add additional validation steps in eIDAS message processing

2 files changed, 78 insertions, 11 deletions

diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/ReceiveAuthnResponseTask.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/ReceiveAuthnResponseTask.java
index c4b2bfeae..45ba3d64e 100644
--- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/ReceiveAuthnResponseTask.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/ReceiveAuthnResponseTask.java
@@ -19,12 +19,12 @@ import at.gv.egovernment.moa.id.auth.modules.eidas.utils.SAMLEngineUtils;
 import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+import at.gv.egovernment.moa.id.protocols.eidas.validator.eIDASResponseValidator;
 import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.MiscUtil;
 import eu.eidas.auth.commons.EidasStringUtil;
 import eu.eidas.auth.commons.protocol.IAuthenticationResponse;
-import eu.eidas.auth.commons.protocol.eidas.LevelOfAssurance;
 import eu.eidas.auth.engine.ProtocolEngineI;
 import eu.eidas.engine.exceptions.EIDASSAMLEngineException;
 
@@ -78,16 +78,8 @@ public class ReceiveAuthnResponseTask extends AbstractAuthServletTask {
 			// **********************************************************
 			// *******   MOA-ID specific response validation   **********
 			// **********************************************************
-			
-			//validate received LoA against minimum required LoA
-			LevelOfAssurance reqLoA = LevelOfAssurance.fromString(pendingReq.getOnlineApplicationConfiguration().getQaaLevel());
-			LevelOfAssurance respLoA = LevelOfAssurance.fromString(samlResp.getLevelOfAssurance()); 
-			if (respLoA.numericValue() < reqLoA.numericValue()) {
-				Logger.error("eIDAS Response LevelOfAssurance is lower than the required! "
-						+ "(Resp-LoA:" + respLoA.getValue() + " Req-LoA:" + reqLoA.getValue() + ")");
-				throw new MOAIDException("eIDAS.14", new Object[]{respLoA.getValue()});
-				
-			}
+			String spCountry = authConfig.getBasicMOAIDConfiguration(Constants.CONIG_PROPS_EIDAS_NODE_COUNTRYCODE, "AT");
+			eIDASResponseValidator.validateResponse(pendingReq, samlResp, spCountry);
 
 			
 			// **********************************************************
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/eIDASAttributeProcessingUtils.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/eIDASAttributeProcessingUtils.java
new file mode 100644
index 000000000..30e1e4505
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/eIDASAttributeProcessingUtils.java
@@ -0,0 +1,75 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.utils;
+
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
+import at.gv.egovernment.moa.id.data.Trible;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+public class eIDASAttributeProcessingUtils {
+	public static final String PERSONALIDENIFIER_VALIDATION_PATTERN = "^[A-Z,a-z]{2}/[A-Z,a-z]{2}/.*";
+	
+	/**
+	 * Validate a eIDAS PersonalIdentifier attribute value 
+	 * This validation is done according to eIDAS SAML Attribute Profile -  Section 2.2.3 Unique Identifier 
+	 * 
+	 * @param uniqueID eIDAS attribute value of a unique identifier
+	 * @return true if the uniqueID matches to eIDAS to Unique Identifier specification, otherwise false
+	 */
+	public static boolean validateEidasPersonalIdentifier(String uniqueID) {
+		Pattern pattern = Pattern.compile(PERSONALIDENIFIER_VALIDATION_PATTERN );
+		Matcher matcher = pattern.matcher(uniqueID);	
+		return matcher.matches();
+		
+	}
+	
+	
+	/**
+	 * Parse an eIDAS PersonalIdentifier attribute value into it components. 
+	 * This processing is done according to eIDAS SAML Attribute Profile -  Section 2.2.3 Unique Identifier 
+	 * 
+	 * @param uniqueID eIDAS attribute value of a unique identifier
+	 * @return {@link Trible} that contains: 
+	 * 				<br> First : citizen country
+	 * 				<br> Second: destination country
+	 * 				<br> Third : unique identifier
+	 * 	<br> or null if the attribute value has a wrong format
+	 */					
+	public static Trible<String, String, String> parseEidasPersonalIdentifier(String uniqueID) {
+		if (!validateEidasPersonalIdentifier(uniqueID)) {
+			Logger.error("eIDAS attribute value for " + Constants.eIDAS_ATTR_PERSONALIDENTIFIER 
+					+ " looks wrong formated. Value:" + ((String)uniqueID));				
+			return null;
+			
+		}		
+		return Trible.newInstance(uniqueID.substring(0, 2), uniqueID.substring(3, 5), uniqueID.substring(6)); 
+		
+	}
+}