoboxvalidator.validate(session
+                            .getIdentityLink().getSamlAssertion());
+                } catch (ValidateException e) {
+                    Logger.error("Error validating " + identifier + " infobox:"
+                            + e.getMessage());
+                    throw new ValidateException("validator.44",
+                            new Object[]{friendlyName});
+                }
+                if (!infoboxValidationResult.isValid()) {
+                    Logger.info("Validation of " + identifier
+                            + " infobox failed.");
+                    throw new ValidateException("validator.40", new Object[]{
+                            friendlyName,
+                            infoboxValidationResult.getErrorMessage()});
+                }
+                String form = infoboxvalidator.getForm();
+                if (ParepUtils.isEmpty(form)) {
+                    AddAdditionalSAMLAttributes(
+                            session,
+                            infoboxValidationResult.getExtendedSamlAttributes(),
+                            identifier, friendlyName);
+                } else {
+                    return "Redirect to Input Processor";
+                }
+            }
+        }
+
+        VerifyXMLSignatureResponse vsresp = new VerifyXMLSignatureResponse();
+        X509Certificate cert = session.getSignerCertificate();
+        vsresp.setX509certificate(cert);
+
+        session.setAuthenticatedUsed(false);
+        session.setAuthenticated(true);
+
+
+        session.setXMLVerifySignatureResponse(vsresp);
+        session.setSignerCertificate(vsresp.getX509certificate());
+        vsresp.setX509certificate(null);
+        session.setForeigner(true);
+
+        //TODO: regenerate MOASession ID!
+        return "new Session";
+    }
+
+    /**
+     * Builds the AuthenticationData object together with the corresponding
+     * <code>&lt;saml:Assertion&gt;</code>
+     *
+     * @param session          authentication session
+     * @param verifyXMLSigResp VerifyXMLSignatureResponse from MOA-SP
+     * @param useUTC           uses correct UTC time format
+     * @param useUTC           indicates that authenticated citizen is a foreigner
+     * @param isForeigner      indicates whether Austrian (false) or foreigner (true) authenticates
+     * @return AuthenticationData object
+     * @throws ConfigurationException while accessing configuration data
+     * @throws BuildException         while building the <code>&lt;saml:Assertion&gt;</code>
+     */
+    public static AuthenticationData buildAuthenticationData(
+            AuthenticationSession session, OAAuthParameter oaParam, String target)
+            throws ConfigurationException, BuildException {
 
 		IdentityLink identityLink = session.getIdentityLink();
 		AuthenticationData authData = new AuthenticationData();
@@ -1511,272 +1476,194 @@ public class AuthenticationServer implements MOAIDAuthConstants {
 				authData.setBPKType(Constants.URN_PREFIX_CDID + "+" + "OW");
 				authData.setIdentityLink(identityLink);
 				Logger.trace("Authenticated User is OW: " + mandate.getOWbPK());
-					
-			} else {
-
-				if (businessService) {
-					//since we have foreigner, wbPK is not calculated in BKU
-					if(identityLink.getIdentificationType().equals(Constants.URN_PREFIX_BASEID)) {
-
-					 	String registerAndOrdNr = oaParam.getIdentityLinkDomainIdentifier();
-
-						if (registerAndOrdNr.startsWith(AuthenticationSession.REGISTERANDORDNR_PREFIX_)) {
-							// If domainIdentifier starts with prefix
-							// "urn:publicid:gv.at:wbpk+"; remove this prefix
-							registerAndOrdNr = registerAndOrdNr
-									.substring(AuthenticationSession.REGISTERANDORDNR_PREFIX_.length());
-							Logger.debug("Register and ordernumber prefix stripped off; resulting register string: "
-									+ registerAndOrdNr);
-						}
-
-						String wbpkBase64 = new BPKBuilder().buildWBPK(identityLink.getIdentificationValue(), registerAndOrdNr);
-						authData.setBPK(wbpkBase64);
-						authData.setBPKType( Constants.URN_PREFIX_WBPK + "+" + registerAndOrdNr);
-
-					} else {
-						authData.setBPK(identityLink.getIdentificationValue());
-						authData.setBPKType(identityLink.getIdentificationType());
-
-					}
-
-					Logger.trace("Authenticate user with wbPK " + authData.getBPK());
-
-					Element idlassertion = session.getIdentityLink().getSamlAssertion();
-					//set bpk/wpbk;
-					Node prIdentification = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_IDENT_VALUE_XPATH);
-					prIdentification.getFirstChild().setNodeValue(authData.getBPK());
-					//set bkp/wpbk type
-					Node prIdentificationType = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_IDENT_TYPE_XPATH);
-					prIdentificationType.getFirstChild().setNodeValue(authData.getBPKType());
-
-					IdentityLinkAssertionParser idlparser = new IdentityLinkAssertionParser(idlassertion);
-					IdentityLink idl = idlparser.parseIdentityLink();
-					authData.setIdentityLink(idl);
-
-				} else {
-
-					if(identityLink.getIdentificationType().equals(Constants.URN_PREFIX_BASEID)) {
-						// only compute bPK if online application is a public service and we have the Stammzahl
-						String bpkBase64 = new BPKBuilder().buildBPK(identityLink.getIdentificationValue(), target);
-						authData.setBPK(bpkBase64);
-						authData.setBPKType(Constants.URN_PREFIX_CDID + "+" + oaParam.getTarget());
-					}
-
-					Logger.trace("Authenticate user with bPK " + authData.getBPK());
 
-					authData.setIdentityLink(identityLink);
-				}
-			}
+            } else {
 
-			return authData;
+                if (businessService) {
+                    //since we have foreigner, wbPK is not calculated in BKU
+                    if (identityLink.getIdentificationType().equals(Constants.URN_PREFIX_BASEID)) {
 
-		} catch (Throwable ex) {
-			throw new BuildException("builder.00", new Object[] {
-					"AuthenticationData", ex.toString() }, ex);
-		}
-	}
-
-	/**
-	 * Retrieves a session from the session store.
-	 *
-	 * @param id
-	 *            session ID
-	 * @return <code>AuthenticationSession</code> stored with given session ID,
-	 *         <code>null</code> if session ID unknown
-	 */
-	public static AuthenticationSession getSession(String id)
-			throws AuthenticationException {
-
-		AuthenticationSession session;
-		try {
-			session = AuthenticationSessionStoreage.getSession(id);
-
-			if (session == null)
-				throw new AuthenticationException("auth.02", new Object[] { id });
-			return session;
-
-		} catch (MOADatabaseException e) {
-			throw new AuthenticationException("parser.04", new Object[] { id });
-		}
-	}
-
-	/**
-	 * Cleans up expired session and authentication data stores.
-	 */
-	public void cleanup() {
-		long now = new Date().getTime();
-
-		//clean AuthenticationSessionStore
-
-		AuthenticationSessionStoreage.clean(now, sessionTimeOutCreated, sessionTimeOutUpdated);
-
-		//clean AssertionStore
-		AssertionStorage assertionstore = AssertionStorage.getInstance();
-		assertionstore.clean(now, authDataTimeOut);
-
-		//clean ExeptionStore
-		DBExceptionStoreImpl exstore = DBExceptionStoreImpl.getStore();
-		exstore.clean(now, authDataTimeOut);
-
-	}
-
-	/**
-	 * Sets the sessionTimeOut.
-	 *
-	 * @param seconds
-	 *            Time out of the session in seconds
-	 */
-	public void setSecondsSessionTimeOutCreated(long seconds) {
-		sessionTimeOutCreated = seconds * 1000;
-	}
-
-	public void setSecondsSessionTimeOutUpdated(long seconds) {
-		sessionTimeOutUpdated = seconds * 1000;
-	}
-
-	/**
-	 * Sets the authDataTimeOut.
-	 *
-	 * @param seconds
-	 *            Time out for signing AuthData in seconds
-	 */
-	public void setSecondsAuthDataTimeOut(long seconds) {
-		authDataTimeOut = seconds * 1000;
-	}
-
-	/**
-	 * Checks a parameter.
-	 *
-	 * @param param
-	 *            parameter
-	 * @return true if the parameter is null or empty
-	 */
-	private boolean isEmpty(String param) {
-		return param == null || param.length() == 0;
-	}
-
-	/**
-	 * Checks the correctness of SAML attributes and returns its value.
-	 *
-	 * @param param
-	 *            samlAttribute
-	 * @param i
-	 *            the number of the verified attribute for messages
-	 * @param identifier
-	 *            the infobox identifier for messages
-	 * @param friendlyname
-	 *            the friendly name of the infobox for messages
-	 * @return the SAML attribute value (Element or String)
-	 */
-	protected static Object verifySAMLAttribute(
-			ExtendedSAMLAttribute samlAttribute, int i, String identifier,
-			String friendlyName) throws ValidateException {
-		String name = samlAttribute.getName();
-
-		if (name == null) {
-			Logger.info("The name of SAML-Attribute number " + (i + 1)
-					+ " returned from " + identifier
-					+ "-infobox validator is null.");
-			throw new ValidateException("validator.45", new Object[] {
-					friendlyName, "Name", String.valueOf((i + 1)), "null" });
-		}
-		if (name == "") {
-			Logger.info("The name of SAML-Attribute number " + (i + 1)
-					+ " returned from " + identifier
-					+ "-infobox validator is empty.");
-			throw new ValidateException("validator.45", new Object[] {
-					friendlyName, "Name", String.valueOf((i + 1)), "leer" });
-		}
-		if (samlAttribute.getNameSpace() == null) {
-			Logger.info("The namespace of SAML-Attribute number " + (i + 1)
-					+ " returned from " + identifier
-					+ "-infobox validator is null.");
-			throw new ValidateException("validator.45",
-					new Object[] { friendlyName, "Namespace",
-							String.valueOf((i + 1)), "null" });
-		}
-		Object value = samlAttribute.getValue();
-		if (value == null) {
-			Logger.info("The value of SAML-Attribute number " + (i + 1)
-					+ " returned from " + identifier
-					+ "-infobox validator is null.");
-			throw new ValidateException("validator.45", new Object[] {
-					friendlyName, "Wert", String.valueOf((i + 1)), "null" });
-		}
-
-		return value;
-	}
-
-	/**
-	   * Does the request to the SZR-GW
-	 * @param oaFriendlyName 
-	 * @param signature XMLDSIG signature
-	   * @return Identity link assertion
-	 * @throws SZRGWClientException 
-	   */
-
-	     public CreateIdentityLinkResponse getIdentityLink(String PEPSIdentifier, String PEPSFirstname, String PEPSFamilyname, String PEPSDateOfBirth, String gender, String citizenSignature, String represented, String representative, String mandateContent, String organizationAddress, String organizationType, String targetType, String targetValue, String oaFriendlyName, List<String> filters, String PEPSFiscalNumber) throws SZRGWClientException {
-
-			try {
-		    	AuthConfigurationProvider authConf = AuthConfigurationProvider.getInstance();
-		    	ConnectionParameter connectionParameters = authConf.getForeignIDConnectionParameter();
-
-		    	SZRGWClient client = new SZRGWClient(connectionParameters);
-		    	 
-		    	
-		    	CreateIdentityLinkRequest request = new CreateIdentityLinkRequest();
-		    	request.setSignature(citizenSignature.getBytes());
-	    	
-		    	PEPSData data = new PEPSData();
-		    	data.setDateOfBirth(PEPSDateOfBirth);
-		    	data.setFamilyname(PEPSFamilyname);
-		    	data.setFirstname(PEPSFirstname);
-		    	data.setIdentifier(PEPSIdentifier);
-		    	data.setFiscalNumber(PEPSFiscalNumber);
-
-		    	data.setRepresentative(representative);
-		    	data.setRepresented(represented);
-		    	data.setMandateContent(mandateContent);
-		    	
-		    	data.setLegalPersonCanonicalRegisteredAddress(organizationAddress);
-		    	data.setLegalPersonTranslatableType(organizationType);
-
-		    	if(null != mandateContent) {
-			    	MISType mis = new MISType();
-			    	
-			    	Target targetObject = new Target();
-			    	targetObject.setType(targetType);
-			    	targetObject.setValue(targetValue);
-			    	mis.setTarget(targetObject);
-			    	
-			    	mis.setOAFriendlyName(oaFriendlyName);
-			    	
-			    	Filters filterObject = new Filters();
-			    	MandateIdentifiers mandateIds = new MandateIdentifiers();
-			    	
-			    	//TODO!
-			        for(String current : filters)
-			        	mandateIds.getMandateIdentifier().add(current.trim());
-			    	filterObject.setMandateIdentifiers(mandateIds);
-			    	mis.setFilters(filterObject);
-			    	
-			    	request.setMIS(mis);
-		    	}
-		    	
-		    	Logger.info("Starte Kommunikation mit dem Stammzahlenregister Gateway(" + connectionParameters.getUrl() + ")...");
-				CreateIdentityLinkResponse response = client.sentCreateIDLRequest(request , connectionParameters.getUrl());
-				return response;
-		    	
-		    }
-		    catch (ConfigurationException e) {
-		    	Logger.warn(e);
-		    	Logger.warn(MOAIDMessageProvider.getInstance().getMessage("config.12", null ));
-			}
-		    
-		    return null;
-		
-	  }
+                        String registerAndOrdNr = oaParam.getIdentityLinkDomainIdentifier();
 
+                        if (registerAndOrdNr.startsWith(AuthenticationSession.REGISTERANDORDNR_PREFIX_)) {
+                            // If domainIdentifier starts with prefix
+                            // "urn:publicid:gv.at:wbpk+"; remove this prefix
+                            registerAndOrdNr = registerAndOrdNr
+                                    .substring(AuthenticationSession.REGISTERANDORDNR_PREFIX_.length());
+                            Logger.debug("Register and ordernumber prefix stripped off; resulting register string: "
+                                    + registerAndOrdNr);
+                        }
+
+                        String wbpkBase64 = new BPKBuilder().buildWBPK(identityLink.getIdentificationValue(), registerAndOrdNr);
+                        authData.setBPK(wbpkBase64);
+                        authData.setBPKType(Constants.URN_PREFIX_WBPK + "+" + registerAndOrdNr);
+
+                    } else {
+                        authData.setBPK(identityLink.getIdentificationValue());
+                        authData.setBPKType(identityLink.getIdentificationType());
+
+                    }
+
+                    Logger.trace("Authenticate user with wbPK " + authData.getBPK());
+
+                    Element idlassertion = session.getIdentityLink().getSamlAssertion();
+                    //set bpk/wpbk;
+                    Node prIdentification = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_IDENT_VALUE_XPATH);
+                    prIdentification.getFirstChild().setNodeValue(authData.getBPK());
+                    //set bkp/wpbk type
+                    Node prIdentificationType = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_IDENT_TYPE_XPATH);
+                    prIdentificationType.getFirstChild().setNodeValue(authData.getBPKType());
+
+                    IdentityLinkAssertionParser idlparser = new IdentityLinkAssertionParser(idlassertion);
+                    IdentityLink idl = idlparser.parseIdentityLink();
+                    authData.setIdentityLink(idl);
+
+                } else {
+
+                    if (identityLink.getIdentificationType().equals(Constants.URN_PREFIX_BASEID)) {
+                        // only compute bPK if online application is a public service and we have the Stammzahl
+                        String bpkBase64 = new BPKBuilder().buildBPK(identityLink.getIdentificationValue(), target);
+                        authData.setBPK(bpkBase64);
+                        authData.setBPKType(Constants.URN_PREFIX_CDID + "+" + oaParam.getTarget());
+                    }
+
+                    Logger.trace("Authenticate user with bPK " + authData.getBPK());
+
+                    authData.setIdentityLink(identityLink);
+                }
+            }
+
+            return authData;
+
+        } catch (Throwable ex) {
+            throw new BuildException("builder.00", new Object[]{
+                    "AuthenticationData", ex.toString()}, ex);
+        }
+    }
+
+    /**
+     * Retrieves a session from the session store.
+     *
+     * @param id session ID
+     * @return <code>AuthenticationSession</code> stored with given session ID,
+     * <code>null</code> if session ID unknown
+     */
+    public static AuthenticationSession getSession(String id)
+            throws AuthenticationException {
+
+        AuthenticationSession session;
+        try {
+            session = AuthenticationSessionStoreage.getSession(id);
+
+            if (session == null)
+                throw new AuthenticationException("auth.02", new Object[]{id});
+            return session;
+
+        } catch (MOADatabaseException e) {
+            throw new AuthenticationException("parser.04", new Object[]{id});
+        }
+    }
+
+    /**
+     * Cleans up expired session and authentication data stores.
+     */
+    public void cleanup() {
+        long now = new Date().getTime();
+
+        //clean AuthenticationSessionStore
+
+        AuthenticationSessionStoreage.clean(now, sessionTimeOutCreated, sessionTimeOutUpdated);
+
+        //clean AssertionStore
+        AssertionStorage assertionstore = AssertionStorage.getInstance();
+        assertionstore.clean(now, authDataTimeOut);
+
+        //clean ExeptionStore
+        DBExceptionStoreImpl exstore = DBExceptionStoreImpl.getStore();
+        exstore.clean(now, authDataTimeOut);
+
+    }
+
+    /**
+     * Sets the sessionTimeOut.
+     *
+     * @param seconds Time out of the session in seconds
+     */
+    public void setSecondsSessionTimeOutCreated(long seconds) {
+        sessionTimeOutCreated = seconds * 1000;
+    }
+
+    public void setSecondsSessionTimeOutUpdated(long seconds) {
+        sessionTimeOutUpdated = seconds * 1000;
+    }
+
+    /**
+     * Sets the authDataTimeOut.
+     *
+     * @param seconds Time out for signing AuthData in seconds
+     */
+    public void setSecondsAuthDataTimeOut(long seconds) {
+        authDataTimeOut = seconds * 1000;
+    }
+
+    /**
+     * Checks a parameter.
+     *
+     * @param param parameter
+     * @return true if the parameter is null or empty
+     */
+    private boolean isEmpty(String param) {
+        return param == null || param.length() == 0;
+    }
+
+    /**
+     * Checks the correctness of SAML attributes and returns its value.
+     *
+     * @param param        samlAttribute
+     * @param i            the number of the verified attribute for messages
+     * @param identifier   the infobox identifier for messages
+     * @param friendlyname the friendly name of the infobox for messages
+     * @return the SAML attribute value (Element or String)
+     */
+    protected static Object verifySAMLAttribute(
+            ExtendedSAMLAttribute samlAttribute, int i, String identifier,
+            String friendlyName) throws ValidateException {
+        String name = samlAttribute.getName();
+
+        if (name == null) {
+            Logger.info("The name of SAML-Attribute number " + (i + 1)
+                    + " returned from " + identifier
+                    + "-infobox validator is null.");
+            throw new ValidateException("validator.45", new Object[]{
+                    friendlyName, "Name", String.valueOf((i + 1)), "null"});
+        }
+        if (name == "") {
+            Logger.info("The name of SAML-Attribute number " + (i + 1)
+                    + " returned from " + identifier
+                    + "-infobox validator is empty.");
+            throw new ValidateException("validator.45", new Object[]{
+                    friendlyName, "Name", String.valueOf((i + 1)), "leer"});
+        }
+        if (samlAttribute.getNameSpace() == null) {
+            Logger.info("The namespace of SAML-Attribute number " + (i + 1)
+                    + " returned from " + identifier
+                    + "-infobox validator is null.");
+            throw new ValidateException("validator.45",
+                    new Object[]{friendlyName, "Namespace",
+                            String.valueOf((i + 1)), "null"});
+        }
+        Object value = samlAttribute.getValue();
+        if (value == null) {
+            Logger.info("The value of SAML-Attribute number " + (i + 1)
+                    + " returned from " + identifier
+                    + "-infobox validator is null.");
+            throw new ValidateException("validator.45", new Object[]{
+                    friendlyName, "Wert", String.valueOf((i + 1)), "null"});
+        }
+        
+        return value;
+    }
+	
 	/**
 	 * Does the request to the SZR-GW.
 	 *
@@ -1788,7 +1675,7 @@ public class AuthenticationServer implements MOAIDAuthConstants {
 	public CreateIdentityLinkResponse getIdentityLink(Element signature) throws SZRGWClientException, ConfigurationException {
 		return getIdentityLink(null, null, null, null, XMLHelper.nodeToString(signature), null);
 	}
-
+    
 	/**
 	 * Does the request to the SZR-GW.
 	 *
@@ -1804,26 +1691,6 @@ public class AuthenticationServer implements MOAIDAuthConstants {
 	public CreateIdentityLinkResponse getIdentityLink(String PEPSIdentifier, String PEPSFirstname, String PEPSFamilyname, String PEPSDateOfBirth, String signature, String PEPSFiscalNumber) throws SZRGWClientException {
 		return getIdentityLink(PEPSIdentifier, PEPSFirstname, PEPSFamilyname, PEPSDateOfBirth, null, signature, null, null, null, null, null, null, null, PEPSFiscalNumber);
 	}
-
-	/**
-	 * Gets the identity link.
-	 *
-	 * @param citizenSignature the citizen signature
-	 * @param representative the representative
-	 * @param represented the represented
-	 * @param mandate the mandate
-	 * @param organizationAddress the organization address
-	 * @param organizationType the organization type
-	 * @return the identity link
-	 * @throws SZRGWClientException 
-	 */
-	public CreateIdentityLinkResponse getIdentityLink(String citizenSignature,
-			String representative, String represented, String mandateContent,
-			String organizationAddress, String organizationType, String targetType, String targetValue, String oaFriendlyName, List<String> filters, String PEPSFiscalNumber) throws SZRGWClientException {
-		return getIdentityLink(null, null, null, null, null,
-				citizenSignature, represented, representative, mandateContent, organizationAddress,
-				organizationType, targetType, targetValue, oaFriendlyName, filters, PEPSFiscalNumber);
-	}
 	
  	/**
 	  * SZR-GW Client interface.
@@ -1847,265 +1714,326 @@ public class AuthenticationServer implements MOAIDAuthConstants {
  				citizenSignature, representative, represented, mandate, null,
  				null, targetType, targetValue, oaFriendlyName, filters, PEPSFiscalNumber);
  	}
+	
+		/**
+		 * Gets the identity link.
+		 *
+		 * @param citizenSignature the citizen signature
+		 * @param representative the representative
+		 * @param represented the represented
+		 * @param mandate the mandate
+		 * @param organizationAddress the organization address
+		 * @param organizationType the organization type
+		 * @return the identity link
+		 * @throws SZRGWClientException 
+		 */
+		public CreateIdentityLinkResponse getIdentityLink(String citizenSignature,
+				String representative, String represented, String mandateContent,
+				String organizationAddress, String organizationType, String targetType, String targetValue, String oaFriendlyName, List<String> filters, String PEPSFiscalNumber) throws SZRGWClientException {
+			return getIdentityLink(null, null, null, null, null,
+					citizenSignature, represented, representative, mandateContent, organizationAddress,
+					organizationType, targetType, targetValue, oaFriendlyName, filters, PEPSFiscalNumber);
+		}	 
+	 
+    public CreateIdentityLinkResponse getIdentityLink(String PEPSIdentifier, String PEPSFirstname, String PEPSFamilyname, String PEPSDateOfBirth, String gender, String citizenSignature, String represented, String representative, String mandateContent, String organizationAddress, String organizationType, String targetType, String targetValue, String oaFriendlyName, List<String> filters, String PEPSFiscalNumber) throws SZRGWClientException {
 
-	/**
-	 * Starts a MOA-ID authentication process using STORK
-	 * @param req HttpServletRequest
-	 * @param resp HttpServletResponse
-	 * @param ccc Citizen country code
-	 * @param oaURL URL of the online application
-	 * @param target Target parameter
-	 * @param targetFriendlyName Friendly Name of Target
-	 * @param authURL Authentication URL
-	 * @param sourceID SourceID parameter
-	 * @throws MOAIDException
-	 * @throws AuthenticationException
-	 * @throws WrongParametersException
-	 * @throws ConfigurationException
-	 */
-	public static void startSTORKAuthentication(
-			HttpServletRequest req,
-			HttpServletResponse resp,
-			AuthenticationSession moasession) throws MOAIDException, AuthenticationException, WrongParametersException, ConfigurationException {
-
-		if (moasession == null) {
-			throw new AuthenticationException("auth.18", new Object[] { });
-		}
-
-		//read configuration paramters of OA
-		OAAuthParameter oaParam = AuthConfigurationProvider.getInstance().getOnlineApplicationParameter(moasession.getPublicOAURLPrefix());
-		if (oaParam == null)
-				throw new AuthenticationException("auth.00", new Object[] { moasession.getPublicOAURLPrefix() });
-
-		//Start of STORK Processing
-		STORKConfig storkConfig = AuthConfigurationProvider.getInstance().getStorkConfig();
-
-		CPEPS cpeps = storkConfig.getCPEPS(moasession.getCcc());
-
-		Logger.debug("Preparing to assemble STORK AuthnRequest witt the following values:");
-    	String destination = cpeps.getPepsURL().toExternalForm();
-    	Logger.debug("C-PEPS URL: " + destination);
-
-    	String issuerValue = AuthConfigurationProvider.getInstance().getPublicURLPrefix();
-    	String providerName= oaParam.getFriendlyName();
-    	Logger.debug("Issuer value: " + issuerValue);
-    	
-//    	String acsURL = issuerValue + PEPSConnectorServlet.PEPSCONNECTOR_SERVLET_URL_PATTERN
-    	String acsURL = new DataURLBuilder().buildDataURL(issuerValue, 
-    			PEPSConnectorServlet.PEPSCONNECTOR_SERVLET_URL_PATTERN, moasession.getSessionID());    			
-    	Logger.debug("MOA Assertion Consumer URL (PEPSConnctor): " + acsURL);
-
-    	// prepare collection of required attributes
-    	// - attributes for online application
-    	List<OAStorkAttribute> attributesFromConfig = oaParam.getRequestedAttributes();
-
-    	// - prepare attribute list
-    	PersonalAttributeList attributeList = new PersonalAttributeList();
-
-    	// - fill container
-    	for(OAStorkAttribute current : attributesFromConfig) {
-	    	PersonalAttribute newAttribute = new PersonalAttribute();
-	    	newAttribute.setName(current.getName());
-
-	    	boolean globallyMandatory = false;
-	    	for(StorkAttribute currentGlobalAttribute : storkConfig.getStorkAttributes())
-	    		if(current.getName().equals(currentGlobalAttribute.getName())) {
-	    			globallyMandatory = currentGlobalAttribute.isMandatory();
-	    			break;
-	    		}
-
-	    	newAttribute.setIsRequired(current.isMandatory() || globallyMandatory);
-	    	attributeList.add(newAttribute);
-    	}
-
-    	// add sign request
-    	PersonalAttribute newAttribute = new PersonalAttribute();
-    	newAttribute.setName("signedDoc");
-    	List<String> value = new ArrayList<String>();
-    	value.add(generateDssSignRequest(CreateXMLSignatureRequestBuilder.buildForeignIDTextToBeSigned("wie im  Signaturzertifikat (as in my signature certificate)", oaParam, moasession),
-    			"application/xhtml+xml",
-    			moasession.getCcc()));
-    	newAttribute.setValue(value);
-    	attributeList.add(newAttribute);
-
-
-		if (Logger.isDebugEnabled()) {
-			Logger.debug("The following attributes are requested for this OA:");
-			for (OAStorkAttribute logReqAttr : attributesFromConfig)
-				Logger.debug("OA specific requested attribute: " + logReqAttr.getName() + ", isRequired: " + logReqAttr.isMandatory());
-		}
-
-		//TODO: check Target in case of SSO!!
-    	String spSector = StringUtils.isEmpty(moasession.getTarget()) ? "Business" : moasession.getTarget();
-    	String spInstitution = StringUtils.isEmpty(oaParam.getFriendlyName()) ? "UNKNOWN" : oaParam.getFriendlyName();
-    	String spApplication = spInstitution;
-    	String spCountry = "AT";
-
-    	//generate AuthnRquest
-    	STORKAuthnRequest authnRequest = new STORKAuthnRequest();
-    	authnRequest.setDestination(destination);
-    	authnRequest.setAssertionConsumerServiceURL(acsURL);
-    	authnRequest.setProviderName(providerName);
-    	authnRequest.setIssuer(issuerValue);
-    	authnRequest.setQaa(oaParam.getQaaLevel());
-    	authnRequest.setSpInstitution(spInstitution);
-    	authnRequest.setCountry(spCountry);
-    	authnRequest.setSpApplication(spApplication);
-    	authnRequest.setSpSector(spSector);
-    	authnRequest.setPersonalAttributeList(attributeList);
-
-    	authnRequest.setEIDCrossBorderShare(true);
-    	authnRequest.setEIDCrossSectorShare(true);
-    	authnRequest.setEIDSectorShare(true);
-
-    	authnRequest.setCitizenCountryCode(moasession.getCcc());
-
-
-    	Logger.debug("STORK AuthnRequest succesfully assembled.");
-
-    	STORKSAMLEngine samlEngine = null;
-    	
-    	try {
-    		samlEngine = STORKSAMLEngine.getInstance("outgoing");
-    		
-    	} catch (Exception e) {
-    		Logger.error("STORK engine initialization FAILED with error " 
-    				+ e.getLocalizedMessage(), e);
-    		throw new MOAIDException("stork.11", null, e);
-  	    		
-    	}
-    	if (samlEngine == null)
-    		throw new MOAIDException("stork.11", null);
-    		
-    		
-    	try {
-    		authnRequest = samlEngine.generateSTORKAuthnRequest(authnRequest);
-    					
-		} catch (Exception e ) {
-			Logger.error("Could not sign STORK SAML AuthnRequest.", e);
-			throw new MOAIDException("stork.00", null, e);
-		}
-
-		Logger.info("STORK AuthnRequest successfully signed!");
-		
-    	//validate AuthnRequest
-		try {
-			samlEngine.validateSTORKAuthnRequest(authnRequest.getTokenSaml());
-			
-		} catch (Exception e) {
-			Logger.error("STORK SAML AuthnRequest not valid.", e);
-			throw new MOAIDException("stork.01", null);
-			
-		}
-		
-		Logger.debug("STORK AuthnRequest successfully internally validated.");
-		
-		//send
-		moasession.setStorkAuthnRequest(authnRequest);
-//		HttpSession httpSession = req.getSession();
-//		httpSession.setAttribute("MOA-Session-ID", moasession.getSessionID());
-
-
-		Logger.info("Preparing to send STORK AuthnRequest.");
-		Logger.info("prepared STORKAuthnRequest: ");
-		Logger.info(new String(authnRequest.getTokenSaml()));
-
-		try {
-			Logger.trace("Initialize VelocityEngine...");
-
-			VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
-			Template template = velocityEngine.getTemplate("/resources/templates/saml2-post-binding-moa.vm");
-			VelocityContext context = new VelocityContext();
-			context.put("SAMLRequest", PEPSUtil.encodeSAMLToken(authnRequest.getTokenSaml()));
-			context.put("action", destination);
-
-			StringWriter writer = new StringWriter();
-			template.merge(context, writer);
-
-			resp.getOutputStream().write(writer.toString().getBytes());
-		} catch (Exception e) {
-			Logger.error("Error sending STORK SAML AuthnRequest.", e);
-			//httpSession.invalidate();
-			throw new MOAIDException("stork.02", new Object[] { destination });
-		}
-
-		Logger.info("STORK AuthnRequest successfully successfully prepared for client with target location: " + authnRequest.getDestination());
-	}
-
-	private static String generateDssSignRequest(String text, String  mimeType, String citizenCountry) {
-		IdentifierGenerator idGenerator;
-		try {
-			idGenerator = new SecureRandomIdentifierGenerator();
-			
-			DocumentType doc = new DocumentType();
-			doc.setBase64XML(text.getBytes());
-			doc.setID(idGenerator.generateIdentifier());
-			
-			SignRequest request = new SignRequest();
-			request.setInputDocuments(ApiUtils.createInputDocuments(doc));
-			
-			String id = idGenerator.generateIdentifier();
-			request.setRequestID(id);
-			request.setDocUI(id);
-			
-			request.setProfile(Profiles.XADES_BES.toString());
-			request.setNumberOfSigners(BigInteger.ONE);
-			request.setTargetCountry(citizenCountry);
-
-			// no, no todo. PEPS will alter this value anyhow.
-			request.setReturnURL("http://invalid_return");
-			
-			AnyType required = new AnyType();
-			required.getAny().add(ApiUtils.createSignatureType(SignatureTypes.XMLSIG_RFC3275.toString()));
-			required.getAny().add(ApiUtils.createAdditionalProfile(AdditionalProfiles.XADES.toString()));
-			required.getAny().add(ApiUtils.createQualityRequirements(QualityLevels.QUALITYLEVEL_QUALIFIEDSIG));
-			required.getAny().add(ApiUtils.createIncludeObject(doc));
-			request.setOptionalInputs(required);
-			
-			return IOUtils.toString(ApiUtils.marshalToInputStream(request));
-		} catch (NoSuchAlgorithmException e) {
-			Logger.error("Cannot generate id", e);
-			throw new RuntimeException(e);
-		} catch (ApiUtilsException e) {
-			Logger.error("Could not create SignRequest", e);
-			throw new RuntimeException(e);
-		} catch (DOMException e) {
-			Logger.error("Could not create SignRequest", e);
-			throw new RuntimeException(e);
-		} catch (IOException e) {
-			Logger.error("Could not create SignRequest", e);
-			throw new RuntimeException(e);
-		}
-	}
-
-	/**
-	 * Extracts an X509 Certificate out of an XML signagture element
-	 * @param signedXML XML signature element
-	 * @return X509Certificate
-	 * @throws CertificateException
-	 */
-	public static X509Certificate getCertificateFromXML(Element signedXML) throws CertificateException {
-
-		NodeList nList = signedXML.getElementsByTagNameNS(Constants.DSIG_NS_URI, "X509Certificate");
-
-		String base64CertString = XMLUtil.getFirstTextValueFromNodeList(nList);
-
-		if (StringUtils.isEmpty(base64CertString)) {
-			String msg = "XML does not contain a X509Certificate element.";
-			Logger.error(msg);
-			throw new CertificateException(msg);
-		}
-
-		InputStream is = new ByteArrayInputStream(Base64.decode(base64CertString));
-
-		X509Certificate cert;
 		try {
-			cert = new X509Certificate(is);
-			return cert;
+	    	AuthConfigurationProvider authConf = AuthConfigurationProvider.getInstance();
+	    	ConnectionParameter connectionParameters = authConf.getForeignIDConnectionParameter();
 
-		} catch (Throwable e) {
-			throw new CertificateException(e);
+	    	SZRGWClient client = new SZRGWClient(connectionParameters);
+	    	 	    	
+	    	CreateIdentityLinkRequest request = new CreateIdentityLinkRequest();
+	    	request.setSignature(citizenSignature.getBytes());
+	
+            PEPSData data = new PEPSData();
+            data.setDateOfBirth(PEPSDateOfBirth);
+            data.setFamilyname(PEPSFamilyname);
+            data.setFirstname(PEPSFirstname);
+            data.setIdentifier(PEPSIdentifier);
+
+            data.setRepresentative(representative);
+            data.setRepresented(represented);
+            data.setMandateContent(mandateContent);
+
+            data.setLegalPersonCanonicalRegisteredAddress(organizationAddress);
+            data.setLegalPersonTranslatableType(organizationType);
+
+            if (null != mandateContent) {
+                MISType mis = new MISType();
+
+                Target targetObject = new Target();
+                targetObject.setType(targetType);
+                targetObject.setValue(targetValue);
+                mis.setTarget(targetObject);
+
+                mis.setOAFriendlyName(oaFriendlyName);
+
+                Filters filterObject = new Filters();
+                MandateIdentifiers mandateIds = new MandateIdentifiers();
+		        for(String current : filters)
+		        	mandateIds.getMandateIdentifier().add(current.trim());
+		    	filterObject.setMandateIdentifiers(mandateIds);
+		    	mis.setFilters(filterObject);
+
+                request.setMIS(mis);
+            }
+
+            Logger.info("Starte Kommunikation mit dem Stammzahlenregister Gateway(" + connectionParameters.getUrl() + ")...");
+            CreateIdentityLinkResponse response = client.sentCreateIDLRequest(request, connectionParameters.getUrl());
+            return response;
+            
+	    }
+	    catch (ConfigurationException e) {
+	    	Logger.warn(e);
+	    	Logger.warn(MOAIDMessageProvider.getInstance().getMessage("config.12", null ));
 		}
-	}
+	    
+	    return null;
+	
+  }
+
+    /**
+     * Starts a MOA-ID authentication process using STORK
+     *
+     * @param req                HttpServletRequest
+     * @param resp               HttpServletResponse
+     * @param ccc                Citizen country code
+     * @param oaURL              URL of the online application
+     * @param target             Target parameter
+     * @param targetFriendlyName Friendly Name of Target
+     * @param authURL            Authentication URL
+     * @param sourceID           SourceID parameter
+     * @throws MOAIDException
+     * @throws AuthenticationException
+     * @throws WrongParametersException
+     * @throws ConfigurationException
+     */
+    public static void startSTORKAuthentication(
+            HttpServletRequest req,
+            HttpServletResponse resp,
+            AuthenticationSession moasession) throws MOAIDException, AuthenticationException, WrongParametersException, ConfigurationException {
+
+        if (moasession == null) {
+            throw new AuthenticationException("auth.18", new Object[]{});
+        }
+
+        //read configuration paramters of OA
+        OAAuthParameter oaParam = AuthConfigurationProvider.getInstance().getOnlineApplicationParameter(moasession.getPublicOAURLPrefix());
+        if (oaParam == null)
+            throw new AuthenticationException("auth.00", new Object[]{moasession.getPublicOAURLPrefix()});
+
+        //Start of STORK Processing
+        STORKConfig storkConfig = AuthConfigurationProvider.getInstance().getStorkConfig();
+
+        CPEPS cpeps = storkConfig.getCPEPS(moasession.getCcc());
+
+        Logger.debug("Preparing to assemble STORK AuthnRequest with the following values:");
+        String destination = cpeps.getPepsURL().toExternalForm();
+        Logger.debug("C-PEPS URL: " + destination);
+
+        String acsURL = HTTPUtils.getBaseURL(req) + PEPSConnectorServlet.PEPSCONNECTOR_SERVLET_URL_PATTERN;
+        Logger.debug("MOA Assertion Consumer URL (PEPSConnctor): " + acsURL);
+
+        String providerName = oaParam.getFriendlyName();
+        String issuerValue = HTTPUtils.getBaseURL(req);
+        Logger.debug("Issuer value: " + issuerValue);
+
+        // prepare collection of required attributes
+        // - attributes for online application
+        List<OAStorkAttribute> attributesFromConfig = oaParam.getRequestedAttributes();
+
+        // - prepare attribute list
+        PersonalAttributeList attributeList = new PersonalAttributeList();
+
+        // - fill container
+        for (OAStorkAttribute current : attributesFromConfig) {
+            PersonalAttribute newAttribute = new PersonalAttribute();
+            newAttribute.setName(current.getName());
+
+            boolean globallyMandatory = false;
+            for (StorkAttribute currentGlobalAttribute : storkConfig.getStorkAttributes())
+                if (current.getName().equals(currentGlobalAttribute.getName())) {
+                    globallyMandatory = currentGlobalAttribute.isMandatory();
+                    break;
+                }
+
+            newAttribute.setIsRequired(current.isMandatory() || globallyMandatory);
+            attributeList.add(newAttribute);
+        }
+
+        // add sign request
+        PersonalAttribute newAttribute = new PersonalAttribute();
+        newAttribute.setName("signedDoc");
+        List<String> value = new ArrayList<String>();
+        value.add(generateDssSignRequest(CreateXMLSignatureRequestBuilder.buildForeignIDTextToBeSigned("wie im  Signaturzertifikat (as in my signature certificate)", oaParam, moasession),
+                "application/xhtml+xml",
+                moasession.getCcc()));
+        newAttribute.setValue(value);
+        attributeList.add(newAttribute);
+
+
+        if (Logger.isDebugEnabled()) {
+            Logger.debug("The following attributes are requested for this OA:");
+            for (OAStorkAttribute logReqAttr : attributesFromConfig)
+                Logger.debug("OA specific requested attribute: " + logReqAttr.getName() + ", isRequired: " + logReqAttr.isMandatory());
+        }
+
+        //TODO: check Target in case of SSO!!
+        String spSector = StringUtils.isEmpty(moasession.getTarget()) ? "Business" : moasession.getTarget();
+        String spInstitution = StringUtils.isEmpty(oaParam.getFriendlyName()) ? "UNKNOWN" : oaParam.getFriendlyName();
+        String spApplication = spInstitution;
+        String spCountry = "AT";
+
+        //generate AuthnRquest
+        STORKAuthnRequest authnRequest = new STORKAuthnRequest();
+        authnRequest.setDestination(destination);
+        authnRequest.setAssertionConsumerServiceURL(acsURL);
+        authnRequest.setProviderName(providerName);
+        authnRequest.setIssuer(issuerValue);
+        authnRequest.setQaa(oaParam.getQaaLevel());
+        authnRequest.setSpInstitution(spInstitution);
+        authnRequest.setCountry(spCountry);
+        authnRequest.setSpApplication(spApplication);
+        authnRequest.setSpSector(spSector);
+        authnRequest.setPersonalAttributeList(attributeList);
+
+        authnRequest.setEIDCrossBorderShare(true);
+        authnRequest.setEIDCrossSectorShare(true);
+        authnRequest.setEIDSectorShare(true);
+
+        authnRequest.setCitizenCountryCode(moasession.getCcc());
+
+
+        Logger.debug("STORK AuthnRequest succesfully assembled.");
+
+        STORKSAMLEngine samlEngine = STORKSAMLEngine.getInstance("outgoing");
+        try {
+            authnRequest = samlEngine.generateSTORKAuthnRequest(authnRequest);
+        } catch (STORKSAMLEngineException e) {
+            Logger.error("Could not sign STORK SAML AuthnRequest.", e);
+            throw new MOAIDException("stork.00", null);
+        }
+
+        Logger.info("STORK AuthnRequest successfully signed!");
+
+        //validate AuthnRequest
+        try {
+            samlEngine.validateSTORKAuthnRequest(authnRequest.getTokenSaml());
+        } catch (STORKSAMLEngineException e) {
+            Logger.error("STORK SAML AuthnRequest not valid.", e);
+            throw new MOAIDException("stork.01", null);
+        }
+
+        Logger.debug("STORK AuthnRequest successfully internally validated.");
+
+        //send
+        moasession.setStorkAuthnRequest(authnRequest);
+        HttpSession httpSession = req.getSession();
+        httpSession.setAttribute("MOA-Session-ID", moasession.getSessionID());
+
+
+        Logger.info("Preparing to send STORK AuthnRequest.");
+        Logger.info("prepared STORKAuthnRequest: ");
+        Logger.info(new String(authnRequest.getTokenSaml()));
+
+        try {
+            Logger.trace("Initialize VelocityEngine...");
+
+            VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
+            Template template = velocityEngine.getTemplate("/resources/templates/saml2-post-binding-moa.vm");
+            VelocityContext context = new VelocityContext();
+            context.put("SAMLRequest", PEPSUtil.encodeSAMLToken(authnRequest.getTokenSaml()));
+            context.put("action", destination);
+
+            StringWriter writer = new StringWriter();
+            template.merge(context, writer);
+
+            resp.getOutputStream().write(writer.toString().getBytes());
+        } catch (Exception e) {
+            Logger.error("Error sending STORK SAML AuthnRequest.", e);
+            httpSession.invalidate();
+            throw new MOAIDException("stork.02", new Object[]{destination});
+        }
+
+        Logger.info("STORK AuthnRequest successfully successfully prepared for client with target location: " + authnRequest.getDestination());
+    }
+
+    private static String generateDssSignRequest(String text, String mimeType, String citizenCountry) {
+        IdentifierGenerator idGenerator;
+        try {
+            idGenerator = new SecureRandomIdentifierGenerator();
+
+            DocumentType doc = new DocumentType();
+            doc.setBase64XML(text.getBytes());
+            doc.setID(idGenerator.generateIdentifier());
+
+            SignRequest request = new SignRequest();
+            request.setInputDocuments(ApiUtils.createInputDocuments(doc));
+
+            String id = idGenerator.generateIdentifier();
+            request.setRequestID(id);
+            request.setDocUI(id);
+
+            request.setProfile(Profiles.XADES_BES.toString());
+            request.setNumberOfSigners(BigInteger.ONE);
+            request.setTargetCountry(citizenCountry);
+
+            // no, no todo. PEPS will alter this value anyhow.
+            request.setReturnURL("http://invalid_return");
+
+            AnyType required = new AnyType();
+            required.getAny().add(ApiUtils.createSignatureType(SignatureTypes.XMLSIG_RFC3275.toString()));
+            required.getAny().add(ApiUtils.createAdditionalProfile(AdditionalProfiles.XADES.toString()));
+            required.getAny().add(ApiUtils.createQualityRequirements(QualityLevels.QUALITYLEVEL_QUALIFIEDSIG));
+            required.getAny().add(ApiUtils.createIncludeObject(doc));
+            request.setOptionalInputs(required);
+
+            return IOUtils.toString(ApiUtils.marshalToInputStream(request));
+        } catch (NoSuchAlgorithmException e) {
+            Logger.error("Cannot generate id", e);
+            throw new RuntimeException(e);
+        } catch (ApiUtilsException e) {
+            Logger.error("Could not create SignRequest", e);
+            throw new RuntimeException(e);
+        } catch (DOMException e) {
+            Logger.error("Could not create SignRequest", e);
+            throw new RuntimeException(e);
+        } catch (IOException e) {
+            Logger.error("Could not create SignRequest", e);
+            throw new RuntimeException(e);
+        }
+    }
+
+    /**
+     * Extracts an X509 Certificate out of an XML signagture element
+     *
+     * @param signedXML XML signature element
+     * @return X509Certificate
+     * @throws CertificateException
+     */
+    public static X509Certificate getCertificateFromXML(Element signedXML) throws CertificateException {
+
+        NodeList nList = signedXML.getElementsByTagNameNS(Constants.DSIG_NS_URI, "X509Certificate");
+
+        String base64CertString = XMLUtil.getFirstTextValueFromNodeList(nList);
+
+        if (StringUtils.isEmpty(base64CertString)) {
+            String msg = "XML does not contain a X509Certificate element.";
+            Logger.error(msg);
+            throw new CertificateException(msg);
+        }
+
+        InputStream is = new ByteArrayInputStream(Base64.decode(base64CertString));
+
+        X509Certificate cert;
+        try {
+            cert = new X509Certificate(is);
+            return cert;
+
+        } catch (Throwable e) {
+            throw new CertificateException(e);
+        }
+    }
 
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java
index bd87737ed..866c5a923 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java
@@ -2,19 +2,19 @@
  * Copyright 2014 Federal Chancellery Austria
  * MOA-ID has been developed in a cooperation between BRZ, the Federal
  * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- * 
+ *
  * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
  * the European Commission - subsequent versions of the EUPL (the "Licence");
  * You may not use this work except in compliance with the Licence.
  * You may obtain a copy of the Licence at:
  * http://www.osor.eu/eupl/
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the Licence is distributed on an "AS IS" basis,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the Licence for the specific language governing permissions and
  * limitations under the Licence.
- * 
+ *
  * This product combines work with different licenses. See the "NOTICE" text
  * file for details on the various modules and licenses.
  * The "NOTICE" text file is part of the distribution. Any derivative works
@@ -46,91 +46,148 @@
 
 package at.gv.egovernment.moa.id.auth.builder;
 
-import java.security.MessageDigest;
-
 import at.gv.egovernment.moa.id.auth.exception.BuildException;
+import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.Base64Utils;
 import at.gv.egovernment.moa.util.Constants;
 
+import java.security.MessageDigest;
+
 /**
  * Builder for the bPK, as defined in
  * <code>&quot;Ableitung f&uml;r die bereichsspezifische Personenkennzeichnung&quot;</code>
  * version <code>1.0.1</code> from <code>&quot;reference.e-government.gv.at&quot;</code>.
- *  
+ *
  * @author Paul Schamberger
  * @version $Id$
  */
 public class BPKBuilder {
 
-  /**
-   * Builds the bPK from the given parameters. 
-   * @param identificationValue Base64 encoded "Stammzahl" 
-   * @param target "Bereich lt. Verordnung des BKA"
-   * @return bPK in a BASE64 encoding
-   * @throws BuildException if an error occurs on building the bPK
-   */
-  public String buildBPK(String identificationValue, String target) 
-    throws BuildException {
-    
-    if ((identificationValue == null || 
-         identificationValue.length() == 0 ||
-    		 target == null || 
-         target.length() == 0)) 
-    {
-      throw new BuildException("builder.00", 
-      		                     new Object[] {"BPK", "Unvollständige Parameterangaben: identificationValue=" + 
-                                             identificationValue + ",target=" + target});
+    /**
+     * Builds the bPK from the given parameters.
+     *
+     * @param identificationValue Base64 encoded "Stammzahl"
+     * @param target              "Bereich lt. Verordnung des BKA"
+     * @return bPK in a BASE64 encoding
+     * @throws BuildException if an error occurs on building the bPK
+     */
+    public String buildBPK(String identificationValue, String target)
+            throws BuildException {
+
+        if ((identificationValue == null ||
+                identificationValue.length() == 0 ||
+                target == null ||
+                target.length() == 0)) {
+            throw new BuildException("builder.00",
+                    new Object[]{"BPK", "Unvollständige Parameterangaben: identificationValue=" +
+                            identificationValue + ",target=" + target});
+        }
+        String basisbegriff;
+        if (target.startsWith(Constants.URN_PREFIX_CDID + "+"))
+            basisbegriff = identificationValue + "+" + target;
+        else
+            basisbegriff = identificationValue + "+" + Constants.URN_PREFIX_CDID + "+" + target;
+
+        try {
+            MessageDigest md = MessageDigest.getInstance("SHA-1");
+            byte[] hash = md.digest(basisbegriff.getBytes("ISO-8859-1"));
+            String hashBase64 = Base64Utils.encode(hash);
+            return hashBase64;
+        } catch (Exception ex) {
+            throw new BuildException("builder.00", new Object[]{"bPK", ex.toString()}, ex);
+        }
     }
-    String basisbegriff;
-	if (target.startsWith(Constants.URN_PREFIX_CDID + "+"))
-		basisbegriff = identificationValue + "+" + target;
-	else
-		basisbegriff = identificationValue + "+" + Constants.URN_PREFIX_CDID + "+" + target;
-	
-    try {
-      MessageDigest md = MessageDigest.getInstance("SHA-1");
-      byte[] hash = md.digest(basisbegriff.getBytes("ISO-8859-1"));
-      String hashBase64 = Base64Utils.encode(hash);
-      return hashBase64;
-    } catch (Exception ex) {
-      throw new BuildException("builder.00", new Object[] {"bPK", ex.toString()}, ex);
+
+    /**
+     * Builds the wbPK from the given parameters.
+     *
+     * @param identificationValue Base64 encoded "Stammzahl"
+     * @param registerAndOrdNr    type of register + "+" + number in register.
+     * @return wbPK in a BASE64 encoding
+     * @throws BuildException if an error occurs on building the wbPK
+     */
+    public String buildWBPK(String identificationValue, String registerAndOrdNr)
+            throws BuildException {
+
+        if ((identificationValue == null ||
+                identificationValue.length() == 0 ||
+                registerAndOrdNr == null ||
+                registerAndOrdNr.length() == 0)) {
+            throw new BuildException("builder.00",
+                    new Object[]{"wbPK", "Unvollständige Parameterangaben: identificationValue=" +
+                            identificationValue + ",Register+Registernummer=" + registerAndOrdNr});
+        }
+
+        String basisbegriff;
+        if (registerAndOrdNr.startsWith(Constants.URN_PREFIX_WBPK + "+"))
+            basisbegriff = identificationValue + "+" + registerAndOrdNr;
+        else
+            basisbegriff = identificationValue + "+" + Constants.URN_PREFIX_WBPK + "+" + registerAndOrdNr;
+
+        try {
+            MessageDigest md = MessageDigest.getInstance("SHA-1");
+            byte[] hash = md.digest(basisbegriff.getBytes("ISO-8859-1"));
+            String hashBase64 = Base64Utils.encode(hash);
+            return hashBase64;
+        } catch (Exception ex) {
+            throw new BuildException("builder.00", new Object[]{"wbPK", ex.toString()}, ex);
+        }
     }
-  }
-
-  /**
-   * Builds the wbPK from the given parameters. 
-   * @param identificationValue Base64 encoded "Stammzahl" 
-   * @param registerAndOrdNr type of register + "+" + number in register.
-   * @return wbPK in a BASE64 encoding
-   * @throws BuildException if an error occurs on building the wbPK
-   */
-  public String buildWBPK(String identificationValue, String registerAndOrdNr) 
-    throws BuildException {
-    
-    if ((identificationValue == null || 
-         identificationValue.length() == 0 ||
-         registerAndOrdNr == null || 
-         registerAndOrdNr.length() == 0)) 
-    {
-      throw new BuildException("builder.00", 
-          new Object[] {"wbPK", "Unvollständige Parameterangaben: identificationValue=" + 
-                        identificationValue + ",Register+Registernummer=" + registerAndOrdNr});
+
+    /**
+     * Builds the storkeid from the given parameters.
+     *
+     * @param identificationValue Base64 encoded "Stammzahl"
+     * @param destinationCountry  destination country code (2 chars)
+     * @return storkid in a BASE64 encoding
+     * @throws BuildException if an error occurs on building the wbPK
+     */
+    public String buildStorkbPK(String identificationValue, String destinationCountry)
+            throws BuildException {
+        return buildStorkbPK(identificationValue, "AT", destinationCountry);
     }
-     
-    String basisbegriff;
-    if (registerAndOrdNr.startsWith(Constants.URN_PREFIX_WBPK + "+" ))
-    	basisbegriff = identificationValue + "+" + registerAndOrdNr;
-    else
-    	basisbegriff = identificationValue + "+" + Constants.URN_PREFIX_WBPK + "+" + registerAndOrdNr;
-    
-    try {
-      MessageDigest md = MessageDigest.getInstance("SHA-1");
-      byte[] hash = md.digest(basisbegriff.getBytes("ISO-8859-1"));
-      String hashBase64 = Base64Utils.encode(hash);
-      return hashBase64;
-    } catch (Exception ex) {
-      throw new BuildException("builder.00", new Object[] {"wbPK", ex.toString()}, ex);
+
+
+    /**
+     * Builds the storkeid from the given parameters.
+     *
+     * @param identificationValue Base64 encoded "Stammzahl"
+     * @param sourceCountry       source country code (2 chars)
+     * @param destinationCountry  destination country code (2 chars)
+     * @return storkid in a BASE64 encoding
+     * @throws BuildException if an error occurs on building the wbPK
+     */
+    public String buildStorkbPK(String identificationValue, String sourceCountry, String destinationCountry)
+            throws BuildException {
+
+        if ((identificationValue == null ||
+                identificationValue.length() == 0 ||
+                destinationCountry == null ||
+                destinationCountry.length() == 0 ||
+                sourceCountry == null ||
+                sourceCountry.length() == 0)) {
+            throw new BuildException("builder.00",
+                    new Object[]{"storkid", "Unvollständige Parameterangaben: identificationValue=" +
+                            identificationValue + ", Zielland=" + destinationCountry + ", Ursprungsland=" + sourceCountry});
+        }
+        Logger.info("Building STORK identification from: " + sourceCountry+"/"+destinationCountry+"/" + "[identValue]");
+        String eIdentifier = sourceCountry+"/"+destinationCountry+"/"+identificationValue;
+
+        /* Commented - it is already done by BKU, we need only to add Stork values
+        String basisbegriff = identificationValue + "+" + Constants.URN_PREFIX_STORK + "+" + sourceCountry + "+" + destinationCountry;
+        Logger.info("Building STORK identification from: [identValue]+" + Constants.URN_PREFIX_STORK + "+" + sourceCountry + "+" + destinationCountry);
+        try {
+            MessageDigest md = MessageDigest.getInstance("SHA-1");
+            byte[] hash = md.digest(basisbegriff.getBytes("ISO-8859-1"));
+            String hashBase64 = Base64Utils.encode(hash);
+            Logger.info("STORK identification defined as: " + hashBase64);
+            return hashBase64;
+        } catch (Exception ex) {
+            throw new BuildException("builder.00", new Object[]{"storkid", ex.toString()}, ex);
+        }
+        */
+        return eIdentifier;
     }
-  }
+
 
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/InfoboxReadRequestBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/InfoboxReadRequestBuilder.java
index 828fc78ab..81ef5e408 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/InfoboxReadRequestBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/InfoboxReadRequestBuilder.java
@@ -2,19 +2,19 @@
  * Copyright 2014 Federal Chancellery Austria
  * MOA-ID has been developed in a cooperation between BRZ, the Federal
  * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- * 
+ *
  * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
  * the European Commission - subsequent versions of the EUPL (the "Licence");
  * You may not use this work except in compliance with the Licence.
  * You may obtain a copy of the Licence at:
  * http://www.osor.eu/eupl/
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the Licence is distributed on an "AS IS" basis,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the Licence for the specific language governing permissions and
  * limitations under the Licence.
- * 
+ *
  * This product combines work with different licenses. See the "NOTICE" text
  * file for details on the various modules and licenses.
  * The "NOTICE" text file is part of the distribution. Any derivative works
@@ -46,87 +46,150 @@
 
 package at.gv.egovernment.moa.id.auth.builder;
 
+import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.Constants;
 
 /**
  * Builder for the <code>&lt;InfoboxReadRequest&gt;</code> structure
  * used for requesting the identity link from the security layer implementation.
- * 
+ *
  * @author Paul Ivancsics
  * @version $Id$
  */
 public class InfoboxReadRequestBuilder implements Constants {
 
 
-  /**
-   * Constructor for InfoboxReadRequestBuilder.
-   */
-  public InfoboxReadRequestBuilder() {
-  }
-   
-  
-  /**
-   * Builds an <code>&lt;InfoboxReadRequest&gt;</code>.
-   * 
-   * @param slVersion12           specifies whether the Security Layer version is
-   *                              version 1.2 or not
-   * @param businessService       specifies whether the online application is a
-   *                              business service or not
-   * @param identityLinkDomainIdentifier  the identification number of the business 
-   *                              company; maybe <code>null</code> if the OA
-   *                              is a public service; must not be <code>null</code>
-   *                              if the OA is a business service
-   * 
-   * @return <code>&lt;InfoboxReadRequest&gt;</code> as String
-   */
-  public String build(boolean businessService, String identityLinkDomainIdentifier) {
-    
-    String slPrefix;
-    String slNsDeclaration;
-    
+    /**
+     * Constructor for InfoboxReadRequestBuilder.
+     */
+    public InfoboxReadRequestBuilder() {
+    }
+
+
+    /**
+     * Builds an <code>&lt;InfoboxReadRequest&gt;</code>.
+     *
+     * @param slVersion12                  specifies whether the Security Layer version is
+     *                                     version 1.2 or not
+     * @param businessService              specifies whether the online application is a
+     *                                     business service or not
+     * @param identityLinkDomainIdentifier the identification number of the business
+     *                                     company; maybe <code>null</code> if the OA
+     *                                     is a public service; must not be <code>null</code>
+     *                                     if the OA is a business service
+     * @return <code>&lt;InfoboxReadRequest&gt;</code> as String
+     */
+    public String build(boolean businessService, String identityLinkDomainIdentifier) {
+        Logger.info("Building InfoBoxReadRequest");
+        String slPrefix;
+        String slNsDeclaration;
+
 //    if (slVersion12) {
-      slPrefix = SL12_PREFIX;
-      slNsDeclaration = SL12_NS_URI;
+        slPrefix = SL12_PREFIX;
+        slNsDeclaration = SL12_NS_URI;
 //    } else {
 //      slPrefix = SL10_PREFIX;
 //      slNsDeclaration = SL10_NS_URI;
 //    }
-        
-    StringBuffer sb = new StringBuffer("<?xml version=\"1.0\" encoding=\"UTF-8\" ?>");
-    sb.append("<");
-    sb.append(slPrefix);
-    sb.append(":InfoboxReadRequest xmlns:");
-    sb.append(slPrefix);
-    sb.append("=\"");
-    sb.append(slNsDeclaration);
-    sb.append("\">");
-    sb.append("<");
-    sb.append(slPrefix);
-    sb.append(":InfoboxIdentifier>IdentityLink</");
-    sb.append(slPrefix);
-    sb.append(":InfoboxIdentifier>");
-    sb.append("<");
-    sb.append(slPrefix);
-    sb.append(":BinaryFileParameters ContentIsXMLEntity=\"true\"/>");
-    if (businessService) {
-      sb.append("<");
-      sb.append(slPrefix);
-      sb.append(":BoxSpecificParameters>");
-      sb.append("<");
-      sb.append(slPrefix);
-      sb.append(":IdentityLinkDomainIdentifier>");
-      sb.append(identityLinkDomainIdentifier);
-      sb.append("</sl:IdentityLinkDomainIdentifier>");
-      sb.append("</");
-      sb.append(slPrefix);
-      sb.append(":BoxSpecificParameters>");
+
+        StringBuffer sb = new StringBuffer("<?xml version=\"1.0\" encoding=\"UTF-8\" ?>");
+        sb.append("<");
+        sb.append(slPrefix);
+        sb.append(":InfoboxReadRequest xmlns:");
+        sb.append(slPrefix);
+        sb.append("=\"");
+        sb.append(slNsDeclaration);
+        sb.append("\">");
+        sb.append("<");
+        sb.append(slPrefix);
+        sb.append(":InfoboxIdentifier>IdentityLink</");
+        sb.append(slPrefix);
+        sb.append(":InfoboxIdentifier>");
+        sb.append("<");
+        sb.append(slPrefix);
+        sb.append(":BinaryFileParameters ContentIsXMLEntity=\"true\"/>");
+        if (businessService) {
+            sb.append("<");
+            sb.append(slPrefix);
+            sb.append(":BoxSpecificParameters>");
+            sb.append("<");
+            sb.append(slPrefix);
+            sb.append(":IdentityLinkDomainIdentifier>");
+            sb.append(identityLinkDomainIdentifier);
+            sb.append("</sl:IdentityLinkDomainIdentifier>");
+            sb.append("</");
+            sb.append(slPrefix);
+            sb.append(":BoxSpecificParameters>");
+        }
+        sb.append("</");
+        sb.append(slPrefix);
+        sb.append(":InfoboxReadRequest>");
+
+        return sb.toString();
+
+    }
+
+
+    /**
+     * Builds an <code>&lt;InfoboxReadRequest&gt;</code>.
+     *
+     * @param slVersion12                  specifies whether the Security Layer version is
+     *                                     version 1.2 or not
+     * @param businessService              specifies whether the online application is a
+     *                                     business service or not
+     * @param identityLinkDomainIdentifier the identification number of the business
+     *                                     company; maybe <code>null</code> if the OA
+     *                                     is a public service; must not be <code>null</code>
+     *                                     if the OA is a business service
+     * @return <code>&lt;InfoboxReadRequest&gt;</code> as String
+     *
+     */
+    public String buildStorkReadRequest(String identityLinkDomainIdentifier) {
+        Logger.info("Building Stork InfoBoxReadRequest for " + identityLinkDomainIdentifier);
+
+        String slPrefix;
+        String slNsDeclaration;
+
+        slPrefix = SL12_PREFIX;
+        slNsDeclaration = SL12_NS_URI;
+
+        StringBuffer sb = new StringBuffer("<?xml version=\"1.0\" encoding=\"UTF-8\" ?>");
+        sb.append("<");
+        sb.append(slPrefix);
+        sb.append(":InfoboxReadRequest xmlns:");
+        sb.append(slPrefix);
+        sb.append("=\"");
+        sb.append(slNsDeclaration);
+        sb.append("\">");
+        sb.append("<");
+        sb.append(slPrefix);
+        sb.append(":InfoboxIdentifier>IdentityLink</");
+        sb.append(slPrefix);
+        sb.append(":InfoboxIdentifier>");
+        sb.append("<");
+        sb.append(slPrefix);
+        sb.append(":BinaryFileParameters ContentIsXMLEntity=\"true\"/>");
+
+        // append box parameters - necessary for stork?
+        sb.append("<");
+        sb.append(slPrefix);
+        sb.append(":BoxSpecificParameters>");
+        sb.append("<");
+        sb.append(slPrefix);
+        sb.append(":IdentityLinkDomainIdentifier>");
+        sb.append(identityLinkDomainIdentifier);
+        sb.append("</sl:IdentityLinkDomainIdentifier>");
+        sb.append("</");
+        sb.append(slPrefix);
+        sb.append(":BoxSpecificParameters>");
+        // end appending box parameters
+
+        sb.append("</");
+        sb.append(slPrefix);
+        sb.append(":InfoboxReadRequest>");
+
+        return sb.toString();
+
     }
-    sb.append("</");
-    sb.append(slPrefix);
-    sb.append(":InfoboxReadRequest>");
-    
-    return sb.toString();
-       
-  }
 
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java
index d6d22fe4a..479775dd5 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java
@@ -110,9 +110,11 @@ public class SignatureVerificationInvoker {
       authConnParam = authConfigProvider.getMoaSpConnectionParameter();
       //If the ConnectionParameter do NOT exist, we try to get the api to work....
       if (authConnParam != null) {
+        Logger.debug("Connecting using auth url: " + authConnParam.getUrl() + ", service " + serviceName.getNamespaceURI() + " : " + serviceName.getLocalPart() + " : "+ serviceName.getPrefix());
         endPoint = authConnParam.getUrl();
         call.setTargetEndpointAddress(endPoint);
         responses = (Vector) call.invoke(serviceName, params);
+        Logger.debug("Got responses: " + responses.size()); // TODO handle axis 302 response when incorrect service url is used
         response = (SOAPBodyElement) responses.get(0);
         return response.getAsDOM();
       }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java
index 83d0ced20..ae9348a0b 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java
@@ -26,10 +26,8 @@ import iaik.x509.X509Certificate;
 import java.io.IOException;

 import java.io.InputStream;

 import java.io.StringWriter;

-import java.net.URL;

 import java.util.ArrayList;

-import java.util.List;

-

+import javax.activation.DataSource;

 import javax.servlet.ServletException;

 import javax.servlet.http.HttpServlet;

 import javax.servlet.http.HttpServletRequest;

@@ -55,7 +53,6 @@ import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

 import at.gv.egovernment.moa.id.auth.stork.STORKException;

 import at.gv.egovernment.moa.id.auth.stork.STORKResponseProcessor;

-import at.gv.egovernment.moa.id.auth.stork.VelocityProvider;

 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;

 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;

 import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;

@@ -64,12 +61,14 @@ import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
 import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;

 import at.gv.egovernment.moa.id.util.HTTPUtils;

 import at.gv.egovernment.moa.id.util.ParamValidatorUtils;

+import at.gv.egovernment.moa.id.util.VelocityProvider;

 import at.gv.egovernment.moa.logging.Logger;

 import at.gv.egovernment.moa.util.StringUtils;

 import at.gv.util.xsd.xmldsig.SignatureType;

 import at.gv.util.xsd.xmldsig.X509DataType;

 import eu.stork.oasisdss.api.ApiUtils;

-import eu.stork.oasisdss.profile.DocumentWithSignature;

+import eu.stork.oasisdss.api.LightweightSourceResolver;

+import eu.stork.oasisdss.api.exceptions.ApiUtilsException;

 import eu.stork.oasisdss.profile.SignResponse;

 import eu.stork.peps.auth.commons.IPersonalAttributeList;

 import eu.stork.peps.auth.commons.PEPSUtil;

@@ -223,17 +222,15 @@ public class PEPSConnectorServlet extends AuthServlet {
 				String signatureInfo = authnResponse.getPersonalAttributeList().get("signedDoc").getValue().get(0);

 				SignResponse dssSignResponse = (SignResponse) ApiUtils.unmarshal(new StreamSource(new java.io.StringReader(signatureInfo)));

 				

-				List<DocumentWithSignature> doclocations = ApiUtils.findNamedElement(dssSignResponse.getOptionalOutputs(), DocumentWithSignature.class.getSimpleName(), DocumentWithSignature.class);

-				// TODO handle multiple docs?

-				Logger.debug("trying first doclocation");

-				String docUrl = doclocations.get(0).getDocument().getDocumentURL();

-				Logger.debug("trying first doclocation successful");

-				

 				// fetch signed doc

-				URL url = new URL(docUrl);

-				InputStream incomming = url.openStream();

-				citizenSignature = IOUtils.toString(incomming);

-				incomming.close();

+				DataSource ds = LightweightSourceResolver.getDataSource(dssSignResponse);

+				if(ds == null){

+					throw new ApiUtilsException("No datasource found in response");

+				}				

+				

+				InputStream incoming  = ds.getInputStream();

+				citizenSignature = IOUtils.toString(incoming);

+				incoming.close();

 				

 				JAXBContext ctx = JAXBContext.newInstance(SignatureType.class.getPackage().getName());

 				SignatureType root = ((JAXBElement<SignatureType>) ctx.createUnmarshaller().unmarshal(IOUtils.toInputStream(citizenSignature))).getValue();

@@ -355,6 +352,7 @@ public class PEPSConnectorServlet extends AuthServlet {
 			

 			//TODO: found better solution, but QAA Level in response could be not supported yet

 			try {

+

 				moasession.setQAALevel(authnResponse.getAssertions().get(0).

 						getAuthnStatements().get(0).getAuthnContext().

 						getAuthnContextClassRef().getAuthnContextClassRef());

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/stork/STORKResponseProcessor.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/stork/STORKResponseProcessor.java
index dbb184e43..c3b45f165 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/stork/STORKResponseProcessor.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/stork/STORKResponseProcessor.java
@@ -138,7 +138,37 @@ public class STORKResponseProcessor {
 			String fiscalNumber = getAttributeValue("fiscalNumber", attributeList);

 			

 			// if we have a signedDoc we test for a representation case

-			if(hasAttribute("mandateContent", attributeList) || hasAttribute("representative", attributeList) || hasAttribute("represented", attributeList)) {

+			// - according to stork samlengine and commons

+			if(hasAttribute("mandate", attributeList)) {

+				// we have a representation case

+				String mandate = getAttributeValue("mandate", attributeList);

+				

+				if(!hasAttribute("dateOfBirth", attributeList)) {

+					// if we get here, we have a natural person representing a legal person

+					String organizationAddress = getAttributeValue("canonicalRegisteredAddress", attributeList);

+					String organizationType = getAttributeValue("translateableType", attributeList);

+					

+					identityLinkResponse = AuthenticationServer.getInstance().getIdentityLink(citizenSignature, null, null, mandate, organizationAddress, organizationType, targetType, targetValue, oaFriendlyName, filters, fiscalNumber);

+				} else {

+					// if we get here, we have a natural person representing another natural person

+					String eIdentifier = getAttributeValue("eIdentifier", attributeList);

+					String givenName = getAttributeValue("givenName", attributeList);

+					String lastName = getAttributeValue("surname", attributeList);

+					String dateOfBirth = getAttributeValue("dateOfBirth", attributeList);

+					

+					// gender attribute is mandatory here because of some legal stuff

+					String gender = getAttributeValue("gender", attributeList);

+					

+					if (!StringUtils.isEmpty(dateOfBirth))

+						dateOfBirth = DateTimeUtils.formatPEPSDateToMOADate(dateOfBirth);

+

+					identityLinkResponse = AuthenticationServer.getInstance().getIdentityLink(eIdentifier, 

+							givenName, lastName, dateOfBirth, gender, citizenSignature, null,

+							null, mandate, targetType, targetValue, oaFriendlyName, filters, fiscalNumber);

+				}

+			}

+			// - according to stork spec

+			else if(hasAttribute("mandateContent", attributeList) || hasAttribute("representative", attributeList) || hasAttribute("represented", attributeList)) {

 				// we have a representation case

 				String representative = getAttributeValue("representative", attributeList);

 				String represented = getAttributeValue("represented", attributeList);

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/validator/VerifyXMLSignatureResponseValidator.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/validator/VerifyXMLSignatureResponseValidator.java
index ccaa7bbbb..038e92f1c 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/validator/VerifyXMLSignatureResponseValidator.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/validator/VerifyXMLSignatureResponseValidator.java
@@ -126,11 +126,12 @@ public class VerifyXMLSignatureResponseValidator {
 				checkFailedReason = MOAIDMessageProvider.getInstance().getMessage("validator.24", null);
 			if (verifyXMLSignatureResponse.getCertificateCheckCode() == 5) 
 				checkFailedReason = MOAIDMessageProvider.getInstance().getMessage("validator.25", null);
-    
-      if (whatToCheck.equals(CHECK_IDENTITY_LINK)) 
-        throw new ValidateException("validator.07", new Object[] { checkFailedReason } );
-      else
-        throw new ValidateException("validator.19", new Object[] { checkFailedReason } );
+
+    // TEST CARDS
+    //  if (whatToCheck.equals(CHECK_IDENTITY_LINK))
+    //    throw new ValidateException("validator.07", new Object[] { checkFailedReason } );
+    //  else
+    //    throw new ValidateException("validator.19", new Object[] { checkFailedReason } );
     }
     
     //check QC 
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/OAParameter.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/OAParameter.java
index 7e21c6667..2d0a0e367 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/OAParameter.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/OAParameter.java
@@ -55,7 +55,12 @@ public class OAParameter {
 			this.businessService = true;
 		else
 			this.businessService = false;
-		
+
+        if (this.oaType.equals("storkService"))
+            this.storkService = true;
+        else
+            this.storkService = false;
+
 		this.publicURLPrefix = oa.getPublicURLPrefix();
 		
 		this.friendlyName = oa.getFriendlyName();
@@ -81,8 +86,15 @@ public class OAParameter {
 	 * if value of {@link #oaType} is "businessService"
 	 */
 	private boolean businessService;
-	
-	/**
+
+    /**
+     * specifies whether the online application is a stork application or not (<code>true</code>
+     * if value of {@link #oaType} is "storkService"
+     */
+    private boolean storkService;
+
+
+    /**
 	 * public URL prefix of the online application
 	 */
 	private String publicURLPrefix;
@@ -139,5 +151,7 @@ public class OAParameter {
 	public OAOAUTH20 getoAuth20Config() {
 		return oAuth20Config;
 	}
+
+    public boolean getStorkService() { return storkService; }
 	
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfigurationProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfigurationProvider.java
index 8b5c8d796..ba2c08bb5 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfigurationProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfigurationProvider.java
@@ -398,11 +398,11 @@ public class AuthConfigurationProvider extends ConfigurationProvider {
 			
 			MOAIDConfiguration moaconfig = BuildFromLegacyConfig.build(new File(legacyconfig), rootConfigFileDir, null);
 			
-			List<OnlineApplication> oas = moaconfig.getOnlineApplication();
+			List<OnlineApplication> oas = moaconfig.getOnlineApplications();
 			for (OnlineApplication oa : oas)
 				ConfigurationDBUtils.save(oa);
 
-			moaconfig.setOnlineApplication(null);	
+			moaconfig.setOnlineApplications(null);	
 			ConfigurationDBUtils.save(moaconfig);
 			
 			Logger.info("Legacy Configuration load is completed.");
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java
index 50b870c98..d16e85084 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java
@@ -51,6 +51,7 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
+import at.gv.egovernment.moa.id.commons.db.dao.config.AttributeProviderPlugin;
 import at.gv.egovernment.moa.id.commons.db.dao.config.AuthComponentOA;
 import at.gv.egovernment.moa.id.commons.db.dao.config.BKUSelectionCustomizationType;
 import at.gv.egovernment.moa.id.commons.db.dao.config.BKUURLS;
@@ -368,6 +369,13 @@ public List<OAStorkAttribute> getRequestedAttributes() {
 	return oa_auth.getOASTORK().getOAAttributes();
 }
 
+public boolean isRequireConsentForStorkAttributes() {
+	return oa_auth.getOASTORK().isRequireConsent();
+}
+
+public List<AttributeProviderPlugin> getStorkAPs() {
+	return oa_auth.getOASTORK().getAttributeProviders();
+}
 
 public byte[] getBKUSelectionTemplate() {
 	
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/stork/STORKConfig.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/stork/STORKConfig.java
index b3a4cca78..4dec2c32e 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/stork/STORKConfig.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/stork/STORKConfig.java
@@ -25,6 +25,7 @@
  */

 package at.gv.egovernment.moa.id.config.stork;

 

+import java.io.IOException;

 import java.net.MalformedURLException;

 import java.net.URL;

 import java.util.ArrayList;

@@ -33,10 +34,15 @@ import java.util.List;
 import java.util.Map;

 import java.util.Properties;

 

+import at.gv.egovernment.moa.id.commons.db.dao.config.SAMLSigningParameter;

 import at.gv.egovernment.moa.id.commons.db.dao.config.STORK;

 import at.gv.egovernment.moa.id.commons.db.dao.config.StorkAttribute;

 import at.gv.egovernment.moa.logging.Logger;

 import at.gv.egovernment.moa.util.StringUtils;

+import org.opensaml.ws.message.encoder.MessageEncodingException;

+import org.xml.sax.SAXException;

+

+import javax.xml.parsers.ParserConfigurationException;

 

 /**

  * Encapsulates several STORK configuration parameters according MOA configuration

@@ -58,33 +64,50 @@ public class STORKConfig {
 		this.basedirectory = basedirectory;

 		this.props = props;

 

+		//create CPEPS map

+		//List<at.gv.egovernment.moa.id.commons.db.dao.config.CPEPS> cpeps = stork.getCPEPS();

+        List<at.gv.egovernment.moa.id.commons.db.dao.config.CPEPS> cpeps = new ArrayList<at.gv.egovernment.moa.id.commons.db.dao.config.CPEPS>();   // TODO Change this

+

+        try {

+            cpeps = stork.getCPEPS();

+        }   catch (NullPointerException ex) {

+            Logger.error("CPEPS not configured!");

+        }

+

 		cpepsMap = new HashMap<String, CPEPS>();

-		attr = new ArrayList<StorkAttribute>();

-		

-		if (stork != null) {

-			//create CPEPS map

-			List<at.gv.egovernment.moa.id.commons.db.dao.config.CPEPS> cpeps = stork.getCPEPS();

-		

-			if (cpeps != null) {

-				for(at.gv.egovernment.moa.id.commons.db.dao.config.CPEPS cpep : cpeps) {

-

-					try {

-						CPEPS moacpep = new CPEPS(cpep.getCountryCode(), new URL(cpep.getURL()));

-

-						cpepsMap.put(cpep.getCountryCode(), moacpep);

-

-					} catch (MalformedURLException e) {

-						Logger.warn("Error in MOA-ID Configuration. CPEP entry for country "

-								+ cpep.getCountryCode() + " has an invalid URL and is ignored.");

-					}	

-				}

-			}

 

-			if (stork.getAttributes() != null) {

-				for(StorkAttribute current : stork.getAttributes()) {

-					attr.add(current);

+		if (cpeps != null) {

+			for(at.gv.egovernment.moa.id.commons.db.dao.config.CPEPS cpep : cpeps) {

+

+				try {

+					CPEPS moacpep = new CPEPS(cpep.getCountryCode(), new URL(cpep.getURL()));

+

+					cpepsMap.put(cpep.getCountryCode(), moacpep);

+

+				} catch (MalformedURLException e) {

+					Logger.warn("Error in MOA-ID Configuration. CPEP entry for country "

+							+ cpep.getCountryCode() + " has an invalid URL and is ignored.");

 				}

 			}

+            /*catch (ParserConfigurationException e) {

+				Logger.warn("Error in MOA-ID Configuration. CPEP entry for country " 

+						+ cpep.getCountryCode() + " has an invalid Attribute and is ignored.");

+			} catch (SAXException e) {

+				Logger.warn("Error in MOA-ID Configuration. CPEP entry for country " 

+						+ cpep.getCountryCode() + " has an invalid Attribute and is ignored.");

+			} catch (IOException e) {

+				Logger.warn("Error in MOA-ID Configuration. CPEP entry for country " 

+						+ cpep.getCountryCode() + " has an invalid Attribute and is ignored.");

+			} catch (MessageEncodingException e) {

+				Logger.warn("Error in MOA-ID Configuration. CPEP entry for country " 

+						+ cpep.getCountryCode() + " has an invalid Attribute and is ignored.");

+			}*/

+		}

+		attr = new ArrayList<StorkAttribute>();

+		if (stork.getAttributes() != null) {

+			for(StorkAttribute current : stork.getAttributes()) {

+				attr.add(current);

+			}

 		}

 

 	}

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/entrypoints/DispatcherServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/entrypoints/DispatcherServlet.java
index 487e86b34..480deb867 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/entrypoints/DispatcherServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/entrypoints/DispatcherServlet.java
@@ -441,7 +441,7 @@ public class DispatcherServlet extends AuthServlet{
 				}
 
 			} catch (Throwable e) {
-				Logger.warn("An authentication error occous: ", e);;
+				Logger.warn("An authentication error occured: ", e);;
 				// Try handle module specific, if not possible rethrow
 				if (!info.generateErrorMessage(e, req, resp, protocolRequest)) {
 					throw e;
@@ -460,6 +460,8 @@ public class DispatcherServlet extends AuthServlet{
 	    	ConfigurationDBUtils.closeSession();
 	    }
 
+        Logger.info("Clossing Dispatcher processing loop");
+        Logger.info("Http response prepared sent: " + resp.toString());
 	}
 	
 	@Override
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/config/CertStoreConfigurationImpl.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/config/CertStoreConfigurationImpl.java
index 65634bed3..b6fe20a61 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/config/CertStoreConfigurationImpl.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/config/CertStoreConfigurationImpl.java
@@ -2,19 +2,19 @@
  * Copyright 2014 Federal Chancellery Austria
  * MOA-ID has been developed in a cooperation between BRZ, the Federal
  * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- * 
+ *
  * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
  * the European Commission - subsequent versions of the EUPL (the "Licence");
  * You may not use this work except in compliance with the Licence.
  * You may obtain a copy of the Licence at:
  * http://www.osor.eu/eupl/
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the Licence is distributed on an "AS IS" basis,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the Licence for the specific language governing permissions and
  * limitations under the Licence.
- * 
+ *
  * This product combines work with different licenses. See the "NOTICE" text
  * file for details on the various modules and licenses.
  * The "NOTICE" text file is part of the distribution. Any derivative works
@@ -46,98 +46,120 @@
 
 package at.gv.egovernment.moa.id.iaik.config;
 
-import java.io.File;
-
 import at.gv.egovernment.moa.id.config.ConfigurationException;
 import at.gv.egovernment.moa.id.config.ConfigurationProvider;
 import at.gv.egovernment.moa.id.iaik.servertools.observer.ObservableImpl;
-import at.gv.egovernment.moa.util.FileUtils;
+import at.gv.egovernment.moa.logging.Logger;
 import iaik.pki.store.certstore.CertStoreConfiguration;
 import iaik.pki.store.certstore.CertStoreParameters;
 import iaik.pki.store.certstore.CertStoreTypes;
 import iaik.pki.store.certstore.directory.DirectoryCertStoreParameters;
 
+import java.io.File;
+
 /**
  * Implementation of interface needed to initialize an IAIK JSSE <code>TrustManager</code>
+ *
  * @author Paul Ivancsics
  * @version $Id$
  */
-public class CertStoreConfigurationImpl extends ObservableImpl 
-  implements CertStoreConfiguration, DirectoryCertStoreParameters {
-  /** identifies the rootDirectory */
-  private String rootDirectory;
-  /** ConfigurationProvider */
-  private ConfigurationProvider conf;
-  /** Array for storing all CertStoreParameters */
-  private CertStoreParameters[] parameters;
-
-  /**
-   * Create a new <code>CertStoreConfigurationImpl</code>.
-   * 
-   * @param conf The MOA configuration from which the configuration data is
-   * @throws ConfigurationException an any config-error
-   * being read.
-   */
-  public CertStoreConfigurationImpl(ConfigurationProvider conf) throws ConfigurationException {
-    this.conf=conf;
-    
-    String certStoreRootDirParam = conf.getCertstoreDirectory();
-    
-    if (certStoreRootDirParam == null)
-      throw new ConfigurationException(
-        "config.08", new Object[] {"CertStoreDirectory"});
-
-		rootDirectory = FileUtils.makeAbsoluteURL(certStoreRootDirParam, conf.getRootConfigFileDir());
-		if(rootDirectory.startsWith("file:")) rootDirectory = rootDirectory.substring(6);
-		File f = new File(rootDirectory);
-				if (!f.isDirectory())
-					throw new ConfigurationException(
-						"config.05", new Object[] {"CertStoreDirectory"});
-    
-    parameters = new CertStoreParameters[] { this };
-  }
-
-  /**
-   * @see iaik.pki.store.certstore.CertStoreConfiguration#getParameters()
-   */
-  public CertStoreParameters[] getParameters() {
-    return parameters;
-  }
-
-  /**
-   * @see iaik.pki.store.certstore.directory.DirectoryCertStoreParameters#getRootDirectory()
-   */
-  public String getRootDirectory() {
-    return rootDirectory;
-  }
-
-  /**
-   * @see iaik.pki.store.certstore.directory.DirectoryCertStoreParameters#createNew()
-   */
-  public boolean createNew() {
-    return false;
-  }
-
-  /**
-   * @see iaik.pki.store.certstore.CertStoreParameters#getId()
-   */
-  public String getId() {
-    return "MOA ID Directory CertStore";
-  }
-
-  /**
-   * @see iaik.pki.store.certstore.CertStoreParameters#isReadOnly()
-   */
-  public boolean isReadOnly() {
-    return false;
-  }
-
-  /**
-   * @return <code>CertStoreTypes.DIRECTORY</code>
-   * @see iaik.pki.store.certstore.CertStoreParameters#getType()
-   */
-  public String getType() {
-    return CertStoreTypes.DIRECTORY;
-  }
+public class CertStoreConfigurationImpl extends ObservableImpl
+        implements CertStoreConfiguration, DirectoryCertStoreParameters {
+    /**
+     * identifies the rootDirectory
+     */
+    private String rootDirectory;
+    /**
+     * ConfigurationProvider
+     */
+    private ConfigurationProvider conf;
+    /**
+     * Array for storing all CertStoreParameters
+     */
+    private CertStoreParameters[] parameters;
+
+    /**
+     * Create a new <code>CertStoreConfigurationImpl</code>.
+     *
+     * @param conf The MOA configuration from which the configuration data is
+     * @throws ConfigurationException an any config-error
+     *                                being read.
+     */
+    public CertStoreConfigurationImpl(ConfigurationProvider conf) throws ConfigurationException {
+        this.conf = conf;
+
+        String certStoreRootDirParam = conf.getCertstoreDirectory();
+
+        if (certStoreRootDirParam == null)
+            throw new ConfigurationException(
+                    "config.08", new Object[]{"CertStoreDirectory"});
+
+        //rootDirectory = FileUtils.makeAbsoluteURL(certStoreRootDirParam, conf.getRootConfigFileDir());
+        rootDirectory = certStoreRootDirParam;
+        Logger.error("Using file: " + rootDirectory);
+        if (rootDirectory.startsWith("file:")) rootDirectory = rootDirectory.substring(5);
+        Logger.error("Using file2: " + rootDirectory);
+
+        File f = new File(rootDirectory);
+        //Logger.error("Using file: " + certStoreRootDirParam + " param: " + conf.getRootConfigFileDir());
+
+        if (!f.exists()) {
+            Logger.error("File does not exists: " + f.getAbsolutePath());
+            throw new ConfigurationException(
+                    "config.05", new Object[]{"CertStoreDirectory"});
+        }
+
+        if (!f.isDirectory()) {
+            Logger.error("File is not a directory: " + f.getAbsolutePath());
+            throw new ConfigurationException(
+                    "config.05", new Object[]{"CertStoreDirectory"});
+        }
+
+
+        parameters = new CertStoreParameters[]{this};
+    }
+
+    /**
+     * @see iaik.pki.store.certstore.CertStoreConfiguration#getParameters()
+     */
+    public CertStoreParameters[] getParameters() {
+        return parameters;
+    }
+
+    /**
+     * @see iaik.pki.store.certstore.directory.DirectoryCertStoreParameters#getRootDirectory()
+     */
+    public String getRootDirectory() {
+        return rootDirectory;
+    }
+
+    /**
+     * @see iaik.pki.store.certstore.directory.DirectoryCertStoreParameters#createNew()
+     */
+    public boolean createNew() {
+        return false;
+    }
+
+    /**
+     * @see iaik.pki.store.certstore.CertStoreParameters#getId()
+     */
+    public String getId() {
+        return "MOA ID Directory CertStore";
+    }
+
+    /**
+     * @see iaik.pki.store.certstore.CertStoreParameters#isReadOnly()
+     */
+    public boolean isReadOnly() {
+        return false;
+    }
+
+    /**
+     * @return <code>CertStoreTypes.DIRECTORY</code>
+     * @see iaik.pki.store.certstore.CertStoreParameters#getType()
+     */
+    public String getType() {
+        return CertStoreTypes.DIRECTORY;
+    }
 
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/ModulStorage.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/ModulStorage.java
index 91f98608c..4a1da76e2 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/ModulStorage.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/ModulStorage.java
@@ -33,6 +33,7 @@ public class ModulStorage {
 	private static final String[] modulClasses = new String[]{
 		"at.gv.egovernment.moa.id.protocols.saml1.SAML1Protocol",
 		"at.gv.egovernment.moa.id.protocols.pvp2x.PVP2XProtocol",
+        "at.gv.egovernment.moa.id.protocols.stork2.STORKProtocol",
 		"at.gv.egovernment.moa.id.protocols.oauth20.protocol.OAuth20Protocol"
 	};
 	
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/PostBinding.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/PostBinding.java
index a609942f3..6517325b9 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/PostBinding.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/PostBinding.java
@@ -26,7 +26,6 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import org.apache.velocity.app.VelocityEngine;
-import org.apache.velocity.runtime.RuntimeConstants;
 import org.opensaml.common.SAMLObject;
 import org.opensaml.common.binding.BasicSAMLMessageContext;
 import org.opensaml.common.xml.SAMLConstants;
@@ -51,6 +50,7 @@ import org.opensaml.xml.security.x509.X509Credential;
 import at.gv.egovernment.moa.id.protocols.pvp2x.metadata.MOAMetadataProvider;
 import at.gv.egovernment.moa.id.protocols.pvp2x.signer.CredentialProvider;
 import at.gv.egovernment.moa.id.protocols.pvp2x.signer.CredentialsNotAvailableException;
+import at.gv.egovernment.moa.id.util.VelocityProvider;
 import at.gv.egovernment.moa.logging.Logger;
 
 public class PostBinding implements IDecoder, IEncoder {
@@ -72,18 +72,7 @@ public class PostBinding implements IDecoder, IEncoder {
 
 			Logger.debug("create SAML POSTBinding response");
 			
-			// VelocityEngine engine =
-			// VelocityProvider.getClassPathVelocityEngine();
-			VelocityEngine engine = new VelocityEngine();
-			engine.setProperty(RuntimeConstants.ENCODING_DEFAULT, "UTF-8");
-			engine.setProperty(RuntimeConstants.OUTPUT_ENCODING, "UTF-8");
-			engine.setProperty(RuntimeConstants.ENCODING_DEFAULT, "UTF-8");
-			engine.setProperty(RuntimeConstants.RESOURCE_LOADER, "classpath");
-			engine.setProperty("classpath.resource.loader.class",
-					"org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader");
-			engine.setProperty(RuntimeConstants.RUNTIME_LOG_LOGSYSTEM_CLASS,
-					"org.apache.velocity.runtime.log.SimpleLog4JLogSystem");
-			engine.init();
+			 VelocityEngine engine = VelocityProvider.getClassPathVelocityEngine();
 
 			HTTPPostEncoder encoder = new HTTPPostEncoder(engine,
 					"resources/templates/pvp_postbinding_template.html");
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AttributeCollector.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AttributeCollector.java
new file mode 100644
index 000000000..1d9e31674
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AttributeCollector.java
@@ -0,0 +1,237 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+import java.io.StringWriter;
+import java.util.ArrayList;
+import java.util.List;
+
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
+import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
+import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.id.moduls.IAction;
+import at.gv.egovernment.moa.id.moduls.IRequest;
+import at.gv.egovernment.moa.id.storage.AssertionStorage;
+import at.gv.egovernment.moa.id.util.VelocityProvider;
+import at.gv.egovernment.moa.logging.Logger;
+import eu.stork.peps.auth.commons.IPersonalAttributeList;
+import eu.stork.peps.auth.commons.PEPSUtil;
+import eu.stork.peps.auth.commons.PersonalAttribute;
+import eu.stork.peps.auth.commons.PersonalAttributeList;
+import eu.stork.peps.auth.engine.STORKSAMLEngine;
+import eu.stork.peps.exceptions.STORKSAMLEngineException;
+import org.apache.velocity.Template;
+import org.apache.velocity.VelocityContext;
+import org.apache.velocity.app.VelocityEngine;
+import org.opensaml.common.impl.SecureRandomIdentifierGenerator;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+/**
+ * the AttributeCollector Action tries to get all requested attributes from a set of {@link AttributeProvider} Plugins.
+ * The class is called whenever the {@link AuthenticationRequest} Action is invoked and checks for missing attributes.
+ * Furthermore, the class can handle direct posts. That is when the class triggers an attribute query which needs user
+ * interaction, redirect to another portal, etc. The redirect will hit here and the class can continue to fetch attributes.
+ * 
+ * TODO how do we treat mandatory and optional attributes?
+ */
+public class AttributeCollector implements IAction {
+
+    /**
+     * The Constant ARTIFACT_ID.
+     */
+    private static final String ARTIFACT_ID = "artifactId";
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IAction#processRequest(at.gv.egovernment.moa.id.moduls.IRequest, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, at.gv.egovernment.moa.id.auth.data.AuthenticationSession)
+     */
+    public String processRequest(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp, AuthenticationSession moasession) throws MOAIDException {
+
+		// - fetch the container
+		String artifactId = (String) httpReq.getParameter(ARTIFACT_ID);
+		DataContainer container;
+		try {
+			container = AssertionStorage.getInstance().get(artifactId, DataContainer.class);
+		} catch (MOADatabaseException e) {
+			Logger.error("Error fetching incomplete Stork response from temporary storage. Most likely a timeout occured.", e);
+			throw new MOAIDException("stork.11", null);
+		}
+
+        // read configuration parameters of OA
+        OAAuthParameter oaParam = AuthConfigurationProvider.getInstance().getOnlineApplicationParameter(container.getRequest().getAssertionConsumerServiceURL());
+        if (oaParam == null)
+            throw new AuthenticationException("stork.12", new Object[]{moasession.getPublicOAURLPrefix()});
+
+        // find the attribute provider plugin that can handle the response
+        IPersonalAttributeList newAttributes = null;
+        for (AttributeProvider current : AttributeProviderFactory.getConfiguredPlugins(oaParam.getStorkAPs()))
+            try {
+                newAttributes = current.parse(httpReq);
+                
+                // stop as soon as we hit a capable plugin
+                break;
+            } catch (UnsupportedAttributeException e1) {
+                // the current provider cannot find anything familiar within the
+                // provided httpreq. Try the next one.
+            }
+
+        if (null == newAttributes) {
+            // we do not have a provider which is capable of fetching something
+            // from the received httpreq.
+            Logger.error("No attribute could be retrieved from the response the attribute provider gave us.");
+        }
+
+        // - insert the embedded attribute(s) into the container
+        addOrUpdateAll(container.getResponse().getPersonalAttributeList(), newAttributes);
+
+        // see if we need some more attributes
+        return processRequest(container, httpReq, httpResp, moasession, oaParam);
+    }
+
+    /**
+     * Checks if there are missing attributes and tries to fetch them. If there are no more attribute to fetch,
+     * this very method creates and sends the protocol result to the asking S-PEPS.
+     *
+     * @param container the {@link DataContainer} representing the status of the overall query.
+     * @return the string
+     * @throws MOAIDException
+     */
+    public String processRequest(DataContainer container, HttpServletRequest request, HttpServletResponse response, AuthenticationSession moasession, OAAuthParameter oaParam) throws MOAIDException {
+        // check if there are attributes we need to fetch
+
+        IPersonalAttributeList requestAttributeList = container.getRequest().getPersonalAttributeList();
+        IPersonalAttributeList responseAttributeList = container.getResponse().getPersonalAttributeList();
+        List<PersonalAttribute> missingAttributes = new ArrayList<PersonalAttribute>();
+        for (PersonalAttribute current : requestAttributeList)
+            if (!responseAttributeList.containsKey(current.getName()))
+                missingAttributes.add(current);
+
+        Logger.info("collecting attributes...");
+		Logger.debug("found " + missingAttributes.size() + " missing attributes");
+
+        // Try to get all missing attributes
+        try {
+            // for each attribute still missing
+            for (PersonalAttribute currentAttribute : missingAttributes) {
+            	
+				/*
+				 * prefill attributes with "notAvailable". If we get them later, we override the value and status.
+				 * This way, there is no error case in which an attribute is left unanswered.
+				 */
+				IPersonalAttributeList aquiredAttributes = new PersonalAttributeList();
+				currentAttribute.setStatus("notAvailable");
+				aquiredAttributes.add((PersonalAttribute) currentAttribute.clone());
+				addOrUpdateAll(container.getResponse().getPersonalAttributeList(), aquiredAttributes);
+
+            	// - check if we can find a suitable AttributeProvider Plugin
+                for (AttributeProvider currentProvider : AttributeProviderFactory.getConfiguredPlugins(oaParam.getStorkAPs())) {
+                    try {
+                        // - hand over control to the suitable plugin
+                    	Logger.info(currentProvider.getClass().getSimpleName() + " called to handle attribute '" + currentAttribute.getName() + "'");
+                        aquiredAttributes = currentProvider.acquire(currentAttribute, container.getRequest().getSpCountry(), moasession);
+                    	Logger.info(currentProvider.getClass().getSimpleName() + " can handle attribute '" + currentAttribute.getName() + "'");
+                        break;
+                    } catch (UnsupportedAttributeException e) {
+                        // ok, try the next attributeprovider
+                    	Logger.info(currentProvider.getClass().getSimpleName() + " could not handle attribute '" + currentAttribute.getName() + "'");
+                    } catch (MOAIDException e) {
+                        // the current plugin had an error. Try the next one.
+                    	Logger.info(currentProvider.getClass().getSimpleName() + " could not handle attribute '" + currentAttribute.getName() + "' due to an error");
+                    }
+                }
+                
+				// check if we could fetch the attribute
+				if (null == aquiredAttributes) {
+					// if not
+					Logger.error("We have no suitable plugin for obtaining the attribute '" + currentAttribute.getName() + "'");
+				} else
+					// else, update any existing attributes
+					addOrUpdateAll(container.getResponse().getPersonalAttributeList(), aquiredAttributes);
+            }
+            Logger.info("collecting attributes done");
+            
+            // ask for consent if necessary
+            if(oaParam.isRequireConsentForStorkAttributes())
+            	new ConsentEvaluator().requestConsent(container, response, oaParam);
+            else
+            	new ConsentEvaluator().generateSTORKResponse(response, container);
+
+            return "12345"; // AssertionId
+
+        } catch (ExternalAttributeRequestRequiredException e) {
+            // the attribute request is ongoing and requires an external service.
+            try {
+                // memorize the container again
+				Logger.debug("prepare putting the container into temporary storage...");
+
+                // - generate new key
+                String newArtifactId = new SecureRandomIdentifierGenerator()
+                        .generateIdentifier();
+                // - put container in temporary store.
+                AssertionStorage.getInstance().put(newArtifactId, container);
+
+				Logger.debug("...successful");
+
+				Logger.info(e.getAp().getClass().getSimpleName() + " is going to ask an external service provider for the requested attributes");
+                // add container-key to redirect embedded within the return URL
+                e.getAp().performRedirect(AuthConfigurationProvider.getInstance().getPublicURLPrefix() + "/stork2/ResumeAuthentication?" + ARTIFACT_ID + "=" + newArtifactId, request, response, oaParam);
+
+            } catch (Exception e1) {
+                // TODO should we return the response as is to the PEPS?
+                Logger.error("Error putting incomplete Stork response into temporary storage", e1);
+                e1.printStackTrace();
+                throw new MOAIDException("stork.11", null);
+            }
+
+            return "12345"; // TODO what to do here?
+        }
+    }
+
+    /**
+     * Adds or updates all {@link PersonalAttribute} objects given in {@code source} to/in {@code target}.
+     *
+     * @param target the target
+     * @param source the source
+     * @throws MOAIDException 
+     */
+	private void addOrUpdateAll(IPersonalAttributeList target, IPersonalAttributeList source) throws MOAIDException {
+		Logger.debug("Updating " + source.size() + " attributes...");
+		for (PersonalAttribute current : source) {
+			Logger.trace("treating " + current.getName());
+	        
+			// check if we need to update the current pa
+			if (target.containsKey(current.getName())) {
+				PersonalAttribute existing = target.get(current.getName());
+				if(!(existing.isEmptyValue() && existing.isEmptyComplexValue()))
+					if(!(existing.getValue().equals(current.getValue()) || existing.getComplexValue().equals(current.getComplexValue()))) {
+		                Logger.error("Attribute Value does not match the value from first authentication!");
+		                throw new MOAIDException("stork.16", new Object[] {existing.getName()});
+					}
+
+				target.get(current.getName()).setStatus(current.getStatus());
+				target.get(current.getName()).setValue(current.getValue());
+				target.get(current.getName()).setComplexValue(current.getComplexValue());
+			} else
+				target.add(current);
+
+			Logger.trace("...successfully treated " + current.getName());
+		}
+	}
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IAction#needAuthentication(at.gv.egovernment.moa.id.moduls.IRequest, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
+     */
+    public boolean needAuthentication(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp) {
+    	// this action does not need any authentication. The authentication is already done by the preceding AuthenticationRequest-Action.
+        return false;
+    }
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IAction#getDefaultActionName()
+     */
+    public String getDefaultActionName() {
+        return STORKProtocol.ATTRIBUTE_COLLECTOR;
+    }
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AttributeProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AttributeProvider.java
new file mode 100644
index 000000000..2914d8f7d
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AttributeProvider.java
@@ -0,0 +1,56 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
+import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+
+import eu.stork.peps.auth.commons.IPersonalAttributeList;
+import eu.stork.peps.auth.commons.PersonalAttribute;
+
+/**
+ * An {@link AttributeProvider} can fetch a set of stork attributes. It might complete the query within one method call,
+ * but might also need to redirect to another webservice to accomplish its task.
+ */
+public interface AttributeProvider {
+	
+	/**
+	 * Acquire the specified attribute. Returns {@code null} when attribute retrieval is in progress, but requires for
+	 * for redirecting the user to an external service. Use {@link AttributeProvider#parse(HttpServletRequest)} to parse
+	 * the response.
+	 *
+	 * @param attributes the list of attributes to be acquired
+	 * @param spCountyCode the sp county code
+	 * @param moasession the moasession
+	 * @return the personal attribute
+	 * @throws UnsupportedAttributeException the unsupported attribute exception
+	 * @throws ExternalAttributeRequestRequiredException an attribute request to an external service has to be done
+	 * @throws MOAIDException the mOAID exception
+	 */
+	public IPersonalAttributeList acquire(PersonalAttribute attributes, String spCountyCode, AuthenticationSession moasession) throws UnsupportedAttributeException, ExternalAttributeRequestRequiredException, MOAIDException;
+
+	/**
+	 * Perform redirect.
+	 *
+	 * @param url the return URL ending with ?artifactId=...
+	 * @param req the request we got from the S-PEPS and for which we have to ask our APs
+	 * @param resp the response to the preceding request
+	 * @param oaParam the oa param
+	 * @throws MOAIDException the mOAID exception
+	 */
+	public void performRedirect(String url, HttpServletRequest req, HttpServletResponse resp, OAAuthParameter oaParam) throws MOAIDException;
+	
+	/**
+	 * Parses the response we got from the external attribute provider.
+	 *
+	 * @param httpReq the http req
+	 * @return a list of attributes
+	 * @throws UnsupportedAttributeException if the provider cannot find anything familiar in the provided httpReq
+	 * @throws MOAIDException if something went wrong
+	 */
+	public IPersonalAttributeList parse(HttpServletRequest httpReq) throws UnsupportedAttributeException, MOAIDException;
+
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AttributeProviderFactory.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AttributeProviderFactory.java
new file mode 100644
index 000000000..a339cff23
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AttributeProviderFactory.java
@@ -0,0 +1,73 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+import at.gv.egovernment.moa.id.commons.db.dao.config.AttributeProviderPlugin;
+import at.gv.egovernment.moa.logging.Logger;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * A factory for creating AttributeProvider objects.
+ */
+public class AttributeProviderFactory {
+
+    /**
+     * Gets the available plugins.
+     *
+     * @return the available plugins
+     */
+    public static List<String> getAvailablePlugins() {
+        List<String> result = new ArrayList<String>();
+        result.add("StorkAttributeRequestProvider");
+        result.add("EHvdAttributeProvider");
+        result.add("SignedDocAttributeRequestProvider");
+        result.add("MandateAttributeRequestProvider");
+
+        return result;
+    }
+
+    /**
+     * Creates an AttributeProvider object for the given shortname. Returns
+     * {@code null} if there is no such provider available.
+     *
+     * @param shortname the simpleName for the providers class
+     * @return the attribute provider
+     */
+    public static AttributeProvider create(String shortname, String url, String attributes) {
+        if (shortname.equals("StorkAttributeRequestProvider")) {
+            return new StorkAttributeRequestProvider(url, attributes);
+        } else if (shortname.equals("EHvdAttributeProvider")) {
+            return new EHvdAttributeProviderPlugin(url, attributes);
+        } else if (shortname.equals("SignedDocAttributeRequestProvider")) {
+            return new SignedDocAttributeRequestProvider(url, attributes);
+        } else if (shortname.equals("MandateAttributeRequestProvider")) {
+            try {
+                return new MandateAttributeRequestProvider(url, attributes);
+            } catch (Exception ex) {
+                ex.printStackTrace();
+                return null;
+            }
+        } else {
+            return null;
+        }
+    }
+
+    /**
+     * Gets fresh instances of the configured plugins.
+     *
+     * @param configuredAPs the configured a ps
+     * @return the configured plugins
+     */
+    public static List<AttributeProvider> getConfiguredPlugins(
+            List<AttributeProviderPlugin> configuredAPs) {
+
+        List<AttributeProvider> result = new ArrayList<AttributeProvider>();
+        for (AttributeProviderPlugin current : configuredAPs) {
+
+            result.add(create(current.getName(), current.getUrl(), current.getAttributes()));
+            Logger.debug("Adding configured attribute provider: " + current.getClass().getName() + current.getName() + " at " + current.getUrl());
+        }
+
+        return result;
+    }
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AuthenticationRequest.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AuthenticationRequest.java
new file mode 100644
index 000000000..5e49fe413
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AuthenticationRequest.java
@@ -0,0 +1,201 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
+import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.id.moduls.IAction;
+import at.gv.egovernment.moa.id.moduls.IRequest;
+import at.gv.egovernment.moa.id.util.client.mis.simple.MISMandate;
+import at.gv.egovernment.moa.logging.Logger;
+import eu.stork.peps.auth.commons.*;
+import eu.stork.peps.auth.engine.STORKSAMLEngine;
+import eu.stork.peps.exceptions.STORKSAMLEngineException;
+import org.apache.velocity.app.VelocityEngine;
+import org.apache.velocity.runtime.RuntimeConstants;
+import org.joda.time.DateTime;
+import org.w3c.dom.Element;
+import org.w3c.dom.NamedNodeMap;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+
+/**
+ * Second request step - after authentication of the user is done and moasession obtained,
+ * process request and forward the user further to PEPS and/or other entities
+ *
+ * @author bsuzic
+ */
+
+public class AuthenticationRequest implements IAction {
+
+
+    private VelocityEngine velocityEngine;
+    private AuthenticationSession moaSession = null;
+    private MOASTORKRequest moaStorkRequest = null;
+
+
+    public String processRequest(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp, AuthenticationSession moasession) throws MOAIDException {
+
+        this.moaSession = moasession;
+
+        if (req instanceof MOASTORKRequest) {
+
+            this.moaStorkRequest = (MOASTORKRequest) req;
+
+            Logger.debug("Entering MOASTORKRequest");
+            httpResp.reset();
+            
+            OAAuthParameter oaParam = AuthConfigurationProvider.getInstance().getOnlineApplicationParameter(moasession.getPublicOAURLPrefix());
+            if (oaParam == null)
+                throw new AuthenticationException("stork.12", new Object[]{moasession.getPublicOAURLPrefix()});
+
+            MOASTORKResponse moaStorkResponse = new MOASTORKResponse();
+            
+            // check if it is attribute query
+            if (moaStorkRequest.isAttrRequest()) {
+                Logger.debug("Starting AttrQueryRequest");
+                
+                moaStorkResponse.setSTORKAttrResponse(new STORKAttrQueryResponse());
+            }
+            // check if we have authentication request
+            else if (moaStorkRequest.isAuthnRequest()) {
+                Logger.debug("Starting AuthenticationRequest");
+                moaStorkResponse.setSTORKAuthnResponse(new STORKAuthnResponse());
+
+
+                STORKSAMLEngine engine = STORKSAMLEngine.getInstance("VIDP");
+
+                Logger.debug("Starting generation of SAML response");
+                try {
+                    moaStorkResponse.setSTORKAuthnResponse(engine.generateSTORKAuthnResponse(moaStorkRequest.getStorkAuthnRequest(), moaStorkResponse.getStorkAuthnResponse(),httpReq.getRemoteAddr(), false));
+                } catch (STORKSAMLEngineException ex) {
+                    // TODO
+                }
+
+                // Get personal attributtes from MOA/IdentityLink
+                moaStorkResponse.setPersonalAttributeList(populateAttributes());
+
+
+            }
+            
+            //moaStorkResponse.setCountry(moaStorkRequest.getSpCountry());
+
+            // Prepare extended attributes
+            Logger.debug("Preparing data container");
+
+            // create fresh container
+            DataContainer container = new DataContainer();
+
+            // - fill in the request we extracted above
+            container.setRequest(moaStorkRequest);
+
+            // - fill in the partial response created above
+            container.setResponse(moaStorkResponse);
+
+            container.setRemoteAddress(httpReq.getRemoteAddr());
+
+
+            STORKAuthnResponse arep = moaStorkResponse.getStorkAuthnResponse();
+
+
+            arep.setCountry("XX");
+            arep.setInResponseTo("xxxx");
+            arep.setMessage("xxxx");
+            arep.setSamlId("xxxx");
+            arep.setStatusCode("xxxx");
+
+           // arep.setNotBefore(new DateTime().withTimeAtStartOfDay());
+           // arep.setNotOnOrAfter(new DateTime().withTimeAtStartOfDay());
+
+
+            Logger.debug("Data container prepared");
+
+            return (new AttributeCollector()).processRequest(container, httpReq, httpResp, moasession, oaParam);
+        } else {
+            Logger.error("Could not recognize request.");
+            throw new MOAIDException("stork.15", null);
+        }
+    }
+
+    public boolean needAuthentication(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp) {
+        return true;
+    }
+
+
+    private void iterate(NamedNodeMap attributesList) {
+        for (int j = 0; j < attributesList.getLength(); j++) {
+            Logger.debug("--Attribute: "
+                    + attributesList.item(j).getNodeName() + " = "
+                    + attributesList.item(j).getNodeValue());
+        }
+    }
+
+
+    // does nothing
+    public void mandate(AuthenticationSession moasession) {
+
+        if (moasession.getUseMandate()) {
+            try {
+                MISMandate mandate = moasession.getMISMandate();
+                String owbpk = mandate.getOWbPK();
+                byte[] mand = mandate.getMandate();
+                String profprep = mandate.getProfRep();
+                //String textdesc = mandate.getTextualDescriptionOfOID();
+                Element mndt = moasession.getMandate();
+
+                iterate(mndt.getAttributes());
+                Logger.debug("mandate encoded: " + new String(org.bouncycastle.util.encoders.Base64.encode(mand)));
+            } catch (Exception x) {
+                Logger.debug("There is no mandate used in transaction");
+            }
+        }
+
+
+    }
+
+    public PersonalAttributeList populateAttributes() {
+
+        IPersonalAttributeList attrLst = moaStorkRequest.getStorkAuthnRequest().getPersonalAttributeList();
+        Logger.info("Found " + attrLst.size() + " personal attributes in the request.");
+
+        // Define attribute list to be populated
+        PersonalAttributeList attributeList = new PersonalAttributeList();
+        MOAAttributeProvider moaAttributeProvider = new MOAAttributeProvider(moaSession.getIdentityLink(), moaStorkRequest);
+
+        try {
+            for (PersonalAttribute personalAttribute : attrLst) {
+                Logger.debug("Personal attribute found in request: " + personalAttribute.getName() + " isRequired: " + personalAttribute.isRequired());
+                moaAttributeProvider.populateAttribute(attributeList, personalAttribute);
+            }
+        } catch (Exception e) {
+            Logger.error("Exception, attributes: " + e.getMessage());
+        }
+
+        Logger.debug("AUTHBLOCK " + moaSession.getAuthBlock());
+        Logger.debug("TARGET " + moaSession.getTarget() + " " + moaSession.getTargetFriendlyName());
+        Logger.debug("SESSION IDENTIFIER " + moaSession.getCcc() + " " + moaSession.getDomainIdentifier());
+        Logger.debug("AUTHBLOCKTOKKEN" + moaSession.getAuthBlockTokken());
+
+        return attributeList;
+    }
+
+    public String getDefaultActionName() {
+        return STORKProtocol.AUTHENTICATIONREQUEST;
+    }
+
+
+    private void initVelocityEngine() throws Exception {
+        velocityEngine = new VelocityEngine();
+        velocityEngine.setProperty(RuntimeConstants.ENCODING_DEFAULT, "UTF-8");
+        velocityEngine.setProperty(RuntimeConstants.OUTPUT_ENCODING, "UTF-8");
+        velocityEngine.setProperty(RuntimeConstants.RESOURCE_LOADER, "classpath");
+        velocityEngine.setProperty("classpath.resource.loader.class",
+                "org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader");
+
+        velocityEngine.init();
+    }
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/ConsentEvaluator.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/ConsentEvaluator.java
new file mode 100644
index 000000000..9a3376e4c
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/ConsentEvaluator.java
@@ -0,0 +1,208 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+import java.io.StringWriter;
+import java.util.ArrayList;
+import java.util.HashMap;
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
+import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
+import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.id.moduls.IAction;
+import at.gv.egovernment.moa.id.moduls.IRequest;
+import at.gv.egovernment.moa.id.storage.AssertionStorage;
+import at.gv.egovernment.moa.id.util.VelocityProvider;
+import at.gv.egovernment.moa.logging.Logger;
+import eu.stork.peps.auth.commons.PEPSUtil;
+import eu.stork.peps.auth.commons.PersonalAttribute;
+import eu.stork.peps.auth.commons.STORKAuthnResponse;
+import eu.stork.peps.auth.engine.STORKSAMLEngine;
+import eu.stork.peps.exceptions.STORKSAMLEngineException;
+import org.apache.velocity.Template;
+import org.apache.velocity.VelocityContext;
+import org.apache.velocity.app.VelocityEngine;
+import org.joda.time.DateTime;
+import org.opensaml.common.impl.SecureRandomIdentifierGenerator;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+/**
+ * The ConsentEvaluator assists with fetching user consent on the list of attributes to be sent to the asking S-PEPS.
+ */
+public class ConsentEvaluator implements IAction {
+
+    /**
+     * The Constant ARTIFACT_ID.
+     */
+    private static final String ARTIFACT_ID = "artifactId";
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IAction#processRequest(at.gv.egovernment.moa.id.moduls.IRequest, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, at.gv.egovernment.moa.id.auth.data.AuthenticationSession)
+     */
+    public String processRequest(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp, AuthenticationSession moasession) throws MOAIDException {
+
+		// - fetch the container
+		String artifactId = (String) httpReq.getParameter(ARTIFACT_ID);
+		DataContainer container;
+		try {
+			container = AssertionStorage.getInstance().get(artifactId, DataContainer.class);
+		} catch (MOADatabaseException e) {
+			Logger.error("Error fetching incomplete Stork response from temporary storage. Most likely a timeout occured.", e);
+			throw new MOAIDException("stork.17", null);
+		}
+
+		// evaluate response
+		for(PersonalAttribute current : container.getResponse().getPersonalAttributeList()) {
+			if(null == httpReq.getParameter(current.getName())) {
+				current.setStatus("notAvailable");
+				current.setValue(new ArrayList<String>());
+				current.setComplexValue(new HashMap<String, String>());
+			}
+		}
+
+        // build and send response
+        generateSTORKResponse(httpResp, container);
+        
+        return "12345"; // AssertionId
+    }
+
+	/**
+	 * Fills the given HttpResponse with the required web page.
+	 *
+	 * @param container the container
+	 * @param response the response
+	 * @param oaParam the oa param
+	 * @return the string
+	 * @throws MOAIDException the mOAID exception
+	 */
+	public String requestConsent(DataContainer container, HttpServletResponse response, OAAuthParameter oaParam) throws MOAIDException {
+		// prepare redirect
+		String newArtifactId;
+		try {
+
+			// memorize the container again
+			Logger.debug("prepare putting the container into temporary storage...");
+
+			// - generate new key
+			newArtifactId = new SecureRandomIdentifierGenerator().generateIdentifier();
+
+			// - put container in temporary store.
+			AssertionStorage.getInstance().put(newArtifactId, container);
+
+			Logger.debug("...successful");
+
+		} catch (Exception e1) {
+			// TODO should we return the response as is to the PEPS?
+			e1.printStackTrace();
+            Logger.error("Error putting incomplete Stork response into temporary storage", e1);
+			throw new MOAIDException("stork.17", null);
+		}
+
+		// ask for consent
+		try {
+			VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
+			Template template = velocityEngine.getTemplate("/resources/templates/stork2_consent.html");
+			VelocityContext context = new VelocityContext();
+
+			context.put("action", AuthConfigurationProvider.getInstance().getPublicURLPrefix() + "/stork2/CompleteAuthentication?" + ARTIFACT_ID + "=" + newArtifactId);
+
+			// assemble table
+			String table = "";
+			for (PersonalAttribute current : container.getResponse().getPersonalAttributeList())
+				if ("Available".equals(current.getStatus()))
+					table += "<tr><td><input type=\"checkbox\" checked=\"yes\" name=\"" + current.getName() + "\"></td><td>" + current.getName() + "</td></tr>\n";
+
+			context.put("tablecontent", table);
+
+			StringWriter writer = new StringWriter();
+			template.merge(context, writer);
+			response.getOutputStream().write(writer.getBuffer().toString().getBytes());
+
+		} catch (Exception e) {
+			Logger.error("Velocity error: " + e.getMessage());
+			throw new MOAIDException("stork.17", null);
+		}
+
+		return "12345"; // AssertionId
+	}
+
+    /**
+     * generates binary response from given response class and fill the given HttpResponse with a SAML Post Binding template.
+     *
+     * @param httpResp the http resp
+     * @param container the container
+     * @throws MOAIDException the mOAID exception
+     */
+    public void generateSTORKResponse(HttpServletResponse httpResp, DataContainer container) throws MOAIDException {
+    	MOASTORKRequest request = container.getRequest();
+        MOASTORKResponse response = container.getResponse();
+        
+        Logger.info("generating stork response...");
+
+        try {
+            //Get SAMLEngine instance
+            STORKSAMLEngine engine = STORKSAMLEngine.getInstance("VIDP");
+            Logger.debug("Starting generation of SAML response");
+			if(response.isAuthnResponse())
+				response.setSTORKAuthnResponse(engine.generateSTORKAuthnResponse(request.getStorkAuthnRequest(), response.getStorkAuthnResponse(), container.getRemoteAddress(), false));
+			else
+				response.setSTORKAttrResponse(engine.generateSTORKAttrQueryResponse(request.getStorkAttrQueryRequest(), response.getStorkAttrQueryResponse(), container.getRemoteAddress(), "", false));
+
+
+            //generateSAML Token
+            Logger.info("SAML response succesfully generated!");
+        } catch (STORKSAMLEngineException e) {
+            Logger.error("Failed to generate STORK SAML Response", e);
+            throw new MOAIDException("stork.05", null);
+        }
+
+        // preparing redirection for the client
+        try {
+            VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
+            Template template = velocityEngine.getTemplate("/resources/templates/stork2_postbinding_template.html");
+            VelocityContext context = new VelocityContext();
+            
+            byte[] blob;
+			if(request.isAttrRequest())
+            	blob = response.getStorkAttrQueryResponse().getTokenSaml();
+            else
+            	blob = response.getStorkAuthnResponse().getTokenSaml();
+
+            context.put("SAMLResponse", PEPSUtil.encodeSAMLToken(blob));
+            Logger.debug("SAMLResponse original: " + new String(blob));
+
+            Logger.debug("Putting assertion consumer url as action: " + request.getAssertionConsumerServiceURL());
+            context.put("action", request.getAssertionConsumerServiceURL());
+            Logger.debug("Starting template merge");
+            StringWriter writer = new StringWriter();
+
+            Logger.debug("Doing template merge");
+            template.merge(context, writer);
+            Logger.debug("Template merge done");
+
+            Logger.debug("Sending html content: " + writer.getBuffer().toString());
+            Logger.debug("Sending html content2  : " + new String(writer.getBuffer()));
+
+            httpResp.getOutputStream().write(writer.getBuffer().toString().getBytes());
+
+        } catch (Exception e) {
+            Logger.error("Velocity error: " + e.getMessage());
+        }
+    }
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IAction#needAuthentication(at.gv.egovernment.moa.id.moduls.IRequest, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
+     */
+    public boolean needAuthentication(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp) {
+    	// this action does not need any authentication. The authentication is already done by the preceding AuthenticationRequest-Action.
+        return false;
+    }
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IAction#getDefaultActionName()
+     */
+    public String getDefaultActionName() {
+        return STORKProtocol.CONSENT_EVALUATOR;
+    }
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/DataContainer.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/DataContainer.java
new file mode 100644
index 000000000..d13754aff
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/DataContainer.java
@@ -0,0 +1,78 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+import java.io.Serializable;
+
+/**
+ * Holds info about an ongoing but yet incomplete stork authnrequest process.
+ */
+public class DataContainer implements Serializable {
+	
+	/** The Constant serialVersionUID. */
+	private static final long serialVersionUID = -8765997480582363012L;
+
+	/** The incoming request. */
+	private MOASTORKRequest request;
+	
+	/** The yet incomplete response. */
+	private MOASTORKResponse response;
+	
+	/** The target. */
+	private String target;
+	
+	/** The remote address. */
+	private String remoteAddress;
+	
+	/**
+	 * Gets the request.
+	 *
+	 * @return the request
+	 */
+	public MOASTORKRequest getRequest() {
+		return request;
+	}
+
+	/**
+	 * Sets the request.
+	 *
+	 * @param moaStorkRequest the new request
+	 */
+	public void setRequest(MOASTORKRequest moaStorkRequest) {
+		this.request = moaStorkRequest;
+	}
+
+	/**
+	 * Gets the response.
+	 *
+	 * @return the response
+	 */
+	public MOASTORKResponse getResponse() {
+		return response;
+	}
+
+	/**
+	 * Sets the response.
+	 *
+	 * @param moaStorkResponse the new response
+	 */
+	public void setResponse(MOASTORKResponse moaStorkResponse) {
+		this.response = moaStorkResponse;
+	}
+
+	/**
+	 * Gets the remote address.
+	 *
+	 * @return the remote address
+	 */
+	public String getRemoteAddress() {
+		return remoteAddress;
+	}
+
+	/**
+	 * Sets the remote address.
+	 *
+	 * @param remoteAddress the new remote address
+	 */
+	public void setRemoteAddress(String remoteAddress) {
+		this.remoteAddress = remoteAddress;
+	}
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/EHvdAttributeProviderPlugin.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/EHvdAttributeProviderPlugin.java
new file mode 100644
index 000000000..5e9d9404c
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/EHvdAttributeProviderPlugin.java
@@ -0,0 +1,222 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+import java.io.StringWriter;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.Map;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.xml.bind.JAXBContext;
+import javax.xml.bind.Marshaller;
+import javax.xml.soap.MessageFactory;
+import javax.xml.soap.SOAPBody;
+import javax.xml.soap.SOAPConnection;
+import javax.xml.soap.SOAPConnectionFactory;
+import javax.xml.soap.SOAPElement;
+import javax.xml.soap.SOAPEnvelope;
+import javax.xml.soap.SOAPMessage;
+import javax.xml.soap.SOAPPart;
+import at.gv.egovernment.moa.id.auth.builder.BPKBuilder;
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
+import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.logging.Logger;
+import eu.stork.peps.auth.commons.IPersonalAttributeList;
+import eu.stork.peps.auth.commons.PersonalAttribute;
+import eu.stork.peps.auth.commons.PersonalAttributeList;
+import eu.stork.peps.complex.attributes.IsHealthCareProfessionalType;
+import eu.stork.peps.complex.attributes.ObjectFactory;
+
+/**
+ * Fetches the attribute IsHealthcareProfessional from the BAGDAD SOAP service
+ */
+public class EHvdAttributeProviderPlugin implements AttributeProvider {
+	
+	/** The destination. */
+	private Object destination;
+	
+	/** The attributes. */
+	private String attributes;
+
+	/**
+	 * Instantiates a new e hvd attribute provider plugin.
+	 *
+	 * @param url the service url
+	 * @param attributes 
+	 */
+	public EHvdAttributeProviderPlugin(String url, String supportedAttributes) {
+		destination = url;
+		attributes = supportedAttributes;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#acquire(eu.stork.peps.auth.commons.PersonalAttribute)
+	 */
+	public IPersonalAttributeList acquire(PersonalAttribute attribute, String spCountryCode, AuthenticationSession moasession)
+			throws UnsupportedAttributeException,
+			ExternalAttributeRequestRequiredException, MOAIDException {
+
+		// break when we cannot handle the requested attribute
+		if(!attributes.contains(attribute.getName()))
+			throw new UnsupportedAttributeException();
+		
+		try {
+	    	Logger.debug("initializing SOAP connections...");
+			// create SOAP connection
+			SOAPConnection soapConnection = SOAPConnectionFactory.newInstance().createConnection();
+			
+			// assemble SOAP request
+			MessageFactory messageFactory = MessageFactory.newInstance();
+			SOAPMessage requestMessage = messageFactory.createMessage();
+			SOAPPart requestPart = requestMessage.getSOAPPart();
+
+			// (soap 1.1 relevant part. could not find a solution to use soap 1.2 in time.
+			requestMessage.getMimeHeaders().setHeader("SOAPAction", "http://gesundheit.gv.at/BAGDAD/DataAccessService/IsHealthcareProfessional");
+
+            /*
+            Construct SOAP Request Message:
+			<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
+			  <soap:Body>
+			    <IsHealthcareProfessional xmlns="http://gesundheit.gv.at/BAGDAD/DataAccessService">
+			      <bPK>string</bPK>
+			    </IsHealthcareProfessional>
+			  </soap:Body>
+			</soap:Envelope>
+
+			see https://stork.ehealth.gv.at/GDAService.asmx?op=IsHealthcareProfessional
+             */
+
+			// SOAP Envelope
+			SOAPEnvelope envelope = requestPart.getEnvelope();
+
+			// SOAP Body
+			SOAPBody requestBody = envelope.getBody();
+			SOAPElement requestBodyElem = requestBody.addChildElement("IsHealthcareProfessional");
+			requestBodyElem.addAttribute(envelope.createName("xmlns"), "http://gesundheit.gv.at/BAGDAD/DataAccessService");
+
+			SOAPElement requestBodyElem1 = requestBodyElem.addChildElement("bPK");
+			requestBodyElem1.addTextNode(new BPKBuilder().buildBPK(moasession.getIdentityLink().getIdentificationValue(), "GH"));
+
+			requestMessage.saveChanges();
+
+			// perform SOAP call
+	    	Logger.debug("call...");
+			SOAPMessage responseMessage = soapConnection.call(requestMessage, destination);
+
+			// parse SOAP response
+
+            /*
+			<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
+			  <soap:Body>
+			    <IsHealthcareProfessionalResponse xmlns="http://gesundheit.gv.at/BAGDAD/DataAccessService">
+			      <IsHealthcareProfessionalResult>
+			        <RequestOK>boolean</RequestOK>
+			        <Message>string</Message>
+			        <IsHealthcareProfessional>boolean</IsHealthcareProfessional>
+			        <NameOfOrganisation>string</NameOfOrganisation>
+			        <Type>string</Type>
+			        <Specialization>string</Specialization>
+			      </IsHealthcareProfessionalResult>
+			    </IsHealthcareProfessionalResponse>
+			  </soap:Body>
+			</soap:Envelope>
+
+			see https://stork.ehealth.gv.at/GDAService.asmx?op=IsHealthcareProfessional
+             */
+	    	Logger.debug("call successful. Parse...");
+			SOAPBody responseBody = responseMessage.getSOAPBody();
+
+			// iterate through tree
+			SOAPElement responseElement = (SOAPElement) responseBody.getChildElements().next();
+			SOAPElement resultElement = (SOAPElement) responseElement.getChildElements().next();
+
+			// collect all info in a map
+			Iterator<?> it = resultElement.getChildElements();
+			Map<String, String> collection = new HashMap<String, String>();
+			while (it.hasNext()) {
+				SOAPElement current = (SOAPElement) it.next();
+
+				collection.put(current.getNodeName(), current.getTextContent());
+			}
+
+			// check if there is anything valid in the map
+			if (collection.isEmpty() || collection.size() != 6) {
+				Logger.warn("eHVD returned an unexpected count of values. Expected 6 got " + collection.size());
+				throw new IndexOutOfBoundsException("response attributes not like specified");
+			}
+
+			// - fetch request validity
+			if (collection.get("RequestOK").equals("false")) {
+				Logger.warn("eHVD reported an invalid request. The error message is: " + collection.get("Message"));
+				throw new Exception("eHVD reported an invalid request");
+			}
+
+			PersonalAttribute acquiredAttribute = null;
+
+			if (collection.get("IsHealthcareProfessional").equals("false")) {
+				// the citizen is no HCP
+				acquiredAttribute = new PersonalAttribute("isHealthCareProfessional", false, new ArrayList<String>(), "NotAvailable");
+			} else {
+				// go on and parse the data
+				IsHealthCareProfessionalType result = new IsHealthCareProfessionalType();
+				result.setNameOfOrganisation(collection.get("NameOfOrganisation"));
+
+				if (collection.get("Type").equals("Medical doctor"))
+					result.setHCPType("D");
+				else
+					result.setHCPType("?");
+
+				if (collection.get("Specialization").contains("Arzt für Allgemeinmedizin"))
+					result.setSpecialisation("GP");
+				else
+					result.setSpecialisation("??");
+
+				result.setAQAA(4);
+
+				final Marshaller m = JAXBContext.newInstance(IsHealthCareProfessionalType.class).createMarshaller();
+			    m.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, true);
+			    
+			    StringWriter stringWriter = new StringWriter();
+			    m.marshal(new ObjectFactory().createIsHealthCareProfessional(result), stringWriter);		    
+				
+				ArrayList<String> value = new ArrayList<String>();
+				value.add(stringWriter.toString());
+
+				acquiredAttribute = new PersonalAttribute("isHealthCareProfessional", false, value, "Available");
+			}
+
+			// pack and return the result
+			PersonalAttributeList result = new PersonalAttributeList();
+			result.add(acquiredAttribute);
+
+			// add stork id for verification
+			ArrayList<String> value = new ArrayList<String>();
+			value.add(new BPKBuilder().buildStorkbPK(moasession.getIdentityLink().getIdentificationValue(), spCountryCode));
+			result.add(new PersonalAttribute("eIdentifier", false, value, "Available"));
+
+			return result;
+		} catch (Exception e) {
+			throw new MOAIDException("stork.13", new Object[] { e });
+		}
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#performRedirect(java.lang.String, java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, at.gv.egovernment.moa.id.config.auth.OAAuthParameter)
+	 */
+	public void performRedirect(String url,
+			HttpServletRequest req, HttpServletResponse resp,
+			OAAuthParameter oaParam) throws MOAIDException {
+		// there is no redirect required
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#parse(javax.servlet.http.HttpServletRequest)
+	 */
+	public IPersonalAttributeList parse(HttpServletRequest httpReq)
+			throws UnsupportedAttributeException, MOAIDException {
+		// there is no redirect required, so we throw an exception when someone asks us to parse a response
+		throw new UnsupportedAttributeException();
+	}
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/ExternalAttributeRequestRequiredException.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/ExternalAttributeRequestRequiredException.java
new file mode 100644
index 000000000..67fbd50f8
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/ExternalAttributeRequestRequiredException.java
@@ -0,0 +1,29 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+public class ExternalAttributeRequestRequiredException extends Exception {
+	
+	/** The Constant serialVersionUID. */
+	private static final long serialVersionUID = 5207631348933518908L;
+	
+	/** The ap. */
+	private AttributeProvider ap;
+
+	/**
+	 * Instantiates a new external attribute request required exception.
+	 *
+	 * @param provider the provider
+	 */
+	public ExternalAttributeRequestRequiredException(AttributeProvider provider) {
+		ap = provider;
+	}
+
+	/**
+	 * Gets the ap that caused the exception.
+	 *
+	 * @return the ap
+	 */
+	public AttributeProvider getAp() {
+		return ap;
+	}
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOAAttributeProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOAAttributeProvider.java
new file mode 100644
index 000000000..873ec1e26
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOAAttributeProvider.java
@@ -0,0 +1,104 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+import at.gv.egovernment.moa.id.auth.builder.BPKBuilder;
+import at.gv.egovernment.moa.id.auth.data.IdentityLink;
+import at.gv.egovernment.moa.id.auth.exception.BuildException;
+import at.gv.egovernment.moa.logging.Logger;
+import eu.stork.peps.auth.commons.PersonalAttribute;
+import eu.stork.peps.auth.commons.PersonalAttributeList;
+
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author bsuzic
+ *         Date: 2/19/14, Time: 4:42 PM
+ */
+public class MOAAttributeProvider {
+    private final IdentityLink identityLink;
+    private static final Map<String, String> storkAttributeSimpleMapping;
+    private static final Map<String, String> storkAttributeFunctionMapping;
+    private final MOASTORKRequest moastorkRequest;
+
+    static {
+        Map<String, String> tempSimpleMap = new HashMap<String, String>();
+        tempSimpleMap.put("givenName", "getGivenName");
+        tempSimpleMap.put("surname", "getFamilyName");
+        tempSimpleMap.put("dateOfBirth", "getDateOfBirth");
+        storkAttributeSimpleMapping = Collections.unmodifiableMap(tempSimpleMap);
+        Map<String, String> tempFunctionMap = new HashMap<String, String>();
+        tempFunctionMap.put("eIdentifier", "geteIdentifier");
+        storkAttributeFunctionMapping = Collections.unmodifiableMap(tempFunctionMap);
+    }
+
+    public MOAAttributeProvider(IdentityLink identityLink, MOASTORKRequest moastorkRequest) {
+        this.identityLink = identityLink;
+        this.moastorkRequest = moastorkRequest;
+        Logger.debug("identity " + identityLink.getIdentificationType() + " " + identityLink.getIdentificationValue());
+    }
+
+    public void populateAttribute(PersonalAttributeList attributeList, PersonalAttribute requestedAttribute ) {
+        String storkAttribute = requestedAttribute.getName();
+        if (storkAttributeSimpleMapping.containsKey(storkAttribute)) {
+            Logger.debug("Trying to get value for attribute using simple mapping [" + storkAttribute + "]");
+            try {
+                Method method = identityLink.getClass().getDeclaredMethod(storkAttributeSimpleMapping.get(storkAttribute));
+                populateAttributeWithMethod(method, identityLink, attributeList, storkAttribute, requestedAttribute.isRequired());
+            } catch (NoSuchMethodException e) {
+                Logger.error("Could not found MOA extraction method while getting attribute: " + storkAttribute);
+                e.printStackTrace();
+            }
+
+        } else if (storkAttributeFunctionMapping.containsKey(storkAttribute)) {
+
+            Logger.debug("Trying to get value for attribute using function mapping [" + storkAttribute + "]");
+            try {
+                Method method = this.getClass().getDeclaredMethod(storkAttributeFunctionMapping.get(storkAttribute));
+                populateAttributeWithMethod(method, this, attributeList, storkAttribute, requestedAttribute.isRequired());
+            } catch (NoSuchMethodException e) {
+                Logger.error("Could not found MOA extraction method while getting attribute: " + storkAttribute);
+                e.printStackTrace();
+            }
+        } else {
+            Logger.debug("MOA method for extraction of attribute " + storkAttribute + " not defined.");
+        }
+    }
+
+    private String geteIdentifier() {
+        Logger.debug("Using base urn for identification value: " + identityLink.getIdentificationType() + " and target country: " + moastorkRequest.getStorkAuthnRequest().getSpCountry());
+        try {
+            return new BPKBuilder().buildStorkbPK(identityLink.getIdentificationValue(), moastorkRequest.getStorkAuthnRequest().getSpCountry());
+        } catch (BuildException be) {
+            Logger.error("Stork eid could not be constructed; " + be.getMessage());
+            return null; // TODO error
+        }
+    }
+
+
+    private void populateAttributeWithMethod(Method method, Object object, PersonalAttributeList attributeList, String storkAttribute, Boolean isRequired) {
+        try {
+            String attributeValue = method.invoke(object, new Class[]{}).toString();
+            PersonalAttribute newAttribute = new PersonalAttribute();
+            newAttribute.setName(storkAttribute);
+
+            newAttribute.setStatus("Available");
+            newAttribute.setIsRequired(isRequired);
+            Logger.info("Got attribute value: " + attributeValue);
+            newAttribute.setValue(new ArrayList<String>(edu.emory.mathcs.backport.java.util.Collections.singletonList(attributeValue)));
+            attributeList.add(newAttribute);
+        } catch (InvocationTargetException e) {
+            Logger.error("Invocation target exception while getting attribute: " + storkAttribute);
+            e.printStackTrace();
+        } catch (IllegalAccessException e) {
+            Logger.error("Illegal access exception while getting attribute: " + storkAttribute);
+            e.printStackTrace();
+        }
+    }
+
+
+}
+
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOASTORKRequest.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOASTORKRequest.java
new file mode 100644
index 000000000..9ea33c8ef
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOASTORKRequest.java
@@ -0,0 +1,213 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+import java.io.Serializable;
+
+import at.gv.egovernment.moa.id.moduls.IRequest;
+import at.gv.egovernment.moa.logging.Logger;
+import eu.stork.peps.auth.commons.IPersonalAttributeList;
+import eu.stork.peps.auth.commons.STORKAttrQueryRequest;
+import eu.stork.peps.auth.commons.STORKAuthnRequest;
+
+/**
+ * Implements MOA request and stores StorkAuthn/Attr-Request related data.
+ *
+ * @author bsuzic
+ */
+public class MOASTORKRequest implements IRequest, Serializable {
+	
+	/** The Constant serialVersionUID. */
+	private static final long serialVersionUID = 4581953368724501376L;
+	
+	/** The request id. */
+	private String requestID;
+    
+    /** The target. */
+    private String target = null;
+    
+    /** The module. */
+    String module = null;
+    
+    /** The action. */
+    String action = null;
+    
+    /** The stork authn request. */
+    private STORKAuthnRequest storkAuthnRequest;
+    
+    /** The stork attr query request. */
+    private STORKAttrQueryRequest storkAttrQueryRequest;
+
+    /**
+     * Sets the sTORK authn request.
+     *
+     * @param request the new sTORK authn request
+     */
+    public void setSTORKAuthnRequest(STORKAuthnRequest request) {
+        this.storkAuthnRequest = request;
+    }
+
+    /**
+     * Sets the sTORK attr request.
+     *
+     * @param request the new sTORK attr request
+     */
+    public void setSTORKAttrRequest(STORKAttrQueryRequest request) {
+        this.storkAttrQueryRequest = request;
+    }
+
+    /**
+     * Checks if the container holds an AttrQueryRequest
+     *
+     * @return true, if is attr request
+     */
+    public boolean isAttrRequest() {
+        return null != storkAttrQueryRequest;
+    }
+
+    /**
+     * Checks if the container holds an AuthnRequest
+     *
+     * @return true, if is authn request
+     */
+    public boolean isAuthnRequest() {
+        return null != storkAuthnRequest;
+    }
+
+
+    /**
+     * Gets the stork authn request.
+     *
+     * @return the stork authn request
+     */
+    public STORKAuthnRequest getStorkAuthnRequest() {
+        return this.storkAuthnRequest;
+    }
+
+    /**
+     * Gets the stork attr query request.
+     *
+     * @return the stork attr query request
+     */
+    public STORKAttrQueryRequest getStorkAttrQueryRequest() {
+        return this.storkAttrQueryRequest;
+    }
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IRequest#getOAURL()
+     */
+    public String getOAURL() {
+        if (isAuthnRequest())
+            return storkAuthnRequest.getAssertionConsumerServiceURL();
+        else if (isAttrRequest())
+            return storkAttrQueryRequest.getAssertionConsumerServiceURL();
+        else {
+            Logger.error("There is no authentication or attribute request contained in MOASTORKRequest.");
+            return null;
+        }
+    }
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IRequest#isPassiv()
+     */
+    public boolean isPassiv() {
+        return false;
+    }
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IRequest#forceAuth()
+     */
+    public boolean forceAuth() {
+        return false;
+    }
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IRequest#isSSOSupported()
+     */
+    public boolean isSSOSupported() {
+        return false;
+    }
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IRequest#requestedModule()
+     */
+    public String requestedModule() {
+        return this.module;
+    }
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IRequest#requestedAction()
+     */
+    public String requestedAction() {
+        return action;
+    }
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IRequest#setModule(java.lang.String)
+     */
+    public void setModule(String module) {
+        this.module = module;
+    }
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IRequest#setAction(java.lang.String)
+     */
+    public void setAction(String action) {
+        this.action = action;
+    }
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IRequest#getTarget()
+     */
+    public String getTarget() {
+        return this.target;
+    }
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IRequest#setRequestID(java.lang.String)
+     */
+    public void setRequestID(String id) {
+        this.requestID = id;
+    }
+
+    /* (non-Javadoc)
+     * @see at.gv.egovernment.moa.id.moduls.IRequest#getRequestID()
+     */
+    public String getRequestID() {
+        return this.requestID;
+    }
+    
+    /**
+     * Gets the personal attribute list.
+     *
+     * @return the personal attribute list
+     */
+    public IPersonalAttributeList getPersonalAttributeList() {
+    	if(isAttrRequest())
+    		return this.storkAttrQueryRequest.getPersonalAttributeList();
+    	else
+    		return this.storkAuthnRequest.getPersonalAttributeList();
+    }
+
+	/**
+	 * Gets the sp country.
+	 *
+	 * @return the sp country
+	 */
+	public String getSpCountry() {
+    	if(isAttrRequest())
+    		return this.storkAttrQueryRequest.getSpCountry();
+    	else
+    		return this.storkAuthnRequest.getSpCountry();
+	}
+
+	/**
+	 * Gets the assertion consumer service url.
+	 *
+	 * @return the assertion consumer service url
+	 */
+	public String getAssertionConsumerServiceURL() {
+    	if(isAttrRequest())
+    		return this.storkAttrQueryRequest.getAssertionConsumerServiceURL();
+    	else
+    		return this.storkAuthnRequest.getAssertionConsumerServiceURL();
+	}
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOASTORKResponse.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOASTORKResponse.java
new file mode 100644
index 000000000..4e0f57779
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOASTORKResponse.java
@@ -0,0 +1,117 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+import java.io.Serializable;
+
+import eu.stork.peps.auth.commons.IPersonalAttributeList;
+import eu.stork.peps.auth.commons.PersonalAttributeList;
+import eu.stork.peps.auth.commons.STORKAttrQueryResponse;
+import eu.stork.peps.auth.commons.STORKAuthnResponse;
+
+/**
+ * Implements MOA request and stores StorkAuthn/Attr-Request related data.
+ *
+ * @author bsuzic
+ */
+public class MOASTORKResponse implements Serializable {
+	
+	/** The Constant serialVersionUID. */
+	private static final long serialVersionUID = -5798803155055518747L;
+	
+	/** The stork authn request. */
+	private STORKAuthnResponse storkAuthnResponse;
+    
+    /** The stork attr query request. */
+    private STORKAttrQueryResponse storkAttrQueryResponse;
+    
+    /**
+     * Sets the sTORK authn response.
+     *
+     * @param request the new sTORK authn response
+     */
+    public void setSTORKAuthnResponse(STORKAuthnResponse request) {
+        this.storkAuthnResponse = request;
+    }
+
+    /**
+     * Sets the sTORK attr response.
+     *
+     * @param request the new sTORK attr response
+     */
+    public void setSTORKAttrResponse(STORKAttrQueryResponse request) {
+        this.storkAttrQueryResponse = request;
+    }
+
+    /**
+     * Checks if the container holds an AttrQuery
+     *
+     * @return true, if is attr response
+     */
+    public boolean isAttrResponse() {
+        return null != storkAttrQueryResponse;
+    }
+
+    /**
+     * Checks if the container holds an AuthnRequest
+     *
+     * @return true, if is authn response
+     */
+    public boolean isAuthnResponse() {
+        return null != storkAuthnResponse;
+    }
+
+
+    /**
+     * Gets the AuthnResponse.
+     *
+     * @return the stork authn response
+     */
+    public STORKAuthnResponse getStorkAuthnResponse() {
+        return this.storkAuthnResponse;
+    }
+
+    /**
+     * Gets the AttrQueryResponse.
+     *
+     * @return the stork attr query response
+     */
+    public STORKAttrQueryResponse getStorkAttrQueryResponse() {
+        return this.storkAttrQueryResponse;
+    }
+    
+    /**
+     * Gets the personal attribute list.
+     *
+     * @return the personal attribute list
+     */
+    public IPersonalAttributeList getPersonalAttributeList() {
+    	if(isAttrResponse())
+    		return this.storkAttrQueryResponse.getPersonalAttributeList();
+    	else
+    		return this.storkAuthnResponse.getPersonalAttributeList();
+    }
+
+    /**
+     * Sets the personal attribute list.
+     *
+     * @param populateAttributes the new personal attribute list
+     */
+    public void setPersonalAttributeList(PersonalAttributeList populateAttributes) {
+    	if(isAttrResponse())
+    		this.storkAttrQueryResponse.setPersonalAttributeList(populateAttributes);
+    	else
+    		this.storkAuthnResponse.setPersonalAttributeList(populateAttributes);
+    }
+    
+	/**
+	 * Sets the country.
+	 *
+	 * @param spCountry the new country
+	 */
+	public void setCountry(String spCountry) {
+    	if(isAttrResponse())
+    		this.storkAttrQueryResponse.setCountry(spCountry);
+    	else
+    		this.storkAuthnResponse.setCountry(spCountry);
+	}
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MandateAttributeRequestProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MandateAttributeRequestProvider.java
new file mode 100644
index 000000000..0e94600db
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MandateAttributeRequestProvider.java
@@ -0,0 +1,125 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
+import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.id.util.HTTPUtils;
+import at.gv.egovernment.moa.id.util.VelocityProvider;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.StringUtils;
+import eu.stork.peps.auth.commons.*;
+import eu.stork.peps.auth.engine.STORKSAMLEngine;
+import eu.stork.peps.exceptions.STORKSAMLEngineException;
+import org.apache.velocity.Template;
+import org.apache.velocity.VelocityContext;
+import org.apache.velocity.app.VelocityEngine;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.StringWriter;
+
+/**
+ * Provides mandate attribute from MIS
+ */
+public class MandateAttributeRequestProvider implements AttributeProvider {
+    /**
+     * The destination.
+     */
+    private String destination;
+
+    /**
+     * The attributes.
+     */
+    private String attributes;
+
+    private String spCountryCode;
+
+    private PersonalAttributeList requestedAttributes;
+
+    public MandateAttributeRequestProvider(String aPurl, String supportedAttributes) throws MOAIDException {
+        destination = aPurl;
+        attributes = supportedAttributes;
+    }
+
+    public String getAttrProviderName() {
+        return "MandateAttributeRequestProvider";
+    }
+
+    public IPersonalAttributeList acquire(PersonalAttribute attribute, String spCountryCode, AuthenticationSession moasession) throws UnsupportedAttributeException, ExternalAttributeRequestRequiredException, MOAIDException {
+        Logger.info("Acquiring attribute: " + attribute.getName() + ", by: " + getAttrProviderName());
+        this.spCountryCode = spCountryCode;
+        requestedAttributes = new PersonalAttributeList(1);
+        requestedAttributes.add(attribute);
+
+        // break if we cannot handle the requested attribute
+        if (!attributes.contains(attribute.getName())) {
+            Logger.info("Attribute " + attribute.getName() + " not supported by the provider: " + getAttrProviderName());
+            throw new UnsupportedAttributeException();
+        }
+        PersonalAttributeList result = new PersonalAttributeList();
+        //return result;
+        Logger.info("Thrown external request by: " + getAttrProviderName());
+        throw new ExternalAttributeRequestRequiredException(this);
+    }
+
+    public void performRedirect(String url, HttpServletRequest req, HttpServletResponse resp, OAAuthParameter oaParam) throws MOAIDException {
+
+        String spSector = "Business";
+        String spInstitution = StringUtils.isEmpty(oaParam.getFriendlyName()) ? "UNKNOWN" : oaParam.getFriendlyName();
+        String spApplication = spInstitution;
+
+        //generate AuthnRquest
+        STORKAttrQueryRequest attributeRequest = new STORKAttrQueryRequest();
+        attributeRequest.setDestination(destination);
+        attributeRequest.setAssertionConsumerServiceURL(url);
+        attributeRequest.setIssuer(HTTPUtils.getBaseURL(req));
+        attributeRequest.setQaa(oaParam.getQaaLevel());
+        attributeRequest.setSpInstitution(spInstitution);
+        attributeRequest.setCountry(spCountryCode);
+        attributeRequest.setSpCountry(spCountryCode);
+        attributeRequest.setSpApplication(spApplication);
+        attributeRequest.setSpSector(spSector);
+        attributeRequest.setPersonalAttributeList(requestedAttributes);
+
+        attributeRequest.setCitizenCountryCode("AT");
+
+
+        Logger.info("STORK AttrRequest successfully assembled.");
+
+        STORKSAMLEngine samlEngine = STORKSAMLEngine.getInstance("VIDP");
+        try {
+            attributeRequest = samlEngine.generateSTORKAttrQueryRequest(attributeRequest);
+        } catch (STORKSAMLEngineException e) {
+            Logger.error("Could not sign STORK SAML AttrRequest.", e);
+            throw new MOAIDException("stork.00", null);
+        }
+
+        Logger.info("STORK AttrRequest successfully signed!");
+
+        try {
+            Logger.trace("Initialize VelocityEngine...");
+
+            VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
+            Template template = velocityEngine.getTemplate("/resources/templates/saml2-post-binding-moa.vm");
+            VelocityContext context = new VelocityContext();
+            context.put("SAMLRequest", PEPSUtil.encodeSAMLToken(attributeRequest.getTokenSaml()));
+            context.put("action", destination);
+
+            StringWriter writer = new StringWriter();
+            template.merge(context, writer);
+
+            resp.getOutputStream().write(writer.toString().getBytes());
+        } catch (Exception e) {
+            Logger.error("Error sending STORK SAML AttrRequest.", e);
+            throw new MOAIDException("stork.11", null);
+        }
+        Logger.info("STORK AttrRequest successfully rendered!");
+
+    }
+
+    public IPersonalAttributeList parse(HttpServletRequest httpReq) throws UnsupportedAttributeException, MOAIDException {
+        return null;  //
+    }
+
+}
+
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MandateRetrievalRequest.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MandateRetrievalRequest.java
new file mode 100644
index 000000000..3bd1686b4
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MandateRetrievalRequest.java
@@ -0,0 +1,28 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
+import at.gv.egovernment.moa.id.moduls.IAction;
+import at.gv.egovernment.moa.id.moduls.IRequest;
+import at.gv.egovernment.moa.logging.Logger;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+/**
+ *
+ */
+public class MandateRetrievalRequest implements IAction {
+    public String processRequest(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp, AuthenticationSession moasession) throws MOAIDException {
+        Logger.info("Entering mandateretrievalrequest");
+        return null;  //
+    }
+
+    public boolean needAuthentication(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp) {
+        return true;  //
+    }
+
+    public String getDefaultActionName() {
+        return STORKProtocol.MANDATERETRIEVALREQUEST;
+    }
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/STORKProtocol.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/STORKProtocol.java
new file mode 100644
index 000000000..5b844580d
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/STORKProtocol.java
@@ -0,0 +1,126 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
+import at.gv.egovernment.moa.id.moduls.IAction;
+import at.gv.egovernment.moa.id.moduls.IModulInfo;
+import at.gv.egovernment.moa.id.moduls.IRequest;
+import at.gv.egovernment.moa.logging.Logger;
+import eu.stork.peps.auth.commons.*;
+import eu.stork.peps.auth.engine.STORKSAMLEngine;
+import eu.stork.peps.exceptions.STORKSAMLEngineException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.util.HashMap;
+
+/**
+ * Stork 2 Protocol Support
+ *
+ * @author bsuzic
+ */
+public class STORKProtocol implements IModulInfo, MOAIDAuthConstants {
+
+    public static final String NAME = STORKProtocol.class.getName();
+    public static final String PATH = "id_stork2";
+
+    public static final String AUTHENTICATIONREQUEST = "AuthenticationRequest";
+    public static final String ATTRIBUTE_COLLECTOR = "AttributeCollector";
+    public static final String MANDATERETRIEVALREQUEST = "MandateRetrievalRequest";
+	public static final String CONSENT_EVALUATOR = "ConsentEvaluator";
+
+    private static HashMap<String, IAction> actions = new HashMap<String, IAction>();
+
+    static {
+        actions.put(AUTHENTICATIONREQUEST, new AuthenticationRequest());
+        actions.put(ATTRIBUTE_COLLECTOR, new AttributeCollector());
+        actions.put(CONSENT_EVALUATOR, new ConsentEvaluator());
+        actions.put(MANDATERETRIEVALREQUEST, new MandateRetrievalRequest());
+    }
+
+    public String getName() {
+        return NAME;
+    }
+
+    public String getPath() {
+        return PATH;
+    }
+
+    public IAction getAction(String action) {
+        return actions.get(action);
+    }
+
+    public STORKProtocol() {
+        super();
+    }
+
+    /*
+        First request step - send it to BKU selection for user authentication. After the user credentials
+        and other info are obtained, in the second step the request will be processed and the user redirected
+         */
+    public IRequest preProcess(HttpServletRequest request, HttpServletResponse response, String action) throws MOAIDException {
+        Logger.info("Starting preprocessing for Stork2 protocol");
+        Logger.debug("Request method: " + request.getMethod());
+        Logger.debug("Request content length: " + request.getContentLength());
+        Logger.debug("Initiating action: " + action);
+
+        MOASTORKRequest STORK2Request = new MOASTORKRequest();
+
+		if (AttributeCollector.class.getSimpleName().equals(action) || ConsentEvaluator.class.getSimpleName().equals(action))
+			return STORK2Request;
+
+        //extract STORK Response from HTTP Request
+        byte[] decSamlToken;
+        try {
+            decSamlToken = PEPSUtil.decodeSAMLToken(request.getParameter("SAMLRequest"));
+        } catch (NullPointerException e) {
+            Logger.error("Unable to retrieve STORK Request", e);
+            throw new MOAIDException("stork.04", null);
+        }
+
+        //Get SAMLEngine instance
+        STORKSAMLEngine engine = STORKSAMLEngine.getInstance("VIDP");
+
+        STORKAuthnRequest authnRequest = null;
+        STORKAttrQueryRequest attrRequest = null;
+
+        // check if valid authn request is contained
+        try {
+            authnRequest = engine.validateSTORKAuthnRequest(decSamlToken);
+        } catch (STORKSAMLEngineException ex) {
+            Logger.error("Unable to validate Stork AuthenticationRequest: " + ex.getMessage());
+        } catch(ClassCastException e) {
+        	// we do not have a authnRequest
+        	// check if a valid attr request is container
+        	try {
+        		attrRequest = engine.validateSTORKAttrQueryRequest(decSamlToken);
+        	} catch (STORKSAMLEngineException ex) {
+        		Logger.error("Unable to validate Stork AuthenticationRequest: " + ex.getMessage());
+        	}
+        }
+
+        // if there is no authn or attr request, raise error
+        if ((authnRequest == null) && (attrRequest == null)) {
+            Logger.error("There is no authentication or attribute request contained.");
+            throw new MOAIDException("stork.14", null);
+        }
+
+        STORK2Request.setSTORKAuthnRequest(authnRequest);
+        STORK2Request.setSTORKAttrRequest(attrRequest);
+
+        return STORK2Request;
+    }
+
+    public IAction canHandleRequest(HttpServletRequest request, HttpServletResponse response) {
+        return null;
+    }
+
+    public boolean generateErrorMessage(Throwable e, HttpServletRequest request, HttpServletResponse response, IRequest protocolRequest) throws Throwable {
+        return false;
+    }
+
+    public boolean validate(HttpServletRequest request, HttpServletResponse response, IRequest pending) {
+        return false;
+    }
+}
+
+
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/SignedDocAttributeRequestProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/SignedDocAttributeRequestProvider.java
new file mode 100644
index 000000000..89eb07815
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/SignedDocAttributeRequestProvider.java
@@ -0,0 +1,129 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+import java.io.StringWriter;
+import java.io.UnsupportedEncodingException;
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.codec.binary.Base64;
+import org.apache.velocity.Template;
+import org.apache.velocity.VelocityContext;
+import org.apache.velocity.app.VelocityEngine;
+
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
+import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.id.util.VelocityProvider;
+import at.gv.egovernment.moa.logging.Logger;
+import eu.stork.peps.auth.commons.IPersonalAttributeList;
+import eu.stork.peps.auth.commons.PersonalAttribute;
+import eu.stork.peps.auth.commons.PersonalAttributeList;
+
+/**
+ * Forwards a signedDoc attribute request to the oasis-dss service instance
+ */
+public class SignedDocAttributeRequestProvider implements AttributeProvider {
+
+	private PersonalAttribute requestedAttribute;
+
+	/**
+	 * The URL of the service listening for the oasis dss webform post request
+	 */
+	private String oasisDssWebFormURL;
+
+	/** The attributes. */
+	private String attributes;
+
+	/**
+	 * Instantiates a new signed doc attribute request provider.
+	 * 
+	 * @param oasisDssWebFormURL
+	 *            the AP location
+	 * @param attributes 
+	 */
+	public SignedDocAttributeRequestProvider(String oasisDssWebFormURL, String attributes) {
+		this.oasisDssWebFormURL = oasisDssWebFormURL;
+		this.attributes = attributes;
+	}
+
+	/*
+	 * (non-Javadoc)
+	 * 
+	 * @see
+	 * at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#acquire(java
+	 * .lang.String)
+	 */
+	public IPersonalAttributeList acquire(PersonalAttribute attribute, String spCountyCode, AuthenticationSession moasession) throws UnsupportedAttributeException,
+			ExternalAttributeRequestRequiredException {
+		if(!attributes.contains(attribute.getName())) {
+			throw new UnsupportedAttributeException();
+		}
+		
+		requestedAttribute = attribute;
+
+		throw new ExternalAttributeRequestRequiredException(this);
+	}
+
+	/*
+	 * (non-Javadoc)
+	 * 
+	 * @see
+	 * at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#parse(javax
+	 * .servlet.http.HttpServletRequest)
+	 */
+	public IPersonalAttributeList parse(HttpServletRequest httpReq) throws MOAIDException, UnsupportedAttributeException {
+		Logger.debug("Beginning to extract OASIS-DSS response out of HTTP Request");
+
+		try {
+			String signResponse = new String(Base64.decodeBase64(httpReq.getParameter("signresponse")), "UTF8");
+			List<String> values = new ArrayList<String>();
+			values.add(signResponse);
+
+			Logger.debug("Assembling signedDoc attribute");
+			PersonalAttribute signedDocAttribute = new PersonalAttribute("signedDoc", false, values,
+					"Available");
+
+			// pack and return the result
+			PersonalAttributeList result = new PersonalAttributeList();
+			result.add(signedDocAttribute);
+			return result;
+		} catch (UnsupportedEncodingException e) {
+			Logger.error("Failed to assemble signedDoc attribute");
+			throw new MOAIDException("stork.05", null);
+		}
+	}
+
+	/*
+	 * (non-Javadoc)
+	 * 
+	 * @see
+	 * at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#performRedirect
+	 * (java.lang.String)
+	 */
+	public void performRedirect(String url, HttpServletRequest req, HttpServletResponse resp, OAAuthParameter oaParam)
+			throws MOAIDException {
+
+		try {
+			Logger.trace("Initialize VelocityEngine...");
+
+			VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
+			Template template = velocityEngine.getTemplate("/resources/templates/oasis_dss_webform_binding.vm");
+			VelocityContext context = new VelocityContext();
+			context.put("signrequest", Base64.encodeBase64String(requestedAttribute.getValue().get(0).getBytes("UTF8")));
+			context.put("clienturl", url);
+			context.put("action", oasisDssWebFormURL);
+
+			StringWriter writer = new StringWriter();
+			template.merge(context, writer);
+
+			resp.getOutputStream().write(writer.toString().getBytes());
+		} catch (Exception e) {
+			Logger.error("Error sending DSS signrequest.", e);
+			throw new MOAIDException("stork.11", null);
+		}
+	}
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/StorkAttributeRequestProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/StorkAttributeRequestProvider.java
new file mode 100644
index 000000000..c0e613b82
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/StorkAttributeRequestProvider.java
@@ -0,0 +1,162 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+import java.io.StringWriter;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.velocity.Template;
+import org.apache.velocity.VelocityContext;
+import org.apache.velocity.app.VelocityEngine;
+
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
+import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.id.util.HTTPUtils;
+import at.gv.egovernment.moa.id.util.VelocityProvider;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.StringUtils;
+
+import eu.stork.peps.auth.commons.IPersonalAttributeList;
+import eu.stork.peps.auth.commons.PEPSUtil;
+import eu.stork.peps.auth.commons.PersonalAttribute;
+import eu.stork.peps.auth.commons.PersonalAttributeList;
+import eu.stork.peps.auth.commons.STORKAttrQueryRequest;
+import eu.stork.peps.auth.commons.STORKAttrQueryResponse;
+import eu.stork.peps.auth.engine.STORKSAMLEngine;
+import eu.stork.peps.exceptions.STORKSAMLEngineException;
+
+/**
+ * creates a STORK attribute request for a configurable set of attributes
+ */
+public class StorkAttributeRequestProvider implements AttributeProvider {
+
+	private PersonalAttributeList requestedAttributes;
+	
+	/** The destination. */
+	private String destination;
+
+	/** The attributes. */
+	private String attributes;
+
+	/** The sp country code. */
+	private String spCountryCode;
+
+	/**
+	 * Instantiates a new stork attribute request provider.
+	 *
+	 * @param apUrl the AP location
+	 * @param supportedAttributes the supported attributes as csv
+	 */
+	public StorkAttributeRequestProvider(String apUrl, String supportedAttributes) {
+		destination = apUrl;
+		attributes = supportedAttributes;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#acquire(java.lang.String)
+	 */
+	public IPersonalAttributeList acquire(PersonalAttribute attribute, String spCountyCode, AuthenticationSession moasession)
+			throws UnsupportedAttributeException, ExternalAttributeRequestRequiredException {
+
+		if (!attributes.contains(attribute.getName()))
+			throw new UnsupportedAttributeException();
+		
+		this.spCountryCode = spCountyCode;
+
+		requestedAttributes = new PersonalAttributeList(1);
+		requestedAttributes.add(attribute);
+		throw new ExternalAttributeRequestRequiredException(this);
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#parse(javax.servlet.http.HttpServletRequest)
+	 */
+	public IPersonalAttributeList parse(HttpServletRequest httpReq) throws MOAIDException, UnsupportedAttributeException {
+
+		Logger.info(this.getClass().getSimpleName() + " tries to extract SAMLResponse out of HTTP Request");
+		
+		//extract STORK Response from HTTP Request
+		//Decodes SAML Response
+		byte[] decSamlToken;
+		try {
+			decSamlToken = PEPSUtil.decodeSAMLToken(httpReq.getParameter("SAMLResponse"));
+		} catch(NullPointerException e) {
+			throw new UnsupportedAttributeException();
+		}
+
+		//Get SAMLEngine instance
+		STORKSAMLEngine engine = STORKSAMLEngine.getInstance("VIDP");
+
+		STORKAttrQueryResponse attrResponse = null;
+		try {
+			//validate SAML Token
+			Logger.debug("Starting validation of SAML response");
+			attrResponse = engine.validateSTORKAttrQueryResponse(decSamlToken, (String) httpReq.getRemoteHost());
+			Logger.info("SAML response successfully verified!");
+		}catch(STORKSAMLEngineException e){
+			Logger.error("Failed to verify STORK SAML Response", e);
+			throw new MOAIDException("stork.05", null);
+		}
+		
+		return attrResponse.getPersonalAttributeList();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#performRedirect(java.lang.String)
+	 */
+	public void performRedirect(String url, HttpServletRequest req, HttpServletResponse resp, OAAuthParameter oaParam) throws MOAIDException {
+
+    	String spSector = "Business";
+    	String spInstitution = StringUtils.isEmpty(oaParam.getFriendlyName()) ? "UNKNOWN" : oaParam.getFriendlyName();
+    	String spApplication = spInstitution;
+
+    	//generate AuthnRquest
+    	STORKAttrQueryRequest attributeRequest = new STORKAttrQueryRequest();
+    	attributeRequest.setDestination(destination);
+    	attributeRequest.setAssertionConsumerServiceURL(url);
+    	attributeRequest.setIssuer(HTTPUtils.getBaseURL(req));
+    	attributeRequest.setQaa(oaParam.getQaaLevel());
+    	attributeRequest.setSpInstitution(spInstitution);
+    	attributeRequest.setCountry(spCountryCode);
+    	attributeRequest.setSpCountry(spCountryCode);
+    	attributeRequest.setSpApplication(spApplication);
+    	attributeRequest.setSpSector(spSector);
+    	attributeRequest.setPersonalAttributeList(requestedAttributes);
+
+    	attributeRequest.setCitizenCountryCode("AT");
+
+
+    	Logger.debug("STORK AttrRequest successfully assembled.");
+
+    	STORKSAMLEngine samlEngine = STORKSAMLEngine.getInstance("VIDP");
+    	try {
+    		attributeRequest = samlEngine.generateSTORKAttrQueryRequest(attributeRequest);
+    	} catch (STORKSAMLEngineException e) {
+			Logger.error("Could not sign STORK SAML AttrRequest.", e);
+			throw new MOAIDException("stork.00", null);
+		}
+
+		Logger.info("STORK AttrRequest successfully signed!");
+		
+		try {
+			Logger.trace("Initialize VelocityEngine...");
+
+			VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
+			Template template = velocityEngine.getTemplate("/resources/templates/saml2-post-binding-moa.vm");
+			VelocityContext context = new VelocityContext();
+			context.put("SAMLRequest", PEPSUtil.encodeSAMLToken(attributeRequest.getTokenSaml()));
+			context.put("action", destination);
+
+			StringWriter writer = new StringWriter();
+			template.merge(context, writer);
+
+			resp.getOutputStream().write(writer.toString().getBytes());
+		} catch (Exception e) {
+			Logger.error("Error sending STORK SAML AttrRequest.", e);
+			throw new MOAIDException("stork.11", null);
+		}
+		Logger.info("STORK AttrRequest successfully rendered!");
+	}
+
+}
+
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/UnsupportedAttributeException.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/UnsupportedAttributeException.java
new file mode 100644
index 000000000..9447c079f
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/UnsupportedAttributeException.java
@@ -0,0 +1,7 @@
+package at.gv.egovernment.moa.id.protocols.stork2;
+
+public class UnsupportedAttributeException extends Exception {
+
+	private static final long serialVersionUID = -7720066381435378111L;
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/stork/VelocityProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/VelocityProvider.java
index b923727f9..231f36fa8 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/stork/VelocityProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/VelocityProvider.java
@@ -48,7 +48,7 @@
 /**

  * 

  */

-package at.gv.egovernment.moa.id.auth.stork;

+package at.gv.egovernment.moa.id.util;

 

 import org.apache.velocity.app.VelocityEngine;

 import org.apache.velocity.runtime.RuntimeConstants;

@@ -103,6 +103,8 @@ public class VelocityProvider {
 		VelocityEngine velocityEngine = new VelocityEngine();

         velocityEngine.setProperty(RuntimeConstants.ENCODING_DEFAULT, "UTF-8");

         velocityEngine.setProperty(RuntimeConstants.OUTPUT_ENCODING, "UTF-8");

+        velocityEngine.setProperty(RuntimeConstants.RUNTIME_LOG_LOGSYSTEM_CLASS,

+				"org.apache.velocity.runtime.log.SimpleLog4JLogSystem");

         

         return velocityEngine;

 	}