First untested part: Refactor authentication modules and process management to Spring

1 files changed, 30 insertions, 62 deletions

diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
index 11917d0c3..065f3866b 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
@@ -1,10 +1,6 @@
 package at.gv.egovernment.moa.id.auth;
 
 
-import iaik.asn1.ObjectID;
-import iaik.x509.X509Certificate;
-import iaik.x509.X509ExtensionInitException;
-
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -22,6 +18,8 @@ import javax.xml.transform.TransformerException;
 import org.apache.commons.lang.StringEscapeUtils;
 import org.apache.xpath.XPathAPI;
 import org.opensaml.xml.util.Base64;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.w3c.dom.NodeList;
@@ -29,7 +27,6 @@ import org.xml.sax.SAXException;
 
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
 import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
-import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
 import at.gv.egovernment.moa.id.auth.builder.AuthenticationBlockAssertionBuilder;
 import at.gv.egovernment.moa.id.auth.builder.BPKBuilder;
 import at.gv.egovernment.moa.id.auth.builder.CreateXMLSignatureRequestBuilder;
@@ -63,6 +60,7 @@ import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWConstants
 import at.gv.egovernment.moa.id.config.ConfigurationException;
 import at.gv.egovernment.moa.id.config.auth.AuthConfiguration;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
+import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
 import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
 import at.gv.egovernment.moa.id.data.MISMandate;
 import at.gv.egovernment.moa.id.moduls.IRequest;
@@ -76,6 +74,9 @@ import at.gv.egovernment.moa.util.DateTimeUtils;
 import at.gv.egovernment.moa.util.FileUtils;
 import at.gv.egovernment.moa.util.MiscUtil;
 import at.gv.egovernment.moa.util.StringUtils;
+import iaik.asn1.ObjectID;
+import iaik.x509.X509Certificate;
+import iaik.x509.X509ExtensionInitException;
 
 /**
  * API for MOA ID Authentication Service.<br> {@link AuthenticationSession} is
@@ -85,24 +86,11 @@ import at.gv.egovernment.moa.util.StringUtils;
  * @version $Id: AuthenticationServer.java 1273 2012-02-27 14:50:18Z kstranacher
  *          $
  */
+@Service("CitizenCardAuthenticationServer")
 public class AuthenticationServer extends BaseAuthenticationServer {
 
-	/**
-	 * single instance
-	 */
-	private static AuthenticationServer instance;
-
-	/**
-	 * Returns the single instance of <code>AuthenticationServer</code>.
-	 *
-	 * @return the single instance of <code>AuthenticationServer</code>
-	 */
-	public static AuthenticationServer getInstance() {
-		if (instance == null)
-			instance = new AuthenticationServer();
-		return instance;
-	}
-
+	@Autowired private MOAReversionLogger revisionsLogger;
+	
 	/**
 	 * Constructor for AuthenticationServer.
 	 */
@@ -139,13 +127,14 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 	 * @param templateMandteURL  URL providing an HTML template for the HTML form generated
 	 *                           (for signing in mandates mode)
 	 * @param req                determines the protocol used
+	 * @param pendingReq 
 	 * @param sourceID
 	 * @return HTML form
 	 * @throws AuthenticationException
 	 * @see GetIdentityLinkFormBuilder
 	 * @see InfoboxReadRequestBuilder
 	 */
-	public String startAuthentication(AuthenticationSession session, HttpServletRequest req) throws WrongParametersException,
+	public String startAuthentication(AuthenticationSession session, HttpServletRequest req, IRequest pendingReq) throws WrongParametersException,
 	AuthenticationException, ConfigurationException, BuildException {
 
 		if (session == null) {
@@ -154,7 +143,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 
 		//load OnlineApplication configuration
 		OAAuthParameter oaParam =
-				AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(session.getPublicOAURLPrefix());
+				authConfig.getOnlineApplicationParameter(session.getPublicOAURLPrefix());
 		if (oaParam == null)
 			throw new AuthenticationException("auth.00", new Object[]{session.getPublicOAURLPrefix()});
 
@@ -172,7 +161,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 
 		String infoboxReadRequest = "";
 
-		String domainIdentifier = AuthConfigurationProviderFactory.getInstance().getSSOTagetIdentifier().trim();
+		String domainIdentifier = authConfig.getSSOTagetIdentifier().trim();
 		if (MiscUtil.isEmpty(domainIdentifier) && session.isSsoRequested()) {
 			//do not use SSO if no Target is set
 			Logger.warn("NO SSO-Target found in configuration. Single Sign-On is deaktivated!");
@@ -209,34 +198,17 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 
 
 		String dataURL = new DataURLBuilder().buildDataURL(
-				session.getAuthURL(), REQ_VERIFY_IDENTITY_LINK, session
-				.getSessionID());
+				session.getAuthURL(), REQ_VERIFY_IDENTITY_LINK, pendingReq.getRequestID());
 
 		//removed in MOAID 2.0
 		String pushInfobox = "";
 
-		//		VerifyInfoboxParameters verifyInfoboxParameters = oaParam
-		//				.getVerifyInfoboxParameters();
-		//		if (verifyInfoboxParameters != null) {
-		//			pushInfobox = verifyInfoboxParameters.getPushInfobox();
-		//			session.setPushInfobox(pushInfobox);
-		//		}
-
-		//build CertInfo request
-		//removed in MOA-ID 2.0
-		//		String certInfoRequest = new CertInfoVerifyXMLSignatureRequestBuilder()
-		//				.build();
-		//		String certInfoDataURL = new DataURLBuilder()
-		//				.buildDataURL(session.getAuthURL(), REQ_START_AUTHENTICATION,
-		//						session.getSessionID());
-
 		//get Applet Parameters
 		String appletwidth = req.getParameter(PARAM_APPLET_WIDTH);
 		String appletheigth = req.getParameter(PARAM_APPLET_HEIGTH);
 		appletheigth = StringEscapeUtils.escapeHtml(appletheigth);
 		appletwidth = StringEscapeUtils.escapeHtml(appletwidth);
 		
-		//TODO: cleanup before MOA-ID 2.1 release
 		try {
 			String htmlForm = new GetIdentityLinkFormBuilder().build(template,
 					session.getBkuURL(), infoboxReadRequest, dataURL, null,
@@ -333,7 +305,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 		VerifyXMLSignatureResponse verifyXMLSignatureResponse = new VerifyXMLSignatureResponseParser(
 				domVerifyXMLSignatureResponse).parseData();
 
-		OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance()
+		OAAuthParameter oaParam = authConfig
 				.getOnlineApplicationParameter(session.getPublicOAURLPrefix());
 
 		// validates the <VerifyXMLSignatureResponse>
@@ -349,7 +321,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 		//Removed in MOA-ID 2.0
 		//verifyInfoboxes(session, infoboxReadResponseParameters, false);
 
-		MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+		revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 				pendingReq, MOAIDEventConstants.AUTHPROCESS_IDL_VALIDATED);
 		
 		return "found!";
@@ -406,7 +378,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 		AuthConfiguration authConf = AuthConfigurationProviderFactory
 				.getInstance();
 
-		OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance()
+		OAAuthParameter oaParam = authConfig
 				.getOnlineApplicationParameter(session.getPublicOAURLPrefix());
 
 		String returnvalue = getCreateXMLSignatureRequestAuthBlockOrRedirect(session,
@@ -441,7 +413,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 			throw new AuthenticationException("auth.10", new Object[]{
 					GET_MIS_SESSIONID, PARAM_SESSIONID});
 
-		OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance()
+		OAAuthParameter oaParam = authConfig
 				.getOnlineApplicationParameter(session.getPublicOAURLPrefix());
 
 		try {
@@ -480,7 +452,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 	 */
 	public String getCreateXMLSignatureRequestAuthBlockOrRedirect(
 			AuthenticationSession session, AuthConfiguration authConf,
-			OAAuthParameter oaParam, IRequest pendingReq) throws ConfigurationException,
+			IOAAuthParameters oaParam, IRequest pendingReq) throws ConfigurationException,
 			BuildException, ValidateException {
 
 		//        // check for intermediate processing of the infoboxes
@@ -488,9 +460,9 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 		//            return "Redirect to Input Processor";
 
 		if (authConf == null)
-			authConf = AuthConfigurationProviderFactory.getInstance();
+			authConf = authConfig;
 		if (oaParam == null)
-			oaParam = AuthConfigurationProviderFactory.getInstance()
+			oaParam = authConfig
 			.getOnlineApplicationParameter(
 					session.getPublicOAURLPrefix());
 
@@ -529,7 +501,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 		AuthConfiguration authConf = AuthConfigurationProviderFactory
 				.getInstance();
 
-		OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance()
+		OAAuthParameter oaParam = authConfig
 				.getOnlineApplicationParameter(session.getPublicOAURLPrefix());
 
 		return getCreateXMLSignatureRequestForeigID(session, authConf, oaParam,
@@ -546,9 +518,9 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 		//            return "Redirect to Input Processor";
 
 		if (authConf == null)
-			authConf = AuthConfigurationProviderFactory.getInstance();
+			authConf = authConfig;
 		if (oaParam == null)
-			oaParam = AuthConfigurationProviderFactory.getInstance()
+			oaParam = authConfig
 			.getOnlineApplicationParameter(
 					session.getPublicOAURLPrefix());
 
@@ -634,15 +606,11 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 	 *                                      including the <code>&lt;ReadInfoboxResponse&gt;</code>
 	 * @throws BKUException
 	 */
-	public X509Certificate getCertificate(IRequest pendingReq, String sessionID,
+	public X509Certificate getCertificate(IRequest pendingReq,
 			Map<String, String> readInfoboxResponseParameters) throws AuthenticationException,
 			BuildException, ParseException, ConfigurationException,
 			ValidateException, ServiceException, BKUException {
 
-		if (isEmpty(sessionID))
-			throw new AuthenticationException("auth.10", new Object[]{
-					REQ_VERIFY_CERTIFICATE, PARAM_SESSIONID});
-
 		String xmlReadInfoboxResponse = (String) readInfoboxResponseParameters
 				.get(PARAM_XMLRESPONSE);
 
@@ -655,7 +623,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 				xmlReadInfoboxResponse);
 		X509Certificate cert = p.parseCertificate();
 
-		MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+		revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 				pendingReq, MOAIDEventConstants.AUTHPROCESS_CERTIFICATE_VALIDATED);
 		
 		return cert;
@@ -673,7 +641,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 	 *                        to be appended to the AUTH-Block.
 	 */
 	private String buildAuthenticationBlock(AuthenticationSession session,
-			OAAuthParameter oaParam, IRequest pendingReq) throws BuildException {
+			IOAAuthParameters oaParam, IRequest pendingReq) throws BuildException {
 
 		IdentityLink identityLink = session.getIdentityLink();
 		String issuer = identityLink.getName();
@@ -1121,7 +1089,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 			}
 		}
 
-		OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance()
+		OAAuthParameter oaParam = authConfig
 				.getOnlineApplicationParameter(session.getPublicOAURLPrefix());
 
 		// validates the <VerifyXMLSignatureResponse>
@@ -1163,10 +1131,10 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 		//set QAA Level four in case of card authentifcation
 		session.setQAALevel(PVPConstants.STORK_QAA_1_4);
 		
-		MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+		revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 				pendingReq, MOAIDEventConstants.AUTHPROCESS_AUTHBLOCK_VALIDATED);
 		
-		MOAReversionLogger.getInstance().logPersonalInformationEvent(pendingReq, session.getIdentityLink() 
+		revisionsLogger.logPersonalInformationEvent(pendingReq, session.getIdentityLink() 
 				);
 	}