aboutsummaryrefslogtreecommitdiff
path: root/id/server/idserverlib
diff options
context:
space:
mode:
authorThomas Lenz <tlenz@iaik.tugraz.at>2017-10-17 15:04:49 +0200
committerThomas Lenz <tlenz@iaik.tugraz.at>2017-10-17 15:04:49 +0200
commit92834aed9d97772a0d37330b9c60aee18374c759 (patch)
tree30adff7052c6eca919aed447a9640522b2c94c3d /id/server/idserverlib
parent698a0066e84dee07f0f8de8aa408d9744f755660 (diff)
parent7c5d84f1f4054d2c85207364d5d996c4ec6fe1f8 (diff)
downloadmoa-id-spss-92834aed9d97772a0d37330b9c60aee18374c759.tar.gz
moa-id-spss-92834aed9d97772a0d37330b9c60aee18374c759.tar.bz2
moa-id-spss-92834aed9d97772a0d37330b9c60aee18374c759.zip
Merge branch 'eIDAS_node_implementation' into development_preview
Diffstat (limited to 'id/server/idserverlib')
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/advancedlogging/StatisticLogger.java48
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/advancedlogging/TransactionIDUtils.java45
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationSessionCleaner.java14
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java168
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java281
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java34
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/DynamicOAAuthParameterBuilder.java26
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java16
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateBKUSelectionFrameTask.java8
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateSSOConsentEvaluatorFrameTask.java8
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java129
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractController.java7
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractProcessEngineSignalController.java9
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GUILayoutBuilderServlet.java65
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/interceptor/UniqueSessionIdentifierInterceptor.java6
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/TargetToSectorNameMapper.java4
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java130
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java20
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/data/DynamicOAAuthParameters.java149
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java17
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/ExceptionContainer.java24
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java5
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java51
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestStorage.java5
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/opemsaml/MOAIDHTTPPostEncoder.java114
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/BPKAttributeBuilder.java4
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePIN.java2
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePINType.java3
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateLegalPersonFullNameAttributeBuilder.java2
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateLegalPersonSourcePinAttributeBuilder.java72
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateLegalPersonSourcePinTypeAttributeBuilder.java4
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonBPKAttributeBuilder.java45
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonBirthDateAttributeBuilder.java2
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonFamilyNameAttributeBuilder.java2
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonGivenNameAttributeBuilder.java2
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonSourcePinAttributeBuilder.java9
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonSourcePinTypeAttributeBuilder.java3
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java10
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AuthenticationAction.java8
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java8
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/SingleLogOutAction.java4
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/IEncoder.java7
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/PostBinding.java53
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/RedirectBinding.java15
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java7
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/AttributQueryBuilder.java15
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/PVPAuthnRequestBuilder.java9
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/SingleLogOutBuilder.java11
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java37
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java7
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/validation/MOASAML2AuthRequestSignedRole.java49
-rw-r--r--id/server/idserverlib/src/main/resources/resources/properties/id_messages_de.properties3
-rw-r--r--id/server/idserverlib/src/main/resources/resources/properties/protocol_response_statuscodes_de.properties1
-rw-r--r--id/server/idserverlib/src/main/resources/resources/templates/ParepMinTemplate.html193
-rw-r--r--id/server/idserverlib/src/main/resources/resources/templates/ParepTemplate.html235
-rw-r--r--id/server/idserverlib/src/main/resources/resources/templates/fetchGender.html16
-rw-r--r--id/server/idserverlib/src/main/resources/resources/templates/oasis_dss_webform_binding.vm36
-rw-r--r--id/server/idserverlib/src/main/resources/templates/pvp_postbinding_template.html (renamed from id/server/idserverlib/src/main/resources/resources/templates/pvp_postbinding_template.html)8
58 files changed, 1147 insertions, 1118 deletions
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/advancedlogging/StatisticLogger.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/advancedlogging/StatisticLogger.java
index 55b1a7c9a..72aef5fed 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/advancedlogging/StatisticLogger.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/advancedlogging/StatisticLogger.java
@@ -116,16 +116,18 @@ public class StatisticLogger implements IStatisticLogger{
//set actual date and time
dblog.setTimestamp(new Date());
-
- //set OA databaseID
- //dblog.setOaID(dbOA.getHjid());
-
+
//log basic AuthInformation
dblog.setOaurlprefix(getMessageWithMaxLength(dbOA.getPublicURLPrefix(), MAXOAIDENTIFIER_LENGTH));
dblog.setOafriendlyName(dbOA.getFriendlyName());
- boolean isbusinessservice = isBusinessService(dbOA);
- dblog.setBusinessservice(isbusinessservice);
+ try {
+ dblog.setBusinessservice(dbOA.hasBaseIdTransferRestriction());
+
+ } catch (Exception e) {
+ Logger.warn("Can not extract some information for StatisticLogger.", e);
+ }
+
dblog.setOatarget(authData.getBPKType());
@@ -266,9 +268,14 @@ public class StatisticLogger implements IStatisticLogger{
if (dbOA != null) {
dblog.setOaurlprefix(getMessageWithMaxLength(dbOA.getPublicURLPrefix(), MAXOAIDENTIFIER_LENGTH));
dblog.setOafriendlyName(dbOA.getFriendlyName());
- dblog.setOatarget(dbOA.getTarget());
- //dblog.setOaID(dbOA.getHjid());
- dblog.setBusinessservice(isBusinessService(dbOA));
+
+ try {
+ dblog.setOatarget(dbOA.getAreaSpecificTargetIdentifier());
+ dblog.setBusinessservice(dbOA.hasBaseIdTransferRestriction());
+ } catch (Exception e) {
+ Logger.warn("Can not extract some information for StatisticLogger.", e);
+
+ }
IAuthenticationSession moasession = null;
if (MiscUtil.isNotEmpty(errorRequest.getInternalSSOSessionIdentifier())) {
@@ -314,15 +321,7 @@ public class StatisticLogger implements IStatisticLogger{
}
}
-
- private boolean isBusinessService(IOAAuthParameters dbOA) {
- if (dbOA.getOaType().equals("businessService"))
- return true;
- else
- return false;
- }
-
private String getMessageWithMaxLength(String msg, int maxlength) {
return getErrorMessageWithMaxLength(msg, maxlength);
@@ -391,15 +390,15 @@ public class StatisticLogger implements IStatisticLogger{
if (bkuURL.equals(dbOA.getBKUURL(OAAuthParameter.LOCALBKU)))
return IOAAuthParameters.LOCALBKU;
- if (bkuURL.equals(dbOA.getBKUURL(OAAuthParameter.ONLINEBKU)))
- return IOAAuthParameters.ONLINEBKU;
+ if (bkuURL.equals(dbOA.getBKUURL(OAAuthParameter.THIRDBKU)))
+ return IOAAuthParameters.THIRDBKU;
}
Logger.trace("Staticic Log search BKUType from DefaultBKUs");
try {
- if (bkuURL.equals(authConfig.getDefaultBKUURL(IOAAuthParameters.ONLINEBKU)))
- return IOAAuthParameters.ONLINEBKU;
+ if (bkuURL.equals(authConfig.getDefaultBKUURL(IOAAuthParameters.THIRDBKU)))
+ return IOAAuthParameters.THIRDBKU;
if (bkuURL.equals(authConfig.getDefaultBKUURL(IOAAuthParameters.LOCALBKU)))
return IOAAuthParameters.LOCALBKU;
@@ -422,12 +421,7 @@ public class StatisticLogger implements IStatisticLogger{
Logger.debug("BKUURL " + bkuURL + " is mapped to " + IOAAuthParameters.HANDYBKU);
return IOAAuthParameters.HANDYBKU;
}
-
- if (bkuURL.contains(GENERIC_ONLINE_BKU)) {
- Logger.debug("BKUURL " + bkuURL + " is mapped to " + IOAAuthParameters.ONLINEBKU);
- return IOAAuthParameters.ONLINEBKU;
- }
-
+
Logger.debug("BKUURL " + bkuURL + " is mapped to " + IOAAuthParameters.AUTHTYPE_OTHERS);
return IOAAuthParameters.AUTHTYPE_OTHERS;
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/advancedlogging/TransactionIDUtils.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/advancedlogging/TransactionIDUtils.java
index 6d53fd510..0b066f3b9 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/advancedlogging/TransactionIDUtils.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/advancedlogging/TransactionIDUtils.java
@@ -23,10 +23,8 @@
package at.gv.egovernment.moa.id.advancedlogging;
-import java.util.Date;
-
import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
-import at.gv.egovernment.moa.util.MiscUtil;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
/**
* @author tlenz
@@ -34,6 +32,43 @@ import at.gv.egovernment.moa.util.MiscUtil;
*/
public class TransactionIDUtils {
+ /**
+ * Set all MDC variables from pending request to this threat context<br>
+ * These includes SessionID, TransactionID, and unique service-provider identifier
+ *
+ * @param pendingRequest
+ */
+ public static void setAllLoggingVariables(IRequest pendingRequest) {
+ setTransactionId(pendingRequest.getUniqueTransactionIdentifier());
+ setSessionId(pendingRequest.getUniqueSessionIdentifier());
+ setServiceProviderId(pendingRequest.getOnlineApplicationConfiguration().getPublicURLPrefix());
+
+ }
+
+ /**
+ * Remove all MDC variables from this threat context
+ *
+ */
+ public static void removeAllLoggingVariables() {
+ removeSessionId();
+ removeTransactionId();
+ removeServiceProviderId();
+
+ }
+
+
+ public static void setServiceProviderId(String oaUniqueId) {
+ org.apache.log4j.MDC.put(MOAIDAuthConstants.MDC_SERVICEPROVIDER_ID, oaUniqueId);
+ org.slf4j.MDC.put(MOAIDAuthConstants.MDC_SERVICEPROVIDER_ID, oaUniqueId);
+
+ }
+
+ public static void removeServiceProviderId() {
+ org.apache.log4j.MDC.remove(MOAIDAuthConstants.MDC_SERVICEPROVIDER_ID);
+ org.slf4j.MDC.remove(MOAIDAuthConstants.MDC_SERVICEPROVIDER_ID);
+
+ }
+
public static void setTransactionId(String pendingRequestID) {
org.apache.log4j.MDC.put(MOAIDAuthConstants.MDC_TRANSACTION_ID,
"TID-" + pendingRequestID);
@@ -50,9 +85,9 @@ public class TransactionIDUtils {
public static void setSessionId(String uniqueSessionId) {
org.apache.log4j.MDC.put(MOAIDAuthConstants.MDC_SESSION_ID,
- "TID-" + uniqueSessionId);
+ "SID-" + uniqueSessionId);
org.slf4j.MDC.put(MOAIDAuthConstants.MDC_SESSION_ID,
- "TID-" + uniqueSessionId);
+ "SID-" + uniqueSessionId);
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationSessionCleaner.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationSessionCleaner.java
index bbb322a4f..34d0d4be1 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationSessionCleaner.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationSessionCleaner.java
@@ -74,20 +74,26 @@ public class AuthenticationSessionCleaner implements Runnable {
ExceptionContainer exContainer = (ExceptionContainer) entry;
if (exContainer.getExceptionThrown() != null) {
- //add session and transaction ID to log if exists
+ //add session, transaction, and service-provider IDs into logging context if exists
if (MiscUtil.isNotEmpty(exContainer.getUniqueTransactionID()))
TransactionIDUtils.setTransactionId(exContainer.getUniqueTransactionID());
if (MiscUtil.isNotEmpty(exContainer.getUniqueSessionID()))
TransactionIDUtils.setSessionId(exContainer.getUniqueSessionID());
+ if (MiscUtil.isNotEmpty(exContainer.getUniqueServiceProviderId()))
+ TransactionIDUtils.setServiceProviderId(exContainer.getUniqueServiceProviderId());
+
//log exception to technical log
logExceptionToTechnicalLog(exContainer.getExceptionThrown());
//remove session and transaction ID from thread
- TransactionIDUtils.removeSessionId();
- TransactionIDUtils.removeTransactionId();
- }
+ TransactionIDUtils.removeAllLoggingVariables();
+
+ } else {
+ Logger.warn("Receive an ExceptionContainer that includes no 'Exception' object. Somethinge is suspect!!!!!");
+
+ }
}
} catch (Exception e) {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
index cad3354f5..5a5d0bcf6 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
@@ -267,9 +267,9 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants {
//####################################################
//set general authData info's
authData.setIssuer(protocolRequest.getAuthURL());
- authData.setSsoSession(protocolRequest.needSingleSignOnFunctionality());
- authData.setIsBusinessService(oaParam.getBusinessService());
-
+ authData.setSsoSession(protocolRequest.needSingleSignOnFunctionality());
+ authData.setBaseIDTransferRestrication(oaParam.hasBaseIdTransferRestriction());
+
//####################################################
//parse user info's from identityLink
@@ -816,21 +816,11 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants {
* @param oaParam Service-Provider configuration, never null
* @param bPKType bPK-Type to check
* @return true, if bPK-Type matchs to Service-Provider configuration, otherwise false
+ * @throws ConfigurationException
*/
- private boolean matchsReceivedbPKToOnlineApplication(IOAAuthParameters oaParam, String bPKType) {
- String oaTarget = null;
- if (oaParam.getBusinessService()) {
- oaTarget = oaParam.getIdentityLinkDomainIdentifier();
-
- } else {
- oaTarget = Constants.URN_PREFIX_CDID + "+" + oaParam.getTarget();
-
- }
-
- if (oaTarget.equals(bPKType))
- return true;
- else
- return false;
+ private boolean matchsReceivedbPKToOnlineApplication(IOAAuthParameters oaParam, String bPKType) throws ConfigurationException {
+ return oaParam.getAreaSpecificTargetIdentifier().equals(bPKType);
+
}
private void parseBasicUserInfosFromIDL(AuthenticationData authData, IIdentityLink identityLink, Collection<String> includedGenericSessionData) {
@@ -918,9 +908,10 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants {
*
* @return Pair<bPK, bPKType> which was received by PVP-Attribute and could be decrypted for this Service Provider,
* or <code>null</code> if no attribute exists or can not decrypted
+ * @throws ConfigurationException
*/
private Pair<String, String> getEncryptedbPKFromPVPAttribute(IAuthenticationSession session,
- AuthenticationData authData, IOAAuthParameters spConfig) {
+ AuthenticationData authData, IOAAuthParameters spConfig) throws ConfigurationException {
//set List of encrypted bPKs to authData DAO
String pvpEncbPKListAttr = session.getGenericDataFromSession(PVPConstants.ENC_BPK_LIST_NAME, String.class);
if (MiscUtil.isNotEmpty(pvpEncbPKListAttr)) {
@@ -935,35 +926,44 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants {
String second = fullEncbPK.substring(0, index);
int secIndex = second.indexOf("+");
if (secIndex >= 0) {
- if (spConfig.getTarget().equals(second.substring(secIndex+1))) {
- Logger.debug("Found encrypted bPK for online-application "
- + spConfig.getPublicURLPrefix()
- + " Start decryption process ...");
- PrivateKey privKey = spConfig.getBPKDecBpkDecryptionKey();
- if (privKey != null) {
- try {
- String bPK = BPKBuilder.decryptBPK(encbPK, spConfig.getTarget(), privKey);
- if (MiscUtil.isNotEmpty(bPK)) {
- Logger.info("bPK decryption process finished successfully.");
- return Pair.newInstance(bPK, Constants.URN_PREFIX_CDID + "+" + spConfig.getTarget());
-
- } else {
- Logger.error("bPK decryption FAILED.");
-
+ String oaTargetId = spConfig.getAreaSpecificTargetIdentifier();
+ if (oaTargetId.startsWith(MOAIDAuthConstants.PREFIX_CDID)) {
+ String publicServiceShortTarget = oaTargetId.substring(MOAIDAuthConstants.PREFIX_CDID.length());
+ if (publicServiceShortTarget.equals(second.substring(secIndex+1))) {
+ Logger.debug("Found encrypted bPK for online-application "
+ + spConfig.getPublicURLPrefix()
+ + " Start decryption process ...");
+ PrivateKey privKey = spConfig.getBPKDecBpkDecryptionKey();
+ if (privKey != null) {
+ try {
+ String bPK = BPKBuilder.decryptBPK(encbPK, publicServiceShortTarget, privKey);
+ if (MiscUtil.isNotEmpty(bPK)) {
+ Logger.info("bPK decryption process finished successfully.");
+ return Pair.newInstance(bPK, oaTargetId);
+
+ } else {
+ Logger.error("bPK decryption FAILED.");
+
+ }
+ } catch (BuildException e) {
+ Logger.error("bPK decryption FAILED.", e);
+
}
- } catch (BuildException e) {
- Logger.error("bPK decryption FAILED.", e);
- }
+ } else {
+ Logger.info("bPK decryption FAILED, because no valid decryption key is found.");
+
+ }
} else {
- Logger.info("bPK decryption FAILED, because no valid decryption key is found.");
+ Logger.info("Found encrypted bPK but " +
+ "encrypted bPK target does not match to online-application target");
- }
+ }
} else {
- Logger.info("Found encrypted bPK but " +
- "encrypted bPK target does not match to online-application target");
+ Logger.info("Encrypted bPKs are only allowed for public services with prefix: " + MOAIDAuthConstants.PREFIX_CDID
+ + " BUT oaTarget is " + oaTargetId);
}
}
@@ -1066,7 +1066,7 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants {
}
private IIdentityLink buildOAspecificIdentityLink(IOAAuthParameters oaParam, IIdentityLink idl, String bPK, String bPKType) throws MOAIDException {
- if (oaParam.getBusinessService()) {
+ if (oaParam.hasBaseIdTransferRestriction()) {
Element idlassertion = idl.getSamlAssertion();
//set bpk/wpbk;
Node prIdentification = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_IDENT_VALUE_XPATH);
@@ -1097,69 +1097,45 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants {
}
- private Pair<String, String> buildOAspecificbPK(IRequest pendingReq, IOAAuthParameters oaParam, AuthenticationData authData) throws BuildException {
+ private Pair<String, String> buildOAspecificbPK(IRequest pendingReq, IOAAuthParameters oaParam, AuthenticationData authData) throws BuildException, ConfigurationException {
- String bPK;
- String bPKType;
-
String baseID = authData.getIdentificationValue();
- String baseIDType = authData.getIdentificationType();
-
- if (Constants.URN_PREFIX_BASEID.equals(baseIDType)) {
- //Calculate eIDAS identifier
- if (oaParam.getBusinessService() &&
- oaParam.getIdentityLinkDomainIdentifier().startsWith(Constants.URN_PREFIX_EIDAS)) {
- String[] splittedTarget = oaParam.getIdentityLinkDomainIdentifier().split("\\+");
- String cititzenCountryCode = splittedTarget[1];
- String eIDASOutboundCountry = splittedTarget[2];
-
- if (cititzenCountryCode.equalsIgnoreCase(eIDASOutboundCountry)) {
- Logger.warn("Suspect configuration FOUND!!! CitizenCountry equals DestinationCountry");
-
- }
-
- Pair<String, String> eIDASID = new BPKBuilder().buildeIDASIdentifer(baseIDType, baseID,
- cititzenCountryCode, eIDASOutboundCountry);
- Logger.debug("Authenticate user with bPK:" + eIDASID.getFirst() + " Type:" + eIDASID.getSecond());
- return eIDASID;
-
- } else if (oaParam.getBusinessService()) {
- //is Austrian private-service application
- String registerAndOrdNr = oaParam.getIdentityLinkDomainIdentifier();
- bPK = new BPKBuilder().buildbPKorwbPK(baseID, registerAndOrdNr);
- bPKType = registerAndOrdNr;
-
- } else {
- // only compute bPK if online application is a public service and we have the Stammzahl
- String target = null;
- Class<?> saml1RequstTemplate = null;
- try {
- saml1RequstTemplate = Class.forName("at.gv.egovernment.moa.id.protocols.saml1.SAML1RequestImpl");
- if (saml1RequstTemplate != null &&
- saml1RequstTemplate.isInstance(pendingReq)) {
- target = (String) pendingReq.getClass().getMethod("getTarget").invoke(pendingReq);
+ String baseIDType = authData.getIdentificationType();
+ Pair<String, String> sectorSpecId = null;
+
+ if (Constants.URN_PREFIX_BASEID.equals(baseIDType)) {
+ //SAML1 legacy target parameter work-around
+ String oaTargetId = null;
+ Class<?> saml1RequstTemplate = null;
+ try {
+ saml1RequstTemplate = Class.forName("at.gv.egovernment.moa.id.protocols.saml1.SAML1RequestImpl");
+ if (saml1RequstTemplate != null &&
+ saml1RequstTemplate.isInstance(pendingReq)) {
+ oaTargetId = (String) pendingReq.getClass().getMethod("getTarget").invoke(pendingReq);
- }
+ }
- } catch (ClassNotFoundException | IllegalAccessException | IllegalArgumentException | java.lang.SecurityException | InvocationTargetException | NoSuchMethodException ex) { }
+ } catch (ClassNotFoundException | IllegalAccessException | IllegalArgumentException | java.lang.SecurityException | InvocationTargetException | NoSuchMethodException ex) { }
+
+ if (MiscUtil.isEmpty(oaTargetId)) {
+ oaTargetId = oaParam.getAreaSpecificTargetIdentifier();
+ Logger.debug("Use OA target identifier '" + oaTargetId + "' from configuration");
- if (MiscUtil.isEmpty(target))
- target = oaParam.getTarget();
-
- bPK = new BPKBuilder().buildBPK(baseID, target);
- bPKType = Constants.URN_PREFIX_CDID + "+" + target;
-
- }
-
+ } else
+ Logger.info("Use OA target identifier '" + oaTargetId + "' from SAML1 request for bPK calculation");
+
+ //calculate sector specific unique identifier
+ sectorSpecId = new BPKBuilder().generateAreaSpecificPersonIdentifier(baseID, oaTargetId);
+
+
} else {
- Logger.warn("!!!baseID-element does not include a baseID. This should not be happen any more!!!");
- bPK = baseID;
- bPKType = baseIDType;
-
+ Logger.fatal("!!!baseID-element does not include a baseID. This should not be happen any more!!!");
+ sectorSpecId = Pair.newInstance(baseID, baseIDType);
+
}
- Logger.trace("Authenticate user with bPK:" + bPK + " Type:" + bPKType);
- return Pair.newInstance(bPK, bPKType);
+ Logger.trace("Authenticate user with bPK:" + sectorSpecId.getFirst() + " Type:" + sectorSpecId.getSecond());
+ return sectorSpecId;
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java
index 32ac8ad68..a7f6e873f 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/BPKBuilder.java
@@ -60,6 +60,7 @@ import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import at.gv.egovernment.moa.id.auth.exception.BuildException;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
import at.gv.egovernment.moa.id.data.Pair;
import at.gv.egovernment.moa.logging.Logger;
import at.gv.egovernment.moa.util.Base64Utils;
@@ -76,77 +77,192 @@ import at.gv.egovernment.moa.util.MiscUtil;
*/
public class BPKBuilder {
- /**
- * Builds the bPK from the given parameters.
- *
- * @param identificationValue Base64 encoded "Stammzahl"
- * @param target "Bereich lt. Verordnung des BKA"
- * @return bPK in a BASE64 encoding
- * @throws BuildException if an error occurs on building the bPK
- */
- public String buildBPK(String identificationValue, String target)
- throws BuildException {
-
- if ((identificationValue == null ||
- identificationValue.length() == 0 ||
- target == null ||
- target.length() == 0)) {
- throw new BuildException("builder.00",
- new Object[]{"BPK", "Unvollständige Parameterangaben: identificationValue=" +
- identificationValue + ",target=" + target});
- }
- String basisbegriff;
- if (target.startsWith(Constants.URN_PREFIX_CDID + "+"))
- basisbegriff = identificationValue + "+" + target;
- else
- basisbegriff = identificationValue + "+" + Constants.URN_PREFIX_CDID + "+" + target;
+ /**
+ * Calculates an area specific unique person-identifier from a baseID
+ *
+ * @param baseID baseId from user but never null
+ * @param targetIdentifier target identifier for area specific identifier calculation but never null
+ * @return Pair<unique person identifier for this target, targetArea> but never null
+ * @throws BuildException if some input data are not valid
+ */
+ public Pair<String, String> generateAreaSpecificPersonIdentifier(String baseID, String targetIdentifier) throws BuildException{
+ return generateAreaSpecificPersonIdentifier(baseID, Constants.URN_PREFIX_BASEID, targetIdentifier);
+
+ }
+
+ /**
+ * Calculates an area specific unique person-identifier from an unique identifier with a specific type
+ *
+ * @param baseID baseId from user but never null
+ * @param baseIdType Type of the baseID but never null
+ * @param targetIdentifier target identifier for area specific identifier calculation but never null
+ * @return Pair<unique person identifier for this target, targetArea> but never null
+ * @throws BuildException if some input data are not valid
+ */
+ public Pair<String, String> generateAreaSpecificPersonIdentifier(String baseID, String baseIdType, String targetIdentifier) throws BuildException{
+ if (MiscUtil.isEmpty(baseID))
+ throw new BuildException("builder.00", new Object[]{"baseID is empty or null"});
- return calculatebPKwbPK(basisbegriff);
- }
+ if (MiscUtil.isEmpty(baseIdType))
+ throw new BuildException("builder.00", new Object[]{"the type of baseID is empty or null"});
+
+ if (MiscUtil.isEmpty(targetIdentifier))
+ throw new BuildException("builder.00", new Object[]{"OA specific target identifier is empty or null"});
+ if (baseIdType.equals(Constants.URN_PREFIX_BASEID)) {
+ Logger.trace("Find baseID. Starting unique identifier caluclation for this target");
+
+ if (targetIdentifier.startsWith(MOAIDAuthConstants.PREFIX_CDID) ||
+ targetIdentifier.startsWith(MOAIDAuthConstants.PREFIX_WPBK) ||
+ targetIdentifier.startsWith(MOAIDAuthConstants.PREFIX_STORK)) {
+ Logger.trace("Calculate bPK, wbPK, or STORK identifier for target: " + targetIdentifier);
+ return Pair.newInstance(calculatebPKwbPK(baseID + "+" + targetIdentifier), targetIdentifier);
+
+ } else if (targetIdentifier.startsWith(MOAIDAuthConstants.PREFIX_EIDAS)) {
+ Logger.trace("Calculate eIDAS identifier for target: " + targetIdentifier);
+ String[] splittedTarget = targetIdentifier.split("\\+");
+ String cititzenCountryCode = splittedTarget[1];
+ String eIDASOutboundCountry = splittedTarget[2];
+
+ if (cititzenCountryCode.equalsIgnoreCase(eIDASOutboundCountry)) {
+ Logger.warn("Suspect configuration FOUND!!! CitizenCountry equals DestinationCountry");
+
+ }
+ return buildeIDASIdentifer(baseID, baseIdType, cititzenCountryCode, eIDASOutboundCountry);
+
+
+ } else
+ throw new BuildException("builder.00",
+ new Object[]{"Target identifier: " + targetIdentifier + " is NOT allowed or unknown"});
+
+ } else {
+ Logger.trace("BaseID is not of type " + Constants.URN_PREFIX_BASEID + ". Check type against requested target ...");
+ if (baseIdType.equals(targetIdentifier)) {
+ Logger.debug("Unique identifier is already area specific. Is nothing todo");
+ return Pair.newInstance(baseID, targetIdentifier);
+
+ } else {
+ Logger.warn("Get unique identifier for target: " + baseIdType + " but target: " + targetIdentifier + " is required!");
+ throw new BuildException("builder.00",
+ new Object[]{"Get unique identifier for target: " + baseIdType + " but target: " + targetIdentifier + " is required"});
+
+ }
+ }
+ }
+
+
/**
- * Builds the wbPK from the given parameters.
+ * Builds the storkeid from the given parameters.
*
- * @param identificationValue Base64 encoded "Stammzahl"
- * @param registerAndOrdNr type of register + "+" + number in register.
- * @return wbPK in a BASE64 encoding
+ * @param baseID baseID of the citizen
+ * @param baseIDType Type of the baseID
+ * @param sourceCountry CountryCode of that country, which build the eIDAs ID
+ * @param destinationCountry CountryCode of that country, which receives the eIDAs ID
+ *
+ * @return Pair<eIDAs, bPKType> in a BASE64 encoding
* @throws BuildException if an error occurs on building the wbPK
*/
- public String buildWBPK(String identificationValue, String registerAndOrdNr)
- throws BuildException {
+ private Pair<String, String> buildeIDASIdentifer(String baseID, String baseIDType, String sourceCountry, String destinationCountry)
+ throws BuildException {
+ String bPK = null;
+ String bPKType = null;
+
+ // check if we have been called by public sector application
+ if (baseIDType.startsWith(Constants.URN_PREFIX_BASEID)) {
+ bPKType = Constants.URN_PREFIX_EIDAS + "+" + sourceCountry + "+" + destinationCountry;
+ Logger.debug("Building eIDAS identification from: [identValue]+" + bPKType);
+ bPK = calculatebPKwbPK(baseID + "+" + bPKType);
+
+ } else { // if not, sector identification value is already calculated by BKU
+ Logger.debug("eIDAS eIdentifier already provided by BKU");
+ bPK = baseID;
+ }
- if ((identificationValue == null ||
- identificationValue.length() == 0 ||
- registerAndOrdNr == null ||
- registerAndOrdNr.length() == 0)) {
+ if ((MiscUtil.isEmpty(bPK) ||
+ MiscUtil.isEmpty(sourceCountry) ||
+ MiscUtil.isEmpty(destinationCountry))) {
throw new BuildException("builder.00",
- new Object[]{"wbPK", "Unvollständige Parameterangaben: identificationValue=" +
- identificationValue + ",Register+Registernummer=" + registerAndOrdNr});
+ new Object[]{"eIDAS-ID", "Unvollständige Parameterangaben: identificationValue=" +
+ bPK + ", Zielland=" + destinationCountry + ", Ursprungsland=" + sourceCountry});
}
-
- String basisbegriff;
- if (registerAndOrdNr.startsWith(Constants.URN_PREFIX_WBPK + "+"))
- basisbegriff = identificationValue + "+" + registerAndOrdNr;
- else
- basisbegriff = identificationValue + "+" + Constants.URN_PREFIX_WBPK + "+" + registerAndOrdNr;
-
- return calculatebPKwbPK(basisbegriff);
- }
-
- public String buildbPKorwbPK(String baseID, String bPKorwbPKTarget) throws BuildException {
- if (MiscUtil.isEmpty(baseID) ||
- !(bPKorwbPKTarget.startsWith(Constants.URN_PREFIX_CDID + "+") ||
- bPKorwbPKTarget.startsWith(Constants.URN_PREFIX_WBPK + "+") ||
- bPKorwbPKTarget.startsWith(Constants.URN_PREFIX_STORK + "+")) ) {
- throw new BuildException("builder.00",
- new Object[]{"bPK/wbPK", "bPK or wbPK target " + bPKorwbPKTarget
- + " has an unkown prefix."});
-
- }
-
- return calculatebPKwbPK(baseID + "+" + bPKorwbPKTarget);
-
+
+ Logger.debug("Building eIDAS identification from: " + sourceCountry+"/"+destinationCountry+"/" + "[identValue]");
+ String eIdentifier = sourceCountry + "/" + destinationCountry + "/" + bPK;
+
+ return Pair.newInstance(eIdentifier, bPKType);
}
+
+// /**
+// * Builds the bPK from the given parameters.
+// *
+// * @param identificationValue Base64 encoded "Stammzahl"
+// * @param target "Bereich lt. Verordnung des BKA"
+// * @return bPK in a BASE64 encoding
+// * @throws BuildException if an error occurs on building the bPK
+// */
+// private String buildBPK(String identificationValue, String target)
+// throws BuildException {
+//
+// if ((identificationValue == null ||
+// identificationValue.length() == 0 ||
+// target == null ||
+// target.length() == 0)) {
+// throw new BuildException("builder.00",
+// new Object[]{"BPK", "Unvollständige Parameterangaben: identificationValue=" +
+// identificationValue + ",target=" + target});
+// }
+// String basisbegriff;
+// if (target.startsWith(Constants.URN_PREFIX_CDID + "+"))
+// basisbegriff = identificationValue + "+" + target;
+// else
+// basisbegriff = identificationValue + "+" + Constants.URN_PREFIX_CDID + "+" + target;
+//
+// return calculatebPKwbPK(basisbegriff);
+// }
+//
+// /**
+// * Builds the wbPK from the given parameters.
+// *
+// * @param identificationValue Base64 encoded "Stammzahl"
+// * @param registerAndOrdNr type of register + "+" + number in register.
+// * @return wbPK in a BASE64 encoding
+// * @throws BuildException if an error occurs on building the wbPK
+// */
+// private String buildWBPK(String identificationValue, String registerAndOrdNr)
+// throws BuildException {
+//
+// if ((identificationValue == null ||
+// identificationValue.length() == 0 ||
+// registerAndOrdNr == null ||
+// registerAndOrdNr.length() == 0)) {
+// throw new BuildException("builder.00",
+// new Object[]{"wbPK", "Unvollständige Parameterangaben: identificationValue=" +
+// identificationValue + ",Register+Registernummer=" + registerAndOrdNr});
+// }
+//
+// String basisbegriff;
+// if (registerAndOrdNr.startsWith(Constants.URN_PREFIX_WBPK + "+"))
+// basisbegriff = identificationValue + "+" + registerAndOrdNr;
+// else
+// basisbegriff = identificationValue + "+" + Constants.URN_PREFIX_WBPK + "+" + registerAndOrdNr;
+//
+// return calculatebPKwbPK(basisbegriff);
+// }
+//
+// private String buildbPKorwbPK(String baseID, String bPKorwbPKTarget) throws BuildException {
+// if (MiscUtil.isEmpty(baseID) ||
+// !(bPKorwbPKTarget.startsWith(Constants.URN_PREFIX_CDID + "+") ||
+// bPKorwbPKTarget.startsWith(Constants.URN_PREFIX_WBPK + "+") ||
+// bPKorwbPKTarget.startsWith(Constants.URN_PREFIX_STORK + "+")) ) {
+// throw new BuildException("builder.00",
+// new Object[]{"bPK/wbPK", "bPK or wbPK target " + bPKorwbPKTarget
+// + " has an unkown prefix."});
+//
+// }
+//
+// return calculatebPKwbPK(baseID + "+" + bPKorwbPKTarget);
+//
+// }
public static String encryptBPK(String bpk, String target, PublicKey publicKey) throws BuildException {
MiscUtil.assertNotNull(bpk, "BPK");
@@ -199,48 +315,7 @@ public class BPKBuilder {
return null;
}
}
-
- /**
- * Builds the storkeid from the given parameters.
- *
- * @param baseID baseID of the citizen
- * @param baseIDType Type of the baseID
- * @param sourceCountry CountryCode of that country, which build the eIDAs ID
- * @param destinationCountry CountryCode of that country, which receives the eIDAs ID
- *
- * @return Pair<eIDAs, bPKType> in a BASE64 encoding
- * @throws BuildException if an error occurs on building the wbPK
- */
- public Pair<String, String> buildeIDASIdentifer(String baseID, String baseIDType, String sourceCountry, String destinationCountry)
- throws BuildException {
- String bPK = null;
- String bPKType = null;
-
- // check if we have been called by public sector application
- if (baseIDType.startsWith(Constants.URN_PREFIX_BASEID)) {
- bPKType = Constants.URN_PREFIX_EIDAS + "+" + sourceCountry + "+" + destinationCountry;
- Logger.debug("Building eIDAS identification from: [identValue]+" + bPKType);
- bPK = calculatebPKwbPK(baseID + "+" + bPKType);
-
- } else { // if not, sector identification value is already calculated by BKU
- Logger.debug("eIDAS eIdentifier already provided by BKU");
- bPK = baseID;
- }
-
- if ((MiscUtil.isEmpty(bPK) ||
- MiscUtil.isEmpty(sourceCountry) ||
- MiscUtil.isEmpty(destinationCountry))) {
- throw new BuildException("builder.00",
- new Object[]{"eIDAS-ID", "Unvollständige Parameterangaben: identificationValue=" +
- bPK + ", Zielland=" + destinationCountry + ", Ursprungsland=" + sourceCountry});
- }
-
- Logger.debug("Building eIDAS identification from: " + sourceCountry+"/"+destinationCountry+"/" + "[identValue]");
- String eIdentifier = sourceCountry + "/" + destinationCountry + "/" + bPK;
- return Pair.newInstance(eIdentifier, bPKType);
- }
-
private String calculatebPKwbPK(String basisbegriff) throws BuildException {
try {
MessageDigest md = MessageDigest.getInstance("SHA-1");
@@ -281,6 +356,4 @@ public class BPKBuilder {
result = cipher.doFinal(encryptedBytes);
return result;
}
-
-
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java
index 73fe961eb..4c4af4239 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java
@@ -53,9 +53,11 @@ import java.util.List;
import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
import at.gv.egovernment.moa.id.config.TargetToSectorNameMapper;
import at.gv.egovernment.moa.util.Constants;
import at.gv.egovernment.moa.util.DateTimeUtils;
+import at.gv.egovernment.moa.util.MiscUtil;
import at.gv.egovernment.moa.util.StringUtils;
/**
@@ -156,8 +158,9 @@ public class CreateXMLSignatureRequestBuilder implements Constants {
* @param oaParam parameter for the OA
* @param session current session
* @return String representation of <code>&lt;CreateXMLSignatureRequest&gt;</code>
+ * @throws ConfigurationException
*/
- public String buildForeignID(String subject, IRequest pendingReq) {
+ public String buildForeignID(String subject, IRequest pendingReq) throws ConfigurationException {
String request = "";
request += "<sl:CreateXMLSignatureRequest xmlns:sl=\"http://www.buergerkarte.at/namespaces/securitylayer/1.2#\">";
@@ -181,11 +184,22 @@ public class CreateXMLSignatureRequestBuilder implements Constants {
return request;
}
- public static String buildForeignIDTextToBeSigned(String subject, IRequest pendingReq) {
+ public static String buildForeignIDTextToBeSigned(String subject, IRequest pendingReq) throws ConfigurationException {
IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
- String target = pendingReq.getGenericData(
- MOAIDAuthConstants.AUTHPROCESS_DATA_TARGET, String.class);
- String sectorName = TargetToSectorNameMapper.getSectorNameViaTarget(target);
+ String target = null;
+ String sectorName = null;
+
+
+ String saml1Target = pendingReq.getGenericData(
+ MOAIDAuthConstants.AUTHPROCESS_DATA_TARGET, String.class);
+ if (MiscUtil.isNotEmpty(saml1Target)) {
+ target = saml1Target;
+ sectorName = TargetToSectorNameMapper.getSectorNameViaTarget(saml1Target);
+
+ } else {
+ target = oaParam.getAreaSpecificTargetIdentifier();
+ sectorName = oaParam.getAreaSpecificTargetIdentifierFriendlyName();
+ }
Calendar cal = Calendar.getInstance();
String date = DateTimeUtils.buildDate(cal);
@@ -243,11 +257,11 @@ public class CreateXMLSignatureRequestBuilder implements Constants {
request += oaParam.getPublicURLPrefix();
request += "</td>";
request += "</tr>";
- boolean business = oaParam.getBusinessService();
- if (business) {
+
+ if (!target.startsWith(MOAIDAuthConstants.PREFIX_CDID)) {
// OA is businessservice
- String identifierType = oaParam.getIdentityLinkDomainIdentifierType();
- String identifier = oaParam.getIdentityLinkDomainIdentifier();
+ String identifierType = oaParam.getAreaSpecificTargetIdentifierFriendlyName();
+ String identifier = oaParam.getAreaSpecificTargetIdentifier();
request += "<tr>";
request += "<td class=\"italicstyle\">";
request += identifierType + ":";
@@ -263,7 +277,7 @@ public class CreateXMLSignatureRequestBuilder implements Constants {
request += "<td class=\"italicstyle\">";
request += "Sektor (Sector):</td>";
request += "<td class=\"normalstyle\">";
- request += target + " (" + sectorName + ")";
+ request += target.substring(MOAIDAuthConstants.PREFIX_CDID.length()) + " (" + sectorName + ")";
request += "</td>";
request += "</tr>";
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/DynamicOAAuthParameterBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/DynamicOAAuthParameterBuilder.java
index f4f6e82ba..fc5489673 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/DynamicOAAuthParameterBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/DynamicOAAuthParameterBuilder.java
@@ -31,14 +31,10 @@ import at.gv.egovernment.moa.id.auth.exception.DynamicOABuildException;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
import at.gv.egovernment.moa.id.commons.api.IRequest;
import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
-import at.gv.egovernment.moa.id.commons.db.dao.session.InterfederationSessionStore;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
import at.gv.egovernment.moa.id.config.auth.data.DynamicOAAuthParameters;
import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
import at.gv.egovernment.moa.logging.Logger;
import at.gv.egovernment.moa.util.Constants;
-import at.gv.egovernment.moa.util.MiscUtil;
/**
* @author tlenz
@@ -57,13 +53,14 @@ public class DynamicOAAuthParameterBuilder {
if (attr.getName().equals(PVPConstants.EID_SECTOR_FOR_IDENTIFIER_NAME)) {
String attrValue = attr.getAttributeValues().get(0).getDOM().getTextContent();
if (attrValue.startsWith(Constants.URN_PREFIX_CDID)) {
- dynamicOA.setBusinessService(false);
- dynamicOA.setTarget(attrValue.substring((Constants.URN_PREFIX_CDID + "+").length()));
+ //dynamicOA.setBusinessService(false);
+ dynamicOA.setAreaSpecificTargetIdentifier(attrValue);
} else if( attrValue.startsWith(Constants.URN_PREFIX_WBPK) ||
- attrValue.startsWith(Constants.URN_PREFIX_STORK) ) {
- dynamicOA.setBusinessService(true);
- dynamicOA.setTarget(attrValue);
+ attrValue.startsWith(Constants.URN_PREFIX_STORK) ||
+ attrValue.startsWith(Constants.URN_PREFIX_EIDAS)) {
+ //dynamicOA.setBusinessService(true);
+ dynamicOA.setAreaSpecificTargetIdentifier(attrValue);
} else {
Logger.error("Sector identification " + attrValue + " is not a valid Target or BusinessServiceArea");
@@ -84,13 +81,16 @@ public class DynamicOAAuthParameterBuilder {
* @param oaParam
* @param protocolRequest
* @return
+ * @throws ConfigurationException
*/
public static IOAAuthParameters buildFromAuthnRequest(
- IOAAuthParameters oaParam, IRequest protocolRequest) {
+ IOAAuthParameters oaParam, IRequest protocolRequest) throws ConfigurationException {
DynamicOAAuthParameters dynOAParams = new DynamicOAAuthParameters();
dynOAParams.setApplicationID(oaParam.getPublicURLPrefix());
- dynOAParams.setBusinessService(oaParam.getBusinessService());
+
+ dynOAParams.setHasBaseIdProcessingRestriction(oaParam.hasBaseIdInternalProcessingRestriction());
+ dynOAParams.setHasBaseIdTransfergRestriction(oaParam.hasBaseIdTransferRestriction());
Object storkRequst = null;
try {
@@ -98,9 +98,9 @@ public class DynamicOAAuthParameterBuilder {
if (storkRequst != null &&
protocolRequest.getClass().isInstance(storkRequst)) {
- dynOAParams.setBusinessTarget(Constants.URN_PREFIX_STORK + "+" + "AT" + "+"
+ dynOAParams.setAreaSpecificTargetIdentifier(Constants.URN_PREFIX_STORK + "+" + "AT" + "+"
+ protocolRequest.getClass().getMethod("getSpCountry", null).invoke(protocolRequest, null));
- dynOAParams.setBusinessService(true);
+ //dynOAParams.setBusinessService(true);
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java
index a82ba501c..d5ca89656 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java
@@ -56,12 +56,16 @@ import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
import at.gv.egovernment.moa.id.commons.api.ConnectionParameterInterface;
import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
+import at.gv.egovernment.moa.spss.MOAException;
import at.gv.egovernment.moa.spss.api.SignatureVerificationService;
+import at.gv.egovernment.moa.spss.api.cmsverify.VerifyCMSSignatureRequest;
+import at.gv.egovernment.moa.spss.api.cmsverify.VerifyCMSSignatureResponse;
import at.gv.egovernment.moa.spss.api.xmlbind.VerifyXMLSignatureRequestParser;
import at.gv.egovernment.moa.spss.api.xmlbind.VerifyXMLSignatureResponseBuilder;
import at.gv.egovernment.moa.spss.api.xmlverify.VerifyXMLSignatureRequest;
import at.gv.egovernment.moa.spss.api.xmlverify.VerifyXMLSignatureResponse;
import at.gv.egovernment.moa.util.MiscUtil;
+import at.gv.egovernment.moaspss.logging.Logger;
/**
* Invoker of the <code>SignatureVerification</code> web service of MOA-SPSS.<br>
@@ -108,6 +112,18 @@ public class SignatureVerificationInvoker {
}
+ public VerifyCMSSignatureResponse verifyCMSSignature(VerifyCMSSignatureRequest cmsSigVerifyReq) throws ServiceException {
+ try {
+ return svs.verifyCMSSignature(cmsSigVerifyReq);
+
+ } catch (MOAException e) {
+ Logger.warn("CMS signature verification has an error.", e);
+ throw new ServiceException("service.03", new Object[] { e.toString()}, e);
+
+ }
+
+ }
+
/**
* Method verifyXMLSignature.
* @param request to be sent
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateBKUSelectionFrameTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateBKUSelectionFrameTask.java
index c582050ad..710008714 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateBKUSelectionFrameTask.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateBKUSelectionFrameTask.java
@@ -32,7 +32,7 @@ import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
import at.gv.egovernment.moa.id.auth.frontend.builder.IGUIBuilderConfiguration;
import at.gv.egovernment.moa.id.auth.frontend.builder.IGUIFormBuilder;
-import at.gv.egovernment.moa.id.auth.frontend.builder.ServiceProviderSpecificGUIFormBuilderConfiguration;
+import at.gv.egovernment.moa.id.auth.frontend.builder.SPSpecificGUIBuilderConfigurationWithDBLoad;
import at.gv.egovernment.moa.id.auth.frontend.exception.GUIBuildException;
import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
@@ -68,10 +68,10 @@ public class GenerateBKUSelectionFrameTask extends AbstractAuthServletTask {
throw new AuthenticationException("auth.00", new Object[] { pendingReq.getOAURL() });
}
-
- IGUIBuilderConfiguration config = new ServiceProviderSpecificGUIFormBuilderConfiguration(
+
+ IGUIBuilderConfiguration config = new SPSpecificGUIBuilderConfigurationWithDBLoad(
pendingReq,
- ServiceProviderSpecificGUIFormBuilderConfiguration.VIEW_BKUSELECTION,
+ SPSpecificGUIBuilderConfigurationWithDBLoad.VIEW_BKUSELECTION,
GeneralProcessEngineSignalController.ENDPOINT_BKUSELECTION_EVALUATION);
guiBuilder.build(response, config, "BKU-Selection form");
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateSSOConsentEvaluatorFrameTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateSSOConsentEvaluatorFrameTask.java
index ca99e9ba3..475009cf2 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateSSOConsentEvaluatorFrameTask.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GenerateSSOConsentEvaluatorFrameTask.java
@@ -31,7 +31,7 @@ import org.springframework.stereotype.Component;
import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
import at.gv.egovernment.moa.id.auth.frontend.builder.IGUIBuilderConfiguration;
import at.gv.egovernment.moa.id.auth.frontend.builder.IGUIFormBuilder;
-import at.gv.egovernment.moa.id.auth.frontend.builder.ServiceProviderSpecificGUIFormBuilderConfiguration;
+import at.gv.egovernment.moa.id.auth.frontend.builder.SPSpecificGUIBuilderConfigurationWithDBLoad;
import at.gv.egovernment.moa.id.auth.frontend.exception.GUIBuildException;
import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
@@ -67,10 +67,10 @@ public class GenerateSSOConsentEvaluatorFrameTask extends AbstractAuthServletTas
//store pending request
requestStoreage.storePendingRequest(pendingReq);
- //build consents evaluator form
- IGUIBuilderConfiguration config = new ServiceProviderSpecificGUIFormBuilderConfiguration(
+ //build consents evaluator form
+ IGUIBuilderConfiguration config = new SPSpecificGUIBuilderConfigurationWithDBLoad(
pendingReq,
- ServiceProviderSpecificGUIFormBuilderConfiguration.VIEW_SENDASSERTION,
+ SPSpecificGUIBuilderConfigurationWithDBLoad.VIEW_SENDASSERTION,
GeneralProcessEngineSignalController.ENDPOINT_SENDASSERTION_EVALUATION);
guiBuilder.build(response, config, "SendAssertion-Evaluation");
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java
index 92d76751f..b2db8d5a2 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java
@@ -52,7 +52,7 @@ public class StartAuthentificationParameterParser extends MOAIDAuthConstants{
@Autowired AuthConfiguration authConfig;
public void parse(IAuthenticationSession moasession,
- String target,
+ String reqTarget,
String oaURL,
String bkuURL,
String templateURL,
@@ -61,10 +61,11 @@ public class StartAuthentificationParameterParser extends MOAIDAuthConstants{
HttpServletRequest req,
IRequest protocolReq) throws WrongParametersException, MOAIDException {
- String targetFriendlyName = null;
-
+ String resultTargetFriendlyName = null;
+ String resultTarget = null;
+
// escape parameter strings
- target = StringEscapeUtils.escapeHtml(target);
+ reqTarget = StringEscapeUtils.escapeHtml(reqTarget);
bkuURL = StringEscapeUtils.escapeHtml(bkuURL);
templateURL = StringEscapeUtils.escapeHtml(templateURL);
useMandate = StringEscapeUtils.escapeHtml(useMandate);
@@ -102,66 +103,70 @@ public class StartAuthentificationParameterParser extends MOAIDAuthConstants{
// get target and target friendly name from config
- String targetConfig = oaParam.getTarget();
- String targetFriendlyNameConfig = oaParam.getTargetFriendlyName();
+ String targetConfig = oaParam.getAreaSpecificTargetIdentifier();
+ String targetFriendlyNameConfig = oaParam.getAreaSpecificTargetIdentifierFriendlyName();
+
+ //SAML1 legacy work-around for public area targets in request
+ if (protocolReq.requestedModule().equals("at.gv.egovernment.moa.id.protocols.saml1.SAML1Protocol") &&
+ !StringUtils.isEmpty(reqTarget)) {
+ //INFO: ONLY SAML1 legacy mode
+ // if SAML1 is used and target attribute is given in request
+ // use requested target
+ // check target parameter
+ if (!ParamValidatorUtils.isValidTarget(reqTarget)) {
+ Logger.error("Selected target is invalid. Used target: " + reqTarget);
+ throw new WrongParametersException("StartAuthentication", PARAM_TARGET, "auth.12");
+ }
+ resultTarget = MOAIDAuthConstants.PREFIX_CDID + reqTarget;
- if (!oaParam.getBusinessService()) {
- if (StringUtils.isEmpty(targetConfig)
- || (protocolReq.requestedModule().equals("at.gv.egovernment.moa.id.protocols.saml1.SAML1Protocol") &&
- !StringUtils.isEmpty(target))
- ) {
- //INFO: ONLY SAML1 legacy mode
- // if SAML1 is used and target attribute is given in request
- // use requested target
- // check target parameter
- if (!ParamValidatorUtils.isValidTarget(target)) {
- Logger.error("Selected target is invalid. Using target: " + target);
- throw new WrongParametersException("StartAuthentication", PARAM_TARGET, "auth.12");
- }
- if (MiscUtil.isNotEmpty(targetConfig))
- targetFriendlyName = targetFriendlyNameConfig;
+ String sectorName = TargetToSectorNameMapper.getSectorNameViaTarget(reqTarget);
+ if (MiscUtil.isNotEmpty(sectorName))
+ resultTargetFriendlyName = sectorName;
+
+ else {
+ //check target contains subSector
+ int delimiter = reqTarget.indexOf("-");
+ if (delimiter > 0) {
+ resultTargetFriendlyName =
+ TargetToSectorNameMapper.getSectorNameViaTarget(reqTarget.substring(0, delimiter));
- else {
- String sectorName = TargetToSectorNameMapper.getSectorNameViaTarget(target);
- if (MiscUtil.isNotEmpty(sectorName))
- targetFriendlyName = sectorName;
-
- else {
- //check target contains subSector
- int delimiter = target.indexOf("-");
- if (delimiter > 0) {
- targetFriendlyName =
- TargetToSectorNameMapper.getSectorNameViaTarget(target.substring(0, delimiter));
-
- }
- }
- }
-
- } else {
- // use target from config
- target = targetConfig;
- targetFriendlyName = targetFriendlyNameConfig;
+ }
}
- if (isEmpty(target))
- throw new WrongParametersException("StartAuthentication",
- PARAM_TARGET, "auth.05");
-
- protocolReq.setGenericDataToSession(MOAIDAuthConstants.AUTHPROCESS_DATA_TARGET, target);
+ if (MiscUtil.isNotEmpty(targetConfig) && MiscUtil.isEmpty(resultTargetFriendlyName))
+ resultTargetFriendlyName = targetFriendlyNameConfig;
+
+ //set info's into request-context. (It's required to support SAML1 requested target parameters)
+ protocolReq.setGenericDataToSession(MOAIDAuthConstants.AUTHPROCESS_DATA_TARGET, resultTarget);
protocolReq.setGenericDataToSession(
- MOAIDAuthConstants.AUTHPROCESS_DATA_TARGETFRIENDLYNAME, targetFriendlyName);
- Logger.debug("Service-Provider is of type 'PublicService' with DomainIdentifier:" + target);
-
- } else {
- Logger.debug("Service-Provider is of type 'PrivateService' with DomainIdentifier:" + oaParam.getIdentityLinkDomainIdentifier());
+ MOAIDAuthConstants.AUTHPROCESS_DATA_TARGETFRIENDLYNAME, resultTargetFriendlyName);
- if (useMandateBoolean) {
- Logger.error("Online-Mandate Mode for business application not supported.");
- throw new AuthenticationException("auth.17", null);
- }
+ } else {
+ Logger.trace("Use oa sector-identifier from configuration");
+ resultTarget = targetConfig;
+ resultTargetFriendlyName = targetFriendlyNameConfig;
}
-
+
+ //check if target is found
+ if (MiscUtil.isEmpty(resultTarget))
+ throw new WrongParametersException("StartAuthentication",
+ PARAM_TARGET, "auth.05");
+
+ //check if mandates are allowed
+ if (useMandateBoolean && oaParam.hasBaseIdInternalProcessingRestriction()) {
+ Logger.error("Online-Mandate Mode for business application not supported.");
+ throw new AuthenticationException("auth.17", null);
+
+ }
+
+ if (resultTarget.startsWith(MOAIDAuthConstants.PREFIX_CDID))
+ Logger.debug("Service-Provider is of type 'PublicService' with DomainIdentifier:" + resultTarget);
+ else
+ Logger.debug("Service-Provider is of type 'PrivateService' with DomainIdentifier:" + resultTarget);
+
+
+
//Validate BKU URI
List<String> allowedbkus = oaParam.getBKUURL();
allowedbkus.addAll(authConfig.getDefaultBKUURLs());
@@ -247,16 +252,4 @@ public class StartAuthentificationParameterParser extends MOAIDAuthConstants{
parse(moasession, target, oaURL, bkuURL, templateURL, useMandate, ccc, req, pendingReq);
}
-
- /**
- * Checks a parameter.
- *
- * @param param
- * parameter
- * @return true if the parameter is null or empty
- */
- private boolean isEmpty(String param) {
- return param == null || param.length() == 0;
- }
-
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractController.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractController.java
index 1431911a3..353261085 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractController.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractController.java
@@ -33,6 +33,7 @@ import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.ExceptionHandler;
import com.google.common.net.MediaType;
+
import at.gv.egovernment.moa.id.advancedlogging.IStatisticLogger;
import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
@@ -139,13 +140,11 @@ public abstract class AbstractController extends MOAIDAuthConstants {
if (pendingReq != null) {
revisionsLogger.logEvent(pendingReq, MOAIDEventConstants.TRANSACTION_ERROR);
transactionStorage.put(key,
- new ExceptionContainer(pendingReq.getUniqueSessionIdentifier(),
- pendingReq.getUniqueTransactionIdentifier(), loggedException),-1);
+ new ExceptionContainer(pendingReq, loggedException),-1);
} else {
transactionStorage.put(key,
- new ExceptionContainer(null,
- null, loggedException),-1);
+ new ExceptionContainer(null, loggedException),-1);
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractProcessEngineSignalController.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractProcessEngineSignalController.java
index 0ce7b0050..32f103ca7 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractProcessEngineSignalController.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractProcessEngineSignalController.java
@@ -45,11 +45,7 @@ public abstract class AbstractProcessEngineSignalController extends AbstractCont
//change pending-request ID
requestStorage.changePendingRequestID(pendingReq);
pendingRequestID = pendingReq.getRequestID();
-
- //add transactionID and unique sessionID to Logger
- TransactionIDUtils.setSessionId(pendingReq.getUniqueSessionIdentifier());
- TransactionIDUtils.setTransactionId(pendingReq.getUniqueTransactionIdentifier());
-
+
// process instance is mandatory
if (pendingReq.getProcessInstanceId() == null) {
throw new MOAIllegalStateException("process.03", new Object[]{"MOA session does not provide process instance id."});
@@ -64,8 +60,7 @@ public abstract class AbstractProcessEngineSignalController extends AbstractCont
} finally {
//MOASessionDBUtils.closeSession();
- TransactionIDUtils.removeTransactionId();
- TransactionIDUtils.removeSessionId();
+ TransactionIDUtils.removeAllLoggingVariables();
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GUILayoutBuilderServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GUILayoutBuilderServlet.java
index 9b658d81b..49145a850 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GUILayoutBuilderServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GUILayoutBuilderServlet.java
@@ -33,9 +33,11 @@ import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
+import at.gv.egovernment.moa.id.auth.frontend.builder.AbstractServiceProviderSpecificGUIFormBuilderConfiguration;
import at.gv.egovernment.moa.id.auth.frontend.builder.IGUIFormBuilder;
-import at.gv.egovernment.moa.id.auth.frontend.builder.ServiceProviderSpecificGUIFormBuilderConfiguration;
+import at.gv.egovernment.moa.id.auth.frontend.builder.SPSpecificGUIBuilderConfigurationWithDBLoad;
import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.commons.MOAIDConstants;
import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
import at.gv.egovernment.moa.id.commons.api.IRequest;
import at.gv.egovernment.moa.id.moduls.IRequestStorage;
@@ -52,6 +54,7 @@ public class GUILayoutBuilderServlet extends AbstractController {
public static final String ENDPOINT_CSS = "/css/buildCSS";
public static final String ENDPOINT_JS = "/js/buildJS";
+ public static final String ENDPOINT_BKUDETECTION = "/feature/bkuDetection";
@Autowired AuthConfiguration authConfig;
@Autowired IRequestStorage requestStoreage;
@@ -65,30 +68,65 @@ public class GUILayoutBuilderServlet extends AbstractController {
}
+ @RequestMapping(value = ENDPOINT_BKUDETECTION, method = {RequestMethod.GET})
+ public void buildBkuDetectionFrame(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+ try {
+ IRequest pendingReq = extractPendingRequest(req);
+
+ //initialize GUI builder configuration
+ AbstractServiceProviderSpecificGUIFormBuilderConfiguration config = null;
+ if (pendingReq != null)
+ config = new SPSpecificGUIBuilderConfigurationWithDBLoad(
+ pendingReq,
+ SPSpecificGUIBuilderConfigurationWithDBLoad.VIEW_TEMPLATE_BKUDETECTION_SP_SPECIFIC,
+ null);
+
+ else {
+ config = new SPSpecificGUIBuilderConfigurationWithDBLoad(
+ HTTPUtils.extractAuthURLFromRequest(req),
+ SPSpecificGUIBuilderConfigurationWithDBLoad.VIEW_TEMPLATE_BKUDETECTION_GENERIC,
+ null);
+ config.setTemplateClasspahtDir(
+ SPSpecificGUIBuilderConfigurationWithDBLoad.VIEW_TEMPLATE_MAINGUI_DIRECTORY);
+
+ }
+
+ //build GUI component
+ formBuilder.build(resp, config, MOAIDConstants.DEFAULT_CONTENT_TYPE_HTML_UTF8, "BKUDetection-Frame");
+
+
+ } catch (Exception e) {
+ Logger.warn("GUI ressource:'BKUDetection' generation FAILED.", e);
+ resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Created resource failed");
+
+ }
+
+ }
+
@RequestMapping(value = "/css/buildCSS", method = {RequestMethod.GET})
public void buildCSS(HttpServletRequest req, HttpServletResponse resp) throws IOException {
try {
IRequest pendingReq = extractPendingRequest(req);
//initialize GUI builder configuration
- ServiceProviderSpecificGUIFormBuilderConfiguration config = null;
+ SPSpecificGUIBuilderConfigurationWithDBLoad config = null;
if (pendingReq != null)
- config = new ServiceProviderSpecificGUIFormBuilderConfiguration(
+ config = new SPSpecificGUIBuilderConfigurationWithDBLoad(
pendingReq,
- ServiceProviderSpecificGUIFormBuilderConfiguration.VIEW_TEMPLATE_CSS,
+ SPSpecificGUIBuilderConfigurationWithDBLoad.VIEW_TEMPLATE_CSS,
null);
else
- config = new ServiceProviderSpecificGUIFormBuilderConfiguration(
+ config = new SPSpecificGUIBuilderConfigurationWithDBLoad(
HTTPUtils.extractAuthURLFromRequest(req),
- ServiceProviderSpecificGUIFormBuilderConfiguration.VIEW_TEMPLATE_CSS,
+ SPSpecificGUIBuilderConfigurationWithDBLoad.VIEW_TEMPLATE_CSS,
null);
//build GUI component
formBuilder.build(resp, config, "text/css; charset=UTF-8", "CSS-Form");
} catch (Exception e) {
- Logger.warn("GUI ressource:'CSS' generation FAILED.");
+ Logger.warn("GUI ressource:'CSS' generation FAILED.", e);
resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Created resource failed");
}
@@ -100,24 +138,24 @@ public class GUILayoutBuilderServlet extends AbstractController {
IRequest pendingReq = extractPendingRequest(req);
//initialize GUI builder configuration
- ServiceProviderSpecificGUIFormBuilderConfiguration config = null;
+ SPSpecificGUIBuilderConfigurationWithDBLoad config = null;
if (pendingReq != null)
- config = new ServiceProviderSpecificGUIFormBuilderConfiguration(
+ config = new SPSpecificGUIBuilderConfigurationWithDBLoad(
pendingReq,
- ServiceProviderSpecificGUIFormBuilderConfiguration.VIEW_TEMPLATE_JS,
+ SPSpecificGUIBuilderConfigurationWithDBLoad.VIEW_TEMPLATE_JS,
GeneralProcessEngineSignalController.ENDPOINT_BKUSELECTION_EVALUATION);
else
- config = new ServiceProviderSpecificGUIFormBuilderConfiguration(
+ config = new SPSpecificGUIBuilderConfigurationWithDBLoad(
HTTPUtils.extractAuthURLFromRequest(req),
- ServiceProviderSpecificGUIFormBuilderConfiguration.VIEW_TEMPLATE_JS,
+ SPSpecificGUIBuilderConfigurationWithDBLoad.VIEW_TEMPLATE_JS,
GeneralProcessEngineSignalController.ENDPOINT_BKUSELECTION_EVALUATION);
//build GUI component
formBuilder.build(resp, config, "text/javascript; charset=UTF-8", "JavaScript");
} catch (Exception e) {
- Logger.warn("GUI ressource:'JavaScript' generation FAILED.");
+ Logger.warn("GUI ressource:'JavaScript' generation FAILED.", e);
resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Created resource failed");
}
@@ -142,6 +180,7 @@ public class GUILayoutBuilderServlet extends AbstractController {
} catch (Exception e) {
Logger.warn("GUI-Layout builder-servlet has an error during request-preprocessing.", e);
+
}
return null;
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/interceptor/UniqueSessionIdentifierInterceptor.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/interceptor/UniqueSessionIdentifierInterceptor.java
index bedc67513..466364adb 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/interceptor/UniqueSessionIdentifierInterceptor.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/interceptor/UniqueSessionIdentifierInterceptor.java
@@ -57,8 +57,8 @@ public class UniqueSessionIdentifierInterceptor implements HandlerInterceptor {
String uniqueSessionIdentifier = ssomanager.getUniqueSessionIdentifier(ssoId);
if (MiscUtil.isEmpty(uniqueSessionIdentifier))
uniqueSessionIdentifier = Random.nextRandom();
- TransactionIDUtils.setSessionId(uniqueSessionIdentifier);
+ TransactionIDUtils.setSessionId(uniqueSessionIdentifier);
request.setAttribute(MOAIDConstants.UNIQUESESSIONIDENTIFIER, uniqueSessionIdentifier);
return true;
@@ -79,8 +79,8 @@ public class UniqueSessionIdentifierInterceptor implements HandlerInterceptor {
@Override
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)
throws Exception {
- // TODO Auto-generated method stub
-
+ TransactionIDUtils.removeAllLoggingVariables();
+
}
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/TargetToSectorNameMapper.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/TargetToSectorNameMapper.java
index c31666bbb..fc5cc0495 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/TargetToSectorNameMapper.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/TargetToSectorNameMapper.java
@@ -52,6 +52,8 @@ package at.gv.egovernment.moa.id.config;
import java.util.HashMap;
import java.util.Map;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+
/**
* @author bzwattendorfer
*
@@ -106,6 +108,8 @@ public class TargetToSectorNameMapper implements TargetsAndSectorNames {
}
public static String getSectorNameViaTarget(String target) {
+ if (target.startsWith(MOAIDAuthConstants.PREFIX_CDID))
+ target = target.substring(MOAIDAuthConstants.PREFIX_CDID.length());
return targetMap.get(target) != null ? (String) targetMap.get(target) : "";
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java
index 6a6359058..3d04a142e 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java
@@ -60,7 +60,9 @@ import java.util.Set;
import org.apache.commons.lang.SerializationUtils;
import at.gv.egovernment.moa.id.auth.exception.BuildException;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
import at.gv.egovernment.moa.id.commons.MOAIDConstants;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
import at.gv.egovernment.moa.id.commons.api.IStorkConfig;
import at.gv.egovernment.moa.id.commons.api.data.BPKDecryptionParameters;
@@ -96,10 +98,31 @@ public class OAAuthParameter implements IOAAuthParameters, Serializable{
final public static String DEFAULT_KEYBOXIDENTIFIER = "SecureSignatureKeypair";
private Map<String, String> oaConfiguration;
+ private List<String> targetAreasWithNoInteralBaseIdRestriction = new ArrayList<String>();
+ private List<String> targetAreasWithNoBaseIdTransmissionRestriction = new ArrayList<String>();
-
- public OAAuthParameter(final Map<String, String> oa) {
+ public OAAuthParameter(final Map<String, String> oa, AuthConfiguration authConfig) {
this.oaConfiguration = oa;
+
+ //set oa specific restrictions
+ targetAreasWithNoInteralBaseIdRestriction = KeyValueUtils.getListOfCSVValues(
+ authConfig.getBasicMOAIDConfiguration(
+ CONFIG_KEY_RESTRICTIONS_BASEID_INTERNAL,
+ MOAIDAuthConstants.PREFIX_CDID));
+
+ targetAreasWithNoBaseIdTransmissionRestriction = KeyValueUtils.getListOfCSVValues(
+ authConfig.getBasicMOAIDConfiguration(
+ CONFIG_KEY_RESTRICTIONS_BASEID_TRANSMISSION,
+ MOAIDAuthConstants.PREFIX_CDID));
+
+ if (Logger.isTraceEnabled()) {
+ Logger.trace("Internal policy for OA: " + getPublicURLPrefix());
+ for (String el : targetAreasWithNoInteralBaseIdRestriction)
+ Logger.trace(" Allow baseID processing for prefix " + el);
+ for (String el : targetAreasWithNoBaseIdTransmissionRestriction)
+ Logger.trace(" Allow baseID transfer for prefix " + el);
+
+ }
}
@@ -111,12 +134,54 @@ public class OAAuthParameter implements IOAAuthParameters, Serializable{
return this.oaConfiguration.get(key);
}
+ @Override
+ public boolean hasBaseIdInternalProcessingRestriction() throws ConfigurationException {
+ String targetAreaIdentifier = getAreaSpecificTargetIdentifier();
+ for (String el : targetAreasWithNoInteralBaseIdRestriction) {
+ if (targetAreaIdentifier.startsWith(el))
+ return false;
+
+ }
+ return true;
+
+ }
+
+ @Override
+ public boolean hasBaseIdTransferRestriction() throws ConfigurationException {
+ String targetAreaIdentifier = getAreaSpecificTargetIdentifier();
+ for (String el : targetAreasWithNoBaseIdTransmissionRestriction) {
+ if (targetAreaIdentifier.startsWith(el))
+ return false;
+
+ }
+ return true;
+
+ }
+
+ @Override
+ public String getAreaSpecificTargetIdentifier() throws ConfigurationException {
+ if (getBusinessService())
+ return getIdentityLinkDomainIdentifier();
+ else
+ return MOAIDAuthConstants.PREFIX_CDID + getTarget();
+
+ }
+
+ @Override
+ public String getAreaSpecificTargetIdentifierFriendlyName() throws ConfigurationException{
+ if (getBusinessService())
+ return getIdentityLinkDomainIdentifierType();
+ else
+ return getTargetFriendlyName();
+
+ }
+
/* (non-Javadoc)
* @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getIdentityLinkDomainIdentifier()
*/
-@Override
-public String getIdentityLinkDomainIdentifier() {
+//@Override
+private String getIdentityLinkDomainIdentifier() {
String type = oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_TYPE);
String value = oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_VALUE);
if (MiscUtil.isNotEmpty(type) && MiscUtil.isNotEmpty(value)) {
@@ -138,8 +203,8 @@ public String getIdentityLinkDomainIdentifier() {
/* (non-Javadoc)
* @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getIdentityLinkDomainIdentifierType()
*/
-@Override
-public String getIdentityLinkDomainIdentifierType() {
+//@Override
+private String getIdentityLinkDomainIdentifierType() {
String value = oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_TYPE);
if (MiscUtil.isNotEmpty(value))
return MOAIDConfigurationConstants.BUSINESSSERVICENAMES.get(value);
@@ -151,8 +216,8 @@ public String getIdentityLinkDomainIdentifierType() {
/* (non-Javadoc)
* @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getTarget()
*/
-@Override
-public String getTarget() {
+//@Override
+private String getTarget() {
if (Boolean.parseBoolean(oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_PUBLIC_USE_OWN)))
return oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_PUBLIC_OWN_TARGET);
@@ -171,8 +236,8 @@ public String getTarget() {
/* (non-Javadoc)
* @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getTargetFriendlyName()
*/
-@Override
-public String getTargetFriendlyName() {
+//@Override
+private String getTargetFriendlyName() {
if (Boolean.parseBoolean(oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_PUBLIC_USE_OWN)))
return oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_PUBLIC_OWN_NAME);
@@ -265,8 +330,8 @@ public String getKeyBoxIdentifier() {
*/
@Override
public String getBKUURL(String bkutype) {
- if (bkutype.equals(ONLINEBKU)) {
- return oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_ONLINE);
+ if (bkutype.equals(THIRDBKU)) {
+ return oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_THIRD);
} else if (bkutype.equals(HANDYBKU)) {
return oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_HANDY);
@@ -274,10 +339,15 @@ public String getKeyBoxIdentifier() {
} else if (bkutype.equals(LOCALBKU)) {
return oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_LOCAL);
+ } else if (bkutype.equals(ONLINEBKU)) {
+ return oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_THIRD);
+
}
+
+
Logger.warn("BKU Type does not match: "
- + ONLINEBKU + " or " + HANDYBKU + " or " + LOCALBKU);
+ + THIRDBKU + " or " + HANDYBKU + " or " + LOCALBKU);
return null;
}
@@ -288,8 +358,8 @@ public String getKeyBoxIdentifier() {
public List<String> getBKUURL() {
List<String> list = new ArrayList<String>();
- if (oaConfiguration.containsKey(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_ONLINE))
- list.add(oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_ONLINE));
+ if (oaConfiguration.containsKey(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_THIRD))
+ list.add(oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_THIRD));
if (oaConfiguration.containsKey(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_HANDY))
list.add(oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_HANDY));
@@ -648,8 +718,8 @@ public boolean isInterfederationSSOStorageAllowed() {
return false;
}
-public boolean isIDPPublicService() {
- return !getBusinessService();
+public boolean isIDPPublicService() throws ConfigurationException {
+ return !hasBaseIdTransferRestriction();
}
@@ -735,11 +805,7 @@ public String getPublicURLPrefix() {
}
-/* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getBusinessService()
- */
-@Override
-public boolean getBusinessService() {
+private boolean getBusinessService() {
String value = oaConfiguration.get(MOAIDConfigurationConstants.SERVICE_BUSINESSSERVICE);
if (MiscUtil.isNotEmpty(value))
return Boolean.parseBoolean(value);
@@ -780,16 +846,16 @@ public String getFriendlyName() {
}
-/* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getOaType()
- */
-@Override
-public String getOaType() {
- if (getBusinessService())
- return "businessService";
- else
- return "publicService";
-}
+///* (non-Javadoc)
+// * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getOaType()
+// */
+//@Override
+//public String getOaType() {
+// if (getBusinessService())
+// return "businessService";
+// else
+// return "publicService";
+//}
/**
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java
index 35d052acd..332604257 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java
@@ -412,7 +412,7 @@ public class PropertyBasedAuthConfigurationProvider extends ConfigurationProvide
return null;
}
- return new OAAuthParameter(oa);
+ return new OAAuthParameter(oa, this);
}
/**
@@ -676,7 +676,7 @@ public class PropertyBasedAuthConfigurationProvider extends ConfigurationProvide
templatesList.add(configuration.getStringValue(
MOAIDConfigurationConstants.GENERAL_DEFAULTS_TEMPLATES_LOCAL));
templatesList.add(configuration.getStringValue(
- MOAIDConfigurationConstants.GENERAL_DEFAULTS_TEMPLATES_ONLINE));
+ MOAIDConfigurationConstants.GENERAL_DEFAULTS_TEMPLATES_THIRD));
templatesList.add(configuration.getStringValue(
MOAIDConfigurationConstants.GENERAL_DEFAULTS_TEMPLATES_HANDY));
@@ -701,9 +701,9 @@ public class PropertyBasedAuthConfigurationProvider extends ConfigurationProvide
try {
switch (type) {
- case IOAAuthParameters.ONLINEBKU:
+ case IOAAuthParameters.THIRDBKU:
slRequestTemplate = configuration.getStringValue(
- MOAIDConfigurationConstants.GENERAL_DEFAULTS_TEMPLATES_ONLINE);
+ MOAIDConfigurationConstants.GENERAL_DEFAULTS_TEMPLATES_THIRD);
break;
case IOAAuthParameters.LOCALBKU:
slRequestTemplate = configuration.getStringValue(
@@ -714,7 +714,7 @@ public class PropertyBasedAuthConfigurationProvider extends ConfigurationProvide
MOAIDConfigurationConstants.GENERAL_DEFAULTS_TEMPLATES_HANDY);
break;
default:
- Logger.warn("getSLRequestTemplates: BKU Type does not match: " + IOAAuthParameters.ONLINEBKU + " or " + IOAAuthParameters.HANDYBKU + " or "
+ Logger.warn("getSLRequestTemplates: BKU Type does not match: " + IOAAuthParameters.THIRDBKU + " or " + IOAAuthParameters.HANDYBKU + " or "
+ IOAAuthParameters.LOCALBKU);
}
@@ -736,7 +736,7 @@ public class PropertyBasedAuthConfigurationProvider extends ConfigurationProvide
List<String> bkuurlsList = new ArrayList<String>();
try {
bkuurlsList.add(configuration.getStringValue(
- MOAIDConfigurationConstants.GENERAL_DEFAULTS_BKU_ONLINE));
+ MOAIDConfigurationConstants.GENERAL_DEFAULTS_BKU_THIRD));
bkuurlsList.add(configuration.getStringValue(
MOAIDConfigurationConstants.GENERAL_DEFAULTS_BKU_LOCAL));
bkuurlsList.add(configuration.getStringValue(
@@ -762,9 +762,9 @@ public class PropertyBasedAuthConfigurationProvider extends ConfigurationProvide
String defaultBKUUrl = null;
try {
switch (type) {
- case IOAAuthParameters.ONLINEBKU:
+ case IOAAuthParameters.THIRDBKU:
defaultBKUUrl = configuration.getStringValue(
- MOAIDConfigurationConstants.GENERAL_DEFAULTS_BKU_ONLINE);
+ MOAIDConfigurationConstants.GENERAL_DEFAULTS_BKU_THIRD);
break;
case IOAAuthParameters.LOCALBKU:
defaultBKUUrl = configuration.getStringValue(
@@ -775,7 +775,7 @@ public class PropertyBasedAuthConfigurationProvider extends ConfigurationProvide
MOAIDConfigurationConstants.GENERAL_DEFAULTS_BKU_HANDY);
break;
default:
- Logger.warn("getDefaultBKUURL: BKU Type does not match: " + IOAAuthParameters.ONLINEBKU + " or " + IOAAuthParameters.HANDYBKU + " or "
+ Logger.warn("getDefaultBKUURL: BKU Type does not match: " + IOAAuthParameters.THIRDBKU + " or " + IOAAuthParameters.HANDYBKU + " or "
+ IOAAuthParameters.LOCALBKU);
}
@@ -817,7 +817,7 @@ public class PropertyBasedAuthConfigurationProvider extends ConfigurationProvide
public String getSSOFriendlyName() {
try {
return configuration.getStringValue(
- MOAIDConfigurationConstants.GENERAL_AUTH_SSO_TARGET, "Default MOA-ID friendly name for SSO");
+ MOAIDConfigurationConstants.GENERAL_AUTH_SSO_SERVICENAME, "Default MOA-ID friendly name for SSO");
} catch (at.gv.egiz.components.configuration.api.ConfigurationException e) {
Logger.warn("Single Sign-On FriendlyName can not be read from configuration.", e);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/data/DynamicOAAuthParameters.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/data/DynamicOAAuthParameters.java
index 9fd58b5c7..f3db82315 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/data/DynamicOAAuthParameters.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/data/DynamicOAAuthParameters.java
@@ -32,6 +32,7 @@ import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
import at.gv.egovernment.moa.id.commons.api.data.SAML1ConfigurationParameters;
import at.gv.egovernment.moa.id.commons.api.data.StorkAttribute;
import at.gv.egovernment.moa.id.commons.api.data.StorkAttributeProviderPlugin;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
/**
* @author tlenz
@@ -45,33 +46,84 @@ public class DynamicOAAuthParameters implements IOAAuthParameters, Serializable{
private static final long serialVersionUID = 1648437815185614566L;
private String publicURLPrefix;
-
- private String businessTarget;
-
- private boolean businessService;
-
+
private boolean isInderfederationIDP;
-
private String IDPQueryURL;
- private String target;
-
+ private boolean hasBaseIdProcessingRestriction;
+ private boolean hasBaseIdTransfergRestriction;
+ private String oaTargetAreaIdentifier;
+
+
/* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getTarget()
+ * @see at.gv.egovernment.moa.id.commons.api.IOAAuthParameters#hasBaseIdInternalProcessingRestriction()
*/
@Override
- public String getTarget() {
- return this.target;
+ public boolean hasBaseIdInternalProcessingRestriction() throws ConfigurationException {
+ return this.hasBaseIdProcessingRestriction;
+ }
+
+ /* (non-Javadoc)
+ * @see at.gv.egovernment.moa.id.commons.api.IOAAuthParameters#hasBaseIdTransferRestriction()
+ */
+ @Override
+ public boolean hasBaseIdTransferRestriction() throws ConfigurationException {
+ return this.hasBaseIdTransfergRestriction;
}
/* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getIdentityLinkDomainIdentifier()
+ * @see at.gv.egovernment.moa.id.commons.api.IOAAuthParameters#getAreaSpecificTargetIdentifier()
+ */
+ @Override
+ public String getAreaSpecificTargetIdentifier() throws ConfigurationException {
+ return this.oaTargetAreaIdentifier;
+ }
+
+ /**
+ * @param hasBaseIdProcessingRestriction the hasBaseIdProcessingRestriction to set
+ */
+ public void setHasBaseIdProcessingRestriction(boolean hasBaseIdProcessingRestriction) {
+ this.hasBaseIdProcessingRestriction = hasBaseIdProcessingRestriction;
+ }
+
+ /**
+ * @param hasBaseIdTransfergRestriction the hasBaseIdTransfergRestriction to set
+ */
+ public void setHasBaseIdTransfergRestriction(boolean hasBaseIdTransfergRestriction) {
+ this.hasBaseIdTransfergRestriction = hasBaseIdTransfergRestriction;
+ }
+
+ /**
+ * @param oaTargetAreaIdentifier the oaTargetAreaIdentifier to set
+ */
+ public void setAreaSpecificTargetIdentifier(String oaTargetAreaIdentifier) {
+ this.oaTargetAreaIdentifier = oaTargetAreaIdentifier;
+ }
+
+ /* (non-Javadoc)
+ * @see at.gv.egovernment.moa.id.commons.api.IOAAuthParameters#getAreaSpecificTargetIdentifierFriendlyName()
*/
@Override
- public String getIdentityLinkDomainIdentifier() {
- return this.businessTarget;
+ public String getAreaSpecificTargetIdentifierFriendlyName() throws ConfigurationException {
+ return null;
}
+// /* (non-Javadoc)
+// * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getTarget()
+// */
+// //@Override
+// public String getTarget() {
+// return this.target;
+// }
+//
+// /* (non-Javadoc)
+// * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getIdentityLinkDomainIdentifier()
+// */
+// //@Override
+// public String getIdentityLinkDomainIdentifier() {
+// return this.businessTarget;
+// }
+
/* (non-Javadoc)
* @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getIDPAttributQueryServiceURL()
*/
@@ -164,7 +216,7 @@ public class DynamicOAAuthParameters implements IOAAuthParameters, Serializable{
/* (non-Javadoc)
* @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getIdentityLinkDomainIdentifierType()
*/
- @Override
+ //@Override
public String getIdentityLinkDomainIdentifierType() {
// TODO Auto-generated method stub
return null;
@@ -251,26 +303,26 @@ public class DynamicOAAuthParameters implements IOAAuthParameters, Serializable{
return null;
}
- /**
- * @param isBusinessService the isBusinessService to set
- */
- public void setBusinessService(boolean isBusinessService) {
- businessService = isBusinessService;
- }
-
- /**
- * @param target the target to set
- */
- public void setTarget(String target) {
- this.target = target;
- }
-
- /**
- * @param businessTarget the businessTarget to set
- */
- public void setBusinessTarget(String businessTarget) {
- this.businessTarget = businessTarget;
- }
+// /**
+// * @param isBusinessService the isBusinessService to set
+// */
+// public void setBusinessService(boolean isBusinessService) {
+// businessService = isBusinessService;
+// }
+
+// /**
+// * @param target the target to set
+// */
+// public void setTarget(String target) {
+// this.target = target;
+// }
+//
+// /**
+// * @param businessTarget the businessTarget to set
+// */
+// public void setBusinessTarget(String businessTarget) {
+// this.businessTarget = businessTarget;
+// }
/**
* @param inderfederatedIDP the inderfederatedIDP to set
@@ -400,27 +452,18 @@ public class DynamicOAAuthParameters implements IOAAuthParameters, Serializable{
return this.publicURLPrefix;
}
- /* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getOaType()
- */
- @Override
- public String getOaType() {
- // TODO Auto-generated method stub
- return null;
- }
-
- /* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getBusinessService()
- */
- @Override
- public boolean getBusinessService() {
- return this.businessService;
- }
+// /* (non-Javadoc)
+// * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getBusinessService()
+// */
+// //@Override
+// public boolean getBusinessService() {
+// return this.businessService;
+// }
/* (non-Javadoc)
* @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getTargetFriendlyName()
*/
- @Override
+ //@Override
public String getTargetFriendlyName() {
// TODO Auto-generated method stub
return null;
@@ -487,4 +530,6 @@ public class DynamicOAAuthParameters implements IOAAuthParameters, Serializable{
// TODO Auto-generated method stub
return false;
}
+
+
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java
index f5f056ccc..7f56f519b 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java
@@ -120,7 +120,8 @@ public class AuthenticationData implements IAuthData, Serializable {
* the corresponding <code>lt;saml:Assertion&gt;</code>
*/
- private boolean businessService;
+ private boolean isBaseIDTransferRestrication = true;
+
/**
* STORK attributes from response
@@ -742,13 +743,15 @@ public class AuthenticationData implements IAuthData, Serializable {
* @see at.gv.egovernment.moa.id.data.IAuthData#isBusinessService()
*/
@Override
- public boolean isBusinessService() {
- return this.businessService;
+ public boolean isBaseIDTransferRestrication() {
+ return isBaseIDTransferRestrication;
}
-
- public void setIsBusinessService(boolean flag) {
- this.businessService = flag;
-
+
+ /**
+ * @param isBaseIDTransmittionAllowed the isBaseIDTransmittionAllowed to set
+ */
+ public void setBaseIDTransferRestrication(boolean isBaseIDTransferRestrication) {
+ this.isBaseIDTransferRestrication = isBaseIDTransferRestrication;
}
/**
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/ExceptionContainer.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/ExceptionContainer.java
index 1c6fdcb65..4820b6fdc 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/ExceptionContainer.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/ExceptionContainer.java
@@ -24,6 +24,8 @@ package at.gv.egovernment.moa.id.data;
import java.io.Serializable;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
+
/**
* @author tlenz
*
@@ -34,13 +36,21 @@ public class ExceptionContainer implements Serializable {
private Throwable exceptionThrown = null;
private String uniqueSessionID = null;
private String uniqueTransactionID = null;
+ private String uniqueServiceProviderId = null;
/**
*
*/
- public ExceptionContainer(String uniqueSessionID, String uniqueTransactionID, Throwable exception) {
- this.uniqueSessionID = uniqueSessionID;
- this.uniqueTransactionID = uniqueTransactionID;
+ public ExceptionContainer(IRequest pendingReq, Throwable exception) {
+ if (pendingReq != null) {
+ this.uniqueSessionID = pendingReq.getUniqueSessionIdentifier();
+ this.uniqueTransactionID = pendingReq.getUniqueTransactionIdentifier();
+
+ if (pendingReq.getOnlineApplicationConfiguration() != null)
+ this.uniqueServiceProviderId = pendingReq.getOnlineApplicationConfiguration().getPublicURLPrefix();
+
+ }
+
this.exceptionThrown = exception;
}
@@ -62,6 +72,14 @@ public class ExceptionContainer implements Serializable {
public String getUniqueTransactionID() {
return uniqueTransactionID;
}
+
+ /**
+ * @return the uniqueServiceProviderId
+ */
+ public String getUniqueServiceProviderId() {
+ return uniqueServiceProviderId;
+ }
+
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java
index 4c15cd3d1..e9fef4676 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java
@@ -38,8 +38,8 @@ public interface IAuthData {
Date getIssueInstant();
String getIssuer();
-
- boolean isBusinessService();
+ boolean isBaseIDTransferRestrication();
+
boolean isSsoSession();
//boolean isInterfederatedSSOSession();
boolean isUseMandate();
@@ -90,5 +90,6 @@ public interface IAuthData {
String getCcc();
public <T> T getGenericData(String key, final Class<T> clazz);
+
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java
index ab0a1ec40..aff2c83ad 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java
@@ -23,6 +23,7 @@
package at.gv.egovernment.moa.id.moduls;
import java.io.IOException;
+import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Enumeration;
@@ -47,6 +48,7 @@ import org.springframework.stereotype.Service;
import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
+import at.gv.egovernment.moa.id.advancedlogging.TransactionIDUtils;
import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionExtensions;
import at.gv.egovernment.moa.id.auth.exception.InvalidProtocolRequestException;
@@ -89,6 +91,7 @@ import at.gv.egovernment.moa.util.MiscUtil;
@Service("MOAID_AuthenticationManager")
public class AuthenticationManager extends MOAIDAuthConstants {
+ private static List<String> reqParameterWhiteListeForModules = new ArrayList<String>();
public static final String MOA_SESSION = "MoaAuthenticationSession";
public static final String MOA_AUTHENTICATED = "MoaAuthenticated";
@@ -202,6 +205,14 @@ public class AuthenticationManager extends MOAIDAuthConstants {
public AuthenticationSession doAuthentication(HttpServletRequest httpReq,
HttpServletResponse httpResp, RequestImpl pendingReq) throws MOADatabaseException, ServletException, IOException, MOAIDException {
+ //load OA configuration from pending request
+ IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
+
+ //set logging context and log unique OA identifier to revision log
+ TransactionIDUtils.setServiceProviderId(pendingReq.getOnlineApplicationConfiguration().getPublicURLPrefix());
+ revisionsLogger.logEvent(oaParam,
+ pendingReq, MOAIDEventConstants.AUTHPROCESS_SERVICEPROVIDER, pendingReq.getOAURL());
+
//generic authentication request validation
if (pendingReq.isPassiv()
&& pendingReq.forceAuth()) {
@@ -236,12 +247,8 @@ public class AuthenticationManager extends MOAIDAuthConstants {
boolean isValidSSOSession = ssoManager.isValidSSOSession(ssoId, pendingReq);
// check if Service-Provider allows SSO sessions
- IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
boolean useSSOOA = oaParam.useSSO() || oaParam.isInderfederationIDP();
-
- revisionsLogger.logEvent(oaParam,
- pendingReq, MOAIDEventConstants.AUTHPROCESS_SERVICEPROVIDER, pendingReq.getOAURL());
-
+
//if a legacy request is used SSO should not be allowed in case of mandate authentication
boolean isUseMandateRequested = LegacyHelper.isUseMandateRequested(httpReq);
@@ -304,6 +311,18 @@ public class AuthenticationManager extends MOAIDAuthConstants {
}
/**
+ * Add a request parameter to whitelist. All parameters that are part of the white list are added into {@link ExecutionContext}
+ *
+ * @param httpReqParam http parameter name, but never null
+ */
+ public void addParameterNameToWhiteList(String httpReqParam) {
+ if (MiscUtil.isNotEmpty(httpReqParam))
+ reqParameterWhiteListeForModules.add(httpReqParam);
+
+ }
+
+
+ /**
* Checks if a authenticated MOASession already exists and if {protocolRequest} is authenticated
*
* @param protocolRequest Authentication request which is actually in process
@@ -381,17 +400,25 @@ public class AuthenticationManager extends MOAIDAuthConstants {
executionContext.put(MOAIDAuthConstants.PROCESSCONTEXT_ISLEGACYREQUEST, leagacyMode);
executionContext.put(MOAIDAuthConstants.PROCESSCONTEXT_PERFORM_BKUSELECTION, !leagacyMode
&& MiscUtil.isEmpty(pendingReq.getGenericData(RequestImpl.DATAID_INTERFEDERATIOIDP_URL, String.class)));
+
+ //add X509 SSL client certificate if exist
+ if (httpReq.getAttribute("javax.servlet.request.X509Certificate") != null) {
+ Logger.debug("Find SSL-client-certificate on request --> Add it to context");
+ executionContext.put(MOAIDAuthConstants.PROCESSCONTEXT_SSL_CLIENT_CERTIFICATE,
+ ((X509Certificate[])httpReq.getAttribute("javax.servlet.request.X509Certificate")));
+
+ }
- //add leagcy parameters to context
- if (leagacyMode) {
+ //add additional http request parameter to context
+ if (!reqParameterWhiteListeForModules.isEmpty() || leagacyMode) {
Enumeration<String> reqParamNames = httpReq.getParameterNames();
while(reqParamNames.hasMoreElements()) {
String paramName = reqParamNames.nextElement();
if (MiscUtil.isNotEmpty(paramName) &&
- MOAIDAuthConstants.LEGACYPARAMETERWHITELIST.contains(paramName))
+ ( MOAIDAuthConstants.LEGACYPARAMETERWHITELIST.contains(paramName)
+ || reqParameterWhiteListeForModules.contains(paramName) ))
executionContext.put(paramName,
- StringEscapeUtils.escapeHtml(httpReq.getParameter(paramName)));
-
+ StringEscapeUtils.escapeHtml(httpReq.getParameter(paramName)));
}
}
@@ -615,7 +642,7 @@ public class AuthenticationManager extends MOAIDAuthConstants {
//send SLO response to SLO request issuer
SingleLogoutService sloService = sloBuilder.getResponseSLODescriptor(pvpReq);
LogoutResponse message = sloBuilder.buildSLOResponseMessage(sloService, pvpReq, sloContainer.getSloFailedOAs());
- sloBuilder.sendFrontChannelSLOMessage(sloService, message, httpReq, httpResp, inboundRelayState);
+ sloBuilder.sendFrontChannelSLOMessage(sloService, message, httpReq, httpResp, inboundRelayState, pvpReq);
} else {
//print SLO information directly
@@ -651,7 +678,7 @@ public class AuthenticationManager extends MOAIDAuthConstants {
if (pvpReq != null) {
SingleLogoutService sloService = sloBuilder.getResponseSLODescriptor(pvpReq);
LogoutResponse message = sloBuilder.buildSLOErrorResponse(sloService, pvpReq, StatusCode.RESPONDER_URI);
- sloBuilder.sendFrontChannelSLOMessage(sloService, message, httpReq, httpResp, inboundRelayState);
+ sloBuilder.sendFrontChannelSLOMessage(sloService, message, httpReq, httpResp, inboundRelayState, pvpReq);
revisionsLogger.logEvent(uniqueSessionIdentifier, uniqueTransactionIdentifier, MOAIDEventConstants.AUTHPROCESS_SLO_NOT_ALL_VALID);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestStorage.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestStorage.java
index eec48e0f3..90ccb3c27 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestStorage.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestStorage.java
@@ -52,9 +52,8 @@ public class RequestStorage implements IRequestStorage{
}
//set transactionID and sessionID to Logger
- TransactionIDUtils.setTransactionId(pendingRequest.getUniqueTransactionIdentifier());
- TransactionIDUtils.setSessionId(pendingRequest.getUniqueSessionIdentifier());
-
+ TransactionIDUtils.setAllLoggingVariables(pendingRequest);
+
return pendingRequest;
} catch (MOADatabaseException | NullPointerException e) {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/opemsaml/MOAIDHTTPPostEncoder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/opemsaml/MOAIDHTTPPostEncoder.java
new file mode 100644
index 000000000..b05e60e94
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/opemsaml/MOAIDHTTPPostEncoder.java
@@ -0,0 +1,114 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.opemsaml;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStreamWriter;
+import java.io.Writer;
+
+import org.apache.velocity.VelocityContext;
+import org.apache.velocity.app.VelocityEngine;
+import org.opensaml.common.binding.SAMLMessageContext;
+import org.opensaml.saml2.binding.encoding.HTTPPostEncoder;
+import org.opensaml.ws.message.encoder.MessageEncodingException;
+import org.opensaml.ws.transport.http.HTTPOutTransport;
+import org.opensaml.ws.transport.http.HTTPTransportUtils;
+
+import at.gv.egovernment.moa.id.auth.frontend.builder.GUIFormBuilderImpl;
+import at.gv.egovernment.moa.id.auth.frontend.builder.IGUIBuilderConfiguration;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+public class MOAIDHTTPPostEncoder extends HTTPPostEncoder {
+
+ private VelocityEngine velocityEngine;
+ private IGUIBuilderConfiguration guiConfig;
+ private GUIFormBuilderImpl guiBuilder;
+
+ /**
+ * @param engine
+ * @param templateId
+ */
+ public MOAIDHTTPPostEncoder(IGUIBuilderConfiguration guiConfig, GUIFormBuilderImpl guiBuilder, VelocityEngine engine) {
+ super(engine, null);
+ this.velocityEngine = engine;
+ this.guiConfig = guiConfig;
+ this.guiBuilder = guiBuilder;
+
+ }
+
+ /**
+ * Base64 and POST encodes the outbound message and writes it to the outbound transport.
+ *
+ * @param messageContext current message context
+ * @param endpointURL endpoint URL to which to encode message
+ *
+ * @throws MessageEncodingException thrown if there is a problem encoding the message
+ */
+ protected void postEncode(SAMLMessageContext messageContext, String endpointURL) throws MessageEncodingException {
+ Logger.debug("Invoking Velocity template to create POST body");
+ InputStream is = null;
+ try {
+ //build Velocity Context from GUI input paramters
+ VelocityContext context = guiBuilder.generateVelocityContextFromConfiguration(guiConfig);
+
+ //load template
+ is = guiBuilder.getTemplateInputStream(guiConfig);
+
+ //populate velocity context with SAML2 parameters
+ populateVelocityContext(context, messageContext, endpointURL);
+
+ //populate transport parameter
+ HTTPOutTransport outTransport = (HTTPOutTransport) messageContext.getOutboundMessageTransport();
+ HTTPTransportUtils.addNoCacheHeaders(outTransport);
+ HTTPTransportUtils.setUTF8Encoding(outTransport);
+ HTTPTransportUtils.setContentType(outTransport, "text/html");
+
+ //evaluate template and write content to response
+ Writer out = new OutputStreamWriter(outTransport.getOutgoingStream(), "UTF-8");
+ velocityEngine.evaluate(context, out, "SAML2_POST_BINDING", new BufferedReader(new InputStreamReader(is)));
+ out.flush();
+
+ } catch (Exception e) {
+ Logger.error("Error invoking Velocity template", e);
+ throw new MessageEncodingException("Error creating output document", e);
+
+ } finally {
+ if (is != null) {
+ try {
+ is.close();
+
+ } catch (IOException e) {
+ Logger.error("Can NOT close GUI-Template InputStream.", e);
+ }
+ }
+
+ }
+ }
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/BPKAttributeBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/BPKAttributeBuilder.java
index eff839e4e..c13c5e288 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/BPKAttributeBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/BPKAttributeBuilder.java
@@ -23,7 +23,6 @@
package at.gv.egovernment.moa.id.protocols.builder.attributes;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
import at.gv.egovernment.moa.id.data.IAuthData;
import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.UnavailableAttributeException;
@@ -51,6 +50,9 @@ public class BPKAttributeBuilder implements IPVPAttributeBuilder {
else if (type.startsWith(Constants.URN_PREFIX_CDID))
type = type.substring((Constants.URN_PREFIX_CDID + "+").length());
+ else if (type.startsWith(Constants.URN_PREFIX_EIDAS))
+ type = type.substring((Constants.URN_PREFIX_EIDAS + "+").length());
+
if (bpk.length() > BPK_MAX_LENGTH) {
bpk = bpk.substring(0, BPK_MAX_LENGTH);
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePIN.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePIN.java
index a6a5f1dd4..b4846db12 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePIN.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePIN.java
@@ -38,7 +38,7 @@ public class EIDSourcePIN implements IPVPAttributeBuilder {
public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
IAttributeGenerator<ATT> g) throws AttributeException {
- if (authData.isBusinessService())
+ if (authData.isBaseIDTransferRestrication())
throw new AttributePolicyException(EID_SOURCE_PIN_NAME);
else {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePINType.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePINType.java
index 1d836802a..ccaecb3b6 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePINType.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSourcePINType.java
@@ -23,7 +23,6 @@
package at.gv.egovernment.moa.id.protocols.builder.attributes;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
import at.gv.egovernment.moa.id.data.IAuthData;
import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.UnavailableAttributeException;
@@ -37,7 +36,7 @@ public class EIDSourcePINType implements IPVPAttributeBuilder {
public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
IAttributeGenerator<ATT> g) throws AttributeException {
- if (authData.isBusinessService())
+ if (authData.isBaseIDTransferRestrication())
throw new UnavailableAttributeException(EID_SOURCE_PIN_TYPE_NAME);
else {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateLegalPersonFullNameAttributeBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateLegalPersonFullNameAttributeBuilder.java
index 97043a3a0..f85fd7cae 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateLegalPersonFullNameAttributeBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateLegalPersonFullNameAttributeBuilder.java
@@ -60,7 +60,7 @@ public class MandateLegalPersonFullNameAttributeBuilder implements IPVPAttribute
}
CorporateBodyType corporation = mandateObject.getMandator().getCorporateBody();
if (corporation == null) {
- Logger.error("No corporation mandate");
+ Logger.info("No corporation mandate");
throw new NoMandateDataAttributeException();
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateLegalPersonSourcePinAttributeBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateLegalPersonSourcePinAttributeBuilder.java
index 46472c983..7e0815ab2 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateLegalPersonSourcePinAttributeBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateLegalPersonSourcePinAttributeBuilder.java
@@ -42,41 +42,12 @@ public class MandateLegalPersonSourcePinAttributeBuilder implements IPVPAttribu
public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
IAttributeGenerator<ATT> g) throws AttributeException {
- if(authData.isUseMandate()) {
-
- //get PVP attribute directly, if exists
- String sourcePin = authData.getGenericData(MANDATE_LEG_PER_SOURCE_PIN_NAME, String.class);
-
- if (MiscUtil.isEmpty(sourcePin)) {
- Element mandate = authData.getMandate();
- if(mandate == null) {
- throw new NoMandateDataAttributeException();
-
- }
- Mandate mandateObject = MandateBuilder.buildMandate(mandate);
- if(mandateObject == null) {
- throw new NoMandateDataAttributeException();
-
- }
- CorporateBodyType corporation = mandateObject.getMandator().getCorporateBody();
- if(corporation == null) {
- Logger.error("No corporation mandate");
- throw new NoMandateDataAttributeException();
-
- }
- if(corporation.getIdentification().size() == 0) {
- Logger.error("Failed to generate IdentificationType");
- throw new NoMandateDataAttributeException();
-
- }
-
- sourcePin = corporation.getIdentification().get(0).getValue().getValue();
-
- }
-
+ if(authData.isUseMandate()) {
return g.buildStringAttribute(MANDATE_LEG_PER_SOURCE_PIN_FRIENDLY_NAME,
- MANDATE_LEG_PER_SOURCE_PIN_NAME, sourcePin);
+ MANDATE_LEG_PER_SOURCE_PIN_NAME, getLegalPersonIdentifierFromMandate(authData));
+
}
+
return null;
}
@@ -84,4 +55,39 @@ public class MandateLegalPersonSourcePinAttributeBuilder implements IPVPAttribu
public <ATT> ATT buildEmpty(IAttributeGenerator<ATT> g) {
return g.buildEmptyAttribute(MANDATE_LEG_PER_SOURCE_PIN_FRIENDLY_NAME, MANDATE_LEG_PER_SOURCE_PIN_NAME);
}
+
+
+ protected String getLegalPersonIdentifierFromMandate(IAuthData authData) throws NoMandateDataAttributeException {
+ //get PVP attribute directly, if exists
+ String sourcePin = authData.getGenericData(MANDATE_LEG_PER_SOURCE_PIN_NAME, String.class);
+
+ if (MiscUtil.isEmpty(sourcePin)) {
+ Element mandate = authData.getMandate();
+ if(mandate == null) {
+ throw new NoMandateDataAttributeException();
+
+ }
+ Mandate mandateObject = MandateBuilder.buildMandate(mandate);
+ if(mandateObject == null) {
+ throw new NoMandateDataAttributeException();
+
+ }
+ CorporateBodyType corporation = mandateObject.getMandator().getCorporateBody();
+ if(corporation == null) {
+ Logger.info("No corporation mandate");
+ throw new NoMandateDataAttributeException();
+
+ }
+ if(corporation.getIdentification().size() == 0) {
+ Logger.info("Failed to generate IdentificationType");
+ throw new NoMandateDataAttributeException();
+
+ }
+
+ sourcePin = corporation.getIdentification().get(0).getValue().getValue();
+
+ }
+
+ return sourcePin;
+ }
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateLegalPersonSourcePinTypeAttributeBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateLegalPersonSourcePinTypeAttributeBuilder.java
index 41c35dad3..8b22acc01 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateLegalPersonSourcePinTypeAttributeBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateLegalPersonSourcePinTypeAttributeBuilder.java
@@ -59,12 +59,12 @@ public class MandateLegalPersonSourcePinTypeAttributeBuilder implements IPVPAttr
}
CorporateBodyType corporation = mandateObject.getMandator().getCorporateBody();
if (corporation == null) {
- Logger.error("No corporate mandate");
+ Logger.info("No corporate mandate");
throw new NoMandateDataAttributeException();
}
if (corporation.getIdentification().size() == 0) {
- Logger.error("Failed to generate IdentificationType");
+ Logger.info("Failed to generate IdentificationType");
throw new NoMandateDataAttributeException();
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonBPKAttributeBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonBPKAttributeBuilder.java
index df8f86f7e..15eed3d44 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonBPKAttributeBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonBPKAttributeBuilder.java
@@ -30,9 +30,12 @@ import at.gv.e_government.reference.namespace.persondata._20020228_.PhysicalPers
import at.gv.egovernment.moa.id.auth.builder.BPKBuilder;
import at.gv.egovernment.moa.id.auth.exception.BuildException;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
import at.gv.egovernment.moa.id.data.IAuthData;
+import at.gv.egovernment.moa.id.data.Pair;
import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.NoMandateDataAttributeException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.UnavailableAttributeException;
import at.gv.egovernment.moa.id.util.MandateBuilder;
import at.gv.egovernment.moa.logging.Logger;
import at.gv.egovernment.moa.util.Constants;
@@ -50,6 +53,7 @@ public class MandateNaturalPersonBPKAttributeBuilder implements IPVPAttributeBui
//get PVP attribute directly, if exists
String bpk = authData.getGenericData(MANDATE_NAT_PER_BPK_NAME, String.class);
+ String type = null;
if (MiscUtil.isEmpty(bpk)) {
//read bPK from mandate if it is not directly included
@@ -63,38 +67,53 @@ public class MandateNaturalPersonBPKAttributeBuilder implements IPVPAttributeBui
}
PhysicalPersonType physicalPerson = mandateObject.getMandator().getPhysicalPerson();
if (physicalPerson == null) {
- Logger.error("No physicalPerson mandate");
+ Logger.info("No physicalPerson mandate");
throw new NoMandateDataAttributeException();
}
IdentificationType id = null;
id = physicalPerson.getIdentification().get(0);
if (id == null) {
- Logger.error("Failed to generate IdentificationType");
+ Logger.info("Failed to generate IdentificationType");
throw new NoMandateDataAttributeException();
}
try {
- if (id.getType().equals(Constants.URN_PREFIX_BASEID)) {
- if (oaParam.getBusinessService()) {
- bpk = new BPKBuilder().buildWBPK(id.getValue().getValue(), oaParam.getIdentityLinkDomainIdentifier());
-
- } else {
- bpk = new BPKBuilder().buildBPK(id.getValue().getValue(), oaParam.getTarget());
-
- }
-
+ if (id.getType().equals(Constants.URN_PREFIX_BASEID)) {
+ Pair<String, String> calcResult = new BPKBuilder().generateAreaSpecificPersonIdentifier(id.getValue().getValue(),
+ oaParam.getAreaSpecificTargetIdentifier());
+ bpk = calcResult.getFirst();
+ type = calcResult.getSecond();
+
} else
bpk = id.getValue().getValue();
+ if (MiscUtil.isEmpty(bpk))
+ throw new UnavailableAttributeException(BPK_NAME);
+
+ if (type.startsWith(Constants.URN_PREFIX_WBPK))
+ type = type.substring((Constants.URN_PREFIX_WBPK + "+").length());
+
+ else if (type.startsWith(Constants.URN_PREFIX_CDID))
+ type = type.substring((Constants.URN_PREFIX_CDID + "+").length());
+
+ else if (type.startsWith(Constants.URN_PREFIX_EIDAS))
+ type = type.substring((Constants.URN_PREFIX_EIDAS + "+").length());
+
+ if (bpk.length() > BPK_MAX_LENGTH) {
+ bpk = bpk.substring(0, BPK_MAX_LENGTH);
+ }
+
+
}
- catch (BuildException e) {
+ catch (BuildException | ConfigurationException e) {
Logger.error("Failed to generate IdentificationType");
throw new NoMandateDataAttributeException();
}
}
- return g.buildStringAttribute(MANDATE_NAT_PER_BPK_FRIENDLY_NAME, MANDATE_NAT_PER_BPK_NAME, bpk);
+ Logger.trace("Authenticate user with bPK/wbPK " + bpk + " and Type=" + type);
+ return g.buildStringAttribute(MANDATE_NAT_PER_BPK_FRIENDLY_NAME, MANDATE_NAT_PER_BPK_NAME, type + ":" + bpk);
}
return null;
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonBirthDateAttributeBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonBirthDateAttributeBuilder.java
index a64880889..b9ac891a9 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonBirthDateAttributeBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonBirthDateAttributeBuilder.java
@@ -65,7 +65,7 @@ public class MandateNaturalPersonBirthDateAttributeBuilder implements IPVPAttrib
}
PhysicalPersonType physicalPerson = mandateObject.getMandator().getPhysicalPerson();
if (physicalPerson == null) {
- Logger.error("No physicalPerson mandate");
+ Logger.info("No physicalPerson mandate");
throw new NoMandateDataAttributeException();
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonFamilyNameAttributeBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonFamilyNameAttributeBuilder.java
index 085579108..d29df66e8 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonFamilyNameAttributeBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonFamilyNameAttributeBuilder.java
@@ -62,7 +62,7 @@ public class MandateNaturalPersonFamilyNameAttributeBuilder implements IPVPAttr
}
PhysicalPersonType physicalPerson = mandateObject.getMandator().getPhysicalPerson();
if(physicalPerson == null) {
- Logger.error("No physicalPerson mandate");
+ Logger.info("No physicalPerson mandate");
throw new NoMandateDataAttributeException();
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonGivenNameAttributeBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonGivenNameAttributeBuilder.java
index 4cd2ca670..32efe061e 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonGivenNameAttributeBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonGivenNameAttributeBuilder.java
@@ -59,7 +59,7 @@ public class MandateNaturalPersonGivenNameAttributeBuilder implements IPVPAttrib
}
PhysicalPersonType physicalPerson = mandateObject.getMandator().getPhysicalPerson();
if (physicalPerson == null) {
- Logger.error("No physicalPerson mandate");
+ Logger.info("No physicalPerson mandate");
throw new NoMandateDataAttributeException();
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonSourcePinAttributeBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonSourcePinAttributeBuilder.java
index 69a731e53..6f0a49ce0 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonSourcePinAttributeBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonSourcePinAttributeBuilder.java
@@ -27,10 +27,7 @@ import org.w3c.dom.Element;
import at.gv.e_government.reference.namespace.mandates._20040701_.Mandate;
import at.gv.e_government.reference.namespace.persondata._20020228_.IdentificationType;
import at.gv.e_government.reference.namespace.persondata._20020228_.PhysicalPersonType;
-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.AuthenticationData;
import at.gv.egovernment.moa.id.data.IAuthData;
import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributePolicyException;
@@ -58,18 +55,18 @@ public class MandateNaturalPersonSourcePinAttributeBuilder implements IPVPAttri
PhysicalPersonType physicalPerson = mandateObject.getMandator()
.getPhysicalPerson();
if (physicalPerson == null) {
- Logger.error("No physicalPerson mandate");
+ Logger.info("No physicalPerson mandate");
throw new NoMandateDataAttributeException();
}
IdentificationType id = null;
id = physicalPerson.getIdentification().get(0);
- if(oaParam.getBusinessService()) {
+ if(authData.isBaseIDTransferRestrication()) {
throw new AttributePolicyException(this.getName());
}
if(id == null) {
- Logger.error("Failed to generate IdentificationType");
+ Logger.info("Failed to generate IdentificationType");
throw new NoMandateDataAttributeException();
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonSourcePinTypeAttributeBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonSourcePinTypeAttributeBuilder.java
index 41a821c98..f7d1af33f 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonSourcePinTypeAttributeBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateNaturalPersonSourcePinTypeAttributeBuilder.java
@@ -28,7 +28,6 @@ import at.gv.e_government.reference.namespace.mandates._20040701_.Mandate;
import at.gv.e_government.reference.namespace.persondata._20020228_.IdentificationType;
import at.gv.e_government.reference.namespace.persondata._20020228_.PhysicalPersonType;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
import at.gv.egovernment.moa.id.data.IAuthData;
import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.NoMandateDataAttributeException;
@@ -55,7 +54,7 @@ public class MandateNaturalPersonSourcePinTypeAttributeBuilder implements IPVPAt
PhysicalPersonType physicalPerson = mandateObject.getMandator()
.getPhysicalPerson();
if (physicalPerson == null) {
- Logger.error("No physicalPerson mandate");
+ Logger.info("No physicalPerson mandate");
throw new NoMandateDataAttributeException();
}
IdentificationType id = null;
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java
index 365a31fe1..72691a034 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java
@@ -39,6 +39,7 @@ import org.opensaml.saml2.core.Response;
import org.opensaml.ws.message.encoder.MessageEncodingException;
import org.opensaml.xml.security.SecurityException;
import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationContext;
import org.springframework.stereotype.Service;
import at.gv.egovernment.moa.id.auth.builder.AuthenticationDataBuilder;
@@ -79,6 +80,7 @@ public class AttributQueryAction implements IAction {
@Autowired private IDPCredentialProvider pvpCredentials;
@Autowired private AuthConfiguration authConfig;
@Autowired(required=true) private MOAMetadataProvider metadataProvider;
+ @Autowired(required=true) ApplicationContext springContext;
private final static List<String> DEFAULTSTORKATTRIBUTES = Arrays.asList(
new String[]{PVPConstants.EID_STORK_TOKEN_NAME});
@@ -141,9 +143,9 @@ public class AttributQueryAction implements IAction {
metadataProvider, issuerEntityID, attrQuery, date,
assertion, authConfig.isPVP2AssertionEncryptionActive());
- SoapBinding decoder = new SoapBinding();
+ SoapBinding decoder = springContext.getBean("PVPSOAPBinding", SoapBinding.class);
decoder.encodeRespone(httpReq, httpResp, authResponse, null, null,
- pvpCredentials.getIDPAssertionSigningCredential());
+ pvpCredentials.getIDPAssertionSigningCredential(), pendingReq);
return null;
} catch (MessageEncodingException e) {
@@ -225,9 +227,9 @@ public class AttributQueryAction implements IAction {
}
//check next IDP service area policy. BusinessService IDPs can only request wbPKs
- if (!spConfig.getBusinessService() && !idp.isIDPPublicService()) {
+ if (!spConfig.hasBaseIdTransferRestriction() && !idp.isIDPPublicService()) {
Logger.error("Interfederated IDP " + idp.getPublicURLPrefix()
- + " has a BusinessService-IDP but requests PublicService attributes.");
+ + " is a BusinessService-IDP but requests PublicService attributes.");
throw new MOAIDException("auth.34", new Object[]{nextIDPInformation.getIdpurlprefix()});
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AuthenticationAction.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AuthenticationAction.java
index aac49844e..9d60ae4b2 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AuthenticationAction.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AuthenticationAction.java
@@ -35,6 +35,7 @@ import org.opensaml.saml2.metadata.EntityDescriptor;
import org.opensaml.ws.message.encoder.MessageEncodingException;
import org.opensaml.xml.security.SecurityException;
import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationContext;
import org.springframework.stereotype.Service;
import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
@@ -62,6 +63,7 @@ public class AuthenticationAction implements IAction {
@Autowired IDPCredentialProvider pvpCredentials;
@Autowired AuthConfiguration authConfig;
@Autowired(required=true) private MOAMetadataProvider metadataProvider;
+ @Autowired(required=true) ApplicationContext springContext;
public SLOInformationInterface processRequest(IRequest req, HttpServletRequest httpReq,
HttpServletResponse httpResp, IAuthData authData) throws MOAIDException {
@@ -102,11 +104,11 @@ public class AuthenticationAction implements IAction {
if (consumerService.getBinding().equals(
SAMLConstants.SAML2_REDIRECT_BINDING_URI)) {
- binding = new RedirectBinding();
+ binding = springContext.getBean("PVPRedirectBinding", RedirectBinding.class);
} else if (consumerService.getBinding().equals(
SAMLConstants.SAML2_POST_BINDING_URI)) {
- binding = new PostBinding();
+ binding = springContext.getBean("PVPPOSTBinding", PostBinding.class);
}
@@ -117,7 +119,7 @@ public class AuthenticationAction implements IAction {
try {
binding.encodeRespone(httpReq, httpResp, authResponse,
consumerService.getLocation(), moaRequest.getRelayState(),
- pvpCredentials.getIDPAssertionSigningCredential());
+ pvpCredentials.getIDPAssertionSigningCredential(), req);
//set protocol type
sloInformation.setProtocolType(req.requestedModule());
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java
index a7a249eed..216d7a8b1 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java
@@ -444,13 +444,13 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController {
IEncoder encoder = null;
if(pvpRequest.getBinding().equals(SAMLConstants.SAML2_REDIRECT_BINDING_URI)) {
- encoder = new RedirectBinding();
+ encoder = applicationContext.getBean("PVPRedirectBinding", RedirectBinding.class);
} else if(pvpRequest.getBinding().equals(SAMLConstants.SAML2_POST_BINDING_URI)) {
- encoder = new PostBinding();
+ encoder = applicationContext.getBean("PVPPOSTBinding", PostBinding.class);
} else if (pvpRequest.getBinding().equals(SAMLConstants.SAML2_SOAP11_BINDING_URI)) {
- encoder = new SoapBinding();
+ encoder = applicationContext.getBean("PVPSOAPBinding", SoapBinding.class);
}
if(encoder == null) {
@@ -465,7 +465,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController {
X509Credential signCred = pvpCredentials.getIDPAssertionSigningCredential();
encoder.encodeRespone(request, response, samlResponse, pvpRequest.getConsumerURL(),
- relayState, signCred);
+ relayState, signCred, protocolRequest);
return true;
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/SingleLogOutAction.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/SingleLogOutAction.java
index ff703d585..f709da213 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/SingleLogOutAction.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/SingleLogOutAction.java
@@ -111,7 +111,7 @@ public class SingleLogOutAction implements IAction {
//LogoutResponse message = sloBuilder.buildSLOErrorResponse(sloService, pvpReq, StatusCode.RESPONDER_URI);
LogoutResponse message = sloBuilder.buildSLOResponseMessage(sloService, pvpReq, null);
Logger.info("Sending SLO success message to requester ...");
- sloBuilder.sendFrontChannelSLOMessage(sloService, message, httpReq, httpResp, samlReq.getRelayState());
+ sloBuilder.sendFrontChannelSLOMessage(sloService, message, httpReq, httpResp, samlReq.getRelayState(), pvpReq);
return null;
} else {
@@ -127,7 +127,7 @@ public class SingleLogOutAction implements IAction {
//LogoutResponse message = sloBuilder.buildSLOErrorResponse(sloService, pvpReq, StatusCode.RESPONDER_URI);
LogoutResponse message = sloBuilder.buildSLOResponseMessage(sloService, pvpReq, null);
Logger.info("Sending SLO success message to requester ...");
- sloBuilder.sendFrontChannelSLOMessage(sloService, message, httpReq, httpResp, samlReq.getRelayState());
+ sloBuilder.sendFrontChannelSLOMessage(sloService, message, httpReq, httpResp, samlReq.getRelayState(), pvpReq);
return null;
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/IEncoder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/IEncoder.java
index 3b2fb3687..ccbef6e6c 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/IEncoder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/IEncoder.java
@@ -31,6 +31,7 @@ import org.opensaml.ws.message.encoder.MessageEncodingException;
import org.opensaml.xml.security.SecurityException;
import org.opensaml.xml.security.credential.Credential;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.PVP2Exception;
public interface IEncoder {
@@ -43,12 +44,13 @@ public interface IEncoder {
* @param targetLocation URL, where the request should be transmit
* @param relayState token for session handling
* @param credentials Credential to sign the request object
+ * @param pendingReq Internal MOA-ID request object that contains session-state informations but never null
* @throws MessageEncodingException
* @throws SecurityException
* @throws PVP2Exception
*/
public void encodeRequest(HttpServletRequest req,
- HttpServletResponse resp, RequestAbstractType request, String targetLocation, String relayState, Credential credentials)
+ HttpServletResponse resp, RequestAbstractType request, String targetLocation, String relayState, Credential credentials, IRequest pendingReq)
throws MessageEncodingException, SecurityException, PVP2Exception;
/**
@@ -59,10 +61,11 @@ public interface IEncoder {
* @param targetLocation URL, where the request should be transmit
* @param relayState token for session handling
* @param credentials Credential to sign the response object
+ * @param pendingReq Internal MOA-ID request object that contains session-state informations but never null
* @throws MessageEncodingException
* @throws SecurityException
*/
public void encodeRespone(HttpServletRequest req,
- HttpServletResponse resp, StatusResponseType response, String targetLocation, String relayState, Credential credentials)
+ HttpServletResponse resp, StatusResponseType response, String targetLocation, String relayState, Credential credentials, IRequest pendingReq)
throws MessageEncodingException, SecurityException, PVP2Exception;
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/PostBinding.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/PostBinding.java
index 9977e607b..c7688c14b 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/PostBinding.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/PostBinding.java
@@ -25,13 +25,11 @@ package at.gv.egovernment.moa.id.protocols.pvp2x.binding;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-import org.apache.velocity.app.VelocityEngine;
import org.opensaml.common.SAMLObject;
import org.opensaml.common.binding.BasicSAMLMessageContext;
import org.opensaml.common.binding.decoding.URIComparator;
import org.opensaml.common.xml.SAMLConstants;
import org.opensaml.saml2.binding.decoding.HTTPPostDecoder;
-import org.opensaml.saml2.binding.encoding.HTTPPostEncoder;
import org.opensaml.saml2.core.RequestAbstractType;
import org.opensaml.saml2.core.StatusResponseType;
import org.opensaml.saml2.metadata.IDPSSODescriptor;
@@ -49,8 +47,17 @@ import org.opensaml.ws.transport.http.HttpServletResponseAdapter;
import org.opensaml.xml.parse.BasicParserPool;
import org.opensaml.xml.security.SecurityException;
import org.opensaml.xml.security.credential.Credential;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+import at.gv.egovernment.moa.id.auth.frontend.builder.GUIFormBuilderImpl;
+import at.gv.egovernment.moa.id.auth.frontend.builder.IGUIBuilderConfiguration;
+import at.gv.egovernment.moa.id.auth.frontend.builder.SPSpecificGUIBuilderConfigurationWithFileSystemLoad;
import at.gv.egovernment.moa.id.auth.frontend.velocity.VelocityProvider;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.config.MOAIDConfigurationConstants;
+import at.gv.egovernment.moa.id.opemsaml.MOAIDHTTPPostEncoder;
import at.gv.egovernment.moa.id.protocols.pvp2x.PVP2XProtocol;
import at.gv.egovernment.moa.id.protocols.pvp2x.config.MOADefaultBootstrap;
import at.gv.egovernment.moa.id.protocols.pvp2x.messages.InboundMessage;
@@ -62,10 +69,14 @@ import at.gv.egovernment.moa.id.protocols.pvp2x.verification.TrustEngineFactory;
import at.gv.egovernment.moa.logging.Logger;
import at.gv.egovernment.moa.util.MiscUtil;
+@Service("PVPPOSTBinding")
public class PostBinding implements IDecoder, IEncoder {
+
+ @Autowired(required=true) AuthConfiguration authConfig;
+ @Autowired(required=true) GUIFormBuilderImpl guiBuilder;
public void encodeRequest(HttpServletRequest req, HttpServletResponse resp,
- RequestAbstractType request, String targetLocation, String relayState, Credential credentials)
+ RequestAbstractType request, String targetLocation, String relayState, Credential credentials, IRequest pendingReq)
throws MessageEncodingException, SecurityException {
try {
@@ -75,9 +86,18 @@ public class PostBinding implements IDecoder, IEncoder {
//load default PVP security configurations
MOADefaultBootstrap.initializeDefaultPVPConfiguration();
- VelocityEngine engine = VelocityProvider.getClassPathVelocityEngine();
- HTTPPostEncoder encoder = new HTTPPostEncoder(engine,
- "resources/templates/pvp_postbinding_template.html");
+ //initialize POST binding encoder with template decoration
+ IGUIBuilderConfiguration guiConfig =
+ new SPSpecificGUIBuilderConfigurationWithFileSystemLoad(
+ pendingReq,
+ "pvp_postbinding_template.html",
+ MOAIDConfigurationConstants.SERVICE_AUTH_TEMPLATES_SAML2POSTBINDING_URL,
+ null,
+ authConfig.getRootConfigFileDir());
+ MOAIDHTTPPostEncoder encoder = new MOAIDHTTPPostEncoder(guiConfig, guiBuilder,
+ VelocityProvider.getClassPathVelocityEngine());
+
+ //set OpenSAML2 process parameter into binding context dao
HttpServletResponseAdapter responseAdapter = new HttpServletResponseAdapter(
resp, true);
BasicSAMLMessageContext<SAMLObject, SAMLObject, SAMLObject> context = new BasicSAMLMessageContext<SAMLObject, SAMLObject, SAMLObject>();
@@ -103,22 +123,27 @@ public class PostBinding implements IDecoder, IEncoder {
}
public void encodeRespone(HttpServletRequest req, HttpServletResponse resp,
- StatusResponseType response, String targetLocation, String relayState, Credential credentials)
+ StatusResponseType response, String targetLocation, String relayState, Credential credentials, IRequest pendingReq)
throws MessageEncodingException, SecurityException {
try {
-// X509Credential credentials = credentialProvider
-// .getIDPAssertionSigningCredential();
-
//load default PVP security configurations
MOADefaultBootstrap.initializeDefaultPVPConfiguration();
Logger.debug("create SAML POSTBinding response");
- VelocityEngine engine = VelocityProvider.getClassPathVelocityEngine();
-
- HTTPPostEncoder encoder = new HTTPPostEncoder(engine,
- "resources/templates/pvp_postbinding_template.html");
+ //initialize POST binding encoder with template decoration
+ IGUIBuilderConfiguration guiConfig =
+ new SPSpecificGUIBuilderConfigurationWithFileSystemLoad(
+ pendingReq,
+ "pvp_postbinding_template.html",
+ MOAIDConfigurationConstants.SERVICE_AUTH_TEMPLATES_SAML2POSTBINDING_URL,
+ null,
+ authConfig.getRootConfigFileDir());
+ MOAIDHTTPPostEncoder encoder = new MOAIDHTTPPostEncoder(guiConfig, guiBuilder,
+ VelocityProvider.getClassPathVelocityEngine());
+
+ //set OpenSAML2 process parameter into binding context dao
HttpServletResponseAdapter responseAdapter = new HttpServletResponseAdapter(
resp, true);
BasicSAMLMessageContext<SAMLObject, SAMLObject, SAMLObject> context = new BasicSAMLMessageContext<SAMLObject, SAMLObject, SAMLObject>();
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/RedirectBinding.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/RedirectBinding.java
index 279038967..95c4f1726 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/RedirectBinding.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/RedirectBinding.java
@@ -31,7 +31,6 @@ import org.opensaml.common.binding.decoding.URIComparator;
import org.opensaml.common.xml.SAMLConstants;
import org.opensaml.saml2.binding.decoding.HTTPRedirectDeflateDecoder;
import org.opensaml.saml2.binding.encoding.HTTPRedirectDeflateEncoder;
-import org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule;
import org.opensaml.saml2.binding.security.SAML2HTTPRedirectDeflateSignatureRule;
import org.opensaml.saml2.core.RequestAbstractType;
import org.opensaml.saml2.core.StatusResponseType;
@@ -50,7 +49,9 @@ import org.opensaml.ws.transport.http.HttpServletResponseAdapter;
import org.opensaml.xml.parse.BasicParserPool;
import org.opensaml.xml.security.SecurityException;
import org.opensaml.xml.security.credential.Credential;
+import org.springframework.stereotype.Service;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
import at.gv.egovernment.moa.id.protocols.pvp2x.PVP2XProtocol;
import at.gv.egovernment.moa.id.protocols.pvp2x.config.MOADefaultBootstrap;
import at.gv.egovernment.moa.id.protocols.pvp2x.messages.InboundMessage;
@@ -58,14 +59,16 @@ import at.gv.egovernment.moa.id.protocols.pvp2x.messages.InboundMessageInterface
import at.gv.egovernment.moa.id.protocols.pvp2x.messages.MOARequest;
import at.gv.egovernment.moa.id.protocols.pvp2x.messages.MOAResponse;
import at.gv.egovernment.moa.id.protocols.pvp2x.metadata.IMOARefreshableMetadataProvider;
+import at.gv.egovernment.moa.id.protocols.pvp2x.validation.MOASAML2AuthRequestSignedRole;
import at.gv.egovernment.moa.id.protocols.pvp2x.verification.TrustEngineFactory;
import at.gv.egovernment.moa.logging.Logger;
import at.gv.egovernment.moa.util.MiscUtil;
+@Service("PVPRedirectBinding")
public class RedirectBinding implements IDecoder, IEncoder {
public void encodeRequest(HttpServletRequest req, HttpServletResponse resp,
- RequestAbstractType request, String targetLocation, String relayState, Credential credentials)
+ RequestAbstractType request, String targetLocation, String relayState, Credential credentials, IRequest pendingReq)
throws MessageEncodingException, SecurityException {
// try {
@@ -100,7 +103,7 @@ public class RedirectBinding implements IDecoder, IEncoder {
public void encodeRespone(HttpServletRequest req, HttpServletResponse resp,
StatusResponseType response, String targetLocation, String relayState,
- Credential credentials) throws MessageEncodingException, SecurityException {
+ Credential credentials, IRequest pendingReq) throws MessageEncodingException, SecurityException {
// try {
// X509Credential credentials = credentialProvider
// .getIDPAssertionSigningCredential();
@@ -156,10 +159,10 @@ public class RedirectBinding implements IDecoder, IEncoder {
SAML2HTTPRedirectDeflateSignatureRule signatureRule = new SAML2HTTPRedirectDeflateSignatureRule(
TrustEngineFactory.getSignatureKnownKeysTrustEngine(metadataProvider));
- SAML2AuthnRequestsSignedRule signedRole = new SAML2AuthnRequestsSignedRule();
+ MOASAML2AuthRequestSignedRole signedRole = new MOASAML2AuthRequestSignedRole();
BasicSecurityPolicy policy = new BasicSecurityPolicy();
- policy.getPolicyRules().add(signatureRule);
- policy.getPolicyRules().add(signedRole);
+ policy.getPolicyRules().add(signedRole);
+ policy.getPolicyRules().add(signatureRule);
SecurityPolicyResolver resolver = new StaticSecurityPolicyResolver(
policy);
messageContext.setSecurityPolicyResolver(resolver);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java
index 94d91694a..552b64ac6 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java
@@ -48,7 +48,9 @@ import org.opensaml.xml.security.SecurityException;
import org.opensaml.xml.security.credential.Credential;
import org.opensaml.xml.signature.SignableXMLObject;
import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
import at.gv.egovernment.moa.id.protocols.pvp2x.PVP2XProtocol;
import at.gv.egovernment.moa.id.protocols.pvp2x.config.MOADefaultBootstrap;
import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.AttributQueryException;
@@ -60,6 +62,7 @@ import at.gv.egovernment.moa.id.protocols.pvp2x.signer.IDPCredentialProvider;
import at.gv.egovernment.moa.logging.Logger;
import at.gv.egovernment.moa.util.MiscUtil;
+@Service("PVPSOAPBinding")
public class SoapBinding implements IDecoder, IEncoder {
@Autowired(required=true) private MOAMetadataProvider metadataProvider;
@@ -136,13 +139,13 @@ public class SoapBinding implements IDecoder, IEncoder {
}
public void encodeRequest(HttpServletRequest req, HttpServletResponse resp,
- RequestAbstractType request, String targetLocation, String relayState, Credential credentials)
+ RequestAbstractType request, String targetLocation, String relayState, Credential credentials, IRequest pendingReq)
throws MessageEncodingException, SecurityException, PVP2Exception {
}
public void encodeRespone(HttpServletRequest req, HttpServletResponse resp,
- StatusResponseType response, String targetLocation, String relayState, Credential credentials)
+ StatusResponseType response, String targetLocation, String relayState, Credential credentials, IRequest pendingReq)
throws MessageEncodingException, SecurityException, PVP2Exception {
// try {
// Credential credentials = credentialProvider
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/AttributQueryBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/AttributQueryBuilder.java
index 2df72637d..4aa4f7419 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/AttributQueryBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/AttributQueryBuilder.java
@@ -59,7 +59,6 @@ import at.gv.egovernment.moa.id.protocols.pvp2x.signer.CredentialsNotAvailableEx
import at.gv.egovernment.moa.id.protocols.pvp2x.signer.IDPCredentialProvider;
import at.gv.egovernment.moa.id.protocols.pvp2x.utils.SAML2Utils;
import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.Constants;
/**
* @author tlenz
@@ -70,7 +69,7 @@ public class AttributQueryBuilder {
@Autowired IDPCredentialProvider credentialProvider;
- public List<Attribute> buildSAML2AttributeList(IOAAuthParameters oa, Iterator<String> iterator) {
+ public List<Attribute> buildSAML2AttributeList(IOAAuthParameters oa, Iterator<String> iterator) throws ConfigurationException {
Logger.debug("Build OA specific Attributes for AttributQuery request");
@@ -87,17 +86,13 @@ public class AttributQueryBuilder {
} else {
//add OA specific information
if (rA.equals(PVPConstants.EID_SECTOR_FOR_IDENTIFIER_NAME)) {
- if (oa.getBusinessService())
- attr = generator.buildStringAttribute(attr.getFriendlyName(),
- attr.getName(), oa.getIdentityLinkDomainIdentifier());
- else
- attr = generator.buildStringAttribute(attr.getFriendlyName(),
- attr.getName(), Constants.URN_PREFIX_CDID + "+" + oa.getTarget());
+ attr = generator.buildStringAttribute(attr.getFriendlyName(),
+ attr.getName(), oa.getAreaSpecificTargetIdentifier());
+
}
//TODO: add attribute values for SSO with mandates (ProfileList)
-
-
+
attrList.add(attr);
}
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/PVPAuthnRequestBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/PVPAuthnRequestBuilder.java
index 01ef4a43d..f29418853 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/PVPAuthnRequestBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/PVPAuthnRequestBuilder.java
@@ -44,6 +44,8 @@ import org.opensaml.saml2.metadata.EntityDescriptor;
import org.opensaml.saml2.metadata.SingleSignOnService;
import org.opensaml.ws.message.encoder.MessageEncodingException;
import org.opensaml.xml.security.SecurityException;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationContext;
import org.springframework.stereotype.Service;
import at.gv.egovernment.moa.id.commons.api.IRequest;
@@ -64,6 +66,7 @@ import at.gv.egovernment.moa.util.MiscUtil;
@Service("PVPAuthnRequestBuilder")
public class PVPAuthnRequestBuilder {
+ @Autowired(required=true) ApplicationContext springContext;
/**
* Build a PVP2.x specific authentication request
@@ -202,17 +205,17 @@ public class PVPAuthnRequestBuilder {
IEncoder binding = null;
if (endpoint.getBinding().equals(
SAMLConstants.SAML2_REDIRECT_BINDING_URI)) {
- binding = new RedirectBinding();
+ binding = springContext.getBean("PVPRedirectBinding", RedirectBinding.class);
} else if (endpoint.getBinding().equals(
SAMLConstants.SAML2_POST_BINDING_URI)) {
- binding = new PostBinding();
+ binding = springContext.getBean("PVPPOSTBinding", PostBinding.class);
}
//encode message
binding.encodeRequest(null, httpResp, authReq,
- endpoint.getLocation(), pendingReq.getRequestID(), config.getAuthnRequestSigningCredential());
+ endpoint.getLocation(), pendingReq.getRequestID(), config.getAuthnRequestSigningCredential(), pendingReq);
}
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/SingleLogOutBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/SingleLogOutBuilder.java
index de59e6055..4fef52aec 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/SingleLogOutBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/SingleLogOutBuilder.java
@@ -59,6 +59,7 @@ import org.opensaml.xml.signature.Signature;
import org.opensaml.xml.signature.SignatureConstants;
import org.opensaml.xml.signature.Signer;
import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationContext;
import org.springframework.stereotype.Service;
import org.w3c.dom.Document;
@@ -95,7 +96,9 @@ import at.gv.egovernment.moa.logging.Logger;
public class SingleLogOutBuilder {
@Autowired(required=true) private MOAMetadataProvider metadataProvider;
+ @Autowired(required=true) ApplicationContext springContext;
@Autowired private IDPCredentialProvider credentialProvider;
+
public void checkStatusCode(ISLOInformationContainer sloContainer, LogoutResponse logOutResp) {
Status status = logOutResp.getStatus();
@@ -185,15 +188,15 @@ public class SingleLogOutBuilder {
public void sendFrontChannelSLOMessage(SingleLogoutService consumerService,
LogoutResponse sloResp, HttpServletRequest req, HttpServletResponse resp,
- String relayState) throws MOAIDException {
+ String relayState, PVPTargetConfiguration pvpReq) throws MOAIDException {
IEncoder binding = null;
if (consumerService.getBinding().equals(
SAMLConstants.SAML2_REDIRECT_BINDING_URI)) {
- binding = new RedirectBinding();
+ binding = springContext.getBean("PVPRedirectBinding", RedirectBinding.class);
} else if (consumerService.getBinding().equals(
SAMLConstants.SAML2_POST_BINDING_URI)) {
- binding = new PostBinding();
+ binding = springContext.getBean("PVPPOSTBinding", PostBinding.class);
}
@@ -204,7 +207,7 @@ public class SingleLogOutBuilder {
try {
binding.encodeRespone(req, resp, sloResp,
consumerService.getLocation(), relayState,
- credentialProvider.getIDPAssertionSigningCredential());
+ credentialProvider.getIDPAssertionSigningCredential(), pvpReq);
} catch (MessageEncodingException e) {
Logger.error("Message Encoding exception", e);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java
index 55d8fa1ff..45539da3f 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java
@@ -60,11 +60,11 @@ import at.gv.e_government.reference.namespace.persondata._20020228_.CorporateBod
import at.gv.e_government.reference.namespace.persondata._20020228_.IdentificationType;
import at.gv.e_government.reference.namespace.persondata._20020228_.PhysicalPersonType;
import at.gv.egovernment.moa.id.auth.builder.BPKBuilder;
-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
import at.gv.egovernment.moa.id.data.IAuthData;
+import at.gv.egovernment.moa.id.data.Pair;
import at.gv.egovernment.moa.id.data.SLOInformationImpl;
import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
import at.gv.egovernment.moa.id.protocols.pvp2x.PVPTargetConfiguration;
@@ -338,20 +338,8 @@ public class PVP2AssertionBuilder implements PVPConstants {
}
//set bPK-Type from configuration, because it MUST be equal to service-provider type
- if (oaParam.getBusinessService()) {
- if (oaParam.getIdentityLinkDomainIdentifier().startsWith(AuthenticationSession.REGISTERANDORDNR_PREFIX_))
- bpktype = oaParam.getIdentityLinkDomainIdentifier();
- else
- bpktype = Constants.URN_PREFIX_WBPK + "+" + oaParam.getIdentityLinkDomainIdentifier();
-
- } else {
- if (oaParam.getTarget().startsWith(Constants.URN_PREFIX_CDID + "+"))
- bpktype = oaParam.getTarget();
- else
- bpktype = Constants.URN_PREFIX_CDID + "+" + oaParam.getTarget();
-
- }
-
+ bpktype = oaParam.getAreaSpecificTargetIdentifier();
+
} else {
//sourcePin is include --> check sourcePinType
if (MiscUtil.isEmpty(bpktype))
@@ -365,21 +353,10 @@ public class PVP2AssertionBuilder implements PVPConstants {
}
- if (bpktype.equals(Constants.URN_PREFIX_BASEID)) {
- if (oaParam.getBusinessService()) {
- subjectNameID.setValue(new BPKBuilder().buildWBPK(bpk, oaParam.getIdentityLinkDomainIdentifier()));
- if (oaParam.getIdentityLinkDomainIdentifier().startsWith(AuthenticationSession.REGISTERANDORDNR_PREFIX_))
- subjectNameID.setNameQualifier(oaParam.getIdentityLinkDomainIdentifier());
- else
- subjectNameID.setNameQualifier(Constants.URN_PREFIX_WBPK + "+" + oaParam.getIdentityLinkDomainIdentifier());
-
- } else {
- subjectNameID.setValue(new BPKBuilder().buildBPK(bpk, oaParam.getTarget()));
- if (oaParam.getTarget().startsWith(Constants.URN_PREFIX_CDID + "+"))
- subjectNameID.setNameQualifier(oaParam.getTarget());
- else
- subjectNameID.setNameQualifier(Constants.URN_PREFIX_CDID + "+" + oaParam.getTarget());
- }
+ if (bpktype.equals(Constants.URN_PREFIX_BASEID)) {
+ Pair<String, String> calcbPK = new BPKBuilder().generateAreaSpecificPersonIdentifier(bpk, oaParam.getAreaSpecificTargetIdentifier());
+ subjectNameID.setValue(calcbPK.getFirst());
+ subjectNameID.setNameQualifier(calcbPK.getSecond());
} else {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
index 5380d7f53..ab355646c 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
@@ -217,6 +217,9 @@ public class MOAMetadataProvider extends SimpleMOAMetadataProvider
Logger.warn("Refresh PVP2X metadata for onlineApplication: "
+ entityID + " FAILED.", e);
+ } catch (ConfigurationException e) {
+ Logger.warn("Refresh PVP2X metadata for onlineApplication: "
+ + entityID + " FAILED.", e);
}
return false;
@@ -484,13 +487,13 @@ public class MOAMetadataProvider extends SimpleMOAMetadataProvider
}
- private PVPMetadataFilterChain buildMetadataFilterChain(IOAAuthParameters oaParam, String metadataURL, byte[] certificate) throws CertificateException {
+ private PVPMetadataFilterChain buildMetadataFilterChain(IOAAuthParameters oaParam, String metadataURL, byte[] certificate) throws CertificateException, ConfigurationException {
PVPMetadataFilterChain filterChain = new PVPMetadataFilterChain(metadataURL, certificate);
filterChain.getFilters().add(new SchemaValidationFilter());
if (oaParam.isInderfederationIDP()) {
Logger.info("Online-Application is an interfederated IDP. Add addional Metadata policies");
- filterChain.getFilters().add(new InterfederatedIDPPublicServiceFilter(metadataURL, oaParam.getBusinessService()));
+ filterChain.getFilters().add(new InterfederatedIDPPublicServiceFilter(metadataURL, oaParam.hasBaseIdTransferRestriction()));
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/validation/MOASAML2AuthRequestSignedRole.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/validation/MOASAML2AuthRequestSignedRole.java
new file mode 100644
index 000000000..efcf21b50
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/validation/MOASAML2AuthRequestSignedRole.java
@@ -0,0 +1,49 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.protocols.pvp2x.validation;
+
+import org.opensaml.common.binding.SAMLMessageContext;
+import org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule;
+import org.opensaml.ws.transport.http.HTTPInTransport;
+import org.opensaml.xml.util.DatatypeHelper;
+
+/**
+ * @author tlenz
+ *
+ */
+public class MOASAML2AuthRequestSignedRole extends SAML2AuthnRequestsSignedRule {
+
+ @Override
+ protected boolean isMessageSigned(SAMLMessageContext messageContext) {
+ // This handles HTTP-Redirect and HTTP-POST-SimpleSign bindings.
+ HTTPInTransport inTransport = (HTTPInTransport) messageContext.getInboundMessageTransport();
+ String sigParam = inTransport.getParameterValue("Signature");
+ boolean isSigned = !DatatypeHelper.isEmpty(sigParam);
+
+ String sigAlgParam = inTransport.getParameterValue("SigAlg");
+ boolean isSigAlgExists = !DatatypeHelper.isEmpty(sigAlgParam);
+
+ return isSigned && isSigAlgExists;
+
+ }
+}
diff --git a/id/server/idserverlib/src/main/resources/resources/properties/id_messages_de.properties b/id/server/idserverlib/src/main/resources/resources/properties/id_messages_de.properties
index 50b2c5ece..05f58d5bc 100644
--- a/id/server/idserverlib/src/main/resources/resources/properties/id_messages_de.properties
+++ b/id/server/idserverlib/src/main/resources/resources/properties/id_messages_de.properties
@@ -88,6 +88,8 @@ config.24=MOA-ID-Auth Configfile {1} does not start with {0} prefix.
config.25=Der verwendete IDP PublicURLPrefix {0} ist nicht erlaubt.
config.26=Federated IDP {0} contains no AttributeQuery URL.
config.27=Fehler beim Verarbeiten eines Konfigurationsparameters. Msg:{0}
+config.28=Fehler beim initialisieren des SSL-TrustManagers. Zertifikat {0} kann nicht geladen werden; Ursache: {1}
+config.29=Fehler beim initialisieren des SSL-TrustManagers. TrustStore: {0} | Ursache: {1}
parser.00=Leichter Fehler beim Parsen: {0}
parser.01=Fehler beim Parsen: {0}
@@ -273,6 +275,7 @@ eIDAS.13=Generation of eIDAS Response FAILED. Reason:{0}
eIDAS.14=eIDAS Response validation FAILED: LevelOfAssurance {0} is to low.
eIDAS.15=Generation of eIDAS Response FAILED. Required attribute: {0} is NOT available.
eIDAS.16=eIDAS Response attribute-validation FAILED. Attribute:{0} Reason: {1}.
+eIDAS.17=Generation of eIDAS Response FAILED. Citzen use mandates for authentication but there are no mandate attributes requested
pvp2.01=Fehler beim kodieren der PVP2 Antwort
pvp2.02=Ungueltiges Datumsformat
diff --git a/id/server/idserverlib/src/main/resources/resources/properties/protocol_response_statuscodes_de.properties b/id/server/idserverlib/src/main/resources/resources/properties/protocol_response_statuscodes_de.properties
index c6d0844ce..0a37fdc91 100644
--- a/id/server/idserverlib/src/main/resources/resources/properties/protocol_response_statuscodes_de.properties
+++ b/id/server/idserverlib/src/main/resources/resources/properties/protocol_response_statuscodes_de.properties
@@ -230,6 +230,7 @@ eIDAS.13=1307
eIDAS.14=1301
eIDAS.15=1307
eIDAS.16=1301
+eIDAS.17=1307
pvp2.01=6100
pvp2.06=6100
diff --git a/id/server/idserverlib/src/main/resources/resources/templates/ParepMinTemplate.html b/id/server/idserverlib/src/main/resources/resources/templates/ParepMinTemplate.html
deleted file mode 100644
index f5bca7f1f..000000000
--- a/id/server/idserverlib/src/main/resources/resources/templates/ParepMinTemplate.html
+++ /dev/null
@@ -1,193 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
-<html>
-<head>
-<BASE href="<BASE_href>">
- <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
- <title>Berufsm&auml;&szlig;ige Parteieinvertretung</title>
-</head>
-<body>
- Berufsm&auml;&szlig;ige Parteienvertretung einer
- nat&uuml;rlichen/juristischen Person
- <form name="ProcessInputForm" method="post" accept-charset="UTF-8"
- enctype="application/x-www-form-urlencoded" action="<BKU>">
- <table width="80%" border="0">
- <tr />
- <tr />
- <tr>
- <td colspan="3"><em>Vertreter:</em></td>
- </tr>
- <tr>
- <td align="right" width="20%">Vorname&nbsp;<img
- title=" Dieses Feld muss ausgef&uuml;llt sein!" alt="Stern"
- src="img/stern.gif" width="10" height="16" /></td>
- <td><input name="rpgivenname_" type="text" disabled="true"
- id="rpgivenname" value="<rpgivenname>" size="50" readonly="true" />
- </td>
- <td></td>
- </tr>
- <tr>
- <td align="right">Name&nbsp;<img
- title=" Dieses Feld muss ausgef&uuml;llt sein!" alt="Stern"
- src="img/stern.gif" width="10" height="16" /></td>
- <td><input name="rpfamilyname_" type="text" disabled="true"
- id="rpfamilyname" value="<rpfamilyname>" size="50" readonly="true" />
- </td>
- <td></td>
- </tr>
- <tr>
- <td align="right">Geburtsdatum&nbsp;<img
- title=" Dieses Feld muss ausgef&uuml;llt sein!" alt="Stern"
- src="img/stern.gif" width="10" height="16" /></td>
- <td><input name="rpdobyear_" type="text" disabled="true"
- id="rpdobyear" value="<rpdobyear>" size="4" maxlength="4"
- readonly="true" /> - <input name="rpdobmonth_" type="text"
- disabled="true" id="rpdobmonth" value="<rpdobmonth>" size="2"
- maxlength="2" readonly="true" /> - <input name="rpdobday_"
- type="text" disabled="true" id="rpdobday" value="<rpdobday>"
- size="2" maxlength="2" readonly="true" /></td>
- <td></td>
- </tr>
- <tr>
- <td colspan="2"><br /> <em>Ich bin berufsm&auml;&szlig;ig
- berechtigt f&uuml;r die nachfolgend genannte Person in deren Namen
- mit der B&uuml;rgerkarte einzuschreiten.</em></td>
- <td>&nbsp;</td>
- </tr>
- <tr>
- <td colspan="3"><br /> <em>Vertretene Person:</em></td>
- </tr>
- <tr>
- <td colspan="3"><input name="physical_" type="radio"
- physdisabled="" value="true" physselected="" />&nbsp;nat&uuml;rliche
- Person:&nbsp;</td>
- </tr>
- <tr>
- <td align="right">Vorname&nbsp;<img
- title=" Dieses Feld muss ausgef&uuml;llt sein!" alt="Stern"
- src="img/stern.gif" width="10" height="16" /></td>
- <td><input name="givenname_" type="text" id="givenname"
- value="<givenname>" physdisabled="" size="50" />&nbsp;<img
- src="img/info.gif" title="Vorname laut ZMR Schreibweise" alt="Info"
- border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td align="right">Name&nbsp;<img
- title=" Dieses Feld muss ausgef&uuml;llt sein!" alt="Stern"
- src="img/stern.gif" width="10" height="16" /></td>
- <td><input name="familyname_" type="text" id="familyname"
- value="<familyname>" physdisabled="" size="50" />&nbsp;<img
- src="img/info.gif" title="Familienname laut ZMR Schreibweise"
- alt="Info" border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td align="right">Geburtsdatum&nbsp;<img
- title=" Dieses Feld muss ausgef&uuml;llt sein!" alt="Stern"
- src="img/stern.gif" width="10" height="16" /></td>
- <td><input name="dobyear_" type="text" id="dobyear" size="4"
- maxlength="4" value="<dobyear>" physdisabled="" /> - <input
- name="dobmonth_" type="text" id="dobmonth" size="2" maxlength="2"
- value="<dobmonth>" physdisabled="" /> - <input name="dobday_"
- type="text" id="dobday" size="2" maxlength="2" value="<dobday>"
- physdisabled="" />&nbsp;<img src="img/info.gif"
- title="Format: JJJJ-MM-TT" alt="Info" border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td align="center"><em>optional:</em></td>
- <td colspan="2" />
- </tr>
- <tr>
- <td align="right">Stra&szlig;e&nbsp;</td>
- <td><input name="streetname_" type="text" id="streetname"
- value="<streetname>" physdisabled="" size="50" />&nbsp;<img
- src="img/info.gif" title="Stra&szlig;e laut ZMR Schreibweise"
- border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td align="right">Hausnummer&nbsp;</td>
- <td><input name="buildingnumber_" type="text"
- id="buildingnumber" value="<buildingnumber>" physdisabled=""
- size="50" />&nbsp;<img src="img/info.gif"
- title="Hausnummer laut ZMR Schreibweise" alt="Info" border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td align="right">Einh. Nr.&nbsp;</td>
- <td><input name="unit_" type="text" id="unit" value="<unit>"
- size="50" physdisabled="" />&nbsp;<img src="img/info.gif"
- title="Nutzungseinheitsnummer laut ZMR Schreibweise" alt="Info"
- border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td align="right">Postleitzahl&nbsp;</td>
- <td><input name="postalcode_" type="text" id="postalcode"
- value="<postalcode>" size="50" physdisabled="" />&nbsp;<img
- src="img/info.gif" title="Postleitzahl laut ZMR Schreibweise"
- alt="Info" border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td align="right">Gemeinde&nbsp;</td>
- <td><input name="municipality_" type="text" id="municipality"
- value="<municipality>" size="50" physdisabled="" />&nbsp;<img
- src="img/info.gif" title="Gemeinde laut ZMR Schreibweise"
- alt="Info" border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td colspan="3">&nbsp;</td>
- </tr>
- <tr>
- <td colspan="3"><input name="physical_" type="radio"
- cbdisabled="" value="false" cbselected=""/ >&nbsp;juristische
- Person:&nbsp;</td>
- </tr>
- <tr>
- <td align="right">Name&nbsp;<img
- title=" Dieses Feld muss ausgef&uuml;llt sein!" src="img/stern.gif"
- alt="Stern" width="10" height="16" /></td>
- <td><input name="fullname_" type="text" cbdisabled=""
- id="fullname" value="<fullname>" size="50" />&nbsp;<img
- src="img/info.gif"
- title="Name der Organisation laut ZMR Schreibweise" alt="Info"
- border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td align="right" nowrap="nowrap"><select
- name="cbidentificationtype_" size="1" cbseldisabled="">
- <option value="urn:publicid:gv.at:baseid+XFN" fnselected="">Firmenbuchnummer</option>
- <option value="urn:publicid:gv.at:baseid+XZVR" vrselected="">Vereinsnummer</option>
- <option value="urn:publicid:gv.at:baseid+XERSB" ersbselected="">Ord.Nr.im
- Erg&auml;nzungsreg.</option>
- </select>&nbsp;<img title=" Dieses Feld muss ausgef&uuml;llt sein!"
- src="img/stern.gif" alt="Stern" width="10" height="16" /></td>
- <td><input name="cbidentificationvalue_" type="text"
- cbdisabled="" id="cbidentificationvalue"
- value="<cbidentificationvalue>" size="50" />&nbsp;<img
- src="img/info.gif" title="Ordnungsbegriff laut ZMR Schreibweise"
- alt="Info" border="0" /></td>
- <td></td>
- </tr>
- </table>
- <br />
- <errortext>
- <p>
- <em>Bitte halten Sie Ihre B&uuml;rgerkartenumgebung bereit.</em>
- </p>
- <p>
- <input name="XMLRequest" type="hidden"
- value="&lt;?xml version='1.0' encoding='UTF-8'?>&lt;NullOperationRequest xmlns='http://www.buergerkarte.at/namespaces/securitylayer/1.2#'/>" />
- <input name="DataURL" type="hidden" value="<DataURL>" /> <input
- type="submit" name="Submit" value=" Weiter " /> <input
- name="Clear" type="reset" id="Clear"
- value="Formular zur&uuml;cksetzen" />
- </p>
- <br />
- </form>
-</body>
-</html>
diff --git a/id/server/idserverlib/src/main/resources/resources/templates/ParepTemplate.html b/id/server/idserverlib/src/main/resources/resources/templates/ParepTemplate.html
deleted file mode 100644
index cffc46981..000000000
--- a/id/server/idserverlib/src/main/resources/resources/templates/ParepTemplate.html
+++ /dev/null
@@ -1,235 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "DTD/xhtml1-transitional.dtd">
-
-<html>
-<head>
-<BASE href="<BASE_href>">
- <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
- <title>Berufsm&auml;&szlig;ige Parteieinvertretung</title>
- <link href="css/styles.css" type="text/css" rel="stylesheet">
- <link href="css/styles_opera.css" type="text/css" rel="stylesheet">
- <link href="css/mandates.css" type="text/css" rel="stylesheet">
-
- <script src="formallg.js" type="text/javascript"></script>
- <script src="fa.js" type="text/javascript"></script>
-</head>
-<body>
-
-
- <div class="hleft">
- <!--Stammzahlenregisterbehörde<br/>-->
- &nbsp;
- <!--Ballhausplatz 2<br/>-->
- <!--1014 Wien-->
- </div>
- <div class="hright" align="right">
- <img src="img/egov_schrift.gif" alt="E-Gov Logo" />
- </div>
- <div class="htitle" align="left">
- <h1>Berufsm&auml;&szlig;ige Parteienvertretung</h1>
- </div>
- <div class="leiste1" align="center">Bitte beachten Sie</div>
- <div class="leiste2" align="center"></div>
- <div class="leiste3">
- <img title=" Dieses Feld muss ausgefüllt sein!" alt="Stern"
- src="img/stern.gif" width="10" height="16" />&nbsp; Feld muss
- ausgef&uuml;llt sein
- </div>
- <div class="leiste3">
- <img title=" Hilfe zum Ausfüllen " alt="Info" src="img/info.gif"
- width="10" height="16" />&nbsp; Ausf&uuml;llhilfe
- </div>
- <div class="leiste3">
- <img title=" Angabe bitte ergänzen oder richtig stellen! "
- alt="Rufezeichen" src="img/rufezeichen.gif" width="10" height="16" />&nbsp;
- Fehlerhinweis
- </div>
- <div style="clear: both">&nbsp;</div>
-
- <h2>Berufsm&auml;&szlig;ige Parteienvertretung einer
- nat&uuml;rlichen/juristischen Person</h2>
- <div class="boundingbox">
- <form name="ProcessInputForm" method="post" accept-charset="UTF-8"
- enctype="application/x-www-form-urlencoded" action="<BKU>">
- <table width="80%" border="0">
- <tr />
- <tr />
- <tr>
- <td colspan="3"><em>Vertreter:</em></td>
- </tr>
- <tr>
- <td align="right" width="20%">Vorname&nbsp;<img
- title=" Dieses Feld muss ausgef&uuml;llt sein!" alt="Stern"
- src="img/stern.gif" width="10" height="16" /></td>
- <td><input name="rpgivenname_" type="text" disabled="true"
- id="rpgivenname" value="<rpgivenname>" size="50" readonly="true" />
- </td>
- <td></td>
- </tr>
- <tr>
- <td align="right">Name&nbsp;<img
- title=" Dieses Feld muss ausgef&uuml;llt sein!" alt="Stern"
- src="img/stern.gif" width="10" height="16" /></td>
- <td><input name="rpfamilyname_" type="text" disabled="true"
- id="rpfamilyname" value="<rpfamilyname>" size="50" readonly="true" />
- </td>
- <td></td>
- </tr>
- <tr>
- <td align="right">Geburtsdatum&nbsp;<img
- title=" Dieses Feld muss ausgef&uuml;llt sein!" alt="Stern"
- src="img/stern.gif" width="10" height="16" /></td>
- <td><input name="rpdobyear_" type="text" disabled="true"
- id="rpdobyear" value="<rpdobyear>" size="4" maxlength="4"
- readonly="true" /> - <input name="rpdobmonth_" type="text"
- disabled="true" id="rpdobmonth" value="<rpdobmonth>" size="2"
- maxlength="2" readonly="true" /> - <input name="rpdobday_"
- type="text" disabled="true" id="rpdobday" value="<rpdobday>"
- size="2" maxlength="2" readonly="true" /></td>
- <td></td>
- </tr>
- <tr>
- <td colspan="2"><br /> <em>Ich bin berufsm&auml;&szlig;ig
- berechtigt f&uuml;r die nachfolgend genannte Person in deren
- Namen mit der B&uuml;rgerkarte einzuschreiten.</em></td>
- <td>&nbsp;</td>
- </tr>
- <tr>
- <td colspan="3"><br /> <em>Vertretene Person:</em></td>
- </tr>
- <tr>
- <td colspan="3"><input name="physical_" type="radio"
- physdisabled="" value="true" physselected="" />&nbsp;nat&uuml;rliche
- Person:&nbsp;</td>
- </tr>
- <tr>
- <td align="right">Vorname&nbsp;<img
- title=" Dieses Feld muss ausgef&uuml;llt sein!" alt="Stern"
- src="img/stern.gif" width="10" height="16" /></td>
- <td><input name="givenname_" type="text" id="givenname"
- value="<givenname>" physdisabled="" size="50" />&nbsp;<img
- src="img/info.gif" title="Vorname laut ZMR Schreibweise"
- alt="Info" border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td align="right">Name&nbsp;<img
- title=" Dieses Feld muss ausgef&uuml;llt sein!" alt="Stern"
- src="img/stern.gif" width="10" height="16" /></td>
- <td><input name="familyname_" type="text" id="familyname"
- value="<familyname>" physdisabled="" size="50" />&nbsp;<img
- src="img/info.gif" title="Familienname laut ZMR Schreibweise"
- alt="Info" border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td align="right">Geburtsdatum&nbsp;<img
- title=" Dieses Feld muss ausgef&uuml;llt sein!" alt="Stern"
- src="img/stern.gif" width="10" height="16" /></td>
- <td><input name="dobyear_" type="text" id="dobyear" size="4"
- maxlength="4" value="<dobyear>" physdisabled="" /> - <input
- name="dobmonth_" type="text" id="dobmonth" size="2" maxlength="2"
- value="<dobmonth>" physdisabled="" /> - <input name="dobday_"
- type="text" id="dobday" size="2" maxlength="2" value="<dobday>"
- physdisabled="" />&nbsp;<img src="img/info.gif"
- title="Format: JJJJ-MM-TT" alt="Info" border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td align="center"><em>optional:</em></td>
- <td colspan="2" />
- </tr>
- <tr>
- <td align="right">Stra&szlig;e&nbsp;</td>
- <td><input name="streetname_" type="text" id="streetname"
- value="<streetname>" physdisabled="" size="50" />&nbsp;<img
- src="img/info.gif" title="Stra&szlig;e laut ZMR Schreibweise"
- border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td align="right">Hausnummer&nbsp;</td>
- <td><input name="buildingnumber_" type="text"
- id="buildingnumber" value="<buildingnumber>" physdisabled=""
- size="50" />&nbsp;<img src="img/info.gif"
- title="Hausnummer laut ZMR Schreibweise" alt="Info" border="0" />
- </td>
- <td></td>
- </tr>
- <tr>
- <td align="right">Einh. Nr.&nbsp;</td>
- <td><input name="unit_" type="text" id="unit" value="<unit>"
- size="50" physdisabled="" />&nbsp;<img src="img/info.gif"
- title="Nutzungseinheitsnummer laut ZMR Schreibweise" alt="Info"
- border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td align="right">Postleitzahl&nbsp;</td>
- <td><input name="postalcode_" type="text" id="postalcode"
- value="<postalcode>" size="50" physdisabled="" />&nbsp;<img
- src="img/info.gif" title="Postleitzahl laut ZMR Schreibweise"
- alt="Info" border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td align="right">Gemeinde&nbsp;</td>
- <td><input name="municipality_" type="text" id="municipality"
- value="<municipality>" size="50" physdisabled="" />&nbsp;<img
- src="img/info.gif" title="Gemeinde laut ZMR Schreibweise"
- alt="Info" border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td colspan="3">&nbsp;</td>
- </tr>
- <tr>
- <td colspan="3"><input name="physical_" type="radio"
- cbdisabled="" value="false" cbselected=""/ >&nbsp;juristische
- Person:&nbsp;</td>
- </tr>
- <tr>
- <td align="right">Name&nbsp;<img
- title=" Dieses Feld muss ausgef&uuml;llt sein!"
- src="img/stern.gif" alt="Stern" width="10" height="16" /></td>
- <td><input name="fullname_" type="text" cbdisabled=""
- id="fullname" value="<fullname>" size="50" />&nbsp;<img
- src="img/info.gif"
- title="Name der Organisation laut ZMR Schreibweise" alt="Info"
- border="0" /></td>
- <td></td>
- </tr>
- <tr>
- <td align="right" nowrap="nowrap"><select
- name="cbidentificationtype_" size="1" cbseldisabled="">
- <option value="urn:publicid:gv.at:baseid+XFN" fnselected="">Firmenbuchnummer</option>
- <option value="urn:publicid:gv.at:baseid+XZVR" vrselected="">Vereinsnummer</option>
- <option value="urn:publicid:gv.at:baseid+XERSB" ersbselected="">Ord.Nr.im
- Erg&auml;nzungsreg.</option>
- </select>&nbsp;<img title=" Dieses Feld muss ausgef&uuml;llt sein!"
- src="img/stern.gif" alt="Stern" width="10" height="16" /></td>
- <td><input name="cbidentificationvalue_" type="text"
- cbdisabled="" id="cbidentificationvalue"
- value="<cbidentificationvalue>" size="50" />&nbsp;<img
- src="img/info.gif" title="Ordnungsbegriff laut ZMR Schreibweise"
- alt="Info" border="0" /></td>
- <td></td>
- </tr>
- </table>
- <br />
- <errortext>
- <p>
- <em>Bitte halten Sie Ihre B&uuml;rgerkartenumgebung bereit.</em>
- </p>
- <p>
- <input name="XMLRequest" type="hidden"
- value="&lt;?xml version='1.0' encoding='UTF-8'?>&lt;NullOperationRequest xmlns='http://www.buergerkarte.at/namespaces/securitylayer/1.2#'/>" />
- <input name="DataURL" type="hidden" value="<DataURL>" /> <input
- type="submit" name="Submit" value=" Weiter " /> <input
- name="Clear" type="reset" id="Clear"
- value="Formular zur&uuml;cksetzen" />
- </p>
- <br />
- </form>
- </div>
-</body>
-</html>
diff --git a/id/server/idserverlib/src/main/resources/resources/templates/fetchGender.html b/id/server/idserverlib/src/main/resources/resources/templates/fetchGender.html
deleted file mode 100644
index f47ee53ff..000000000
--- a/id/server/idserverlib/src/main/resources/resources/templates/fetchGender.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
-
- <body>
- <form action="${action}" method="post" target="_parent">
- <div>
- <input type="hidden" name="SAMLResponse" value="${SAMLResponse}"/>
- </div>
- <p>Please indicate the gender of the represented.</p>
- <div>
- <input type="submit" name="gender" value="M"/>
- <input type="submit" name="gender" value="F"/>
- </div>
- </form>
-
- </body>
-</html> \ No newline at end of file
diff --git a/id/server/idserverlib/src/main/resources/resources/templates/oasis_dss_webform_binding.vm b/id/server/idserverlib/src/main/resources/resources/templates/oasis_dss_webform_binding.vm
deleted file mode 100644
index 7fcc1bb36..000000000
--- a/id/server/idserverlib/src/main/resources/resources/templates/oasis_dss_webform_binding.vm
+++ /dev/null
@@ -1,36 +0,0 @@
-##
-## Velocity Template for OASIS WEBFORM BINDING
-##
-## Velocity context may contain the following properties
-## action - String - the action URL for the form
-## signresponse - String - the Base64 encoded SAML Request
-## verifyresponse - String - the Base64 encoded SAML Response
-## clienturl - String - URL where the USer gets redirected after the signature process
-
-<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
-
- <body onload="document.forms[0].submit()">
- <noscript>
- <p>
- <strong>Note:</strong> Since your browser does not support JavaScript,
- you must press the Continue button once to proceed.
- </p>
- </noscript>
-
- <form action="${action}" method="post">
- <div>
- #if($signrequest)<input type="hidden" name="signrequest" value="${signrequest}"/>#end
-
- #if($verifyrequest)<input type="hidden" name="verifyrequest" value="${verifyrequest}"/>#end
- #if($clienturl)<input type="hidden" name="clienturl" value="${clienturl}"/>#end
-
- </div>
- <noscript>
- <div>
- <input type="submit" value="Continue"/>
- </div>
- </noscript>
- </form>
-
- </body>
-</html> \ No newline at end of file
diff --git a/id/server/idserverlib/src/main/resources/resources/templates/pvp_postbinding_template.html b/id/server/idserverlib/src/main/resources/templates/pvp_postbinding_template.html
index 64e88a688..45c183215 100644
--- a/id/server/idserverlib/src/main/resources/resources/templates/pvp_postbinding_template.html
+++ b/id/server/idserverlib/src/main/resources/templates/pvp_postbinding_template.html
@@ -31,11 +31,9 @@
<form action="${action}" method="post" target="_parent">
<div>
- #if($RelayState)<input type="hidden" name="RelayState"
- value="${RelayState}" />#end #if($SAMLRequest)<input type="hidden"
- name="SAMLRequest" value="${SAMLRequest}" />#end #if($SAMLResponse)<input
- type="hidden" name="SAMLResponse" value="${SAMLResponse}" />#end
-
+ #if($RelayState) <input type="hidden" name="RelayState" value="${RelayState}"/> #end
+ #if($SAMLRequest) <input type="hidden" name="SAMLRequest" value="${SAMLRequest}" /> #end
+ #if($SAMLResponse) <input type="hidden" name="SAMLResponse" value="${SAMLResponse}" /> #end
</div>
<noscript>
<div>