Merge tag 'MOA-ID-3.1.0' into development_preview

JoinUp Release

211 files changed, 13882 insertions, 10845 deletions

diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/pom.xml b/id/server/modules/moa-id-modul-citizencard_authentication/pom.xml
index 49293420c..f2403a62e 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/pom.xml
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/pom.xml
@@ -20,12 +20,11 @@
   		<artifactId>moa-id-lib</artifactId>
   		<scope>test</scope>
   		<type>test-jar</type>
-  		<version>3.0.3-Snapshot</version>
   	</dependency>
   	
   	<dependency>
-			<groupId>MOA</groupId>
-			<artifactId>moa-common</artifactId>
+			<groupId>MOA.id.server</groupId>
+			<artifactId>moa-id-commons</artifactId>
 			<type>test-jar</type>
 			<scope>test</scope>
 		</dependency>
@@ -39,7 +38,19 @@
             <groupId>xalan-bin-dist</groupId>
             <artifactId>xalan</artifactId>
             <scope>provided</scope>
-        </dependency>
+            <exclusions>
+            	<exclusion>
+            		<artifactId>xml-apis</artifactId>
+            		<groupId>xml-apis</groupId>
+            	</exclusion>
+            </exclusions>
+  	   	</dependency>
+        
+        <dependency>
+					<groupId>xalan-bin-dist</groupId>
+					<artifactId>xml-apis</artifactId>
+					<scope>provided</scope>
+				</dependency>
         
   		<dependency>
 			<groupId>org.springframework</groupId>
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
index 11917d0c3..f5000581c 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
@@ -1,10 +1,6 @@
 package at.gv.egovernment.moa.id.auth;
 
 
-import iaik.asn1.ObjectID;
-import iaik.x509.X509Certificate;
-import iaik.x509.X509ExtensionInitException;
-
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -22,6 +18,8 @@ import javax.xml.transform.TransformerException;
 import org.apache.commons.lang.StringEscapeUtils;
 import org.apache.xpath.XPathAPI;
 import org.opensaml.xml.util.Base64;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.w3c.dom.NodeList;
@@ -29,7 +27,6 @@ import org.xml.sax.SAXException;
 
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
 import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
-import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
 import at.gv.egovernment.moa.id.auth.builder.AuthenticationBlockAssertionBuilder;
 import at.gv.egovernment.moa.id.auth.builder.BPKBuilder;
 import at.gv.egovernment.moa.id.auth.builder.CreateXMLSignatureRequestBuilder;
@@ -46,7 +43,6 @@ import at.gv.egovernment.moa.id.auth.data.VerifyXMLSignatureResponse;
 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
 import at.gv.egovernment.moa.id.auth.exception.BKUException;
 import at.gv.egovernment.moa.id.auth.exception.BuildException;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.auth.exception.ParseException;
 import at.gv.egovernment.moa.id.auth.exception.ServiceException;
 import at.gv.egovernment.moa.id.auth.exception.ValidateException;
@@ -60,12 +56,13 @@ import at.gv.egovernment.moa.id.auth.validator.IdentityLinkValidator;
 import at.gv.egovernment.moa.id.auth.validator.VerifyXMLSignatureResponseValidator;
 import at.gv.egovernment.moa.id.auth.validator.parep.ParepUtils;
 import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWConstants;
-import at.gv.egovernment.moa.id.config.ConfigurationException;
-import at.gv.egovernment.moa.id.config.auth.AuthConfiguration;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.data.MISMandate;
-import at.gv.egovernment.moa.id.moduls.IRequest;
 import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
 import at.gv.egovernment.moa.id.util.XMLUtil;
 import at.gv.egovernment.moa.logging.LogMsg;
@@ -76,6 +73,9 @@ import at.gv.egovernment.moa.util.DateTimeUtils;
 import at.gv.egovernment.moa.util.FileUtils;
 import at.gv.egovernment.moa.util.MiscUtil;
 import at.gv.egovernment.moa.util.StringUtils;
+import iaik.asn1.ObjectID;
+import iaik.x509.X509Certificate;
+import iaik.x509.X509ExtensionInitException;
 
 /**
  * API for MOA ID Authentication Service.<br> {@link AuthenticationSession} is
@@ -85,24 +85,12 @@ import at.gv.egovernment.moa.util.StringUtils;
  * @version $Id: AuthenticationServer.java 1273 2012-02-27 14:50:18Z kstranacher
  *          $
  */
+@Service("CitizenCardAuthenticationServer")
 public class AuthenticationServer extends BaseAuthenticationServer {
 
-	/**
-	 * single instance
-	 */
-	private static AuthenticationServer instance;
-
-	/**
-	 * Returns the single instance of <code>AuthenticationServer</code>.
-	 *
-	 * @return the single instance of <code>AuthenticationServer</code>
-	 */
-	public static AuthenticationServer getInstance() {
-		if (instance == null)
-			instance = new AuthenticationServer();
-		return instance;
-	}
-
+	@Autowired private MOAReversionLogger revisionsLogger;
+	@Autowired private AuthConfiguration authConfig;
+	
 	/**
 	 * Constructor for AuthenticationServer.
 	 */
@@ -139,13 +127,14 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 	 * @param templateMandteURL  URL providing an HTML template for the HTML form generated
 	 *                           (for signing in mandates mode)
 	 * @param req                determines the protocol used
+	 * @param pendingReq 
 	 * @param sourceID
 	 * @return HTML form
 	 * @throws AuthenticationException
 	 * @see GetIdentityLinkFormBuilder
 	 * @see InfoboxReadRequestBuilder
 	 */
-	public String startAuthentication(AuthenticationSession session, HttpServletRequest req) throws WrongParametersException,
+	public String startAuthentication(AuthenticationSession session, HttpServletRequest req, IRequest pendingReq) throws WrongParametersException,
 	AuthenticationException, ConfigurationException, BuildException {
 
 		if (session == null) {
@@ -153,40 +142,39 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 		}
 
 		//load OnlineApplication configuration
-		OAAuthParameter oaParam =
-				AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(session.getPublicOAURLPrefix());
+		IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
 		if (oaParam == null)
-			throw new AuthenticationException("auth.00", new Object[]{session.getPublicOAURLPrefix()});
+			throw new AuthenticationException("auth.00", new Object[]{pendingReq.getOAURL()});
 
 		//load Template
+		String templateURL = pendingReq.getGenericData(
+				MOAIDAuthConstants.AUTHPROCESS_DATA_SECURITYLAYERTEMPLATE, String.class);
 		String template = null;
-		if (session.getTemplateURL() != null) {
+		if (MiscUtil.isNotEmpty(templateURL)) {
 			try {
-
-				template = new String(FileUtils.readURL(session.getTemplateURL()));
+				template = new String(FileUtils.readURL(templateURL));
+				
 			} catch (IOException ex) {
 				throw new AuthenticationException("auth.03", new Object[]{
-						session.getTemplateURL(), ex.toString()}, ex);
+						templateURL, ex.toString()}, ex);
+				
 			}
+			
+		} else {
+			throw new AuthenticationException("auth.04", new Object[]{
+					"SecurityLayerTemplate", "No template definde"});
+			
 		}
 
 		String infoboxReadRequest = "";
-
-		String domainIdentifier = AuthConfigurationProviderFactory.getInstance().getSSOTagetIdentifier().trim();
-		if (MiscUtil.isEmpty(domainIdentifier) && session.isSsoRequested()) {
-			//do not use SSO if no Target is set
-			Logger.warn("NO SSO-Target found in configuration. Single Sign-On is deaktivated!");
-			session.setSsoRequested(false);
-
-		}
-
-		if (session.isSsoRequested()) {
-			Logger.info("SSO Login requested");
+		String ssoDomainIdentifier = authConfig.getSSOTagetIdentifier();
+		if (MiscUtil.isNotEmpty(ssoDomainIdentifier) && 
+				pendingReq.needSingleSignOnFunctionality()) {
+			Logger.debug("SSO Login requested");
 			//load identityLink with SSO Target
 			boolean isbuisness = false;
-
-			if (domainIdentifier.startsWith(PREFIX_WPBK)) {
-
+			
+			if (ssoDomainIdentifier.startsWith(PREFIX_WPBK)) {
 				isbuisness = true;
 
 			} else {
@@ -196,10 +184,10 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 
 			//build ReadInfobox request
 			infoboxReadRequest = new InfoboxReadRequestBuilder().build(
-					isbuisness, domainIdentifier);
+					isbuisness, ssoDomainIdentifier);
 
 		} else {
-			Logger.info("Non-SSO Login requested");
+			Logger.debug("Non-SSO Login requested or SSO not allowed/possible");
 			//build ReadInfobox request
 			infoboxReadRequest = new InfoboxReadRequestBuilder().build(
 					oaParam.getBusinessService(), oaParam
@@ -207,36 +195,19 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 
 		}
 
-
+		//build DataURL for BKU request
 		String dataURL = new DataURLBuilder().buildDataURL(
-				session.getAuthURL(), REQ_VERIFY_IDENTITY_LINK, session
-				.getSessionID());
+				pendingReq.getAuthURL(), REQ_VERIFY_IDENTITY_LINK, pendingReq.getRequestID());
 
 		//removed in MOAID 2.0
 		String pushInfobox = "";
 
-		//		VerifyInfoboxParameters verifyInfoboxParameters = oaParam
-		//				.getVerifyInfoboxParameters();
-		//		if (verifyInfoboxParameters != null) {
-		//			pushInfobox = verifyInfoboxParameters.getPushInfobox();
-		//			session.setPushInfobox(pushInfobox);
-		//		}
-
-		//build CertInfo request
-		//removed in MOA-ID 2.0
-		//		String certInfoRequest = new CertInfoVerifyXMLSignatureRequestBuilder()
-		//				.build();
-		//		String certInfoDataURL = new DataURLBuilder()
-		//				.buildDataURL(session.getAuthURL(), REQ_START_AUTHENTICATION,
-		//						session.getSessionID());
-
 		//get Applet Parameters
 		String appletwidth = req.getParameter(PARAM_APPLET_WIDTH);
 		String appletheigth = req.getParameter(PARAM_APPLET_HEIGTH);
 		appletheigth = StringEscapeUtils.escapeHtml(appletheigth);
 		appletwidth = StringEscapeUtils.escapeHtml(appletwidth);
 		
-		//TODO: cleanup before MOA-ID 2.1 release
 		try {
 			String htmlForm = new GetIdentityLinkFormBuilder().build(template,
 					session.getBkuURL(), infoboxReadRequest, dataURL, null,
@@ -291,9 +262,6 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 			throw new AuthenticationException("auth.10", new Object[]{
 					REQ_VERIFY_IDENTITY_LINK, PARAM_XMLRESPONSE});
 
-		AuthConfiguration authConf = AuthConfigurationProviderFactory
-				.getInstance();
-
 		// check if an identity link was found
 		// Errorcode 2911 von Trustdesk BKU (nicht spezifikationskonform
 		// (SL1.2))
@@ -323,23 +291,22 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 		IdentityLinkValidator.getInstance().validate(identityLink);
 		// builds a <VerifyXMLSignatureRequest> for a call of MOA-SP
 		Element domVerifyXMLSignatureRequest = new VerifyXMLSignatureRequestBuilder()
-		.build(identityLink, authConf
+		.build(identityLink, authConfig
 				.getMoaSpIdentityLinkTrustProfileID(pendingReq.getOnlineApplicationConfiguration().isUseIDLTestTrustStore()));
 
 		// invokes the call
-		Element domVerifyXMLSignatureResponse = new SignatureVerificationInvoker()
+		Element domVerifyXMLSignatureResponse = SignatureVerificationInvoker.getInstance()
 		.verifyXMLSignature(domVerifyXMLSignatureRequest);
 		// parses the <VerifyXMLSignatureResponse>
 		VerifyXMLSignatureResponse verifyXMLSignatureResponse = new VerifyXMLSignatureResponseParser(
 				domVerifyXMLSignatureResponse).parseData();
 
-		OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance()
-				.getOnlineApplicationParameter(session.getPublicOAURLPrefix());
-
+		IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
+		
 		// validates the <VerifyXMLSignatureResponse>
 		VerifyXMLSignatureResponseValidator.getInstance().validate(
 				verifyXMLSignatureResponse,
-				authConf.getIdentityLinkX509SubjectNames(),
+				authConfig.getIdentityLinkX509SubjectNames(),
 				VerifyXMLSignatureResponseValidator.CHECK_IDENTITY_LINK,
 				oaParam);
 
@@ -349,7 +316,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 		//Removed in MOA-ID 2.0
 		//verifyInfoboxes(session, infoboxReadResponseParameters, false);
 
-		MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+		revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 				pendingReq, MOAIDEventConstants.AUTHPROCESS_IDL_VALIDATED);
 		
 		return "found!";
@@ -379,15 +346,11 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 	 * @return String representation of the
 	 * <code>&lt;CreateXMLSignatureRequest&gt;</code>
 	 */
-	public String verifyCertificate(AuthenticationSession session,
+	public void verifyCertificate(AuthenticationSession session,
 			X509Certificate certificate, IRequest pendingReq) throws AuthenticationException,
 			BuildException, ParseException, ConfigurationException,
 			ValidateException, ServiceException, MOAIDException {
 
-		if (session == null)
-			throw new AuthenticationException("auth.10", new Object[]{
-					REQ_VERIFY_CERTIFICATE, PARAM_SESSIONID});
-
 		// check if person is a Organwalter
 		// if true - don't show bPK in AUTH Block
 		try {
@@ -403,16 +366,6 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 			session.setOW(false);
 		}
 
-		AuthConfiguration authConf = AuthConfigurationProviderFactory
-				.getInstance();
-
-		OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance()
-				.getOnlineApplicationParameter(session.getPublicOAURLPrefix());
-
-		String returnvalue = getCreateXMLSignatureRequestAuthBlockOrRedirect(session,
-				authConf, oaParam, pendingReq);
-
-		return returnvalue;
 	}
 
 	/**
@@ -426,6 +379,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 	 * layer implementation</li>
 	 * </ul>
 	 * @param pendingReq 
+	 * @param pendingReq 
 	 *
 	 * @param sessionID                     ID of associated authentication session data
 	 * @param infoboxReadResponseParameters The parameters from the response returned from the BKU
@@ -433,7 +387,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 	 * @return String representation of the
 	 * <code>&lt;CreateXMLSignatureRequest&gt;</code>
 	 */
-	public void verifyMandate(AuthenticationSession session, MISMandate mandate)
+	public void verifyMandate(IRequest pendingReq, AuthenticationSession session, MISMandate mandate)
 			throws AuthenticationException, BuildException, ParseException,
 			ConfigurationException, ValidateException, ServiceException {
 
@@ -441,9 +395,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 			throw new AuthenticationException("auth.10", new Object[]{
 					GET_MIS_SESSIONID, PARAM_SESSIONID});
 
-		OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance()
-				.getOnlineApplicationParameter(session.getPublicOAURLPrefix());
-
+		IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
 		try {
 			// sets the extended SAML attributes for OID (Organwalter)
 			setExtendedSAMLAttributeForMandatesOID(session, mandate, oaParam
@@ -470,8 +422,6 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 
 	/**
 	 * @param session
-	 * @param authConf
-	 * @param oaParam
 	 * @param pendingReq 
 	 * @return
 	 * @throws ConfigurationException
@@ -479,26 +429,16 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 	 * @throws ValidateException
 	 */
 	public String getCreateXMLSignatureRequestAuthBlockOrRedirect(
-			AuthenticationSession session, AuthConfiguration authConf,
-			OAAuthParameter oaParam, IRequest pendingReq) throws ConfigurationException,
+			AuthenticationSession session, IRequest pendingReq) throws ConfigurationException,
 			BuildException, ValidateException {
 
-		//        // check for intermediate processing of the infoboxes
-		//        if (session.isValidatorInputPending())
-		//            return "Redirect to Input Processor";
-
-		if (authConf == null)
-			authConf = AuthConfigurationProviderFactory.getInstance();
-		if (oaParam == null)
-			oaParam = AuthConfigurationProviderFactory.getInstance()
-			.getOnlineApplicationParameter(
-					session.getPublicOAURLPrefix());
+		IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
 
 		// builds the AUTH-block
 		String authBlock = buildAuthenticationBlock(session, oaParam, pendingReq);
 
 		// builds the <CreateXMLSignatureRequest>
-		List<String> transformsInfos = authConf.getTransformsInfos();
+		List<String> transformsInfos = authConfig.getTransformsInfos();
 
 		String createXMLSignatureRequest = new CreateXMLSignatureRequestBuilder()
 		.build(authBlock, oaParam.getKeyBoxIdentifier(),
@@ -511,112 +451,26 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 	 * <ul>
 	 * <li>Creates an CreateXMLSignatureRequest to be signed by the user</li>
 	 * </ul>
+	 * @param pendingReq 
 	 *
 	 * @param sessionID ID of associated authentication session data
 	 * @param cert      The certificate from the user
 	 * @return String representation of the
 	 * <code>&lt;CreateXMLSignatureRequest&gt;</code>
 	 */
-	public String createXMLSignatureRequestForeignID(AuthenticationSession session,
+	public String createXMLSignatureRequestForeignID(IRequest pendingReq,
 			X509Certificate cert) throws AuthenticationException,
 			BuildException, ParseException, ConfigurationException,
 			ValidateException, ServiceException {
 
-		if (session == null)
-			throw new AuthenticationException("auth.10", new Object[]{
-					REQ_VERIFY_CERTIFICATE, PARAM_SESSIONID});
-
-		AuthConfiguration authConf = AuthConfigurationProviderFactory
-				.getInstance();
-
-		OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance()
-				.getOnlineApplicationParameter(session.getPublicOAURLPrefix());
-
-		return getCreateXMLSignatureRequestForeigID(session, authConf, oaParam,
-				cert);
-	}
-
-	public String getCreateXMLSignatureRequestForeigID(
-			AuthenticationSession session, AuthConfiguration authConf,
-			OAAuthParameter oaParam, X509Certificate cert)
-					throws ConfigurationException {
-
-		//        // check for intermediate processing of the infoboxes
-		//        if (session.isValidatorInputPending())
-		//            return "Redirect to Input Processor";
-
-		if (authConf == null)
-			authConf = AuthConfigurationProviderFactory.getInstance();
-		if (oaParam == null)
-			oaParam = AuthConfigurationProviderFactory.getInstance()
-			.getOnlineApplicationParameter(
-					session.getPublicOAURLPrefix());
-
 		Principal subject = cert.getSubjectDN();
 
 		String createXMLSignatureRequest = new CreateXMLSignatureRequestBuilder()
-		.buildForeignID(subject.toString(), oaParam, session);
+				.buildForeignID(subject.toString(), pendingReq);
 		return createXMLSignatureRequest;
+		
 	}
 
-//	/**
-//	 * Processes an <code>&lt;CreateXMLSignatureResponse&gt;</code> sent by the
-//	 * security layer implementation.<br>
-//	 * <ul>
-//	 * <li>Validates given <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
-//	 * <li>Parses response enclosed in
-//	 * <code>&lt;CreateXMLSignatureResponse&gt;</code></li>
-//	 * <li>Verifies signature by calling the MOA SP component</li>
-//	 * <li>Returns the signer certificate</li>
-//	 * </ul>
-//	 *
-//	 * @param sessionID                            ID of associated authentication session data
-//	 * @param createXMLSignatureResponseParameters The parameters from the response returned from the BKU
-//	 *                                             including the <code>&lt;CreateXMLSignatureResponse&gt;</code>
-//	 * @throws BKUException
-//	 */
-//	public X509Certificate verifyXMLSignature(String sessionID,
-//			Map<String, String> createXMLSignatureResponseParameters)
-//					throws AuthenticationException, BuildException, ParseException,
-//					ConfigurationException, ValidateException, ServiceException, BKUException {
-//
-//		if (isEmpty(sessionID))
-//			throw new AuthenticationException("auth.10", new Object[]{
-//					REQ_GET_FOREIGN_ID, PARAM_SESSIONID});
-//
-//		String xmlCreateXMLSignatureResponse = (String) createXMLSignatureResponseParameters
-//				.get(PARAM_XMLRESPONSE);
-//
-//		if (isEmpty(xmlCreateXMLSignatureResponse))
-//			throw new AuthenticationException("auth.10", new Object[]{
-//					REQ_GET_FOREIGN_ID, PARAM_XMLRESPONSE});
-//
-//		AuthConfiguration authConf = AuthConfigurationProviderFactory
-//				.getInstance();
-//
-//		// parses the <CreateXMLSignatureResponse>
-//		CreateXMLSignatureResponseParser p = new CreateXMLSignatureResponseParser(
-//				xmlCreateXMLSignatureResponse);
-//		CreateXMLSignatureResponse createXMLSignatureResponse = p
-//				.parseResponseDsig();
-//
-//		// builds a <VerifyXMLSignatureRequest> for a call of MOA-SP
-//		Element domVerifyXMLSignatureRequest = new VerifyXMLSignatureRequestBuilder()
-//		.buildDsig(createXMLSignatureResponse, authConf
-//				.getMoaSpAuthBlockTrustProfileID());
-//
-//		// invokes the call
-//		Element domVerifyXMLSignatureResponse = new SignatureVerificationInvoker()
-//		.verifyXMLSignature(domVerifyXMLSignatureRequest);
-//
-//		// parses the <VerifyXMLSignatureResponse>
-//		VerifyXMLSignatureResponse verifyXMLSignatureResponse = new VerifyXMLSignatureResponseParser(
-//				domVerifyXMLSignatureResponse).parseData();
-//
-//		return verifyXMLSignatureResponse.getX509certificate();
-//
-//	}
-
 	/**
 	 * Processes an <code>&lt;CreateXMLSignatureResponse&gt;</code> sent by the
 	 * security layer implementation.<br>
@@ -634,15 +488,11 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 	 *                                      including the <code>&lt;ReadInfoboxResponse&gt;</code>
 	 * @throws BKUException
 	 */
-	public X509Certificate getCertificate(IRequest pendingReq, String sessionID,
+	public X509Certificate getCertificate(IRequest pendingReq,
 			Map<String, String> readInfoboxResponseParameters) throws AuthenticationException,
 			BuildException, ParseException, ConfigurationException,
 			ValidateException, ServiceException, BKUException {
 
-		if (isEmpty(sessionID))
-			throw new AuthenticationException("auth.10", new Object[]{
-					REQ_VERIFY_CERTIFICATE, PARAM_SESSIONID});
-
 		String xmlReadInfoboxResponse = (String) readInfoboxResponseParameters
 				.get(PARAM_XMLRESPONSE);
 
@@ -655,7 +505,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 				xmlReadInfoboxResponse);
 		X509Certificate cert = p.parseCertificate();
 
-		MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+		revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 				pendingReq, MOAIDEventConstants.AUTHPROCESS_CERTIFICATE_VALIDATED);
 		
 		return cert;
@@ -673,7 +523,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 	 *                        to be appended to the AUTH-Block.
 	 */
 	private String buildAuthenticationBlock(AuthenticationSession session,
-			OAAuthParameter oaParam, IRequest pendingReq) throws BuildException {
+			IOAAuthParameters oaParam, IRequest pendingReq) throws BuildException {
 
 		IdentityLink identityLink = session.getIdentityLink();
 		String issuer = identityLink.getName();
@@ -682,8 +532,16 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 		String identificationValue = null;
 		String identificationType = null;
 
+		//get processing data from pending-request
+		String authURL = pendingReq.getAuthURL();
+		String requestedTarget = pendingReq.getGenericData(
+				MOAIDAuthConstants.AUTHPROCESS_DATA_TARGET, String.class);		
+		String targetFriendlyName = pendingReq.getGenericData(
+				MOAIDAuthConstants.AUTHPROCESS_DATA_TARGETFRIENDLYNAME, String.class);
+
+		
 		//set empty AuthBlock BPK in case of OW or SSO or bpk is not requested
-		if (session.isOW() || session.isSsoRequested() || oaParam.isRemovePBKFromAuthBlock()) {
+		if (session.isOW() || pendingReq.needSingleSignOnFunctionality() || oaParam.isRemovePBKFromAuthBlock()) {
 			identificationType = "";
 			identificationValue = "";
 
@@ -700,11 +558,11 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 				else
 					identificationType = Constants.URN_PREFIX_WBPK + "+" + oaParam.getIdentityLinkDomainIdentifier();
 
-			} else {
+			} else {				
 				String bpkBase64 = new BPKBuilder().buildBPK(identityLink
-						.getIdentificationValue(), session.getTarget());
+						.getIdentificationValue(), requestedTarget);
 				identificationValue = bpkBase64;
-				identificationType = Constants.URN_PREFIX_CDID + "+" + session.getTarget();
+				identificationType = Constants.URN_PREFIX_CDID + "+" + requestedTarget;
 			}
 
 
@@ -714,12 +572,10 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 
 		}
 
+		//set AuthBlock generation time to session
 		String issueInstant = DateTimeUtils.buildDateTimeUTC(Calendar
 				.getInstance());
 		session.setIssueInstant(issueInstant);
-		String authURL = session.getAuthURL();
-		String target = session.getTarget();
-		String targetFriendlyName = session.getTargetFriendlyName();
 
 		// Bug #485
 		// (https://egovlabs.gv.at/tracker/index.php?func=detail&aid=485&group_id=6&atid=105)
@@ -728,22 +584,22 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 		List<ExtendedSAMLAttribute> extendedSAMLAttributes = session.getExtendedSAMLAttributesAUTH();
 
 
-		if (session.isSsoRequested()) {
+		if (pendingReq.needSingleSignOnFunctionality()) {
 			String oaURL = pendingReq.getAuthURL();
 			if (MiscUtil.isNotEmpty(oaURL))
 				oaURL = oaURL.replaceAll("&", "&amp;");
 
 			String authBlock = new AuthenticationBlockAssertionBuilder()
-			.buildAuthBlockSSO(issuer, issueInstant, authURL, target,
+			.buildAuthBlockSSO(issuer, issueInstant, authURL, requestedTarget,
 					targetFriendlyName, identificationValue,
 					identificationType, oaURL, gebDat,
 					extendedSAMLAttributes, session, oaParam);
 			return authBlock;
 
-		} else {
-			String oaURL = session.getPublicOAURLPrefix().replaceAll("&", "&amp;");
+		} else {			
+			String oaURL = oaParam.getPublicURLPrefix().replaceAll("&", "&amp;");
 			String authBlock = new AuthenticationBlockAssertionBuilder()
-			.buildAuthBlock(issuer, issueInstant, authURL, target,
+			.buildAuthBlock(issuer, issueInstant, authURL, requestedTarget,
 					targetFriendlyName, identificationValue,
 					identificationType, oaURL, gebDat,
 					extendedSAMLAttributes, session, oaParam);
@@ -1066,8 +922,6 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 			throw new AuthenticationException("auth.10", new Object[]{
 					REQ_VERIFY_AUTH_BLOCK, PARAM_XMLRESPONSE});
 
-		AuthConfiguration authConf = AuthConfigurationProviderFactory
-				.getInstance();
 		// parses <CreateXMLSignatureResponse>
 		CreateXMLSignatureResponse csresp = new CreateXMLSignatureResponseParser(
 				xmlCreateXMLSignatureReadResponse).parseResponse();
@@ -1084,14 +938,15 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 					REQ_VERIFY_AUTH_BLOCK, PARAM_XMLRESPONSE});
 		}
 		// validates <CreateXMLSignatureResponse>
-		if (session.isSsoRequested())
+		if (pendingReq.needSingleSignOnFunctionality())
 			new CreateXMLSignatureResponseValidator().validateSSO(csresp, session, pendingReq);
+		
 		else
 			new CreateXMLSignatureResponseValidator().validate(csresp, session, pendingReq);
 
 		// builds a <VerifyXMLSignatureRequest> for a MOA-SPSS call
-		List<String> vtids = authConf.getMoaSpAuthBlockVerifyTransformsInfoIDs();
-		String tpid = authConf.getMoaSpAuthBlockTrustProfileID(pendingReq.getOnlineApplicationConfiguration().isUseAuthBlockTestTestStore());
+		List<String> vtids = authConfig.getMoaSpAuthBlockVerifyTransformsInfoIDs();
+		String tpid = authConfig.getMoaSpAuthBlockTrustProfileID(pendingReq.getOnlineApplicationConfiguration().isUseAuthBlockTestTestStore());
 		Element domVsreq = new VerifyXMLSignatureRequestBuilder().build(csresp,
 				vtids, tpid);
 		// debug output
@@ -1100,8 +955,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 
 		//        try {
 		// invokes the call
-		domVsresp = new SignatureVerificationInvoker()
-		.verifyXMLSignature(domVsreq);
+		domVsresp = SignatureVerificationInvoker.getInstance().verifyXMLSignature(domVsreq);
 
 		// parses the <VerifyXMLSignatureResponse>
 		VerifyXMLSignatureResponse vsresp = new VerifyXMLSignatureResponseParser(
@@ -1121,8 +975,7 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 			}
 		}
 
-		OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance()
-				.getOnlineApplicationParameter(session.getPublicOAURLPrefix());
+		IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
 
 		// validates the <VerifyXMLSignatureResponse>
 		VerifyXMLSignatureResponseValidator.getInstance().validate(vsresp,
@@ -1163,10 +1016,10 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 		//set QAA Level four in case of card authentifcation
 		session.setQAALevel(PVPConstants.STORK_QAA_1_4);
 		
-		MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+		revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 				pendingReq, MOAIDEventConstants.AUTHPROCESS_AUTHBLOCK_VALIDATED);
 		
-		MOAReversionLogger.getInstance().logPersonalInformationEvent(pendingReq, session.getIdentityLink() 
+		revisionsLogger.logPersonalInformationEvent(pendingReq, session.getIdentityLink() 
 				);
 	}
 
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKAgeAttributBuilder.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/CitizenCardAuthenticationSpringResourceProvider.java
index dff93139c..ea22b8c4f 100644
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKAgeAttributBuilder.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/CitizenCardAuthenticationSpringResourceProvider.java
@@ -1,4 +1,4 @@
-/*******************************************************************************
+/*
  * Copyright 2014 Federal Chancellery Austria
  * MOA-ID has been developed in a cooperation between BRZ, the Federal
  * Chancellery Austria - ICT staff unit, and Graz University of Technology.
@@ -19,31 +19,45 @@
  * file for details on the various modules and licenses.
  * The "NOTICE" text file is part of the distribution. Any derivative works
  * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.builder.attributes;
+ */
+package at.gv.egovernment.moa.id.auth;
 
-import at.gv.egovernment.moa.id.auth.stork.STORKConstants;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
 
-public class STORKAgeAttributBuilder implements IPVPAttributeBuilder  {
+import at.gv.egiz.components.spring.api.SpringResourceProvider;
 
-	public String getName() {
-		return STORKConstants.AGE_NAME;
-	}
+/**
+ * @author tlenz
+ *
+ */
+public class CitizenCardAuthenticationSpringResourceProvider implements SpringResourceProvider {
 
-	public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
-			IAttributeGenerator<ATT> g) throws AttributeException {
+	/* (non-Javadoc)
+	 * @see at.gv.egiz.components.spring.api.SpringResourceProvider#getResourcesToLoad()
+	 */
+	@Override
+	public Resource[] getResourcesToLoad() {
+		ClassPathResource citizenCardAuthConfig = new ClassPathResource("/moaid_citizencard_auth.beans.xml", CitizenCardAuthenticationSpringResourceProvider.class);					
 		
-		return g.buildStringAttribute(STORKConstants.AGE_FRIENDLYNAME, STORKConstants.AGE_NAME, 
-				STORKAttributHelper.getAttribut(STORKConstants.AGE_NAME, authData)); 
-					
+		return new Resource[] {citizenCardAuthConfig};	
 	}
 
-	public <ATT> ATT buildEmpty(IAttributeGenerator<ATT> g) {
-		return g.buildEmptyAttribute(STORKConstants.AGE_FRIENDLYNAME, STORKConstants.AGE_NAME);
+	/* (non-Javadoc)
+	 * @see at.gv.egiz.components.spring.api.SpringResourceProvider#getPackagesToScan()
+	 */
+	@Override
+	public String[] getPackagesToScan() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egiz.components.spring.api.SpringResourceProvider#getName()
+	 */
+	@Override
+	public String getName() {
+		return "MOA-ID-CitizenCardAuthentication SpringResourceProvider";
 	}
 
 }
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationBlockAssertionBuilder.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationBlockAssertionBuilder.java
index 760d28d5b..e51700111 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationBlockAssertionBuilder.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationBlockAssertionBuilder.java
@@ -48,11 +48,10 @@ import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttribute;
 import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttributeImpl;
 import at.gv.egovernment.moa.id.auth.exception.BuildException;
 import at.gv.egovernment.moa.id.auth.exception.ParseException;
-import at.gv.egovernment.moa.id.config.ConfigurationException;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 import at.gv.egovernment.moa.id.config.TargetToSectorNameMapper;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
 import at.gv.egovernment.moa.id.util.Random;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.Constants;
@@ -175,7 +174,7 @@ public class AuthenticationBlockAssertionBuilder extends AuthenticationAssertion
     String gebDat,
     List<ExtendedSAMLAttribute> extendedSAMLAttributes,
     AuthenticationSession session,
-    OAAuthParameter oaParam)
+    IOAAuthParameters oaParam)
   throws BuildException
   
   {
@@ -233,9 +232,10 @@ public class AuthenticationBlockAssertionBuilder extends AuthenticationAssertion
     	  extendedSAMLAttributes.add(bpkAttribute);
       }
       
-      boolean useMandate = session.getUseMandate();
+      boolean useMandate = session.isMandateUsed();
       if (useMandate) {
-    	  String mandateReferenceValue = Random.nextRandom();
+    	  //String mandateReferenceValue = Random.nextRandom();
+    	  String mandateReferenceValue = Random.nextProcessReferenceValue();
     	  // remove leading "-"
     	  if (mandateReferenceValue.startsWith("-"))
     		  mandateReferenceValue = mandateReferenceValue.substring(1);
@@ -264,15 +264,9 @@ public class AuthenticationBlockAssertionBuilder extends AuthenticationAssertion
     
     
     String text = "";
-    try {
-		OAAuthParameter oaparam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(session.getPublicOAURLPrefix());		
-		if (MiscUtil.isNotEmpty(oaparam.getAditionalAuthBlockText())) {
-			Logger.debug("Use addional AuthBlock Text from OA=" + oaparam.getPublicURLPrefix());
-			text = oaparam.getAditionalAuthBlockText();
-		}
-		
-	} catch (ConfigurationException e) {
-		Logger.warn("Addional AuthBlock Text can not loaded from OA!", e);
+    if (MiscUtil.isNotEmpty(oaParam.getAditionalAuthBlockText())) {
+		Logger.debug("Use addional AuthBlock Text from OA=" + oaParam.getPublicURLPrefix());
+		text = oaParam.getAditionalAuthBlockText();
 	}
     
    	String specialText =  MessageFormat.format(SPECIAL_TEXT_ATTRIBUTE, 
@@ -345,25 +339,14 @@ public class AuthenticationBlockAssertionBuilder extends AuthenticationAssertion
     String oaURL, 
     String gebDat,
     List<ExtendedSAMLAttribute> extendedSAMLAttributes,
-    AuthenticationSession session)
+    AuthenticationSession session,
+    IOAAuthParameters oaParam)
   throws BuildException
   {
     session.setSAMLAttributeGebeORwbpk(true);
     String gebeORwbpk = "";
     String wbpkNSDeclaration = "";
-    
-    //BZ.., reading OA parameters
-    OAAuthParameter oaParam;
-   try {
-      oaParam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(
-           session.getPublicOAURLPrefix());
-   } catch (ConfigurationException e) {
-      Logger.error("Error on building AUTH-Block: " + e.getMessage());
-         throw new BuildException("builder.00", new Object[] { "AUTH-Block", e.toString()});
-   }
-   //..BZ
-    
-    
+        
     if (target == null) {
       // OA is a business application
       if (!Constants.URN_PREFIX_HPI.equals(identityLinkType)) {
@@ -419,14 +402,9 @@ public class AuthenticationBlockAssertionBuilder extends AuthenticationAssertion
     //..BZ
     
     String text = "";
-    try {
-		OAAuthParameter oaparam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(session.getPublicOAURLPrefix());
-		if (MiscUtil.isNotEmpty(oaparam.getAditionalAuthBlockText())) {
-			Logger.debug("Use addional AuthBlock Text from OA=" + oaparam.getPublicURLPrefix());
-			text = oaparam.getAditionalAuthBlockText();
-		}
-	} catch (ConfigurationException e) {
-		Logger.warn("Addional AuthBlock Text can not loaded from OA!", e);
+    if (MiscUtil.isNotEmpty(oaParam.getAditionalAuthBlockText())) {
+		Logger.debug("Use addional AuthBlock Text from OA=" + oaParam.getPublicURLPrefix());
+		text = oaParam.getAditionalAuthBlockText();
 	}
     
    	String specialText =  MessageFormat.format(SPECIAL_TEXT_ATTRIBUTE, 
@@ -511,9 +489,10 @@ public class AuthenticationBlockAssertionBuilder extends AuthenticationAssertion
 		           
 		    if (target != null) {
 		      
-		      boolean useMandate = session.getUseMandate();
+		      boolean useMandate = session.isMandateUsed();
 		      if (useMandate) {
-		    	  String mandateReferenceValue = Random.nextRandom();
+		    	  //String mandateReferenceValue = Random.nextRandom();
+		    	  String mandateReferenceValue = Random.nextProcessReferenceValue();
 		    	  // remove leading "-"
 		    	  if (mandateReferenceValue.startsWith("-"))
 		    		  mandateReferenceValue = mandateReferenceValue.substring(1);
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetIdentityLinkFormBuilder.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetIdentityLinkFormBuilder.java
index dc981ba33..18495381e 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetIdentityLinkFormBuilder.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetIdentityLinkFormBuilder.java
@@ -49,11 +49,11 @@ package at.gv.egovernment.moa.id.auth.builder;
 import java.io.IOException;
 import java.io.StringReader;
 import java.io.StringWriter;
-import java.util.Map;
 
 import at.gv.egovernment.moa.id.auth.exception.BuildException;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.util.FormBuildUtils;
+import at.gv.egovernment.moa.id.auth.frontend.utils.FormBuildUtils;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.config.MOAIDConfigurationConstants;
 import at.gv.egovernment.moa.util.MiscUtil;
 
 /**
@@ -165,31 +165,32 @@ public class GetIdentityLinkFormBuilder extends Builder {
     htmlForm = replaceTag(htmlForm, PUSHINFOBOX_TAG, pushInfobox, false, ALL);
 //new:wird oben mitreplaced    htmlForm = replaceTag(htmlForm, BKU_TAG, bkuURL);
     
-    //removed in MOA-ID 2.0
-//    htmlForm = replaceTag(htmlForm, CERTINFO_XMLREQUEST_TAG, encodeParameter(certInfoXMLRequest), true, ALL);
-//    htmlForm = replaceTag(htmlForm, CERTINFO_DATAURL_TAG, certInfoDataURL, true, ALL);
+     
+    //set applet-background coller
+   	if (oaParam != null && MiscUtil.isNotEmpty(oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_AUTH_TEMPLATES_CUSTOMIZATION_BACKGROUNDCOLOR)))
+   		htmlForm = replaceTag(htmlForm, COLOR_TAG, 
+   				oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_AUTH_TEMPLATES_CUSTOMIZATION_BACKGROUNDCOLOR), false, ALL);    	
+   	else
+		htmlForm = replaceTag(htmlForm, COLOR_TAG, FormBuildUtils.getDefaultMap().get(FormBuildUtils.PARAM_MAIN_BACKGROUNDCOLOR), false, ALL);
+    	
+   	//set redirect target
+   	if (oaParam != null && MiscUtil.isNotEmpty(oaParam.getConfigurationValue(oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_AUTH_TEMPLATES_CUSTOMIZATION_APPLETREDIRECTTARGET))))
+   		htmlForm = replaceTag(htmlForm, REDIRECTTARGETTAG, 
+   				oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_AUTH_TEMPLATES_CUSTOMIZATION_APPLETREDIRECTTARGET), false, ALL);
+   	else
+   		htmlForm = replaceTag(htmlForm, REDIRECTTARGETTAG, FormBuildUtils.getDefaultMap().get(FormBuildUtils.PARAM_REDIRECTTARGET), false, ALL);
     
-    Map<String, String> map = null;
-    
-    if (oaParam != null) {
-    	map = oaParam.getFormCustomizaten();
-    	htmlForm = replaceTag(htmlForm, COLOR_TAG, map.get(FormBuildUtils.MAIN_BACKGROUNDCOLOR), false, ALL);
-    	htmlForm = replaceTag(htmlForm, REDIRECTTARGETTAG, map.get(FormBuildUtils.REDIRECTTARGET), false, ALL);
-    	    	
-    } else {
-    	htmlForm = replaceTag(htmlForm, COLOR_TAG, FormBuildUtils.getDefaultMap().get(FormBuildUtils.MAIN_BACKGROUNDCOLOR), false, ALL);
-		htmlForm = replaceTag(htmlForm, REDIRECTTARGETTAG, FormBuildUtils.getDefaultMap().get(FormBuildUtils.REDIRECTTARGET), false, ALL);
-    }
-    
-    if (map != null && MiscUtil.isNotEmpty(map.get(FormBuildUtils.APPLET_HEIGHT)))
-    	htmlForm = replaceTag(htmlForm, APPLETHEIGHT_TAG, map.get(FormBuildUtils.APPLET_HEIGHT), false, ALL);
+   	//set applet heigh
+    if (oaParam != null && MiscUtil.isNotEmpty(oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_AUTH_TEMPLATES_CUSTOMIZATION_APPLETHEIGHT)))
+    	htmlForm = replaceTag(htmlForm, APPLETHEIGHT_TAG, oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_AUTH_TEMPLATES_CUSTOMIZATION_APPLETHEIGHT), false, ALL);
     else if (MiscUtil.isNotEmpty(appletheigth))
     	htmlForm = replaceTag(htmlForm, APPLETHEIGHT_TAG, appletheigth, false, ALL);
     else
     	htmlForm = replaceTag(htmlForm, APPLETHEIGHT_TAG, "160", false, ALL);
     
-    if (map != null && MiscUtil.isNotEmpty(map.get(FormBuildUtils.APPLET_WIDTH)))
-    	htmlForm = replaceTag(htmlForm, APPLETWIDTH_TAG, map.get(FormBuildUtils.APPLET_WIDTH), false, ALL);
+    //set applet width
+    if (oaParam != null && MiscUtil.isNotEmpty(oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_AUTH_TEMPLATES_CUSTOMIZATION_APPLETWIDTH)))
+    	htmlForm = replaceTag(htmlForm, APPLETWIDTH_TAG, oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_AUTH_TEMPLATES_CUSTOMIZATION_APPLETWIDTH), false, ALL);
     else if (MiscUtil.isNotEmpty(appletwidth))
     	htmlForm = replaceTag(htmlForm, APPLETWIDTH_TAG, appletwidth, false, ALL); 
     else
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/SAMLResponseBuilder.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/SAMLResponseBuilder.java
index 8b0d906fe..306c871fc 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/SAMLResponseBuilder.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/SAMLResponseBuilder.java
@@ -123,7 +123,8 @@ public class SAMLResponseBuilder implements Constants {
         statusMessage, 
         StringUtils.removeXMLDeclaration(samlAssertion) });
   		Element domResponse = DOMUtils.parseDocument(xmlResponse, false, ALL_SCHEMA_LOCATIONS, null).getDocumentElement();
-		  return domResponse;
+		return domResponse;
+		
   	}
   	catch (Throwable ex) {
   		throw new BuildException(
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/StartAuthenticationBuilder.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/StartAuthenticationBuilder.java
deleted file mode 100644
index 5c1b12e0d..000000000
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/StartAuthenticationBuilder.java
+++ /dev/null
@@ -1,70 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- * 
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- * 
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- ******************************************************************************/
-package at.gv.egovernment.moa.id.auth.builder;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import at.gv.egovernment.moa.id.auth.AuthenticationServer;
-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
-import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
-import at.gv.egovernment.moa.logging.Logger;
-
-public class StartAuthenticationBuilder {
-
-	private static StartAuthenticationBuilder instance = null;
-	
-	public static StartAuthenticationBuilder getInstance() {
-		if (instance == null) {
-			instance = new StartAuthenticationBuilder();
-		}
-		return instance;
-	}
-	
-	
-	/**
-	 * Depending on the selected citizen's country ({@code moasession.ccc}):
-	 * <ul>
-	 * <li><strong>Either</strong> creates an "IdentityLinkForm" with embedded {@code InfoBoxReadRequest} to be submitted to a citizen card
-	 * environment for reading the subject's IdentityLink</li>
-	 * </ul>
-	 * 
-	 * @return The IdentityLinkForm.
-	 */
-	public String build(AuthenticationSession moasession, HttpServletRequest req,
-			HttpServletResponse resp) throws WrongParametersException, MOAIDException {
-		
-		if (moasession == null) {
-			throw new AuthenticationException("auth.18", new Object[] { });
-		}
-		  
-    	//normal MOA-ID authentication
-    	Logger.debug("Starting normal MOA-ID authentication");
-	    			    	    	
-    	String getIdentityLinkForm = AuthenticationServer.getInstance().startAuthentication(moasession, req);	   
-
-    	return getIdentityLinkForm;
-	}
-}
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java
deleted file mode 100644
index 72a7d3ba1..000000000
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java
+++ /dev/null
@@ -1,142 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- * 
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- * 
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- ******************************************************************************/
-/*
- * Copyright 2003 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- */
-
-
-package at.gv.egovernment.moa.id.auth.invoke;
-
-import java.util.Vector;
-
-import javax.xml.namespace.QName;
-import javax.xml.rpc.Call;
-import javax.xml.rpc.Service;
-import javax.xml.rpc.ServiceFactory;
-
-import org.apache.axis.message.SOAPBodyElement;
-import org.w3c.dom.Document;
-import org.w3c.dom.Element;
-
-import at.gv.egovernment.moa.id.auth.exception.ServiceException;
-import at.gv.egovernment.moa.id.config.ConnectionParameter;
-import at.gv.egovernment.moa.id.config.auth.AuthConfiguration;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.spss.api.SignatureVerificationService;
-import at.gv.egovernment.moa.spss.api.xmlbind.VerifyXMLSignatureRequestParser;
-import at.gv.egovernment.moa.spss.api.xmlbind.VerifyXMLSignatureResponseBuilder;
-import at.gv.egovernment.moa.spss.api.xmlverify.VerifyXMLSignatureRequest;
-import at.gv.egovernment.moa.spss.api.xmlverify.VerifyXMLSignatureResponse;
-import at.gv.egovernment.moa.util.MiscUtil;
-
-/**
- * Invoker of the <code>SignatureVerification</code> web service of MOA-SPSS.<br>
- * Either invokes the web service, or calls the corresponding API, depending on configuration data.
- * 
- * @author Stefan Knirsch
- * @version $Id$
- */
-public class SignatureVerificationInvoker {
-  /** This QName Object identifies the SignatureVerification endpoint of the web service */
-  private static final QName SERVICE_QNAME = new QName("SignatureVerification");
-
-  /**
-   * Method verifyXMLSignature.
-   * @param request to be sent
-   * @return Element with the answer
-   * @throws ServiceException if an error occurs
-   */
-  public Element verifyXMLSignature(Element request) throws ServiceException {
-    return doCall(SERVICE_QNAME, request);
-  }
-
-  /**
-   * Method doCall.
-   * @param serviceName the name of the service
-   * @param request the request to be sent
-   * @return Element the answer
-   * @throws ServiceException if an error occurs
-   */
-  protected Element doCall(QName serviceName, Element request) throws ServiceException {
-    ConnectionParameter authConnParam = null;
-    try {
-      Service service = ServiceFactory.newInstance().createService(serviceName);
-      Call call = service.createCall();
-      SOAPBodyElement body = new SOAPBodyElement(request);
-      SOAPBodyElement[] params = new SOAPBodyElement[] { body };
-      Vector responses;
-      SOAPBodyElement response;
-
-      String endPoint;
-      AuthConfiguration authConfigProvider = AuthConfigurationProviderFactory.getInstance();
-      authConnParam = authConfigProvider.getMoaSpConnectionParameter();
-      //If the ConnectionParameter do NOT exist, we try to get the api to work....
-      if (authConnParam != null && MiscUtil.isNotEmpty(authConnParam.getUrl())) {
-        Logger.debug("Connecting using auth url: " + authConnParam.getUrl() + ", service " + serviceName.getNamespaceURI() + " : " + serviceName.getLocalPart() + " : "+ serviceName.getPrefix());
-        endPoint = authConnParam.getUrl();
-        call.setTargetEndpointAddress(endPoint);
-        responses = (Vector) call.invoke(serviceName, params);
-        Logger.debug("Got responses: " + responses.size()); // TODO handle axis 302 response when incorrect service url is used
-        response = (SOAPBodyElement) responses.get(0);
-        return response.getAsDOM();
-      }
-      else {
-        SignatureVerificationService svs = SignatureVerificationService.getInstance();
-        VerifyXMLSignatureRequest vsrequest = new VerifyXMLSignatureRequestParser().parse(request);
-		
-        VerifyXMLSignatureResponse vsresponse = svs.verifyXMLSignature(vsrequest);
-        Document result = new VerifyXMLSignatureResponseBuilder().build(vsresponse);
-
-        //Logger.setHierarchy("moa.id.auth");
-        return result.getDocumentElement();
-      }
-    }
-    catch (Exception ex) {
-      if (authConnParam != null) {
-	      throw new ServiceException("service.00", new Object[] { ex.toString()}, ex);
-      } else {
-        throw new ServiceException("service.03", new Object[] { ex.toString()}, ex);
-      }
-    }
-  }
-}
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/DefaultAuthModuleImpl.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/DefaultCitizenCardAuthModuleImpl.java
index cac7359c7..b0efb100a 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/DefaultAuthModuleImpl.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/DefaultCitizenCardAuthModuleImpl.java
@@ -1,15 +1,16 @@
 package at.gv.egovernment.moa.id.auth.modules.internal;
 
+
 import org.apache.commons.lang3.StringUtils;
 
-import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
 import at.gv.egovernment.moa.id.auth.modules.AuthModule;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
 
 /**
  * Module descriptor
  */
-public class DefaultAuthModuleImpl implements AuthModule {
+public class DefaultCitizenCardAuthModuleImpl implements AuthModule {
 
 	@Override
 	public int getPriority() {
@@ -19,8 +20,15 @@ public class DefaultAuthModuleImpl implements AuthModule {
 	@Override
 	public String selectProcess(ExecutionContext context) {		
 		//select process if BKU is selected and it is no STORK authentication
+		
+		boolean performBKUSelection = false;
+		Object performBKUSelectionObj = context.get("performBKUSelection");
+		if (performBKUSelectionObj != null && performBKUSelectionObj instanceof Boolean)
+			performBKUSelection = (boolean) performBKUSelectionObj;
+		
 		if (StringUtils.isBlank((String) context.get("ccc")) && 
-				StringUtils.isNotBlank((String) context.get(MOAIDAuthConstants.PARAM_BKU)))
+				StringUtils.isNotBlank((String) context.get(MOAIDAuthConstants.PARAM_BKU)) &&
+				 	!performBKUSelection)
 			return "DefaultAuthentication";
 		
 		else
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CertificateReadRequestTask.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CertificateReadRequestTask.java
index 7e1bf1fc7..000a47438 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CertificateReadRequestTask.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CertificateReadRequestTask.java
@@ -1,29 +1,25 @@
 package at.gv.egovernment.moa.id.auth.modules.internal.tasks;
 
-import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.*;
+import static at.gv.egovernment.moa.id.commons.MOAIDAuthConstants.REQ_VERIFY_CERTIFICATE;
 
 import java.io.IOException;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.apache.commons.lang.StringEscapeUtils;
 import org.apache.commons.lang3.BooleanUtils;
+import org.springframework.stereotype.Component;
 
 import at.gv.egovernment.moa.id.auth.AuthenticationServer;
 import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;
 import at.gv.egovernment.moa.id.auth.builder.InfoboxReadRequestBuilderCertificate;
-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
 import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
-
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
-import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;
 import at.gv.egovernment.moa.id.util.CitizenCardServletUtils;
-import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
 import at.gv.egovernment.moa.logging.Logger;
 
 /**
@@ -36,7 +32,7 @@ import at.gv.egovernment.moa.logging.Logger;
  * </ul>
  * Expects:
  * <ul>
- * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>
+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>
  * </ul>
  * Result:
  * <ul>
@@ -46,53 +42,43 @@ import at.gv.egovernment.moa.logging.Logger;
  * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)
  *
  */
+@Component("CertificateReadRequestTask")
 public class CertificateReadRequestTask extends AbstractAuthServletTask {
 
 	@Override
 	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)
 			throws TaskExecutionException {
-
-		// TODO[branch]: Foreign citizen or mandate mode; respond with IRR for certificates, dataURL = "/VerifyCertificate"
-		Logger.info("Send InfoboxReadRequest to BKU to get signer certificate.");
-
-		setNoCachingHeaders(resp);		
+		Logger.debug("Send InfoboxReadRequest to BKU to get signer certificate.");
+					
 		try {
+			//execute default task initialization
+			defaultTaskInitialization(req, executionContext);
 		
-			String sessionID = StringEscapeUtils.escapeHtml(req.getParameter(PARAM_SESSIONID));
-			
-			// check parameter
-			if (!ParamValidatorUtils.isValidSessionID(sessionID)) {
-				throw new WrongParametersException("CertificateReadRequestTask", PARAM_SESSIONID, "auth.12");
-			}
-
-			AuthenticationSession session = AuthenticationServer.getSession(sessionID);
-
-			boolean useMandate = session.getUseMandate();
-			boolean identityLinkAvailable = BooleanUtils.isTrue((Boolean) executionContext.get("identityLinkAvailable"));
-			
+			boolean useMandate = moasession.isMandateUsed();
+			boolean identityLinkAvailable = BooleanUtils.isTrue((Boolean) executionContext.get("identityLinkAvailable"));	
 			if (!identityLinkAvailable && useMandate) {
 				Logger.error("Online-Mandate Mode for foreign citizencs not supported.");
 				throw new AuthenticationException("auth.13", null);
 			}
-
-			// change MOASessionID
-			AuthenticationSessionStoreage.changeSessionID(session);
 			
 			// create the InfoboxReadRequest to get the certificate
 			String infoboxReadRequest = new InfoboxReadRequestBuilderCertificate().build(true);
 
 			// build dataurl (to the VerifyCertificateSerlvet)
-			String dataurl = new DataURLBuilder().buildDataURL(session.getAuthURL(), REQ_VERIFY_CERTIFICATE,
-					session.getSessionID());
+			String dataurl = new DataURLBuilder().buildDataURL(pendingReq.getAuthURL(), REQ_VERIFY_CERTIFICATE,
+					pendingReq.getRequestID());
 
 			CitizenCardServletUtils.writeCreateXMLSignatureRequest(resp, infoboxReadRequest,
 					AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "VerifyIdentityLink", dataurl);
 		
 		} catch (MOAIDException ex) {
-			throw new TaskExecutionException(ex.getMessage(), ex);
+			throw new TaskExecutionException(pendingReq, ex.getMessage(), ex);
 					
 		} catch (IOException e) {
-			throw new TaskExecutionException(e.getMessage(), e);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
+			
+		} catch (MOADatabaseException e1) {
+			throw new TaskExecutionException(pendingReq, e1.getMessage(), e1);
 			
 		} finally {
 			
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateIdentityLinkFormTask.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateIdentityLinkFormTask.java
index 307074ee2..e82aa8fbb 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateIdentityLinkFormTask.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateIdentityLinkFormTask.java
@@ -1,33 +1,24 @@
 package at.gv.egovernment.moa.id.auth.modules.internal.tasks;
 
-import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.PARAM_SESSIONID;
-
 import java.io.PrintWriter;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.apache.commons.lang.StringEscapeUtils;
 import org.apache.commons.lang3.BooleanUtils;
-import org.apache.commons.lang3.ObjectUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.stereotype.Component;
 
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
-import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
 import at.gv.egovernment.moa.id.advancedlogging.TransactionIDUtils;
-import at.gv.egovernment.moa.id.auth.builder.StartAuthenticationBuilder;
-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
+import at.gv.egovernment.moa.id.auth.AuthenticationServer;
 import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
 import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
-import at.gv.egovernment.moa.id.auth.servlet.GenerateIFrameTemplateServlet;
-import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
-import at.gv.egovernment.moa.id.moduls.IRequest;
-import at.gv.egovernment.moa.id.moduls.RequestStorage;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
-import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;
 import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.MiscUtil;
 import at.gv.egovernment.moa.util.StringUtils;
 
 /**
@@ -35,14 +26,14 @@ import at.gv.egovernment.moa.util.StringUtils;
  * In detail:
  * <ul>
  * <li>Renames the moa session id.</li>
- * <li>Removes ExecutionContext property {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}.</li>
+ * <li>Removes ExecutionContext property {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}.</li>
  * <li>Creates the http form mentioned above.</li>
  * <li>Returns the http form via HttpServletResponse.</li>
  * </ul>
  * Expects:
  * <ul>
- * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID} <strong>or</strong></li>
- * <li>ExecutionContext property {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID} (in case of legacy authentication without CCE selection, where the moa session is not provided by request parameter).</li>
+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID} <strong>or</strong></li>
+ * <li>ExecutionContext property {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID} (in case of legacy authentication without CCE selection, where the moa session is not provided by request parameter).</li>
  * </ul>
  * Result:
  * <ul>
@@ -62,46 +53,27 @@ import at.gv.egovernment.moa.util.StringUtils;
  * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)
  *
  */
+@Component("CreateIdentityLinkFormTask")
 public class CreateIdentityLinkFormTask extends AbstractAuthServletTask {
 
+	@Autowired @Qualifier("CitizenCardAuthenticationServer") private AuthenticationServer authServer;
+	
 	@Override
 	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)
-			throws TaskExecutionException {
-
-		String moasessionid = StringEscapeUtils.escapeHtml(ObjectUtils.defaultIfNull(req.getParameter(PARAM_SESSIONID), (String) executionContext.get(PARAM_SESSIONID)));
-		AuthenticationSession moasession = null;
+			throws TaskExecutionException {		
 		try {
-			
-			if (MiscUtil.isEmpty(moasessionid)) {
-				Logger.warn("MOASessionID is empty.");
-				throw new MOAIDException("auth.18", new Object[] {});
-			}
-			
-			try {			
-				moasession = AuthenticationSessionStoreage.getSession(moasessionid);
+			//execute default task initialization
+			defaultTaskInitialization(req, executionContext);
+						
+	    	//normal MOA-ID authentication
+	    	Logger.debug("Starting normal MOA-ID authentication");		    			    	    	
+	    	String getIdentityLinkForm = authServer.startAuthentication(moasession, req, pendingReq);	   
 
-				AuthenticationSessionStoreage.changeSessionID(moasession);
-				executionContext.remove(PARAM_SESSIONID);
-			
-			} catch (MOADatabaseException e) {
-				Logger.info("MOASession with SessionID=" + moasessionid + " is not found in Database");
-				throw new MOAIDException("init.04", new Object[] { moasessionid });
-
-			} catch (Throwable e) {
-				Logger.info("No HTTP Session found!");
-				throw new MOAIDException("auth.18", new Object[] {});
-			}
-
-			StartAuthenticationBuilder startauth = StartAuthenticationBuilder.getInstance();
-			String getIdentityLinkForm = startauth.build(moasession, req, resp);
-
-			IRequest pendingReq = RequestStorage.getPendingRequest(
-					(String) executionContext.get("pendingRequestID"));
 			
 			if (BooleanUtils.isTrue((Boolean) executionContext.get("useMandate")))
-				MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+				revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 						pendingReq, MOAIDEventConstants.AUTHPROCESS_MANDATES_REQUESTED);			
-			MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+				revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 					pendingReq, MOAIDEventConstants.AUTHPROCESS_BKU_URL, moasession.getBkuURL());
 			
 			if (!StringUtils.isEmpty(getIdentityLinkForm)) {
@@ -109,21 +81,21 @@ public class CreateIdentityLinkFormTask extends AbstractAuthServletTask {
 				PrintWriter out = new PrintWriter(resp.getOutputStream());
 				out.print(getIdentityLinkForm);
 				out.flush();
-				Logger.debug("Finished GET " + GenerateIFrameTemplateServlet.class);
+				Logger.debug("Finished GET " + CreateIdentityLinkFormTask.class);
 			}
 			
 		} catch (WrongParametersException ex) {
-//			handleWrongParameters(ex, req, resp);
-			throw new TaskExecutionException(ex.getMessage(), ex);
+			throw new TaskExecutionException(pendingReq, ex.getMessage(), ex);
+			
 		}
 
 		catch (MOAIDException ex) {
 			Logger.info("GetIdentityLink request generation FAILED. Reason:" + ex.getMessage());
-			throw new TaskExecutionException(ex.getMessage(), ex);
+			throw new TaskExecutionException(pendingReq, ex.getMessage(), ex);
 
 		} catch (Exception e) {
 			Logger.error("CreateIdentityLinkFormTask has an interal Error.", e);
-			throw new TaskExecutionException(e.getMessage(), e);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
 
 		}
 
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GetForeignIDTask.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GetForeignIDTask.java
index b729f26e1..7cc9df30c 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GetForeignIDTask.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GetForeignIDTask.java
@@ -1,6 +1,7 @@
 package at.gv.egovernment.moa.id.auth.modules.internal.tasks;
 
-import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.*;
+import static at.gv.egovernment.moa.id.commons.MOAIDAuthConstants.PARAM_XMLRESPONSE;
+import static at.gv.egovernment.moa.id.commons.MOAIDAuthConstants.REQ_VERIFY_AUTH_BLOCK;
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
@@ -12,17 +13,15 @@ import javax.servlet.http.HttpServletResponse;
 import javax.xml.transform.TransformerException;
 
 import org.apache.commons.fileupload.FileUploadException;
-import org.apache.commons.lang.StringEscapeUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.stereotype.Component;
 import org.w3c.dom.Element;
 
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
-import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
 import at.gv.egovernment.moa.id.auth.AuthenticationServer;
-import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;
-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
 import at.gv.egovernment.moa.id.auth.data.CreateXMLSignatureResponse;
 import at.gv.egovernment.moa.id.auth.data.IdentityLink;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.auth.exception.ParseException;
 import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
 import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
@@ -31,13 +30,10 @@ import at.gv.egovernment.moa.id.auth.parser.CreateXMLSignatureResponseParser;
 import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser;
 import at.gv.egovernment.moa.id.client.SZRGWClientException;
 import at.gv.egovernment.moa.id.client.utils.SZRGWClientUtils;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
-import at.gv.egovernment.moa.id.moduls.IRequest;
-import at.gv.egovernment.moa.id.moduls.ModulUtils;
-import at.gv.egovernment.moa.id.moduls.RequestStorage;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
 import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
-import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;
 import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.DOMUtils;
@@ -48,7 +44,7 @@ import at.gv.util.xsd.srzgw.CreateIdentityLinkResponse;
  * In detail:
  * <ul>
  * <li>Renames the moa session id.</li>
- * <li>Parses the CreateXMLSignatureResponse retrieved from POST parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE}.</li>
+ * <li>Parses the CreateXMLSignatureResponse retrieved from POST parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE}.</li>
  * <li>Extracts signature and signer certificate.</li>
  * <li>Send request to SZR Gateway in order to get an identity link.</li>
  * <li>Updates moa session (sets identity link, QAA level 4, authentication data and foreigner flag).</li>
@@ -56,8 +52,8 @@ import at.gv.util.xsd.srzgw.CreateIdentityLinkResponse;
  * </ul>
  * Expects:
  * <ul>
- * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>
- * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE} containing a {@code CreateXMLSignatureResponse}.</li>
+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>
+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE} containing a {@code CreateXMLSignatureResponse}.</li>
  * </ul>
  * Result:
  * <ul>
@@ -68,16 +64,17 @@ import at.gv.util.xsd.srzgw.CreateIdentityLinkResponse;
  * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)
  *
  */
+@Component("GetForeignIDTask")
 public class GetForeignIDTask extends AbstractAuthServletTask {
 
+	@Autowired @Qualifier("CitizenCardAuthenticationServer") private AuthenticationServer authServer;
+	
 	@Override
 	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)
 			throws TaskExecutionException {
 
 		Logger.debug("POST GetForeignIDServlet");
 
-		setNoCachingHeaders(resp);
-
 		Map<String, String> parameters;
 
 		try {
@@ -85,41 +82,28 @@ public class GetForeignIDTask extends AbstractAuthServletTask {
 			
 		} catch (FileUploadException | IOException e) {
 			Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());
-			throw new TaskExecutionException("Parsing mulitpart/form-data request parameters failed", new IOException(e.getMessage()));
+			throw new TaskExecutionException(pendingReq, "Parsing mulitpart/form-data request parameters failed", new IOException(e.getMessage()));
 		}
 		
-		String sessionID = StringEscapeUtils.escapeHtml(req.getParameter(PARAM_SESSIONID));
-		String pendingRequestID = null;
-		String redirectURL = null;
-		AuthenticationSession session = null;
 		try {
-			// check parameter
-			if (!ParamValidatorUtils.isValidSessionID(sessionID)) {
-				throw new WrongParametersException("GetForeignID", PARAM_SESSIONID, "auth.12");
-			}
+			//check if response exists
 			String xmlCreateXMLSignatureResponse = (String) parameters.get(PARAM_XMLRESPONSE);
 			if (!ParamValidatorUtils.isValidXMLDocument(xmlCreateXMLSignatureResponse)) {
 				throw new WrongParametersException("GetForeignID", PARAM_XMLRESPONSE, "auth.12");
+				
 			}
-			pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID);
-			session = AuthenticationServer.getSession(sessionID);
-
-			IRequest pendingReq = RequestStorage.getPendingRequest(
-					(String) executionContext.get("pendingRequestID"));			
-			MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
-					pendingReq, MOAIDEventConstants.AUTHPROCESS_BKU_DATAURL_IP, req.getRemoteHost());
-			
-			// change MOASessionID
-			sessionID = AuthenticationSessionStoreage.changeSessionID(session);
-
 			Logger.debug(xmlCreateXMLSignatureResponse);
-
+			
+			//execute default task initialization
+			defaultTaskInitialization(req, executionContext);
+			
+		
 			CreateXMLSignatureResponse csresp = new CreateXMLSignatureResponseParser(xmlCreateXMLSignatureResponse)
 					.parseResponseDsig();
 
 			try {
 				String serializedAssertion = DOMUtils.serializeNode(csresp.getDsigSignature());
-				session.setAuthBlock(serializedAssertion);
+				moasession.setAuthBlock(serializedAssertion);
 
 			} catch (TransformerException e) {
 				throw new ParseException("parser.04", new Object[] { REQ_VERIFY_AUTH_BLOCK, PARAM_XMLRESPONSE });
@@ -132,13 +116,14 @@ public class GetForeignIDTask extends AbstractAuthServletTask {
 			Element signature = csresp.getDsigSignature();
 
 			try {
-				session.setSignerCertificate(AuthenticationServer.getCertificateFromXML(signature));
+				moasession.setSignerCertificate(AuthenticationServer.getCertificateFromXML(signature));
+				
 			} catch (CertificateException e) {
 				Logger.error("Could not extract certificate from CreateXMLSignatureResponse");
 				throw new MOAIDException("auth.14", null);
 			}
 
-			MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+			revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 					pendingReq, MOAIDEventConstants.AUTHPROCESS_FOREIGN_SZRGW_CONNECTED);
 			
 			// make SZR request to the identity link
@@ -152,38 +137,32 @@ public class GetForeignIDTask extends AbstractAuthServletTask {
 				IdentityLinkAssertionParser ilParser = new IdentityLinkAssertionParser(new ByteArrayInputStream(
 						response.getIdentityLink()));
 				IdentityLink identitylink = ilParser.parseIdentityLink();
-				session.setIdentityLink(identitylink);
+				moasession.setIdentityLink(identitylink);
 
 				// set QAA Level four in case of card authentifcation
-				session.setQAALevel(PVPConstants.STORK_QAA_1_4);
-
-				AuthenticationServer.getInstance().getForeignAuthenticationData(session);
-
-				// session is implicit stored in changeSessionID!!!!
-				String newMOASessionID = AuthenticationSessionStoreage.changeSessionID(session);
+				moasession.setQAALevel(PVPConstants.STORK_QAA_1_4);
 
-				Logger.info("Changed MOASession " + sessionID + " to Session " + newMOASessionID);
-				Logger.info("Daten angelegt zu MOASession " + newMOASessionID);
+				authServer.getForeignAuthenticationData(moasession);
 				
-				MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+				revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 						pendingReq, MOAIDEventConstants.AUTHPROCESS_FOREIGN_SZRGW_RECEIVED);
 				
 				try {
-					AuthenticationSessionStoreage.storeSession(session);
+					authenticatedSessionStorage.storeSession(moasession);
+					
 				} catch (MOADatabaseException e) {
 					throw new MOAIDException("Session store error", null);
 				}
 
-				//put session to context 
-				executionContext.put(PARAM_SESSIONID, session.getSessionID());
+ 
 			}
 
 		} catch (MOAIDException ex) {
-			throw new TaskExecutionException(ex.getMessage(), ex);
+			throw new TaskExecutionException(pendingReq, ex.getMessage(), ex);
 
 		} catch (Exception e) {
 			Logger.error("GetForeignIDServlet has an interal Error.", e);
-			throw new TaskExecutionException(e.getMessage(), e);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
 
 		}
 
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GetMISSessionIDTask.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GetMISSessionIDTask.java
index d85681b40..c172c3b9c 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GetMISSessionIDTask.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GetMISSessionIDTask.java
@@ -1,7 +1,6 @@
 package at.gv.egovernment.moa.id.auth.modules.internal.tasks;
 
-import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.*;
-import iaik.pki.PKIException;
+import static at.gv.egovernment.moa.id.commons.MOAIDAuthConstants.GET_MIS_SESSIONID;
 
 import java.security.GeneralSecurityException;
 import java.util.List;
@@ -11,35 +10,25 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.xml.parsers.ParserConfigurationException;
 
-import org.apache.commons.lang.StringEscapeUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.stereotype.Component;
 import org.xml.sax.SAXException;
 
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
-import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
 import at.gv.egovernment.moa.id.auth.AuthenticationServer;
-import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;
-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
 import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
-
-import at.gv.egovernment.moa.id.config.ConnectionParameter;
-import at.gv.egovernment.moa.id.config.auth.AuthConfiguration;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
+import at.gv.egovernment.moa.id.commons.api.ConnectionParameterInterface;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.data.MISMandate;
-import at.gv.egovernment.moa.id.moduls.IRequest;
-import at.gv.egovernment.moa.id.moduls.ModulUtils;
-import at.gv.egovernment.moa.id.moduls.RequestStorage;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
-import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
-import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;
-import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
 import at.gv.egovernment.moa.id.util.SSLUtils;
 import at.gv.egovernment.moa.id.util.client.mis.simple.MISSimpleClient;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.DOMUtils;
+import iaik.pki.PKIException;
 
 /**
  * Retrieves a mandate from the online mandate issuing service.<p/>
@@ -53,7 +42,7 @@ import at.gv.egovernment.moa.util.DOMUtils;
  * </ul>
  * Expects:
  * <ul>
- * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>
+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>
  * </ul>
  * Result:
  * <ul>
@@ -64,64 +53,47 @@ import at.gv.egovernment.moa.util.DOMUtils;
  * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)
  *
  */
+@Component("GetMISSessionIDTask")
 public class GetMISSessionIDTask extends AbstractAuthServletTask {
 
+	@Autowired @Qualifier("CitizenCardAuthenticationServer") private AuthenticationServer authServer;
+	
 	@Override
 	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)
 			throws TaskExecutionException {
 		
 		Logger.debug("POST GetMISSessionIDServlet");
 
-		String sessionID = req.getParameter(PARAM_SESSIONID);
-
-		// escape parameter strings
-		sessionID = StringEscapeUtils.escapeHtml(sessionID);
-
-		AuthenticationSession session = null;
-		String pendingRequestID = null;
 		try {
-			// check parameter
-			if (!ParamValidatorUtils.isValidSessionID(sessionID))
-				throw new WrongParametersException("VerifyCertificate",
-						PARAM_SESSIONID, "auth.12");
-
-			pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID);
+			//execute default task initialization
+			defaultTaskInitialization(req, executionContext);
 			
-			session = AuthenticationServer.getSession(sessionID);
+			//get MIS sessionID
+			String misSessionID = moasession.getMISSessionID();
 
-			IRequest pendingReq = RequestStorage.getPendingRequest(
-					(String) executionContext.get("pendingRequestID"));			
-			
-			//change MOASessionID
-		    sessionID = AuthenticationSessionStoreage.changeSessionID(session);
-			
-			String misSessionID = session.getMISSessionID();
-
-			AuthConfiguration authConf = AuthConfigurationProviderFactory
-					.getInstance();
-			ConnectionParameter connectionParameters = authConf
+			//get mandates from MIS
+			ConnectionParameterInterface connectionParameters = authConfig
 					.getOnlineMandatesConnectionParameter();
 			SSLSocketFactory sslFactory = SSLUtils.getSSLSocketFactory(
-					AuthConfigurationProviderFactory.getInstance(),
+					authConfig,
 					connectionParameters);
-
 			List<MISMandate> list = MISSimpleClient.sendGetMandatesRequest(
 					connectionParameters.getUrl(), misSessionID, sslFactory);
 
+			//check if mandates received
 			if (list == null || list.size() == 0) {
 				Logger.error("Keine Vollmacht gefunden.");
 				throw new AuthenticationException("auth.15", null);
 			}
 
-			MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+			revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 					pendingReq, MOAIDEventConstants.AUTHPROCESS_MANDATE_RECEIVED);
 
 			
 			// for now: list contains only one element
 			MISMandate mandate = (MISMandate) list.get(0);
 
-			// TODO[tlenz]: UTF-8 ?
-			String sMandate = new String(mandate.getMandate());
+			String sMandate = new String(mandate.getMandate(), "UTF-8");
 			if (sMandate == null || sMandate.compareToIgnoreCase("") == 0) {
 				Logger.error("Mandate is empty.");
 				throw new AuthenticationException("auth.15",
@@ -136,43 +108,35 @@ public class GetMISSessionIDTask extends AbstractAuthServletTask {
 					null, null).getDocumentElement();
 			
 			// extract RepresentationType
-			AuthenticationServer.getInstance().verifyMandate(session, mandate);
+			authServer.verifyMandate(pendingReq, moasession, mandate);
 			
-			session.setMISMandate(mandate);
+			moasession.setMISMandate(mandate);
 			
 			//log mandate specific set of events
-			MOAReversionLogger.getInstance().logMandateEventSet(pendingReq, mandate);
-						
-			String oldsessionID = session.getSessionID();
+			revisionsLogger.logMandateEventSet(pendingReq, mandate);
+									
+			//Stor MOAsession
+			authenticatedSessionStorage.storeSession(moasession);
 			
-			//Session is implicite stored in changeSessionID!!!
-			String newMOASessionID = AuthenticationSessionStoreage.changeSessionID(session);
 			
-			Logger.info("Changed MOASession " + oldsessionID + " to Session " + newMOASessionID);
-			Logger.info("Daten angelegt zu MOASession " + newMOASessionID);
-
-			//put session to context 
-			executionContext.put(PARAM_SESSIONID, session.getSessionID());
-			
-
 		} catch (MOAIDException ex) {
-			throw new TaskExecutionException(ex.getMessage(), ex);
+			throw new TaskExecutionException(pendingReq, ex.getMessage(), ex);
 			
 		} catch (GeneralSecurityException ex) {
-			throw new TaskExecutionException(ex.getMessage(), ex);
+			throw new TaskExecutionException(pendingReq, ex.getMessage(), ex);
 			
 		} catch (PKIException e) {
-			throw new TaskExecutionException(e.getMessage(), e);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
 			
 		} catch (SAXException e) {
-			throw new TaskExecutionException(e.getMessage(), e);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
 			
 		} catch (ParserConfigurationException e) {
-			throw new TaskExecutionException(e.getMessage(), e);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
 			
 	    } catch (Exception e) {
 	    	Logger.error("MISMandateValidation has an interal Error.", e);
-	    	throw new TaskExecutionException(e.getMessage(), e);
+	    	throw new TaskExecutionException(pendingReq, e.getMessage(), e);
 	       
 	    }
 	    finally {
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/InitializeBKUAuthenticationTask.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/InitializeBKUAuthenticationTask.java
index 1dd4780f7..c1fae1f1e 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/InitializeBKUAuthenticationTask.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/InitializeBKUAuthenticationTask.java
@@ -27,22 +27,20 @@ import java.util.List;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
-import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
-import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
+import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
 import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
 import at.gv.egovernment.moa.id.auth.parser.StartAuthentificationParameterParser;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.moduls.IRequest;
-import at.gv.egovernment.moa.id.moduls.RequestStorage;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
-import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.FileUtils;
 import at.gv.egovernment.moa.util.MiscUtil;
@@ -51,8 +49,11 @@ import at.gv.egovernment.moa.util.MiscUtil;
  * @author tlenz
  *
  */
+@Component("InitializeBKUAuthenticationTask")
 public class InitializeBKUAuthenticationTask extends AbstractAuthServletTask {
 
+	@Autowired StartAuthentificationParameterParser authInitialisationParser;
+	
 	/* (non-Javadoc)
 	 * @see at.gv.egovernment.moa.id.process.springweb.MoaIdTask#execute(at.gv.egovernment.moa.id.process.api.ExecutionContext, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
 	 */
@@ -62,111 +63,14 @@ public class InitializeBKUAuthenticationTask extends AbstractAuthServletTask {
 			throws TaskExecutionException {
 		
 		try {
-	    	String moasessionid = (String) executionContext.get(MOAIDAuthConstants.PARAM_SESSIONID);	    	
-			String pendingRequestID = (String) executionContext.get("pendingRequestID");
-
-			//load pending request
-			IRequest pendingReq = RequestStorage.getPendingRequest(pendingRequestID);				
-			if (pendingReq == null) {
-				Logger.info("No PendingRequest with Id: " + pendingRequestID + " Maybe, a transaction timeout occure.");
-				throw new MOAIDException("auth.28", new Object[]{pendingRequestID});
-				
-			}
-	    	
-			//load MOASession object
-			AuthenticationSession moasession = AuthenticationSessionStoreage.getSession(moasessionid);
-			
-			boolean isLegacyRequest = false;
-			Object isLegacyRequestObj = executionContext.get("isLegacyRequest");
-			if (isLegacyRequestObj != null && isLegacyRequestObj instanceof Boolean)
-				isLegacyRequest = (boolean) isLegacyRequestObj;
-
-			if (isLegacyRequest) {
-				//parse request parameter into MOASession
-			    Logger.info("Start Authentication Module: " + moasession.getModul() 
-			    		+ " Action: " + moasession.getAction());
-
-				StartAuthentificationParameterParser.parse(executionContext, request, moasession, pendingReq);
-												
-			} else {						
-		    	String bkuid = (String) executionContext.get(MOAIDAuthConstants.PARAM_BKU);
-		    	String useMandate = (String) executionContext.get(MOAIDAuthConstants.PARAM_USEMANDATE);
-				String ccc = (String) executionContext.get(MOAIDAuthConstants.PARAM_CCC);
-							
-				//remove MOASessionID from executionContext because it is not needed any more
-	
-				
-		    	if (MiscUtil.isEmpty(bkuid) || MiscUtil.isEmpty(moasessionid)) {
-		    		Logger.warn("MOASessionID or BKU-type is empty. Maybe an old BKU-selection template is in use.");
-		    		throw new MOAIDException("auth.23", new Object[] {});
-		    	}
-								
-		    	//load OA Config
-				IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
-				
-				if (oaParam == null)
-					throw new AuthenticationException("auth.00", new Object[] { moasession.getOAURLRequested() });
-				
-				else {
-					MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
-							pendingReq, MOAIDEventConstants.AUTHPROCESS_BKUTYPE_SELECTED, bkuid);
-					
-			    	//get Target from config or from request in case of SAML 1				
-					String target = null;
-					if (MiscUtil.isNotEmpty(pendingReq.getTarget()) && 
-							pendingReq.requestedModule().equals("id_saml1"))
-						target = pendingReq.getTarget();
-					else
-						target = oaParam.getTarget();
-									
-			    	String bkuURL = oaParam.getBKUURL(bkuid);
-			    	if (MiscUtil.isEmpty(bkuURL)) {
-			    		Logger.info("No OA specific BKU defined. Use BKU from default configuration");
-			    		bkuURL = AuthConfigurationProviderFactory.getInstance().getDefaultBKUURL(bkuid);
-			    	}
-			    	
-			    	//search for OA specific template
-			    	String templateURL = null;
-			    	List<String> oaTemplateURLList = oaParam.getTemplateURL();
-			    	if ( oaTemplateURLList != null && oaTemplateURLList.size() > 0
-			    			&& MiscUtil.isNotEmpty(oaTemplateURLList.get(0)) ) {
-			    		templateURL = oaTemplateURLList.get(0);
-			    		
-			    	} else {		    	
-			    		templateURL = AuthConfigurationProviderFactory.getInstance().getSLRequestTemplates(bkuid);
-			    	}
-			    	
-			    	//make url absolut if it is a local url
-		    		if (MiscUtil.isNotEmpty(templateURL))
-		    			templateURL = FileUtils.makeAbsoluteURL(templateURL, 
-		    					AuthConfigurationProviderFactory.getInstance().getRootConfigFileDir());
-			    	
-			    	if (oaParam.isOnlyMandateAllowed()) 
-			    		useMandate = "true";
-			    	
-			    	if (!oaParam.isShowMandateCheckBox())
-			    		useMandate = "false";
-			    	
-			    	//parse all OA parameters i
-			    	StartAuthentificationParameterParser.parse(moasession, 
-			    											   target, 
-			    											   moasession.getOAURLRequested(),
-			    											   bkuURL,
-			    											   templateURL,
-			    											   useMandate,
-			    											   ccc, 
-			    											   moasession.getModul(),
-			    											   moasession.getAction(),
-			    											   request,
-			    											   pendingReq);
-				}
-			}
+			//
+			internalInitializeWithoutPersist(executionContext, request, response);
 			
-			executionContext.put(MOAIDAuthConstants.PARAM_USEMANDATE, moasession.getUseMandate());
-			
-			// make sure moa session has been persisted before running the process
+			// make sure MOASession and Pending-Request has been persisted before running the process
 			try {
-				AuthenticationSessionStoreage.storeSession(moasession);
+				authenticatedSessionStorage.storeSession(moasession);				
+				requestStoreage.storePendingRequest(pendingReq);
+				
 			} catch (MOADatabaseException e) {
 				Logger.error("Database Error! MOASession is not stored!");
 				throw new MOAIDException("init.04", new Object[] {
@@ -176,14 +80,106 @@ public class InitializeBKUAuthenticationTask extends AbstractAuthServletTask {
 			
 		} catch (MOADatabaseException | MOAIDException e) {
 			Logger.info("Initialize BKUAuthentication FAILED. Reason:" + e.getMessage());
-			throw new TaskExecutionException(e.getMessage(), e);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
 			
 		} catch (Exception e) {
 			Logger.warn("InitializeBKUAuthentication has an internal error", e);
-			throw new TaskExecutionException(e.getMessage(), e);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
 			
 		}
 
 	}
+	
+	protected void internalInitializeWithoutPersist(ExecutionContext executionContext,
+			HttpServletRequest request, HttpServletResponse response) throws WrongParametersException, MOAIDException, MOADatabaseException {
+		
+		Logger.info("BKU is selected -> Start BKU communication ...");			
+		defaultTaskInitialization(request, executionContext);
+		
+		boolean isLegacyRequest = false;
+		Object isLegacyRequestObj = executionContext.get("isLegacyRequest");
+		if (isLegacyRequestObj != null && isLegacyRequestObj instanceof Boolean)
+			isLegacyRequest = (boolean) isLegacyRequestObj;
+
+		if (isLegacyRequest) {
+			//parse request parameter into MOASession
+		    Logger.info("Start Authentication Module: " + pendingReq.requestedModule() 
+		    		+ " Action: " + pendingReq.requestedAction());
+
+		    authInitialisationParser.parse(executionContext, request, moasession, pendingReq);
+											
+		} else {						
+	    	String bkuid = (String) executionContext.get(MOAIDAuthConstants.PARAM_BKU);
+	    	String useMandate = (String) executionContext.get(MOAIDAuthConstants.PARAM_USEMANDATE);
+			String ccc = (String) executionContext.get(MOAIDAuthConstants.PARAM_CCC);
+											
+	    	if (MiscUtil.isEmpty(bkuid)) {
+	    		Logger.warn("BKU-type is empty. Maybe an old BKU-selection template is in use.");
+	    		throw new MOAIDException("auth.23", new Object[] {});
+	    	}
+							
+	    	//load OA Config
+			IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
+			
+			if (oaParam == null)
+				throw new AuthenticationException("auth.00", new Object[] { pendingReq.getOAURL() });
+			
+			else {
+				revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+						pendingReq, MOAIDEventConstants.AUTHPROCESS_BKUTYPE_SELECTED, bkuid);
+				
+		    	//get Target from config or from request in case of SAML 1				
+				String target = null;
+				if (MiscUtil.isNotEmpty(pendingReq.getGenericData("target", String.class)) && 
+						pendingReq.requestedModule().equals("at.gv.egovernment.moa.id.protocols.saml1.SAML1Protocol"))
+					target = pendingReq.getGenericData("target", String.class);
+				else
+					target = oaParam.getTarget();
+								
+		    	String bkuURL = oaParam.getBKUURL(bkuid);
+		    	if (MiscUtil.isEmpty(bkuURL)) {
+		    		Logger.info("No OA specific BKU defined. Use BKU from default configuration");
+		    		bkuURL = authConfig.getDefaultBKUURL(bkuid);
+		    	}
+		    	
+		    	//search for OA specific template
+		    	String templateURL = null;
+		    	List<String> oaTemplateURLList = oaParam.getTemplateURL();
+		    	if ( oaTemplateURLList != null && oaTemplateURLList.size() > 0
+		    			&& MiscUtil.isNotEmpty(oaTemplateURLList.get(0)) ) {
+		    		templateURL = oaTemplateURLList.get(0);
+		    		
+		    	} else {		    	
+		    		templateURL = authConfig.getSLRequestTemplates(bkuid);
+		    	}
+		    	
+		    	//make url absolut if it is a local url
+	    		if (MiscUtil.isNotEmpty(templateURL))
+	    			templateURL = FileUtils.makeAbsoluteURL(templateURL, 
+	    					authConfig.getRootConfigFileDir());
+		    	
+		    	if (oaParam.isOnlyMandateAllowed()) 
+		    		useMandate = "true";
+		    	
+		    	if (!oaParam.isShowMandateCheckBox())
+		    		useMandate = "false";
+		    	
+		    	//parse all OA parameters i
+		    	authInitialisationParser.parse(	moasession, 
+		    									target, 
+		    									pendingReq.getOAURL(),
+		    									bkuURL,
+		    									templateURL,
+		    									useMandate,
+		    									ccc, 
+		    									request,
+		    									pendingReq);
+			}
+		}
+		
+		//set useMandate flag to executionContext
+		executionContext.put(MOAIDAuthConstants.PARAM_USEMANDATE, moasession.isMandateUsed());
+				
+	}
 
 }
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/PrepareAuthBlockSignatureTask.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/PrepareAuthBlockSignatureTask.java
index 49888c136..ed49201b8 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/PrepareAuthBlockSignatureTask.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/PrepareAuthBlockSignatureTask.java
@@ -1,28 +1,18 @@
 package at.gv.egovernment.moa.id.auth.modules.internal.tasks;
 
-import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.*;
-
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.apache.commons.lang.StringEscapeUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.stereotype.Component;
 
 import at.gv.egovernment.moa.id.auth.AuthenticationServer;
-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
 import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
-
-import at.gv.egovernment.moa.id.config.auth.AuthConfiguration;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.moduls.IRequest;
-import at.gv.egovernment.moa.id.moduls.RequestStorage;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
-import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;
 import at.gv.egovernment.moa.id.util.CitizenCardServletUtils;
-import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
 import at.gv.egovernment.moa.logging.Logger;
 
 /**
@@ -35,7 +25,7 @@ import at.gv.egovernment.moa.logging.Logger;
  * </ul>
  * Expects:
  * <ul>
- * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>
+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>
  * </ul>
  * Result:
  * <ul>
@@ -45,56 +35,40 @@ import at.gv.egovernment.moa.logging.Logger;
  * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)
  *
  */
+@Component("PrepareAuthBlockSignatureTask")
 public class PrepareAuthBlockSignatureTask extends AbstractAuthServletTask {
 
+	@Autowired @Qualifier("CitizenCardAuthenticationServer") private AuthenticationServer authServer;
+	
 	@Override
 	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)
 			throws TaskExecutionException {
 		// note: code taken from at.gv.egovernment.moa.id.auth.servlet.VerifyIdentityLinkServlet
 
-		Logger.debug("Process IdentityLink");
-
-		setNoCachingHeaders(resp);
+		Logger.debug("Process CreateAuthBlock Task");
 		
-		String pendingRequestID = null;
-
 		try {
+			//initialize task
+			defaultTaskInitialization(req, executionContext);
 			
-			String sessionID = StringEscapeUtils.escapeHtml(req.getParameter(PARAM_SESSIONID));
-			
-			// check parameter
-			if (!ParamValidatorUtils.isValidSessionID(sessionID)) {
-				throw new WrongParametersException("VerifyIdentityLink", PARAM_SESSIONID, "auth.12");
-			}
-
-			pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID);
-			IRequest pendingReq = RequestStorage.getPendingRequest(
-					(String) executionContext.get("pendingRequestID"));	
-						
-			AuthenticationSession session = AuthenticationServer.getSession(sessionID);
-
-			// change MOASessionID
-			sessionID = AuthenticationSessionStoreage.changeSessionID(session);
-				
-			OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(
-					session.getPublicOAURLPrefix());
-			AuthConfiguration authConf = AuthConfigurationProviderFactory.getInstance();
-
-			String createXMLSignatureRequest = AuthenticationServer.getInstance()
-					.getCreateXMLSignatureRequestAuthBlockOrRedirect(session, authConf, oaParam, pendingReq);
+			//build authBlock
+			String createXMLSignatureRequest = authServer
+					.getCreateXMLSignatureRequestAuthBlockOrRedirect(moasession, pendingReq);
 
-			AuthenticationSessionStoreage.storeSession(session);
+			//store MOASession
+			authenticatedSessionStorage.storeSession(moasession);
 			
-			CitizenCardServletUtils.writeCreateXMLSignatureRequestOrRedirect(resp, session,
+			//write response
+			CitizenCardServletUtils.writeCreateXMLSignatureRequestOrRedirect(resp, pendingReq,
 					createXMLSignatureRequest, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT,
 					"VerifyIdentityLink");
 
 		} catch (MOAIDException ex) {
-			throw new TaskExecutionException(ex.getMessage(), ex);
+			throw new TaskExecutionException(pendingReq, ex.getMessage(), ex);
 
 		} catch (Exception e) {
 			Logger.error("IdentityLinkValidation has an interal Error.", e);
-			throw new TaskExecutionException(e.getMessage(), e);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
 		}
 
 		finally {
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/PrepareGetMISMandateTask.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/PrepareGetMISMandateTask.java
index 099bc085c..afbb87f10 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/PrepareGetMISMandateTask.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/PrepareGetMISMandateTask.java
@@ -22,47 +22,41 @@
  */
 package at.gv.egovernment.moa.id.auth.modules.internal.tasks;
 
-import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.GET_MIS_SESSIONID;
-import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.PARAM_SESSIONID;
+import static at.gv.egovernment.moa.id.commons.MOAIDAuthConstants.GET_MIS_SESSIONID;
 
 import java.util.List;
 
 import javax.net.ssl.SSLSocketFactory;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.stereotype.Component;
 import org.w3c.dom.Element;
 
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
-import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
 import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;
 import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
 import at.gv.egovernment.moa.id.auth.exception.BuildException;
 import at.gv.egovernment.moa.id.auth.exception.MISSimpleClientException;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
+import at.gv.egovernment.moa.id.commons.api.ConnectionParameterInterface;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
-import at.gv.egovernment.moa.id.config.ConnectionParameter;
-import at.gv.egovernment.moa.id.config.auth.AuthConfiguration;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.moduls.IRequest;
-import at.gv.egovernment.moa.id.moduls.RequestStorage;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
-import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;
 import at.gv.egovernment.moa.id.util.SSLUtils;
 import at.gv.egovernment.moa.id.util.client.mis.simple.MISSessionId;
 import at.gv.egovernment.moa.id.util.client.mis.simple.MISSimpleClient;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.DOMUtils;
-import at.gv.egovernment.moa.util.MiscUtil;
 
 /**
  * @author tlenz
  *
  */
+@Component("PrepareGetMISMandateTask")
 public class PrepareGetMISMandateTask extends AbstractAuthServletTask {
 
 	/* (non-Javadoc)
@@ -75,66 +69,26 @@ public class PrepareGetMISMandateTask extends AbstractAuthServletTask {
 
 		//mandate Mode
 		try {
-			IRequest pendingReq = RequestStorage.getPendingRequest(
-					(String) executionContext.get("pendingRequestID"));	
-			
-			//get Session from context
-			String moasessionid = (String) executionContext.get(PARAM_SESSIONID);
-			AuthenticationSession session = null;				
-			if (MiscUtil.isEmpty(moasessionid)) {
-				Logger.warn("MOASessionID is empty.");
-				throw new MOAIDException("auth.18", new Object[] {});
-			}
-				
-			try {			
-				session = AuthenticationSessionStoreage.getSession(moasessionid);
-				AuthenticationSessionStoreage.changeSessionID(session);
-								
-			} catch (MOADatabaseException e) {
-				Logger.info("MOASession with SessionID=" + moasessionid + " is not found in Database");
-				throw new MOAIDException("init.04", new Object[] { moasessionid });
-
-			} catch (Throwable e) {
-				Logger.info("No HTTP Session found!");
-				throw new MOAIDException("auth.18", new Object[] {});
-				
-			} finally {
-				executionContext.remove(PARAM_SESSIONID);
-				
-			}
-
-			
-		  AuthConfiguration authConf= AuthConfigurationProviderFactory.getInstance();
-			ConnectionParameter connectionParameters = authConf.getOnlineMandatesConnectionParameter();	
-			SSLSocketFactory sslFactory = SSLUtils.getSSLSocketFactory(AuthConfigurationProviderFactory.getInstance(), connectionParameters);
+			//perform default task initialization
+			defaultTaskInitialization(request, executionContext);
+						
+			ConnectionParameterInterface connectionParameters = authConfig.getOnlineMandatesConnectionParameter();	
+			SSLSocketFactory sslFactory = SSLUtils.getSSLSocketFactory(authConfig, connectionParameters);
 			
 			// get identitity link as byte[]
-			Element elem = session.getIdentityLink().getSamlAssertion();
+			Element elem = moasession.getIdentityLink().getSamlAssertion();
 			String s = DOMUtils.serializeNode(elem);
 			
 			//System.out.println("IDL: " + s);
 			
 			byte[] idl = s.getBytes("UTF-8");
-			
-			// redirect url
-			// build redirect(to the GetMISSessionIdSerlvet)
-			
-			//change MOASessionID before MIS request
-			String newMOASessionID = AuthenticationSessionStoreage.changeSessionID(session);
-			
+						
 	        String redirectURL = new DataURLBuilder().buildDataURL(
-			    session.getAuthURL(),
+			    pendingReq.getAuthURL(),
 			    GET_MIS_SESSIONID,
-			    newMOASessionID);
+			    pendingReq.getRequestID());
 			
-	        String oaURL = session.getOAURLRequested();
 	        IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
-	        if (oaParam == null) {
-	        	oaParam = authConf.getOnlineApplicationParameter(oaURL);
-	        	Logger.info("No Service info in PendingRequest --> load service info from configuration");
-	        	
-	        }
-	        
 	        List<String> profiles = oaParam.getMandateProfiles();
 
 	        if (profiles == null) {
@@ -143,24 +97,21 @@ public class PrepareGetMISMandateTask extends AbstractAuthServletTask {
 	        }
 	        
 	        String oaFriendlyName = oaParam.getFriendlyName();
-	        String mandateReferenceValue = session.getMandateReferenceValue();
-	        byte[] cert = session.getEncodedSignerCertificate();
-	        byte[] authBlock = session.getAuthBlock().getBytes("UTF-8");
+	        String mandateReferenceValue = moasession.getMandateReferenceValue();
+	        byte[] cert = moasession.getEncodedSignerCertificate();
+	        byte[] authBlock = moasession.getAuthBlock().getBytes("UTF-8");
 	        
 	        //TODO: check in case of SSO!!!
 	        String targetType = null;  
-	        if(oaParam.getBusinessService()) {
-	        	String id = oaParam.getIdentityLinkDomainIdentifier();
-	        	if (id.startsWith(AuthenticationSession.REGISTERANDORDNR_PREFIX_))
-	        		targetType = id;
-	        	else
-	        		targetType = AuthenticationSession.REGISTERANDORDNR_PREFIX_+session.getDomainIdentifier();
+	        if(oaParam.getBusinessService()){
+	        	targetType = oaParam.getIdentityLinkDomainIdentifier();
 	        	
 	        } else {
 	        	targetType = AuthenticationSession.TARGET_PREFIX_ + oaParam.getTarget();
+	        	
 	        }
 	        
-	        MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+	        revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 					pendingReq, MOAIDEventConstants.AUTHPROCESS_MANDATE_SERVICE_REQUESTED, mandateReferenceValue);
 	        
 	        MISSessionId misSessionID = MISSimpleClient.sendSessionIdRequest(
@@ -178,20 +129,21 @@ public class PrepareGetMISMandateTask extends AbstractAuthServletTask {
 	        if (misSessionID == null) {
 	      	  Logger.error("Fehler bei Anfrage an Vollmachten Service. MIS Session ID ist null.");
 	      	  throw new MISSimpleClientException("Fehler bei Anfrage an Vollmachten Service.");
+	      	  
 	        }
 	        
 	        String redirectMISGUI = misSessionID.getRedirectURL();
-	        session.setMISSessionID(misSessionID.getSessiondId());
+	        moasession.setMISSessionID(misSessionID.getSessiondId());
 		
 			try {
-				AuthenticationSessionStoreage.storeSession(session);
+				authenticatedSessionStorage.storeSession(moasession);
 				
 			} catch (MOADatabaseException | BuildException e) {
 				throw new MOAIDException("Session store error", null);
 				
 			}
 	        			
-			MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+			revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 					pendingReq, MOAIDEventConstants.AUTHPROCESS_MANDATE_REDIRECT);
 			
 	        response.setStatus(302);
@@ -199,7 +151,7 @@ public class PrepareGetMISMandateTask extends AbstractAuthServletTask {
 	    	Logger.debug("REDIRECT TO: " + redirectMISGUI);
 	    	
 		} catch (Exception e ) {
-			throw new TaskExecutionException(e.getMessage(), e);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
 			
 		} 
 	}
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyAuthenticationBlockTask.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyAuthenticationBlockTask.java
index 35104bf3e..516e9501b 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyAuthenticationBlockTask.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyAuthenticationBlockTask.java
@@ -1,65 +1,42 @@
 package at.gv.egovernment.moa.id.auth.modules.internal.tasks;
 
-import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.*;
-import iaik.pki.PKIException;
+import static at.gv.egovernment.moa.id.commons.MOAIDAuthConstants.PARAM_XMLRESPONSE;
 
 import java.io.IOException;
-import java.security.GeneralSecurityException;
-import java.util.List;
 import java.util.Map;
 
-import javax.net.ssl.SSLSocketFactory;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
-import javax.xml.transform.TransformerException;
 
 import org.apache.commons.fileupload.FileUploadException;
-import org.apache.commons.lang.StringEscapeUtils;
-import org.w3c.dom.Element;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.stereotype.Component;
 
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
-import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
 import at.gv.egovernment.moa.id.auth.AuthenticationServer;
-import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;
-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
-import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
-import at.gv.egovernment.moa.id.auth.exception.MISSimpleClientException;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
 import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
-
-import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
-import at.gv.egovernment.moa.id.config.ConnectionParameter;
-import at.gv.egovernment.moa.id.config.auth.AuthConfiguration;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.moduls.IRequest;
-import at.gv.egovernment.moa.id.moduls.ModulUtils;
-import at.gv.egovernment.moa.id.moduls.RequestStorage;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
-import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;
 import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
-import at.gv.egovernment.moa.id.util.SSLUtils;
-import at.gv.egovernment.moa.id.util.client.mis.simple.MISSessionId;
-import at.gv.egovernment.moa.id.util.client.mis.simple.MISSimpleClient;
 import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.DOMUtils;
 
 /**
  * Verifies the signed authentication block (provided as {@code CreateXMLSignatureResponse}).<p/>
  * In detail:
  * <ul>
  * <li>Renames the moa session id.</li>
- * <li>Takes the {@code CreateXMLSignatureResponse} from POST parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE}.</li>
+ * <li>Takes the {@code CreateXMLSignatureResponse} from POST parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE}.</li>
  * <li>Verifies the {@code CreateXMLSignatureResponse}.</li>
  * <li>Updates moa session.</li>
  * <li>Redirects back to {@code /dispatcher} in order to finalize the authentication.</li>
  * </ul>
  * Expects:
  * <ul>
- * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>
- * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE} containing a {@code CreateXMLSignatureResponse}.</li>
+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>
+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE} containing a {@code CreateXMLSignatureResponse}.</li>
  * </ul>
  * Result:
  * <ul>
@@ -79,82 +56,63 @@ import at.gv.egovernment.moa.util.DOMUtils;
  * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)
  *
  */
+@Component("VerifyAuthenticationBlockTask")
 public class VerifyAuthenticationBlockTask extends AbstractAuthServletTask {
 
+	@Autowired @Qualifier("CitizenCardAuthenticationServer") private AuthenticationServer authServer;
+	
 	@Override
 	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)
 			throws TaskExecutionException {
-
-		// note: code taken from at.gv.egovernment.moa.id.auth.servlet.VerifyAuthenticationBlockServlet
 		
 		Logger.debug("POST VerifyAuthenticationBlock");
 		
-		String pendingRequestID = null;		
-		
 	    Map<String, String> parameters;
 	    try 
 	    {
 	      parameters = getParameters(req);
 	      
-	    } catch (FileUploadException | IOException e) 
-	    {
+	    } catch (FileUploadException | IOException e) {
 	      Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());
-	      throw new TaskExecutionException("Parsing mulitpart/form-data request parameters failed", new IOException(e.getMessage()));
-	    }
+	      throw new TaskExecutionException(pendingReq, "Parsing mulitpart/form-data request parameters failed", new IOException(e.getMessage()));
 	      
-			String sessionID = req.getParameter(PARAM_SESSIONID);
-			String createXMLSignatureResponse = (String)parameters.get(PARAM_XMLRESPONSE);
-
-			// escape parameter strings
-			sessionID = StringEscapeUtils.escapeHtml(sessionID);
-			pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID);
-		   		
-			String redirectURL = null;
-			try {
-	         // check parameter
-	         if (!ParamValidatorUtils.isValidSessionID(sessionID))
-	            throw new WrongParametersException("VerifyAuthenticationBlock", PARAM_SESSIONID, "auth.12");
-	         if (!ParamValidatorUtils.isValidXMLDocument(createXMLSignatureResponse))
-	            throw new WrongParametersException("VerifyAuthenticationBlock", PARAM_XMLRESPONSE, "auth.12");
-
-				AuthenticationSession session = AuthenticationServer.getSession(sessionID);
-
-				IRequest pendingReq = RequestStorage.getPendingRequest(
-						(String) executionContext.get("pendingRequestID"));			
-				MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
-						pendingReq, MOAIDEventConstants.AUTHPROCESS_BKU_DATAURL_IP, req.getRemoteHost());
-								
-				//change MOASessionID
-			    sessionID = AuthenticationSessionStoreage.changeSessionID(session);
-				
-				AuthenticationServer.getInstance().verifyAuthenticationBlock(pendingReq, session, createXMLSignatureResponse);
-				
-				//store all changes in session DAO
-				AuthenticationSessionStoreage.storeSession(session);
-				
-				//put session to context 
-				executionContext.put(PARAM_SESSIONID, session.getSessionID());
-				
-			}
+	    }
 	    
-			catch (MOAIDException ex) {
-				throw new TaskExecutionException(ex.getMessage(), ex);
-				
+	    String createXMLSignatureResponse = (String)parameters.get(PARAM_XMLRESPONSE);
+	    		
+		try {
+			//check if authblock is received
+			if (!ParamValidatorUtils.isValidXMLDocument(createXMLSignatureResponse))
+				throw new WrongParametersException("VerifyAuthenticationBlock", PARAM_XMLRESPONSE, "auth.12");
+
+			//execute default task initialization
+			defaultTaskInitialization(req, executionContext);
 			
-				
-		    } catch (Exception e) {
-		    	Logger.error("AuthBlockValidation has an interal Error.", e);
-		    	throw new TaskExecutionException(e.getMessage(), e);
-		    	
-		    }
-		       
+			revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+					pendingReq, MOAIDEventConstants.AUTHPROCESS_BKU_DATAURL_IP, req.getRemoteHost());
 			
-		    finally {
-		    	
-		    }		
-		
-		
+			//verify authBlock
+			authServer.verifyAuthenticationBlock(pendingReq, moasession, createXMLSignatureResponse);
+			
+			//store all changes in session DAO
+			authenticatedSessionStorage.storeSession(moasession);
+							
+		}
+    
+		catch (MOAIDException ex) {
+			throw new TaskExecutionException(pendingReq, ex.getMessage(), ex);
+						
+	    } catch (Exception e) {
+	    	Logger.error("AuthBlockValidation has an interal Error.", e);
+	    	throw new TaskExecutionException(pendingReq, e.getMessage(), e);
+	    	
+	    }
+	       
 		
+	    finally {
+	    	
+	    }		
+	
 	}
 
 }
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyCertificateTask.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyCertificateTask.java
index 2734d1027..df158a7ec 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyCertificateTask.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyCertificateTask.java
@@ -1,7 +1,6 @@
 package at.gv.egovernment.moa.id.auth.modules.internal.tasks;
 
-import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.*;
-import iaik.x509.X509Certificate;
+import static at.gv.egovernment.moa.id.commons.MOAIDAuthConstants.REQ_GET_FOREIGN_ID;
 
 import java.io.IOException;
 import java.util.Map;
@@ -10,36 +9,30 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.fileupload.FileUploadException;
-import org.apache.commons.lang.StringEscapeUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.stereotype.Component;
 
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
-import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
 import at.gv.egovernment.moa.id.auth.AuthenticationServer;
 import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;
-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
 import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
-
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
-import at.gv.egovernment.moa.id.moduls.IRequest;
-import at.gv.egovernment.moa.id.moduls.RequestStorage;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
-import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;
 import at.gv.egovernment.moa.id.util.CitizenCardServletUtils;
-import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
-import at.gv.egovernment.moa.id.util.ServletUtils;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.spss.util.CertificateUtils;
+import iaik.x509.X509Certificate;
 
 /**
- * Parses the certificate from {@code InfoBoxReadResponse} (via POST parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE}), creates the auth block to be signed and returns a {@code CreateXMLSignatureRequest} for auth block signature.<p/>
+ * Parses the certificate from {@code InfoBoxReadResponse} (via POST parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE}), creates the auth block to be signed and returns a {@code CreateXMLSignatureRequest} for auth block signature.<p/>
  * In detail:
  * <ul>
  * <li>Renames the moa session id.</li>
- * <li>Retrieves the certificate via {@code InfoBoxReadResponse} from POST parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE}.</li>
+ * <li>Retrieves the certificate via {@code InfoBoxReadResponse} from POST parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE}.</li>
  * <li>Verifies the certificate.</li>
  * <li>Creates the auth block to be signed using information from the certificate (Organwalter, foreign citizen.</li>
  * <li>Puts it in a {@code CreateXMLSignatureRequest}.</li>
@@ -48,8 +41,8 @@ import at.gv.egovernment.moa.spss.util.CertificateUtils;
  * </ul>
  * Expects:
  * <ul>
- * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>
- * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_SESSIONID} containing a {@code InfoBoxReadResponse}.</li>
+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>
+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_SESSIONID} containing a {@code InfoBoxReadResponse}.</li>
  * </ul>
  * Result:
  * <ul>
@@ -59,15 +52,18 @@ import at.gv.egovernment.moa.spss.util.CertificateUtils;
  * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)
  *
  */
+@Component("VerifyCertificateTask")
 public class VerifyCertificateTask extends AbstractAuthServletTask {
 
+	@Autowired @Qualifier("CitizenCardAuthenticationServer") private AuthenticationServer authServer;
+	
 	@Override
 	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)
 			throws TaskExecutionException {
 
 		// note: code taken from at.gv.egovernment.moa.id.auth.servlet.VerifyCertificateServlet
 
-		Logger.debug("POST VerifyCertificateServlet");
+		Logger.debug("Reveive VerifyCertificate Response");
 				
 		Map<String, String> parameters;
 	    try 
@@ -76,53 +72,42 @@ public class VerifyCertificateTask extends AbstractAuthServletTask {
 	    } catch (FileUploadException | IOException e) 
 	    {
 	      Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());
-	      throw new TaskExecutionException("Parsing mulitpart/form-data request parameters failed", new IOException(e.getMessage()));
+	      throw new TaskExecutionException(pendingReq, "Parsing mulitpart/form-data request parameters failed", new IOException(e.getMessage()));
 	     }
-	    String sessionID = req.getParameter(PARAM_SESSIONID);
-	    
-	    // escape parameter strings
-		sessionID = StringEscapeUtils.escapeHtml(sessionID);
 				
-	    AuthenticationSession session = null;
 	    try {
-	       // check parameter
-	       if (!ParamValidatorUtils.isValidSessionID(sessionID))
-	          throw new WrongParametersException("VerifyCertificate", PARAM_SESSIONID, "auth.12");
-	       
-	    	session = AuthenticationServer.getSession(sessionID);
-	    	
-			IRequest pendingReq = RequestStorage.getPendingRequest(
-					(String) executionContext.get("pendingRequestID"));			
-			MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+	    	//execute default task initialization
+			defaultTaskInitialization(req, executionContext);
+			
+			revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 					pendingReq, MOAIDEventConstants.AUTHPROCESS_BKU_DATAURL_IP, req.getRemoteHost());
 	    		    	
-	        //change MOASessionID
-	        sessionID = AuthenticationSessionStoreage.changeSessionID(session);
-	    	
-    		X509Certificate cert = AuthenticationServer.getInstance().getCertificate(pendingReq, sessionID, parameters);
+	    	//read certificate from response
+    		X509Certificate cert = authServer.getCertificate(pendingReq, parameters);
     		if (cert == null) {
     			Logger.error("Certificate could not be read.");
     			throw new AuthenticationException("auth.14", null);    		
     		}
-    		
-	    	boolean useMandate = session.getUseMandate();
-	    	
-	    	if (useMandate) {
+    			    	
+	    	if (moasession.isMandateUsed()) {
 
-	    		// verify certificate for OrganWalter
-	    		String createXMLSignatureRequestOrRedirect = AuthenticationServer.getInstance().verifyCertificate(session, cert, pendingReq);
+	    		// verify certificate for OrganWalter	    		
+	    		authServer.verifyCertificate(moasession, cert, pendingReq);
+	    		
+	    		//create AuthBlock
+	    		String createXMLSignatureRequestOrRedirect = 
+	    				authServer.getCreateXMLSignatureRequestAuthBlockOrRedirect(moasession, pendingReq);
 	    		
 		    	try {
-					AuthenticationSessionStoreage.storeSession(session);
+					authenticatedSessionStorage.storeSession(moasession);
+					
 				} catch (MOADatabaseException e) {
 					throw new MOAIDException("session store error", null);
 				}
 	    		
-		    	// TODO[branch]: Mandate; respond with CXSR for authblock signature, dataURL "/VerifyAuthBlock"
-		    	CitizenCardServletUtils.writeCreateXMLSignatureRequestOrRedirect(resp, session, createXMLSignatureRequestOrRedirect, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "VerifyCertificate");
+		    	CitizenCardServletUtils.writeCreateXMLSignatureRequestOrRedirect(resp, pendingReq, createXMLSignatureRequestOrRedirect, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "VerifyCertificate");
 	    		
-	    	}
-	    	else {
+	    	} else {
 	    					    	
 	    		String countrycode = CertificateUtils.getIssuerCountry(cert);
 	    		if (countrycode != null) {
@@ -133,35 +118,29 @@ public class VerifyCertificateTask extends AbstractAuthServletTask {
 	    		}
 	    		
 	    		// Foreign Identities Modus	
-	    		MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+	    		revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 						pendingReq, MOAIDEventConstants.AUTHPROCESS_FOREIGN_FOUND);
 	    		
-		    	String createXMLSignatureRequest = AuthenticationServer.getInstance().createXMLSignatureRequestForeignID(session, cert);
+		    	String createXMLSignatureRequest = authServer.createXMLSignatureRequestForeignID(pendingReq, cert);
+		    	
 		      // build dataurl (to the GetForeignIDSerlvet)
 		    	String dataurl =
 	             new DataURLBuilder().buildDataURL(
-	               session.getAuthURL(),
+	               pendingReq.getAuthURL(),
 	               REQ_GET_FOREIGN_ID,
-	               session.getSessionID());
-	       
-		    	try {
-					AuthenticationSessionStoreage.storeSession(session);
-				} catch (MOADatabaseException e) {
-					throw new MOAIDException("session store error", null);
-				}
-		    	
-	    		// TODO[branch]: Foreign citizen; respond with CXSR for authblock signature, dataURL "/GetForeignID"
+	               pendingReq.getRequestID());
+	      		    	
 		    	CitizenCardServletUtils.writeCreateXMLSignatureRequest(resp, createXMLSignatureRequest, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "GetForeignID", dataurl);
 		    	
 		    	Logger.debug("Send CreateXMLSignatureRequest to BKU");
 	    	}	    		    	 
 	    }
 	    catch (MOAIDException ex) {
-	    	throw new TaskExecutionException(ex.getMessage(), ex);
+	    	throw new TaskExecutionException(pendingReq, ex.getMessage(), ex);
 	      
 	    } catch (Exception e) {
 	    	Logger.error("CertificateValidation has an interal Error.", e);
-	    	throw new TaskExecutionException(e.getMessage(), e);
+	    	throw new TaskExecutionException(pendingReq, e.getMessage(), e);
 	    	
 	    }
 	       
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyIdentityLinkTask.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyIdentityLinkTask.java
index 50ef11f27..0deda4d43 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyIdentityLinkTask.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyIdentityLinkTask.java
@@ -1,30 +1,22 @@
 package at.gv.egovernment.moa.id.auth.modules.internal.tasks;
 
-import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.*;
-
 import java.io.IOException;
 import java.util.Map;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.apache.commons.lang.StringEscapeUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.stereotype.Component;
 
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
-import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
 import at.gv.egovernment.moa.id.auth.AuthenticationServer;
-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.auth.exception.ParseException;
-import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
 import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
-
-import at.gv.egovernment.moa.id.moduls.IRequest;
-import at.gv.egovernment.moa.id.moduls.RequestStorage;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.process.api.ExecutionContext;
-import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;
-import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
 import at.gv.egovernment.moa.logging.Logger;
 
 /**
@@ -32,15 +24,15 @@ import at.gv.egovernment.moa.logging.Logger;
  * In detail:
  * <ul>
  * <li>Renames the moa session id.</li>
- * <li>Parses the identity link retrieved as {@code InfoBoxReadResponse} from POST parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE}.</li>
+ * <li>Parses the identity link retrieved as {@code InfoBoxReadResponse} from POST parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE}.</li>
  * <li>Verifies the identity link.</li>
  * <li>Updates moa session.</li>
  * <li>Puts boolean flag {@code identityLinkAvailable} into {@code ExecutionContext}.</li>
  * </ul>
  * Expects:
  * <ul>
- * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>
- * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE} containing a {@code InfoBoxReadResponse}.</li>
+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>
+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.commons.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE} containing a {@code InfoBoxReadResponse}.</li>
  * </ul>
  * Result:
  * <ul>
@@ -51,17 +43,16 @@ import at.gv.egovernment.moa.logging.Logger;
  * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)
  *
  */
+@Component("VerifyIdentityLinkTask")
 public class VerifyIdentityLinkTask extends AbstractAuthServletTask {
 
+	@Autowired @Qualifier("CitizenCardAuthenticationServer") private AuthenticationServer authServer;
+	
 	@Override
 	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)
 			throws TaskExecutionException {
 
-		// note: code taken from at.gv.egovernment.moa.id.auth.servlet.VerifyIdentityLinkServlet
-
-		Logger.debug("POST VerifyIdentityLink");
-
-		setNoCachingHeaders(resp);
+		Logger.debug("Receive VerifyIdentityLink Response");
 		
 		Map<String, String> parameters;
 
@@ -69,37 +60,34 @@ public class VerifyIdentityLinkTask extends AbstractAuthServletTask {
 			parameters = getParameters(req);
 		} catch (Exception e) {
 			Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());
-			throw new TaskExecutionException("Parsing mulitpart/form-data request parameters failed", new IOException(e.getMessage()));
+			throw new TaskExecutionException(pendingReq, "Parsing mulitpart/form-data request parameters failed", new IOException(e.getMessage()));
 		}
 		
 		try {
-			
-			String sessionID = StringEscapeUtils.escapeHtml(req.getParameter(PARAM_SESSIONID));
-			// check parameter
-			if (!ParamValidatorUtils.isValidSessionID(sessionID)) {
-				throw new WrongParametersException("VerifyIdentityLink", PARAM_SESSIONID, "auth.12");
-			}
-			AuthenticationSession session = AuthenticationServer.getSession(sessionID);
-
-			IRequest pendingReq = RequestStorage.getPendingRequest(
-					(String) executionContext.get("pendingRequestID"));			
-			MOAReversionLogger.getInstance().logEvent(pendingReq.getOnlineApplicationConfiguration(), 
+			//execute default task initialization
+			defaultTaskInitialization(req, executionContext);
+		
+			revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 					pendingReq, MOAIDEventConstants.AUTHPROCESS_BKU_DATAURL_IP, req.getRemoteHost());
+
+			//verify identityLink
+			boolean identityLinkAvailable = authServer.verifyIdentityLink(pendingReq, moasession, parameters) != null;
 			
-			boolean identityLinkAvailable = AuthenticationServer.getInstance().verifyIdentityLink(pendingReq, session, parameters) != null;
-			AuthenticationSessionStoreage.storeSession(session);
+			//store session
+			authenticatedSessionStorage.storeSession(moasession);
 
+			//set 'identityLink exists' flag to context
 			executionContext.put("identityLinkAvailable", identityLinkAvailable);
 
 		} catch (ParseException ex) {
-			throw new TaskExecutionException(ex.getMessage(), ex);
+			throw new TaskExecutionException(pendingReq, ex.getMessage(), ex);
 
 		} catch (MOAIDException ex) {
-			throw new TaskExecutionException(ex.getMessage(), ex);
+			throw new TaskExecutionException(pendingReq, ex.getMessage(), ex);
 
 		} catch (Exception e) {
 			Logger.error("IdentityLinkValidation has an interal Error.", e);
-			throw new TaskExecutionException(e.getMessage(), e);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
 			
 		}
 
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/parser/CreateXMLSignatureResponseParser.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/parser/CreateXMLSignatureResponseParser.java
index b39cf9e9b..eca231094 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/parser/CreateXMLSignatureResponseParser.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/parser/CreateXMLSignatureResponseParser.java
@@ -49,7 +49,10 @@ package at.gv.egovernment.moa.id.auth.parser;
 import java.io.ByteArrayInputStream;
 import java.io.InputStream;
 import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 
 import org.w3c.dom.Element;
 import org.w3c.dom.NodeList;
@@ -96,6 +99,15 @@ public class CreateXMLSignatureResponseParser {
   /** This is the root element of the CreateXMLsignatureResponse */
   private Element sigResponse_;
 
+  private static final Map<String, Object> parserFeatures =
+		  Collections.unmodifiableMap(new HashMap<String, Object>() {
+				private static final long serialVersionUID = 1L;
+				{	
+					put(DOMUtils.DISALLOW_DOCTYPE_FEATURE, true);
+					
+				}
+		  });
+  
   /**
    * Parses and validates the document given as string and extracts the 
    * root element.
@@ -156,7 +168,7 @@ public class CreateXMLSignatureResponseParser {
   private void init(InputStream is) throws AuthenticationException, ParseException, BKUException {
     try {
       
-      Element responseElem = DOMUtils.parseXmlValidating(is);
+      Element responseElem = DOMUtils.parseXmlValidating(is, parserFeatures);
       
       if ("CreateXMLSignatureResponse".equals(responseElem.getLocalName())) {
         sigResponse_ = responseElem;
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/parser/InfoboxReadResponseParser.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/parser/InfoboxReadResponseParser.java
index 28ce69e95..90fd7e1c7 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/parser/InfoboxReadResponseParser.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/parser/InfoboxReadResponseParser.java
@@ -46,18 +46,19 @@
 
 package at.gv.egovernment.moa.id.auth.parser;
 
-import iaik.x509.X509Certificate;
-
 import java.io.ByteArrayInputStream;
+import java.io.IOException;
 import java.io.InputStream;
 import java.security.cert.CertificateException;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
 
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.transform.TransformerException;
 
-import org.apache.axis.encoding.Base64;
 import org.apache.xpath.XPathAPI;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
@@ -66,9 +67,11 @@ import at.gv.egovernment.moa.id.auth.data.IdentityLink;
 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
 import at.gv.egovernment.moa.id.auth.exception.BKUException;
 import at.gv.egovernment.moa.id.auth.exception.ParseException;
+import at.gv.egovernment.moa.util.Base64Utils;
 import at.gv.egovernment.moa.util.Constants;
 import at.gv.egovernment.moa.util.DOMUtils;
 import at.gv.egovernment.moa.util.XPathUtils;
+import iaik.x509.X509Certificate;
 
 /**
  * Parses an <code>&lt;InfoboxReadResponse&gt;</code>.
@@ -82,6 +85,16 @@ public class InfoboxReadResponseParser {
   /** This is the root element of the XML-Document provided by the Security Layer Card*/
   private Element infoBoxElem_;
 
+  private static final Map<String, Object> parserFeatures =
+		  Collections.unmodifiableMap(new HashMap<String, Object>() {
+				private static final long serialVersionUID = 1L;
+				{	
+					put(DOMUtils.DISALLOW_DOCTYPE_FEATURE, true);
+					
+				}
+		  });
+
+  
   /**
    * Parses and validates the document given as string and extracts the 
    * root element.
@@ -132,7 +145,8 @@ public class InfoboxReadResponseParser {
   private void init(InputStream is) throws AuthenticationException, ParseException, BKUException {
     try {
       
-      Element responseElem = DOMUtils.parseXmlValidating(is);
+    	
+      Element responseElem = DOMUtils.parseXmlValidating(is, parserFeatures);
       
       if ("InfoboxReadResponse".equals(responseElem.getLocalName())) {
         infoBoxElem_ = responseElem;
@@ -256,16 +270,14 @@ public class InfoboxReadResponseParser {
          
          String base64Content = DOMUtils.getText(base64ContentElement);
          
-         // Decode Base64 value to X509Certificate
-         byte[] content = Base64.decode(base64Content);
+         // Decode Base64 value to X509Certificate         					
+         byte[] content = Base64Utils.decode(base64Content, false);
          return new X509Certificate(content);
          
-      } catch (ParserConfigurationException e) {
-         throw new ParseException("parser.01", new Object[] { "Could not parse X509Certificate from InfoboxReadRequest."}, e);
-      } catch (TransformerException e) {
-         throw new ParseException("parser.01", new Object[] { "Could not parse X509Certificate from InfoboxReadRequest."}, e);
-      } catch (CertificateException e) {
+      } catch (ParserConfigurationException | TransformerException |
+    		  CertificateException | IOException  e) {
          throw new ParseException("parser.01", new Object[] { "Could not parse X509Certificate from InfoboxReadRequest."}, e);
+         
       } 
 
    }
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/parser/VerifyXMLSignatureResponseParser.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/parser/VerifyXMLSignatureResponseParser.java
deleted file mode 100644
index 7bce406e0..000000000
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/parser/VerifyXMLSignatureResponseParser.java
+++ /dev/null
@@ -1,211 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- * 
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- * 
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- ******************************************************************************/
-/*
- * Copyright 2003 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- */
-
-
-package at.gv.egovernment.moa.id.auth.parser;
-
-import iaik.utils.Base64InputStream;
-import iaik.x509.X509Certificate;
-
-import java.io.ByteArrayInputStream;
-import java.io.InputStream;
-
-import org.w3c.dom.Element;
-
-import at.gv.egovernment.moa.id.auth.data.VerifyXMLSignatureResponse;
-import at.gv.egovernment.moa.id.auth.exception.ParseException;
-import at.gv.egovernment.moa.util.Constants;
-import at.gv.egovernment.moa.util.DOMUtils;
-import at.gv.egovernment.moa.util.XPathUtils;
-
-/**
- * Parses a <code>&lt;VerifyXMLSignatureResponse&gt;</code> returned by
- * MOA-SPSS.
- * This class implements the Singleton pattern
- * 
- * @author Stefan Knirsch
- * @version $Id$
- */
-
-
-public class VerifyXMLSignatureResponseParser {
-  //
-  // XPath namespace prefix shortcuts
-  //
-  /** Xpath prefix for reaching MOA Namespaces */
-  private static final String MOA = Constants.MOA_PREFIX + ":";
-  /** Xpath prefix for reaching DSIG Namespaces */
-  private static final String DSIG = Constants.DSIG_PREFIX + ":";
-  /** Xpath expression to the root element */    
-  private static final String ROOT = "/" + MOA + "VerifyXMLSignatureResponse/";
-  
-    /** Xpath expression to the X509SubjectName element */  
-  private static final String DSIG_SUBJECT_NAME_XPATH = 
-      ROOT + MOA + "SignerInfo/" + DSIG + "X509Data/" + 
-      DSIG + "X509SubjectName";        
-  /** Xpath expression to the X509Certificate element */  
-  private static final String DSIG_X509_CERTIFICATE_XPATH = 
-      ROOT + MOA + "SignerInfo/" + DSIG + "X509Data/" + 
-          DSIG + "X509Certificate";        
-  /** Xpath expression to the PublicAuthority element */  
-  private static final String PUBLIC_AUTHORITY_XPATH =
-     ROOT + MOA + "SignerInfo/" + DSIG + "X509Data/" + 
-      MOA + "PublicAuthority";        
-  /** Xpath expression to the PublicAuthorityCode element */  
-  private static final String PUBLIC_AUTHORITY_CODE_XPATH =
-     PUBLIC_AUTHORITY_XPATH + "/" + MOA + "Code";        
-  /** Xpath expression to the QualifiedCertificate element */  
-   private static final String QUALIFIED_CERTIFICATE_XPATH =
-     ROOT + MOA + "SignerInfo/" + DSIG + "X509Data/" + 
-      MOA + "QualifiedCertificate";        
-   
-  /** Xpath expression to the SignatureCheckCode element */    
-  private static final String SIGNATURE_CHECK_CODE_XPATH = 
-   ROOT + MOA + "SignatureCheck/" + MOA + "Code";
-  /** Xpath expression to the XMLDSIGManifestCheckCode element */    
-  private static final String XMLDSIG_MANIFEST_CHECK_CODE_XPATH = 
-   ROOT + MOA + "XMLDSIGManifestCheck/" + MOA + "Code";
-  /** Xpath expression to the SignatureManifestCheckCode element */    
-  private static final String SIGNATURE_MANIFEST_CHECK_CODE_XPATH = 
-   ROOT + MOA + "SignatureManifestCheck/" + MOA + "Code";
-  /** Xpath expression to the CertificateCheckCode element */      
-  private static final String CERTIFICATE_CHECK_CODE_XPATH = 
-   ROOT + MOA + "CertificateCheck/" + MOA + "Code";
-  
-    
-  /** This is the root element of the XML-Document provided by the Security Layer Card*/
-  private Element verifyXMLSignatureResponse;
-
-  /**
-   * Constructor for VerifyXMLSignatureResponseParser.
-   * A DOM-representation of the incoming String will be created
-   * @param xmlResponse <code>&lt;InfoboxReadResponse&gt;</code> as String
-   * @throws ParseException on any parsing error
-   */
-  public VerifyXMLSignatureResponseParser(String xmlResponse) throws ParseException{
-   try {
-  InputStream s = new ByteArrayInputStream(xmlResponse.getBytes("UTF-8"));
-  
-  verifyXMLSignatureResponse = DOMUtils.parseXmlValidating(s); 
-     }
-     catch (Throwable t) {
-      throw new ParseException("parser.01", new Object[] { t.toString() }, t);
-    } 
-  }
-  
-  /**
-   * Constructor for VerifyXMLSignatureResponseParser.
-   * A DOM-representation of the incoming Inputstream will be created
-   * @param xmlResponse <code>&lt;InfoboxReadResponse&gt;</code> as InputStream
-   * @throws Exception on any parsing error
-   */
-  public VerifyXMLSignatureResponseParser(InputStream xmlResponse) throws Exception
-  {
-    try {
-       verifyXMLSignatureResponse = DOMUtils.parseXmlValidating(xmlResponse);                        
-    }
-     catch (Throwable t) {
-      throw new ParseException("parser.01", null, t);
-    } 
-  } 
-  
-   /**
-   * Constructor for VerifyXMLSignatureResponseParser.
-   * The incoming Element will be used for further operations
-   * @param xmlResponse <code>&lt;InfoboxReadResponse&gt;</code> as Element
-   */
-  public VerifyXMLSignatureResponseParser(Element xmlResponse)
-  {
-      verifyXMLSignatureResponse =xmlResponse;                        
-  
-  }
-  
-  /**
-   * Parse identity link from <code>&lt;InfoboxReadResponse&gt;</code>
-   * @return Identity link
-   * @throws ParseException on any parsing error
-   */
-
-  public VerifyXMLSignatureResponse parseData() throws ParseException {
-
-    VerifyXMLSignatureResponse respData=new VerifyXMLSignatureResponse();
-
-    try {
-    	
-      String s = DOMUtils.serializeNode(verifyXMLSignatureResponse);
-      respData.setXmlDsigSubjectName(XPathUtils.getElementValue(verifyXMLSignatureResponse,DSIG_SUBJECT_NAME_XPATH,""));
-      Element e = (Element)XPathUtils.selectSingleNode(verifyXMLSignatureResponse,QUALIFIED_CERTIFICATE_XPATH);
-      respData.setQualifiedCertificate(e!=null);
-
-      Base64InputStream in = new Base64InputStream(new ByteArrayInputStream(XPathUtils.getElementValue(
-        verifyXMLSignatureResponse,DSIG_X509_CERTIFICATE_XPATH,"").getBytes("UTF-8")),true);
-
-      respData.setX509certificate(new X509Certificate(in));
-      Element publicAuthority = (Element)XPathUtils.selectSingleNode(verifyXMLSignatureResponse,PUBLIC_AUTHORITY_XPATH);
-      respData.setPublicAuthority(publicAuthority != null);
-      respData.setPublicAuthorityCode(XPathUtils.getElementValue(verifyXMLSignatureResponse,PUBLIC_AUTHORITY_CODE_XPATH,""));
-      respData.setSignatureCheckCode(new Integer(XPathUtils.getElementValue(verifyXMLSignatureResponse,SIGNATURE_CHECK_CODE_XPATH,"")).intValue());
-
-      String xmlDsigCheckCode = XPathUtils.getElementValue(verifyXMLSignatureResponse,XMLDSIG_MANIFEST_CHECK_CODE_XPATH,null);
-      if (xmlDsigCheckCode!=null) { 
-        respData.setXmlDSIGManigest(true);
-        respData.setXmlDSIGManifestCheckCode(new Integer(xmlDsigCheckCode).intValue());
-      } else {
-        respData.setXmlDSIGManigest(false);
-      }
-      String signatureManifestCheckCode = XPathUtils.getElementValue(verifyXMLSignatureResponse,SIGNATURE_MANIFEST_CHECK_CODE_XPATH,null);
-      if (signatureManifestCheckCode != null) {
-        respData.setSignatureManifestCheckCode(new Integer(signatureManifestCheckCode).intValue());
-      }
-      respData.setCertificateCheckCode(new Integer(XPathUtils.getElementValue(verifyXMLSignatureResponse,CERTIFICATE_CHECK_CODE_XPATH,"")).intValue());             
-    }
-    catch (Throwable t) {
-      throw new ParseException("parser.01", null, t);
-    }        
-    return respData;
-  }
-  
-  
-}
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/servlet/CitizenCardAuthProcessEngineSignalController.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/servlet/CitizenCardAuthProcessEngineSignalController.java
new file mode 100644
index 000000000..139be49fe
--- /dev/null
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/servlet/CitizenCardAuthProcessEngineSignalController.java
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.servlet;
+
+import java.io.IOException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+/**
+ * @author tlenz
+ *
+ */
+@Controller
+public class CitizenCardAuthProcessEngineSignalController extends AbstractProcessEngineSignalController {
+
+	@RequestMapping(value = {"/GetMISSessionID", 
+			 				 "/GetForeignID",
+			 				 "/VerifyAuthBlock",
+			 				 "/VerifyCertificate",
+			 				 "/VerifyIdentityLink"
+           					}, 
+					method = {RequestMethod.POST, RequestMethod.GET})
+	public void performCitizenCardAuthentication(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+		signalProcessManagement(req, resp);
+
+}
+}
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/validator/CreateXMLSignatureResponseValidator.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/validator/CreateXMLSignatureResponseValidator.java
index 8a9c19c80..4b0e7b869 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/validator/CreateXMLSignatureResponseValidator.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/validator/CreateXMLSignatureResponseValidator.java
@@ -63,11 +63,12 @@ import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttribute;
 import at.gv.egovernment.moa.id.auth.data.IdentityLink;
 import at.gv.egovernment.moa.id.auth.data.SAMLAttribute;
 import at.gv.egovernment.moa.id.auth.exception.ValidateException;
-import at.gv.egovernment.moa.id.config.ConfigurationException;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 import at.gv.egovernment.moa.id.config.TargetToSectorNameMapper;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.moduls.IRequest;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.Constants;
 import at.gv.egovernment.moa.util.MiscUtil;
@@ -132,10 +133,14 @@ public class CreateXMLSignatureResponseValidator {
    throws ValidateException {
       
       // A3.056: more then one /saml:Assertion/saml:AttributeStatement/saml:Subject/saml:NameIdentifier
-    
-    String gbTarget = session.getTarget();
-    String oaURL = session.getPublicOAURLPrefix(); 
-    boolean businessService = session.getBusinessService();
+    IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
+	  
+    String gbTarget = pendingReq.getGenericData(
+    		MOAIDAuthConstants.AUTHPROCESS_DATA_TARGET, String.class);
+    String targetFriendlyName = pendingReq.getGenericData(
+    		MOAIDAuthConstants.AUTHPROCESS_DATA_TARGETFRIENDLYNAME, String.class);
+    String oaURL = oaParam.getPublicURLPrefix(); 
+    boolean businessService = oaParam.getBusinessService();
     
     IdentityLink identityLink = session.getIdentityLink();
     
@@ -227,8 +232,7 @@ public class CreateXMLSignatureResponseValidator {
           }
         }
         if (samlAttribute.getNamespace().equals("http://reference.e-government.gv.at/namespace/moa/20020822#")) {          
-          foundGB = true;
-          String targetFriendlyName = session.getTargetFriendlyName();
+          foundGB = true;          
           String sectorName = TargetToSectorNameMapper.getSectorNameViaTarget(gbTarget);
           if (StringUtils.isEmpty(sectorName)) {
         	  if (targetFriendlyName != null)
@@ -293,23 +297,18 @@ public class CreateXMLSignatureResponseValidator {
       samlSpecialText = samlSpecialText.replaceAll("'", "&#39;");
       
       String text = "";
-      try {
-		OAAuthParameter oaparam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(session.getPublicOAURLPrefix());
-		if (MiscUtil.isNotEmpty(oaparam.getAditionalAuthBlockText())) {
-			Logger.info("Use addional AuthBlock Text from OA=" + oaparam.getPublicURLPrefix());
-			text = oaparam.getAditionalAuthBlockText();
-		}
-      } catch (ConfigurationException e) {
-    	  Logger.warn("Addional AuthBlock Text can not loaded from OA!", e);
+      if (MiscUtil.isNotEmpty(oaParam.getAditionalAuthBlockText())) {
+		Logger.info("Use addional AuthBlock Text from OA=" + oaParam.getPublicURLPrefix());
+		text = oaParam.getAditionalAuthBlockText();
       }
-      
-      
+            
       String specialText = AuthenticationBlockAssertionBuilder.generateSpecialText(text, issuer, identityLink.getDateOfBirth(), issueInstant);
       if (!samlSpecialText.equals(specialText)) {
-        throw new ValidateException("validator.67", new Object[] {samlSpecialText, specialText});
+    	  throw new ValidateException("validator.67", new Object[] {samlSpecialText, specialText});
       }
     } else {
       throw new ValidateException("validator.35", null);
+      
     }
     
     
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/validator/VerifyXMLSignatureResponseValidator.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/validator/VerifyXMLSignatureResponseValidator.java
index ac528c89d..df101f5b7 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/validator/VerifyXMLSignatureResponseValidator.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/validator/VerifyXMLSignatureResponseValidator.java
@@ -61,14 +61,14 @@ import java.util.Iterator;
 import java.util.List;
 import java.util.Set;
 
-import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
 import at.gv.egovernment.moa.id.auth.data.IdentityLink;
 import at.gv.egovernment.moa.id.auth.data.VerifyXMLSignatureResponse;
 import at.gv.egovernment.moa.id.auth.exception.ValidateException;
-import at.gv.egovernment.moa.id.config.ConfigurationException;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
+import at.gv.egovernment.moa.id.commons.utils.MOAIDMessageProvider;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.util.MOAIDMessageProvider;
 import at.gv.egovernment.moa.logging.Logger;
 
 /**
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/validator/parep/ParepUtils.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/validator/parep/ParepUtils.java
index 1850ff671..55562176d 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/validator/parep/ParepUtils.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/validator/parep/ParepUtils.java
@@ -69,7 +69,7 @@ import at.gv.egovernment.moa.id.auth.exception.ParseException;
 import at.gv.egovernment.moa.id.auth.exception.ValidateException;
 import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWClientException;
 import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWConstants;
-import at.gv.egovernment.moa.id.config.ConfigurationException;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.BoolUtils;
 import at.gv.egovernment.moa.util.Constants;
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/util/CitizenCardServletUtils.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/util/CitizenCardServletUtils.java
index 276d6a105..2a8d26566 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/util/CitizenCardServletUtils.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/util/CitizenCardServletUtils.java
@@ -53,13 +53,13 @@ import java.io.IOException;
 import java.io.OutputStream;
 import java.net.URLEncoder;
 
-import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
 import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;
 import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.logging.Logger;
 
 /**
@@ -73,21 +73,21 @@ public class CitizenCardServletUtils extends ServletUtils{
    * depending on the requests starting text.
    * 
    * @param resp The httpServletResponse
-   * @param session The current AuthenticationSession
+   * @param pendingReq The current AuthenticationSession
    * @param createXMLSignatureRequestOrRedirect The request
    * @param servletGoal The servlet to which the redirect should happen
    * @param servletName The servlet name for debug purposes
    * @throws MOAIDException
    * @throws IOException
    */
-  public static void writeCreateXMLSignatureRequestOrRedirect(HttpServletResponse resp, AuthenticationSession session, String createXMLSignatureRequestOrRedirect, String servletGoal, String servletName) 
+  public static void writeCreateXMLSignatureRequestOrRedirect(HttpServletResponse resp, IRequest pendingReq, String createXMLSignatureRequestOrRedirect, String servletGoal, String servletName) 
   throws MOAIDException,
          IOException
   { 
     if (!createXMLSignatureRequestOrRedirect.startsWith("Redirect")) {
       resp.setStatus(307);
       String dataURL = new DataURLBuilder().buildDataURL(
-        session.getAuthURL(), MOAIDAuthConstants.REQ_VERIFY_AUTH_BLOCK, session.getSessionID());
+        pendingReq.getAuthURL(), MOAIDAuthConstants.REQ_VERIFY_AUTH_BLOCK, pendingReq.getRequestID());
       resp.addHeader("Location", dataURL);
       
       //TODO test impact of explicit setting charset with older versions of BKUs (HotSign)
@@ -100,7 +100,7 @@ public class CitizenCardServletUtils extends ServletUtils{
       Logger.debug("Finished POST " + servletName);
       
     } else {
-      String redirectURL = new DataURLBuilder().buildDataURL(session.getAuthURL(), servletGoal, session.getSessionID());
+      String redirectURL = new DataURLBuilder().buildDataURL(pendingReq.getAuthURL(), servletGoal, pendingReq.getRequestID());
       resp.setContentType("text/html");
       resp.setStatus(302);
       resp.addHeader("Location", redirectURL);
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/util/client/mis/simple/MISSimpleClient.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/util/client/mis/simple/MISSimpleClient.java
index e346c8bee..7b5a7b9c0 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/util/client/mis/simple/MISSimpleClient.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/util/client/mis/simple/MISSimpleClient.java
@@ -56,7 +56,6 @@ import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.transform.TransformerException;
 
 import org.apache.commons.codec.binary.Base64;
-import org.apache.commons.httpclient.HostConfiguration;
 import org.apache.commons.httpclient.HttpClient;
 import org.apache.commons.httpclient.methods.PostMethod;
 import org.apache.commons.httpclient.methods.StringRequestEntity;
@@ -148,7 +147,6 @@ public class MISSimpleClient {
 				
 				//misMandate.setMandate(Base64.decodeBase64(DOMUtils.getText(mandate)));
 				misMandate.setMandate(Base64.decodeBase64(DOMUtils.getText(mandate).getBytes()));
-				misMandate.setFullMandateIncluded(true);
 				
 				foundMandates.add(misMandate);
 			}
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider
new file mode 100644
index 000000000..2ca8587b6
--- /dev/null
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider
@@ -0,0 +1 @@
+at.gv.egovernment.moa.id.auth.CitizenCardAuthenticationSpringResourceProvider
\ No newline at end of file
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/resources/META-INF/services/at.gv.egovernment.moa.id.auth.modules.AuthModule b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/resources/META-INF/services/at.gv.egovernment.moa.id.auth.modules.AuthModule
index 865096055..e628fbd1b 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/resources/META-INF/services/at.gv.egovernment.moa.id.auth.modules.AuthModule
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/resources/META-INF/services/at.gv.egovernment.moa.id.auth.modules.AuthModule
@@ -1,2 +1,2 @@
 # The default moaid process
-at.gv.egovernment.moa.id.auth.modules.internal.DefaultAuthModuleImpl
+at.gv.egovernment.moa.id.auth.modules.internal.DefaultCitizenCardAuthModuleImpl
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/resources/at/gv/egovernment/moa/id/auth/modules/internal/DefaultAuthentication.process.xml b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/resources/at/gv/egovernment/moa/id/auth/modules/internal/DefaultAuthentication.process.xml
index 6bbaf6ece..74792ed72 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/resources/at/gv/egovernment/moa/id/auth/modules/internal/DefaultAuthentication.process.xml
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/resources/at/gv/egovernment/moa/id/auth/modules/internal/DefaultAuthentication.process.xml
@@ -5,17 +5,17 @@
 	- National authentication with Austrian Citizen Card and mobile signature with our without mandate.
 	- Legacy authentication for foreign citizens using MOCCA supported signature cards.
 -->
-	<pd:Task id="initializeBKUAuthentication" class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.InitializeBKUAuthenticationTask" />
-	<pd:Task id="createIdentityLinkForm"    class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.CreateIdentityLinkFormTask" />
-	<pd:Task id="verifyIdentityLink"        class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.VerifyIdentityLinkTask"        async="true" />
-	<pd:Task id="verifyAuthBlock"           class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.VerifyAuthenticationBlockTask" async="true" />
-	<pd:Task id="verifyCertificate"         class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.VerifyCertificateTask"         async="true" />
-	<pd:Task id="getMISMandate"           class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.GetMISSessionIDTask"           async="true" />
-	<pd:Task id="certificateReadRequest"    class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.CertificateReadRequestTask" />
-	<pd:Task id="prepareAuthBlockSignature" class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.PrepareAuthBlockSignatureTask" />
-	<pd:Task id="prepareGetMISMandate" 			class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.PrepareGetMISMandateTask" />
-	<pd:Task id="finalizeAuthentication" 		class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.FinalizeAuthenticationTask" />
-	<pd:Task id="getForeignID"              class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.GetForeignIDTask"              async="true" />
+	<pd:Task id="initializeBKUAuthentication" class="InitializeBKUAuthenticationTask" />
+	<pd:Task id="createIdentityLinkForm"    class="CreateIdentityLinkFormTask" />
+	<pd:Task id="verifyIdentityLink"        class="VerifyIdentityLinkTask"        async="true" />
+	<pd:Task id="verifyAuthBlock"           class="VerifyAuthenticationBlockTask" async="true" />
+	<pd:Task id="verifyCertificate"         class="VerifyCertificateTask"         async="true" />
+	<pd:Task id="getMISMandate"           	class="GetMISSessionIDTask"           async="true" />
+	<pd:Task id="certificateReadRequest"    class="CertificateReadRequestTask" />
+	<pd:Task id="prepareAuthBlockSignature" class="PrepareAuthBlockSignatureTask" />
+	<pd:Task id="prepareGetMISMandate" 			class="PrepareGetMISMandateTask" />
+	<pd:Task id="finalizeAuthentication" 		class="FinalizeAuthenticationTask" />
+	<pd:Task id="getForeignID"              class="GetForeignIDTask"              async="true" />
 
 	<!-- Process is triggered either by GenerateIFrameTemplateServlet (upon bku selection) or by AuthenticationManager (upon legacy authentication start using legacy parameters. -->
 	<pd:StartEvent id="start" />
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/resources/moaid_citizencard_auth.beans.xml b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/resources/moaid_citizencard_auth.beans.xml
new file mode 100644
index 000000000..b0ab11a11
--- /dev/null
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/resources/moaid_citizencard_auth.beans.xml
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xmlns:tx="http://www.springframework.org/schema/tx"
+	xmlns:aop="http://www.springframework.org/schema/aop"
+	xsi:schemaLocation="http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.1.xsd
+		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd
+		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd">
+ 
+	<bean id="CitizenCardAuthenticationServer" 
+				class="at.gv.egovernment.moa.id.auth.AuthenticationServer"/>
+							
+				
+<!-- Authentication Process Tasks -->
+	<bean id="InitializeBKUAuthenticationTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.InitializeBKUAuthenticationTask"
+				scope="prototype"/>
+
+	<bean id="CreateIdentityLinkFormTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.CreateIdentityLinkFormTask"
+				scope="prototype"/>
+				
+	<bean id="VerifyIdentityLinkTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.VerifyIdentityLinkTask"
+				scope="prototype"/>				
+
+	<bean id="CertificateReadRequestTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.CertificateReadRequestTask"
+				scope="prototype"/>
+
+	<bean id="VerifyCertificateTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.VerifyCertificateTask"
+				scope="prototype"/>
+				
+	<bean id="PrepareAuthBlockSignatureTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.PrepareAuthBlockSignatureTask"
+				scope="prototype"/>
+				
+	<bean id="VerifyAuthenticationBlockTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.VerifyAuthenticationBlockTask"
+				scope="prototype"/>
+				
+	<bean id="PrepareGetMISMandateTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.PrepareGetMISMandateTask"
+				scope="prototype"/>
+				
+	<bean id="GetMISSessionIDTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.GetMISSessionIDTask"
+				scope="prototype"/>
+				
+	<bean id="GetForeignIDTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.internal.tasks.GetForeignIDTask"
+				scope="prototype"/>
+																																					
+</beans>
\ No newline at end of file
diff --git a/id/server/modules/moa-id-module-eIDAS/pom.xml b/id/server/modules/moa-id-module-eIDAS/pom.xml
new file mode 100644
index 000000000..addf086d8
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/pom.xml
@@ -0,0 +1,160 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>MOA.id.server.modules</groupId>
+    <artifactId>moa-id-modules</artifactId>
+    <version>${moa-id-version}</version>
+  </parent>
+  <artifactId>moa-id-module-eIDAS</artifactId>
+  <name>MOA-ID eIDAS Module</name>
+  <description>Inbound / outbound implemention of eIDAS protocol for MOA-ID</description>
+  
+  <properties>
+		<repositoryPath>${basedir}/../../../../repository</repositoryPath>
+		
+		<eidas-commons.version>eidas.1.0</eidas-commons.version>
+		<eidas-saml-engine.version>eidas.1.0</eidas-saml-engine.version>
+		<eidas-encryption.version>eidas.1.0</eidas-encryption.version>
+		<eidas-configmodule.version>eidas.1.0</eidas-configmodule.version>
+				
+	</properties>
+  
+      <profiles>
+        <profile>
+            <id>default</id>
+            <activation>
+                <activeByDefault>true</activeByDefault>
+            </activation>
+            <repositories>
+                <repository>
+                    <id>local</id>
+                    <name>local</name>
+                    <url>file:${basedir}/../../../../repository</url>
+                </repository>
+                <repository>
+                    <id>egiz-commons</id>
+                    <url>https://demo.egiz.gv.at/int-repo/</url>
+                    <releases>
+                        <enabled>true</enabled>
+                    </releases>
+                </repository>
+            </repositories>
+        </profile>
+    </profiles>
+  
+  <dependencies>
+  	<dependency>
+			<groupId>org.springframework</groupId>
+			<artifactId>spring-test</artifactId>
+			<scope>test</scope>
+		</dependency>
+
+		<dependency>
+			<groupId>junit</groupId>
+			<artifactId>junit</artifactId>
+			<scope>test</scope>
+		</dependency>
+  
+		<!-- eidas Commons -->
+		<dependency>
+    		<groupId>eu.eidas</groupId>
+    		<artifactId>eidas-commons</artifactId>
+    		<version>${eidas-commons.version}</version>
+			<!--scope>provided</scope-->
+            <exclusions>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+                <exclusion>
+                	<artifactId>log4j-over-slf4j</artifactId>
+                	<groupId>org.slf4j</groupId>
+                </exclusion>
+            </exclusions>
+		</dependency>
+	
+		<dependency>
+			<groupId>eu.eidas</groupId>
+  		<artifactId>eidas-configmodule</artifactId>
+  		<version>${eidas-configmodule.version}</version>
+  		<exclusions>
+  			<exclusion>
+  				<artifactId>log4j-over-slf4j</artifactId>
+  				<groupId>org.slf4j</groupId>
+  			</exclusion>
+  		</exclusions>
+		</dependency>
+
+		<dependency>
+			<groupId>eu.eidas</groupId>
+			<artifactId>eidas-encryption</artifactId>
+  		<version>${eidas-encryption.version}</version>
+  		<exclusions>
+  			<exclusion>
+  				<artifactId>log4j-over-slf4j</artifactId>
+  				<groupId>org.slf4j</groupId>
+  			</exclusion>
+  		</exclusions>
+		</dependency>
+
+		<!-- eidas SAML Engine -->
+		<dependency> 
+    		<groupId>eu.eidas</groupId>
+    		<artifactId>saml-engine</artifactId>
+    		<version>${eidas-saml-engine.version}</version>
+    		<scope>compile</scope>
+			<exclusions>
+				<exclusion>
+					<groupId>org.slf4j</groupId>
+					<artifactId>slf4j-simple</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>org.slf4j</groupId>
+					<artifactId>jcl-over-slf4j</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>org.slf4j</groupId>
+					<artifactId>slf4j-api</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>org.slf4j</groupId>
+					<artifactId>jul-to-slf4j</artifactId>
+				</exclusion>
+				<exclusion>
+					<groupId>org.slf4j</groupId>
+					<artifactId>log4j-over-slf4j</artifactId>
+				</exclusion>
+                <exclusion>
+                    <groupId>xalan</groupId>
+                    <artifactId>serializer</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>xalan</groupId>
+                    <artifactId>xalan</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>xerces</groupId>
+                    <artifactId>xercesImpl</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>xml-resolver</groupId>
+                    <artifactId>xml-resolver</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>xml-apis</groupId>
+                    <artifactId>xml-apis</artifactId>
+                </exclusion>
+			</exclusions>
+		</dependency>  
+  
+  	<dependency>
+			<groupId>org.bouncycastle</groupId>
+			<artifactId>bcprov-jdk15on</artifactId>
+			<version>1.52</version>
+			<!-- <scope>provided</scope> -->
+		</dependency>
+  
+  
+  </dependencies>
+  
+</project>
\ No newline at end of file
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/Constants.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/Constants.java
new file mode 100644
index 000000000..d93d739b1
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/Constants.java
@@ -0,0 +1,124 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.opensaml.xml.encryption.EncryptionConstants;
+import org.opensaml.xml.signature.SignatureConstants;
+
+import eu.eidas.auth.engine.core.eidas.EidasAttributesTypes;
+import eu.eidas.auth.engine.core.validator.eidas.EIDASAttributes;
+
+/**
+ * @author tlenz
+ *
+ */
+public class Constants {
+
+	public static final String eIDAS_SAML_ENGINE_NAME = "default";
+	public static final String SSLSOCKETFACTORYNAME = "eIDASMetadataSSLSocketFactory";
+		
+	//default keys for eIDAS SAML-engine configuration
+	public static final String eIDAS_SAML_ENGINE_NAME_ID_BASICCONFIG = "SamlEngineConf";
+	public static final String eIDAS_SAML_ENGINE_NAME_ID_SIGNATURECONFIG = "SignatureConf";
+	public static final String eIDAS_SAML_ENGINE_NAME_ID_ENCRYPTIONCONFIG = "EncryptionConf";
+	public static final String eIDAS_SAML_ENGINE_NAME_ID_CLASS = "class";
+	
+	//default implementations for eIDAS SAML-engine functionality
+	public static final String SAML_SIGNING_IMPLENTATION = "eu.eidas.auth.engine.core.impl.SignSW";
+	public static final String SAML_ENCRYPTION_IMPLENTATION = "at.gv.egovernment.moa.id.auth.modules.eidas.config.ModifiedEncryptionSW";
+	
+	//configuration property keys
+	public static final String CONIG_PROPS_EIDAS_PREFIX="moa.id.protocols.eIDAS";
+	public static final String CONIG_PROPS_EIDAS_SAMLENGINE="samlengine";
+	public static final String CONIG_PROPS_EIDAS_SAMLENGINE_PREFIX=CONIG_PROPS_EIDAS_PREFIX + "." + CONIG_PROPS_EIDAS_SAMLENGINE;
+	public static final String CONIG_PROPS_EIDAS_SAMLENGINE_BASIC_CONFIGFILE = CONIG_PROPS_EIDAS_SAMLENGINE_PREFIX + ".config.file";	
+	public static final String CONIG_PROPS_EIDAS_SAMLENGINE_SIGN="sign";
+	public static final String CONIG_PROPS_EIDAS_SAMLENGINE_ENCRYPT="enc";
+	public static final String CONIG_PROPS_EIDAS_SAMLENGINE_SIGN_CONFIGFILE = CONIG_PROPS_EIDAS_SAMLENGINE_PREFIX + "." 
+			+ CONIG_PROPS_EIDAS_SAMLENGINE_SIGN + ".config.file";
+	public static final String CONIG_PROPS_EIDAS_SAMLENGINE_ENC_CONFIGFILE = CONIG_PROPS_EIDAS_SAMLENGINE_PREFIX + "." 
+			+ CONIG_PROPS_EIDAS_SAMLENGINE_ENCRYPT + ".config.file";	
+	public static final String CONIG_PROPS_EIDAS_METADATA_VALIDATION_TRUSTSTORE = CONIG_PROPS_EIDAS_PREFIX + ".metadata.validation.truststore";
+	
+	//timeouts and clock skews
+	public static final long CONFIG_PROPS_SKEWTIME = 2 * 60 * 1000;  			//2 minutes skew time for response validation
+	public static final int CONFIG_PROPS_METADATA_SOCKED_TIMEOUT = 20 * 1000;  	//20 seconds metadata socked timeout
+	public static final long CONFIG_PROPS_METADATA_GARBAGE_TIMEOUT = 7 * 24 * 60 * 60 * 1000;	//remove unused eIDAS metadata after 7 days
+		
+	//eIDAS attribute names
+	public static final String eIDAS_ATTR_PERSONALIDENTIFIER = EIDASAttributes.ATTRIBUTE_NAME_SUFFIX_PERSONIDENTIFIER;
+	public static final String eIDAS_ATTR_DATEOFBIRTH = EIDASAttributes.ATTRIBUTE_NAME_SUFFIX_DATEOFBIRTH;
+	public static final String eIDAS_ATTR_CURRENTGIVENNAME = EIDASAttributes.ATTRIBUTE_NAME_SUFFIX_FIRSTNAME;
+	public static final String eIDAS_ATTR_CURRENTFAMILYNAME = EIDASAttributes.ATTRIBUTE_NAME_SUFFIX_GIVENNAME;
+		
+	//http endpoint descriptions
+	public static final String eIDAS_HTTP_ENDPOINT_SP_POST = "/eidas/sp/post";
+	public static final String eIDAS_HTTP_ENDPOINT_SP_REDIRECT = "/eidas/sp/redirect";
+	public static final String eIDAS_HTTP_ENDPOINT_IDP_POST = "/eidas/idp/post";	
+	public static final String eIDAS_HTTP_ENDPOINT_IDP_COLLEAGUEREQUEST = "/eidas/ColleagueRequest";
+	public static final String eIDAS_HTTP_ENDPOINT_IDP_REDIRECT = "/eidas/idp/redirect";
+	public static final String eIDAS_HTTP_ENDPOINT_METADATA = "/eidas/metadata";
+	
+	
+	//Event-Codes for Revisionslog
+	public static final int eIDAS_REVERSIONSLOG_METADATA = 3400;
+	public static final int eIDAS_REVERSIONSLOG_IDP_AUTHREQUEST = 3401;
+	public static final int eIDAS_REVERSIONSLOG_IDP_AUTHRESPONSE = 3402;
+	public static final int eIDAS_REVERSIONSLOG_SP_AUTHREQUEST= 3403;
+	public static final int eIDAS_REVERSIONSLOG_SP_AUTHRESPONSE= 3404;
+		
+	//metadata constants
+    public final static Map<String, EidasAttributesTypes> METADATA_POSSIBLE_ATTRIBUTES = Collections.unmodifiableMap(
+            new HashMap<String, EidasAttributesTypes>(){
+				private static final long serialVersionUID = 1L;
+				{
+                    put(EIDASAttributes.ATTRIBUTE_GIVENNAME, EidasAttributesTypes.NATURAL_PERSON_MANDATORY);
+                    put(EIDASAttributes.ATTRIBUTE_FIRSTNAME, EidasAttributesTypes.NATURAL_PERSON_MANDATORY);
+                    put(EIDASAttributes.ATTRIBUTE_DATEOFBIRTH, EidasAttributesTypes.NATURAL_PERSON_MANDATORY);
+                    put(EIDASAttributes.ATTRIBUTE_PERSONIDENTIFIER, EidasAttributesTypes.NATURAL_PERSON_MANDATORY);
+
+                    //TODO: add additional attributes for eIDAS with mandates
+                    //put(EIDASAttributes.ATTRIBUTE_LEGALIDENTIFIER, EidasAttributesTypes.LEGAL_PERSON_MANDATORY);
+                    //put(EIDASAttributes.ATTRIBUTE_LEGALNAME, EidasAttributesTypes.LEGAL_PERSON_MANDATORY);
+                }
+            }
+    );
+    
+    public static final String METADATA_ALLOWED_ALG_DIGIST = 
+    		SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256 + ";" + 
+    		SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512 ;
+    
+    public static final String METADATA_ALLOWED_ALG_SIGN = 
+    		SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256 + ";" + 
+    		SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512;
+    
+    public static final String METADATA_ALLOWED_ALG_ENCRYPT = 
+    		EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM + ";" + 
+    		EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192_GCM + ";" + 
+    		EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256_GCM;
+    
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/config/MOAIDCertificateManagerConfigurationImpl.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/config/MOAIDCertificateManagerConfigurationImpl.java
new file mode 100644
index 000000000..1759a7281
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/config/MOAIDCertificateManagerConfigurationImpl.java
@@ -0,0 +1,118 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.config;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import at.gv.egovernment.moa.logging.Logger;
+
+import eu.eidas.config.ConfigurationException;
+import eu.eidas.samlengineconfig.AbstractCertificateConfigurationManager;
+import eu.eidas.samlengineconfig.EngineInstance;
+import eu.eidas.samlengineconfig.SamlEngineConfiguration;
+import eu.eidas.samlengineconfig.impl.SamlEngineConfigurationImpl;
+
+/**
+ * @author tlenz
+ *
+ */
+public class MOAIDCertificateManagerConfigurationImpl extends
+		AbstractCertificateConfigurationManager {
+
+    private SamlEngineConfiguration samlEngineConfiguration =null;
+	
+    @Override
+	public boolean isActive() {
+		return true;
+	}
+    
+    /**
+	 * 
+	 */
+	public MOAIDCertificateManagerConfigurationImpl() {
+		try {
+			initalizeConfiguration();
+			
+		} catch (at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException e) {
+			Logger.error("eIDAS SAML-engine initialization FAILED", e);
+			
+		}
+	}
+    
+	
+	/* (non-Javadoc)
+	 * @see eu.eidas.samlengineconfig.CertificateConfigurationManager#addConfiguration(java.lang.String, java.lang.String, java.util.Map, boolean)
+	 */
+	@Override
+	public void addConfiguration(String paramString1, String paramString2,
+			Map<String, String> paramMap, boolean paramBoolean) {
+		throw new ConfigurationException("","not yet implemented");
+
+	}
+
+	/* (non-Javadoc)
+	 * @see eu.eidas.samlengineconfig.CertificateConfigurationManager#getInstance(java.lang.String)
+	 */
+	@Override
+	public EngineInstance getInstance(String paramString) {
+		return getConfiguration().get(paramString);
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see eu.eidas.samlengineconfig.CertificateConfigurationManager#getConfiguration()
+	 */
+	@Override
+	public Map<String, EngineInstance> getConfiguration() {
+		if(samlEngineConfiguration == null){
+			try {
+				initalizeConfiguration();
+				
+			} catch (at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException e) {
+				Logger.error("eIDAS SAML-engine initialization FAILED", e);
+				
+			}
+			
+		}
+		
+		return samlEngineConfiguration==null?new HashMap<String, EngineInstance>():((MOAeIDASSAMLEngineConfigurationImpl) samlEngineConfiguration).getInstanceMap();
+		
+	}
+	
+	
+	/**
+	 * Initialize eIDAS SAML-engine from MOA-ID configuration
+	 * @throws at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException 
+	 * 
+	 */
+	private void initalizeConfiguration() throws at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException {
+		//initialize configuration
+		MOAeIDASSAMLEngineConfigurationImpl tmp = new MOAeIDASSAMLEngineConfigurationImpl();
+		tmp.initialize();
+				
+		//set initialized configuration
+		samlEngineConfiguration = tmp;
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/config/MOAeIDASSAMLEngineConfigurationImpl.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/config/MOAeIDASSAMLEngineConfigurationImpl.java
new file mode 100644
index 000000000..5d1874157
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/config/MOAeIDASSAMLEngineConfigurationImpl.java
@@ -0,0 +1,268 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.config;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.MalformedURLException;
+import java.net.URISyntaxException;
+import java.net.URL;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+
+import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
+import at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.EIDASEngineConfigurationException;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.FileUtils;
+import at.gv.egovernment.moa.util.MiscUtil;
+
+import eu.eidas.samlengineconfig.BinaryParameter;
+import eu.eidas.samlengineconfig.ConfigurationParameter;
+import eu.eidas.samlengineconfig.EngineInstance;
+import eu.eidas.samlengineconfig.InstanceConfiguration;
+import eu.eidas.samlengineconfig.PropsParameter;
+import eu.eidas.samlengineconfig.SamlEngineConfiguration;
+
+/**
+ * @author tlenz
+ *
+ */
+public class MOAeIDASSAMLEngineConfigurationImpl extends
+		SamlEngineConfiguration {
+	
+    private static final String KEYSTORE_PATH="keystorePath";
+    private static final String METADATA_KEYSTORE_PATH="metadata.keystorePath";
+    private static final String ENCRYPTION_ACTIVATION="encryptionActivation";
+    private static final String[] BINARY_PARAMETERS={KEYSTORE_PATH, ENCRYPTION_ACTIVATION,METADATA_KEYSTORE_PATH};
+		
+    public List<EngineInstance> getInstances(){
+        return super.getInstances();
+    }
+	
+    @Override
+    public void setInstances(List<EngineInstance> engineInstances) {
+        super.setInstances(engineInstances);
+        
+    }
+    
+    public Map<String, EngineInstance> getInstanceMap() {
+        Map<String, EngineInstance> result = new HashMap<String, EngineInstance>();
+        for(EngineInstance instance:getInstances()) {
+        	
+            result.put(instance.getName(), instance);
+        }
+        
+        return result;
+    }
+    
+    //initialize
+    public void initialize() throws ConfigurationException { 
+    	//create an eIDAS SAML-engine instance
+    	EngineInstance engineInst = new EngineInstance();
+    	engineInst.setName(Constants.eIDAS_SAML_ENGINE_NAME);    	    	
+    	List<InstanceConfiguration> engineConfigs = new ArrayList<InstanceConfiguration>();
+		
+    	
+		//add configurations
+		
+		//add basic eIDAS SAML-engine configuration
+		MOAeIDASSAMLInstanceConfigurationImpl samlBaseConfig = new MOAeIDASSAMLInstanceConfigurationImpl();
+		samlBaseConfig.setName(Constants.eIDAS_SAML_ENGINE_NAME_ID_BASICCONFIG);				
+		samlBaseConfig.addParameter(loadConfigurationFromExternalFile(Constants.CONIG_PROPS_EIDAS_SAMLENGINE_BASIC_CONFIGFILE));
+		engineConfigs.add(samlBaseConfig);
+				
+		//add signing eIDAS SAML-engine configuration
+		MOAeIDASSAMLInstanceConfigurationImpl samlSignConfig = new MOAeIDASSAMLInstanceConfigurationImpl();
+		samlSignConfig.setName(Constants.eIDAS_SAML_ENGINE_NAME_ID_SIGNATURECONFIG);		
+		samlSignConfig.addParameter(Constants.eIDAS_SAML_ENGINE_NAME_ID_CLASS, 
+				Constants.SAML_SIGNING_IMPLENTATION);
+		
+		//TODO: load signing keys directly from MOA-ID configuration in finale version
+		samlSignConfig.addParameter(loadConfigurationFromExternalFile(Constants.CONIG_PROPS_EIDAS_SAMLENGINE_SIGN_CONFIGFILE));
+		engineConfigs.add(samlSignConfig);
+		
+		//add encryption eIDAS SAML-engine configuration
+		MOAeIDASSAMLInstanceConfigurationImpl samlEncConfig = new MOAeIDASSAMLInstanceConfigurationImpl();
+		samlEncConfig.setName(Constants.eIDAS_SAML_ENGINE_NAME_ID_ENCRYPTIONCONFIG);
+		samlEncConfig.addParameter(Constants.eIDAS_SAML_ENGINE_NAME_ID_CLASS, 
+				Constants.SAML_ENCRYPTION_IMPLENTATION);
+
+		//TODO: load encryption keys directly from MOA-ID configuration in finale version
+		samlEncConfig.addParameter(loadConfigurationFromExternalFile(Constants.CONIG_PROPS_EIDAS_SAMLENGINE_ENC_CONFIGFILE));
+		engineConfigs.add(samlEncConfig);
+		
+		engineInst.setConfigurations(engineConfigs);  
+		super.addInstance(engineInst);
+		
+    }
+    
+    /**
+     *	Load an external eIDAS SAML-engine configuration file, which is referenced from MOA-ID configuration
+     * 
+     * @param key Configuration key, which is used in property based MOA-ID configuration file
+     * @return eIDAS SAML-engine configuration object
+     * @throws ConfigurationException
+     */
+        
+    private ConfigurationParameter loadConfigurationFromExternalFile(String key) throws ConfigurationException {
+		String configFile = 
+				AuthConfigurationProviderFactory.getInstance().getBasicMOAIDConfiguration(key);
+		if (MiscUtil.isEmpty(configFile)) {
+			Logger.warn("No eIDAS SAML-engine configuration key: " 
+					+ key + " found in MOA-ID properties configuration file.");
+			//throw new EIDASEngineConfigurationException("No eIDAS SAML-engine configuration property.", null);
+			return null;
+		}
+		
+		Properties inputProps = loadPropsFromXml(configFile);    	
+		return buildPropsParameter(inputProps, configFile);
+    	
+    }
+    
+    
+    private PropsParameter buildPropsParameter(Properties inputProps, String fileName) throws EIDASEngineConfigurationException {
+    	PropsParameter outputProps = new PropsParameter();
+    	outputProps.setFileName(fileName);
+    	
+    	//original eIDAS SAML-engine use this identifier
+    	outputProps.setName("fileConfiguration");
+    	
+    	outputProps.setValue(inputProps);
+
+    	//post-process special parameters
+    	for(String key:BINARY_PARAMETERS) {
+            Object keystorePath = inputProps.get(key);
+            if (keystorePath != null) {
+            	if (keystorePath instanceof String && 
+            			isBinaryParameter((String)keystorePath) ) {
+            		BinaryParameter bp = new BinaryParameter();
+            		bp.setValue(loadBinaryFile(keystorePath.toString()));
+            		bp.setName(key);
+            		bp.setUrl(keystorePath.toString());
+            		inputProps.put(key, bp);
+                
+            	} else {
+            		Logger.warn("eIDAS SAML-engine keyStore parameter has an unsuspected type. +" +
+            				"(Type: " + keystorePath.toString() + ")");
+            	
+            	}
+            }
+        }
+    	
+    	return outputProps;
+    }
+    
+    private boolean isBinaryParameter(String parameter) {
+    	if (MiscUtil.isNotEmpty(parameter)) {
+    		String absoluteConfigFile;
+			try {
+				absoluteConfigFile = FileUtils.makeAbsoluteURL(
+						parameter,
+						AuthConfigurationProviderFactory.getInstance().getRootConfigFileDir());
+				File file = new File(new URL(absoluteConfigFile).toURI());
+	    		return file.exists();
+	    		
+			} catch (ConfigurationException | MalformedURLException | URISyntaxException e) {
+				Logger.warn("Binary eIDAS SAML-engine configuration parameter: " 
+						+ parameter + " is not loadable.");
+				
+			}
+     		
+    	}
+    	
+    	return false;
+        
+    }
+    
+    private byte[] loadBinaryFile(String fileName) throws EIDASEngineConfigurationException{
+    	InputStream is = null;
+    	byte data[]=null;
+    	try {
+    		String absoluteConfigFile = FileUtils.makeAbsoluteURL(
+    				fileName,
+    				AuthConfigurationProviderFactory.getInstance().getRootConfigFileDir());
+    		
+    		File file = new File(new URL(absoluteConfigFile).toURI());
+    		is = new FileInputStream(file);
+    		data=new byte[is.available()];
+            is.read(data);
+    		
+    	} catch (ConfigurationException | URISyntaxException | IOException e) {
+    		throw new EIDASEngineConfigurationException("eIDAS SAML-engine configuration FAILED", null, e);
+    				
+    	} finally {
+    		if (is != null)
+				try {
+					is.close();
+					
+				} catch (IOException e) {
+					Logger.warn("eIDAS SAML-engine configuration is not closeable.", e);
+					
+				}
+    		
+    	}
+    	
+    	return data;
+        
+    }
+    
+    private Properties loadPropsFromXml(String configFile) throws EIDASEngineConfigurationException {
+    	Properties props = new Properties();
+    	InputStream is = null;
+    	try {
+    		String absoluteConfigFile = FileUtils.makeAbsoluteURL(
+    				configFile,
+    				AuthConfigurationProviderFactory.getInstance().getRootConfigFileDir());
+    		
+    		File file = new File(new URL(absoluteConfigFile).toURI());
+    		is = new FileInputStream(file);
+    		props.loadFromXML(is);
+    		
+    	} catch (ConfigurationException | URISyntaxException | IOException e) {
+    		throw new EIDASEngineConfigurationException("eIDAS SAML-engine configuration FAILED", null, e);
+    				
+    	} finally {
+    		if (is != null)
+				try {
+					is.close();
+					
+				} catch (IOException e) {
+					Logger.warn("eIDAS SAML-engine configuration is not closeable.", e);
+					
+				}
+    		
+    	}
+    	
+    	return props;
+    	    	
+    }
+    
+    
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/config/MOAeIDASSAMLInstanceConfigurationImpl.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/config/MOAeIDASSAMLInstanceConfigurationImpl.java
new file mode 100644
index 000000000..dccd39905
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/config/MOAeIDASSAMLInstanceConfigurationImpl.java
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.config;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import eu.eidas.samlengineconfig.ConfigurationParameter;
+import eu.eidas.samlengineconfig.InstanceConfiguration;
+import eu.eidas.samlengineconfig.StringParameter;
+
+/**
+ * @author tlenz
+ *
+ */
+public class MOAeIDASSAMLInstanceConfigurationImpl extends
+		InstanceConfiguration {
+
+	public void addParameter(ConfigurationParameter param) {
+		if (param != null) {
+			List<ConfigurationParameter> paramList = super.getParameters();
+			if (paramList == null) {
+				paramList = new ArrayList<ConfigurationParameter>();
+				super.setParameters(paramList);
+			
+			}
+		
+			paramList.add(param);
+		}		
+	}
+	
+	public void addParameter(String key, String value) {
+		StringParameter param = new StringParameter();
+		param.setName(key);
+		param.setValue(value);		
+		addParameter(param);
+		
+	}
+		
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/config/ModifiedEncryptionSW.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/config/ModifiedEncryptionSW.java
new file mode 100644
index 000000000..1ba344fd1
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/config/ModifiedEncryptionSW.java
@@ -0,0 +1,29 @@
+package at.gv.egovernment.moa.id.auth.modules.eidas.config;
+
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
+import at.gv.egovernment.moa.logging.Logger;
+import eu.eidas.auth.engine.core.impl.EncryptionSW;
+
+/**
+ * This encryption module asks the moa configuration on whether to encrypt the response or not. In doubt, encryption is enforced.
+ */
+public class ModifiedEncryptionSW extends EncryptionSW {
+
+	@Override
+	public boolean isEncryptionEnable(String countryCode) {
+		// - encrypt if so configured
+		try {
+			AuthConfiguration moaconfig = AuthConfigurationProviderFactory.getInstance();
+			Boolean useEncryption = moaconfig.getStorkConfig().getCPEPS(countryCode).isXMLSignatureSupported();
+			Logger.info(useEncryption ? "using encryption" : "do not use encrpytion");
+			return useEncryption;
+		} catch(NullPointerException | ConfigurationException e) {
+			Logger.warn("failed to gather information about encryption for countryCode " + countryCode + " - thus, enabling encryption");
+			if(Logger.isDebugEnabled())
+				e.printStackTrace();
+			return true;
+		}
+	}
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/eIDASAuthenticationModulImpl.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/eIDASAuthenticationModulImpl.java
new file mode 100644
index 000000000..7b044522c
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/eIDASAuthenticationModulImpl.java
@@ -0,0 +1,72 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas;
+
+import org.apache.commons.lang3.StringUtils;
+
+import at.gv.egovernment.moa.id.auth.modules.AuthModule;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+
+/**
+ * @author tlenz
+ *
+ */
+public class eIDASAuthenticationModulImpl implements AuthModule {
+
+	private int priority = 1;
+
+	@Override
+	public int getPriority() {
+		return priority;
+	}
+
+	/**
+	 * Sets the priority of this module. Default value is {@code 0}.
+	 * @param priority The priority.
+	 */
+	public void setPriority(int priority) {
+		this.priority = priority;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.AuthModule#selectProcess(at.gv.egovernment.moa.id.process.api.ExecutionContext)
+	 */
+	@Override
+	public String selectProcess(ExecutionContext context) {
+		if (StringUtils.isNotBlank((String) context.get("ccc")) || 
+				StringUtils.isNotBlank((String) context.get("CCC"))) 
+			return "eIDASAuthentication";
+		else
+			return null;
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.AuthModule#getProcessDefinitions()
+	 */
+	@Override
+	public String[] getProcessDefinitions() {
+		return new String[] { "classpath:at/gv/egovernment/moa/id/auth/modules/eidas/eIDAS.Authentication.process.xml" };
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/eIDASAuthenticationSpringResourceProvider.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/eIDASAuthenticationSpringResourceProvider.java
new file mode 100644
index 000000000..70bd7b3d7
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/eIDASAuthenticationSpringResourceProvider.java
@@ -0,0 +1,28 @@
+package at.gv.egovernment.moa.id.auth.modules.eidas;
+
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
+
+import at.gv.egiz.components.spring.api.SpringResourceProvider;
+
+public class eIDASAuthenticationSpringResourceProvider implements SpringResourceProvider {
+
+	@Override
+	public String getName() {
+		return "MOA-ID eIDAS-Authentication SpringResourceProvider";
+	}
+
+	@Override
+	public String[] getPackagesToScan() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	@Override
+	public Resource[] getResourcesToLoad() {
+		ClassPathResource eIDASAuthConfig = new ClassPathResource("/moaid_eidas_auth.beans.xml", eIDASAuthenticationSpringResourceProvider.class);					
+		
+		return new Resource[] {eIDASAuthConfig};
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/eIDASSignalServlet.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/eIDASSignalServlet.java
new file mode 100644
index 000000000..16d909331
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/eIDASSignalServlet.java
@@ -0,0 +1,107 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas;
+
+import java.io.IOException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.lang.StringEscapeUtils;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+import at.gv.egovernment.moa.id.auth.servlet.AbstractProcessEngineSignalController;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+@Controller
+public class eIDASSignalServlet extends AbstractProcessEngineSignalController {
+
+	public eIDASSignalServlet() {
+		super();
+		Logger.debug("Registering servlet " + getClass().getName() + 
+				" with mappings '"+ Constants.eIDAS_HTTP_ENDPOINT_SP_POST + 
+				"' and '"+ Constants.eIDAS_HTTP_ENDPOINT_SP_REDIRECT + "'.");
+		
+	}
+	
+	@RequestMapping(value = {	"/eidas/sp/post", 
+			 					"/eidas/sp/redirect"
+							}, 
+					method = {RequestMethod.POST, RequestMethod.GET})
+	public void performCitizenCardAuthentication(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+		signalProcessManagement(req, resp);
+	}
+	
+	@Override
+	/**
+	 * Protocol specific implementation to get the pending-requestID 
+	 * from http request object
+	 * 
+	 * @param request The http Servlet-Request object
+	 * @return The Pending-request id 
+	 * 
+	 */
+	public String getPendingRequestId(HttpServletRequest request) {
+		String sessionId = super.getPendingRequestId(request);
+		
+		try {
+
+			// use SAML2 relayState
+			if (sessionId == null) {
+				sessionId = StringEscapeUtils.escapeHtml(request.getParameter("RelayState"));
+			} else
+				Logger.warn("No parameter 'SAMLResponse'. Unable to retrieve MOA session id.");
+
+			// take from InResponseTo attribute of SAMLResponse
+//			if (sessionId == null) {
+//				String base64SamlToken = request.getParameter("SAMLResponse");
+//				if (base64SamlToken != null && false) {
+//					byte[] samlToken = Base64Utils.decode(base64SamlToken, false);
+//					Document samlResponse = parseDocument(new ByteArrayInputStream(samlToken));
+//
+//					XPath xPath = XPathFactory.newInstance().newXPath();
+//					SimpleNamespaceContext nsContext = new SimpleNamespaceContext();
+//					nsContext.bindNamespaceUri("saml2p", "urn:oasis:names:tc:SAML:2.0:protocol");
+//					xPath.setNamespaceContext(nsContext);
+//					XPathExpression expression = xPath.compile("string(/saml2p:Response/@InResponseTo)");
+//					sessionId = (String) expression.evaluate(samlResponse, XPathConstants.STRING);
+//					sessionId = StringEscapeUtils.escapeHtml(StringUtils.trimToNull(sessionId));
+//				} else {
+//					Logger.warn("No parameter 'SAMLResponse'. Unable to retrieve MOA session id.");
+//				}
+//			}
+
+		} catch (Exception e) {
+			Logger.warn("Unable to retrieve moa session id.", e);
+		}
+
+		return sessionId;
+	}
+	
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASChainingMetadataProvider.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASChainingMetadataProvider.java
new file mode 100644
index 000000000..80a2734f2
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASChainingMetadataProvider.java
@@ -0,0 +1,409 @@
+package at.gv.egovernment.moa.id.auth.modules.eidas.engine;
+
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.Timer;
+
+import javax.net.ssl.SSLHandshakeException;
+import javax.xml.namespace.QName;
+
+import org.apache.commons.httpclient.MOAHttpClient;
+import org.apache.commons.httpclient.params.HttpClientParams;
+import org.opensaml.saml2.metadata.EntitiesDescriptor;
+import org.opensaml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml2.metadata.RoleDescriptor;
+import org.opensaml.saml2.metadata.provider.ChainingMetadataProvider;
+import org.opensaml.saml2.metadata.provider.FilterException;
+import org.opensaml.saml2.metadata.provider.HTTPMetadataProvider;
+import org.opensaml.saml2.metadata.provider.MetadataFilter;
+import org.opensaml.saml2.metadata.provider.MetadataProvider;
+import org.opensaml.saml2.metadata.provider.MetadataProviderException;
+import org.opensaml.saml2.metadata.provider.ObservableMetadataProvider;
+import org.opensaml.xml.XMLObject;
+
+import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.commons.ex.MOAHttpProtocolSocketFactoryException;
+import at.gv.egovernment.moa.id.commons.utils.MOAHttpProtocolSocketFactory;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
+import at.gv.egovernment.moa.id.config.auth.IGarbageCollectorProcessing;
+import at.gv.egovernment.moa.id.config.auth.MOAGarbageCollector;
+import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.filter.SchemaValidationException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.filter.SignatureValidationException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.MOASPMetadataSignatureFilter;
+import at.gv.egovernment.moa.id.saml2.MetadataFilterChain;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.MiscUtil;
+import eu.eidas.auth.engine.AbstractSAMLEngine;
+
+public class MOAeIDASChainingMetadataProvider implements ObservableMetadataProvider, IGarbageCollectorProcessing {
+
+	private static MOAeIDASChainingMetadataProvider instance = null;
+	private static Object mutex = new Object();
+	
+	private MetadataProvider internalProvider;
+	private Map<String, Date> lastAccess = null;
+	
+	
+	public static MOAeIDASChainingMetadataProvider getInstance() {
+		if (instance == null) {
+			synchronized (mutex) {
+				if (instance == null) {
+					instance = new MOAeIDASChainingMetadataProvider();
+					MOAGarbageCollector.addModulForGarbageCollection(instance);
+				}
+			}
+		}
+		return instance;
+	}
+	
+	
+	private MOAeIDASChainingMetadataProvider() {
+		internalProvider = new ChainingMetadataProvider();
+		lastAccess = new HashMap<String, Date>();
+				
+	}
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IGarbageCollectorProcessing#runGarbageCollector()
+	 */
+	@Override
+	public void runGarbageCollector() {
+		if (!lastAccess.isEmpty()) {
+			Date now = new Date();
+			Date expioredate = new Date(now.getTime() - 
+					Constants.CONFIG_PROPS_METADATA_GARBAGE_TIMEOUT);
+			Logger.debug("Starting eIDAS Metadata garbag collection (Expioredate:" 
+					+ expioredate + ")");
+			
+			List<String> expiredEntities = new ArrayList<String>();
+			
+			Iterator<Entry<String, Date>> lastAccessInterator = lastAccess.entrySet().iterator();
+			while(lastAccessInterator.hasNext()) {
+				Entry<String, Date> element = lastAccessInterator.next();
+				if (element.getValue().before(expioredate)) {
+					Logger.debug("Remove unused eIDAS Metadate: " + element.getKey());
+					expiredEntities.add(element.getKey());
+					
+				}								
+			}
+		
+			ChainingMetadataProvider chainProvider = (ChainingMetadataProvider) internalProvider;
+			boolean isUpdateRequired = false;
+			
+			//get all actually loaded metadata providers
+			Map<String, HTTPMetadataProvider> loadedproviders = getAllActuallyLoadedProviders();
+						
+			if (!expiredEntities.isEmpty()) {										
+				for (String expired : expiredEntities) {
+					if (loadedproviders.containsKey(expired)) {
+						HTTPMetadataProvider provider = loadedproviders.get(expired);
+					
+						//destroy metadata provider
+						provider.destroy();
+					
+						//remove from map
+						loadedproviders.remove(expired);
+						isUpdateRequired = true;
+						
+						/*OpenSAML ChainingMetadataProvider can not remove a MetadataProvider (UnsupportedOperationException)
+						 *The ChainingMetadataProvider use internal a unmodifiableList to hold all registrated MetadataProviders.*/
+						//chainProvider.removeMetadataProvider(provider);					
+						Logger.info("Remove not used eIDAS MetadataProvider " + expired 
+								+ " after timeout.");
+										
+					} else
+						Logger.warn("eIDAS metadata for EntityID: " + expired 
+								+ " is marked as unsed, but no loaded metadata provider is found.");
+				
+				}			
+			}
+			
+			//check signature of all metadata which are actually loaded
+			List<String> nonValidMetadataProvider = new ArrayList<String>();
+			for (HTTPMetadataProvider provider : loadedproviders.values()) {
+				try {
+					provider.getMetadataFilter().doFilter(provider.getMetadata());
+					
+				} catch (FilterException | MetadataProviderException e) {
+					Logger.info("eIDAS MetadataProvider: " + provider.getMetadataURI() 
+						+ " is not valid any more. Reason:" + e.getMessage());
+					if (Logger.isDebugEnabled())
+						Logger.warn("Reason", e);
+
+					nonValidMetadataProvider.add(provider.getMetadataURI());
+										
+				}										
+			}			
+			for (String el : nonValidMetadataProvider) {
+				loadedproviders.remove(el);
+				isUpdateRequired = true;
+				
+			}
+
+			//update chaining metadata-provider if it is required
+			if (isUpdateRequired) {
+				try {
+					synchronized (chainProvider) {
+						chainProvider.setProviders(new ArrayList<MetadataProvider>(loadedproviders.values()));
+				
+						emitChangeEvent();	
+					}
+				
+				} catch (MetadataProviderException e) {
+					Logger.warn("ReInitalize eIDASA MetaDataProvider is not possible! MOA-ID Instance has to be restarted manualy", e);
+			
+				}
+			}
+		}					
+	}
+	
+	
+	
+	private HTTPMetadataProvider createNewHTTPMetaDataProvider(String metadataURL) {
+		HTTPMetadataProvider httpProvider = null;
+		Timer timer= null;
+		MOAHttpClient httpClient = null;
+		try {
+			AuthConfiguration authConfig = AuthConfigurationProviderFactory.getInstance();
+			
+			httpClient = new MOAHttpClient();
+			
+			HttpClientParams httpClientParams = new HttpClientParams();
+			httpClientParams.setSoTimeout(Constants.CONFIG_PROPS_METADATA_SOCKED_TIMEOUT);
+			httpClient.setParams(httpClientParams);
+			
+			if (metadataURL.startsWith("https:")) {
+				try {
+					MOAHttpProtocolSocketFactory protoSocketFactory = new MOAHttpProtocolSocketFactory(
+							Constants.SSLSOCKETFACTORYNAME, 
+							authConfig.getCertstoreDirectory(), 
+							authConfig.getTrustedCACertificates(),
+							null,
+							AuthConfiguration.DEFAULT_X509_CHAININGMODE, 
+							authConfig.isTrustmanagerrevoationchecking());
+					
+					httpClient.setCustomSSLTrustStore(metadataURL, protoSocketFactory);
+
+				} catch (MOAHttpProtocolSocketFactoryException e) {
+					Logger.warn("MOA SSL-TrustStore can not initialized. Use default Java TrustStore.");
+					
+				}
+			}
+			
+			timer = new Timer();
+			httpProvider = new HTTPMetadataProvider(timer, httpClient, 
+					metadataURL);
+			httpProvider.setParserPool(AbstractSAMLEngine.getNewBasicSecuredParserPool());
+			httpProvider.setRequireValidMetadata(true);
+			httpProvider.setMinRefreshDelay(1000*60*15); //15 minutes
+			httpProvider.setMaxRefreshDelay(1000*60*60*24); //24 hours
+			//httpProvider.setRefreshDelayFactor(0.1F);
+			
+			//add Metadata filters
+			MetadataFilterChain filter = new MetadataFilterChain();
+			filter.addFilter(new MOASPMetadataSignatureFilter(
+					authConfig.getBasicMOAIDConfiguration(Constants.CONIG_PROPS_EIDAS_METADATA_VALIDATION_TRUSTSTORE)));
+			httpProvider.setMetadataFilter(filter);
+			
+			httpProvider.initialize();
+			
+			return httpProvider;
+						
+		} catch (Throwable e) {			
+			if (e.getCause() != null && e.getCause().getCause() instanceof SSLHandshakeException) {
+				Logger.warn("SSL-Server certificate for metadata " 
+						+ metadataURL + " not trusted.", e);
+				
+			} if (e.getCause() != null && e.getCause().getCause() instanceof SignatureValidationException) {				
+				Logger.warn("Signature verification for metadata" 
+						+ metadataURL + " FAILED.", e);
+			
+			} if (e.getCause() != null && e.getCause().getCause() instanceof SchemaValidationException) {
+				Logger.warn("Schema validation for metadata " 
+						+ metadataURL + " FAILED.", e);								
+			}
+			
+			Logger.error(
+					"Failed to add Metadata file for "
+							+ metadataURL + "[ "
+							+ e.getMessage() + " ]", e);
+						
+			if (httpProvider != null) {
+				Logger.debug("Destroy failed Metadata provider");
+				httpProvider.destroy();
+			}
+			
+			if (timer != null) {
+				Logger.debug("Destroy Timer.");
+				timer.cancel();
+			}
+
+			
+		}
+		
+		return null;	
+	}
+
+	private Map<String, HTTPMetadataProvider> getAllActuallyLoadedProviders() {
+		Map<String, HTTPMetadataProvider> loadedproviders = new HashMap<String, HTTPMetadataProvider>();
+		ChainingMetadataProvider chainProvider = (ChainingMetadataProvider) internalProvider;
+		
+		//make a Map of all actually loaded HTTPMetadataProvider
+		List<MetadataProvider> providers = chainProvider.getProviders();
+		for (MetadataProvider provider : providers) {
+			if (provider instanceof HTTPMetadataProvider) {
+				HTTPMetadataProvider httpprovider = (HTTPMetadataProvider) provider;
+				loadedproviders.put(httpprovider.getMetadataURI(), httpprovider);
+
+			}
+		}
+		
+		return loadedproviders;		
+	}
+	
+	public boolean refreshMetadataProvider(String metadataURL) {
+		try {
+			if (MiscUtil.isNotEmpty(metadataURL)) {
+				Map<String, HTTPMetadataProvider> actuallyLoadedProviders = getAllActuallyLoadedProviders();
+
+				// check if MetadataProvider is actually loaded
+				if (actuallyLoadedProviders.containsKey(metadataURL)) {
+					actuallyLoadedProviders.get(metadataURL).refresh();						
+					Logger.info("eIDAS metadata for " 
+							+ metadataURL + " is refreshed.");
+					return true;
+					
+				} else {
+					//load new Metadata Provider				
+					ChainingMetadataProvider chainProvider = (ChainingMetadataProvider) internalProvider;						
+					HTTPMetadataProvider newMetadataProvider = createNewHTTPMetaDataProvider(metadataURL);										
+					chainProvider.addMetadataProvider(newMetadataProvider);
+					
+					emitChangeEvent();
+					Logger.info("eIDAS metadata for " 
+							+ metadataURL + " is added.");
+					return true;
+										
+				}
+														
+			} else
+				Logger.debug("Can not refresh eIDAS metadata: NO eIDAS metadata URL.");
+																								
+		} catch (MetadataProviderException e) {
+			Logger.warn("Refresh eIDAS metadata for " 
+					+ metadataURL + " FAILED.", e);
+			
+		}
+		
+		return false;
+		
+	}
+	
+	
+	public boolean requireValidMetadata() {
+		return internalProvider.requireValidMetadata();
+	}
+
+	public void setRequireValidMetadata(boolean requireValidMetadata) {
+		internalProvider.setRequireValidMetadata(requireValidMetadata);
+	}
+
+	public MetadataFilter getMetadataFilter() {
+		return internalProvider.getMetadataFilter();
+	}
+
+	public void setMetadataFilter(MetadataFilter newFilter)
+			throws MetadataProviderException {
+		internalProvider.setMetadataFilter(newFilter);
+	}
+
+	public XMLObject getMetadata() throws MetadataProviderException {
+		return internalProvider.getMetadata();
+	}
+
+	public EntitiesDescriptor getEntitiesDescriptor(String entitiesID)
+			throws MetadataProviderException {
+		Logger.warn("eIDAS metadata not support 'EntitiesDescriptor' elements!");		
+		return null;
+		
+	}
+
+	public EntityDescriptor getEntityDescriptor(String entityID)
+			throws MetadataProviderException {
+		EntityDescriptor entityDesc = null;
+		try {
+			entityDesc = internalProvider.getEntityDescriptor(entityID);
+			if (entityDesc == null) {
+				Logger.debug("Can not find eIDAS metadata for entityID: " + entityID 
+						+ " Start refreshing process ...");
+				if (refreshMetadataProvider(entityID))
+					entityDesc =  internalProvider.getEntityDescriptor(entityID);
+									
+			} else {
+				if (!entityDesc.isValid())
+					if (refreshMetadataProvider(entityID))
+						entityDesc = internalProvider.getEntityDescriptor(entityID);
+									
+			}
+			
+			
+		} catch (MetadataProviderException e) {
+			Logger.debug("Can not find eIDAS metadata for entityID: " + entityID 
+					+ " Start refreshing process ...");
+			if (refreshMetadataProvider(entityID))
+				entityDesc = internalProvider.getEntityDescriptor(entityID);
+			
+		}
+		
+		if (entityDesc != null)
+			lastAccess.put(entityID, new Date());
+		
+		return entityDesc;
+	}
+
+	public List<RoleDescriptor> getRole(String entityID, QName roleName)
+			throws MetadataProviderException {
+		EntityDescriptor entityDesc = getEntityDescriptor(entityID);
+		if (entityDesc != null)
+			return entityDesc.getRoleDescriptors(roleName);
+		
+		else
+			return null;
+	}
+
+	public RoleDescriptor getRole(String entityID, QName roleName,
+			String supportedProtocol) throws MetadataProviderException {
+		EntityDescriptor entityDesc = getEntityDescriptor(entityID);
+		if (entityDesc != null)		
+			return internalProvider.getRole(entityID, roleName, supportedProtocol);
+		
+		else
+			return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see org.opensaml.saml2.metadata.provider.ObservableMetadataProvider#getObservers()
+	 */
+	@Override
+	public List<Observer> getObservers() {
+		return ((ChainingMetadataProvider) internalProvider).getObservers();
+	}
+
+	protected void emitChangeEvent() {
+		if ((getObservers() == null) || (getObservers().size() == 0)) {
+			return;
+		}
+
+		List<Observer> tempObserverList = new ArrayList<Observer>(getObservers());
+		for (ObservableMetadataProvider.Observer observer : tempObserverList)
+			if (observer != null)
+				observer.onEvent(this);
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASMetadataProviderDecorator.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASMetadataProviderDecorator.java
new file mode 100644
index 000000000..7537c4d84
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASMetadataProviderDecorator.java
@@ -0,0 +1,122 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.engine;
+
+import java.security.KeyStore;
+
+import org.opensaml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml2.metadata.IDPSSODescriptor;
+import org.opensaml.saml2.metadata.RoleDescriptor;
+import org.opensaml.saml2.metadata.SPSSODescriptor;
+import org.opensaml.saml2.metadata.provider.MetadataProvider;
+import org.opensaml.saml2.metadata.provider.MetadataProviderException;
+
+import eu.eidas.auth.engine.EIDASSAMLEngine;
+import eu.eidas.auth.engine.metadata.MetadataProcessorI;
+import eu.eidas.engine.exceptions.SAMLEngineException;
+
+/**
+ * @author tlenz
+ *
+ */
+public class MOAeIDASMetadataProviderDecorator implements MetadataProcessorI {
+
+	private MetadataProvider metadataprovider = null;
+	
+	/**
+	 * 
+	 */
+	public MOAeIDASMetadataProviderDecorator(MetadataProvider metadataprovider) {
+		this.metadataprovider = metadataprovider;
+		
+	}
+	
+	/* (non-Javadoc)
+	 * @see eu.eidas.auth.engine.metadata.MetadataProcessorI#getEntityDescriptor(java.lang.String)
+	 */
+	@Override
+	public EntityDescriptor getEntityDescriptor(String url)
+			throws SAMLEngineException {		
+		try {
+			return this.metadataprovider.getEntityDescriptor(url);
+			
+		} catch (MetadataProviderException e) {
+			throw new SAMLEngineException("eIDAS Metadata processing FAILED.", e);
+			
+		}
+	}
+
+	/* (non-Javadoc)
+	 * @see eu.eidas.auth.engine.metadata.MetadataProcessorI#getSPSSODescriptor(java.lang.String)
+	 */
+	@Override
+	public SPSSODescriptor getSPSSODescriptor(String url)
+			throws SAMLEngineException {
+		return getFirstRoleDescriptor(getEntityDescriptor(url), SPSSODescriptor.class);
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see eu.eidas.auth.engine.metadata.MetadataProcessorI#getIDPSSODescriptor(java.lang.String)
+	 */
+	@Override
+	public IDPSSODescriptor getIDPSSODescriptor(String url)
+			throws SAMLEngineException {
+		return getFirstRoleDescriptor(getEntityDescriptor(url), IDPSSODescriptor.class);
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see eu.eidas.auth.engine.metadata.MetadataProcessorI#checkValidMetadataSignature(java.lang.String, eu.eidas.auth.engine.EIDASSAMLEngine)
+	 */
+	@Override
+	public void checkValidMetadataSignature(String url, EIDASSAMLEngine engine)
+			throws SAMLEngineException {
+		//Do nothing, because metadata signature is already validated during 
+		//metadata provider initialization 
+
+		//TODO: maybe signature validation is needed on every request
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see eu.eidas.auth.engine.metadata.MetadataProcessorI#checkValidMetadataSignature(java.lang.String, java.security.KeyStore)
+	 */
+	@Override
+	public void checkValidMetadataSignature(String url, KeyStore trustStore)
+			throws SAMLEngineException {
+		//Do nothing, because metadata signature is already validated during 
+		//metadata provider initialization 
+		
+	}
+
+    protected <T extends RoleDescriptor> T getFirstRoleDescriptor(EntityDescriptor entityDescriptor, final Class<T> clazz){
+        for(RoleDescriptor rd:entityDescriptor.getRoleDescriptors()){
+            if(clazz.isInstance(rd)){
+                return (T)rd;
+            }
+        }
+        return null;
+    }
+
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDAsExtensionProcessor.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDAsExtensionProcessor.java
new file mode 100644
index 000000000..5837d7dbf
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDAsExtensionProcessor.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.engine;
+
+import java.util.HashSet;
+import java.util.Set;
+
+import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
+import eu.eidas.auth.engine.core.ExtensionProcessorI;
+import eu.eidas.auth.engine.core.eidas.EidasExtensionProcessor;
+
+/**
+ * @author tlenz
+ *
+ */
+public class MOAeIDAsExtensionProcessor extends EidasExtensionProcessor implements ExtensionProcessorI {
+
+	/**
+	 * Add only eIDAS attributes which are supported by Austrian eIDAS node
+	 * 
+	 */
+    @Override
+    public Set<String> getSupportedAttributes(){
+        Set<String> supportedAttributes=new HashSet<String>( Constants.METADATA_POSSIBLE_ATTRIBUTES.keySet());
+       
+        return supportedAttributes;
+    }
+}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/stork/STORKException.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/EIDASEngineConfigurationException.java
index 79641d085..20f18b772 100644
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/stork/STORKException.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/EIDASEngineConfigurationException.java
@@ -1,64 +1,60 @@
-/*******************************************************************************
+/*
  * Copyright 2014 Federal Chancellery Austria
  * MOA-ID has been developed in a cooperation between BRZ, the Federal
  * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- * 
+ *
  * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
  * the European Commission - subsequent versions of the EUPL (the "Licence");
  * You may not use this work except in compliance with the Licence.
  * You may obtain a copy of the Licence at:
  * http://www.osor.eu/eupl/
- * 
+ *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the Licence is distributed on an "AS IS" basis,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the Licence for the specific language governing permissions and
  * limitations under the Licence.
- * 
+ *
  * This product combines work with different licenses. See the "NOTICE" text
  * file for details on the various modules and licenses.
  * The "NOTICE" text file is part of the distribution. Any derivative works
  * that you distribute must include a readable copy of the "NOTICE" text file.
- ******************************************************************************/
-/**
- * 
  */
-package at.gv.egovernment.moa.id.auth.stork;
+package at.gv.egovernment.moa.id.auth.modules.eidas.exceptions;
 
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 
 /**
- * Exception thrown if error occurs in STORK processing
- * @author bzwattendorfer
+ * @author tlenz
  *
  */
-public class STORKException extends Exception{
+public class EIDASEngineConfigurationException extends ConfigurationException {
 
 	/**
 	 * 
 	 */
 	private static final long serialVersionUID = 1L;
-
-	public STORKException() {
-		super();
-		
+	
+	/**
+	 * @param messageId
+	 * @param parameters
+	 * @param wrapped
+	 */
+	public EIDASEngineConfigurationException(String messageId,
+			Object[] parameters, Throwable wrapped) {
+		super(messageId, parameters, wrapped);
 	}
 
-	public STORKException(String message, Throwable cause) {
-		super(message, cause);
-		
+	/**
+	 * @param string
+	 * @param object
+	 */
+	public EIDASEngineConfigurationException(String string, Object[] object) {
+		super(string, object);
 	}
 
-	public STORKException(String message) {
-		super(message);
-		
-	}
 
-	public STORKException(Throwable cause) {
-		super(cause);
-		
-	}
+
 	
 	
-
-
 }
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/ExternalAttributeRequestRequiredException.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/EIDASEngineException.java
index 096f223d7..234c4e038 100644
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/ExternalAttributeRequestRequiredException.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/EIDASEngineException.java
@@ -1,4 +1,4 @@
-/*******************************************************************************
+/*
  * Copyright 2014 Federal Chancellery Austria
  * MOA-ID has been developed in a cooperation between BRZ, the Federal
  * Chancellery Austria - ICT staff unit, and Graz University of Technology.
@@ -19,35 +19,46 @@
  * file for details on the various modules and licenses.
  * The "NOTICE" text file is part of the distribution. Any derivative works
  * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2;
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.exceptions;
 
-import at.gv.egovernment.moa.id.protocols.stork2.attributeproviders.AttributeProvider;
+import org.opensaml.saml2.core.StatusCode;
 
-public class ExternalAttributeRequestRequiredException extends Exception {
-	
-	/** The Constant serialVersionUID. */
-	private static final long serialVersionUID = 5207631348933518908L;
-	
-	/** The ap. */
-	private AttributeProvider ap;
+/**
+ * @author tlenz
+ *
+ */
+public class EIDASEngineException extends eIDASException {
 
 	/**
-	 * Instantiates a new external attribute request required exception.
-	 *
-	 * @param provider the provider
+	 * @param objects 
+	 * @param string
+	 * @param e
 	 */
-	public ExternalAttributeRequestRequiredException(AttributeProvider provider) {
-		ap = provider;
+	public EIDASEngineException(String msg, Object[] objects, Throwable e) {
+		super(msg, objects, e);
 	}
 
 	/**
-	 * Gets the ap that caused the exception.
-	 *
-	 * @return the ap
+	 * 
+	 */
+	private static final long serialVersionUID = 1559812927427153879L;
+
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.eIDASException#getStatusCodeFirstLevel()
+	 */
+	@Override
+	public String getStatusCodeFirstLevel() {
+		return StatusCode.RESPONDER_URI;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.eIDASException#getStatusCodeSecondLevel()
 	 */
-	public AttributeProvider getAp() {
-		return ap;
+	@Override
+	public String getStatusCodeSecondLevel() {
+		return StatusCode.AUTHN_FAILED_URI;
 	}
 
 }
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/Pair.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASAttributeException.java
index eb3cfcccb..b25895eca 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/Pair.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASAttributeException.java
@@ -1,4 +1,4 @@
-/*******************************************************************************
+/*
  * Copyright 2014 Federal Chancellery Austria
  * MOA-ID has been developed in a cooperation between BRZ, the Federal
  * Chancellery Austria - ICT staff unit, and Graz University of Technology.
@@ -19,27 +19,34 @@
  * file for details on the various modules and licenses.
  * The "NOTICE" text file is part of the distribution. Any derivative works
  * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.oauth20;
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.exceptions;
 
-public class Pair<P1, P2> {
-	private final P1 first;
-	private final P2 second;
-	
-	private Pair(final P1 newFirst, final P2 newSecond) {
-		this.first = newFirst;
-		this.second = newSecond;
-	}
+import org.opensaml.saml2.core.StatusCode;
+
+/**
+ * @author tlenz
+ *
+ */
+public class eIDASAttributeException extends eIDASException {
+
+	private static final long serialVersionUID = 1L;
 	
-	public P1 getFirst() {
-		return this.first;
+	public eIDASAttributeException(String message) {
+		super("eIDAS.07", new Object[]{message});
+		
 	}
-	
-	public P2 getSecond() {
-		return this.second;
+
+	@Override
+	public String getStatusCodeFirstLevel() {
+		return StatusCode.RESPONDER_URI;
 	}
-	
-	public static <P1, P2> Pair<P1, P2> newInstance(final P1 newFirst, final P2 newSecond) {
-		return new Pair<P1, P2>(newFirst, newSecond);
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.eIDASException#getStatusCodeSecondLevel()
+	 */
+	@Override
+	public String getStatusCodeSecondLevel() {
+		return StatusCode.AUTHN_FAILED_URI;
 	}
 }
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASAuthnRequestProcessingException.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASAuthnRequestProcessingException.java
new file mode 100644
index 000000000..c96af37ef
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASAuthnRequestProcessingException.java
@@ -0,0 +1,80 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.exceptions;
+
+import org.opensaml.saml2.core.StatusCode;
+
+import at.gv.egovernment.moa.util.MiscUtil;
+
+/**
+ * @author tlenz
+ *
+ */
+public class eIDASAuthnRequestProcessingException extends eIDASException {
+
+	private String subStatusCode = null;
+	
+	/**
+	 * 
+	 */
+	private static final long serialVersionUID = 1083563877689098041L;
+
+	/**
+	 * @param messageId
+	 * @param parameters
+	 */
+	public eIDASAuthnRequestProcessingException(String messageId, Object[] parameters) {
+		super(messageId, parameters);
+	}
+	
+	public eIDASAuthnRequestProcessingException(String subStatusCode, String messageId, Object[] parameters) {
+		super(messageId, parameters);
+		this.subStatusCode = subStatusCode;
+	}
+	
+	public eIDASAuthnRequestProcessingException(String messageId, Object[] parameters, Throwable e) {
+		super(messageId, parameters, e );
+	}
+	
+	public eIDASAuthnRequestProcessingException(String subStatusCode, String messageId, Object[] parameters, Throwable e) {
+		super(messageId, parameters, e );
+		this.subStatusCode = subStatusCode;
+	}
+
+	@Override
+	public String getStatusCodeFirstLevel() {
+		return StatusCode.REQUESTER_URI;
+		
+	}
+	
+	@Override
+	public String getStatusCodeSecondLevel() {
+		if (MiscUtil.isNotEmpty(subStatusCode))
+			return subStatusCode;
+		
+		else
+			return StatusCode.REQUEST_DENIED_URI;
+		
+	}
+	
+}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/UnsupportedAttributeException.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASAuthnRequestValidationException.java
index 31b9c9c0a..2a15ee18a 100644
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/UnsupportedAttributeException.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASAuthnRequestValidationException.java
@@ -1,4 +1,4 @@
-/*******************************************************************************
+/*
  * Copyright 2014 Federal Chancellery Austria
  * MOA-ID has been developed in a cooperation between BRZ, the Federal
  * Chancellery Austria - ICT staff unit, and Graz University of Technology.
@@ -19,11 +19,41 @@
  * file for details on the various modules and licenses.
  * The "NOTICE" text file is part of the distribution. Any derivative works
  * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2;
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.exceptions;
 
-public class UnsupportedAttributeException extends Exception {
+import org.opensaml.saml2.core.StatusCode;
 
-	private static final long serialVersionUID = -7720066381435378111L;
+/**
+ * @author tlenz
+ *
+ */
+public class eIDASAuthnRequestValidationException extends eIDASException {
+
+	/**
+	 * 
+	 */
+	private static final long serialVersionUID = 4353716509546972267L;
+
+	/**
+	 * @param messageId
+	 * @param parameters
+	 */
+	public eIDASAuthnRequestValidationException(String messageId, Object[] parameters) {
+		super(messageId, parameters);
+
+	}
+	
+	@Override
+	public String getStatusCodeFirstLevel() {
+		return StatusCode.REQUESTER_URI;
+		
+	}
+	
+	@Override
+	public String getStatusCodeSecondLevel() {
+		return StatusCode.RESOURCE_NOT_RECOGNIZED_URI;
+		
+	}
 
 }
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASException.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASException.java
new file mode 100644
index 000000000..f42004abc
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASException.java
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.exceptions;
+
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+
+/**
+ * @author tlenz
+ *
+ */
+public abstract class eIDASException extends MOAIDException {
+
+	/**
+	 * 
+	 */
+	private static final long serialVersionUID = 1L;
+
+	
+	public abstract String getStatusCodeFirstLevel();	
+	public abstract String getStatusCodeSecondLevel();
+
+	
+	/**
+	 * @param messageId
+	 * @param parameters
+	 */
+	public eIDASException(String messageId, Object[] parameters) {
+		super(messageId, parameters);
+	}
+
+	/**
+	 * @param messageId
+	 * @param parameters
+	 */
+	public eIDASException(String messageId, Object[] parameters, Throwable e) {
+		super(messageId, parameters, e);
+	}
+	
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASResponseBuildException.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASResponseBuildException.java
new file mode 100644
index 000000000..0ffcf11ef
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASResponseBuildException.java
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.exceptions;
+
+import org.opensaml.saml2.core.StatusCode;
+
+/**
+ * @author tlenz
+ *
+ */
+public class eIDASResponseBuildException extends eIDASException {
+
+	/**
+	 * 
+	 */
+	private static final long serialVersionUID = 4446851988854996919L;
+
+	/**
+	 * @param messageId
+	 * @param parameters
+	 */
+	public eIDASResponseBuildException(String messageId, Object[] parameters) {
+		super(messageId, parameters);
+	}
+	
+	public eIDASResponseBuildException(String messageId, Object[] parameters, Throwable e) {
+		super(messageId, parameters, e);
+	}
+	
+	@Override
+	public String getStatusCodeFirstLevel() {
+		return StatusCode.RESPONDER_URI;
+		
+	}
+	
+	@Override
+	public String getStatusCodeSecondLevel() {
+			return StatusCode.AUTHN_FAILED_URI;
+		
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASResponseNotSuccessException.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASResponseNotSuccessException.java
new file mode 100644
index 000000000..d10ca1c88
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASResponseNotSuccessException.java
@@ -0,0 +1,67 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.exceptions;
+
+import org.opensaml.saml2.core.StatusCode;
+
+/**
+ * @author tlenz
+ *
+ */
+public class eIDASResponseNotSuccessException extends eIDASException {
+
+	/**
+	 * 
+	 */
+	private static final long serialVersionUID = 6145402939313568907L;
+
+	public eIDASResponseNotSuccessException(String messageId, Object[] parameters) {
+		super(messageId, parameters);
+	}
+	
+	/**
+	 * @param messageId
+	 * @param parameters
+	 * @param e
+	 */
+	public eIDASResponseNotSuccessException(String messageId, Object[] parameters, Throwable e) {
+		super(messageId, parameters, e);
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.eIDASException#getStatusCodeFirstLevel()
+	 */
+	@Override
+	public String getStatusCodeFirstLevel() {
+		return StatusCode.RESPONDER_URI;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.eIDASException#getStatusCodeSecondLevel()
+	 */
+	@Override
+	public String getStatusCodeSecondLevel() {
+		return StatusCode.AUTHN_FAILED_URI;
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/CreateIdentityLinkTask.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/CreateIdentityLinkTask.java
new file mode 100644
index 000000000..5d7430dd7
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/CreateIdentityLinkTask.java
@@ -0,0 +1,162 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.tasks;
+
+import java.io.InputStream;
+import java.text.SimpleDateFormat;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.stereotype.Component;
+import org.w3c.dom.Element;
+import org.w3c.dom.Node;
+
+import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants;
+import at.gv.egovernment.moa.id.auth.data.IdentityLink;
+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
+import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
+import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
+import at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.eIDASAttributeException;
+import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+import at.gv.egovernment.moa.id.util.IdentityLinkReSigner;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.DOMUtils;
+import at.gv.egovernment.moa.util.XPathUtils;
+import eu.eidas.auth.commons.IPersonalAttributeList;
+
+/**
+ * @author tlenz
+ *
+ */
+@Component("CreateIdentityLinkTask")
+public class CreateIdentityLinkTask extends AbstractAuthServletTask {
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.process.springweb.MoaIdTask#execute(at.gv.egovernment.moa.id.process.api.ExecutionContext, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
+	 */
+	@Override
+	public void execute(ExecutionContext executionContext,
+			HttpServletRequest request, HttpServletResponse response)
+			throws TaskExecutionException {
+		try{
+			defaultTaskInitialization(request, executionContext);
+												
+			//get eIDAS attributes from MOA-Session
+			IPersonalAttributeList eIDASAttributes = moasession.getGenericDataFromSession(
+					AuthenticationSessionStorageConstants.eIDAS_ATTRIBUTELIST, 
+					IPersonalAttributeList.class);
+			
+			IdentityLink identityLink = null;
+			
+			//connect SZR-Gateway
+			//TODO: implement SZR-Gateway communication!!!!
+			if(true) {
+								
+				// create fake IdL
+				// - fetch IdL template from resources
+				InputStream s = CreateIdentityLinkTask.class.getResourceAsStream("/resources/xmldata/fakeIdL_IdL_template.xml");
+				Element idlTemplate = DOMUtils.parseXmlValidating(s);
+
+			    identityLink = new IdentityLinkAssertionParser(idlTemplate).parseIdentityLink();
+
+			    // replace data
+	            Element idlassertion = identityLink.getSamlAssertion();
+	            
+	            // - set bpk/wpbk;
+		        Node prIdentification = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_IDENT_VALUE_XPATH);		        		        
+		        if(!eIDASAttributes.containsKey(Constants.eIDAS_ATTR_PERSONALIDENTIFIER))
+		        	throw new eIDASAttributeException(Constants.eIDAS_ATTR_PERSONALIDENTIFIER);
+		        String eIdentifier = eIDASAttributes.get(Constants.eIDAS_ATTR_PERSONALIDENTIFIER).getValue().get(0);
+		        prIdentification.getFirstChild().setNodeValue(eIdentifier);
+
+		        // - set last name
+		        Node prFamilyName = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_FAMILY_NAME_XPATH);
+		        if(!eIDASAttributes.containsKey(Constants.eIDAS_ATTR_CURRENTFAMILYNAME))
+		        	throw new eIDASAttributeException(Constants.eIDAS_ATTR_CURRENTFAMILYNAME);
+				String familyName = eIDASAttributes.get(Constants.eIDAS_ATTR_CURRENTFAMILYNAME).getValue().get(0);
+				prFamilyName.getFirstChild().setNodeValue(familyName);
+
+		        // - set first name
+		        Node prGivenName = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_GIVEN_NAME_XPATH);
+		        if(!eIDASAttributes.containsKey(Constants.eIDAS_ATTR_CURRENTGIVENNAME))
+		        	throw new eIDASAttributeException(Constants.eIDAS_ATTR_CURRENTGIVENNAME);
+				String givenName = eIDASAttributes.get(Constants.eIDAS_ATTR_CURRENTGIVENNAME).getValue().get(0);
+				prGivenName.getFirstChild().setNodeValue(givenName);
+
+		        // - set date of birth
+		        Node prDateOfBirth = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_DATE_OF_BIRTH_XPATH);
+		        if(!eIDASAttributes.containsKey(Constants.eIDAS_ATTR_DATEOFBIRTH))
+		        	throw new eIDASAttributeException(Constants.eIDAS_ATTR_DATEOFBIRTH);
+				String dateOfBirth = eIDASAttributes.get(Constants.eIDAS_ATTR_DATEOFBIRTH).getValue().get(0);
+				dateOfBirth = new SimpleDateFormat("yyyy-MM-dd").format(new SimpleDateFormat("yyyyMMdd").parse(dateOfBirth));
+				prDateOfBirth.getFirstChild().setNodeValue(dateOfBirth);
+
+	            identityLink = new IdentityLinkAssertionParser(idlassertion).parseIdentityLink();
+
+	            //resign IDL
+				IdentityLinkReSigner identitylinkresigner = IdentityLinkReSigner.getInstance();
+				Element resignedilAssertion = identitylinkresigner.resignIdentityLink(identityLink.getSamlAssertion(), authConfig.getStorkFakeIdLResigningKey());
+				identityLink = new IdentityLinkAssertionParser(resignedilAssertion).parseIdentityLink();
+				
+			} else {
+				//contact SZR Gateway
+				Logger.debug("Starting connecting SZR Gateway");
+			
+				//TODO:!!!!!!
+				
+			}
+			
+			Logger.debug("SZR communication was successfull");
+
+			if (identityLink == null) {
+				Logger.error("SZR Gateway did not return an identity link.");
+				throw new MOAIDException("stork.10", null);
+			}
+			
+			revisionsLogger.logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_PEPS_IDL_RECEIVED);			
+			moasession.setForeigner(true);
+			moasession.setIdentityLink(identityLink);
+			moasession.setBkuURL("Not applicable (eIDASAuthentication)");
+			
+			//store MOA-session to database
+			authenticatedSessionStorage.storeSession(moasession);
+		
+		} catch (eIDASAttributeException e) {
+			throw new TaskExecutionException(pendingReq, "Minimum required eIDAS attributeset not found.", e);
+						
+		} catch (MOAIDException | MOADatabaseException e) {
+			throw new TaskExecutionException(pendingReq, "IdentityLink generation for foreign person FAILED.", e);
+						
+		} catch (Exception e) {
+			Logger.error("IdentityLink generation for foreign person FAILED.", e);
+			throw new TaskExecutionException(pendingReq, "IdentityLink generation for foreign person FAILED.", e);
+			
+		}
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/GenerateAuthnRequestTask.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/GenerateAuthnRequestTask.java
new file mode 100644
index 000000000..c82636a8f
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/GenerateAuthnRequestTask.java
@@ -0,0 +1,207 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.tasks;
+
+import java.io.StringWriter;
+import java.util.Collection;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.lang3.BooleanUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.velocity.Template;
+import org.apache.velocity.VelocityContext;
+import org.apache.velocity.app.VelocityEngine;
+import org.springframework.stereotype.Component;
+
+import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
+import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
+import at.gv.egovernment.moa.id.auth.frontend.velocity.VelocityProvider;
+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
+import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
+import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
+import at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.EIDASEngineException;
+import at.gv.egovernment.moa.id.auth.modules.eidas.utils.SAMLEngineUtils;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.data.CPEPS;
+import at.gv.egovernment.moa.id.commons.api.data.StorkAttribute;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+import at.gv.egovernment.moa.logging.Logger;
+import eu.eidas.auth.commons.EIDASAuthnRequest;
+import eu.eidas.auth.commons.EIDASUtil;
+import eu.eidas.auth.commons.EidasLoaCompareType;
+import eu.eidas.auth.commons.EidasLoaLevels;
+import eu.eidas.auth.commons.IPersonalAttributeList;
+import eu.eidas.auth.commons.PersonalAttribute;
+import eu.eidas.auth.commons.PersonalAttributeList;
+import eu.eidas.auth.engine.EIDASSAMLEngine;
+import eu.eidas.auth.engine.core.eidas.SPType;
+import eu.eidas.engine.exceptions.EIDASSAMLEngineException;
+
+/**
+ * @author tlenz
+ *
+ */
+@Component("GenerateAuthnRequestTask")
+public class GenerateAuthnRequestTask extends AbstractAuthServletTask {
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.process.springweb.MoaIdTask#execute(at.gv.egovernment.moa.id.process.api.ExecutionContext, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
+	 */
+	@Override
+	public void execute(ExecutionContext executionContext,
+			HttpServletRequest request, HttpServletResponse response)
+			throws TaskExecutionException {
+		
+		try{						
+			//get service-provider configuration
+			IOAAuthParameters oaConfig = pendingReq.getOnlineApplicationConfiguration();
+
+			// get target country
+			String citizenCountryCode = (String) executionContext.get(MOAIDAuthConstants.PARAM_CCC);
+
+			if (StringUtils.isEmpty(citizenCountryCode)) {
+				// illegal state; task should not have been executed without a selected country
+				throw new AuthenticationException("eIDAS.03", new Object[] { "" });
+			}
+
+			CPEPS cpeps = authConfig.getStorkConfig().getCPEPS(citizenCountryCode);
+			if(null == cpeps) {
+				Logger.error("PEPS unknown for country", new Object[] {citizenCountryCode});
+				throw new AuthenticationException("eIDAS.04", new Object[] {citizenCountryCode});
+			}
+			Logger.debug("Found eIDaS Node/C-PEPS configuration for citizen of country: " + citizenCountryCode);
+			String destination = cpeps.getPepsURL().toString().split(";")[1].trim(); // FIXME convenience for metadata url and assertion destination
+			String metadataUrl = cpeps.getPepsURL().toString().split(";")[0].trim();
+
+			
+			//TODO: switch to entityID
+			revisionsLogger.logEvent(oaConfig, pendingReq, 
+					MOAIDEventConstants.AUTHPROCESS_PEPS_SELECTED,
+					metadataUrl);
+			
+			// assemble requested attributes
+			Collection<StorkAttribute> attributesFromConfig = oaConfig.getRequestedSTORKAttributes();
+
+			// - prepare attribute list
+			IPersonalAttributeList pAttList = new PersonalAttributeList();
+
+			// - fill container
+			for (StorkAttribute current : attributesFromConfig) {
+				PersonalAttribute newAttribute = new PersonalAttribute();
+				newAttribute.setName(current.getName());
+
+				boolean globallyMandatory = false;
+				for (StorkAttribute currentGlobalAttribute : authConfig.getStorkConfig().getStorkAttributes())
+					if (current.getName().equals(currentGlobalAttribute.getName())) {
+						globallyMandatory = BooleanUtils.isTrue(currentGlobalAttribute.getMandatory());
+						break;
+					}
+
+				newAttribute.setIsRequired(current.getMandatory() || globallyMandatory);
+				pAttList.add(newAttribute);
+			}
+
+			EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine();
+
+			//build eIDAS AuthnRequest
+			EIDASAuthnRequest authnRequest = new EIDASAuthnRequest();
+			authnRequest.setProviderName(pendingReq.getAuthURL());
+			authnRequest.setPersonalAttributeList(pAttList);
+			
+			authnRequest.setIssuer(pendingReq.getAuthURL() + Constants.eIDAS_HTTP_ENDPOINT_METADATA);
+			
+			authnRequest.setDestination(destination); 
+			authnRequest.setEidasNameidFormat(EIDASAuthnRequest.NAMEID_FORMAT_UNSPECIFIED);
+			authnRequest.setEidasLoA(EidasLoaLevels.LOW.stringValue());
+			authnRequest.setEidasLoACompareType(EidasLoaCompareType.MINIMUM.stringValue());
+			
+			//set correct SPType for this online application
+			if (oaConfig.getBusinessService())
+				authnRequest.setSPType("private");
+			else
+				authnRequest.setSPType(SPType.DEFAULT_VALUE);
+
+			engine.initRequestedAttributes(pAttList);
+			authnRequest = engine.generateEIDASAuthnRequest(authnRequest);
+			
+			//encode AuthnRequest
+			byte[] token = authnRequest.getTokenSaml();		
+			String SAMLRequest = EIDASUtil.encodeSAMLToken(token);
+			
+			
+			//send
+	        try {
+	            VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
+	            Template template = velocityEngine.getTemplate("/resources/templates/eidas_postbinding_template.vm");
+	            VelocityContext context = new VelocityContext();
+
+	            String actionType = "SAMLRequest";
+	            context.put(actionType, SAMLRequest);
+	            Logger.debug("Encoded " + actionType + " original: " + SAMLRequest);
+
+	            context.put("RelayState", pendingReq.getRequestID());
+	            
+	            Logger.debug("Using assertion consumer url as action: " + destination);
+	            context.put("action", destination);
+
+	            Logger.debug("Starting template merge");
+	            StringWriter writer = new StringWriter();
+
+	            Logger.debug("Doing template merge");
+	            template.merge(context, writer);
+	            Logger.debug("Template merge done");
+
+	            Logger.debug("Sending html content: " + writer.getBuffer().toString());
+
+	            response.setContentType("text/html;charset=UTF-8");
+	            response.getOutputStream().write(writer.getBuffer().toString().getBytes("UTF-8"));
+
+	            revisionsLogger.logEvent(oaConfig, pendingReq, 
+						MOAIDEventConstants.AUTHPROCESS_PEPS_REQUESTED,
+						authnRequest.getSamlId());
+	            	        
+	        } catch (Exception e) {
+	            Logger.error("Velocity general error: " + e.getMessage());
+	            throw new MOAIDException("eIDAS.02", new Object[]{e.getMessage()}, e);
+	            
+	        }
+
+		}catch (EIDASSAMLEngineException e){
+			throw new TaskExecutionException(pendingReq, "eIDAS AuthnRequest generation FAILED.", 
+					new EIDASEngineException("eIDAS.00", new Object[]{e.getMessage()}, e));
+			
+		} catch (MOAIDException  e) {
+			throw new TaskExecutionException(pendingReq, "eIDAS AuthnRequest generation FAILED.", e);
+			
+		} catch (Exception e) {
+			Logger.error("eIDAS AuthnRequest generation FAILED.", e);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
+			
+		}
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/ReceiveAuthnResponseTask.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/ReceiveAuthnResponseTask.java
new file mode 100644
index 000000000..fae06031a
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/ReceiveAuthnResponseTask.java
@@ -0,0 +1,121 @@
+package at.gv.egovernment.moa.id.auth.modules.eidas.tasks;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.opensaml.saml2.core.StatusCode;
+import org.springframework.stereotype.Component;
+
+import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants;
+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
+import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
+import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
+import at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.EIDASEngineException;
+import at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.eIDASResponseNotSuccessException;
+import at.gv.egovernment.moa.id.auth.modules.eidas.utils.MOAPersonalAttributeList;
+import at.gv.egovernment.moa.id.auth.modules.eidas.utils.SAMLEngineUtils;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.MiscUtil;
+import eu.eidas.auth.commons.EIDASAuthnResponse;
+import eu.eidas.auth.commons.EIDASUtil;
+import eu.eidas.auth.engine.EIDASSAMLEngine;
+import eu.eidas.engine.exceptions.EIDASSAMLEngineException;
+
+@Component("ReceiveAuthnResponseTask")
+public class ReceiveAuthnResponseTask extends AbstractAuthServletTask {
+
+	@Override
+	public void execute(ExecutionContext executionContext, HttpServletRequest request, HttpServletResponse response) throws TaskExecutionException {
+
+		try{			
+			//get SAML Response
+			String base64SamlToken = request.getParameter("SAMLResponse");
+			if (MiscUtil.isEmpty(base64SamlToken)) {
+				Logger.warn("No eIDAS SAMLReponse found in http request.");
+				throw new MOAIDException("HTTP request includes no eIDAS SAML-Response element.", null);
+				
+			}
+			
+			//get MOASession
+			defaultTaskInitialization(request, executionContext);
+			
+			//decode SAML response
+			byte[] decSamlToken = EIDASUtil.decodeSAMLToken(base64SamlToken);		
+			
+			//get eIDAS SAML-engine
+			EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine();
+			
+			//validate SAML token
+			EIDASAuthnResponse samlResp = engine.validateEIDASAuthnResponse(decSamlToken, 
+					request.getRemoteHost(), Constants.CONFIG_PROPS_SKEWTIME);
+			
+			boolean encryptedResponse=engine.isEncryptedSamlResponse(decSamlToken);
+			if (encryptedResponse) {
+				Logger.info("Received encrypted eIDAS SAML-Response.");
+				//TODO: check if additional decryption operation is required
+				
+			}
+
+			//check response StatusCode
+			if (!samlResp.getStatusCode().equals(StatusCode.SUCCESS_URI)) {
+				Logger.info("Receice eIDAS Response with StatusCode:" + samlResp.getStatusCode()
+				+ " Subcode:" + samlResp.getSubStatusCode() + " Msg:" + samlResp.getMessage());
+				throw new eIDASResponseNotSuccessException("eIDAS.11", new Object[]{samlResp.getMessage()});
+				
+			}
+			
+			//MOA-ID specific response validation
+			//TODO: implement MOA-ID specific response validation
+			
+			//update MOA-Session data with received information			
+			Logger.debug("Store eIDAS response information into MOA-session.");
+			moasession.setQAALevel(samlResp.getAssuranceLevel());
+						
+			moasession.setGenericDataToSession(
+					AuthenticationSessionStorageConstants.eIDAS_ATTRIBUTELIST, 
+					new MOAPersonalAttributeList(samlResp.getPersonalAttributeList()));
+						
+			moasession.setGenericDataToSession(
+					AuthenticationSessionStorageConstants.eIDAS_RESPONSE, 
+					decSamlToken);
+			
+			//set issuer nation as PVP attribute into MOASession
+			moasession.setGenericDataToSession(PVPConstants.EID_ISSUING_NATION_NAME, samlResp.getCountry());
+						
+			//store MOA-session to database
+			authenticatedSessionStorage.storeSession(moasession);
+			
+			revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), pendingReq, 
+					MOAIDEventConstants.AUTHPROCESS_PEPS_RECEIVED,
+					samlResp.getSamlId());
+			
+		}catch (EIDASSAMLEngineException e) {
+			Logger.error("eIDAS AuthnRequest generation FAILED.", e);
+			revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), pendingReq, 
+					MOAIDEventConstants.AUTHPROCESS_PEPS_RECEIVED_ERROR);
+			throw new TaskExecutionException(pendingReq, "eIDAS AuthnRequest generation FAILED.", 
+					new EIDASEngineException("eIDAS.09", new Object[]{e.getMessage()}, e));
+					
+		} catch (MOADatabaseException e) {
+			revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), pendingReq, 
+					MOAIDEventConstants.AUTHPROCESS_PEPS_RECEIVED_ERROR);
+			throw new TaskExecutionException(pendingReq, "eIDAS Response processing FAILED.", 
+					new MOAIDException("init.04", new Object[]{""}, e));
+			
+		} catch (Exception e) {
+			Logger.error("eIDAS Response processing FAILED.", e);
+			revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), pendingReq, 
+					MOAIDEventConstants.AUTHPROCESS_PEPS_RECEIVED_ERROR);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), 
+					new MOAIDException("eIDAS.10", new Object[]{e.getMessage()}, e));
+			
+		}	
+		
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/MOAOrderedAttributeIterator.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/MOAOrderedAttributeIterator.java
new file mode 100644
index 000000000..573163af0
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/MOAOrderedAttributeIterator.java
@@ -0,0 +1,66 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.utils;
+
+import java.util.Iterator;
+import java.util.NoSuchElementException;
+
+import at.gv.egovernment.moa.logging.Logger;
+
+import eu.eidas.auth.commons.PersonalAttribute;
+import eu.eidas.auth.commons.PersonalAttributeList;
+
+
+/**
+ * @author tlenz
+ *
+ */
+public class MOAOrderedAttributeIterator  implements Iterator<PersonalAttribute> {
+	
+    private MOAPersonalAttributeList pal;
+    private Iterator<String> keyIterator;
+
+    public MOAOrderedAttributeIterator(MOAPersonalAttributeList palArg) {
+        this.pal = palArg;
+        keyIterator = palArg.getInsertOrder().iterator();
+    }
+
+    @Override
+    public boolean hasNext() {
+        return keyIterator.hasNext();
+    }
+
+    @Override
+    public PersonalAttribute next() {
+        if (!hasNext()) {
+            throw new NoSuchElementException();
+        }
+        return pal.get(keyIterator.next());
+    }
+
+    @Override
+    public void remove() {
+        Logger.error("Not implemented");
+    }
+
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/MOAPersonalAttributeList.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/MOAPersonalAttributeList.java
new file mode 100644
index 000000000..5cc100b70
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/MOAPersonalAttributeList.java
@@ -0,0 +1,343 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.utils;
+
+import java.io.IOException;
+import java.io.ObjectInputStream;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+import java.util.StringTokenizer;
+import java.util.concurrent.ConcurrentHashMap;
+
+import org.apache.commons.lang.StringUtils;
+
+import at.gv.egovernment.moa.logging.Logger;
+
+import eu.eidas.auth.commons.AttributeConstants;
+import eu.eidas.auth.commons.AttributeUtil;
+import eu.eidas.auth.commons.EIDASErrors;
+import eu.eidas.auth.commons.EIDASParameters;
+import eu.eidas.auth.commons.EIDASUtil;
+import eu.eidas.auth.commons.EIDASValues;
+import eu.eidas.auth.commons.IPersonalAttributeList;
+import eu.eidas.auth.commons.PersonalAttribute;
+import eu.eidas.auth.commons.exceptions.InternalErrorEIDASException;
+
+/**
+ * @author tlenz
+ *
+ */
+public final class MOAPersonalAttributeList extends
+	ConcurrentHashMap<String, PersonalAttribute> implements IPersonalAttributeList {
+	
+	 /**
+	 * 
+	 */
+	private static final long serialVersionUID = -4488124133022713089L;
+
+    public MOAPersonalAttributeList(IPersonalAttributeList eIDASAttributeList) {
+    	super();
+    	Iterator<PersonalAttribute> element = eIDASAttributeList.iterator();
+    	while(element.hasNext())
+    		add(element.next());    		
+    	
+    }
+	
+	/**
+     * Hash with the latest fetched attribute name alias.
+     */
+    private Map<String, Integer> latestAttrAlias =
+            new HashMap<String, Integer>();
+
+    /**
+     * Hash with mapping number of alias or the attribute name.
+     */
+    private Map<String, Integer> attrAliasNumber =
+            new HashMap<String, Integer>();
+    private List<String> insertOrder = new ArrayList<String>();
+
+    /**
+     * Obtain the insertOrder Collection
+     *
+     * @return defensive copy of the collection
+     */
+    List<String> getInsertOrder() {
+        return Collections.unmodifiableList(this.insertOrder);
+    }
+
+    /**
+     * Default constructor.
+     */
+    public MOAPersonalAttributeList() {
+        super();
+        
+    }
+    
+    /**
+     * Constructor with initial capacity for the PersonalAttributeList size.
+     *
+     * @param capacity The initial capacity for the PersonalAttributeList.
+     */
+    public MOAPersonalAttributeList(final int capacity) {
+        super(capacity);
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public Iterator<PersonalAttribute> iterator() {
+        return new MOAOrderedAttributeIterator(this);
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public PersonalAttribute get(final Object key) {
+        String attrName = (String) key;
+
+        if (this.latestAttrAlias == null)
+        	this.latestAttrAlias = new HashMap<String, Integer>();
+        
+        if (this.attrAliasNumber == null)
+        	this.attrAliasNumber = new HashMap<String, Integer>();
+        
+        if (this.latestAttrAlias.containsKey(key)) {
+            attrName = attrName + this.latestAttrAlias.get(key);
+        } else {
+            if (this.attrAliasNumber.containsKey(key)) {
+                this.latestAttrAlias.put(attrName, this.attrAliasNumber.get(key));
+            }
+        }
+        return super.get(attrName);
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public void add(final PersonalAttribute value) {
+        if (value != null) {
+            this.put(value.getName(), value);
+        }
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public PersonalAttribute put(final String key, final PersonalAttribute val) {
+        if (StringUtils.isNotEmpty(key) && val != null) {
+            // Validate if attribute name already exists!
+            String attrAlias = key;
+            if (this.containsKey(attrAlias)) {
+            	if (this.attrAliasNumber == null)
+            		this.attrAliasNumber = new HashMap<String, Integer>();
+                if (!val.isEmptyValue() && StringUtils.isNumeric(val.getValue().get(0))) {
+                    final String attrValue = val.getValue().get(0);
+                    attrAlias = key + attrValue;
+                    this.attrAliasNumber.put(key, Integer.valueOf(attrValue));
+                } else {
+                    final PersonalAttribute attr = super.get(key);
+                    if (!attr.isEmptyValue()
+                            && StringUtils.isNumeric(attr.getValue().get(0))) {
+                        attrAlias = key + attr.getValue().get(0);
+                        super.put(key, (PersonalAttribute) attr);
+                        this.attrAliasNumber.put(key, null);
+                    }
+                }
+            } else {
+            	if (insertOrder == null)
+            		insertOrder = new ArrayList<String>();
+            	
+                insertOrder.add(key);
+            }
+            return super.put(attrAlias, val);
+        } else {
+            return null;
+        }
+    }
+
+    @Override
+    public PersonalAttribute remove(Object key) {
+        insertOrder.remove(key);
+        return super.remove(key);
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public void populate(final String attrList) {
+        final StringTokenizer strToken =
+                new StringTokenizer(attrList, EIDASValues.ATTRIBUTE_SEP.toString());
+
+        while (strToken.hasMoreTokens()) {
+            final PersonalAttribute persAttr = new PersonalAttribute();
+            String[] tuples =
+                    strToken.nextToken().split(EIDASValues.ATTRIBUTE_TUPLE_SEP.toString(),
+                            AttributeConstants.NUMBER_TUPLES.intValue());
+
+            // Convert to the new format if needed!
+            tuples = convertFormat(tuples);
+
+            if (AttributeUtil.hasValidTuples(tuples)) {
+                final int attrValueIndex =
+                        AttributeConstants.ATTR_VALUE_INDEX.intValue();
+                final String tmpAttrValue =
+                        tuples[attrValueIndex].substring(1,
+                                tuples[attrValueIndex].length() - 1);
+                final String[] vals =
+                        tmpAttrValue.split(EIDASValues.ATTRIBUTE_VALUE_SEP.toString());
+
+                persAttr.setName(tuples[AttributeConstants.ATTR_NAME_INDEX.intValue()]);
+                persAttr.setIsRequired(Boolean
+                        .valueOf(tuples[AttributeConstants.ATTR_TYPE_INDEX.intValue()]));
+                // check if it is a complex value
+                if (tuples[AttributeConstants.ATTR_NAME_INDEX.intValue()]
+                        .equals(EIDASParameters.COMPLEX_ADDRESS_VALUE.toString())) {
+                    persAttr.setComplexValue(createComplexValue(vals));
+                } else {
+                    persAttr.setValue(createValues(vals));
+                }
+
+                if (tuples.length == AttributeConstants.NUMBER_TUPLES.intValue()) {
+                    persAttr.setStatus(tuples[AttributeConstants.ATTR_STATUS_INDEX
+                            .intValue()]);
+                }
+                this.put(tuples[AttributeConstants.ATTR_NAME_INDEX.intValue()],
+                        persAttr);
+
+            } else {
+                Logger.info("BUSINESS EXCEPTION : Invalid personal attribute list tuples");
+            }
+
+        }
+    }
+
+  /**
+  * Returns a copy of this <tt>IPersonalAttributeList</tt> instance.
+  *
+  * @return The copy of this IPersonalAttributeList.
+  */
+  public Object clone() {
+      try {
+          MOAPersonalAttributeList theClone= (MOAPersonalAttributeList)super.clone();
+          theClone.insertOrder=new ArrayList<String>(insertOrder);
+          return theClone;
+          
+      } catch (CloneNotSupportedException e) {
+          throw new InternalErrorEIDASException(
+                  EIDASUtil.getConfig(EIDASErrors.INTERNAL_ERROR.errorCode()),
+                  EIDASUtil.getConfig(EIDASErrors.INTERNAL_ERROR.errorMessage()), e);
+      }
+  }
+
+  /**
+   * Creates a string in the following format.
+   *
+   * attrName:attrType:[attrValue1,attrValue2=attrComplexValue]:attrStatus;
+   *
+   * @return {@inheritDoc}
+   */
+  @Override
+  public String toString() {
+      final StringBuilder strBuilder = new StringBuilder();
+      final Iterator<String> iteratorInsertOrder = insertOrder.iterator();
+      while (iteratorInsertOrder.hasNext()) {
+          String key = iteratorInsertOrder.next();
+          final PersonalAttribute attr = get(key);
+          strBuilder.append(attr.toString());
+          if (isNumberAlias(key)) {
+              strBuilder.append(get(key).toString());
+          }
+      }
+      return strBuilder.toString();
+  }
+
+    /**
+     * Validates and creates the attribute's complex values.
+     *
+     * @param values The complex values.
+     * @return The {@link Map} with the complex values.
+     * @see Map
+     */
+    private Map<String, String> createComplexValue(final String[] values) {
+        final Map<String, String> complexValue = new HashMap<String, String>();
+        for (final String val : values) {
+            final String[] tVal = val.split("=");
+            if (StringUtils.isNotEmpty(val) && tVal.length == 2) {
+                complexValue.put(tVal[0], AttributeUtil.unescape(tVal[1]));
+            }
+        }
+        return complexValue;
+    }
+
+    /**
+     * Validates and creates the attribute values.
+     *
+     * @param vals The attribute values.
+     * @return The {@link List} with the attribute values.
+     * @see List
+     */
+    private List<String> createValues(final String[] vals) {
+        final List<String> values = new ArrayList<String>();
+        for (final String val : vals) {
+            if (StringUtils.isNotEmpty(val)) {
+                values.add(AttributeUtil.unescape(val));
+            }
+        }
+        return values;
+    }
+
+    //////////////////
+    /**
+     * Converts the attribute tuple (attrName:attrType...) to the new format.
+     *
+     * @param tuples The attribute tuples to convert.
+     * @return The attribute tuples in the new format.
+     */
+    private String[] convertFormat(final String[] tuples) {
+        final String[] newFormatTuples =
+                new String[AttributeConstants.NUMBER_TUPLES.intValue()];
+        if (tuples != null) {
+            System.arraycopy(tuples, 0, newFormatTuples, 0, tuples.length);
+
+            for (int i = tuples.length; i < newFormatTuples.length; i++) {
+                if (i == AttributeConstants.ATTR_VALUE_INDEX.intValue()) {
+                    newFormatTuples[i] = "[]";
+                } else {
+                    newFormatTuples[i] = "";
+                }
+            }
+        }
+        return newFormatTuples;
+    }
+
+    public boolean isNumberAlias(String key) {
+        return this.attrAliasNumber.containsKey(key);
+    }
+	
+	
+
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/SAMLEngineUtils.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/SAMLEngineUtils.java
new file mode 100644
index 000000000..eeb8305cf
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/SAMLEngineUtils.java
@@ -0,0 +1,77 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.utils;
+
+import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
+import at.gv.egovernment.moa.id.auth.modules.eidas.config.MOAIDCertificateManagerConfigurationImpl;
+import at.gv.egovernment.moa.id.auth.modules.eidas.engine.MOAeIDASChainingMetadataProvider;
+import at.gv.egovernment.moa.id.auth.modules.eidas.engine.MOAeIDASMetadataProviderDecorator;
+import at.gv.egovernment.moa.id.auth.modules.eidas.engine.MOAeIDAsExtensionProcessor;
+import at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.EIDASEngineException;
+import at.gv.egovernment.moa.logging.Logger;
+import eu.eidas.auth.engine.EIDASSAMLEngine;
+import eu.eidas.auth.engine.core.ExtensionProcessorI;
+import eu.eidas.engine.exceptions.EIDASSAMLEngineException;
+import eu.eidas.samlengineconfig.CertificateConfigurationManager;
+
+/**
+ * @author tlenz
+ *
+ */
+public class SAMLEngineUtils {
+
+	private static EIDASSAMLEngine eIDASEngine = null;
+	
+	public static synchronized EIDASSAMLEngine createSAMLEngine() throws EIDASEngineException{
+		
+		if (eIDASEngine == null) {
+			try {
+				//get eIDAS SAMLengine configuration from MOA-ID configuration
+				CertificateConfigurationManager configManager = new MOAIDCertificateManagerConfigurationImpl();
+				
+				//initial eIDAS SAMLengine
+				EIDASSAMLEngine engine = EIDASSAMLEngine.createSAMLEngine(Constants.eIDAS_SAML_ENGINE_NAME,
+							configManager);
+	
+				//set metadata management to eIDAS SAMLengine
+				engine.setMetadataProcessor(
+						new MOAeIDASMetadataProviderDecorator(
+								MOAeIDASChainingMetadataProvider.getInstance()));
+	
+				//set MOA specific extension processor 
+				ExtensionProcessorI extensionProcessor = new MOAeIDAsExtensionProcessor();
+				engine.setExtensionProcessor(extensionProcessor);
+				
+				eIDASEngine = engine;
+				
+			} catch (EIDASSAMLEngineException e) {
+				Logger.error("eIDAS SAMLengine initialization FAILED!", e);
+				throw new EIDASEngineException("eIDAS.00", new Object[]{e.getMessage()}, e);
+				
+			}
+		}
+		
+		return eIDASEngine;
+	}
+	
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASData.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASData.java
new file mode 100644
index 000000000..563c3a18c
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASData.java
@@ -0,0 +1,108 @@
+package at.gv.egovernment.moa.id.protocols.eidas;
+
+import java.util.Collection;
+
+import org.springframework.beans.factory.config.BeanDefinition;
+import org.springframework.context.annotation.Scope;
+import org.springframework.stereotype.Component;
+
+import at.gv.egovernment.moa.id.auth.modules.eidas.utils.MOAPersonalAttributeList;
+import at.gv.egovernment.moa.id.moduls.RequestImpl;
+import eu.eidas.auth.commons.EIDASAuthnRequest;
+
+@Component("EIDASData")
+@Scope(value = BeanDefinition.SCOPE_PROTOTYPE)
+public class EIDASData extends RequestImpl {
+
+	/** The Constant serialVersionUID. */
+	private static final long serialVersionUID = 8765755670214923910L;
+	
+	/** The attributes requested by the eIDaS. */
+	private MOAPersonalAttributeList attributes;
+
+	/** The incoming eIDaS SAML2 AuthnRequest. */
+	private EIDASAuthnRequest authnRequest;
+
+	/** The ip address of the requester. */
+	private String remoteIPAddress;
+
+	private String remoteRelayState;
+
+	@Override
+	public Collection<String> getRequestedAttributes() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+	
+	/**
+	 * Gets the eidas requested attributes.
+	 *
+	 * @return the requested attributes
+	 */
+	public MOAPersonalAttributeList getEidasRequestedAttributes() {
+		return (MOAPersonalAttributeList) attributes.clone();
+	}
+
+	/**
+	 * Sets the eidas requested attributes.
+	 *
+	 * @param personalAttributeList the requested attributes
+	 */
+	public void setEidasRequestedAttributes(MOAPersonalAttributeList personalAttributeList) {
+		attributes = personalAttributeList;
+	}
+
+	/**
+	 * Gets the eidas request.
+	 *
+	 * @return the eidas request
+	 */
+	public EIDASAuthnRequest getEidasRequest() {
+		return authnRequest;
+	}
+	
+	/**
+	 * Sets the eidas request.
+	 *
+	 * @param request the new eidas request
+	 */
+	public void setEidasRequest(EIDASAuthnRequest request) {
+		authnRequest = request;  
+	}
+
+	/**
+	 * Gets the remote address.
+	 *
+	 * @return the remote address
+	 */
+	public String getRemoteAddress() {
+		return remoteIPAddress;
+	}
+	
+	/**
+	 * Sets the remote address.
+	 *
+	 * @param remoteIP the new remote address
+	 */
+	public void setRemoteAddress(String remoteIP) {
+		remoteIPAddress = remoteIP;
+	}
+
+	/**
+	 * Gets the remote relay state.
+	 *
+	 * @return the remote relay state
+	 */
+	public String getRemoteRelayState() {
+		return remoteRelayState;
+	}
+
+	/**
+	 * Sets the remote relay state.
+	 *
+	 * @param relayState the new remote relay state
+	 */
+	public void setRemoteRelayState(String relayState) {
+		remoteRelayState = relayState;
+	}
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASProtocol.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASProtocol.java
new file mode 100644
index 000000000..24134f1d9
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASProtocol.java
@@ -0,0 +1,339 @@
+/*******************************************************************************
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ *******************************************************************************/
+package at.gv.egovernment.moa.id.protocols.eidas;
+
+import java.io.IOException;
+import java.io.StringWriter;
+import java.util.List;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.velocity.Template;
+import org.apache.velocity.VelocityContext;
+import org.apache.velocity.app.VelocityEngine;
+import org.opensaml.saml2.core.StatusCode;
+import org.opensaml.saml2.metadata.AssertionConsumerService;
+import org.springframework.http.MediaType;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
+import at.gv.egovernment.moa.id.auth.frontend.velocity.VelocityProvider;
+import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
+import at.gv.egovernment.moa.id.auth.modules.eidas.engine.MOAeIDASChainingMetadataProvider;
+import at.gv.egovernment.moa.id.auth.modules.eidas.engine.MOAeIDASMetadataProviderDecorator;
+import at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.eIDASAuthnRequestProcessingException;
+import at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.eIDASAuthnRequestValidationException;
+import at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.eIDASException;
+import at.gv.egovernment.moa.id.auth.modules.eidas.utils.MOAPersonalAttributeList;
+import at.gv.egovernment.moa.id.auth.modules.eidas.utils.SAMLEngineUtils;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.moduls.RequestImpl;
+import at.gv.egovernment.moa.id.protocols.AbstractAuthProtocolModulController;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.MiscUtil;
+import eu.eidas.auth.commons.EIDASAuthnRequest;
+import eu.eidas.auth.commons.EIDASAuthnResponse;
+import eu.eidas.auth.commons.EIDASUtil;
+import eu.eidas.auth.engine.EIDASSAMLEngine;
+import eu.eidas.auth.engine.metadata.MetadataUtil;
+import eu.eidas.engine.exceptions.EIDASSAMLEngineException;
+
+/**
+ * eIDAS Protocol Support for outbound authentication and metadata generation
+ *
+ * @author tlenz
+ */
+@Controller
+public class EIDASProtocol extends AbstractAuthProtocolModulController {
+
+    public static final String NAME = EIDASProtocol.class.getName();
+    public static final String PATH = "eidas";
+
+	public EIDASProtocol() {
+		super();
+		Logger.debug("Registering servlet " + getClass().getName() + 
+				" with mappings '" + Constants.eIDAS_HTTP_ENDPOINT_METADATA + 
+				"' and '" + Constants.eIDAS_HTTP_ENDPOINT_IDP_COLLEAGUEREQUEST + 
+				"' and '" + Constants.eIDAS_HTTP_ENDPOINT_IDP_POST +"'.");
+	
+	}
+    
+    public String getName() {
+        return NAME;
+    }
+
+    public String getPath() {
+        return PATH;
+    }
+
+	//eIDAS metadata end-point
+	@RequestMapping(value = "/eidas/metadata", method = {RequestMethod.GET})
+	public void eIDASMetadataRequest(HttpServletRequest req, HttpServletResponse resp) throws MOAIDException {
+		
+		//create pendingRequest object
+		EIDASData pendingReq = applicationContext.getBean(EIDASData.class);
+		pendingReq.initialize(req);
+		pendingReq.setModule(NAME);
+		pendingReq.setNeedAuthentication(false);
+		pendingReq.setAuthenticated(false);
+		
+		revisionsLogger.logEvent(
+				pendingReq.getUniqueSessionIdentifier(), 
+				pendingReq.getUniqueTransactionIdentifier(), 
+				MOAIDEventConstants.TRANSACTION_IP, 
+				req.getRemoteAddr());
+		
+
+		EidasMetaDataRequest metadataAction = applicationContext.getBean(EidasMetaDataRequest.class);
+		metadataAction.processRequest(pendingReq, 
+				req, resp, null);
+		
+		revisionsLogger.logEvent(
+				pendingReq.getUniqueSessionIdentifier(), 
+				pendingReq.getUniqueTransactionIdentifier(), 
+				Constants.eIDAS_REVERSIONSLOG_METADATA);
+	}
+    
+	
+	//PVP2.x IDP POST-Binding end-point
+	@RequestMapping(value = "/eidas/ColleagueRequest", method = {RequestMethod.POST})
+	public void PVPIDPPostRequest(HttpServletRequest req, HttpServletResponse resp) throws MOAIDException, IOException {
+		
+		//create pending-request object
+		EIDASData pendingReq = applicationContext.getBean(EIDASData.class);
+		pendingReq.initialize(req);
+		pendingReq.setModule(NAME);
+		
+		revisionsLogger.logEvent(MOAIDEventConstants.SESSION_CREATED, pendingReq.getUniqueSessionIdentifier());
+		revisionsLogger.logEvent(MOAIDEventConstants.TRANSACTION_CREATED, pendingReq.getUniqueTransactionIdentifier());						
+		revisionsLogger.logEvent(
+				pendingReq.getUniqueSessionIdentifier(), 
+				pendingReq.getUniqueTransactionIdentifier(), 
+				MOAIDEventConstants.TRANSACTION_IP, 
+				req.getRemoteAddr());
+		
+		//preProcess eIDAS request
+		preProcess(req, resp, pendingReq);
+		
+		revisionsLogger.logEvent(pendingReq, Constants.eIDAS_REVERSIONSLOG_IDP_AUTHREQUEST);
+		
+		//AuthnRequest needs authentication
+		pendingReq.setNeedAuthentication(true);
+
+		//set protocol action, which should be executed after authentication
+		pendingReq.setAction(eIDASAuthenticationRequest.class.getName());
+		
+		//switch to session authentication
+		performAuthentication(req, resp, pendingReq);
+	}
+    
+    /*
+        First request step - send it to BKU selection for user authentication. After the user credentials
+        and other info are obtained, in the second step the request will be processed and the user redirected
+         */
+    private void preProcess(HttpServletRequest request, HttpServletResponse response, EIDASData pendingReq) throws MOAIDException {
+
+        Logger.info("received an eIDaS request");
+
+		//get SAML Response and decode it
+		String base64SamlToken = request.getParameter("SAMLRequest");
+		if (MiscUtil.isEmpty(base64SamlToken)) {
+			Logger.warn("No eIDAS SAMLRequest found in http request.");
+			throw new MOAIDException("HTTP request includes no eIDAS SAML-Request element.", null);
+		}						
+		byte[] decSamlToken = EIDASUtil.decodeSAMLToken(base64SamlToken);	
+
+		try {
+			//get eIDAS SAML-engine
+			EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine();
+
+			//validate SAML token
+			EIDASAuthnRequest samlReq = engine.validateEIDASAuthnRequest(decSamlToken);
+
+			// - memorize remote ip
+			pendingReq.setRemoteAddress(request.getRemoteAddr());
+			
+			// - memorize relaystate
+			String relayState = request.getParameter("RelayState");
+			pendingReq.setRemoteRelayState(relayState);
+
+			// - memorize country code of target country
+			pendingReq.setGenericDataToSession(
+					RequestImpl.eIDAS_GENERIC_REQ_DATA_COUNTRY, samlReq.getCountry());
+			
+			// - memorize requested attributes
+			pendingReq.setEidasRequestedAttributes(new MOAPersonalAttributeList(samlReq.getPersonalAttributeList()));
+
+			// - memorize whole request
+			samlReq.setPersonalAttributeList(pendingReq.getEidasRequestedAttributes()); // circumvent non-serializable eidas personal attribute list
+			pendingReq.setEidasRequest(samlReq);
+			
+			//validate destination against metadata 
+			String reqDestination = samlReq.getDestination();
+			if (MiscUtil.isNotEmpty(reqDestination)) {
+				boolean isValid = false;
+				List<AssertionConsumerService> allowedAssertionConsumerUrl = new MOAeIDASMetadataProviderDecorator(MOAeIDASChainingMetadataProvider.getInstance())
+						.getSPSSODescriptor(samlReq.getIssuer()).getAssertionConsumerServices();
+				
+				for (AssertionConsumerService el : allowedAssertionConsumerUrl) {
+					if (reqDestination.equals(el.getLocation()))
+						isValid = true;
+					
+				}
+				
+				if (!isValid) {
+					Logger.info("eIDAS AuthnRequest contains a not valid 'Destination' attribute");
+					throw new eIDASAuthnRequestValidationException("stork.01", 
+							new Object[]{"eIDAS AuthnRequest contains a not valid 'Destination' attribute"});
+				}
+				
+			}
+			
+			
+			// - memorize OA url
+			pendingReq.setOAURL(samlReq.getIssuer());
+	
+			// - memorize OA config
+			IOAAuthParameters oaConfig = authConfig.getOnlineApplicationParameter(pendingReq.getOAURL());
+			if (oaConfig == null)
+				throw new eIDASAuthnRequestProcessingException("eIDAS.08", new Object[]{pendingReq.getOAURL()});
+			
+			pendingReq.setOnlineApplicationConfiguration(oaConfig);
+
+			String spType = samlReq.getSPType();
+			if (MiscUtil.isEmpty(spType)) {
+				Logger.info("Load SPType from metadata ... IS NOT IMPLEMENTED YET!!!");
+				//TODO: maybe implement this if required
+							
+			}
+
+			Logger.debug("eIDAS request has SPType:" + spType);
+					
+		} catch (MOAIDException e) {
+			Logger.info("eIDAS AuthnRequest preProcessing FAILED. Msg:" + e.getMessage());
+			throw e;
+					
+		} catch (EIDASSAMLEngineException e) {
+			Logger.info("eIDAS AuthnRequest preProcessing FAILED. Msg:" + e.getMessage());
+			throw new eIDASAuthnRequestProcessingException("eIDAS.06", new Object[]{e.getMessage()}, e);
+			
+		} catch(Exception e) {
+			Logger.warn("eIDAS AuthnRequest preProcessing FAILED. Msg:" + e.getMessage(), e);
+			throw new eIDASAuthnRequestProcessingException("eIDAS.06", new Object[]{e.getMessage()}, e);
+			
+		}
+    }
+
+    public boolean generateErrorMessage(Throwable e, HttpServletRequest request, HttpServletResponse response, IRequest pendingReq) throws Throwable {
+        if (pendingReq != null && pendingReq instanceof EIDASData) {
+        	EIDASData eidasReq = (EIDASData) pendingReq;
+        	if (eidasReq.getEidasRequest() == null) {
+        		Logger.info("Can not build eIDAS ErrorResponse. No eIDAS AuthnRequest found.");
+        		return false;
+        	}
+        	
+        	try {
+        		EIDASAuthnResponse eIDASResp = new EIDASAuthnResponse();
+        		eIDASResp.setIssuer(pendingReq.getAuthURL() + Constants.eIDAS_HTTP_ENDPOINT_METADATA);
+        	     		
+        		if (e instanceof eIDASException) {
+        			eIDASResp.setStatusCode(((eIDASException) e).getStatusCodeFirstLevel());
+        			eIDASResp.setSubStatusCode(((eIDASException) e).getStatusCodeSecondLevel());
+        			eIDASResp.setMessage(e.getMessage());
+     			
+        		} else if (e instanceof MOAIDException ) {
+        			eIDASResp.setStatusCode(StatusCode.RESPONDER_URI);
+        			eIDASResp.setSubStatusCode(StatusCode.AUTHN_FAILED_URI);
+        			eIDASResp.setMessage(e.getMessage());
+     			
+        		} else {
+        			eIDASResp.setStatusCode(StatusCode.RESPONDER_URI);
+        			eIDASResp.setSubStatusCode(StatusCode.AUTHN_FAILED_URI);
+        			eIDASResp.setMessage(e.getMessage());
+     			
+        		}
+     		
+        		
+        		EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine();
+        		
+        		if(null == eidasReq.getEidasRequest().getAssertionConsumerServiceURL()) {
+    				String assertionConsumerUrl = MetadataUtil.getAssertionUrlFromMetadata(
+    						new MOAeIDASMetadataProviderDecorator(MOAeIDASChainingMetadataProvider.getInstance()), 
+    						engine, 
+    						eidasReq.getEidasRequest());
+    				eidasReq.getEidasRequest().setAssertionConsumerServiceURL(assertionConsumerUrl);
+    				
+    			}        		
+        		//get eIDAS SAML-engine
+        		
+        		eIDASResp = engine.generateEIDASAuthnResponseFail(eidasReq.getEidasRequest(), eIDASResp, 
+        				eidasReq.getRemoteAddress(), true);
+        		
+        		String token = EIDASUtil.encodeSAMLToken(eIDASResp.getTokenSaml());
+     		
+                VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
+                Template template = velocityEngine.getTemplate("/resources/templates/stork2_postbinding_template.html");
+                VelocityContext context = new VelocityContext();
+
+                context.put("RelayState", eidasReq.getRemoteRelayState());
+
+                context.put("SAMLResponse", token);
+                Logger.debug("SAMLResponse original: " + token);
+
+                Logger.debug("Putting assertion consumer url as action: " + eidasReq.getEidasRequest().getAssertionConsumerServiceURL());
+                context.put("action", eidasReq.getEidasRequest().getAssertionConsumerServiceURL());
+                Logger.trace("Starting template merge");
+                StringWriter writer = new StringWriter();
+
+                Logger.trace("Doing template merge");
+                template.merge(context, writer);
+                Logger.trace("Template merge done");
+
+                Logger.trace("Sending html content  : " + new String(writer.getBuffer()));
+
+                response.getOutputStream().write(writer.getBuffer().toString().getBytes("UTF-8"));
+                response.setContentType(MediaType.TEXT_HTML.getType());
+        		
+                return true;
+                
+        	} catch (Exception e1 ) { 
+        		Logger.error("Generate eIDAS Error-Response failed.", e);
+        		
+        	}
+     		     		
+        }
+    	
+    	return false;
+    }
+
+    public boolean validate(HttpServletRequest request, HttpServletResponse response, IRequest pending) {
+        return false;
+    }
+}
+
+
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EidasMetaDataRequest.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EidasMetaDataRequest.java
new file mode 100644
index 000000000..b4db5c83d
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EidasMetaDataRequest.java
@@ -0,0 +1,162 @@
+/*******************************************************************************
+ *  Copyright 2015 e-SENS project
+ *
+ *  Licensed under the EUPL, Version 1.1 or - as soon they will be
+ *  approved by the European Commission - subsequent versions of
+ *  the EUPL (the "Licence");
+ *  You may not use this work except in compliance with the Licence.
+ *  You may obtain a copy of the Licence at: http://ec.europa.eu/idabc/eupl
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the Licence is distributed on an "AS IS" basis,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ *  implied.
+ *  See the Licence for the specific language governing permissions and
+ *  limitations under the Licence.
+ *******************************************************************************/
+package at.gv.egovernment.moa.id.protocols.eidas;
+
+import java.util.List;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.opensaml.saml2.metadata.ContactPerson;
+import org.opensaml.saml2.metadata.Organization;
+import org.springframework.http.MediaType;
+import org.springframework.stereotype.Service;
+
+import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
+import at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.EIDASEngineException;
+import at.gv.egovernment.moa.id.auth.modules.eidas.utils.SAMLEngineUtils;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.data.IAuthData;
+import at.gv.egovernment.moa.id.data.SLOInformationInterface;
+import at.gv.egovernment.moa.id.moduls.IAction;
+import at.gv.egovernment.moa.id.protocols.pvp2x.config.PVPConfiguration;
+import at.gv.egovernment.moa.logging.Logger;
+import eu.eidas.auth.engine.EIDASSAMLEngine;
+import eu.eidas.auth.engine.metadata.Contact;
+import eu.eidas.auth.engine.metadata.MetadataConfigParams;
+import eu.eidas.auth.engine.metadata.MetadataGenerator;
+import eu.eidas.engine.exceptions.SAMLEngineException;
+
+
+/**
+ * First version to provide some valid metadata to an asking eIDaS node
+ */
+@Service("EidasMetaDataRequest")
+public class EidasMetaDataRequest implements IAction {
+    
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.moduls.IAction#processRequest(at.gv.egovernment.moa.id.moduls.IRequest, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, at.gv.egovernment.moa.id.data.IAuthData)
+	 */
+	@Override
+	public SLOInformationInterface processRequest(IRequest req,
+			HttpServletRequest httpReq, HttpServletResponse httpResp,
+			IAuthData authData) throws MOAIDException {
+       
+		try {            
+            String pubURLPrefix = req.getAuthURL();
+            
+            String metadata_url = pubURLPrefix + Constants.eIDAS_HTTP_ENDPOINT_METADATA;
+            
+            String sp_return_url = pubURLPrefix + Constants.eIDAS_HTTP_ENDPOINT_SP_POST;            
+            String metaData = generateMetadata(metadata_url, sp_return_url);
+
+            Logger.trace(metaData);
+
+            httpResp.setContentType(MediaType.APPLICATION_XML.getType());
+            httpResp.getWriter().print(metaData);
+            httpResp.flushBuffer();
+        } catch (Exception e) {        	
+        	Logger.error("eIDAS Metadata generation FAILED.", e);
+        	throw new MOAIDException("eIDAS.05", new Object[]{e.getMessage()}, e);
+            
+        } 
+		
+		
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.moduls.IAction#needAuthentication(at.gv.egovernment.moa.id.moduls.IRequest, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
+	 */
+	@Override
+	public boolean needAuthentication(IRequest req, HttpServletRequest httpReq,
+			HttpServletResponse httpResp) {
+		return false;
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.moduls.IAction#getDefaultActionName()
+	 */
+	@Override
+	public String getDefaultActionName() {
+		return "eIDAS-Metadata Action";
+		
+	}
+    
+    public String generateMetadata(String metadata_url, String sp_return_url) throws SAMLEngineException, EIDASEngineException{
+        String metadata="invalid metadata";
+
+		EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine();
+        
+        MetadataGenerator generator = new MetadataGenerator();
+        MetadataConfigParams mcp=new MetadataConfigParams();
+        generator.setConfigParams(mcp);
+        generator.initialize(engine);
+        
+        mcp.setEntityID(metadata_url);        
+        mcp.setAssertionConsumerUrl(sp_return_url);
+        
+        
+        //TODO: make it configurable
+        mcp.setAuthnRequestsSigned(true);
+        mcp.setWantAssertionsSigned(true);
+        mcp.setAssuranceLevel("http://eidas.europa.eu/LoA/substantial");
+        
+        //must be set in request, because it could be different for every online-application
+        //mcp.setSpType(SPType.DEFAULT_VALUE);
+        
+        mcp.setDigestMethods(Constants.METADATA_ALLOWED_ALG_DIGIST);
+        mcp.setSigningMethods(Constants.METADATA_ALLOWED_ALG_SIGN);
+        mcp.setEncryptionAlgorithms(Constants.METADATA_ALLOWED_ALG_ENCRYPT);
+        
+        //add organisation information from PVP metadata information        
+        Organization pvpOrganisation = null;
+		try {
+			pvpOrganisation = PVPConfiguration.getInstance().getIDPOrganisation();			
+			Contact technicalContact = new Contact();
+			
+			List<ContactPerson> contacts = PVPConfiguration.getInstance().getIDPContacts();
+			if (contacts != null && contacts.size() >= 1) {								
+				technicalContact.setEmail(contacts.get(0).getEmailAddresses().get(0).getAddress());
+				technicalContact.setGivenName(contacts.get(0).getGivenName().getName());
+				technicalContact.setSurName(contacts.get(0).getSurName().getName());
+				technicalContact.setPhone(contacts.get(0).getTelephoneNumbers().get(0).getNumber());
+				mcp.setTechnicalContact(technicalContact );			
+				
+			}
+			
+			if (pvpOrganisation != null) {
+	        	mcp.setNodeUrl(pvpOrganisation.getURLs().get(0).getURL().getLocalString());
+	        	mcp.setCountryName("Austria");		        
+	        	technicalContact.setCompany(pvpOrganisation.getDisplayNames().get(0).getName().getLocalString());
+			}
+									
+		} catch (ConfigurationException | NullPointerException e) {
+			Logger.warn("Can not load Organisation or Contact from Configuration", e);
+			
+		}
+		        
+        generator.addSPRole();
+        generator.addIDPRole();
+        
+        metadata = generator.generateMetadata();
+        return metadata;
+    }
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/eIDASAuthenticationRequest.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/eIDASAuthenticationRequest.java
new file mode 100644
index 000000000..9943cc5fb
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/eIDASAuthenticationRequest.java
@@ -0,0 +1,189 @@
+/*******************************************************************************
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ *******************************************************************************/
+package at.gv.egovernment.moa.id.protocols.eidas;
+
+import java.io.StringWriter;
+import java.text.SimpleDateFormat;
+import java.util.Map.Entry;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.velocity.Template;
+import org.apache.velocity.VelocityContext;
+import org.apache.velocity.app.VelocityEngine;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.MediaType;
+import org.springframework.stereotype.Service;
+
+import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
+import at.gv.egovernment.moa.id.auth.frontend.velocity.VelocityProvider;
+import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
+import at.gv.egovernment.moa.id.auth.modules.eidas.engine.MOAeIDASChainingMetadataProvider;
+import at.gv.egovernment.moa.id.auth.modules.eidas.engine.MOAeIDASMetadataProviderDecorator;
+import at.gv.egovernment.moa.id.auth.modules.eidas.utils.MOAPersonalAttributeList;
+import at.gv.egovernment.moa.id.auth.modules.eidas.utils.SAMLEngineUtils;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.data.IAuthData;
+import at.gv.egovernment.moa.id.data.SLOInformationInterface;
+import at.gv.egovernment.moa.id.moduls.IAction;
+import at.gv.egovernment.moa.logging.Logger;
+import eu.eidas.auth.commons.EIDASAuthnResponse;
+import eu.eidas.auth.commons.EIDASStatusCode;
+import eu.eidas.auth.commons.EIDASUtil;
+import eu.eidas.auth.commons.PersonalAttribute;
+import eu.eidas.auth.engine.EIDASSAMLEngine;
+import eu.eidas.auth.engine.metadata.MetadataUtil;
+
+
+/**
+ * Second request step - after authentication of the user is done and moasession obtained,
+ * process request and forward the user further to PEPS and/or other entities
+ *
+ * @author tlenz
+ */
+
+@Service("eIDASAuthenticationRequest")
+public class eIDASAuthenticationRequest implements IAction {
+
+	@Autowired protected MOAReversionLogger revisionsLogger;
+	
+	@Override
+	public SLOInformationInterface processRequest(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp, IAuthData authData) throws MOAIDException {
+		EIDASData eidasRequest;
+		if(req instanceof EIDASData)
+			eidasRequest = (EIDASData) req;
+		else
+			throw new MOAIDException("got wrong IRequest type. is: {}, should be: {}", new String[] {req.getClass().toString(), EIDASData.class.toString()});
+		
+		
+		// gather attributes
+		MOAPersonalAttributeList resultingAttributeList = (MOAPersonalAttributeList) eidasRequest.getEidasRequestedAttributes().clone();
+		
+		for(Entry<String, PersonalAttribute> current : resultingAttributeList.entrySet()) {
+			String newValue = "";
+			
+			// TODO make use of proper builder
+			switch(current.getKey()) {
+			case Constants.eIDAS_ATTR_DATEOFBIRTH: newValue = new SimpleDateFormat("YYYY-MM-dd").format(authData.getDateOfBirth()); break;
+			case Constants.eIDAS_ATTR_CURRENTFAMILYNAME: newValue = authData.getFamilyName();break;
+			case Constants.eIDAS_ATTR_CURRENTGIVENNAME: newValue = authData.getGivenName();break;
+			
+			//TODO: change bPK builder !!!!!!
+			case Constants.eIDAS_ATTR_PERSONALIDENTIFIER: newValue = authData.getBPK(); break;
+			}
+			
+			if("".equals(newValue))
+				current.getValue().setStatus(EIDASStatusCode.STATUS_NOT_AVAILABLE.toString());
+			else {
+				current.getValue().getValue().clear();
+				current.getValue().getValue().add(newValue);
+				current.getValue().setStatus(EIDASStatusCode.STATUS_AVAILABLE.toString());
+			}
+		}
+		
+		// construct eIDaS response
+		EIDASAuthnResponse response = new EIDASAuthnResponse();
+		response.setPersonalAttributeList(resultingAttributeList);
+		
+		// - create metadata url
+        String pubURLPrefix = req.getAuthURL();
+        String metadata_url = pubURLPrefix + Constants.eIDAS_HTTP_ENDPOINT_METADATA;
+		response.setIssuer(metadata_url);
+
+		response.setAssuranceLevel(authData.getEIDASQAALevel());
+		
+		String token = null;
+		try {
+			EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine();
+			
+			// encryption is done by the SamlEngine, i.e. by the module we provide in the config
+			// but we need to set the appropriate request issuer
+			engine.setRequestIssuer(eidasRequest.getEidasRequest().getIssuer());
+
+
+			if(null == eidasRequest.getEidasRequest().getAssertionConsumerServiceURL()) {
+				String assertionConsumerUrl = MetadataUtil.getAssertionUrlFromMetadata(
+						new MOAeIDASMetadataProviderDecorator(MOAeIDASChainingMetadataProvider.getInstance()), 
+						engine, 
+						eidasRequest.getEidasRequest());
+				eidasRequest.getEidasRequest().setAssertionConsumerServiceURL(assertionConsumerUrl);
+				
+			}
+			
+			response = engine.generateEIDASAuthnResponse(eidasRequest.getEidasRequest(), response, eidasRequest.getRemoteAddress(), true);
+
+			
+			token = EIDASUtil.encodeSAMLToken(response.getTokenSaml());
+			
+		} catch(Exception e) {
+			e.printStackTrace();
+		}
+		
+		revisionsLogger.logEvent(req, Constants.eIDAS_REVERSIONSLOG_IDP_AUTHREQUEST);
+		
+		// send the response
+        try {
+            VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
+            Template template = velocityEngine.getTemplate("/resources/templates/stork2_postbinding_template.html");
+            VelocityContext context = new VelocityContext();
+
+            context.put("RelayState", eidasRequest.getRemoteRelayState());
+
+            context.put("SAMLResponse", token);
+            Logger.debug("SAMLResponse original: " + token);
+
+            Logger.debug("Putting assertion consumer url as action: " + eidasRequest.getEidasRequest().getAssertionConsumerServiceURL());
+            context.put("action", eidasRequest.getEidasRequest().getAssertionConsumerServiceURL());
+            Logger.trace("Starting template merge");
+            StringWriter writer = new StringWriter();
+
+            Logger.trace("Doing template merge");
+            template.merge(context, writer);
+            Logger.trace("Template merge done");
+
+            Logger.trace("Sending html content  : " + new String(writer.getBuffer()));
+
+            httpResp.getOutputStream().write(writer.getBuffer().toString().getBytes("UTF-8"));
+            httpResp.setContentType(MediaType.TEXT_HTML.getType());
+
+        } catch (Exception e) {
+            Logger.error("Velocity error: " + e.getMessage());
+        }
+		
+		return null;
+	}
+
+	@Override
+	public boolean needAuthentication(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp) {
+		return true;
+	}
+
+	@Override
+	public String getDefaultActionName() {		
+		return "eIDAS_AuthnRequest";
+	}
+
+
+}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider b/id/server/modules/moa-id-module-eIDAS/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider
new file mode 100644
index 000000000..cd2416a91
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider
@@ -0,0 +1 @@
+at.gv.egovernment.moa.id.auth.modules.eidas.eIDASAuthenticationSpringResourceProvider
\ No newline at end of file
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/resources/at/gv/egovernment/moa/id/auth/modules/eidas/eIDAS.Authentication.process.xml b/id/server/modules/moa-id-module-eIDAS/src/main/resources/at/gv/egovernment/moa/id/auth/modules/eidas/eIDAS.Authentication.process.xml
new file mode 100644
index 000000000..4ff64e76d
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/resources/at/gv/egovernment/moa/id/auth/modules/eidas/eIDAS.Authentication.process.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<pd:ProcessDefinition id="eIDASAuthentication" xmlns:pd="http://reference.e-government.gv.at/namespace/moa/process/definition/v1">
+
+
+	<pd:Task id="createAuthnRequest" class="GenerateAuthnRequestTask" />
+	<pd:Task id="receiveAuthnResponse" class="ReceiveAuthnResponseTask" async="true" />
+	<pd:Task id="finalizeAuthentication" class="FinalizeAuthenticationTask" />
+	<pd:Task id="generateIdentityLink" class="CreateIdentityLinkTask" />
+
+	<pd:StartEvent id="start" />	
+	<pd:Transition from="start" to="createAuthnRequest" />	
+	<pd:Transition from="createAuthnRequest" to="receiveAuthnResponse" />
+	<pd:Transition from="receiveAuthnResponse" to="generateIdentityLink" />
+	<pd:Transition from="generateIdentityLink" to="finalizeAuthentication" />		
+	<pd:Transition from="finalizeAuthentication"    to="end" />	
+	<pd:EndEvent id="end" />
+
+</pd:ProcessDefinition>
diff --git a/id/server/modules/module-stork/src/main/resources/at/gv/egovernment/moa/id/auth/modules/stork/STORK.authmodule.beans.xml b/id/server/modules/moa-id-module-eIDAS/src/main/resources/at/gv/egovernment/moa/id/auth/modules/eidas/eIDAS.authmodule.beans.xml
index 2e924bdd0..0e1b60fe7 100644
--- a/id/server/modules/module-stork/src/main/resources/at/gv/egovernment/moa/id/auth/modules/stork/STORK.authmodule.beans.xml
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/resources/at/gv/egovernment/moa/id/auth/modules/eidas/eIDAS.authmodule.beans.xml
@@ -1,14 +1,14 @@
-<?xml version="1.0" encoding="UTF-8"?>

-<beans xmlns="http://www.springframework.org/schema/beans"

-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

-	xmlns:context="http://www.springframework.org/schema/context"

+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:context="http://www.springframework.org/schema/context"
 	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">

-

-	<context:annotation-config />

-

-	<bean id="storkAuthModule" class="at.gv.egovernment.moa.id.auth.modules.stork.STORKAuthModuleImpl">

-		<property name="priority" value="0" />

-	</bean>

-

-</beans>

+		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">
+
+	<context:annotation-config />
+
+	<bean id="eIDASAuthModule" class="at.gv.egovernment.moa.id.auth.modules.eidas.eIDASAuthenticationModulImpl">
+		<property name="priority" value="1" />
+	</bean>
+
+</beans>
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/resources/moaid_eidas_auth.beans.xml b/id/server/modules/moa-id-module-eIDAS/src/main/resources/moaid_eidas_auth.beans.xml
new file mode 100644
index 000000000..5d79d082a
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/resources/moaid_eidas_auth.beans.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xmlns:tx="http://www.springframework.org/schema/tx"
+	xmlns:aop="http://www.springframework.org/schema/aop"
+	xsi:schemaLocation="http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.1.xsd
+		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd
+		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd">
+ 
+	<bean id="eIDASSignalServlet"
+				class="at.gv.egovernment.moa.id.auth.modules.eidas.eIDASSignalServlet"/>
+
+	<bean id="EIDASProtocol"
+				class="at.gv.egovernment.moa.id.protocols.eidas.EIDASProtocol"/>
+							
+<!-- Authentication Process Tasks -->
+	<bean id="GenerateAuthnRequestTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.eidas.tasks.GenerateAuthnRequestTask"
+				scope="prototype"/>
+	
+	<bean id="ReceiveAuthnResponseTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.eidas.tasks.ReceiveAuthnResponseTask"
+				scope="prototype"/>
+				
+	<bean id="CreateIdentityLinkTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.eidas.tasks.CreateIdentityLinkTask"
+				scope="prototype"/>
+																						
+</beans>
\ No newline at end of file
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/resources/resources/templates/eidas_postbinding_template.vm b/id/server/modules/moa-id-module-eIDAS/src/main/resources/resources/templates/eidas_postbinding_template.vm
new file mode 100644
index 000000000..3bd225b00
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/resources/resources/templates/eidas_postbinding_template.vm
@@ -0,0 +1,41 @@
+##
+## Velocity Template for SAML 2 HTTP-POST binding
+##
+## Velocity context may contain the following properties
+## action - String - the action URL for the form
+## RelayState - String - the relay state for the message
+## SAMLRequest - String - the Base64 encoded SAML Request
+## SAMLResponse - String - the Base64 encoded SAML Response
+## Contains target attribute to delegate PEPS authentication out of iFrame
+
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+		<head>
+			<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
+		</head>
+
+    <body onload="document.forms[0].submit()">
+        <noscript>
+            <p>
+                <strong>Note:</strong> Since your browser does not support JavaScript,
+                you must press the Continue button once to proceed.
+            </p>
+        </noscript>
+        
+        <form action="${action}" method="post" target="_top">
+            <div>
+                #if($RelayState)<input type="hidden" name="RelayState" value="${RelayState}"/>#end
+                
+                #if($SAMLRequest)<input type="hidden" name="SAMLRequest" value="${SAMLRequest}"/>#end
+                
+                #if($SAMLResponse)<input type="hidden" name="SAMLResponse" value="${SAMLResponse}"/>#end
+                
+            </div>
+            <noscript>
+                <div>
+                    <input type="submit" value="Continue"/>
+                </div>
+            </noscript>
+        </form>
+        
+    </body>
+</html>
\ No newline at end of file
diff --git a/id/server/modules/module-stork/src/main/resources/resources/xmldata/fakeIdL_IdL_template.xml b/id/server/modules/moa-id-module-eIDAS/src/main/resources/resources/xmldata/fakeIdL_IdL_template.xml
index 09084a34f..09084a34f 100644
--- a/id/server/modules/module-stork/src/main/resources/resources/xmldata/fakeIdL_IdL_template.xml
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/resources/resources/xmldata/fakeIdL_IdL_template.xml
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/.gitignore b/id/server/modules/moa-id-module-elga_mandate_service/.gitignore
new file mode 100644
index 000000000..b83d22266
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/.gitignore
@@ -0,0 +1 @@
+/target/
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/pom.xml b/id/server/modules/moa-id-module-elga_mandate_service/pom.xml
new file mode 100644
index 000000000..3b5d1ba66
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/pom.xml
@@ -0,0 +1,47 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>MOA.id.server.modules</groupId>
+    <artifactId>moa-id-modules</artifactId>
+    <version>${moa-id-version}</version>
+  </parent>
+  <artifactId>moa-id-module-elga_mandate_service</artifactId>
+  <version>${moa-id-module-elga_mandate_client}</version>
+  <name>ELGA mandate-service client</name>
+  <description>This authentication module implements a 
+  	client to integrate ELGA mandates in the MOA-ID identification and authentication process. 
+  </description>
+  <organization>
+  	<name>EGIZ</name>
+  	<url>https://www.egiz.gv.at</url>
+  </organization>
+  <developers>
+  	<developer>
+  		<name>Thomas Lenz</name>
+  		<organization>EGIZ</organization>
+  		<email>thomas.lenz@egiz.gv.at</email>
+  	</developer>
+  </developers>
+  
+ 	<properties>
+		<repositoryPath>${basedir}/../../../../repository</repositoryPath>
+	</properties>
+  
+  	<dependencies>
+  	  	<dependency>
+  					<groupId>MOA.id.server</groupId>
+  					<artifactId>moa-id-lib</artifactId>
+  			</dependency>
+  			
+  			<dependency>
+  				<groupId>MOA.id.server.modules</groupId>
+  				<artifactId>moa-id-modul-citizencard_authentication</artifactId>
+  				<exclusions>
+  					<exclusion>
+  						<groupId>*</groupId>
+  					</exclusion>
+  				</exclusions>
+  			</dependency>
+  	</dependencies>
+  
+</project>
\ No newline at end of file
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/ELGAMandatesAuthConstants.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/ELGAMandatesAuthConstants.java
new file mode 100644
index 000000000..7ca4590bb
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/ELGAMandatesAuthConstants.java
@@ -0,0 +1,116 @@
+package at.gv.egovernment.moa.id.auth.modules.elgamandates;
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import at.gv.egovernment.moa.id.data.Pair;
+import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
+
+/**
+ * @author tlenz
+ *
+ */
+public class ELGAMandatesAuthConstants {
+
+	public static final String MODULE_NAME_FOR_LOGGING = "ELGA Mandate-Service";
+	
+	public static final int METADATA_VALIDUNTIL_IN_HOURS = 24; 
+	
+	//Service endpoint definitions
+	public static final String ENDPOINT_POST = "/sp/elga_mandate/post";
+	public static final String ENDPOINT_REDIRECT = "/sp/elga_mandate/redirect";
+	public static final String ENDPOINT_METADATA = "/sp/elga_mandate/metadata";
+
+	public static final String TEMPLATE_MANDATE_SERVICE_SELECTION = "/mandate-service-selection.html";
+	
+	//configuration properties
+	public static final String CONFIG_PROPS_PREFIX = "modules.elga_mandate.";
+	
+	public static final String CONFIG_PROPS_SUBJECTNAMEID_TARGET = CONFIG_PROPS_PREFIX + "nameID.target";
+	
+	public static final String CONFIG_PROPS_ENTITYID = CONFIG_PROPS_PREFIX + "service.entityID";
+	public static final String CONFIG_PROPS_METADATAURL = CONFIG_PROPS_PREFIX + "service.metadataurl";
+	public static final String CONFIG_PROPS_METADATA_TRUSTPROFILE = CONFIG_PROPS_PREFIX + "service.metadata.trustprofileID";
+	public static final String CONFIG_PROPS_ALLOWED_MANDATE_TYPES = CONFIG_PROPS_PREFIX + "service.mandateprofiles";
+	
+	public static final String CONFIG_PROPS_KEYSTORE = CONFIG_PROPS_PREFIX + "keystore.path";
+	public static final String CONFIG_PROPS_KEYSTOREPASSWORD = CONFIG_PROPS_PREFIX + "keystore.password";
+	public static final String CONFIG_PROPS_SIGN_METADATA_KEY_PASSWORD = CONFIG_PROPS_PREFIX + "metadata.sign.password";
+	public static final String CONFIG_PROPS_SIGN_METADATA_ALIAS_PASSWORD = CONFIG_PROPS_PREFIX + "metadata.sign.alias";
+	public static final String CONFIG_PROPS_SIGN_SIGNING_KEY_PASSWORD = CONFIG_PROPS_PREFIX + "request.sign.password";
+	public static final String CONFIG_PROPS_SIGN_SIGNING_ALIAS_PASSWORD = CONFIG_PROPS_PREFIX + "request.sign.alias";
+	public static final String CONFIG_PROPS_ENCRYPTION_KEY_PASSWORD = CONFIG_PROPS_PREFIX + "response.encryption.password";
+	public static final String CONFIG_PROPS_ENCRYPTION_ALIAS_PASSWORD = CONFIG_PROPS_PREFIX + "response.encryption.alias";
+	
+	
+	/** 
+	 * 
+	 * Get required PVP attributes
+	 * First : PVP attribute name (OID) 
+	 * Second: FriendlyName
+	 * 
+	 */
+	public static final List<Pair<String, String>> REQUIRED_PVP_ATTRIBUTES = 
+			Collections.unmodifiableList(new ArrayList<Pair<String, String>>() {
+				private static final long serialVersionUID = 1L;
+				{	
+					//add PVP Version attribute
+					add(Pair.newInstance(PVPConstants.PVP_VERSION_NAME, PVPConstants.PVP_VERSION_FRIENDLY_NAME));
+					
+					//request mandate type					
+					add(Pair.newInstance(PVPConstants.MANDATE_TYPE_NAME, PVPConstants.MANDATE_TYPE_FRIENDLY_NAME));
+					
+					//request attributes for natural mandators  
+					add(Pair.newInstance(PVPConstants.MANDATE_NAT_PER_BPK_NAME, PVPConstants.MANDATE_NAT_PER_BPK_FRIENDLY_NAME));
+					add(Pair.newInstance(PVPConstants.MANDATE_NAT_PER_BIRTHDATE_NAME, PVPConstants.MANDATE_NAT_PER_BIRTHDATE_FRIENDLY_NAME));
+					add(Pair.newInstance(PVPConstants.MANDATE_NAT_PER_FAMILY_NAME_NAME, PVPConstants.MANDATE_NAT_PER_FAMILY_NAME_FRIENDLY_NAME));
+					add(Pair.newInstance(PVPConstants.MANDATE_NAT_PER_GIVEN_NAME_NAME, PVPConstants.MANDATE_NAT_PER_GIVEN_NAME_FRIENDLY_NAME));
+					
+					//request reference_value
+					add(Pair.newInstance(PVPConstants.MANDATE_REFERENCE_VALUE_NAME, PVPConstants.MANDATE_REFERENCE_VALUE_FRIENDLY_NAME));
+				}
+			});
+	
+	
+	public static final String CONFIG_DEFAULT_QAA_STORK_LEVEL = "http://www.stork.gov.eu/1.0/citizenQAALevel/4";
+	public static final String CONFIG_DEFAULT_QAA_SECCLASS_LEVEL = "http://www.ref.gv.at/ns/names/agiz/pvp/secclass/0-3";
+
+	public static final String SUBJECTCONFORMATIONDATE_ELEMENT_NAMESPACE = "rc";
+	public static final String SUBJECTCONFORMATIONDATE_ELEMENT_NAMESPACE_URI = "http://egiz.gv.at/namespace/subjectconformationdate/elga";
+	public static final String SUBJECTCONFORMATIONDATE_ELEMENT_ROOT = SUBJECTCONFORMATIONDATE_ELEMENT_NAMESPACE + ":Representative";
+	public static final String SUBJECTCONFORMATIONDATE_ELEMENT_FAMILYNAME = SUBJECTCONFORMATIONDATE_ELEMENT_NAMESPACE + ":FamilyName";
+	public static final String SUBJECTCONFORMATIONDATE_ELEMENT_GIVENNAME = SUBJECTCONFORMATIONDATE_ELEMENT_NAMESPACE + ":GivenName";
+	public static final String SUBJECTCONFORMATIONDATE_ELEMENT_DATEOFBIRTH = SUBJECTCONFORMATIONDATE_ELEMENT_NAMESPACE + ":DateOfBirth";
+
+	public static List<String> getRequiredAttributeNames() {
+		List<String> list = new ArrayList<String>();
+		for (Pair<String, String> el : REQUIRED_PVP_ATTRIBUTES)
+			list.add(el.getFirst());
+		return list;
+	}
+	
+	
+}
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/ELGAMandatesAuthModuleImpl.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/ELGAMandatesAuthModuleImpl.java
new file mode 100644
index 000000000..c2efe5bfc
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/ELGAMandatesAuthModuleImpl.java
@@ -0,0 +1,86 @@
+package at.gv.egovernment.moa.id.auth.modules.elgamandates;
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+import org.springframework.beans.factory.annotation.Autowired;
+
+import at.gv.egovernment.moa.id.auth.modules.internal.DefaultCitizenCardAuthModuleImpl;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+import at.gv.egovernment.moa.util.MiscUtil;
+
+/**
+ * This authentication module extens the default citizen  
+ * 
+ * @author tlenz
+ *
+ */
+public class ELGAMandatesAuthModuleImpl extends DefaultCitizenCardAuthModuleImpl {
+
+	@Autowired private AuthConfiguration authConfig; 
+	
+	private int priority = 0;
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.AuthModule#getPriority()
+	 */
+	@Override
+	public int getPriority() {
+		return priority;
+	}
+	
+	@Override
+	public String selectProcess(ExecutionContext context) {
+		String selectedProcessID = super.selectProcess(context);
+	
+		//check if BKU authentication is selected and ELGA-MandateService is configurated
+		if (MiscUtil.isNotEmpty(selectedProcessID)) {
+			if (MiscUtil.isNotEmpty(authConfig.getBasicMOAIDConfiguration(
+					ELGAMandatesAuthConstants.CONFIG_PROPS_ENTITYID)))
+				return "DefaultAuthenticationWithELGAMandates";
+			
+		}
+		
+		return selectedProcessID;
+		
+	}
+		
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.AuthModule#getProcessDefinitions()
+	 */
+	@Override
+	public String[] getProcessDefinitions() {
+		return new String[] { "classpath:at/gv/egovernment/moa/id/auth/modules/elgamandates/DefaultAuth_with_ELGA_mandates.process.xml" };
+	}
+
+	/**
+	 * @param priority the priority to set
+	 */
+	public void setPriority(int priority) {
+		this.priority = priority;
+		
+	}
+
+	
+}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/SimpleNamespaceContext.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/ELGAMandatesSpringResourceProvider.java
index 2c2df3e54..649e8e5f5 100644
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/SimpleNamespaceContext.java
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/ELGAMandatesSpringResourceProvider.java
@@ -1,3 +1,4 @@
+package at.gv.egovernment.moa.id.auth.modules.elgamandates;
 /*
  * Copyright 2014 Federal Chancellery Austria
  * MOA-ID has been developed in a cooperation between BRZ, the Federal
@@ -20,64 +21,44 @@
  * The "NOTICE" text file is part of the distribution. Any derivative works
  * that you distribute must include a readable copy of the "NOTICE" text file.
  */
-package at.gv.egovernment.moa.id.protocols.stork2;
 
-import java.util.HashMap;
-import java.util.Iterator;
-import java.util.Map.Entry;
-import java.util.Set;
 
-import javax.xml.namespace.NamespaceContext;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
+
+import at.gv.egiz.components.spring.api.SpringResourceProvider;
 
 /**
  * @author tlenz
  *
  */
-public class SimpleNamespaceContext implements NamespaceContext {
-
-	HashMap<String, String> prefMap = null;	
-	/**
-	 * @param prefMap
-	 */
-	 SimpleNamespaceContext(HashMap<String, String> prefMap) {
-		 this.prefMap = prefMap;
-	}
+public class ELGAMandatesSpringResourceProvider implements SpringResourceProvider {
 
 	/* (non-Javadoc)
-	 * @see javax.xml.namespace.NamespaceContext#getNamespaceURI(java.lang.String)
+	 * @see at.gv.egiz.components.spring.api.SpringResourceProvider#getResourcesToLoad()
 	 */
 	@Override
-	public String getNamespaceURI(String prefix) {
-		if (prefMap.containsKey(prefix))
-			return prefMap.get(prefix);		
-		else
-			return null;
+	public Resource[] getResourcesToLoad() {
+		ClassPathResource elgaAuthConfig = new ClassPathResource("/moaid_elga_mandate_client_auth.beans.xml", ELGAMandatesSpringResourceProvider.class);					
+		
+		return new Resource[] {elgaAuthConfig};
 	}
 
 	/* (non-Javadoc)
-	 * @see javax.xml.namespace.NamespaceContext#getPrefix(java.lang.String)
+	 * @see at.gv.egiz.components.spring.api.SpringResourceProvider#getPackagesToScan()
 	 */
 	@Override
-	public String getPrefix(String namespaceURI) {
-		if (prefMap.containsValue(namespaceURI)) {
-			Set<Entry<String, String>> set = prefMap.entrySet();
-			for (Entry<String, String> el : set) {
-				if (el.getValue().equals(namespaceURI))
-					return el.getKey();
-				
-			}			
-		}
-		
+	public String[] getPackagesToScan() {
+		// TODO Auto-generated method stub
 		return null;
 	}
 
 	/* (non-Javadoc)
-	 * @see javax.xml.namespace.NamespaceContext#getPrefixes(java.lang.String)
+	 * @see at.gv.egiz.components.spring.api.SpringResourceProvider#getName()
 	 */
 	@Override
-	public Iterator getPrefixes(String namespaceURI) {
-		// TODO Auto-generated method stub
-		return null;
+	public String getName() {
+		return "MOA-ID Auth-module 'ELGA Mandate-Client'";
 	}
 
 }
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/config/ELGAMandatesMetadataConfiguration.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/config/ELGAMandatesMetadataConfiguration.java
new file mode 100644
index 000000000..5743590f9
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/config/ELGAMandatesMetadataConfiguration.java
@@ -0,0 +1,313 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.elgamandates.config;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import org.opensaml.saml2.core.Attribute;
+import org.opensaml.saml2.core.NameIDType;
+import org.opensaml.saml2.metadata.ContactPerson;
+import org.opensaml.saml2.metadata.Organization;
+import org.opensaml.saml2.metadata.RequestedAttribute;
+import org.opensaml.xml.security.credential.Credential;
+
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.ELGAMandatesAuthConstants;
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.utils.ELGAMandatesCredentialProvider;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
+import at.gv.egovernment.moa.id.data.Pair;
+import at.gv.egovernment.moa.id.protocols.pvp2x.builder.PVPAttributeBuilder;
+import at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPMetadataBuilderConfiguration;
+import at.gv.egovernment.moa.id.protocols.pvp2x.config.PVPConfiguration;
+import at.gv.egovernment.moa.id.protocols.pvp2x.signer.CredentialsNotAvailableException;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+public class ELGAMandatesMetadataConfiguration implements IPVPMetadataBuilderConfiguration {
+	
+	private String authURL;
+	private ELGAMandatesCredentialProvider credentialProvider;
+	
+	public ELGAMandatesMetadataConfiguration(String authURL, ELGAMandatesCredentialProvider credentialProvider) {
+		this.authURL = authURL;
+		this.credentialProvider = credentialProvider;
+				
+	}
+	
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getMetadataValidUntil()
+	 */
+	@Override
+	public int getMetadataValidUntil() {
+		return ELGAMandatesAuthConstants.METADATA_VALIDUNTIL_IN_HOURS;
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#buildEntitiesDescriptorAsRootElement()
+	 */
+	@Override
+	public boolean buildEntitiesDescriptorAsRootElement() {
+		return false;
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#buildIDPSSODescriptor()
+	 */
+	@Override
+	public boolean buildIDPSSODescriptor() {
+		return false;
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#buildSPSSODescriptor()
+	 */
+	@Override
+	public boolean buildSPSSODescriptor() {
+		return true;
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getEntityIDPostfix()
+	 */
+	@Override
+	public String getEntityID() {
+		return authURL + ELGAMandatesAuthConstants.ENDPOINT_METADATA;
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getEntityFriendlyName()
+	 */
+	@Override
+	public String getEntityFriendlyName() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getContactPersonInformation()
+	 */
+	@Override
+	public List<ContactPerson> getContactPersonInformation() {
+		try {
+			return PVPConfiguration.getInstance().getIDPContacts();
+			
+		} catch (ConfigurationException e) {
+			Logger.warn("Can not load Metadata entry: Contect Person", e);
+			return null;
+			
+		}
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getOrgansiationInformation()
+	 */
+	@Override
+	public Organization getOrgansiationInformation() {
+		try {
+			return PVPConfiguration.getInstance().getIDPOrganisation();
+			
+		} catch (ConfigurationException e) {
+			Logger.warn("Can not load Metadata entry: Organisation", e);
+			return null;
+			
+		}
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getMetadataSigningCredentials()
+	 */
+	@Override
+	public Credential getMetadataSigningCredentials() throws CredentialsNotAvailableException {
+		return credentialProvider.getIDPMetaDataSigningCredential();
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getRequestorResponseSigningCredentials()
+	 */
+	@Override
+	public Credential getRequestorResponseSigningCredentials() throws CredentialsNotAvailableException {
+		return credentialProvider.getIDPAssertionSigningCredential();
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getEncryptionCredentials()
+	 */
+	@Override
+	public Credential getEncryptionCredentials() throws CredentialsNotAvailableException {
+		return credentialProvider.getIDPAssertionEncryptionCredential();
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getIDPWebSSOPostBindingURL()
+	 */
+	@Override
+	public String getIDPWebSSOPostBindingURL() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getIDPWebSSORedirectBindingURL()
+	 */
+	@Override
+	public String getIDPWebSSORedirectBindingURL() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getIDPSLOPostBindingURL()
+	 */
+	@Override
+	public String getIDPSLOPostBindingURL() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getIDPSLORedirectBindingURL()
+	 */
+	@Override
+	public String getIDPSLORedirectBindingURL() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getSPAssertionConsumerServicePostBindingURL()
+	 */
+	@Override
+	public String getSPAssertionConsumerServicePostBindingURL() {
+		return authURL + ELGAMandatesAuthConstants.ENDPOINT_POST;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getSPAssertionConsumerServiceRedirectBindingURL()
+	 */
+	@Override
+	public String getSPAssertionConsumerServiceRedirectBindingURL() {
+		return authURL + ELGAMandatesAuthConstants.ENDPOINT_REDIRECT;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getSPSLOPostBindingURL()
+	 */
+	@Override
+	public String getSPSLOPostBindingURL() {
+		//return authURL + ELGAMandatesAuthConstants.ENDPOINT_POST;
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getSPSLORedirectBindingURL()
+	 */
+	@Override
+	public String getSPSLORedirectBindingURL() {
+		//return authURL + ELGAMandatesAuthConstants.ENDPOINT_REDIRECT;
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getSPSLOSOAPBindingURL()
+	 */
+	@Override
+	public String getSPSLOSOAPBindingURL() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getIDPPossibleAttributes()
+	 */
+	@Override
+	public List<Attribute> getIDPPossibleAttributes() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getIDPPossibleNameITTypes()
+	 */
+	@Override
+	public List<String> getIDPPossibleNameITTypes() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getSPRequiredAttributes()
+	 */
+	@Override
+	public List<RequestedAttribute> getSPRequiredAttributes() {
+		List<RequestedAttribute> requestedAttributes = new ArrayList<RequestedAttribute>();
+
+		for (Pair<String, String> el : ELGAMandatesAuthConstants.REQUIRED_PVP_ATTRIBUTES)
+			requestedAttributes.add(PVPAttributeBuilder.buildReqAttribute(el.getFirst(), el.getSecond(), true));	
+					
+		return requestedAttributes;
+	}
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getSPAllowedNameITTypes()
+	 */
+	@Override
+	public List<String> getSPAllowedNameITTypes() {
+		return Arrays.asList(NameIDType.PERSISTENT);
+		
+	}
+
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPMetadataBuilderConfiguration#getSPNameForLogging()
+	 */
+	@Override
+	public String getSPNameForLogging() {
+		return ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING;
+	}
+
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPMetadataBuilderConfiguration#wantAssertionSigned()
+	 */
+	@Override
+	public boolean wantAssertionSigned() {
+		return true;
+		
+	}
+
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPMetadataBuilderConfiguration#wantAuthnRequestSigned()
+	 */
+	@Override
+	public boolean wantAuthnRequestSigned() {
+		return true;
+		
+	}
+}
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/config/ELGAMandatesRequestBuilderConfiguration.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/config/ELGAMandatesRequestBuilderConfiguration.java
new file mode 100644
index 000000000..b67d263fc
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/config/ELGAMandatesRequestBuilderConfiguration.java
@@ -0,0 +1,303 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.elgamandates.config;
+
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+
+import org.opensaml.Configuration;
+import org.opensaml.saml2.core.AuthnContextComparisonTypeEnumeration;
+import org.opensaml.saml2.core.NameID;
+import org.opensaml.saml2.core.SubjectConfirmation;
+import org.opensaml.saml2.core.SubjectConfirmationData;
+import org.opensaml.saml2.metadata.EntityDescriptor;
+import org.opensaml.xml.io.Marshaller;
+import org.opensaml.xml.io.MarshallingException;
+import org.opensaml.xml.security.credential.Credential;
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.ELGAMandatesAuthConstants;
+import at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation;
+import at.gv.egovernment.moa.id.protocols.pvp2x.utils.SAML2Utils;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+public class ELGAMandatesRequestBuilderConfiguration implements IPVPAuthnRequestBuilderConfiguruation {
+
+	private boolean isPassive = false;
+	private String SPEntityID = null;
+	private String QAA_Level = null;
+	private EntityDescriptor idpEntity = null;
+	private Credential signCred = null;
+	private String subjectNameID = null;
+	private String subjectNameIDQualifier = null;
+	private String requestID = null;
+	private Element subjectConformationDate = null;
+	
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#isPassivRequest()
+	 */
+	@Override
+	public Boolean isPassivRequest() {
+		return this.isPassive;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getAssertionConsumerServiceId()
+	 */
+	@Override
+	public Integer getAssertionConsumerServiceId() {
+		return 0;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getEntityID()
+	 */
+	@Override
+	public String getSPEntityID() {
+		return this.SPEntityID;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getNameIDPolicy()
+	 */
+	@Override
+	public String getNameIDPolicyFormat() {
+		return NameID.PERSISTENT;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getNameIDPolicy()
+	 */
+	@Override
+	public boolean getNameIDPolicyAllowCreation() {
+		return false;
+	}
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getAuthnContextClassRef()
+	 */
+	@Override
+	public String getAuthnContextClassRef() {
+		return this.QAA_Level;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getAuthnContextComparison()
+	 */
+	@Override
+	public AuthnContextComparisonTypeEnumeration getAuthnContextComparison() {
+		return AuthnContextComparisonTypeEnumeration.MINIMUM;
+	}
+
+	/**
+	 * @param isPassive the isPassive to set
+	 */
+	public void setPassive(boolean isPassive) {
+		this.isPassive = isPassive;
+	}
+
+	/**
+	 * @param sPEntityID the sPEntityID to set
+	 */
+	public void setSPEntityID(String sPEntityID) {
+		SPEntityID = sPEntityID;
+	}
+
+	/**
+	 * @param qAA_Level the qAA_Level to set
+	 */
+	public void setQAA_Level(String qAA_Level) {
+		QAA_Level = qAA_Level;
+	}
+
+	/**
+	 * @param idpEntity the idpEntity to set
+	 */
+	public void setIdpEntity(EntityDescriptor idpEntity) {
+		this.idpEntity = idpEntity;
+	}
+
+	/**
+	 * @param signCred the signCred to set
+	 */
+	public void setSignCred(Credential signCred) {
+		this.signCred = signCred;
+	}
+
+		
+	/**
+	 * @param subjectNameID the subjectNameID to set
+	 */
+	public void setSubjectNameID(String subjectNameID) {
+		this.subjectNameID = subjectNameID;
+	}
+
+	
+	
+	/**
+	 * @param requestID the requestID to set
+	 */
+	public void setRequestID(String requestID) {
+		this.requestID = requestID;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getAuthnRequestSigningCredential()
+	 */
+	@Override
+	public Credential getAuthnRequestSigningCredential() {
+		return this.signCred;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getIDPEntityDescriptor()
+	 */
+	@Override
+	public EntityDescriptor getIDPEntityDescriptor() {
+		return this.idpEntity;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getSubjectNameID()
+	 */
+	@Override
+	public String getSubjectNameID() {
+		return this.subjectNameID;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getSPNameForLogging()
+	 */
+	@Override
+	public String getSPNameForLogging() {
+		return ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getSubjectNameIDFormat()
+	 */
+	@Override
+	public String getSubjectNameIDFormat() {
+		return NameID.PERSISTENT;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getRequestID()
+	 */
+	@Override
+	public String getRequestID() {
+		return this.requestID;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getSubjectNameIDQualifier()
+	 */
+	@Override
+	public String getSubjectNameIDQualifier() {
+		return this.subjectNameIDQualifier;
+	}
+
+	/**
+	 * @param subjectNameIDQualifier the subjectNameIDQualifier to set
+	 */
+	public void setSubjectNameIDQualifier(String subjectNameIDQualifier) {
+		this.subjectNameIDQualifier = subjectNameIDQualifier;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getSubjectConformationMethode()
+	 */
+	@Override
+	public String getSubjectConformationMethode() {
+		return SubjectConfirmation.METHOD_BEARER;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getSubjectConformationDate()
+	 */
+	@Override
+	public Element getSubjectConformationDate() {
+		return subjectConformationDate;
+	}
+
+	/**
+	 * @param subjectConformationDate the subjectConformationDate to set
+	 */
+	public void setSubjectConformationDate(String givenName, String familyName, String dateOfBirth) {
+		try {
+			Logger.trace("Build 'SubjectConfirmationData' for ELGA Mandate-Service request ...");
+			//build empty 'SubjectConfirmationData' element
+			SubjectConfirmationData subjectConformDate = SAML2Utils.createSAMLObject(SubjectConfirmationData.class);					
+			DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+			dbf.setNamespaceAware(true);
+			DocumentBuilder builder = dbf.newDocumentBuilder();			
+			Document doc = builder.newDocument();
+			
+			Marshaller out = Configuration.getMarshallerFactory()
+					.getMarshaller(subjectConformDate);
+			out.marshall(subjectConformDate, doc);
+			
+			//build root element for personal information
+			Element rootDom = doc.createElementNS(
+					ELGAMandatesAuthConstants.SUBJECTCONFORMATIONDATE_ELEMENT_NAMESPACE_URI, 					 
+					ELGAMandatesAuthConstants.SUBJECTCONFORMATIONDATE_ELEMENT_ROOT);
+			rootDom.setPrefix(ELGAMandatesAuthConstants.SUBJECTCONFORMATIONDATE_ELEMENT_NAMESPACE);
+			rootDom.setAttributeNS("http://www.w3.org/2000/xmlns/", 
+					"xmlns:" + ELGAMandatesAuthConstants.SUBJECTCONFORMATIONDATE_ELEMENT_NAMESPACE, 
+					ELGAMandatesAuthConstants.SUBJECTCONFORMATIONDATE_ELEMENT_NAMESPACE_URI);			
+						
+			//build personal information
+			Element familyNameDom = doc.createElement(ELGAMandatesAuthConstants.SUBJECTCONFORMATIONDATE_ELEMENT_FAMILYNAME);
+			Element givenNameDom = doc.createElement(ELGAMandatesAuthConstants.SUBJECTCONFORMATIONDATE_ELEMENT_GIVENNAME);
+			Element dateOfBirthDom = doc.createElement(ELGAMandatesAuthConstants.SUBJECTCONFORMATIONDATE_ELEMENT_DATEOFBIRTH);
+			familyNameDom.setTextContent(familyName);						
+			givenNameDom.setTextContent(givenName);						
+			dateOfBirthDom.setTextContent(dateOfBirth);
+						
+			//add personal information to 'SubjectConfirmationData' element
+			doc.getFirstChild().appendChild(rootDom);
+			rootDom.appendChild(givenNameDom);
+			rootDom.appendChild(familyNameDom);
+			rootDom.appendChild(dateOfBirthDom);
+			
+			this.subjectConformationDate = doc.getDocumentElement();
+			Logger.trace("'SubjectConfirmationData' for ELGA Mandate-Service is complete");
+			
+		} catch (ParserConfigurationException | MarshallingException e) {
+			Logger.error("Can not generate 'SubjectConformationDate' for " 
+					+ ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING);
+			
+		}
+		
+				
+	}
+	
+		
+}
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/controller/ELGAMandateMetadataController.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/controller/ELGAMandateMetadataController.java
new file mode 100644
index 000000000..29bc5ee12
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/controller/ELGAMandateMetadataController.java
@@ -0,0 +1,97 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.elgamandates.controller;
+
+import java.io.IOException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.ELGAMandatesAuthConstants;
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.config.ELGAMandatesMetadataConfiguration;
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.utils.ELGAMandatesCredentialProvider;
+import at.gv.egovernment.moa.id.auth.servlet.AbstractController;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.protocols.pvp2x.builder.PVPMetadataBuilder;
+import at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPMetadataBuilderConfiguration;
+import at.gv.egovernment.moa.id.util.HTTPUtils;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+@Controller
+public class ELGAMandateMetadataController extends AbstractController {
+	
+	@Autowired PVPMetadataBuilder metadatabuilder;
+	@Autowired AuthConfiguration authConfig;
+	@Autowired ELGAMandatesCredentialProvider credentialProvider; 
+	
+	public ELGAMandateMetadataController() {
+		super();
+		Logger.debug("Registering servlet " + getClass().getName() 
+				+ " with mappings '" + ELGAMandatesAuthConstants.ENDPOINT_METADATA 
+				+ "'.");
+		
+	}
+	
+	@RequestMapping(value = "/sp/elga_mandate/metadata", 
+					method = {RequestMethod.GET})
+	public void getSPMetadata(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+		//check PublicURL prefix
+		try {
+			String authURL = HTTPUtils.extractAuthURLFromRequest(req);		
+			if (!authConfig.getPublicURLPrefix().contains(authURL)) {		
+				resp.sendError(HttpServletResponse.SC_FORBIDDEN, "No valid request URL");
+				return;
+				
+			} else {
+				//initialize metadata builder configuration
+				IPVPMetadataBuilderConfiguration metadataConfig = 
+						new ELGAMandatesMetadataConfiguration(authURL, credentialProvider);
+				
+				//build metadata
+				String xmlMetadata = metadatabuilder.buildPVPMetadata(metadataConfig);
+				
+				//write response
+				resp.setContentType("text/xml");
+				resp.getOutputStream().write(xmlMetadata.getBytes("UTF-8"));
+				resp.getOutputStream().close();
+
+			}
+			
+		} catch (Exception e) {
+			Logger.warn("Build federated-authentication PVP metadata FAILED.", e);
+			handleErrorNoRedirect(e, req, resp, false);
+			
+		}
+		
+	}
+		
+}
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/controller/ELGAMandateSignalController.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/controller/ELGAMandateSignalController.java
new file mode 100644
index 000000000..585e72c2f
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/controller/ELGAMandateSignalController.java
@@ -0,0 +1,67 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.elgamandates.controller;
+
+import java.io.IOException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.lang3.StringEscapeUtils;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.ELGAMandatesAuthConstants;
+import at.gv.egovernment.moa.id.auth.servlet.AbstractProcessEngineSignalController;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+@Controller
+public class ELGAMandateSignalController extends AbstractProcessEngineSignalController {
+
+	public ELGAMandateSignalController() {
+		super();
+		Logger.debug("Registering servlet " + getClass().getName() 
+				+ " with mappings '" + ELGAMandatesAuthConstants.ENDPOINT_POST 
+				+ "' and '" + ELGAMandatesAuthConstants.ENDPOINT_REDIRECT + "'.");
+		
+	}
+	
+	@RequestMapping(value = {	"/sp/elga_mandate/post", 
+			 					"/sp/elga_mandate/redirect"
+							}, 
+					method = {RequestMethod.POST, RequestMethod.GET})
+	public void performCitizenCardAuthentication(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+		signalProcessManagement(req, resp);
+		
+	}
+	
+	public String getPendingRequestId(HttpServletRequest request) {
+		return StringEscapeUtils.escapeHtml4(request.getParameter("RelayState"));
+		
+	}
+}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/STORKPVPUtilits.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/exceptions/ELGAMetadataException.java
index 123d32af4..d27353809 100644
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/STORKPVPUtilits.java
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/exceptions/ELGAMetadataException.java
@@ -20,30 +20,30 @@
  * The "NOTICE" text file is part of the distribution. Any derivative works
  * that you distribute must include a readable copy of the "NOTICE" text file.
  */
-package at.gv.egovernment.moa.id.protocols.stork2;
+package at.gv.egovernment.moa.id.auth.modules.elgamandates.exceptions;
 
-import java.util.Arrays;
-import java.util.List;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 
 /**
  * @author tlenz
  *
  */
-public class STORKPVPUtilits {
-	
-	public static final List<String> attributesRequirePVPAuthentication = 
-			Arrays.asList("ECApplicationRole", "MSOrganization");
-	
-	
-	
-	public static boolean performAuthenticationOnNationalIDP(MOASTORKRequest moastorkRequest) {		
-		for (String el : attributesRequirePVPAuthentication) {		
-			if (moastorkRequest.getPersonalAttributeList().containsKey(el)) {
-				return true;
-			
-			}
-		}
-		return false;
+public class ELGAMetadataException extends MOAIDException {
+
+	/**
+	 * 
+	 */
+	private static final long serialVersionUID = 1L;
+
+	/**
+	 * @param messageId
+	 * @param parameters
+	 */
+	public ELGAMetadataException(String messageId, Object[] parameters) {
+		super(messageId, parameters);
+	}
+
+	public ELGAMetadataException(String messageId, Object[] parameters, Throwable e) {
+		super(messageId, parameters, e);
 	}
-	
 }
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/EvaluateMandateServiceTask.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/EvaluateMandateServiceTask.java
new file mode 100644
index 000000000..f05446771
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/EvaluateMandateServiceTask.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.elgamandates.tasks;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.lang.StringEscapeUtils;
+import org.springframework.stereotype.Component;
+
+import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
+import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.ELGAMandatesAuthConstants;
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.utils.ELGAMandateUtils;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.MiscUtil;
+
+/**
+ * @author tlenz
+ *
+ */
+@Component("EvaluateMandateServiceTask")
+public class EvaluateMandateServiceTask extends AbstractAuthServletTask {
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask#execute(at.gv.egovernment.moa.id.process.api.ExecutionContext, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
+	 */
+	@Override
+	public void execute(ExecutionContext executionContext, HttpServletRequest request, HttpServletResponse response)
+			throws TaskExecutionException {
+		try {
+			boolean useMIS = getUserConfermationFromRequest(request, MOAIDAuthConstants.PARAM_USEMISMANDATE);
+			boolean useELGA = getUserConfermationFromRequest(request, MOAIDAuthConstants.PARAM_USEELGAMANDATE);
+			
+			//check if both mandate Services are requested
+			if ( useMIS && useELGA ) {
+				Logger.error("Can not use MIS-MandateService and ELGA-MandateService twince");
+				throw new MOAIDException("validator.73", null);
+				
+			}
+			
+			//select next process step
+			if (useELGA) {
+				//validate service-provider again
+				if (!ELGAMandateUtils.checkServiceProviderAgainstELGAModulConfigration(authConfig, pendingReq)) {
+					Logger.info("Service-Provider: " + pendingReq.getOnlineApplicationConfiguration().getPublicURLPrefix() 
+							+ " does not fulfill requirements to use ELGA-MandateService.");
+					throw new MOAIDException("service.10", new Object[]{
+							ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING,
+							"No valid mandate-profile defined"});
+				
+				}
+				
+				executionContext.put(MOAIDAuthConstants.PARAM_USEELGAMANDATE, useELGA);
+				Logger.debug("ELGA Mandate-Service is selected. Initialize service communication ... ");
+				
+			} else if(useMIS) {
+				executionContext.put(MOAIDAuthConstants.PARAM_USEMISMANDATE, useMIS);
+				Logger.debug("MIS Mandate-Service is selected. Initialize service communication ... ");
+				
+				
+			} else {
+				//mark pending-request as aborted
+				Logger.info("No Mandate-Service is selected. Abort authentication process ... ");
+				pendingReq.setAbortedByUser(true);
+				pendingReq.setAuthenticated(false);
+				
+				//store pending-request
+				requestStoreage.storePendingRequest(pendingReq);
+				
+				//redirect to protocol finalization
+				performRedirectToProtocolFinialization(pendingReq, response);
+				
+			}
+			
+		} catch (MOAIDException e) {
+			Logger.info("Evaluation of Mandate-Service selection FAILED. Reason:" + e.getMessage());
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
+			
+		} catch (Exception e) {
+			Logger.info("Mandate-Service selection evaluation: General Exception. Msg:" + e.getMessage());
+			throw new TaskExecutionException(pendingReq, "ELGA mandate-service: General Exception.", e);
+			
+		}
+
+	}
+
+	private boolean getUserConfermationFromRequest(HttpServletRequest httpReq, String paramName) throws WrongParametersException {
+		String paramString = httpReq.getParameter(paramName);
+		paramString = StringEscapeUtils.escapeHtml(paramString);
+		if (!ParamValidatorUtils.isValidUseMandate(paramString))
+			throw new WrongParametersException("Mandate-Service selection-evaluation", paramName, null);
+		
+		if (MiscUtil.isNotEmpty(paramString))
+			return Boolean.parseBoolean(paramString);
+		
+		else
+			return false;
+		
+	}
+}
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/ReceiveElgaMandateResponseTask.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/ReceiveElgaMandateResponseTask.java
new file mode 100644
index 000000000..5604b7640
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/ReceiveElgaMandateResponseTask.java
@@ -0,0 +1,306 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.elgamandates.tasks;
+
+import java.io.IOException;
+import java.util.Set;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.xml.transform.TransformerException;
+
+import org.opensaml.saml2.core.Response;
+import org.opensaml.saml2.core.StatusCode;
+import org.opensaml.ws.message.decoder.MessageDecodingException;
+import org.opensaml.xml.io.MarshallingException;
+import org.opensaml.xml.security.SecurityException;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
+import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
+import at.gv.egovernment.moa.id.auth.exception.InvalidProtocolRequestException;
+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
+import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.ELGAMandatesAuthConstants;
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.utils.ELGAMandateServiceMetadataProvider;
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.utils.ELGAMandatesCredentialProvider;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
+import at.gv.egovernment.moa.id.protocols.pvp2x.PVPTargetConfiguration;
+import at.gv.egovernment.moa.id.protocols.pvp2x.binding.IDecoder;
+import at.gv.egovernment.moa.id.protocols.pvp2x.binding.MOAURICompare;
+import at.gv.egovernment.moa.id.protocols.pvp2x.binding.PostBinding;
+import at.gv.egovernment.moa.id.protocols.pvp2x.binding.RedirectBinding;
+import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.AssertionValidationExeption;
+import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.AuthnResponseValidationException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.messages.InboundMessage;
+import at.gv.egovernment.moa.id.protocols.pvp2x.messages.MOAResponse;
+import at.gv.egovernment.moa.id.protocols.pvp2x.signer.CredentialsNotAvailableException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.utils.AssertionAttributeExtractor;
+import at.gv.egovernment.moa.id.protocols.pvp2x.utils.SAML2Utils;
+import at.gv.egovernment.moa.id.protocols.pvp2x.verification.SAMLVerificationEngineSP;
+import at.gv.egovernment.moa.id.protocols.pvp2x.verification.TrustEngineFactory;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.MiscUtil;
+
+/**
+ * @author tlenz
+ *
+ */
+@Component("ReceiveElgaMandateResponseTask")
+public class ReceiveElgaMandateResponseTask extends AbstractAuthServletTask {
+
+	@Autowired SAMLVerificationEngineSP samlVerificationEngine;
+	@Autowired ELGAMandatesCredentialProvider credentialProvider;
+	@Autowired ELGAMandateServiceMetadataProvider metadataProvider;
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask#execute(at.gv.egovernment.moa.id.process.api.ExecutionContext, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
+	 */
+	@Override
+	public void execute(ExecutionContext executionContext, HttpServletRequest request, HttpServletResponse response)
+			throws TaskExecutionException {		
+		InboundMessage msg = null;
+		
+		try {						
+			IDecoder decoder = null;
+			MOAURICompare comperator = null;
+			//select Response Binding
+			if (request.getMethod().equalsIgnoreCase("POST")) {
+				decoder = new PostBinding();
+				comperator = new MOAURICompare(pendingReq.getAuthURL() 
+						+ ELGAMandatesAuthConstants.ENDPOINT_POST);
+				Logger.debug("Receive PVP Response from ELGA mandate-service, by using POST-Binding.");
+				
+			}  else if (request.getMethod().equalsIgnoreCase("GET")) {
+				decoder = new RedirectBinding();
+				comperator = new MOAURICompare(pendingReq.getAuthURL()
+						+ ELGAMandatesAuthConstants.ENDPOINT_REDIRECT);
+				Logger.debug("Receive PVP Response from ELGA mandate-service, by using Redirect-Binding.");
+				
+			} else {
+				Logger.warn("Receive PVP Response, but Binding (" 
+						+ request.getMethod() + ") is not supported.");
+				throw new AuthnResponseValidationException("sp.pvp2.03", 
+						new Object[] {ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING});
+				
+			}
+			
+			//decode PVP response object
+			msg = (InboundMessage) decoder.decode(request, response, metadataProvider, true,
+					comperator);
+			 
+			if (MiscUtil.isEmpty(msg.getEntityID())) {
+				throw new InvalidProtocolRequestException("sp.pvp2.04", 
+						new Object[] {ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING});
+				
+			}
+			
+			//validate response signature
+			if(!msg.isVerified()) {
+				samlVerificationEngine.verify(msg, 
+						TrustEngineFactory.getSignatureKnownKeysTrustEngine(metadataProvider));
+				msg.setVerified(true);
+								
+			}
+			
+			Logger.debug("PVP Response from ELGA mandate-service is cryptographically valid.");
+			revisionsLogger.logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_ELGA_MANDATE_RECEIVED_IP, request.getRemoteAddr());
+			
+			
+			//validate assertion
+			MOAResponse processedMsg = preProcessAuthResponse((MOAResponse) msg);			
+			
+			//write ELGA mandate information into MOASession
+			AssertionAttributeExtractor extractor = 
+					new AssertionAttributeExtractor(processedMsg.getResponse());
+			
+			//check if all attributes are include
+			if (!extractor.containsAllRequiredAttributes(
+					ELGAMandatesAuthConstants.getRequiredAttributeNames())) {
+				Logger.warn("PVP Response from ELGA mandate-service contains not all requested attributes.");
+				throw new AssertionValidationExeption("sp.pvp2.06", new Object[]{ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING});
+				
+			}
+
+			
+			
+			//load MOASession object
+			defaultTaskInitialization(request, executionContext);
+			
+			//validate receive mandate reference-value
+			//TODO: update if ReferenceValue Discussion is finished
+			String responseRefValue = extractor.getSingleAttributeValue(PVPConstants.MANDATE_REFERENCE_VALUE_NAME); 
+			if (!moasession.getMandateReferenceValue().equals(responseRefValue)) {
+				Logger.warn("PVP Response from ELGA mandate-service contains a not valid MandateReferenceValue.");
+				throw new AssertionValidationExeption("sp.pvp2.07", 
+						new Object[]{ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING,
+								PVPConstants.MANDATE_REFERENCE_VALUE_FRIENDLY_NAME});
+				
+			}
+			
+			Logger.debug("Validation of PVP Response from ELGA mandate-service is complete.");
+			
+			Set<String> includedAttrNames = extractor.getAllIncludeAttributeNames();
+			for (String el : includedAttrNames) {
+				moasession.setGenericDataToSession(el, extractor.getSingleAttributeValue(el));
+				Logger.debug("Add PVP-attribute " + el + " into MOASession");
+				
+			}
+			
+			//store MOASession
+			authenticatedSessionStorage.storeSession(moasession);
+						
+			//write revisions log entry
+			revisionsLogger.logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_ELGA_MANDATE_RECEIVED, 
+						extractor.getSingleAttributeValue(PVPConstants.MANDATE_REFERENCE_VALUE_NAME));
+
+			//write mandate info's to revisions log
+			revisionsLogger.logEvent(pendingReq, MOAIDEventConstants.PERSONAL_INFORMATION_MANDATE_TYPE, 
+									 extractor.getSingleAttributeValue(PVPConstants.MANDATE_TYPE_NAME));
+			revisionsLogger.logEvent(pendingReq, MOAIDEventConstants.PERSONAL_INFORMATION_MANDATE_MANDATOR_TYPE, 
+									 MOAReversionLogger.NAT_PERSON);
+			revisionsLogger.logEvent(pendingReq, MOAIDEventConstants.PERSONAL_INFORMATION_MANDATE_MANDATOR_HASH, 
+									  revisionsLogger.buildPersonInformationHash(
+											 extractor.getSingleAttributeValue(PVPConstants.MANDATE_NAT_PER_GIVEN_NAME_NAME), 
+											 extractor.getSingleAttributeValue(PVPConstants.MANDATE_NAT_PER_FAMILY_NAME_NAME), 
+											 extractor.getSingleAttributeValue(PVPConstants.MANDATE_NAT_PER_BIRTHDATE_NAME)));						
+			
+			Logger.info("Receive a valid assertion from ELGA mandate-service " + msg.getEntityID()); 
+											
+		} catch (MessageDecodingException | SecurityException e) {
+			String samlRequest = request.getParameter("SAMLRequest");			
+			Logger.warn("Receive INVALID PVP Response from ELGA mandate-service: " + samlRequest, e);
+			revisionsLogger.logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_ELGA_MANDATE_ERROR_RECEIVED);
+			throw new TaskExecutionException(pendingReq, 
+					"Receive INVALID PVP Response from ELGA mandate-service", 
+					new AuthnResponseValidationException("sp.pvp2.12", 
+							new Object[]{ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING, e.getMessage()}, 
+							e));
+
+		} catch (IOException | MarshallingException | TransformerException e) {
+			Logger.warn("Processing PVP response from ELGA mandate-service FAILED.", e);
+			revisionsLogger.logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_ELGA_MANDATE_ERROR_RECEIVED);
+			throw new TaskExecutionException(pendingReq, 
+					"Processing PVP response from ELGA mandate-service FAILED.", 
+					new AuthnResponseValidationException("sp.pvp2.12", 
+							new Object[]{ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING, e.getMessage()}, 
+							e));
+			
+		} catch (CredentialsNotAvailableException e) {
+			Logger.error("ELGA mandate-service: PVP response decrytion FAILED. No credential found.", e);
+			revisionsLogger.logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_ELGA_MANDATE_ERROR_RECEIVED);
+			throw new TaskExecutionException(pendingReq, "ELGA mandate-service: PVP response decrytion FAILED. No credential found.", e);
+
+		} catch (AssertionValidationExeption | AuthnResponseValidationException e) {
+			Logger.info("ELGA mandate-service: PVP response validation FAILED. Msg:" + e.getMessage());
+			revisionsLogger.logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_ELGA_MANDATE_ERROR_RECEIVED, e.getMessageId());
+			throw new TaskExecutionException(pendingReq, "ELGA mandate-service: PVP response validation FAILED.", e);
+		
+		} catch (Exception e) {
+			Logger.info("ELGA mandate-service: General Exception. Msg:" + e.getMessage());
+			revisionsLogger.logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_ELGA_MANDATE_ERROR_RECEIVED);
+			throw new TaskExecutionException(pendingReq, "ELGA mandate-service: General Exception.", e);
+			
+		}
+
+	}
+		
+	/**
+	 * PreProcess AuthResponse and Assertion 
+	 * @param msg
+	 * @throws TransformerException 
+	 * @throws MarshallingException 
+	 * @throws IOException 
+	 * @throws CredentialsNotAvailableException 
+	 * @throws AssertionValidationExeption 
+	 * @throws AuthnResponseValidationException 
+	 */
+	private MOAResponse preProcessAuthResponse(MOAResponse msg) throws IOException, MarshallingException, TransformerException, AssertionValidationExeption, CredentialsNotAvailableException, AuthnResponseValidationException {
+		Logger.debug("Start PVP-2.1 assertion processing... ");
+		Response samlResp = (Response) msg.getResponse();
+
+		//validate 'inResponseTo' attribute
+		String authnReqID = pendingReq.getGenericData(
+				PVPTargetConfiguration.DATAID_INTERFEDERATION_REQUESTID, String.class);
+		String inResponseTo = samlResp.getInResponseTo();
+		
+		if (MiscUtil.isEmpty(authnReqID) || MiscUtil.isEmpty(inResponseTo) || 
+				!authnReqID.equals(inResponseTo)) {
+			Logger.info("Validation of request/response IDs FAILED."
+					+ " ReqID:" + authnReqID + " InRespTo:" + inResponseTo);
+			throw new AuthnResponseValidationException("sp.pvp2.07", 
+					new Object[]{ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING,
+							"'InResponseTo'"});
+			
+		}
+		
+		// check SAML2 response status-code
+		if (samlResp.getStatus().getStatusCode().getValue().equals(StatusCode.SUCCESS_URI)) {				
+			//validate PVP 2.1 assertion
+			samlVerificationEngine.validateAssertion(samlResp, true, 
+					credentialProvider.getIDPAssertionEncryptionCredential(),
+					pendingReq.getAuthURL() + ELGAMandatesAuthConstants.ENDPOINT_METADATA,
+					ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING);
+
+			msg.setSAMLMessage(SAML2Utils.asDOMDocument(samlResp).getDocumentElement());
+			return msg;
+				
+		} else {
+			String errorMsg = "No error message";
+			StatusCode firstCode = samlResp.getStatus().getStatusCode();
+			
+			//get errormessage from response
+			if (samlResp.getStatus().getStatusMessage() != null && 
+					MiscUtil.isNotEmpty(samlResp.getStatus().getStatusMessage().getMessage()))
+				errorMsg = samlResp.getStatus().getStatusMessage().getMessage();
+			
+			//extract response status-codes
+			if (firstCode.getStatusCode() == null) {			
+				Logger.info("Receive StatusCode:" + firstCode.getValue() + " | Msg:" +  errorMsg 
+						+ " from federated IDP.");			
+				throw new AuthnResponseValidationException("sp.pvp2.05", 
+						new Object[]{ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING, 
+								samlResp.getIssuer().getValue(), 
+								firstCode.getValue(),
+								samlResp.getStatus().getStatusMessage().getMessage()});
+				
+			} else {
+				StatusCode secondCode = firstCode.getStatusCode();
+				Logger.info("Receive StatusCode:" + firstCode.getValue() + " -> StatusCode:" + secondCode.getValue() 
+					+ " | Msg:" +  errorMsg + " from federated IDP.");			
+				throw new AuthnResponseValidationException("sp.pvp2.09", 
+						new Object[]{ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING, 
+								samlResp.getIssuer().getValue(), 
+								firstCode.getValue(),
+								secondCode.getValue(),
+								samlResp.getStatus().getStatusMessage().getMessage()});
+				
+			}
+					
+		}
+								
+	}	
+
+}
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/RequestELGAMandateTask.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/RequestELGAMandateTask.java
new file mode 100644
index 000000000..6a7858575
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/RequestELGAMandateTask.java
@@ -0,0 +1,196 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.elgamandates.tasks;
+
+import java.security.NoSuchAlgorithmException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.opensaml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml2.metadata.provider.MetadataProviderException;
+import org.opensaml.ws.message.encoder.MessageEncodingException;
+import org.opensaml.xml.security.SecurityException;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
+import at.gv.egovernment.moa.id.auth.builder.BPKBuilder;
+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
+import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.ELGAMandatesAuthConstants;
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.config.ELGAMandatesRequestBuilderConfiguration;
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.exceptions.ELGAMetadataException;
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.utils.ELGAMandateServiceMetadataProvider;
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.utils.ELGAMandatesCredentialProvider;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+import at.gv.egovernment.moa.id.protocols.pvp2x.PVPTargetConfiguration;
+import at.gv.egovernment.moa.id.protocols.pvp2x.builder.PVPAuthnRequestBuilder;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.Constants;
+import at.gv.egovernment.moa.util.MiscUtil;
+
+/**
+ * @author tlenz
+ *
+ */
+@Component("RequestELGAMandateTask")
+public class RequestELGAMandateTask extends AbstractAuthServletTask {
+
+	@Autowired PVPAuthnRequestBuilder authnReqBuilder;
+	@Autowired ELGAMandatesCredentialProvider credential;
+	@Autowired AuthConfiguration authConfig;
+	@Autowired ELGAMandateServiceMetadataProvider metadataService;
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask#execute(at.gv.egovernment.moa.id.process.api.ExecutionContext, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
+	 */
+	@Override
+	public void execute(ExecutionContext executionContext, HttpServletRequest request, HttpServletResponse response)
+			throws TaskExecutionException {
+		try{
+			// get IDP entityID
+			String elgaMandateServiceEntityID = authConfig.getBasicMOAIDConfiguration(ELGAMandatesAuthConstants.CONFIG_PROPS_ENTITYID);
+					
+			if (MiscUtil.isEmpty(elgaMandateServiceEntityID)) {
+				Logger.info("Connect ELGA Mandate-Service FAILED -> not EntityID found!");
+				throw new TaskExecutionException(pendingReq, "Connect ELGA Mandate-Service FAILED", 
+						new MOAIDException("service.10", 
+								new Object[]{ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING, "Not EntityID found"}));
+				
+			}
+			
+			//load metadata with metadataURL, as backup
+			String metadataURL = authConfig.getBasicMOAIDConfiguration(ELGAMandatesAuthConstants.CONFIG_PROPS_METADATAURL);
+			if (MiscUtil.isNotEmpty(metadataURL)) {
+				Logger.warn("Use not recommended metadata-provider initialization!"
+						+ " SAML2 'Well-Known-Location' is the preferred methode.");
+				Logger.info("Initialize ELGA Mandate-Service metadata-provider with URL:" + metadataURL);				
+				metadataService.initialize(metadataURL);
+				
+			}
+			
+			//load IDP SAML2 entitydescriptor
+			EntityDescriptor entityDesc = metadataService.getEntityDescriptor(elgaMandateServiceEntityID);			
+			
+			//load MOASession from database
+			defaultTaskInitialization(request, executionContext);
+			
+			//setup AuthnRequestBuilder configuration
+			ELGAMandatesRequestBuilderConfiguration authnReqConfig = new ELGAMandatesRequestBuilderConfiguration();
+			authnReqConfig.setIdpEntity(entityDesc);
+			authnReqConfig.setPassive(false);
+			authnReqConfig.setSignCred(credential.getIDPAssertionSigningCredential());
+			authnReqConfig.setSPEntityID(pendingReq.getAuthURL() + ELGAMandatesAuthConstants.ENDPOINT_METADATA);			
+						
+			//set bPK of representative
+			String representativeBPK = null;
+			
+			String configTarget = authConfig.getBasicMOAIDConfiguration(ELGAMandatesAuthConstants.CONFIG_PROPS_SUBJECTNAMEID_TARGET);
+			if (MiscUtil.isEmpty(configTarget)) {
+				Logger.warn("Connect ELGA Mandate-Service FAILED -> No bPK-Type for SubjectNameID found.");
+				throw new MOAIDException("service.10", 
+						new Object[]{ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING, "No bPK-Type for SubjectNameID found in configuration."}); 
+				
+			} else {
+				if (!configTarget.startsWith(Constants.URN_PREFIX_CDID)) {
+					Logger.warn("Connect ELGA Mandate-Service FAILED -> bPK-Type for SubjectNameID has wrong format.");
+					throw new MOAIDException("service.10", 
+							new Object[]{ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING, "bPK-Type for SubjectNameID has wrong format."});
+					
+				}								
+			}
+
+			//check if identityLink exists in moaSession DAO
+			if (moasession.getIdentityLink() == null) {
+				Logger.error("Connect ELGA Mandate-Service FAILED -> NO identityLink in moaSession DAO");
+				throw new MOAIDException("service.10", 
+						new Object[]{ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING, "NO identityLink in moaSession DAO."});
+				
+			}
+			
+			String sourcePinType = moasession.getIdentityLink().getIdentificationType();
+			String sourcePinValue = moasession.getIdentityLink().getIdentificationValue();			
+			if (sourcePinType.startsWith(Constants.URN_PREFIX_BASEID)) {
+				representativeBPK = new BPKBuilder().buildBPK(sourcePinValue, configTarget);
+				
+			} else {
+				Logger.debug("No 'SourcePin' found for representative. "
+						+ "Check sourcePinType against target from configuration.");
+				if (!configTarget.equals(sourcePinType)) {
+					Logger.warn("Connect ELGA Mandate-Service FAILED -> Generate bPK for configurated bPK-Type is not possible.");
+					throw new MOAIDException("service.10", 
+							new Object[]{ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING, "Generate bPK for configurated bPK-Type is not possible."});
+					
+				} else {
+					representativeBPK = sourcePinValue;
+					
+				}								
+			}
+			
+			//set bPK of representative as SAML2 subjectNameID
+			authnReqConfig.setSubjectNameID(representativeBPK );
+			authnReqConfig.setSubjectNameIDQualifier(configTarget);
+			
+			//set MandateReferenceValue as RequestID
+			authnReqConfig.setRequestID(moasession.getMandateReferenceValue());
+			pendingReq.setGenericDataToSession(
+					PVPTargetConfiguration.DATAID_INTERFEDERATION_REQUESTID,
+					authnReqConfig.getRequestID());
+			
+			//set SubjectConformationDate
+			authnReqConfig.setSubjectConformationDate(
+					moasession.getIdentityLink().getGivenName(), 
+					moasession.getIdentityLink().getFamilyName(), 
+					moasession.getIdentityLink().getDateOfBirth());
+			
+			//store pending-request
+			requestStoreage.storePendingRequest(pendingReq);
+			
+			//build and transmit AuthnRequest
+			authnReqBuilder.buildAuthnRequest(pendingReq, authnReqConfig , response);
+		
+			//write revisions log entry
+			revisionsLogger.logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_ELGA_MANDATE_SERVICE_REQUESTED, moasession.getMandateReferenceValue());
+			
+		} catch (MetadataProviderException e) {			
+			throw new TaskExecutionException(pendingReq, "ELGA Mandate-Service metadata problem", new ELGAMetadataException("service.10", 
+						new Object[]{ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING, e.getMessage()}, e));
+			
+		} catch (MOAIDException e) {
+			throw new TaskExecutionException(pendingReq, "Build PVP2.1 AuthnRequest for ELGA Mandate-Service FAILED.", e);
+
+		} catch (MessageEncodingException | NoSuchAlgorithmException  | SecurityException e) {
+			Logger.error("Build PVP2.1 AuthnRequest for ELGA Mandate-Service FAILED", e);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
+			
+		} catch (Exception e) {
+			Logger.error("Build PVP2.1 AuthnRequest for ELGA Mandate-Service FAILED", e);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
+			
+		}
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/SelectMandateServiceTask.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/SelectMandateServiceTask.java
new file mode 100644
index 000000000..8d6ac1762
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/SelectMandateServiceTask.java
@@ -0,0 +1,95 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.elgamandates.tasks;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import at.gv.egovernment.moa.id.auth.frontend.builder.IGUIBuilderConfiguration;
+import at.gv.egovernment.moa.id.auth.frontend.builder.IGUIFormBuilder;
+import at.gv.egovernment.moa.id.auth.frontend.builder.ServiceProviderSpecificGUIFormBuilderConfiguration;
+import at.gv.egovernment.moa.id.auth.frontend.exception.GUIBuildException;
+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
+import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.ELGAMandatesAuthConstants;
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.utils.ELGAMandateUtils;
+import at.gv.egovernment.moa.id.auth.servlet.GeneralProcessEngineSignalController;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+@Component("SelectMandateServiceTask")
+public class SelectMandateServiceTask extends AbstractAuthServletTask {
+
+	@Autowired IGUIFormBuilder guiBuilder;
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask#execute(at.gv.egovernment.moa.id.process.api.ExecutionContext, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
+	 */
+	@Override
+	public void execute(ExecutionContext executionContext, HttpServletRequest request, HttpServletResponse response)
+			throws TaskExecutionException {
+		try {
+			//check if Service-Provider allows ELGA-mandates
+			if (ELGAMandateUtils.checkServiceProviderAgainstELGAModulConfigration(authConfig, pendingReq)) {			
+				Logger.trace("Build GUI for mandate-service selection ...");
+						
+				IGUIBuilderConfiguration config = new ServiceProviderSpecificGUIFormBuilderConfiguration(
+						pendingReq, 
+						ELGAMandatesAuthConstants.TEMPLATE_MANDATE_SERVICE_SELECTION, 
+						GeneralProcessEngineSignalController.ENDPOINT_GENERIC);
+			
+				guiBuilder.build(response, config, "Mandate-Service selection");
+		
+				Logger.debug("GUI for mandate-service selection is generated. Wait for user interaction ... ");
+				
+			} else {
+				//service-provider does not allow ELGA-mandates  --> switch to MIS mandate-service
+				Logger.debug("Service-Provider does not allow ELGA Mandate-Service. --> Select MIS Mandate-Service as Default.");
+				executionContext.put(MOAIDAuthConstants.PARAM_USEMISMANDATE, true);
+				
+			}
+			
+		} catch (GUIBuildException e) {
+			Logger.warn("Can not build GUI:'Mandate-Service selection'. Msg:" + e.getMessage());
+			throw new TaskExecutionException(pendingReq, 
+					"Can not build GUI. Msg:" + e.getMessage(), 
+					new MOAIDException("builder.09", new Object[]{e.getMessage()}, e));
+						
+		} catch (Exception e) {
+			Logger.info("Mandate-Service selection: General Exception. Msg:" + e.getMessage());
+			throw new TaskExecutionException(pendingReq, "ELGA mandate-service: General Exception.", e);
+			
+		}
+
+	}
+	
+}
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/utils/ELGAMandateServiceMetadataProvider.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/utils/ELGAMandateServiceMetadataProvider.java
new file mode 100644
index 000000000..c9485104b
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/utils/ELGAMandateServiceMetadataProvider.java
@@ -0,0 +1,223 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.elgamandates.utils;
+
+import java.util.List;
+
+import javax.xml.namespace.QName;
+
+import org.opensaml.saml2.metadata.EntitiesDescriptor;
+import org.opensaml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml2.metadata.RoleDescriptor;
+import org.opensaml.saml2.metadata.provider.HTTPMetadataProvider;
+import org.opensaml.saml2.metadata.provider.MetadataFilter;
+import org.opensaml.saml2.metadata.provider.MetadataProviderException;
+import org.opensaml.xml.XMLObject;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.ELGAMandatesAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.protocols.pvp2x.metadata.SimpleMOAMetadataProvider;
+import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.MOASPMetadataSignatureFilter;
+import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.SchemaValidationFilter;
+import at.gv.egovernment.moa.id.saml2.MetadataFilterChain;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.MiscUtil;
+
+/**
+ * @author tlenz
+ *
+ */
+
+@Service("ELGAMandate_MetadataProvider")
+public class ELGAMandateServiceMetadataProvider extends SimpleMOAMetadataProvider {
+
+	@Autowired AuthConfiguration authConfig;
+	
+	private HTTPMetadataProvider metadataProvider = null;
+
+	
+	public void initialize(String metadataURL) throws MetadataProviderException {
+		if (metadataProvider == null) {
+			internalInitialize(metadataURL);
+			
+		} else {
+			Logger.info("ELGA Mandate-Service metadata-provider is already initialized.");
+			
+		}
+		
+	}
+	
+		
+	/* (non-Javadoc)
+	 * @see org.opensaml.saml2.metadata.provider.MetadataProvider#requireValidMetadata()
+	 */
+	@Override
+	public boolean requireValidMetadata() {
+		if (metadataProvider == null) {
+			Logger.fatal("ELGA Mandate-Service metadata-provider is not initialized");
+			return false;
+			
+		} else
+			return metadataProvider.requireValidMetadata();
+	}
+
+	/* (non-Javadoc)
+	 * @see org.opensaml.saml2.metadata.provider.MetadataProvider#setRequireValidMetadata(boolean)
+	 */
+	@Override
+	public void setRequireValidMetadata(boolean requireValidMetadata) {
+		if (metadataProvider == null) {
+			Logger.fatal("ELGA Mandate-Service metadata-provider is not initialized");
+			
+		} else		
+			metadataProvider.setRequireValidMetadata(requireValidMetadata);;
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see org.opensaml.saml2.metadata.provider.MetadataProvider#getMetadataFilter()
+	 */
+	@Override
+	public MetadataFilter getMetadataFilter() {
+		if (metadataProvider == null) {
+			Logger.fatal("ELGA Mandate-Service metadata-provider is not initialized");
+			return null;
+			
+		} else		
+			return metadataProvider.getMetadataFilter();
+	}
+
+	/* (non-Javadoc)
+	 * @see org.opensaml.saml2.metadata.provider.MetadataProvider#setMetadataFilter(org.opensaml.saml2.metadata.provider.MetadataFilter)
+	 */
+	@Override
+	public void setMetadataFilter(MetadataFilter newFilter) throws MetadataProviderException {
+		Logger.fatal("Set Metadata Filter is not implemented her!");
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see org.opensaml.saml2.metadata.provider.MetadataProvider#getMetadata()
+	 */
+	@Override
+	public XMLObject getMetadata() throws MetadataProviderException {
+		if (metadataProvider == null) {
+			Logger.error("ELGA Mandate-Service metadata-provider is not initialized");
+			throw new MetadataProviderException("ELGA Mandate-Service metadata-provider is not initialized");
+			
+		}
+		
+		return metadataProvider.getMetadata();
+	}
+
+	/* (non-Javadoc)
+	 * @see org.opensaml.saml2.metadata.provider.MetadataProvider#getEntitiesDescriptor(java.lang.String)
+	 */
+	@Override
+	public EntitiesDescriptor getEntitiesDescriptor(String name) throws MetadataProviderException {
+		if (metadataProvider == null) {
+			Logger.fatal("ELGA Mandate-Service metadata-provider is not initialized");
+			throw new MetadataProviderException("ELGA Mandate-Service metadata-provider is not initialized");
+			
+		} else		
+			return metadataProvider.getEntitiesDescriptor(name);
+	}
+
+	/* (non-Javadoc)
+	 * @see org.opensaml.saml2.metadata.provider.MetadataProvider#getEntityDescriptor(java.lang.String)
+	 */
+	@Override
+	public EntityDescriptor getEntityDescriptor(String entityID) throws MetadataProviderException {
+		if (metadataProvider == null) 
+			internalInitialize(entityID);
+										
+		try {
+			EntityDescriptor entityDesc = metadataProvider.getEntityDescriptor(entityID);
+			if (entityDesc == null) {
+				Logger.error("ELGA Mandate-Service Client ERROR: No EntityID with "+ entityID);
+				throw new MetadataProviderException("No EntityID with "+ entityID);
+			}
+			
+			return entityDesc;
+			
+		} catch (MetadataProviderException e) {
+			Logger.error("ELGA Mandate-Service Client ERROR: Metadata extraction FAILED.", e);
+			throw new MetadataProviderException("Metadata extraction FAILED", e);
+			
+		}
+	}
+
+	/* (non-Javadoc)
+	 * @see org.opensaml.saml2.metadata.provider.MetadataProvider#getRole(java.lang.String, javax.xml.namespace.QName)
+	 */
+	@Override
+	public List<RoleDescriptor> getRole(String entityID, QName roleName) throws MetadataProviderException {
+		if (metadataProvider == null)
+			internalInitialize(entityID);
+		
+		return metadataProvider.getRole(entityID, roleName);
+	}
+
+	/* (non-Javadoc)
+	 * @see org.opensaml.saml2.metadata.provider.MetadataProvider#getRole(java.lang.String, javax.xml.namespace.QName, java.lang.String)
+	 */
+	@Override
+	public RoleDescriptor getRole(String entityID, QName roleName, String supportedProtocol)
+			throws MetadataProviderException {
+		if (metadataProvider == null)
+			internalInitialize(entityID);
+		
+		return metadataProvider.getRole(entityID, roleName, supportedProtocol);
+	}
+	
+	private synchronized void internalInitialize(String metdataURL) throws MetadataProviderException {		
+		if (metadataProvider == null) {
+			Logger.info("Initialize PVP MetadataProvider to connect ELGA Mandate-Service");
+		
+			String trustProfileID = authConfig.getBasicMOAIDConfiguration(ELGAMandatesAuthConstants.CONFIG_PROPS_METADATA_TRUSTPROFILE);
+			if (MiscUtil.isEmpty(trustProfileID)) {
+				Logger.error("Create ELGA Mandate-Service Client FAILED: No trustProfileID to verify PVP metadata." );
+				throw new MetadataProviderException("No trustProfileID to verify PVP metadata.");
+			}
+						
+			//create metadata validation filter chain
+			MetadataFilterChain filter = new MetadataFilterChain();
+			filter.addFilter(new SchemaValidationFilter(true));
+			filter.addFilter(new MOASPMetadataSignatureFilter(trustProfileID));
+		
+			metadataProvider = createNewHTTPMetaDataProvider(metdataURL, 
+					filter, 
+					ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING);
+		
+			if (metadataProvider == null) {
+				Logger.error("Create ELGA Mandate-Service Client FAILED.");
+				throw new MetadataProviderException("Can not initialize ELGA Mandate-Service metadaa provider.");
+			
+			}
+		
+			metadataProvider.setRequireValidMetadata(true);
+		}
+	}
+}
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/utils/ELGAMandateUtils.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/utils/ELGAMandateUtils.java
new file mode 100644
index 000000000..03f8fa195
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/utils/ELGAMandateUtils.java
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.elgamandates.utils;
+
+import java.util.List;
+
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.ELGAMandatesAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.utils.KeyValueUtils;
+
+/**
+ * @author tlenz
+ *
+ */
+public class ELGAMandateUtils {
+	/**
+	 * Check Service-Provider mandate-profiles against allowed mandate-profiles for ELGA MandateService.
+	 * 
+	 * @return true, if ELGA mandateservice is allowed, otherwise false
+	 */
+	public static boolean checkServiceProviderAgainstELGAModulConfigration(AuthConfiguration authConfig, IRequest pendingReq) {
+		String allowedMandateTypesCSV = 
+				authConfig.getBasicMOAIDConfiguration(ELGAMandatesAuthConstants.CONFIG_PROPS_ALLOWED_MANDATE_TYPES);		
+		List<String> allowedMandateTypes = KeyValueUtils.getListOfCSVValues(allowedMandateTypesCSV);		
+		List<String> spMandateProfiles = pendingReq.getOnlineApplicationConfiguration().getMandateProfiles();
+
+		boolean isELGAMandateServiceAllowed = false;
+		if (spMandateProfiles != null) {			
+			for (String el : allowedMandateTypes) {
+				if (spMandateProfiles.contains(el))
+					isELGAMandateServiceAllowed = true;
+			
+			}
+		}
+		
+		return isELGAMandateServiceAllowed;
+	}
+}
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/utils/ELGAMandatesCredentialProvider.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/utils/ELGAMandatesCredentialProvider.java
new file mode 100644
index 000000000..f5bcdb70b
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/utils/ELGAMandatesCredentialProvider.java
@@ -0,0 +1,123 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.elgamandates.utils;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import at.gv.egovernment.moa.id.auth.modules.elgamandates.ELGAMandatesAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider;
+import at.gv.egovernment.moa.util.FileUtils;
+
+/**
+ * @author tlenz
+ *
+ */
+@Service("ELGAMandatesCredentialProvider")
+public class ELGAMandatesCredentialProvider extends AbstractCredentialProvider {
+
+	@Autowired AuthConfiguration authConfig;
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getKeyStoreFilePath()
+	 */
+	@Override
+	public String getKeyStoreFilePath() {
+		return FileUtils.makeAbsoluteURL(
+					authConfig.getBasicMOAIDConfiguration(ELGAMandatesAuthConstants.CONFIG_PROPS_KEYSTORE), 
+					authConfig.getRootConfigFileDir());
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getKeyStorePassword()
+	 */
+	@Override
+	public String getKeyStorePassword() {
+		return authConfig.getBasicMOAIDConfiguration(ELGAMandatesAuthConstants.CONFIG_PROPS_KEYSTOREPASSWORD).trim();
+
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getMetadataKeyAlias()
+	 */
+	@Override
+	public String getMetadataKeyAlias() {
+		return authConfig.getBasicMOAIDConfiguration(
+				ELGAMandatesAuthConstants.CONFIG_PROPS_SIGN_METADATA_ALIAS_PASSWORD).trim();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getMetadataKeyPassword()
+	 */
+	@Override
+	public String getMetadataKeyPassword() {
+		return authConfig.getBasicMOAIDConfiguration(
+				ELGAMandatesAuthConstants.CONFIG_PROPS_SIGN_METADATA_KEY_PASSWORD).trim();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getSignatureKeyAlias()
+	 */
+	@Override
+	public String getSignatureKeyAlias() {
+		return authConfig.getBasicMOAIDConfiguration(
+				ELGAMandatesAuthConstants.CONFIG_PROPS_SIGN_SIGNING_ALIAS_PASSWORD).trim();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getSignatureKeyPassword()
+	 */
+	@Override
+	public String getSignatureKeyPassword() {
+		return authConfig.getBasicMOAIDConfiguration(
+				ELGAMandatesAuthConstants.CONFIG_PROPS_SIGN_SIGNING_KEY_PASSWORD).trim();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getEncryptionKeyAlias()
+	 */
+	@Override
+	public String getEncryptionKeyAlias() {
+		return authConfig.getBasicMOAIDConfiguration(
+				ELGAMandatesAuthConstants.CONFIG_PROPS_ENCRYPTION_ALIAS_PASSWORD).trim();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getEncryptionKeyPassword()
+	 */
+	@Override
+	public String getEncryptionKeyPassword() {
+		return authConfig.getBasicMOAIDConfiguration(
+				ELGAMandatesAuthConstants.CONFIG_PROPS_ENCRYPTION_KEY_PASSWORD).trim();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getCredentialName()
+	 */
+	@Override
+	public String getFriendlyName() {
+		return "FederatedAuth-SP";
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider b/id/server/modules/moa-id-module-elga_mandate_service/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider
new file mode 100644
index 000000000..1ebc153ce
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider
@@ -0,0 +1 @@
+at.gv.egovernment.moa.id.auth.modules.elgamandates.ELGAMandatesSpringResourceProvider
\ No newline at end of file
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/resources/at/gv/egovernment/moa/id/auth/modules/elgamandates/DefaultAuth_with_ELGA_mandates.process.xml b/id/server/modules/moa-id-module-elga_mandate_service/src/main/resources/at/gv/egovernment/moa/id/auth/modules/elgamandates/DefaultAuth_with_ELGA_mandates.process.xml
new file mode 100644
index 000000000..4dee1160e
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/resources/at/gv/egovernment/moa/id/auth/modules/elgamandates/DefaultAuth_with_ELGA_mandates.process.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<pd:ProcessDefinition id="DefaultAuthenticationWithELGAMandates" xmlns:pd="http://reference.e-government.gv.at/namespace/moa/process/definition/v1">
+
+<!--
+	- National authentication with Austrian Citizen Card and mobile signature with our without mandate.
+	- Legacy authentication for foreign citizens using MOCCA supported signature cards.
+-->
+	<pd:Task id="initializeBKUAuthentication" class="InitializeBKUAuthenticationTask" />
+	<pd:Task id="createIdentityLinkForm"    class="CreateIdentityLinkFormTask" />
+	<pd:Task id="verifyIdentityLink"        class="VerifyIdentityLinkTask"        async="true" />
+	<pd:Task id="verifyAuthBlock"           class="VerifyAuthenticationBlockTask" async="true" />
+	<pd:Task id="verifyCertificate"         class="VerifyCertificateTask"         async="true" />
+	<pd:Task id="getMISMandate"           	class="GetMISSessionIDTask"           async="true" />
+	<pd:Task id="certificateReadRequest"    class="CertificateReadRequestTask" />
+	<pd:Task id="prepareAuthBlockSignature" class="PrepareAuthBlockSignatureTask" />
+	<pd:Task id="prepareGetMISMandate" 			class="PrepareGetMISMandateTask" />
+	<pd:Task id="finalizeAuthentication" 		class="FinalizeAuthenticationTask" />
+	<pd:Task id="getForeignID"              class="GetForeignIDTask"              async="true" />
+	
+	<!-- ELGA Mandate-Service Tasks -->
+	<pd:Task id="selectMandateServiceTask"    			class="SelectMandateServiceTask" />
+	<pd:Task id="evaluateMandateServiceTask"    		class="EvaluateMandateServiceTask" async="true"/>
+	<pd:Task id="requestELGAMandateTask"    				class="RequestELGAMandateTask" />
+	<pd:Task id="receiveElgaMandateResponseTask"    class="ReceiveElgaMandateResponseTask"  async="true"/>
+	
+
+	<!-- Process is triggered either by GenerateIFrameTemplateServlet (upon bku selection) or by AuthenticationManager (upon legacy authentication start using legacy parameters. -->
+	<pd:StartEvent id="start" />
+	
+	<pd:Transition from="start"                     			to="initializeBKUAuthentication" />
+	
+	<pd:Transition from="initializeBKUAuthentication" to="createIdentityLinkForm" />
+	
+	<pd:Transition from="createIdentityLinkForm"    to="verifyIdentityLink" />
+	
+	<pd:Transition from="verifyIdentityLink"        to="certificateReadRequest" conditionExpression="!ctx['identityLinkAvailable'] || ctx['useMandate']" />
+	<pd:Transition from="verifyIdentityLink"        to="prepareAuthBlockSignature" />
+	
+	<pd:Transition from="prepareAuthBlockSignature" to="verifyAuthBlock" />
+	<!-- Note: verifyAuthBlock still creates a MIS session and redirects the user to the MIS gui. This should be separated from the auth block verification. -->
+	
+	<pd:Transition from="certificateReadRequest"    to="verifyCertificate" />
+	<!-- Note: verifyCertificate still creates the auth block to be signed which should be separated from certificat verification. -->
+	
+	<pd:Transition from="verifyCertificate"         to="verifyAuthBlock" conditionExpression="ctx['useMandate']" />
+	<pd:Transition from="verifyCertificate"         to="getForeignID" />
+	
+	<pd:Transition from="verifyAuthBlock"           to="selectMandateServiceTask" conditionExpression="ctx['useMandate']" />
+	<pd:Transition from="verifyAuthBlock"           to="finalizeAuthentication" />
+		
+	<pd:Transition from="selectMandateServiceTask"   to="prepareGetMISMandate" conditionExpression="ctx['useMISMandate']" />
+	<pd:Transition from="selectMandateServiceTask"   to="evaluateMandateServiceTask" />
+		
+	<pd:Transition from="evaluateMandateServiceTask" to="prepareGetMISMandate" conditionExpression="ctx['useMISMandate']" />
+	<pd:Transition from="evaluateMandateServiceTask" to="requestELGAMandateTask" conditionExpression="ctx['useELGAMandate']" />
+	<pd:Transition from="evaluateMandateServiceTask" to="end" />
+
+			
+	<pd:Transition from="requestELGAMandateTask"      		to="receiveElgaMandateResponseTask" />
+	<pd:Transition from="receiveElgaMandateResponseTask"  to="finalizeAuthentication" />
+	
+	<pd:Transition from="prepareGetMISMandate"      to="getMISMandate" />	
+	<pd:Transition from="getMISMandate"           	to="finalizeAuthentication" />
+	
+	<pd:Transition from="getForeignID"              to="finalizeAuthentication" />
+	
+	<pd:Transition from="finalizeAuthentication"    to="end" />
+		
+	<pd:EndEvent id="end" />
+
+</pd:ProcessDefinition>
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/resources/moaid_elga_mandate_client_auth.beans.xml b/id/server/modules/moa-id-module-elga_mandate_service/src/main/resources/moaid_elga_mandate_client_auth.beans.xml
new file mode 100644
index 000000000..cbc4e65c1
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/resources/moaid_elga_mandate_client_auth.beans.xml
@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xmlns:tx="http://www.springframework.org/schema/tx"
+	xmlns:aop="http://www.springframework.org/schema/aop"
+	xsi:schemaLocation="http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.1.xsd
+		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd
+		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd">
+ 
+<!-- ELGA mandate-service client beans -->
+	<bean id="elgaMandatesAuthModule" class="at.gv.egovernment.moa.id.auth.modules.elgamandates.ELGAMandatesAuthModuleImpl">
+		<property name="priority" value="1" />
+	</bean>
+
+	<bean	id="ELGAMandate_MetadataProvider"
+				class="at.gv.egovernment.moa.id.auth.modules.elgamandates.utils.ELGAMandateServiceMetadataProvider"/>
+
+	<bean	id="ELGAMandatesCredentialProvider"
+				class="at.gv.egovernment.moa.id.auth.modules.elgamandates.utils.ELGAMandatesCredentialProvider"/>
+	
+	<bean	id="ELGAMandateMetadataController"
+				class="at.gv.egovernment.moa.id.auth.modules.elgamandates.controller.ELGAMandateMetadataController"/>
+				
+	<bean	id="ELGAMandateSignalController"
+				class="at.gv.egovernment.moa.id.auth.modules.elgamandates.controller.ELGAMandateSignalController"/>
+	
+<!-- ELGA-MandateService communication Process Tasks -->
+	<bean id="SelectMandateServiceTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.elgamandates.tasks.SelectMandateServiceTask"
+				scope="prototype"/>
+				
+	<bean id="EvaluateMandateServiceTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.elgamandates.tasks.EvaluateMandateServiceTask"
+				scope="prototype"/>				
+				
+	<bean id="RequestELGAMandateTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.elgamandates.tasks.RequestELGAMandateTask"
+				scope="prototype"/>
+				
+	<bean id="ReceiveElgaMandateResponseTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.elgamandates.tasks.ReceiveElgaMandateResponseTask"
+				scope="prototype"/>
+																								
+</beans>
\ No newline at end of file
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/resources/templates/mandate-service-selection.html b/id/server/modules/moa-id-module-elga_mandate_service/src/main/resources/templates/mandate-service-selection.html
new file mode 100644
index 000000000..b0be4a475
--- /dev/null
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/resources/templates/mandate-service-selection.html
@@ -0,0 +1,76 @@
+<!DOCTYPE html> 
+<html>
+<head>
+	<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
+    <!-- MOA-ID 2.x BKUSelection Layout CSS -->               
+    <link rel="stylesheet" href="$contextPath/css/buildCSS?pendingid=#ID#" />
+    
+    <title>Anmeldung an Online-Applikation</title>   
+</head>
+
+
+<body>
+		<div id="page">
+
+			<div id="page1" class="case selected-case" role="main">
+
+<!-- 					<h2 class="OA_header">Anmeldung an: #OAName#</h2> -->
+
+					<div id="main">
+					<!--div id="leftcontent" class="hell"-->
+            <div id=processContent>
+              <div id="bku_header" class="dunkel">
+						    <h2 id="tabheader" class="dunkel" role="heading">
+						      Anmeldeinformationen:							  
+						    </h2>
+              </div>
+					
+						  <div id="selectArea" class="hell" role="application">
+							  <h3>Anmeldung an: $OAName</h3>
+					    
+          
+                <div id="processInfoArea">
+                  <p>Für die Anmeldung 'in Vertretung' stehen Ihnen zwei Systeme zur Vollmachtenauswahl zur Verfügung. Bitte wählen Sie das gewünschte Service.</p> 
+                </div>
+              
+                <div id="processSelectionArea">
+							   <div id="elgaMandateButton" class="processSelectionButtonArea">
+							 		  <form method="post" id="moaidform_yes" action="$contextPath$submitEndpoint">
+										  <input type="hidden" name="useELGAMandate" value="true">
+                      <input type="hidden" name="pendingid" value="$pendingReqID">
+										  <input type="submit" value="Eltern-Kind Vertretung" class="processSelectionButton" role="button">
+									 </form>
+                    <div class="buttonDescription">
+                      <p>Eltern-Kind Vertretung</p>
+                    </div>
+							     </div>
+							     <div id="misMandateButton" class="processSelectionButtonArea">
+								    <form method="post" id="moaidform_no" action="$contextPath$submitEndpoint">
+									    <input type="hidden" name="useMISMandate" value="true">
+                      <input type="hidden" name="pendingid" value="$pendingReqID">
+								      <input type="submit" value="allgemeine Vertretung" class="processSelectionButton" role="button">
+								    </form>
+                    <div class="buttonDescription">
+                      <p>Vollmachtenservice der Österreichischen Datenschutzbehörde <a href="https://mms.stammzahlenregister.gv.at/mms/moaid.do">(MMS Service)</a></p>
+                    </div>
+							     </div>
+							     <div id="abortButton" class="processSelectionButtonArea">
+										<form method="post" id="moaidform_no" action="$contextPath$submitEndpoint">
+                      <input type="hidden" name="pendingid" value="$pendingReqID">
+										  <input type="submit" value="Abbrechen" class="processSelectionButton" role="button">
+									  </form>
+                    <div class="buttonDescription">
+                      <p>Den Anmeldevorgang abbrechen</p>
+                    </div>
+							     </div>
+						      </div>
+                  
+                </div>
+              </div>
+            
+						<!--/div-->												
+					</div>
+				</div>
+		</div>
+</body>
+</html>
diff --git a/id/server/modules/moa-id-module-openID/pom.xml b/id/server/modules/moa-id-module-openID/pom.xml
index 080d5ae0b..4684c8032 100644
--- a/id/server/modules/moa-id-module-openID/pom.xml
+++ b/id/server/modules/moa-id-module-openID/pom.xml
@@ -73,11 +73,11 @@
 			</exclusions>
 		</dependency>
 
-<!-- 		<dependency>
+		<dependency>
 			<groupId>com.google.guava</groupId>
 			<artifactId>guava</artifactId>
 			<version>19.0</version>
-		</dependency> -->
+		</dependency>
 		
 				<!-- TestNG -->
 		<dependency>
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/OAuth20Configuration.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/OAuth20Configuration.java
index e2ac97535..9060f35c5 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/OAuth20Configuration.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/OAuth20Configuration.java
@@ -24,7 +24,7 @@ package at.gv.egovernment.moa.id.protocols.oauth20;
 
 import java.util.Properties;
 
-import at.gv.egovernment.moa.id.config.ConfigurationException;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
 import at.gv.egovernment.moa.util.FileUtils;
 
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OAuth20AttributeBuilder.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OAuth20AttributeBuilder.java
index bb180d8e9..9b19e0a4d 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OAuth20AttributeBuilder.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OAuth20AttributeBuilder.java
@@ -27,14 +27,13 @@ import java.util.List;
 
 import org.apache.commons.lang.StringUtils;
 
-import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder;
-import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeGenerator;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonPrimitive;
 
 import at.gv.egovernment.moa.id.auth.stork.STORKConstants;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
 import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.oauth20.Pair;
-import at.gv.egovernment.moa.id.protocols.oauth20.protocol.OAuth20AuthRequest;
+import at.gv.egovernment.moa.id.data.Pair;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.BPKAttributeBuilder;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.EIDAuthBlock;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.EIDCcsURL;
@@ -46,6 +45,8 @@ import at.gv.egovernment.moa.id.protocols.builder.attributes.EIDSectorForIDAttri
 import at.gv.egovernment.moa.id.protocols.builder.attributes.EIDSignerCertificate;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.EIDSourcePIN;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.EIDSourcePINType;
+import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder;
+import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeGenerator;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.MandateLegalPersonFullNameAttributeBuilder;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.MandateLegalPersonSourcePinAttributeBuilder;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.MandateLegalPersonSourcePinTypeAttributeBuilder;
@@ -59,13 +60,11 @@ import at.gv.egovernment.moa.id.protocols.builder.attributes.MandateProfRepDescA
 import at.gv.egovernment.moa.id.protocols.builder.attributes.MandateProfRepOIDAttributeBuilder;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.MandateReferenceValueAttributeBuilder;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.MandateTypeAttributeBuilder;
+import at.gv.egovernment.moa.id.protocols.oauth20.protocol.OAuth20AuthRequest;
 import at.gv.egovernment.moa.id.protocols.pvp2x.builder.PVPAttributeBuilder;
 import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
 import at.gv.egovernment.moa.logging.Logger;
 
-import com.google.gson.JsonObject;
-import com.google.gson.JsonPrimitive;
-
 public final class OAuth20AttributeBuilder {
 	
 	private OAuth20AttributeBuilder() {
@@ -207,7 +206,7 @@ public final class OAuth20AttributeBuilder {
 	}
 	
 	private static void addAttibutes(final List<IAttributeBuilder> builders, final JsonObject jsonObject,
-			final OAAuthParameter oaParam, final IAuthData authData, OAuth20AuthRequest oAuthRequest) {
+			final IOAAuthParameters oaParam, final IAuthData authData, OAuth20AuthRequest oAuthRequest) {
 		for (IAttributeBuilder b : builders) {
 			try {
 				//TODO: better solution requires more refactoring :(
@@ -230,33 +229,33 @@ public final class OAuth20AttributeBuilder {
 	}
 	
 	public static void addScopeOpenId(final JsonObject jsonObject,
-			final OAAuthParameter oaParam, final IAuthData authData, 
+			final IOAAuthParameters oaParam, final IAuthData authData, 
 			final OAuth20AuthRequest oAuthRequest) {
 		addAttibutes(buildersOpenId, jsonObject, oaParam, authData, oAuthRequest);
 	}
 	
 	public static void addScopeProfile(final JsonObject jsonObject,
-			final OAAuthParameter oaParam, final IAuthData authData) {
+			final IOAAuthParameters oaParam, final IAuthData authData) {
 		addAttibutes(buildersProfile, jsonObject, oaParam, authData, null);
 	}
 	
 	public static void addScopeEID(final JsonObject jsonObject,
-			final OAAuthParameter oaParam, final IAuthData authData) {
+			final IOAAuthParameters oaParam, final IAuthData authData) {
 		addAttibutes(buildersEID, jsonObject, oaParam, authData, null);
 	}
 	
 	public static void addScopeEIDGov(final JsonObject jsonObject,
-			final OAAuthParameter oaParam, final IAuthData authData) {
+			final IOAAuthParameters oaParam, final IAuthData authData) {
 		addAttibutes(buildersEIDGov, jsonObject, oaParam, authData, null);
 	}
 	
 	public static void addScopeMandate(final JsonObject jsonObject,
-			final OAAuthParameter oaParam, final IAuthData authData) {
+			final IOAAuthParameters oaParam, final IAuthData authData) {
 		addAttibutes(buildersMandate, jsonObject, oaParam, authData, null);
 	}
 	
 	public static void addScopeSTORK(final JsonObject jsonObject,
-			final OAAuthParameter oaParam, final IAuthData authData) {
+			final IOAAuthParameters oaParam, final IAuthData authData) {
 		addAttibutes(buildersSTORK, jsonObject, oaParam, authData, null);
 	}
 
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdAudiencesAttribute.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdAudiencesAttribute.java
index e81132ca7..a43c8fce9 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdAudiencesAttribute.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdAudiencesAttribute.java
@@ -22,7 +22,7 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.protocols.oauth20.attributes;
 
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
 import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
 import at.gv.egovernment.moa.id.data.IAuthData;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder;
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdAuthenticationTimeAttribute.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdAuthenticationTimeAttribute.java
index c4260db82..c6775b692 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdAuthenticationTimeAttribute.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdAuthenticationTimeAttribute.java
@@ -22,7 +22,7 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.protocols.oauth20.attributes;
 
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
 import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
 import at.gv.egovernment.moa.id.data.IAuthData;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder;
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdExpirationTimeAttribute.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdExpirationTimeAttribute.java
index 6008eede1..5f32e32a2 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdExpirationTimeAttribute.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdExpirationTimeAttribute.java
@@ -24,7 +24,7 @@ package at.gv.egovernment.moa.id.protocols.oauth20.attributes;
 
 import java.util.Date;
 
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
 import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
 import at.gv.egovernment.moa.id.data.IAuthData;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder;
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdIssueInstantAttribute.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdIssueInstantAttribute.java
index ad7fe68b9..04f38faf6 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdIssueInstantAttribute.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdIssueInstantAttribute.java
@@ -24,7 +24,7 @@ package at.gv.egovernment.moa.id.protocols.oauth20.attributes;
 
 import java.util.Date;
 
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
 import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
 import at.gv.egovernment.moa.id.data.IAuthData;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder;
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdIssuerAttribute.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdIssuerAttribute.java
index 5c4fe02df..ff19a618a 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdIssuerAttribute.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdIssuerAttribute.java
@@ -22,7 +22,7 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.protocols.oauth20.attributes;
 
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
 import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
 import at.gv.egovernment.moa.id.data.IAuthData;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder;
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdNonceAttribute.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdNonceAttribute.java
index d2636c259..eda276df2 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdNonceAttribute.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdNonceAttribute.java
@@ -22,12 +22,11 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.protocols.oauth20.attributes;
 
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
 import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.oauth20.protocol.OAuth20AuthRequest;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeGenerator;
+import at.gv.egovernment.moa.id.protocols.oauth20.protocol.OAuth20AuthRequest;
 import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
 import at.gv.egovernment.moa.util.MiscUtil;
 
@@ -42,7 +41,7 @@ public class OpenIdNonceAttribute implements IAttributeBuilder {
 		return g.buildStringAttribute(this.getName(), "", null);
 	}
 	
-	public <ATT> ATT build(OAAuthParameter oaParam, IAuthData authData, OAuth20AuthRequest oAuthRequest,
+	public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData, OAuth20AuthRequest oAuthRequest,
 			IAttributeGenerator<ATT> g) throws AttributeException { 
 		if (MiscUtil.isNotEmpty(oAuthRequest.getNonce()))
 			return g.buildStringAttribute(this.getName(), "", oAuthRequest.getNonce());
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdSubjectIdentifierAttribute.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdSubjectIdentifierAttribute.java
index 10af9cc32..7de90e98e 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdSubjectIdentifierAttribute.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/OpenIdSubjectIdentifierAttribute.java
@@ -22,7 +22,7 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.protocols.oauth20.attributes;
 
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
 import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
 import at.gv.egovernment.moa.id.data.IAuthData;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder;
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/ProfileDateOfBirthAttribute.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/ProfileDateOfBirthAttribute.java
index 4262d6bb3..3ebadba52 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/ProfileDateOfBirthAttribute.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/ProfileDateOfBirthAttribute.java
@@ -22,7 +22,7 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.protocols.oauth20.attributes;
 
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
 import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
 import at.gv.egovernment.moa.id.data.IAuthData;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder;
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/ProfileFamilyNameAttribute.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/ProfileFamilyNameAttribute.java
index da4f76e2d..89209b062 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/ProfileFamilyNameAttribute.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/ProfileFamilyNameAttribute.java
@@ -22,7 +22,7 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.protocols.oauth20.attributes;
 
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
 import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
 import at.gv.egovernment.moa.id.data.IAuthData;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder;
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/ProfileGivenNameAttribute.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/ProfileGivenNameAttribute.java
index 04a6ec60b..895037b2e 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/ProfileGivenNameAttribute.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/attributes/ProfileGivenNameAttribute.java
@@ -22,7 +22,7 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.protocols.oauth20.attributes;
 
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
 import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
 import at.gv.egovernment.moa.id.data.IAuthData;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder;
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/exceptions/OAuth20Exception.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/exceptions/OAuth20Exception.java
index 307615fbd..5dc36868b 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/exceptions/OAuth20Exception.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/exceptions/OAuth20Exception.java
@@ -22,9 +22,9 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.protocols.oauth20.exceptions;
 
-import at.gv.egovernment.moa.id.util.MOAIDMessageProvider;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 
-public class OAuth20Exception extends RuntimeException {
+public class OAuth20Exception extends MOAIDException {
 	
 	private static final long serialVersionUID = 1L;
 	
@@ -33,7 +33,7 @@ public class OAuth20Exception extends RuntimeException {
 	private String errorCode;
 	
 	public OAuth20Exception(final String errorCode, final String messageId, final Object[] parameters) {
-		super(MOAIDMessageProvider.getInstance().getMessage(messageId, parameters));
+		super(messageId, parameters);
 		this.errorCode = errorCode;
 		this.messageId = messageId;
 	}
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20AuthAction.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20AuthAction.java
index 88e26da76..803ae388f 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20AuthAction.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20AuthAction.java
@@ -30,19 +30,21 @@ import java.util.UUID;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
 import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.data.IAuthData;
+import at.gv.egovernment.moa.id.data.Pair;
 import at.gv.egovernment.moa.id.data.SLOInformationImpl;
 import at.gv.egovernment.moa.id.data.SLOInformationInterface;
 import at.gv.egovernment.moa.id.moduls.IAction;
-import at.gv.egovernment.moa.id.moduls.IRequest;
 import at.gv.egovernment.moa.id.protocols.oauth20.OAuth20Constants;
 import at.gv.egovernment.moa.id.protocols.oauth20.OAuth20SessionObject;
-import at.gv.egovernment.moa.id.protocols.oauth20.Pair;
 import at.gv.egovernment.moa.id.protocols.oauth20.attributes.OAuth20AttributeBuilder;
 import at.gv.egovernment.moa.id.protocols.oauth20.attributes.OpenIdExpirationTimeAttribute;
 import at.gv.egovernment.moa.id.protocols.oauth20.exceptions.OAuth20Exception;
@@ -51,28 +53,31 @@ import at.gv.egovernment.moa.id.protocols.oauth20.exceptions.OAuth20ServerErrorE
 import at.gv.egovernment.moa.id.protocols.oauth20.json.OAuth20SignatureUtil;
 import at.gv.egovernment.moa.id.protocols.oauth20.json.OAuthJsonToken;
 import at.gv.egovernment.moa.id.protocols.oauth20.json.OAuthSigner;
-import at.gv.egovernment.moa.id.storage.AssertionStorage;
+import at.gv.egovernment.moa.id.storage.ITransactionStorage;
 import at.gv.egovernment.moa.id.util.Random;
 import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.MiscUtil;
 
+@Service("OAuth20AuthAction")
 class OAuth20AuthAction implements IAction {
 	
+	@Autowired protected MOAReversionLogger revisionsLogger;
+	@Autowired protected ITransactionStorage transactionStorage;
+	
 	public SLOInformationInterface processRequest(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp,
 			IAuthData authData) throws MOAIDException {
 		
 		OAuth20AuthRequest oAuthRequest = (OAuth20AuthRequest) req;		
 		String responseType = oAuthRequest.getResponseType();
 		
-		MOAReversionLogger.getInstance().logEvent(req, MOAIDEventConstants.AUTHPROTOCOL_OPENIDCONNECT_AUTHREQUEST);
+		revisionsLogger.logEvent(req, MOAIDEventConstants.AUTHPROTOCOL_OPENIDCONNECT_AUTHREQUEST);
 		
 		String code = Random.nextRandom();		
 				
 		try {
 			
 			String accessToken = UUID.randomUUID().toString();
-			
-			Logger.debug("Stored session with id: " + code);
+						
+			Logger.debug("Build OAuth20SessionObject from authenticationData.");
 			OAuth20SessionObject o = new OAuth20SessionObject();
 			if (responseType.equals(OAuth20Constants.RESPONSE_CODE)) {
 				o.setScope(oAuthRequest.getScope());
@@ -86,8 +91,9 @@ class OAuth20AuthAction implements IAction {
 				throw new OAuth20ResponseTypeException();
 			}
 			
-			// store data in oath session			
-			AssertionStorage.getInstance().put(code, o);
+			// store data in oath session
+			
+			transactionStorage.put(code, o);
 			
 			Logger.debug("Saved OAuth20SessionObject in session with id: " + code);
 			
@@ -105,7 +111,7 @@ class OAuth20AuthAction implements IAction {
 			
 			
 			//TODO: maybe add bPK / wbPK to SLO information
-			SLOInformationInterface sloInformation = new SLOInformationImpl(req.getAuthURL(), accessToken, null, null, req.requestedModule());
+			SLOInformationInterface sloInformation = new SLOInformationImpl(req.getAuthURL(), req.getOnlineApplicationConfiguration().getPublicURLPrefix(), accessToken, null, null, req.requestedModule());
 			
 			return sloInformation;
 		}
@@ -113,8 +119,8 @@ class OAuth20AuthAction implements IAction {
 			Logger.warn("An error occur during OpenID-Connect idToken generation.", e);
 			
 			//remove OAuthSessionObject if it already exists
-			if (AssertionStorage.getInstance().containsKey(code)) {
-				AssertionStorage.getInstance().remove(code);
+			if (transactionStorage.containsKey(code)) {
+				transactionStorage.remove(code);
 			}
 			
 			if (e instanceof OAuth20Exception) {
@@ -147,7 +153,7 @@ class OAuth20AuthAction implements IAction {
 	
 	private Pair<String, String> buildIdToken(String scope, OAuth20AuthRequest oAuthRequest, IAuthData authData)
 			throws MOAIDException, SignatureException {
-		OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(oAuthRequest.getOAURL());
+		IOAAuthParameters oaParam = oAuthRequest.getOnlineApplicationConfiguration();
 		
 		OAuthSigner signer = OAuth20SignatureUtil.loadSigner(authData.getIssuer());
 		OAuthJsonToken token = new OAuthJsonToken(signer);
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20AuthRequest.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20AuthRequest.java
index e5d8db873..98fcdc8dc 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20AuthRequest.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20AuthRequest.java
@@ -22,18 +22,21 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.protocols.oauth20.protocol;
 
+import java.util.Collection;
 import java.util.HashMap;
-import java.util.List;
 import java.util.Map;
 
 import javax.servlet.http.HttpServletRequest;
 
-import org.opensaml.saml2.core.Attribute;
+import org.springframework.beans.factory.config.BeanDefinition;
+import org.springframework.context.annotation.Scope;
+import org.springframework.stereotype.Component;
 
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 import at.gv.egovernment.moa.id.commons.config.MOAIDConfigurationConstants;
-import at.gv.egovernment.moa.id.config.ConfigurationException;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder;
 import at.gv.egovernment.moa.id.protocols.oauth20.OAuth20Constants;
 import at.gv.egovernment.moa.id.protocols.oauth20.OAuth20Util;
 import at.gv.egovernment.moa.id.protocols.oauth20.attributes.OAuth20AttributeBuilder;
@@ -42,19 +45,24 @@ import at.gv.egovernment.moa.id.protocols.oauth20.exceptions.OAuth20Exception;
 import at.gv.egovernment.moa.id.protocols.oauth20.exceptions.OAuth20ResponseTypeException;
 import at.gv.egovernment.moa.id.protocols.oauth20.exceptions.OAuth20WrongParameterException;
 import at.gv.egovernment.moa.id.protocols.pvp2x.PVP2XProtocol;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.AttributQueryBuilder;
-import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder;
 import at.gv.egovernment.moa.logging.Logger;
 
+@Component("OAuth20AuthRequest")
+@Scope(value = BeanDefinition.SCOPE_PROTOTYPE)
 public class OAuth20AuthRequest extends OAuth20BaseRequest {
 	
 	/**
 	 * @param req
 	 * @throws ConfigurationException
 	 */
-	public OAuth20AuthRequest(HttpServletRequest req)
-			throws ConfigurationException {
-		super(req);
+	public OAuth20AuthRequest()  {
+		super();
+				
+		//AuthnRequest needs authentication
+		this.setNeedAuthentication(true);
+
+		//set protocol action, which should be executed after authentication
+		this.setAction(OAuth20AuthAction.class.getName());
 	}
 
 	private static final long serialVersionUID = 1L;
@@ -179,7 +187,7 @@ public class OAuth20AuthRequest extends OAuth20BaseRequest {
 		// check if client id and redirect uri are ok
 		try {
 			// OAOAUTH20 cannot be null at this point. check was done in base request
-			OAAuthParameter oAuthConfig = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(this.getOAURL());
+			IOAAuthParameters oAuthConfig = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(this.getOAURL());
 			
 			
 			if (!this.getClientID().equals(oAuthConfig.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_PROTOCOLS_OPENID_CLIENTID))
@@ -201,43 +209,36 @@ public class OAuth20AuthRequest extends OAuth20BaseRequest {
 	 * @see at.gv.egovernment.moa.id.moduls.RequestImpl#getRequestedAttributes()
 	 */
 	@Override
-	public List<Attribute> getRequestedAttributes() {
+	public Collection<String> getRequestedAttributes() {
 		Map<String, String> reqAttr = new HashMap<String, String>();
 		for (String el : PVP2XProtocol.DEFAULTREQUESTEDATTRFORINTERFEDERATION)
 			reqAttr.put(el, "");
 						
-		try {
-			OAAuthParameter oa = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(getOAURL());
-			
-			for (String s : scope.split(" ")) {
-				if (s.equalsIgnoreCase("profile")) {
-					for (IAttributeBuilder el :OAuth20AttributeBuilder.getBuildersprofile())
-						reqAttr.put(el.getName(), "");
+		for (String s : scope.split(" ")) {
+			if (s.equalsIgnoreCase("profile")) {
+				for (IAttributeBuilder el :OAuth20AttributeBuilder.getBuildersprofile())
+					reqAttr.put(el.getName(), "");
 
-				} else if (s.equalsIgnoreCase("eID")) {
-					for (IAttributeBuilder el :OAuth20AttributeBuilder.getBuilderseid())
-						reqAttr.put(el.getName(), "");
-					
-				} else if (s.equalsIgnoreCase("eID_gov")) {
-					for (IAttributeBuilder el :OAuth20AttributeBuilder.getBuilderseidgov())
-						reqAttr.put(el.getName(), "");
-					
-				} else if (s.equalsIgnoreCase("mandate")) {
-					for (IAttributeBuilder el :OAuth20AttributeBuilder.getBuildersmandate())
-						reqAttr.put(el.getName(), "");
-					
-				} else if (s.equalsIgnoreCase("stork")) {
-					for (IAttributeBuilder el :OAuth20AttributeBuilder.getBuildersstork())
-						reqAttr.put(el.getName(), "");
-					
-				}
+			} else if (s.equalsIgnoreCase("eID")) {
+				for (IAttributeBuilder el :OAuth20AttributeBuilder.getBuilderseid())
+					reqAttr.put(el.getName(), "");
+				
+			} else if (s.equalsIgnoreCase("eID_gov")) {
+				for (IAttributeBuilder el :OAuth20AttributeBuilder.getBuilderseidgov())
+					reqAttr.put(el.getName(), "");
+				
+			} else if (s.equalsIgnoreCase("mandate")) {
+				for (IAttributeBuilder el :OAuth20AttributeBuilder.getBuildersmandate())
+					reqAttr.put(el.getName(), "");
+				
+			} else if (s.equalsIgnoreCase("stork")) {
+				for (IAttributeBuilder el :OAuth20AttributeBuilder.getBuildersstork())
+					reqAttr.put(el.getName(), "");
+				
 			}
-			
-			return AttributQueryBuilder.buildSAML2AttributeList(oa, reqAttr.keySet().iterator());
-			
-		} catch (ConfigurationException e) {
-			Logger.error("Load configuration for OA " + getOAURL() + " FAILED", e);
-			return null;
 		}
+		
+		//return attributQueryBuilder.buildSAML2AttributeList(this.getOnlineApplicationConfiguration(), reqAttr.keySet().iterator());
+		return reqAttr.keySet();
 	}
 }
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20BaseRequest.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20BaseRequest.java
index 5fcac0b2f..3ab283db5 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20BaseRequest.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20BaseRequest.java
@@ -31,14 +31,13 @@ import javax.servlet.http.HttpServletRequest;
 import org.apache.commons.lang.StringEscapeUtils;
 import org.apache.commons.lang.StringUtils;
 
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 import at.gv.egovernment.moa.id.commons.config.MOAIDConfigurationConstants;
-import at.gv.egovernment.moa.id.config.ConfigurationException;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
 import at.gv.egovernment.moa.id.moduls.RequestImpl;
 import at.gv.egovernment.moa.id.protocols.oauth20.OAuth20Constants;
 import at.gv.egovernment.moa.id.protocols.oauth20.exceptions.OAuth20Exception;
-import at.gv.egovernment.moa.id.protocols.oauth20.exceptions.OAuth20InvalidRequestException;
 import at.gv.egovernment.moa.id.protocols.oauth20.exceptions.OAuth20OANotSupportedException;
 import at.gv.egovernment.moa.id.protocols.oauth20.exceptions.OAuth20WrongParameterException;
 import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
@@ -49,11 +48,7 @@ abstract class OAuth20BaseRequest extends RequestImpl {
 	private static final long serialVersionUID = 1L;
 	
 	protected Set<String> allowedParameters = new HashSet<String>();
-	
-	public OAuth20BaseRequest(HttpServletRequest req) throws ConfigurationException {
-		super(req);
-	}
-	
+		
 	protected String getParam(final HttpServletRequest request, final String name, final boolean isNeeded) throws OAuth20Exception {
 		String param = request.getParameter(name);
 		Logger.debug("Reading param " + name + " from HttpServletRequest with value " + param);
@@ -76,12 +71,11 @@ abstract class OAuth20BaseRequest extends RequestImpl {
 				throw new OAuth20WrongParameterException(OAuth20Constants.PARAM_CLIENT_ID);
 			}
 			this.setOAURL(oaURL);
-			OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(oaURL);
+			IOAAuthParameters oaParam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(oaURL);
 			
 			if (oaParam == null) {
 				throw new OAuth20WrongParameterException(OAuth20Constants.PARAM_CLIENT_ID);
 			}
-			this.setTarget(oaParam.getTarget());
 			
 			if (StringUtils.isEmpty(oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_PROTOCOLS_OPENID_CLIENTSECRET)) 
 					|| StringUtils.isEmpty(oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_PROTOCOLS_OPENID_CLIENTID))
@@ -100,7 +94,7 @@ abstract class OAuth20BaseRequest extends RequestImpl {
 		this.checkAllowedParameters(request);
 	}
 	
-	private void checkAllowedParameters(final HttpServletRequest request) {
+	private void checkAllowedParameters(final HttpServletRequest request) throws OAuth20WrongParameterException {
 		Logger.debug("Going to check for allowed parameters");
 		this.allowedParameters.add(OAuth20Constants.PARAM_MOA_ACTION);
 		this.allowedParameters.add(OAuth20Constants.PARAM_MOA_MOD);
@@ -120,29 +114,4 @@ abstract class OAuth20BaseRequest extends RequestImpl {
 	
 	protected abstract void populateSpecialParameters(final HttpServletRequest request) throws OAuth20Exception;
 	
-	public static OAuth20BaseRequest newInstance(final String action, final HttpServletRequest request, String sessionId, String transactionId) throws OAuth20Exception {
-		OAuth20BaseRequest res;
-		try {
-			if (action.equals(OAuth20Protocol.AUTH_ACTION)) {
-				res = new OAuth20AuthRequest(request);
-			
-			} else if (action.equals(OAuth20Protocol.TOKEN_ACTION)) {
-				res = new OAuth20TokenRequest(request);
-			
-			} else {
-				throw new OAuth20InvalidRequestException();
-			}
-			
-		} catch (ConfigurationException e) {
-			Logger.warn(e.getMessage());
-			throw new OAuth20InvalidRequestException();
-			
-		}
-		
-		res.setAction(action);
-		res.setModule(OAuth20Protocol.NAME);
-		
-		res.populateParameters(request);
-		return res;
-	}
 }
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20Protocol.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20Protocol.java
index 70c29359e..e6ccc67b7 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20Protocol.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20Protocol.java
@@ -1,6 +1,8 @@
 package at.gv.egovernment.moa.id.protocols.oauth20.protocol;
 
+import java.io.IOException;
 import java.net.URLEncoder;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -9,12 +11,19 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.lang.StringUtils;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+import com.google.gson.JsonObject;
 
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.moduls.IAction;
-import at.gv.egovernment.moa.id.moduls.IModulInfo;
-import at.gv.egovernment.moa.id.moduls.IRequest;
+import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
+import at.gv.egovernment.moa.id.auth.exception.InvalidProtocolRequestException;
+import at.gv.egovernment.moa.id.auth.exception.ProtocolNotActiveException;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.moduls.RequestImpl;
+import at.gv.egovernment.moa.id.protocols.AbstractAuthProtocolModulController;
 import at.gv.egovernment.moa.id.protocols.oauth20.OAuth20Constants;
 import at.gv.egovernment.moa.id.protocols.oauth20.OAuth20Util;
 import at.gv.egovernment.moa.id.protocols.oauth20.exceptions.OAuth20Exception;
@@ -23,11 +32,8 @@ import at.gv.egovernment.moa.id.util.ErrorResponseUtils;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.MiscUtil;
 
-import com.google.gson.JsonObject;
-
-import java.util.Arrays;
-
-public class OAuth20Protocol implements IModulInfo {
+@Controller
+public class OAuth20Protocol extends AbstractAuthProtocolModulController {
 	
 	public static final String NAME = OAuth20Protocol.class.getName();
 	public static final String PATH = "id_oauth20";
@@ -40,14 +46,7 @@ public class OAuth20Protocol implements IModulInfo {
 					PVPConstants.EID_SECTOR_FOR_IDENTIFIER_NAME,
 					PVPConstants.BPK_NAME
 			});
-	
-	private static HashMap<String, IAction> actions = new HashMap<String, IAction>();
-	
-	static {
-		actions.put(AUTH_ACTION, new OAuth20AuthAction());
-		actions.put(TOKEN_ACTION, new OAuth20TokenAction());
-	}
-	
+		
 	public String getName() {
 		return NAME;
 	}
@@ -56,42 +55,83 @@ public class OAuth20Protocol implements IModulInfo {
 		return PATH;
 	}
 	
-	public IAction getAction(String action) {
-		return actions.get(action);
-	}
-	
-	/*
-	 * (non-Javadoc)
-	 * @see
-	 * at.gv.egovernment.moa.id.moduls.IModulInfo#preProcess(javax.servlet.http.HttpServletRequest,
-	 * javax.servlet.http.HttpServletResponse, java.lang.String)
+	/**
+	 * 
 	 */
-	public IRequest preProcess(HttpServletRequest request, HttpServletResponse resp, String action,
-			String sessionId, String transactionId) throws MOAIDException {
-		// validation is done inside creation
-		OAuth20BaseRequest res = OAuth20BaseRequest.newInstance(action, request, sessionId, transactionId);
-		Logger.debug("Created: " + res);
-		return res;
+	public OAuth20Protocol() {
+		super();
+		Logger.debug("Registering servlet " + getClass().getName() + 
+				" with mappings '/oauth2/auth' and '/oauth2/token'.");
 	}
 	
-	/*
-	 * (non-Javadoc)
-	 * @see
-	 * at.gv.egovernment.moa.id.moduls.IModulInfo#canHandleRequest(javax.servlet.http.HttpServletRequest
-	 * , javax.servlet.http.HttpServletResponse)
-	 */
-	public IAction canHandleRequest(HttpServletRequest request, HttpServletResponse response) {
-		if (!StringUtils.isEmpty(request.getParameter("action"))) {
-			if (request.getParameter("action").equals(AUTH_ACTION)) {
-				return getAction(AUTH_ACTION);
-			} else if (request.getParameter("action").equals(TOKEN_ACTION)) {
-				return getAction(TOKEN_ACTION);
-			}
+	//OpenID Connect auth request
+	@RequestMapping(value = "/oauth2/auth", method = {RequestMethod.POST, RequestMethod.GET})
+	public void openIDConnectAuthRequest(HttpServletRequest req, HttpServletResponse resp) throws MOAIDException, IOException {
+		if (!authConfig.getAllowedProtocols().isOAUTHActive()) {
+			Logger.info("OpenID-Connect is deaktivated!");
+			throw new ProtocolNotActiveException("auth.22", new java.lang.Object[] { NAME });
+			
+		}
+		
+		OAuth20AuthRequest pendingReq = applicationContext.getBean(OAuth20AuthRequest.class);
+		try {			
+			pendingReq.initialize(req);
+			pendingReq.setModule(OAuth20Protocol.NAME);		
+			pendingReq.populateParameters(req);
+			
+		} catch (OAuth20Exception e) {
+			Logger.info("OpenID-Connect request has a validation error: " + e.getMessage());
+			throw new InvalidProtocolRequestException(e.getMessageId(), e.getParameters(), e);
+			
 		}
 		
-		return null;// getAction(AUTH_ACTION);
+		revisionsLogger.logEvent(MOAIDEventConstants.SESSION_CREATED, pendingReq.getUniqueSessionIdentifier());
+		revisionsLogger.logEvent(MOAIDEventConstants.TRANSACTION_CREATED, pendingReq.getUniqueTransactionIdentifier());						
+		revisionsLogger.logEvent(
+				pendingReq.getUniqueSessionIdentifier(), 
+				pendingReq.getUniqueTransactionIdentifier(), 
+				MOAIDEventConstants.TRANSACTION_IP, 
+				req.getRemoteAddr());
+		
+		//process request
+		performAuthentication(req, resp, (RequestImpl)pendingReq);
+		
 	}
 	
+	//openID Connect tokken request
+	@RequestMapping(value = "/oauth2/token", method = {RequestMethod.POST, RequestMethod.GET})
+	public void OpenIDConnectTokkenRequest(HttpServletRequest req, HttpServletResponse resp) throws MOAIDException, IOException {
+		if (!authConfig.getAllowedProtocols().isOAUTHActive()) {
+			Logger.info("OpenID-Connect is deaktivated!");
+			throw new ProtocolNotActiveException("auth.22", new java.lang.Object[] { NAME });
+			
+		}
+		
+		OAuth20TokenRequest pendingReq = applicationContext.getBean(OAuth20TokenRequest.class);
+		try {			
+			pendingReq.initialize(req);
+			pendingReq.setModule(OAuth20Protocol.NAME);		
+			pendingReq.populateParameters(req);
+			
+		} catch (OAuth20Exception e) {
+			Logger.info("OpenID-Connect request has a validation error: " + e.getMessage());
+			throw new InvalidProtocolRequestException(e.getMessageId(), e.getParameters(), e);
+			
+		}
+				
+		revisionsLogger.logEvent(MOAIDEventConstants.SESSION_CREATED, pendingReq.getUniqueSessionIdentifier());
+		revisionsLogger.logEvent(MOAIDEventConstants.TRANSACTION_CREATED, pendingReq.getUniqueTransactionIdentifier());						
+		revisionsLogger.logEvent(
+				pendingReq.getUniqueSessionIdentifier(), 
+				pendingReq.getUniqueTransactionIdentifier(), 
+				MOAIDEventConstants.TRANSACTION_IP, 
+				req.getRemoteAddr());
+		
+		//process request
+		performAuthentication(req, resp, (RequestImpl)pendingReq);
+		
+	}
+			
 	/*
 	 * (non-Javadoc)
 	 * @see at.gv.egovernment.moa.id.moduls.IModulInfo#generateErrorMessage(java.lang.Throwable,
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20TokenAction.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20TokenAction.java
index 2238a25e1..9d78418cd 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20TokenAction.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20TokenAction.java
@@ -26,25 +26,32 @@ package at.gv.egovernment.moa.id.protocols.oauth20.protocol;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import com.google.gson.JsonObject;
+
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
 import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
 import at.gv.egovernment.moa.id.data.IAuthData;
 import at.gv.egovernment.moa.id.data.SLOInformationInterface;
 import at.gv.egovernment.moa.id.moduls.IAction;
-import at.gv.egovernment.moa.id.moduls.IRequest;
 import at.gv.egovernment.moa.id.protocols.oauth20.OAuth20SessionObject;
 import at.gv.egovernment.moa.id.protocols.oauth20.OAuth20Util;
 import at.gv.egovernment.moa.id.protocols.oauth20.exceptions.OAuth20ServerErrorException;
 import at.gv.egovernment.moa.id.protocols.oauth20.exceptions.OAuth20UnauthorizedClientException;
-import at.gv.egovernment.moa.id.storage.AssertionStorage;
+import at.gv.egovernment.moa.id.storage.ITransactionStorage;
 import at.gv.egovernment.moa.logging.Logger;
 
-import com.google.gson.JsonObject;
-
+@Service("OAuth20TokenAction")
 class OAuth20TokenAction implements IAction {
 	
+	@Autowired protected MOAReversionLogger revisionsLogger;
+	@Autowired protected ITransactionStorage transactionStorage;
+	
 	public SLOInformationInterface processRequest(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp,
 			IAuthData authData) throws MOAIDException {
 		
@@ -53,13 +60,13 @@ class OAuth20TokenAction implements IAction {
 		try {
 			OAuth20TokenRequest oAuthRequest = (OAuth20TokenRequest) req;
 		
-			MOAReversionLogger.getInstance().logEvent(req, MOAIDEventConstants.AUTHPROTOCOL_OPENIDCONNECT_TOKENREQUEST);
+			revisionsLogger.logEvent(req, MOAIDEventConstants.AUTHPROTOCOL_OPENIDCONNECT_TOKENREQUEST);
 			
 			try {
 				Logger.debug("Loaded OAuth20SessionObject from session: " + oAuthRequest.getCode());
 				
 				auth20SessionObject = 
-						AssertionStorage.getInstance().get(oAuthRequest.getCode(), OAuth20SessionObject.class);
+						transactionStorage.get(oAuthRequest.getCode(), OAuth20SessionObject.class);
 			
 			} catch (MOADatabaseException e) {
 				throw new OAuth20UnauthorizedClientException();
@@ -97,7 +104,7 @@ class OAuth20TokenAction implements IAction {
 				// destroy session for clean up
 
 				Logger.debug("Going to destroy session: " + auth20SessionObject.getCode());
-				AssertionStorage.getInstance().remove(auth20SessionObject.getCode());
+				transactionStorage.remove(auth20SessionObject.getCode());
 
 			}
 		}
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20TokenRequest.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20TokenRequest.java
index abfe4ce15..f35de9c58 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20TokenRequest.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20TokenRequest.java
@@ -22,16 +22,18 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.protocols.oauth20.protocol;
 
-import java.util.List;
+import java.util.Collection;
 
 import javax.servlet.http.HttpServletRequest;
 
-import org.opensaml.saml2.core.Attribute;
+import org.springframework.beans.factory.config.BeanDefinition;
+import org.springframework.context.annotation.Scope;
+import org.springframework.stereotype.Component;
 
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 import at.gv.egovernment.moa.id.commons.config.MOAIDConfigurationConstants;
-import at.gv.egovernment.moa.id.config.ConfigurationException;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
 import at.gv.egovernment.moa.id.protocols.oauth20.OAuth20Constants;
 import at.gv.egovernment.moa.id.protocols.oauth20.exceptions.OAuth20AccessDeniedException;
 import at.gv.egovernment.moa.id.protocols.oauth20.exceptions.OAuth20Exception;
@@ -39,15 +41,21 @@ import at.gv.egovernment.moa.id.protocols.oauth20.exceptions.OAuth20InvalidGrant
 import at.gv.egovernment.moa.id.protocols.oauth20.exceptions.OAuth20WrongParameterException;
 import at.gv.egovernment.moa.logging.Logger;
 
+@Component("OAuth20TokenRequest")
+@Scope(value = BeanDefinition.SCOPE_PROTOTYPE)
 class OAuth20TokenRequest extends OAuth20BaseRequest {
 	
 	/**
 	 * @param req
 	 * @throws ConfigurationException
 	 */
-	public OAuth20TokenRequest(HttpServletRequest req)
-			throws ConfigurationException {
-		super(req);
+	public OAuth20TokenRequest() {
+		super();
+		//AuthnRequest needs authentication
+		this.setNeedAuthentication(false);
+
+		//set protocol action, which should be executed after authentication
+		this.setAction(OAuth20TokenAction.class.getName());
 	}
 
 	private static final long serialVersionUID = 1L;
@@ -132,7 +140,7 @@ class OAuth20TokenRequest extends OAuth20BaseRequest {
 		// check if client id and secret are ok
 		try {
 			// OAOAUTH20 cannot be null at this point. check was done in base request
-			OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(this.getOAURL());
+			IOAAuthParameters oaParam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(this.getOAURL());
 			
 			if (!this.getClientID().equals(oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_PROTOCOLS_OPENID_CLIENTID))) {
 				throw new OAuth20AccessDeniedException();
@@ -160,7 +168,7 @@ class OAuth20TokenRequest extends OAuth20BaseRequest {
 	 * @see at.gv.egovernment.moa.id.moduls.RequestImpl#getRequestedAttributes()
 	 */
 	@Override
-	public List<Attribute> getRequestedAttributes() {
+	public Collection<String> getRequestedAttributes() {
 		return null;
 	}
 }
diff --git a/id/server/modules/moa-id-module-openID/src/main/resources/META-INF/services/at.gv.egovernment.moa.id.moduls.IModulInfo b/id/server/modules/moa-id-module-openID/src/main/resources/META-INF/services/at.gv.egovernment.moa.id.moduls.IModulInfo
deleted file mode 100644
index b653c91c3..000000000
--- a/id/server/modules/moa-id-module-openID/src/main/resources/META-INF/services/at.gv.egovernment.moa.id.moduls.IModulInfo
+++ /dev/null
@@ -1 +0,0 @@
-at.gv.egovernment.moa.id.protocols.oauth20.protocol.OAuth20Protocol
\ No newline at end of file
diff --git a/id/server/modules/moa-id-module-pvp2/.gitignore b/id/server/modules/moa-id-module-pvp2/.gitignore
new file mode 100644
index 000000000..b83d22266
--- /dev/null
+++ b/id/server/modules/moa-id-module-pvp2/.gitignore
@@ -0,0 +1 @@
+/target/
diff --git a/id/server/modules/moa-id-module-pvp2/pom.xml b/id/server/modules/moa-id-module-pvp2/pom.xml
new file mode 100644
index 000000000..0a71e27ce
--- /dev/null
+++ b/id/server/modules/moa-id-module-pvp2/pom.xml
@@ -0,0 +1,11 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>MOA.id.server.modules</groupId>
+    <artifactId>moa-id-modules</artifactId>
+    <version>${moa-id-version}</version>
+  </parent>
+  <artifactId>moa-id-module-pvp2</artifactId>
+  <name>PVP2 Module</name>
+  <description>PVP2.x authentication modul for MOA-ID-Auth</description>
+</project>
\ No newline at end of file
diff --git a/id/server/modules/moa-id-module-ssoTransfer/pom.xml b/id/server/modules/moa-id-module-ssoTransfer/pom.xml
new file mode 100644
index 000000000..b15d7dc85
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/pom.xml
@@ -0,0 +1,56 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>MOA.id.server.modules</groupId>
+    <artifactId>moa-id-modules</artifactId>
+    <version>${moa-id-version}</version>
+  </parent>
+  <artifactId>moa-id-module-ssoTransfer</artifactId>
+  <name>MOA-ID_SSO_Transfer_modul</name>
+  <description>MOA-ID modul to transfer Single Sign-On sessions to other devices</description>
+  
+  <dependencies>
+  	<dependency>
+			<groupId>net.glxn</groupId>
+			<artifactId>qrgen</artifactId>
+			<version>1.4</version>
+		</dependency>
+		
+				<!-- JSON JWT implementation -->
+		<dependency>
+			<groupId>com.googlecode.jsontoken</groupId>
+			<artifactId>jsontoken</artifactId>
+			<version>1.1</version>
+			<exclusions>
+				<exclusion>
+					<groupId>javax.servlet</groupId>
+					<artifactId>servlet-api</artifactId>
+				</exclusion>
+				<exclusion>
+					<artifactId>google-collections</artifactId>
+					<groupId>com.google.collections</groupId>
+				</exclusion>
+			</exclusions>
+		</dependency>
+		
+		<dependency>
+			<groupId>org.bouncycastle</groupId>
+			<artifactId>bcprov-jdk15on</artifactId>
+			<version>1.52</version>
+			<!-- <scope>provided</scope> -->
+		</dependency>
+		
+		<dependency>
+			<groupId>org.bouncycastle</groupId>
+			<artifactId>bcpkix-jdk15on</artifactId>
+			<version>1.52</version>
+		</dependency>
+		
+		<dependency>
+    	<groupId>MOA.id.server</groupId>
+  		<artifactId>moa-id-frontend-resources</artifactId>
+    </dependency>
+		
+  </dependencies>
+  
+</project>
\ No newline at end of file
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/SSOTransferAuthModuleImpl.java b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/SSOTransferAuthModuleImpl.java
new file mode 100644
index 000000000..2a2b7bf80
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/SSOTransferAuthModuleImpl.java
@@ -0,0 +1,76 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.ssotransfer;
+
+import at.gv.egovernment.moa.id.auth.modules.AuthModule;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+
+/**
+ * @author tlenz
+ *
+ */
+public class SSOTransferAuthModuleImpl implements AuthModule{
+
+	private int priority = 1;
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.AuthModule#getPriority()
+	 */
+	@Override
+	public int getPriority() {
+		return priority;
+	}
+
+	/**
+	 * Sets the priority of this module. Default value is {@code 0}.
+	 * @param priority The priority.
+	 */
+	public void setPriority(int priority) {
+		this.priority = priority;
+	}
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.AuthModule#selectProcess(at.gv.egovernment.moa.id.process.api.ExecutionContext)
+	 */
+	@Override
+	public String selectProcess(ExecutionContext context) {		
+		Object restoreSSOSessionObj = context.get("restoreSSOSession");
+		if (restoreSSOSessionObj != null && restoreSSOSessionObj instanceof String) {
+			boolean restoreSSOSession = (boolean) Boolean.parseBoolean((String)restoreSSOSessionObj);
+			if (restoreSSOSession)
+				return "SSOTransferAuthentication";
+			
+		}
+		
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.AuthModule#getProcessDefinitions()
+	 */
+	@Override
+	public String[] getProcessDefinitions() {
+		return new String[] { "classpath:at/gv/egovernment/moa/id/auth/modules/ssotransfer/SSOTransferAuthentication.process.xml" };
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/SSOTransferConstants.java b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/SSOTransferConstants.java
new file mode 100644
index 000000000..1a4356653
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/SSOTransferConstants.java
@@ -0,0 +1,76 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.ssotransfer;
+
+/**
+ * @author tlenz
+ *
+ */
+public class SSOTransferConstants {
+
+	public static final String MOASESSION_DATA_HOLDEROFKEY_CERTIFICATE = "holderofkey_cert";
+	
+	public static final String DH_PRIME_BASE64 = "AO672PgS9gv0vLTDDISxnZ61aroRrvj53F4CX1ffNNdU+PYPv6ff3pkmuaw3av41tpD/Y0ypcCEPLh39GemNDUnehwBfi6PocHdDGPhTvhan5kYgDoWPWebA9P3Qy3eUdslwU+Eusr0SBhN+Cssw7XZ0nue5IiOjBxdzdijJiojH";
+	public static final String DH_GENERATOR_BASE64 = "NuuDqMxQa7T3XP4H6OFR30imozmM0Eho0na9gXak+Qs+J9uE/3xgHspz9PYO/6Lk2wgeOk42Pk4MHamKVPCLdqztlmEFgKPwHiAwNdNr4PklonLWk5zPSEYDVUt/8IFmK+cu0cPomACo0AfSCSZqdexq0FnFey/5mBjOGPimOJQ="; 
+	
+	public static final String SERVLET_SSOTRANSFER_GUI = "/TransferSSOSession";
+	public static final String SERVLET_SSOTRANSFER_TO_SMARTPHONE = "/TransmitSSOSession";	
+	public static final String SERVLET_SSOTRANSFER_FROM_SMARTPHONE = "/SSOTransferSignalEndpoint";
+	
+	public static final String REQ_PARAM_GENERATE_QR = "createQR";
+	public static final String REQ_PARAM_TOKEN = "token";
+	
+	public static final String SSOCONTAINER_KEY_TYPE = "type";
+	public static final String SSOCONTAINER_VALUE_TYPE_TRANSER = "TRANSFER";
+	public static final String SSOCONTAINER_VALUE_TYPE_PERSIST = "PERSIST";
+	public static final String SSOCONTAINER_VALUE_TYPE_SSO = "SSO";
+	
+	public static final String SSOCONTAINER_KEY_URL = "url";
+	
+	public static final String SSOCONTAINER_KEY_DH_PUBKEY = "pubKey";
+	public static final String SSOCONTAINER_KEY_DH_PRIME = "prime";
+	public static final String SSOCONTAINER_KEY_DH_GENERATOR = "generator";
+	
+	public static final String SSOCONTAINER_KEY_CSR = "certificate";
+	
+	public static final String SSOCONTAINER_KEY_VALIDTO = "validTo";
+	public static final String SSOCONTAINER_KEY_ENTITYID = "entityID";
+	public static final String SSOCONTAINER_KEY_USERID = "userID";
+	public static final String SSOCONTAINER_KEY_SESSION = "session";
+	public static final String SSOCONTAINER_KEY_RESULTENDPOINT = "resultEndPoint";
+	public static final String SSOCONTAINER_KEY_NONCE = "nonce";
+	public static final String SSOCONTAINER_KEY_BLOB = "blob";
+	public static final String SSOCONTAINER_KEY_SIGNATURE = "signature";
+	public static final String SSOCONTAINER_KEY_UNIQUEUSERID = "bPK";
+	
+	public static final String SSOCONTAINER_KEY_STATUS = "status";
+	
+	public static final String FLAG_SSO_SESSION_RESTORED = "ssoRestoredFlag";
+	public static final long CERT_VALIDITY = 700; //2 years
+
+	public static final String PENDINGREQ_DH = "dhparams";
+	public static final String PENDINGREQ_NONCE = "nonce";
+
+	
+	
+}
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/SSOTransferSpringResourceProvider.java b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/SSOTransferSpringResourceProvider.java
new file mode 100644
index 000000000..1c7a9f124
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/SSOTransferSpringResourceProvider.java
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.ssotransfer;
+
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
+
+import at.gv.egiz.components.spring.api.SpringResourceProvider;
+
+/**
+ * @author tlenz
+ *
+ */
+public class SSOTransferSpringResourceProvider implements SpringResourceProvider {
+
+	/* (non-Javadoc)
+	 * @see at.gv.egiz.components.spring.api.SpringResourceProvider#getResourcesToLoad()
+	 */
+	@Override
+	public Resource[] getResourcesToLoad() {
+		ClassPathResource ssoTransferAuthConfig = new ClassPathResource("/moaid_ssotransfer_auth.beans.xml", SSOTransferSpringResourceProvider.class);							
+		return new Resource[] {ssoTransferAuthConfig};
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egiz.components.spring.api.SpringResourceProvider#getPackagesToScan()
+	 */
+	@Override
+	public String[] getPackagesToScan() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egiz.components.spring.api.SpringResourceProvider#getName()
+	 */
+	@Override
+	public String getName() {
+		return "SSO Transfer Module";
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/data/Pair.java b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/data/Pair.java
new file mode 100644
index 000000000..47351b2bd
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/data/Pair.java
@@ -0,0 +1,21 @@
+package at.gv.egovernment.moa.id.auth.modules.ssotransfer.data;
+
+import java.io.Serializable;
+
+public class Pair<F,S> implements Serializable {
+    /**
+	 * 
+	 */
+	private static final long serialVersionUID = -1677989418252218345L;
+	
+	private F l;
+    private S r;
+    public Pair(F l, S r){
+        this.l = l;
+        this.r = r;
+    }
+    public F getF(){ return l; }
+    public S getS(){ return r; }
+    public void setF(F l){ this.l = l; }
+    public void setS(S r){ this.r = r; }
+}
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/data/SSOTransferAuthenticationData.java b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/data/SSOTransferAuthenticationData.java
new file mode 100644
index 000000000..78cbd788d
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/data/SSOTransferAuthenticationData.java
@@ -0,0 +1,365 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.ssotransfer.data;
+
+import java.security.cert.CertificateEncodingException;
+import java.util.Date;
+import java.util.List;
+
+import org.w3c.dom.Element;
+
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.data.IdentityLink;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
+import at.gv.egovernment.moa.id.data.AuthenticationRole;
+import at.gv.egovernment.moa.id.data.IAuthData;
+import at.gv.egovernment.moa.id.data.MISMandate;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+public class SSOTransferAuthenticationData implements IAuthData {
+
+	private AuthenticationSession authSession = null;
+	boolean isIDPPrivateService = true;
+	
+	public SSOTransferAuthenticationData(AuthConfiguration authConfig, AuthenticationSession authSession) throws ConfigurationException {
+		this.authSession = authSession;
+		String domainIdentifier = authConfig.getSSOTagetIdentifier();
+		if (domainIdentifier != null)
+			isIDPPrivateService = domainIdentifier.startsWith(MOAIDAuthConstants.PREFIX_WPBK);
+		
+	}
+	
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getIssueInstant()
+	 */
+	@Override
+	public Date getIssueInstant() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getIssuer()
+	 */
+	@Override
+	public String getIssuer() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#isBusinessService()
+	 */
+	@Override
+	public boolean isBusinessService() {
+		return this.isIDPPrivateService;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#isSsoSession()
+	 */
+	@Override
+	public boolean isSsoSession() {
+		return true;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#isUseMandate()
+	 */
+	@Override
+	public boolean isUseMandate() {
+		return this.authSession.isMandateUsed();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getFamilyName()
+	 */
+	@Override
+	public String getFamilyName() {
+		return this.authSession.getIdentityLink().getFamilyName();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getGivenName()
+	 */
+	@Override
+	public String getGivenName() {
+		return this.authSession.getIdentityLink().getGivenName();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getDateOfBirth()
+	 */
+	@Override
+	public Date getDateOfBirth() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getFormatedDateOfBirth()
+	 */
+	@Override
+	public String getFormatedDateOfBirth() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getBPK()
+	 */
+	@Override
+	public String getBPK() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getBPKType()
+	 */
+	@Override
+	public String getBPKType() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getSsoSessionValidTo()
+	 */
+	@Override
+	public Date getSsoSessionValidTo() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getIdentificationValue()
+	 */
+	@Override
+	public String getIdentificationValue() {
+		return this.authSession.getIdentityLink().getIdentificationValue();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getIdentificationType()
+	 */
+	@Override
+	public String getIdentificationType() {
+		return this.authSession.getIdentityLink().getIdentificationType();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getBkuURL()
+	 */
+	@Override
+	public String getBkuURL() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getEncbPKList()
+	 */
+	@Override
+	public List<String> getEncbPKList() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getIdentityLink()
+	 */
+	@Override
+	public IdentityLink getIdentityLink() {
+		return this.authSession.getIdentityLink();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getSignerCertificate()
+	 */
+	@Override
+	public byte[] getSignerCertificate() {
+		try {
+			return this.authSession.getSignerCertificate().getEncoded();
+			
+		} catch (CertificateEncodingException e) {
+			Logger.error("SSO-Transfer: SignerCertificate encoding FAILED.", e);
+			return null;
+		}
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getAuthBlock()
+	 */
+	@Override
+	public String getAuthBlock() {
+		return this.authSession.getAuthBlock();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getPvpAttribute_OU()
+	 */
+	@Override
+	public String getPvpAttribute_OU() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getAuthenticationRoles()
+	 */
+	@Override
+	public List<AuthenticationRole> getAuthenticationRoles() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#isPublicAuthority()
+	 */
+	@Override
+	public boolean isPublicAuthority() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getPublicAuthorityCode()
+	 */
+	@Override
+	public String getPublicAuthorityCode() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#isQualifiedCertificate()
+	 */
+	@Override
+	public boolean isQualifiedCertificate() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getMISMandate()
+	 */
+	@Override
+	public MISMandate getMISMandate() {
+		return this.authSession.getMISMandate();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getMandate()
+	 */
+	@Override
+	public Element getMandate() {
+		return this.authSession.getMISMandate().getMandateDOM();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getMandateReferenceValue()
+	 */
+	@Override
+	public String getMandateReferenceValue() {
+		return this.authSession.getMandateReferenceValue();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getQAALevel()
+	 */
+	@Override
+	public String getQAALevel() {
+		return this.authSession.getQAALevel();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getSessionIndex()
+	 */
+	@Override
+	public String getSessionIndex() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getNameID()
+	 */
+	@Override
+	public String getNameID() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getNameIDFormat()
+	 */
+	@Override
+	public String getNameIDFormat() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#isForeigner()
+	 */
+	@Override
+	public boolean isForeigner() {
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getCcc()
+	 */
+	@Override
+	public String getCcc() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getEIDASQAALevel()
+	 */
+	@Override
+	public String getEIDASQAALevel() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.data.IAuthData#getGenericData(java.lang.String, java.lang.Class)
+	 */
+	@Override
+	public <T> T getGenericData(String key, Class<T> clazz) {		
+		return this.authSession.getGenericDataFromSession(key, clazz);
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/data/SSOTransferContainer.java b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/data/SSOTransferContainer.java
new file mode 100644
index 000000000..eecf03b71
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/data/SSOTransferContainer.java
@@ -0,0 +1,107 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.ssotransfer.data;
+
+import java.io.Serializable;
+import java.math.BigInteger;
+import java.security.PrivateKey;
+
+import javax.crypto.spec.DHPublicKeySpec;
+
+/**
+ * @author tlenz
+ *
+ */
+public class SSOTransferContainer implements Serializable {
+
+	private static final long serialVersionUID = 3762458954168085854L;
+	
+	private String authURL = null;
+	private String tokkenID = null;
+	private String moaSessionID = null;
+
+	//DH parameters
+	private PrivateKey dh_privKey;
+	private BigInteger dh_pubKey;
+	private BigInteger dh_prime;
+	private BigInteger dh_generator;	
+	
+		
+	/**
+	 * @return the authURL
+	 */
+	public String getAuthURL() {
+		return authURL;
+	}
+	/**
+	 * @param authURL the authURL to set
+	 */
+	public void setAuthURL(String authURL) {
+		this.authURL = authURL;
+	}
+	/**
+	 * @return the tokkenID
+	 */
+	public String getTokkenID() {
+		return tokkenID;
+	}
+	/**
+	 * @param tokkenID the tokkenID to set
+	 */
+	public void setTokkenID(String tokkenID) {
+		this.tokkenID = tokkenID;
+	}
+	/**
+	 * @return the moaSessionID
+	 */
+	public String getMoaSessionID() {
+		return moaSessionID;
+	}
+	/**
+	 * @param moaSessionID the moaSessionID to set
+	 */
+	public void setMoaSessionID(String moaSessionID) {
+		this.moaSessionID = moaSessionID;
+	}
+	/**
+	 * @return the dhParams
+	 */
+	public Pair<DHPublicKeySpec, PrivateKey> getDhParams() {
+		return new Pair<DHPublicKeySpec, PrivateKey>(new DHPublicKeySpec(this.dh_pubKey, 
+				this.dh_prime, 
+				this.dh_generator), this.dh_privKey);
+	}
+	/**
+	 * @param dhParams the dhParams to set
+	 */
+	public void setDhParams(Pair<DHPublicKeySpec, PrivateKey> dhParams) {
+		this.dh_privKey = dhParams.getS();
+		
+		this.dh_pubKey = dhParams.getF().getY();
+		this.dh_prime = dhParams.getF().getP();
+		this.dh_generator = dhParams.getF().getG();
+	}
+	
+	
+	
+}
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/data/SSOTransferOnlineApplication.java b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/data/SSOTransferOnlineApplication.java
new file mode 100644
index 000000000..af180ff10
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/data/SSOTransferOnlineApplication.java
@@ -0,0 +1,444 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.ssotransfer.data;
+
+import java.security.PrivateKey;
+import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.data.CPEPS;
+import at.gv.egovernment.moa.id.commons.api.data.SAML1ConfigurationParameters;
+import at.gv.egovernment.moa.id.commons.api.data.StorkAttribute;
+import at.gv.egovernment.moa.id.commons.api.data.StorkAttributeProviderPlugin;
+
+/**
+ * @author tlenz
+ *
+ */
+public class SSOTransferOnlineApplication implements IOAAuthParameters {
+
+	public SSOTransferOnlineApplication() {
+		
+	}
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getBusinessService()
+	 */
+	@Override
+	public boolean getBusinessService() {
+		return false;
+	}
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#useSSO()
+	 */
+	@Override
+	public boolean useSSO() {
+		return true;
+	}
+	
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getBKUURL()
+	 */
+	@Override
+	public List<String> getBKUURL() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+	
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getFullConfiguration()
+	 */
+	@Override
+	public Map<String, String> getFullConfiguration() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getConfigurationValue(java.lang.String)
+	 */
+	@Override
+	public String getConfigurationValue(String key) {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getFriendlyName()
+	 */
+	@Override
+	public String getFriendlyName() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getPublicURLPrefix()
+	 */
+	@Override
+	public String getPublicURLPrefix() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getOaType()
+	 */
+	@Override
+	public String getOaType() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getTarget()
+	 */
+	@Override
+	public String getTarget() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getTargetFriendlyName()
+	 */
+	@Override
+	public String getTargetFriendlyName() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#isInderfederationIDP()
+	 */
+	@Override
+	public boolean isInderfederationIDP() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#isSTORKPVPGateway()
+	 */
+	@Override
+	public boolean isSTORKPVPGateway() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getIdentityLinkDomainIdentifier()
+	 */
+	@Override
+	public String getIdentityLinkDomainIdentifier() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getKeyBoxIdentifier()
+	 */
+	@Override
+	public String getKeyBoxIdentifier() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getSAML1Parameter()
+	 */
+	@Override
+	public SAML1ConfigurationParameters getSAML1Parameter() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getTemplateURL()
+	 */
+	@Override
+	public List<String> getTemplateURL() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getAditionalAuthBlockText()
+	 */
+	@Override
+	public String getAditionalAuthBlockText() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getBKUURL(java.lang.String)
+	 */
+	@Override
+	public String getBKUURL(String bkutype) {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#useSSOQuestion()
+	 */
+	@Override
+	public boolean useSSOQuestion() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getMandateProfiles()
+	 */
+	@Override
+	public List<String> getMandateProfiles() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getIdentityLinkDomainIdentifierType()
+	 */
+	@Override
+	public String getIdentityLinkDomainIdentifierType() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#isShowMandateCheckBox()
+	 */
+	@Override
+	public boolean isShowMandateCheckBox() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#isOnlyMandateAllowed()
+	 */
+	@Override
+	public boolean isOnlyMandateAllowed() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#isShowStorkLogin()
+	 */
+	@Override
+	public boolean isShowStorkLogin() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getQaaLevel()
+	 */
+	@Override
+	public Integer getQaaLevel() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#isRequireConsentForStorkAttributes()
+	 */
+	@Override
+	public boolean isRequireConsentForStorkAttributes() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getRequestedSTORKAttributes()
+	 */
+	@Override
+	public Collection<StorkAttribute> getRequestedSTORKAttributes() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getBKUSelectionTemplate()
+	 */
+	@Override
+	public byte[] getBKUSelectionTemplate() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getSendAssertionTemplate()
+	 */
+	@Override
+	public byte[] getSendAssertionTemplate() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getPepsList()
+	 */
+	@Override
+	public Collection<CPEPS> getPepsList() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getIDPAttributQueryServiceURL()
+	 */
+	@Override
+	public String getIDPAttributQueryServiceURL() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#isInboundSSOInterfederationAllowed()
+	 */
+	@Override
+	public boolean isInboundSSOInterfederationAllowed() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#isInterfederationSSOStorageAllowed()
+	 */
+	@Override
+	public boolean isInterfederationSSOStorageAllowed() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#isOutboundSSOInterfederationAllowed()
+	 */
+	@Override
+	public boolean isOutboundSSOInterfederationAllowed() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#isTestCredentialEnabled()
+	 */
+	@Override
+	public boolean isTestCredentialEnabled() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getTestCredentialOIDs()
+	 */
+	@Override
+	public List<String> getTestCredentialOIDs() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#isUseIDLTestTrustStore()
+	 */
+	@Override
+	public boolean isUseIDLTestTrustStore() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#isUseAuthBlockTestTestStore()
+	 */
+	@Override
+	public boolean isUseAuthBlockTestTestStore() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getBPKDecBpkDecryptionKey()
+	 */
+	@Override
+	public PrivateKey getBPKDecBpkDecryptionKey() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#isPassivRequestUsedForInterfederation()
+	 */
+	@Override
+	public boolean isPassivRequestUsedForInterfederation() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#isPerformLocalAuthenticationOnInterfederationError()
+	 */
+	@Override
+	public boolean isPerformLocalAuthenticationOnInterfederationError() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getStorkAPs()
+	 */
+	@Override
+	public Collection<StorkAttributeProviderPlugin> getStorkAPs() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#getReversionsLoggingEventCodes()
+	 */
+	@Override
+	public List<Integer> getReversionsLoggingEventCodes() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.config.auth.IOAAuthParameters#isRemovePBKFromAuthBlock()
+	 */
+	@Override
+	public boolean isRemovePBKFromAuthBlock() {
+		// TODO Auto-generated method stub
+		return false;
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/servlet/SSOTransferServlet.java b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/servlet/SSOTransferServlet.java
new file mode 100644
index 000000000..b18425839
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/servlet/SSOTransferServlet.java
@@ -0,0 +1,634 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.ssotransfer.servlet;
+
+import java.io.BufferedReader;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.PrintWriter;
+import java.math.BigInteger;
+import java.net.URL;
+import java.security.InvalidKeyException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.SecureRandom;
+import java.security.Security;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.InvalidParameterSpecException;
+import java.util.Date;
+
+import javax.crypto.BadPaddingException;
+import javax.crypto.Cipher;
+import javax.crypto.IllegalBlockSizeException;
+import javax.crypto.NoSuchPaddingException;
+import javax.crypto.spec.DHParameterSpec;
+import javax.crypto.spec.DHPublicKeySpec;
+import javax.security.cert.CertificateException;
+import javax.security.cert.X509Certificate;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x509.BasicConstraints;
+import org.bouncycastle.asn1.x509.Extension;
+import org.bouncycastle.cert.X509CertificateHolder;
+import org.bouncycastle.cert.X509v3CertificateBuilder;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.ContentVerifierProvider;
+import org.bouncycastle.operator.OperatorCreationException;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+import org.bouncycastle.operator.jcajce.JcaContentVerifierProviderBuilder;
+import org.bouncycastle.pkcs.PKCS10CertificationRequest;
+import org.bouncycastle.pkcs.PKCSException;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
+import at.gv.egovernment.moa.id.auth.exception.ParseException;
+import at.gv.egovernment.moa.id.auth.frontend.builder.DefaultGUIFormBuilderConfiguration;
+import at.gv.egovernment.moa.id.auth.frontend.builder.IGUIFormBuilder;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.SSOTransferConstants;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.data.Pair;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.data.SSOTransferContainer;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.utils.SSOContainerUtils;
+import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.commons.api.exceptions.SessionDataStorageException;
+import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
+import at.gv.egovernment.moa.id.moduls.SSOManager;
+import at.gv.egovernment.moa.id.protocols.pvp2x.signer.CredentialsNotAvailableException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.signer.IDPCredentialProvider;
+import at.gv.egovernment.moa.id.storage.IAuthenticationSessionStoreage;
+import at.gv.egovernment.moa.id.storage.ITransactionStorage;
+import at.gv.egovernment.moa.id.util.HTTPUtils;
+import at.gv.egovernment.moa.id.util.Random;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.Base64Utils;
+import at.gv.egovernment.moa.util.FileUtils;
+import at.gv.egovernment.moa.util.MiscUtil;
+import net.glxn.qrgen.QRCode;
+import net.glxn.qrgen.image.ImageType;
+
+
+
+/**
+ * @author tlenz
+ *
+ */
+//@WebServlet(name = "SSOTransferGUI", value = "/TransferSSOSession")
+@Controller
+public class SSOTransferServlet{
+
+	private static final long transmisionTimeOut = 90 * 1000; // default 90 secundes
+	
+	@Autowired SSOManager ssomanager;
+	@Autowired IAuthenticationSessionStoreage authenticationSessionStorage;
+	@Autowired SSOContainerUtils ssoTransferUtils;
+	@Autowired ITransactionStorage transactionStorage;
+	@Autowired IDPCredentialProvider idpCredentials;
+	@Autowired AuthConfiguration authConfig;
+	@Autowired IGUIFormBuilder guiBuilder;
+	
+	public SSOTransferServlet() {
+		super();
+		Logger.debug("Registering servlet " + getClass().getName() 
+				+ " with mapping {'/TransferSSOSession','/TransmitSSOSession'}"
+				+ " Development-EndPoints: {'/TestTransferSSOSession','/TestTransmitSSOSession'}.");		
+	}
+
+	/**
+	 * Only for development and debugging
+	 * This methode create template QR and for the template service
+	 * 
+	 * @param req
+	 * @param resp
+	 * @throws IOException
+	 */
+	@RequestMapping(value = {	"/TestTransferSSOSession"
+							}, 
+							method = {RequestMethod.GET})
+	public void testTransferSSOSessionGUIWithoutAuthentication(HttpServletRequest req, HttpServletResponse resp) throws IOException {				
+		try {
+			//create first step of SSO Transfer GUI
+			String authURL = HTTPUtils.extractAuthURLFromRequest(req);
+			if (!AuthConfigurationProviderFactory.getInstance().getPublicURLPrefix().contains(authURL)) {						
+				Logger.warn("Requested URL is not allowed.");;
+				resp.sendError(500, "Requested URL is not allowed.");
+
+			}
+
+			DefaultGUIFormBuilderConfiguration config = new DefaultGUIFormBuilderConfiguration(
+					authURL, 
+					DefaultGUIFormBuilderConfiguration.VIEW_SSO_SESSION_TRANSFER, 
+					null);
+			
+			internalCreateQRCodeForTransfer(resp, authURL, 
+					"123456", "/TestTransmitSSOSession", config);
+
+		} catch (MOAIDException | MOADatabaseException e) {
+			e.printStackTrace();
+			resp.sendError(500, e.getMessage());
+
+		} catch (NoSuchAlgorithmException | InvalidParameterSpecException e) {
+			e.printStackTrace();
+			resp.sendError(500, e.getMessage());
+
+		} catch (Exception e) {
+			e.printStackTrace();
+			resp.sendError(500, e.getMessage());
+		}							
+	}
+
+	/**
+	 * Only for development and debugging
+	 * This methode transfer personal information to smartphone
+	 * 
+	 * @param req
+	 * @param resp
+	 * @throws IOException
+	 */
+	@RequestMapping(value = {	"/TestTransmitSSOSession"
+							},  
+							method = {RequestMethod.GET, RequestMethod.POST})	
+	public void testTransferToPhone(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+		Logger.debug("Receive " + this.getClass().getName() + " request");
+		Object tokenObj = req.getParameter(SSOTransferConstants.REQ_PARAM_TOKEN);		
+		if (tokenObj != null && tokenObj instanceof String) {
+			String token = (String)tokenObj;
+			try {
+				Logger.debug("Load token:" + token + " from storage.");
+				SSOTransferContainer container = transactionStorage.get(token, SSOTransferContainer.class, transmisionTimeOut * 1000);
+				if (container != null) {
+					AuthenticationSession moaSession = new AuthenticationSession("123456", new Date());
+					
+					URL idlURL = new URL(FileUtils.makeAbsoluteURL(
+							authConfig.getMonitoringTestIdentityLinkURL(), 
+							authConfig.getRootConfigFileDir()));
+					InputStream idlstream = idlURL.openStream();
+					moaSession.setIdentityLink(new IdentityLinkAssertionParser(idlstream).parseIdentityLink());
+					internalTransferPersonalInformation(req, resp, container, moaSession, true);
+					
+				} else {
+					Logger.info("Servlet " + getClass().getName() + " receive a token:" +
+							token + ", which references an empty data object.");
+					resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Empty data object.");
+					
+				}
+												
+			} catch (MOADatabaseException e) {
+				Logger.info("Servlet " + getClass().getName() + " receive a token:" +
+						token + ", which is UNKNOWN.");
+				resp.sendError(HttpServletResponse.SC_NOT_FOUND, "Transfer token is UNKOWN:");
+				
+				
+			} catch (AuthenticationException e) {
+				Logger.info("Servlet " + getClass().getName() + " receive a token:" +
+						token + ", which has a timeout.");
+				resp.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Single Sign-On session transfer token is not valid any more.");
+				
+			} catch (OperatorCreationException e) {
+				Logger.warn("Device inpersonisation FAILED: " + e.getMessage(), e);
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (CredentialsNotAvailableException e) {
+				Logger.warn("Device inpersonisation FAILED: " + e.getMessage(), e);
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (PKCSException e) {
+				Logger.warn("Device inpersonisation FAILED: " + e.getMessage(), e);
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (CertificateException e) {
+				Logger.warn("Device inpersonisation FAILED: " + e.getMessage(), e);
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (InvalidKeyException e) {
+				Logger.warn("Device inpersonisation FAILED: " + e.getMessage(), e);
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (NoSuchAlgorithmException e) {
+				Logger.warn("Device inpersonisation FAILED: " + e.getMessage(), e);
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (InvalidKeySpecException e) {
+				Logger.warn("Device inpersonisation FAILED: " + e.getMessage(), e);
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (SessionDataStorageException e) {
+				Logger.warn("Device inpersonisation FAILED: " + e.getMessage(), e);
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (ParseException e) {
+				Logger.warn("Device inpersonisation FAILED: " + e.getMessage(), e);
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (IllegalBlockSizeException e) {
+				Logger.warn("Device inpersonisation FAILED: " + e.getMessage(), e);
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (BadPaddingException e) {
+				Logger.warn("Device inpersonisation FAILED: " + e.getMessage(), e);
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (NoSuchPaddingException e) {
+				Logger.warn("Device inpersonisation FAILED: " + e.getMessage(), e);
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			}
+							
+		} else {
+			Logger.info("Servlet " + getClass().getName() + " receive a NOT valid request.");
+			resp.sendError(HttpServletResponse.SC_NOT_FOUND, "Request not valid.");
+			
+		}
+		
+	}
+
+	
+	@RequestMapping(value = {	"/TransmitSSOSession"
+							}, 
+							method = {RequestMethod.GET, RequestMethod.POST})	
+	public void transferToPhone(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+		Logger.debug("Receive " + this.getClass().getName() + " request");
+		
+		Object tokenObj = req.getParameter(SSOTransferConstants.REQ_PARAM_TOKEN);		
+		if (tokenObj != null && tokenObj instanceof String) {
+			String token = (String)tokenObj;
+			try {								
+				SSOTransferContainer container = transactionStorage.get(token, SSOTransferContainer.class, transmisionTimeOut);
+				if (container != null) {				
+					AuthenticationSession moaSession = authenticationSessionStorage.getSession(container.getMoaSessionID());					
+					if (moaSession != null) {
+						internalTransferPersonalInformation(req, resp, container, moaSession, false);
+						
+						
+					} else {
+						Logger.info("Servlet " + getClass().getName() + " receive a token:" +
+								token + ", but the corresponding MOASession is empty");
+						resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "No MOASession.");
+						
+					}
+										
+				} else {
+					Logger.info("Servlet " + getClass().getName() + " receive a token:" +
+							token + ", which references an empty data object.");
+					resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Empty data object.");
+					
+				}
+												
+			} catch (MOADatabaseException e) {
+				Logger.info("Servlet " + getClass().getName() + " receive a token:" +
+						token + ", which is UNKNOWN.");
+				resp.sendError(HttpServletResponse.SC_NOT_FOUND, "Transfer token is UNKOWN:");
+				
+				
+			} catch (AuthenticationException e) {
+				Logger.info("Servlet " + getClass().getName() + " receive a token:" +
+						token + ", which has a timeout.");
+				resp.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Single Sign-On session transfer token is not valid any more.");
+				
+			} catch (OperatorCreationException e) {
+				// TODO Auto-generated catch block
+				e.printStackTrace();
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (CredentialsNotAvailableException e) {
+				// TODO Auto-generated catch block
+				e.printStackTrace();
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (PKCSException e) {
+				// TODO Auto-generated catch block
+				e.printStackTrace();
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (CertificateException e) {
+				// TODO Auto-generated catch block
+				e.printStackTrace();
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (InvalidKeyException e) {
+				// TODO Auto-generated catch block
+				e.printStackTrace();
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (NoSuchAlgorithmException e) {
+				// TODO Auto-generated catch block
+				e.printStackTrace();
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (InvalidKeySpecException e) {
+				// TODO Auto-generated catch block
+				e.printStackTrace();
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+				
+			} catch (SessionDataStorageException e) {
+				e.printStackTrace();
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+			} catch (IllegalBlockSizeException e) {
+				e.printStackTrace();
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+			} catch (BadPaddingException e) {
+				e.printStackTrace();
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+			} catch (NoSuchPaddingException e) {
+				e.printStackTrace();
+				resp.sendError(HttpServletResponse.SC_BAD_REQUEST, e.getMessage());
+			}
+			
+			
+		
+		} else {
+			Logger.info("Servlet " + getClass().getName() + " receive a NOT valid request.");
+			resp.sendError(HttpServletResponse.SC_NOT_FOUND, "Request not valid.");
+			
+		}
+		
+		
+	}
+	
+	
+	@RequestMapping(value = {	"/TransferSSOSession"
+							}, 
+							method = {RequestMethod.GET, RequestMethod.POST})
+	public void transferSSOSessionGUI(HttpServletRequest req, HttpServletResponse resp) throws IOException {		
+		//search SSO session	
+		String ssoid = ssomanager.getSSOSessionID(req);
+		
+		try {
+			String authURL = HTTPUtils.extractAuthURLFromRequest(req);
+			if (!AuthConfigurationProviderFactory.getInstance().getPublicURLPrefix().
+					contains(authURL)) {						
+				Logger.warn("Requested URL is not allowed.");;
+				resp.sendError(500, "Requested URL is not allowed.");
+				
+			}
+			
+			DefaultGUIFormBuilderConfiguration config = new DefaultGUIFormBuilderConfiguration(
+					authURL, 
+					DefaultGUIFormBuilderConfiguration.VIEW_SSO_SESSION_TRANSFER, 
+					null);
+			
+			if (ssomanager.isValidSSOSession(ssoid, null)) {
+				//Object createQRObj = req.getParameter(SSOTransferConstants.REQ_PARAM_GENERATE_QR);		
+				
+				//create first step of SSO Transfer GUI
+								
+				String moaSessionID = authenticationSessionStorage.getMOASessionSSOID(ssoid);
+				if (MiscUtil.isNotEmpty(moaSessionID)) {					
+					AuthenticationSession authSession = authenticationSessionStorage.getSession(moaSessionID);
+					if(authSession != null) {
+						internalCreateQRCodeForTransfer(resp, authURL, 
+								authSession.getSessionID(), 
+								SSOTransferConstants.SERVLET_SSOTRANSFER_TO_SMARTPHONE, config);
+						
+						return;
+					}
+				}
+								
+			}
+			
+			config.putCustomParameter("errorMsg", 
+					"No active Single Sign-On session found! SSO Session transfer is not possible.");
+			
+			guiBuilder.build(resp, config, "SSO-Transfer-Module");
+			
+		} catch (MOAIDException | MOADatabaseException e) {
+			e.printStackTrace();
+			resp.sendError(500, e.getMessage());
+		
+		} catch (NoSuchAlgorithmException | InvalidParameterSpecException e) {
+			e.printStackTrace();
+			resp.sendError(500, e.getMessage());
+			
+		} catch (Exception e) {
+			e.printStackTrace();
+			resp.sendError(500, e.getMessage());
+		}							
+	}
+	
+	private void internalTransferPersonalInformation(HttpServletRequest req, HttpServletResponse resp,
+			SSOTransferContainer container, AuthenticationSession moaSession, boolean developmentMode) throws IOException, InvalidKeyException, NoSuchAlgorithmException, InvalidKeySpecException, OperatorCreationException, CredentialsNotAvailableException, PKCSException, CertificateException, SessionDataStorageException, IllegalBlockSizeException, BadPaddingException, NoSuchPaddingException {
+		Logger.debug("");
+		JsonObject receivedData = getJSONObjectFromPostMessage(req, developmentMode);
+		
+		if (receivedData == null) {
+			Logger.warn("No data received");
+			throw new IOException("No data received");
+			
+		}
+				
+		String mobilePubKeyBase64 = receivedData.get(
+				SSOTransferConstants.SSOCONTAINER_KEY_DH_PUBKEY).getAsString();						
+		String mobileCSRBase64 = receivedData.get(
+				SSOTransferConstants.SSOCONTAINER_KEY_CSR).getAsString();
+														    
+		Logger.debug("Receive PubKey:" +mobilePubKeyBase64 + " | CSR:" + mobileCSRBase64); 
+
+		//finish DH key agreement
+		BigInteger mobilePubKey = new BigInteger(Base64Utils.decode(mobilePubKeyBase64, true));
+		DHPublicKeySpec mobilePubKeySpec = new DHPublicKeySpec(mobilePubKey, 
+					container.getDhParams().getF().getP(), 
+					container.getDhParams().getF().getG());
+		byte[] sharedSecret = ssoTransferUtils.getSecret(mobilePubKeySpec, container.getDhParams().getS());
+		
+		//build ASE256 key
+		MessageDigest digest = MessageDigest.getInstance("SHA-256");
+		digest.reset();
+		byte[] hashedSecret = digest.digest(sharedSecret);
+		
+		//decrypt CSR		
+		Logger.debug("Finished Diffie-Hellman key exchange.  --> Starting CSR decryption ...");														
+		byte[] encryptedCSR = Base64Utils.decode(mobileCSRBase64, true);		
+		Logger.debug("EncCSR:" + Base64Utils.encode(encryptedCSR) + " | Key:" + Base64Utils.encode(hashedSecret));
+		
+		byte[] decryptedCSR = ssoTransferUtils.enOrDeCryptCSR(encryptedCSR, hashedSecret, Cipher.DECRYPT_MODE);
+		Logger.debug("DecCSR:" + Base64Utils.encode(decryptedCSR));		
+		Logger.debug("CSR decryption finished. --> Starting CSR validation and signing ...");
+				
+		//generate certificate from CSR
+		X509Certificate mobileCert = signCSRWithMOAKey(decryptedCSR);
+
+		Logger.debug("CSR validation finished. --> Starting personData generation ... ");
+		
+		moaSession.setGenericDataToSession(
+				SSOTransferConstants.MOASESSION_DATA_HOLDEROFKEY_CERTIFICATE, 
+				mobileCert.getEncoded());
+		
+		//generate assertion
+		Date now = new Date();
+		String personInformationToTransfer = 
+				ssoTransferUtils.generateSignedAndEncryptedSSOContainer(
+						container.getAuthURL(), moaSession, now, hashedSecret);
+		Logger.debug("PersonData:" + personInformationToTransfer);
+		
+		//encrypt personal information
+		Logger.debug("PersonData generation finished. --> Starting personData encryption ... ");				
+				
+		Logger.debug("Encrypt personData finished. --> Send token to device.");
+		resp.setContentType("text/html;charset=UTF-8");
+		PrintWriter out = new PrintWriter(resp.getOutputStream()); 
+		out.print(personInformationToTransfer);
+		out.flush();
+		return;
+		
+	}
+	
+	private void internalCreateQRCodeForTransfer(HttpServletResponse resp, String authURL,
+			String moaSessionID, String servletEndPoint, DefaultGUIFormBuilderConfiguration config) throws Exception {
+		SSOTransferContainer container = new SSOTransferContainer();							
+		String token = Random.nextRandom();
+		
+		container.setAuthURL(authURL);
+		container.setTokkenID(token);
+		container.setMoaSessionID(moaSessionID);
+									
+		//build Diffie-Hellman parameter for Data transfer
+		Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());								
+				
+		//TODO: implement worker-thread to generate new parameters every day
+		//generate new DH parameters
+		//SecureRandom secureRandom = SecureRandom.getInstance("SHA1PRNG-SP80090", "IAIK");
+		//AlgorithmParameterGenerator paramGen = AlgorithmParameterGenerator.getInstance("DiffieHellman", "BC");
+		//paramGen.init(1024, secureRandom ); // number of bits
+		//AlgorithmParameters params = paramGen.generateParameters();
+		//DHParameterSpec dhSpec = (DHParameterSpec)params.getParameterSpec(DHParameterSpec.class);
+		//DHParameterSpec dhSpec = (DHParameterSpec)params.getParameterSpec(DHParameterSpec.class);
+		
+		//use predefined parameters
+		BigInteger prime = new BigInteger(Base64Utils.decode(SSOTransferConstants.DH_PRIME_BASE64, false));
+		BigInteger generator = new BigInteger(Base64Utils.decode(SSOTransferConstants.DH_GENERATOR_BASE64, false));
+		DHParameterSpec dhSpec = new DHParameterSpec(prime, generator, 1024);
+							
+		Pair<DHPublicKeySpec, PrivateKey> dhKeyIDP = ssoTransferUtils.createSpecificKey(dhSpec.getP(), dhSpec.getG());
+		container.setDhParams(dhKeyIDP);
+		
+		//store container							
+		transactionStorage.put(token, container);
+									
+		//build QR code
+		String containerURL = authURL
+				+ servletEndPoint
+				+ "?"+ SSOTransferConstants.REQ_PARAM_TOKEN + "=" + token;
+		
+		JsonObject qrResult = new JsonObject();
+		qrResult.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_TYPE, 
+				SSOTransferConstants.SSOCONTAINER_VALUE_TYPE_PERSIST);
+		qrResult.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_URL, 
+				containerURL);
+		
+		//add DH parameters
+		qrResult.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_DH_PUBKEY, 
+				Base64Utils.encode(dhKeyIDP.getF().getY().toByteArray()));
+		qrResult.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_DH_PRIME, 
+				Base64Utils.encode(dhKeyIDP.getF().getP().toByteArray()));
+		qrResult.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_DH_GENERATOR, 
+				Base64Utils.encode(dhKeyIDP.getF().getG().toByteArray()));
+		
+		ByteArrayOutputStream qrStream = 
+				QRCode.from(qrResult.toString()).to(ImageType.GIF).withSize(350, 350).stream();							
+		String base64EncodedImage = Base64Utils.encode(qrStream.toByteArray());							
+		config.putCustomParameter("QRImage", base64EncodedImage);
+		
+		config.putCustomParameter("successMsg", "Scan the QR-Code with your <i>SSO-Transfer App</i> to start the transfer operation.");
+		
+		
+		guiBuilder.build(resp, config, "SSO-Session Transfer-Module");
+		
+	}
+		
+	private X509Certificate signCSRWithMOAKey(byte[] inputCSR) throws IOException, OperatorCreationException, PKCSException, CredentialsNotAvailableException, CertificateException {		
+		PKCS10CertificationRequest csr = new PKCS10CertificationRequest(inputCSR);
+					
+		//validate CSR request		
+		ContentVerifierProvider verifier = new JcaContentVerifierProviderBuilder().setProvider(
+				new BouncyCastleProvider()).build(csr.getSubjectPublicKeyInfo());
+		csr.isSignatureValid(verifier);
+		 
+		//build certificate with CSR
+		X500Name issuer = new X500Name("CN=IDP");
+	    BigInteger serial = new BigInteger(32, new SecureRandom());
+	    Date from = new Date();
+	    Date to = new Date(System.currentTimeMillis() + (SSOTransferConstants.CERT_VALIDITY * 86400000L));
+	    X509v3CertificateBuilder certgen = new X509v3CertificateBuilder(issuer, serial, from, to, csr.getSubject(), csr.getSubjectPublicKeyInfo());
+	    certgen.addExtension(Extension.basicConstraints, false, new BasicConstraints(false));
+	    //certgen.addExtension(Extension.subjectKeyIdentifier, false, SubjectKeyIdentifier.getInstance(csr.getSubjectPublicKeyInfo()));
+	    
+	    //build signer
+	    ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA").build(idpCredentials.getIDPAssertionSigningCredential().getPrivateKey());
+		
+	    //sign certificate
+	    X509CertificateHolder x509CertificateHolder = certgen.build(sigGen);
+	    
+	    return X509Certificate.getInstance(x509CertificateHolder.getEncoded());
+	    
+		
+	}
+		
+	private JsonObject getJSONObjectFromPostMessage(HttpServletRequest req, boolean developmentMode) {
+		//read POST request
+		StringBuffer sb = new StringBuffer();
+		String receivedPostMessage = null;
+
+		try {						
+			BufferedReader reader = req.getReader();
+		    String line = null;
+		    while ((line = reader.readLine()) != null) {
+		    	sb.append(line);
+		    }
+
+		    receivedPostMessage = sb.toString();
+		    
+		} catch (IOException e) {
+			Logger.warn("Received POST-message produce an ERROR.", e);
+			Logger.info("Msg: " + receivedPostMessage); 
+			
+		}
+		
+		JsonParser parser = new JsonParser();
+		JsonObject receivedData = null;
+		Logger.debug("JSON POST msg: " + sb.toString());		
+		if (MiscUtil.isNotEmpty(receivedPostMessage)) {			
+			receivedData = (JsonObject) parser.parse(sb.toString());
+			
+		} else if (developmentMode && MiscUtil.isNotEmpty(req.getParameter("blob"))) {
+			receivedData = (JsonObject) parser.parse(req.getParameter("blob"));
+			
+		}
+
+		return receivedData;
+				
+	}
+	
+}
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/servlet/SSOTransferSignalServlet.java b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/servlet/SSOTransferSignalServlet.java
new file mode 100644
index 000000000..e92925dfb
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/servlet/SSOTransferSignalServlet.java
@@ -0,0 +1,101 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.ssotransfer.servlet;
+
+import java.io.IOException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.lang.StringEscapeUtils;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+import at.gv.egovernment.moa.id.advancedlogging.TransactionIDUtils;
+import at.gv.egovernment.moa.id.auth.servlet.AbstractProcessEngineSignalController;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+@Controller
+public class SSOTransferSignalServlet extends AbstractProcessEngineSignalController {
+	public SSOTransferSignalServlet() {
+		super();
+		Logger.debug("Registering servlet " + getClass().getName() + " with mappings '/SSOTransferEndpoint'.");
+		
+	}
+	
+	@RequestMapping(value = {	"/SSOTransferSignalEndpoint"
+							}, 
+							method = {RequestMethod.POST, RequestMethod.GET})
+	public void performSSOTransfer(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+		signalProcessManagement(req, resp);
+
+	}
+	
+	@Override
+	protected void signalProcessManagement(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+		String pendingRequestID = StringEscapeUtils.escapeHtml(getPendingRequestId(req));
+		IRequest pendingReq = null;
+		try {	
+			if (pendingRequestID == null) {
+				throw new IllegalStateException("Unable to determine MOA pending-request id.");
+			}
+			
+			pendingReq = requestStorage.getPendingRequest(pendingRequestID);
+			if (pendingReq == null) {
+				Logger.info("No PendingRequest with Id: " + pendingRequestID + " Maybe, a transaction timeout occure.");
+				throw new MOAIDException("auth.28", new Object[]{pendingRequestID});
+				
+			}
+						
+			//add transactionID and unique sessionID to Logger
+			TransactionIDUtils.setSessionId(pendingReq.getUniqueSessionIdentifier());
+			TransactionIDUtils.setTransactionId(pendingReq.getUniqueTransactionIdentifier());
+			
+			// process instance is mandatory
+			if (pendingReq.getProcessInstanceId() == null) {
+				throw new IllegalStateException("MOA session does not provide process instance id.");
+			}
+
+			// wake up next task
+			processEngine.signal(pendingReq);
+			
+		} catch (Exception ex) {
+			handleError(null, ex, req, resp, pendingReq);
+			
+		} finally {
+			//MOASessionDBUtils.closeSession();
+			TransactionIDUtils.removeTransactionId();
+			TransactionIDUtils.removeSessionId();
+			
+		}
+		
+		
+	}
+}
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/task/InitializeRestoreSSOSessionTask.java b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/task/InitializeRestoreSSOSessionTask.java
new file mode 100644
index 000000000..be27de9a1
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/task/InitializeRestoreSSOSessionTask.java
@@ -0,0 +1,115 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.ssotransfer.task;
+
+import java.math.BigInteger;
+import java.security.PrivateKey;
+
+import javax.crypto.spec.DHParameterSpec;
+import javax.crypto.spec.DHPublicKeySpec;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import at.gv.egovernment.moa.id.auth.frontend.builder.IGUIFormBuilder;
+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
+import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.SSOTransferConstants;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.data.Pair;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.data.SSOTransferContainer;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.utils.GUIUtils;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.utils.SSOContainerUtils;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+import at.gv.egovernment.moa.id.util.HTTPUtils;
+import at.gv.egovernment.moa.id.util.Random;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.Base64Utils;
+
+/**
+ * @author tlenz
+ *
+ */
+@Component("InitializeRestoreSSOSessionTask")
+public class InitializeRestoreSSOSessionTask extends AbstractAuthServletTask {
+	
+	@Autowired IGUIFormBuilder guiBuilder;
+	@Autowired SSOContainerUtils ssoTransferUtils;
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.process.springweb.MoaIdTask#execute(at.gv.egovernment.moa.id.process.api.ExecutionContext, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
+	 */
+	@Override
+	public void execute(ExecutionContext executionContext,
+			HttpServletRequest request, HttpServletResponse response)
+			throws TaskExecutionException {
+
+		try {
+			//create first step of SSO Transfer GUI
+			String authURL = HTTPUtils.extractAuthURLFromRequest(request);
+			if (!AuthConfigurationProviderFactory.getInstance().getPublicURLPrefix().
+					contains(authURL)) {						
+				Logger.warn("Requested URL is not allowed.");;
+				response.sendError(500, "Requested URL is not allowed.");
+				
+			}
+
+			//use predefined parameters
+			BigInteger prime = new BigInteger(Base64Utils.decode(SSOTransferConstants.DH_PRIME_BASE64, false));
+			BigInteger generator = new BigInteger(Base64Utils.decode(SSOTransferConstants.DH_GENERATOR_BASE64, false));
+			DHParameterSpec dhSpec = new DHParameterSpec(prime, generator, 1024);
+								
+			Pair<DHPublicKeySpec, PrivateKey> dhKeyIDP = ssoTransferUtils.createSpecificKey(dhSpec.getP(), dhSpec.getG());
+			String nonce = Random.nextLongRandom();
+			
+			GUIUtils.buildSSOTransferGUI(guiBuilder, response, authURL, 
+					pendingReq.getRequestID(), nonce, dhKeyIDP.getF());
+			
+			//store DH params and nonce to pending-request
+			SSOTransferContainer container = new SSOTransferContainer();
+			container.setDhParams(dhKeyIDP);
+			pendingReq.setGenericDataToSession(SSOTransferConstants.PENDINGREQ_DH, container);
+			pendingReq.setGenericDataToSession(SSOTransferConstants.PENDINGREQ_NONCE, nonce);
+						
+			//store pending-request
+			requestStoreage.storePendingRequest(pendingReq);
+			
+			//set flag
+			executionContext.put("sessionRestoreFinished", false);
+									
+		} catch (MOAIDException e) {
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
+
+		} catch (Exception e) {
+			Logger.error(this.getClass().getName() + " has an interal Error.", e);
+			throw new TaskExecutionException(pendingReq, this.getClass().getName() + " has an interal Error.", e);
+			
+		}
+		
+
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/task/RestoreSSOSessionTask.java b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/task/RestoreSSOSessionTask.java
new file mode 100644
index 000000000..dd133e4fb
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/task/RestoreSSOSessionTask.java
@@ -0,0 +1,306 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.ssotransfer.task;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.math.BigInteger;
+import java.security.MessageDigest;
+
+import javax.crypto.Cipher;
+import javax.crypto.spec.DHPublicKeySpec;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.lang3.BooleanUtils;
+import org.joda.time.DateTime;
+import org.opensaml.saml2.core.Response;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+
+import at.gv.egovernment.moa.id.auth.frontend.builder.IGUIFormBuilder;
+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
+import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.SSOTransferConstants;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.data.SSOTransferContainer;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.utils.GUIUtils;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.utils.SSOContainerUtils;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
+import at.gv.egovernment.moa.id.protocols.pvp2x.utils.AssertionAttributeExtractor;
+import at.gv.egovernment.moa.id.util.HTTPUtils;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.Base64Utils;
+import at.gv.egovernment.moa.util.MiscUtil;
+import iaik.x509.X509Certificate;
+
+/**
+ * @author tlenz
+ *
+ */
+@Component("RestoreSSOSessionTask")
+public class RestoreSSOSessionTask extends AbstractAuthServletTask {
+
+	@Autowired SSOContainerUtils ssoTransferUtils;
+	@Autowired IGUIFormBuilder guiBuilder;
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.process.springweb.MoaIdTask#execute(at.gv.egovernment.moa.id.process.api.ExecutionContext, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
+	 */
+	@Override
+	public void execute(ExecutionContext executionContext,
+			HttpServletRequest request, HttpServletResponse response)
+			throws TaskExecutionException {
+		
+		Logger.debug("Receive " + this.getClass().getName() + " request");
+				
+		StringBuffer sb = new StringBuffer();
+		String receivedPostMessage = null;
+		String authURL =null;
+		try {						
+			BufferedReader reader = request.getReader();
+		    String line = null;
+		    while ((line = reader.readLine()) != null) {
+		    	sb.append(line);
+		    }
+
+		    receivedPostMessage = sb.toString();
+		    
+		} catch (IOException e) {
+			Logger.warn("Received POST-message produce an ERROR.", e);
+			
+		}
+		
+    	String nonce = pendingReq.getGenericData(SSOTransferConstants.PENDINGREQ_NONCE, String.class);
+    	SSOTransferContainer container = pendingReq.getGenericData(
+    			SSOTransferConstants.PENDINGREQ_DH, SSOTransferContainer.class);
+    	if (container == null) {
+    		throw new TaskExecutionException(pendingReq, "NO DH-Params in pending-request", 
+    				new MOAIDException("NO DH-Params in pending-request", null));
+    		
+    	}
+    	
+		
+		if (MiscUtil.isNotEmpty(receivedPostMessage)) {
+			Logger.debug("Receive POST-Message data. Start data-validation process ... ");
+			JsonObject responseMsg = new JsonObject();
+			try {
+				Logger.debug("Unformated Msg:" + receivedPostMessage);
+				
+			    JsonParser parser = new JsonParser();
+			    JsonObject receivedData = (JsonObject) parser.parse(sb.toString());		    
+			    
+			    JsonObject receivedSession = receivedData.get(
+			    		SSOTransferConstants.SSOCONTAINER_KEY_SESSION).getAsJsonObject();
+			    
+			    Logger.debug("Received Session-Object:"+ receivedSession.toString());
+			    
+			    String signature = receivedData.get(
+			    		SSOTransferConstants.SSOCONTAINER_KEY_SIGNATURE).getAsString();
+			    String mobilePubKeyBase64 = receivedData.get(
+						SSOTransferConstants.SSOCONTAINER_KEY_DH_PUBKEY).getAsString();	
+			    			    
+			    String respNonce = receivedSession.get(
+			    		SSOTransferConstants.PENDINGREQ_NONCE).getAsString();			    			   			 			    
+			    String encSessionBlobBase64 = receivedSession.get(
+			    		SSOTransferConstants.SSOCONTAINER_KEY_BLOB).getAsString();
+			    
+				Logger.debug("Receive PubKey:" +mobilePubKeyBase64 
+						+ " | SessionBlob:" + encSessionBlobBase64
+						+ " | Nonce:" + respNonce
+						+ " | Signature:" + signature
+						+ " | SignedData:" + receivedSession.toString()); 
+
+				if (MiscUtil.isEmpty(respNonce) || !respNonce.equals(nonce)) {
+					Logger.warn("Received 'nonce':" + respNonce 
+							+ " does not match to stored 'nonce':" + nonce);
+					 throw new TaskExecutionException(pendingReq, "Received 'nonce':" + respNonce 
+								+ " does not match to stored 'nonce':" + nonce, 
+								new MOAIDException("Received 'nonce':" + respNonce + " does not match to stored 'nonce':" + nonce, null));
+					
+				}
+				
+				
+				//finish DH key agreement
+				BigInteger mobilePubKey = new BigInteger(Base64Utils.decode(mobilePubKeyBase64, true));
+				DHPublicKeySpec mobilePubKeySpec = new DHPublicKeySpec(mobilePubKey, 
+							container.getDhParams().getF().getP(), 
+							container.getDhParams().getF().getG());
+				byte[] sharedSecret = ssoTransferUtils.getSecret(mobilePubKeySpec, container.getDhParams().getS());
+				
+				//build ASE256 key
+				MessageDigest digest = MessageDigest.getInstance("SHA-256");
+				digest.reset();
+				byte[] hashedSecret = digest.digest(sharedSecret);
+				
+				//decrypt CSR		
+				Logger.debug("Finished Diffie-Hellman key exchange.  --> Starting SessionBlob decryption ...");														
+				byte[] encryptedSessionBlob = Base64Utils.decode(encSessionBlobBase64, true);		
+				Logger.debug("EncSessionBlob:" + Base64Utils.encode(encryptedSessionBlob) + " | Key:" + Base64Utils.encode(hashedSecret));
+				
+				byte[] sessionBlobArray = ssoTransferUtils.enOrDeCryptCSR(encryptedSessionBlob, hashedSecret, Cipher.DECRYPT_MODE);
+				String sessionBlob = new String(sessionBlobArray, "UTF-8");
+				Logger.debug("DecSessionBlob:" + sessionBlob);	
+			    
+				//parse SAML2 assertion
+				Response ssoInformation = ssoTransferUtils.validateReceivedSSOContainer(sessionBlob);
+			    				
+				//validate signature
+				AssertionAttributeExtractor attributeExtractor = new AssertionAttributeExtractor(ssoInformation);
+				String holderOfKeyCertBase64 = attributeExtractor.getSingleAttributeValue(PVPConstants.PVP_HOLDEROFKEY_NAME);
+				byte[] holderOfKeyCertEncoded = Base64Utils.decode(holderOfKeyCertBase64, false);
+				X509Certificate holderOfKeyCert = new X509Certificate(holderOfKeyCertEncoded);
+				Logger.debug("Found HolderOfKey Certificate:" + holderOfKeyCert.getSubjectDN().toString());
+
+				
+				//TODO: implement Signature validation
+				
+				Logger.debug("MobileDevice is valid. --> Starting session reconstruction ...");
+		    	
+				
+		    	//session is valid --> load MOASession object
+		    	try {
+					defaultTaskInitialization(request, executionContext);
+								
+				} catch (MOAIDException | MOADatabaseException e1) {
+					Logger.error("Database Error! MOASession is not stored!");
+					throw new TaskExecutionException(pendingReq, "Load MOASession FAILED.", e1);
+					
+				}
+				
+		    	//transfer SSO Assertion into MOA-Session
+		    	ssoTransferUtils.parseSSOContainerToMOASessionDataObject(pendingReq, moasession, attributeExtractor);
+		    		
+		    	// store MOASession into database
+				try {
+					authenticatedSessionStorage.storeSession(moasession);
+						
+				} catch (MOADatabaseException e) {
+					Logger.error("Database Error! MOASession is not stored!");
+					throw new MOAIDException("init.04", new Object[] {
+							moasession.getSessionID()});
+				}
+		    		
+		    	executionContext.put(SSOTransferConstants.FLAG_SSO_SESSION_RESTORED, true);
+		    	executionContext.put("sessionRestoreFinished", false);	
+		    	
+		    	
+		    	responseMsg.addProperty(
+		    			SSOTransferConstants.SSOCONTAINER_KEY_STATUS, 
+		    			"OK");
+		    	response.setStatus(HttpServletResponse.SC_OK);
+		    	response.setContentType("text/html;charset=UTF-8");
+				PrintWriter out = new PrintWriter(response.getOutputStream()); 
+				out.print(responseMsg.toString());
+				out.flush();
+
+		    	
+//		    	Logger.info("Received SSO session-data is from IDP: " + entityID 
+//		    			+ ". Start inderfederation process to restore SSO session ... ");
+//		    	//change to inderfederated session reconstruction
+//		    	
+//		    	Logger.warn("Device Session Transfer with interfederation is not implemented, yet!!!!");
+			    	
+
+			    						
+			 } catch (Exception e) {
+				 Logger.error("Parse reveived JSON data-object " + sb.toString() + " FAILED!", e);
+				 //throw new TaskExecutionException(pendingReq, "JSON data is not parseable.", e);
+				 try {
+					 responseMsg.addProperty(
+							 SSOTransferConstants.SSOCONTAINER_KEY_STATUS, 
+							 "FAILED");
+					 response.setStatus(HttpServletResponse.SC_OK);
+					 response.setContentType("text/html;charset=UTF-8");
+					 PrintWriter out = new PrintWriter(response.getOutputStream());				 
+					 out.print(responseMsg.toString());
+					 out.flush();
+				 } catch (IOException e1) {
+						e1.printStackTrace();
+						
+				 } 
+			 }
+			
+		} else {
+			Logger.debug("Reveive NO POST-message data. Start check-session process ... ");
+			
+			boolean isSSOSessionRestored = 
+					BooleanUtils.isTrue((Boolean) executionContext.get(SSOTransferConstants.FLAG_SSO_SESSION_RESTORED));
+			
+			if (isSSOSessionRestored) {
+				Logger.info("Found restored SSO session. Resume authentication process ...");
+				executionContext.remove(SSOTransferConstants.FLAG_SSO_SESSION_RESTORED);
+				executionContext.put("sessionRestoreFinished", true);
+				
+			} else {
+		    	//session is valid --> load MOASession object
+		    	try {
+					defaultTaskInitialization(request, executionContext);
+								
+				} catch (MOAIDException | MOADatabaseException e1) {
+					Logger.error("Database Error! MOASession is not stored!");
+					throw new TaskExecutionException(pendingReq, "Load MOASession FAILED.", e1);
+					
+				}
+				
+				DateTime moaSessionCreated = new DateTime(moasession.getSessionCreated().getTime());
+				if (moaSessionCreated.plusMinutes(1).isBeforeNow()) {
+					Logger.warn("No SSO session-container received. Stop authentication process after time-out.");
+					throw new TaskExecutionException(pendingReq, "No SSO container received from smartphone app.", 
+							new MOAIDException("No SSO container received from smartphone app.", null));
+					
+				} else { 				
+					Logger.debug("No restored SSO session found --> Wait a few minutes and check again.");
+					executionContext.put("sessionRestoreFinished", false);	
+					
+					try {
+						//create first step of SSO Transfer GUI
+						authURL = HTTPUtils.extractAuthURLFromRequest(request);
+						if (!AuthConfigurationProviderFactory.getInstance().getPublicURLPrefix().
+								contains(authURL)) {						
+							Logger.warn("Requested URL is not allowed.");;
+							response.sendError(500, "Requested URL is not allowed.");
+							
+						}	
+						
+						GUIUtils.buildSSOTransferGUI(guiBuilder, response, 
+								authURL, pendingReq.getRequestID(), nonce, container.getDhParams().getF());
+						
+					} catch (IOException | MOAIDException e) {
+						throw new TaskExecutionException(pendingReq, e.getMessage(), e);
+						
+					}
+
+				}												
+			}			
+		}				 
+	}
+
+}
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/utils/GUIUtils.java b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/utils/GUIUtils.java
new file mode 100644
index 000000000..13a278d1d
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/utils/GUIUtils.java
@@ -0,0 +1,120 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.ssotransfer.utils;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+
+import javax.crypto.spec.DHPublicKeySpec;
+import javax.servlet.http.HttpServletResponse;
+
+import com.google.gson.JsonObject;
+
+import at.gv.egovernment.moa.id.auth.frontend.builder.DefaultGUIFormBuilderConfiguration;
+import at.gv.egovernment.moa.id.auth.frontend.builder.IGUIFormBuilder;
+import at.gv.egovernment.moa.id.auth.frontend.exception.GUIBuildException;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.SSOTransferConstants;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.Base64Utils;
+import at.gv.egovernment.moa.util.MiscUtil;
+import net.glxn.qrgen.QRCode;
+import net.glxn.qrgen.image.ImageType;
+
+/**
+ * @author tlenz
+ *
+ */
+public class GUIUtils {		
+	public static final int REFESH_TIMEOUT = 5 * 1000; //5 sec
+	
+	public static void buildSSOTransferGUI(
+			IGUIFormBuilder guiBuilder, HttpServletResponse httpResp,
+			String authURL, String pendingReqID) throws ConfigurationException, IOException {
+		buildSSOTransferGUI(guiBuilder, httpResp, authURL, pendingReqID, null, null);
+				
+	}
+
+	/**
+	 * @param guiBuilder
+	 * @param response
+	 * @param authURL
+	 * @param requestID
+	 * @param nonce
+	 * @param dhKeyIDP
+	 * @throws ConfigurationException 
+	 * @throws IOException 
+	 */
+	public static void buildSSOTransferGUI(IGUIFormBuilder guiBuilder, HttpServletResponse response, String authURL,
+			String requestID, String nonce, DHPublicKeySpec dhKeyIDP) throws ConfigurationException, IOException {
+		try {
+			String containerURL = authURL
+					+ SSOTransferConstants.SERVLET_SSOTRANSFER_FROM_SMARTPHONE
+					+ "?" + MOAIDAuthConstants.PARAM_TARGET_PENDINGREQUESTID + "=" + requestID;
+		
+			
+			
+			
+			JsonObject qrResult = new JsonObject();
+			qrResult.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_TYPE, 
+					SSOTransferConstants.SSOCONTAINER_VALUE_TYPE_TRANSER);
+			qrResult.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_URL, containerURL);
+			
+			if (MiscUtil.isNotEmpty(nonce))
+				qrResult.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_NONCE, nonce);
+
+			if (dhKeyIDP != null) {
+				qrResult.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_DH_PUBKEY, 
+						Base64Utils.encode(dhKeyIDP.getY().toByteArray()));
+				qrResult.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_DH_PRIME, 
+						Base64Utils.encode(dhKeyIDP.getP().toByteArray()));
+				qrResult.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_DH_GENERATOR, 
+						Base64Utils.encode(dhKeyIDP.getG().toByteArray()));
+				
+			}
+			
+			ByteArrayOutputStream qrStream = 
+					QRCode.from(qrResult.toString()).to(ImageType.GIF).withSize(350, 350).stream();							
+			String base64EncodedImage = Base64Utils.encode(qrStream.toByteArray());
+					
+			DefaultGUIFormBuilderConfiguration config = new DefaultGUIFormBuilderConfiguration(
+					authURL, 
+					DefaultGUIFormBuilderConfiguration.VIEW_SSO_SESSION_TRANSFER, 
+					null);
+			
+			config.putCustomParameter("QRImage", base64EncodedImage);		
+			config.putCustomParameter("successMsg", "Select the SSO Session in your <i>SSO-Transfer App</i> and scan the QR-Code to start the process.");			
+			config.putCustomParameter("timeoutURL", containerURL);
+			config.putCustomParameter("timeout", REFESH_TIMEOUT);
+				
+			guiBuilder.build(response, config, "SSO-Transfer-Module");
+			
+		} catch (GUIBuildException e) {
+			Logger.warn("Can not build GUI:'BKU-Selection'. Msg:" + e.getMessage(), e);
+			throw new ConfigurationException("builder.09", new Object[]{e.getMessage()}, e);
+			
+		}
+		
+	}		
+}
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/utils/SSOContainerUtils.java b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/utils/SSOContainerUtils.java
new file mode 100644
index 000000000..0785f767b
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/utils/SSOContainerUtils.java
@@ -0,0 +1,553 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.ssotransfer.utils;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.StringWriter;
+import java.math.BigInteger;
+import java.security.InvalidKeyException;
+import java.security.KeyFactory;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.cert.CertificateException;
+import java.security.spec.InvalidKeySpecException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+
+import javax.crypto.BadPaddingException;
+import javax.crypto.Cipher;
+import javax.crypto.IllegalBlockSizeException;
+import javax.crypto.KeyAgreement;
+import javax.crypto.NoSuchPaddingException;
+import javax.crypto.spec.DHParameterSpec;
+import javax.crypto.spec.DHPublicKeySpec;
+import javax.crypto.spec.SecretKeySpec;
+import javax.xml.XMLConstants;
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.transform.Transformer;
+import javax.xml.transform.TransformerException;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.TransformerFactoryConfigurationError;
+import javax.xml.transform.dom.DOMSource;
+import javax.xml.transform.stream.StreamResult;
+
+import org.joda.time.DateTime;
+import org.opensaml.Configuration;
+import org.opensaml.saml2.core.Assertion;
+import org.opensaml.saml2.core.Attribute;
+import org.opensaml.saml2.core.AuthnContextClassRef;
+import org.opensaml.saml2.core.Issuer;
+import org.opensaml.saml2.core.NameID;
+import org.opensaml.saml2.core.Response;
+import org.opensaml.saml2.core.StatusCode;
+import org.opensaml.saml2.core.SubjectConfirmationData;
+import org.opensaml.security.SAMLSignatureProfileValidator;
+import org.opensaml.xml.XMLObject;
+import org.opensaml.xml.encryption.EncryptionException;
+import org.opensaml.xml.io.Marshaller;
+import org.opensaml.xml.io.MarshallingException;
+import org.opensaml.xml.io.Unmarshaller;
+import org.opensaml.xml.io.UnmarshallerFactory;
+import org.opensaml.xml.io.UnmarshallingException;
+import org.opensaml.xml.parse.BasicParserPool;
+import org.opensaml.xml.parse.XMLParserException;
+import org.opensaml.xml.security.SecurityException;
+import org.opensaml.xml.security.SecurityHelper;
+import org.opensaml.xml.security.credential.Credential;
+import org.opensaml.xml.signature.Signature;
+import org.opensaml.xml.signature.SignatureException;
+import org.opensaml.xml.signature.SignatureValidator;
+import org.opensaml.xml.signature.Signer;
+import org.opensaml.xml.validation.ValidationException;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+import org.w3c.dom.NodeList;
+
+import com.google.gson.JsonObject;
+
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.exception.ParseException;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.SSOTransferConstants;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.data.Pair;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.data.SSOTransferAuthenticationData;
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.data.SSOTransferOnlineApplication;
+import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
+import at.gv.egovernment.moa.id.data.IAuthData;
+import at.gv.egovernment.moa.id.data.MISMandate;
+import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
+import at.gv.egovernment.moa.id.protocols.pvp2x.builder.PVPAttributeBuilder;
+import at.gv.egovernment.moa.id.protocols.pvp2x.builder.assertion.PVP2AssertionBuilder;
+import at.gv.egovernment.moa.id.protocols.pvp2x.config.PVPConfiguration;
+import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.AssertionAttributeExtractorExeption;
+import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.NoCredentialsException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.SAMLRequestNotSignedException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider;
+import at.gv.egovernment.moa.id.protocols.pvp2x.signer.CredentialsNotAvailableException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.signer.IDPCredentialProvider;
+import at.gv.egovernment.moa.id.protocols.pvp2x.utils.AssertionAttributeExtractor;
+import at.gv.egovernment.moa.id.protocols.pvp2x.utils.SAML2Utils;
+import at.gv.egovernment.moa.id.protocols.pvp2x.verification.SAMLVerificationEngineSP;
+import at.gv.egovernment.moa.id.util.Random;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.Base64Utils;
+import at.gv.egovernment.moa.util.MiscUtil;
+import at.gv.util.BpkUtil;
+import iaik.x509.X509Certificate;
+
+/**
+ * @author tlenz
+ *
+ */
+@Service("SSOContainerUtils")
+public class SSOContainerUtils {
+	
+	private static final String PVP_HOLDEROFKEY_NAME = PVPConstants.URN_OID_PREFIX + 
+			"1.2.40.0.10.2.1.1.261.xx.xx";
+	
+    public static final List<String> REQUIRED_ATTRIBUTES;
+	static {
+		List<String> tmp = new ArrayList<String>();
+		tmp.add(PVPConstants.EID_AUTH_BLOCK_NAME);
+		tmp.add(PVPConstants.EID_IDENTITY_LINK_NAME);
+		tmp.add(PVPConstants.EID_ISSUING_NATION_NAME);
+		tmp.add(PVPConstants.EID_SIGNER_CERTIFICATE_NAME);
+		tmp.add(PVPConstants.EID_SOURCE_PIN_NAME);
+		tmp.add(PVPConstants.EID_SOURCE_PIN_TYPE_NAME);
+		tmp.add(PVPConstants.MANDATE_REFERENCE_VALUE_NAME);
+		tmp.add(PVPConstants.MANDATE_FULL_MANDATE_NAME);
+		tmp.add(PVPConstants.MANDATE_TYPE_NAME);
+		tmp.add(PVPConstants.MANDATE_PROF_REP_OID_NAME);
+		tmp.add(PVPConstants.MANDATE_PROF_REP_DESC_NAME);
+		tmp.add(PVPConstants.EID_CITIZEN_QAA_LEVEL_NAME);
+		
+		//TODO: change to final definition
+		tmp.add(PVP_HOLDEROFKEY_NAME);
+		
+        REQUIRED_ATTRIBUTES = Collections.unmodifiableList(tmp);
+	}
+	
+	@Autowired IDPCredentialProvider credentials;
+	@Autowired SAMLVerificationEngineSP samlVerificationEngine;
+	@Autowired AuthConfiguration authConfig;
+	
+	public void parseSSOContainerToMOASessionDataObject(IRequest pendingReq, AuthenticationSession moasession, AssertionAttributeExtractor attributeExtractor) throws AssertionAttributeExtractorExeption, ConfigurationException {
+//		AssertionAttributeExtractor attributeExtractor = new AssertionAttributeExtractor(ssoInformation);
+		
+		//TODO: maybe change to correct URL
+		//set dummy BKU URLx
+		moasession.setBkuURL("http://egiz.gv.at/sso_session-transfer_app");
+		
+		
+		String qaaLevel = attributeExtractor.getSingleAttributeValue(PVPConstants.EID_CITIZEN_QAA_LEVEL_NAME);
+		if (MiscUtil.isNotEmpty(qaaLevel)) {
+			if (qaaLevel.startsWith(PVPConstants.STORK_QAA_PREFIX))
+				moasession.setQAALevel(qaaLevel);
+			else 
+				moasession.setQAALevel(PVPConstants.STORK_QAA_PREFIX + qaaLevel);
+				
+			
+		} else {
+			Logger.warn("SSO session-container contains NO QAA-level");
+			
+		}
+		
+		String authBlock = attributeExtractor.getSingleAttributeValue(PVPConstants.EID_AUTH_BLOCK_NAME);
+		if (MiscUtil.isNotEmpty(authBlock))
+			moasession.setAuthBlock(authBlock);
+		else
+			Logger.warn("SSO session-container contains NO AuthBlock");
+		
+		try {
+			String signerCert = attributeExtractor.getSingleAttributeValue(PVPConstants.EID_SIGNER_CERTIFICATE_NAME);
+			if (MiscUtil.isNotEmpty(signerCert))			
+				moasession.setSignerCertificate(new X509Certificate(Base64Utils.decode(signerCert, false)));
+			else
+				Logger.warn("SSO session-container contains NO SignerCertificate");
+			
+		} catch (CertificateException | IOException e) {
+			Logger.error("SignerCertificate is not parseable.", e);
+			
+		}
+		
+		String idlStr = attributeExtractor.getSingleAttributeValue(PVPConstants.EID_IDENTITY_LINK_NAME);
+		try {
+			if (MiscUtil.isNotEmpty(idlStr)) {
+				IdentityLinkAssertionParser idlParser = new IdentityLinkAssertionParser(Base64Utils.decodeToStream(idlStr, false));
+				moasession.setIdentityLink(idlParser.parseIdentityLink());
+			
+			} else {
+				Logger.warn("SSO session-container contains NO IdentityLink");
+				throw new AssertionAttributeExtractorExeption("SSO session-container contains NO IdentityLink");
+			
+			}
+			
+		} catch (ParseException e) {
+			Logger.error("IdentityLink is not parseable.", e);
+			throw new AssertionAttributeExtractorExeption("IdentityLink is not parseable.");
+			
+		}
+		
+		
+		String mandateRefValue = attributeExtractor.getSingleAttributeValue(PVPConstants.MANDATE_REFERENCE_VALUE_NAME);
+		if (MiscUtil.isNotEmpty(mandateRefValue)) {
+			moasession.setMandateReferenceValue(mandateRefValue);
+			moasession.setUseMandate("true");
+			Logger.info("Found mandate information in SSO session-container.");
+			
+			try {
+				MISMandate mandate = new MISMandate();
+				
+				String mandateFull = attributeExtractor.getSingleAttributeValue(PVPConstants.MANDATE_FULL_MANDATE_NAME);
+				if (MiscUtil.isNotEmpty(mandateFull)) {					
+					mandate.setMandate(Base64Utils.decode(mandateFull, false));
+							
+				} else {
+					Logger.warn("No Full-Mandate information found in SSO session-container.");
+				
+				}
+				
+				String oid = attributeExtractor.getSingleAttributeValue(PVPConstants.MANDATE_PROF_REP_OID_NAME);
+				if (MiscUtil.isNotEmpty(oid))
+					mandate.setProfRep(oid );
+								
+				NodeList mandateElements = mandate.getMandateDOM().getChildNodes();
+				for (int i=0; i<mandateElements.getLength(); i++) {
+					Element mandateEl = (Element) mandateElements.item(i);									
+					if (mandateEl.hasAttribute("OWbPK")) {
+						mandate.setOWbPK(mandateEl.getAttribute("OWbPK"));
+					}
+				}
+								
+				moasession.setMISMandate(mandate);
+				
+			} catch (IOException e) {
+				Logger.error("Full-Mandate information is not parseable.", e);
+				
+			}			
+		}
+		
+
+		
+			
+		
+	}
+	
+	public Response validateReceivedSSOContainer(String signedEncryptedContainer) throws IOException, XMLParserException, UnmarshallingException, MOAIDException  {	
+		final BasicParserPool ppMgr = new BasicParserPool();
+		final HashMap<String, Boolean> features = new HashMap<String, Boolean>();
+		features.put(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+		ppMgr.setBuilderFeatures(features);
+		ppMgr.setNamespaceAware(true);
+		
+		Document document = ppMgr.parse(new ByteArrayInputStream(signedEncryptedContainer.getBytes()));
+		Element domElement = document.getDocumentElement();
+		
+		UnmarshallerFactory saml2UnmarshallerFactory = Configuration.getUnmarshallerFactory();
+		Unmarshaller saml2Unmarshaller = saml2UnmarshallerFactory.getUnmarshaller(domElement);
+		XMLObject responseXMLObj = saml2Unmarshaller.unmarshall(domElement);
+		
+		if (responseXMLObj instanceof Response) {
+			Response ssoContainer = (Response) responseXMLObj;
+			
+			try {
+				SAMLSignatureProfileValidator sigValidator = new SAMLSignatureProfileValidator();
+				sigValidator.validate(ssoContainer.getSignature());
+				
+			} catch (ValidationException e) {
+				Logger.error("Failed to validate Signature", e);
+				throw new SAMLRequestNotSignedException(e);
+			}
+			
+			Credential credential = credentials.getIDPAssertionSigningCredential();
+			if (credential == null) {
+				throw new NoCredentialsException("moaID IDP");
+			}
+
+			SignatureValidator sigValidator = new SignatureValidator(credential);
+			try {
+				sigValidator.validate(ssoContainer.getSignature());
+
+			} catch (ValidationException e) {
+				Logger.error("Failed to verfiy Signature", e);
+				throw new SAMLRequestNotSignedException(e);
+			}
+			
+			if (ssoContainer.getStatus().getStatusCode().getValue().equals(StatusCode.SUCCESS_URI)) {
+					
+				//validate PVP 2.1 assertion
+				samlVerificationEngine.validateAssertion(ssoContainer, false, 
+						credentials.getIDPAssertionEncryptionCredential(),
+						ssoContainer.getIssuer().getValue(),
+						"SSO-Session Transfer module",
+						false);
+				return ssoContainer;
+									
+			} else {
+				Logger.debug("Receive StatusCode " + ssoContainer.getStatus().getStatusCode().getValue() 
+						+ " from interfederated IDP.");
+				throw new MOAIDException("SSO Container has a not valid Status Code", null);
+							
+			}
+													
+		} else {
+			Logger.warn("SSO Container is not of type SAML2 Response");
+			throw new MOAIDException("SSO Container is not of type SAML2 Response", null);
+			
+		}				
+	}
+	
+	
+	public String generateSignedAndEncryptedSSOContainer(String authURL,
+			AuthenticationSession authSession, Date date, byte[] hashedSecret) {		
+		try {
+			String entityID = PVPConfiguration.getInstance().getIDPSSOMetadataService(authURL);
+			AuthnContextClassRef authnContextClassRef = SAML2Utils
+					.createSAMLObject(AuthnContextClassRef.class);
+			authnContextClassRef.setAuthnContextClassRef(authSession.getQAALevel());			
+					
+			NameID subjectNameID = SAML2Utils.createSAMLObject(NameID.class);
+			String random = Random.nextLongRandom();		
+			try {
+				MessageDigest md = MessageDigest.getInstance("SHA-1");
+				byte[] hash = md.digest((random).getBytes("ISO-8859-1"));			
+				subjectNameID.setValue(Base64Utils.encode(hash));
+				subjectNameID.setNameQualifier(null);
+				subjectNameID.setFormat(NameID.TRANSIENT);
+				
+			} catch (Exception e) {
+				Logger.warn("PVP2 subjectNameID error", e);
+				
+			}
+						
+			SubjectConfirmationData subjectConfirmationData = SAML2Utils
+					.createSAMLObject(SubjectConfirmationData.class);
+			long maxSSOSessionTime = AuthConfigurationProviderFactory.getInstance().getSSOCreatedTimeOut() * 1000;		
+			Date ssoSessionValidTo = new Date(authSession.getSessionCreated().getTime() + maxSSOSessionTime);
+			subjectConfirmationData.setNotOnOrAfter(new DateTime(ssoSessionValidTo.getTime()));			
+			
+			String sessionIndex = SAML2Utils.getSecureIdentifier();
+
+			IAuthData authData = new SSOTransferAuthenticationData(authConfig, authSession);
+			
+			Assertion assertion = PVP2AssertionBuilder.buildGenericAssertion(
+					entityID,
+					entityID, 
+					new DateTime(date.getTime()), 
+					authnContextClassRef, 
+					buildSSOAttributeForTransfer(authSession, authData), 
+					subjectNameID, 
+					subjectConfirmationData, 
+					sessionIndex, 
+					subjectConfirmationData.getNotOnOrAfter());
+		
+			//build blob with signed session information
+			String ssoDataBlob = buildSSOContainerObject(entityID, assertion, new DateTime(date.getTime()));			
+			Logger.debug("Unencrypted SessionBlob:" + ssoDataBlob);
+			
+			//encrypt session information with ephemeral key
+			byte[] encPersonData = enOrDeCryptCSR(ssoDataBlob.getBytes(), hashedSecret, Cipher.ENCRYPT_MODE);
+			String encAndEncodedPersonalData = Base64Utils.encode(encPersonData);
+			Logger.debug("Encrypted SessionBlob:" + encAndEncodedPersonalData);
+			
+			//build JSON response
+			JsonObject container = new JsonObject();
+			container.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_TYPE, SSOTransferConstants.SSOCONTAINER_VALUE_TYPE_SSO);
+			container.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_VALIDTO, subjectConfirmationData.getNotOnOrAfter().toString());
+			container.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_ENTITYID, entityID);
+			container.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_USERID, authData.getGivenName() + " " + authData.getFamilyName());
+						
+			container.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_SESSION, encAndEncodedPersonalData);
+			container.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_UNIQUEUSERID, 
+					BpkUtil.calcBPK(authData.getIdentificationValue(), "AB"));
+			
+			//TODO
+			container.addProperty(SSOTransferConstants.SSOCONTAINER_KEY_RESULTENDPOINT, "https://demo.egiz.gv.at");
+						
+			return container.toString();
+												
+		} catch (ConfigurationException | EncryptionException | CredentialsNotAvailableException | SecurityException | ParserConfigurationException | MarshallingException | SignatureException | TransformerFactoryConfigurationError | TransformerException | IOException | InvalidKeyException | IllegalBlockSizeException | BadPaddingException | NoSuchAlgorithmException | NoSuchPaddingException e) {
+			Logger.warn("SSO container generation FAILED.", e);
+		}
+		
+		return null;
+	}
+	
+	public byte[] enOrDeCryptCSR(byte[] binBlob, byte[] binSecret, int mode) throws IllegalBlockSizeException, BadPaddingException, NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException {
+        byte[] decrypted = null;
+        SecretKeySpec skeySpec = new SecretKeySpec(binSecret, "AES");
+        Cipher cipher = Cipher.getInstance("AES");
+        cipher.init(mode, skeySpec);
+        decrypted = cipher.doFinal(binBlob);
+
+        return decrypted;
+    }
+	
+	public Pair<DHPublicKeySpec, PrivateKey> createSpecificKey(BigInteger p, BigInteger g) throws Exception {
+		KeyPairGenerator kpg = KeyPairGenerator.getInstance("DiffieHellman");
+
+		DHParameterSpec param = new DHParameterSpec(p, g);
+		kpg.initialize(param);
+		KeyPair kp = kpg.generateKeyPair();
+
+		KeyFactory kfactory = KeyFactory.getInstance("DiffieHellman");
+
+		Pair<DHPublicKeySpec, PrivateKey> pair = new Pair<DHPublicKeySpec, PrivateKey>(
+		        (DHPublicKeySpec) kfactory.getKeySpec(kp.getPublic(), DHPublicKeySpec.class), kp.getPrivate());
+		return pair;
+
+	}
+	
+	public byte[] getSecret(DHPublicKeySpec kspectrans, PrivateKey privateKey) throws NoSuchAlgorithmException, InvalidKeySpecException, InvalidKeyException {
+		KeyAgreement aKeyAgree = KeyAgreement.getInstance("DiffieHellman");
+		aKeyAgree.init(privateKey);
+			
+		KeyFactory kfactory = KeyFactory.getInstance("DiffieHellman");
+		PublicKey pub = kfactory.generatePublic(kspectrans);
+		aKeyAgree.doPhase(pub, true);
+			
+		byte[] secretKey = aKeyAgree.generateSecret();
+		return secretKey;
+
+	}
+	
+	private String buildSSOContainerObject(String entityID, Assertion assertion, DateTime date) throws ConfigurationException, EncryptionException, CredentialsNotAvailableException, SecurityException, ParserConfigurationException, MarshallingException, SignatureException, TransformerFactoryConfigurationError, TransformerException, IOException {
+		Response authResponse = SAML2Utils.createSAMLObject(Response.class);
+
+		Issuer nissuer = SAML2Utils.createSAMLObject(Issuer.class);
+		
+		//change to entity value from entity name to IDP EntityID (URL)
+		nissuer.setValue(entityID);
+		nissuer.setFormat(NameID.ENTITY);
+		authResponse.setIssuer(nissuer);
+
+		//set responseID
+		String remoteSessionID = SAML2Utils.getSecureIdentifier();
+		authResponse.setID(remoteSessionID);
+		
+		
+		//SAML2 response required IssueInstant
+		authResponse.setIssueInstant(date);		
+		authResponse.setStatus(SAML2Utils.getSuccessStatus());
+		
+		//encrypt container
+//		X509Credential encryptionCredentials = credentials.getIDPAssertionEncryptionCredential();
+//		EncryptionParameters dataEncParams = new EncryptionParameters();
+//		dataEncParams.setAlgorithm(PVPConstants.DEFAULT_SYM_ENCRYPTION_METHODE);
+//						
+//		List<KeyEncryptionParameters> keyEncParamList = new ArrayList<KeyEncryptionParameters>();
+//		KeyEncryptionParameters  keyEncParam = new KeyEncryptionParameters();
+//	
+//		keyEncParam.setEncryptionCredential(encryptionCredentials);
+//		keyEncParam.setAlgorithm(PVPConstants.DEFAULT_ASYM_ENCRYPTION_METHODE);
+//		KeyInfoGeneratorFactory kigf = Configuration.getGlobalSecurityConfiguration()
+//				.getKeyInfoGeneratorManager().getDefaultManager()
+//				.getFactory(encryptionCredentials);
+//		keyEncParam.setKeyInfoGenerator(kigf.newInstance());
+//		keyEncParamList.add(keyEncParam);
+//									
+//		Encrypter samlEncrypter = new Encrypter(dataEncParams, keyEncParamList); 
+//		//samlEncrypter.setKeyPlacement(KeyPlacement.INLINE);
+//		samlEncrypter.setKeyPlacement(KeyPlacement.PEER);
+//		
+//		EncryptedAssertion encryptAssertion = null;
+//		
+//		encryptAssertion = samlEncrypter.encrypt(assertion);		
+//		authResponse.getEncryptedAssertions().add(encryptAssertion);
+		
+		//add unencrypted assertion
+		authResponse.getAssertions().add(assertion);
+				
+		//sign container
+		Credential signingCredential = credentials.getIDPAssertionSigningCredential();
+		Signature signature = AbstractCredentialProvider.getIDPSignature(signingCredential);
+		
+		SecurityHelper.prepareSignatureParams(signature, signingCredential, null, null);		
+		authResponse.setSignature(signature);
+		
+		DocumentBuilder builder;
+		DocumentBuilderFactory factory = DocumentBuilderFactory
+				.newInstance();
+
+		builder = factory.newDocumentBuilder();
+		Document document = builder.newDocument();
+		Marshaller out = Configuration.getMarshallerFactory()
+				.getMarshaller(authResponse);
+		out.marshall(authResponse, document);
+
+		Signer.signObject(signature);
+
+		Transformer transformer = TransformerFactory.newInstance()
+				.newTransformer();
+
+		StringWriter sw = new StringWriter();
+		StreamResult sr = new StreamResult(sw);
+		DOMSource source = new DOMSource(document);
+		transformer.transform(source, sr);
+		sw.close();
+		
+		return sw.toString();
+		
+	}
+	
+	private static List<Attribute> buildSSOAttributeForTransfer(AuthenticationSession authSession, IAuthData authData) {
+		List<Attribute> attrList = new ArrayList<Attribute>();
+				
+		IOAAuthParameters oaParam = new SSOTransferOnlineApplication();	
+		
+		for (String el : REQUIRED_ATTRIBUTES) {
+			try {
+				Attribute attr = PVPAttributeBuilder.buildAttribute(
+						el, oaParam, authData);
+				if (attr != null)
+					attrList.add(attr);
+				else
+					Logger.info("SSO-Transfer attribute " + el + " is empty!");
+				
+			} catch (Exception e) {
+				Logger.info("Build SSO-Transfer attribute " + el + " FAILED:" + e.getMessage());
+				
+			}
+		}
+		
+		return attrList;				
+	}
+	
+}
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider b/id/server/modules/moa-id-module-ssoTransfer/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider
new file mode 100644
index 000000000..b0744b49b
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider
@@ -0,0 +1 @@
+at.gv.egovernment.moa.id.auth.modules.ssotransfer.SSOTransferSpringResourceProvider
\ No newline at end of file
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/resources/at/gv/egovernment/moa/id/auth/modules/ssotransfer/SSOTransfer.authmodule.beans.xml b/id/server/modules/moa-id-module-ssoTransfer/src/main/resources/at/gv/egovernment/moa/id/auth/modules/ssotransfer/SSOTransfer.authmodule.beans.xml
new file mode 100644
index 000000000..1a8709e15
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/resources/at/gv/egovernment/moa/id/auth/modules/ssotransfer/SSOTransfer.authmodule.beans.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">
+
+	<context:annotation-config />
+
+	<bean id="ssoTransferAuthModule" class="at.gv.egovernment.moa.id.auth.modules.ssotransfer.SSOTransferAuthModuleImpl">
+		<property name="priority" value="1" />
+	</bean>
+
+</beans>
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/resources/at/gv/egovernment/moa/id/auth/modules/ssotransfer/SSOTransferAuthentication.process.xml b/id/server/modules/moa-id-module-ssoTransfer/src/main/resources/at/gv/egovernment/moa/id/auth/modules/ssotransfer/SSOTransferAuthentication.process.xml
new file mode 100644
index 000000000..e7d98c8c8
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/resources/at/gv/egovernment/moa/id/auth/modules/ssotransfer/SSOTransferAuthentication.process.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<pd:ProcessDefinition id="SSOTransferAuthentication" xmlns:pd="http://reference.e-government.gv.at/namespace/moa/process/definition/v1">
+
+<!--
+	STORK authentication both with C-PEPS supporting xml signatures and with C-PEPS not supporting xml signatures.
+-->
+	<pd:Task id="initializeRestoreSSOSessionTask"      class="InitializeRestoreSSOSessionTask" />
+	<pd:Task id="restoreSSOSessionTask"                class="RestoreSSOSessionTask" async="true" />
+	<pd:Task id="finalizeAuthentication" 							 class="FinalizeAuthenticationTask" />
+
+	<!-- Process is triggered either by GenerateIFrameTemplateServlet (upon bku selection) or by AuthenticationManager (upon legacy authentication start using legacy parameters. -->
+	<pd:StartEvent id="start" />
+	
+	<pd:Transition from="start" to="initializeRestoreSSOSessionTask" />	
+	<pd:Transition from="initializeRestoreSSOSessionTask" to="restoreSSOSessionTask"/>
+		
+	<pd:Transition from="restoreSSOSessionTask" to="restoreSSOSessionTask" conditionExpression="!ctx['sessionRestoreFinished']"/>
+	<pd:Transition from="restoreSSOSessionTask" to="finalizeAuthentication" />
+	
+	<pd:Transition from="finalizeAuthentication"    to="end" />
+	
+	<pd:EndEvent id="end" />
+
+</pd:ProcessDefinition>
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/resources/moaid_ssotransfer_auth.beans.xml b/id/server/modules/moa-id-module-ssoTransfer/src/main/resources/moaid_ssotransfer_auth.beans.xml
new file mode 100644
index 000000000..4a4af4ac5
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/resources/moaid_ssotransfer_auth.beans.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xmlns:tx="http://www.springframework.org/schema/tx"
+	xmlns:aop="http://www.springframework.org/schema/aop"
+	xsi:schemaLocation="http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.1.xsd
+		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd
+		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd">
+ 
+							
+	<bean	id="SSOContainerUtils"
+				class="at.gv.egovernment.moa.id.auth.modules.ssotransfer.utils.SSOContainerUtils"/>
+
+
+	<bean	id="SSOTransferSignalServlet"
+				class="at.gv.egovernment.moa.id.auth.modules.ssotransfer.servlet.SSOTransferSignalServlet"/>
+
+
+	<bean	id="SSOTransferServlet"
+				class="at.gv.egovernment.moa.id.auth.modules.ssotransfer.servlet.SSOTransferServlet"/>
+
+
+<!-- Federated Authentication Process Tasks -->
+	<bean id="RestoreSSOSessionTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.ssotransfer.task.RestoreSSOSessionTask"
+				scope="prototype"/>
+				
+	<bean id="InitializeRestoreSSOSessionTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.ssotransfer.task.InitializeRestoreSSOSessionTask"
+				scope="prototype"/>
+																						
+</beans>
\ No newline at end of file
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/resources/sso_transfer_template.html b/id/server/modules/moa-id-module-ssoTransfer/src/main/resources/sso_transfer_template.html
new file mode 100644
index 000000000..962faa58f
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/resources/sso_transfer_template.html
@@ -0,0 +1,447 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+<head>
+  <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
+  
+   <!-- MOA-ID 2.x BKUSelection Layout CSS -->               
+    <style type="text/css">
+			@media screen and (min-width: 650px) {
+			
+				body {
+					margin:0;
+					padding:0;
+					color : #000;
+					background-color : #fff;
+			  	text-align: center;
+			  	background-color: #6B7B8B;
+				}
+  
+			  #page {
+			    display: block;
+			    border: 2px solid rgb(0,0,0);
+			    width: 650px;
+			    height: 460px;
+			    margin: 0 auto;
+			    margin-top: 5%;
+			    position: relative;
+			    border-radius: 25px;
+			    background: rgb(255,255,255);
+			  }
+			  
+			  #page1 {
+			    text-align: center;
+			  }
+			  
+			  #main {
+			    /*	clear:both; */
+				  position:relative;
+			    margin: 0 auto;
+			    width: 250px;
+			    text-align: center;
+			  }
+			  
+			  .OA_header {
+			/*	  background-color: white;*/
+			    font-size: 20pt;
+			    margin-bottom: 25px;
+			    margin-top: 25px;
+			  }
+			
+			  #leftcontent {
+			    /*float:left; */
+				  width:250px;
+				  margin-bottom: 25px;
+			    text-align: left;
+			    /*border: 1px solid rgb(0,0,0);*/
+			  }
+			
+			  #leftcontent {
+				 width: 300px;
+				 margin-top: 30px;
+			  }
+      
+        h2#tabheader{
+				  font-size: 1.1em; 
+          padding-left: 2%;
+          padding-right: 2%;
+          position: relative;
+			  }
+        		  
+			  .setAssertionButton_full {
+			  	background: #efefef;
+				  cursor: pointer;
+				  margin-top: 15px;
+			    width: 100px;
+			    height: 30px
+			  }
+			
+			  #leftbutton  {
+				 width: 30%; 
+				 float:left; 
+				 margin-left: 40px;
+			  }
+			
+			  #rightbutton {
+				 width: 30%; 
+				 float:right; 
+				 margin-right: 45px; 
+				 text-align: right;
+			  }
+        
+        button {
+          height: 25px;
+          width: 75px;
+          margin-bottom: 10px;
+        }
+        
+       #validation {
+        position: absolute;
+        bottom: 0px;
+        margin-left: 270px;
+        padding-bottom: 10px;
+      }
+			
+			}
+
+      @media screen and (max-width: 205px) {
+        #localBKU p {
+          font-size: 0.6em;
+        } 
+        
+        #localBKU input {
+          font-size: 0.6em;
+          min-width: 60px;
+         /* max-width: 65px; */
+          min-height: 1.0em;
+         /* border-radius: 5px; */
+        }
+        
+      }
+
+      @media screen and (max-width: 249px) and (min-width: 206px) {
+        #localBKU p {
+          font-size: 0.7em;
+        } 
+        
+        #localBKU input {
+          font-size: 0.7em;
+          min-width: 70px;
+       /*    max-width: 75px;    */
+          min-height: 0.95em;
+        /*  border-radius: 6px;    */
+        }
+         
+      }
+
+      @media screen and (max-width: 299px) and (min-width: 250px) {
+        #localBKU p {
+          font-size: 0.9em;
+        } 
+        
+        #localBKU input {
+          font-size: 0.8em;
+          min-width: 70px;
+       /*    max-width: 75px;      */
+      /*    border-radius: 6px;  */
+        }
+
+      }
+
+      @media screen and (max-width: 399px) and (min-width: 300px) {
+        #localBKU p {
+          font-size: 0.9em;
+        } 
+        
+        #localBKU input {
+          font-size: 0.8em;
+          min-width: 70px;
+      /*     max-width: 75px;     */
+      /*    border-radius: 6px;       */
+        }
+
+      }
+      
+      @media screen and (max-width: 649px) and (min-width: 400px) {
+        #localBKU p {
+          font-size: 0.9em;
+        } 
+        
+        #localBKU input {
+          font-size: 0.8em;
+          min-width: 70px;
+      /*     max-width: 80px;       */
+     /*     border-radius: 6px;          */
+        }
+
+      }
+
+
+			
+			@media screen and (max-width: 649px) {
+				
+        body {
+					margin:0;
+					padding:0;
+					color : #000;
+			  	text-align: center;
+          font-size: 100%;
+			  	background-color: #MAIN_BACKGOUNDCOLOR#;
+				}
+        				
+			  #page {
+			     visibility: hidden;
+			     margin-top: 0%;
+			  }
+			  
+			  #page1 {
+			    visibility: hidden;
+			  }
+			  
+			  #main {
+			    visibility: hidden;
+			  }
+        
+        #validation {
+          visibility: hidden;
+          display: none;
+        }
+			  
+			  .OA_header {
+			    margin-bottom: 0px;
+			    margin-top: 0px;
+			    font-size: 0pt;
+			    visibility: hidden;
+			  }
+			
+			  #leftcontent {
+			    visibility: visible;
+			    margin-bottom: 0px;
+			    text-align: left;
+			    border:none;
+          vertical-align: middle;
+          min-height: 173px;
+          min-width: 204px;
+          
+			  }
+        
+        input[type=button] {
+/*          height: 11%;  */
+          width: 70%;
+        }
+			}
+			      
+			* {
+				margin: 0;
+				padding: 0;
+        font-family: #FONTTYPE#;
+			}
+							      			
+			#selectArea {
+				padding-top: 10px;
+				padding-bottom: 55px;
+				padding-left: 10px;
+			}
+			
+			.setAssertionButton {
+				background: #efefef;
+				cursor: pointer;
+				margin-top: 15px;
+			  width: 70px;
+			  height: 25px;
+			}
+			
+			#leftbutton  {
+				width: 35%; 
+				float:left; 
+				margin-left: 15px;
+			}
+			
+			#rightbutton {
+				width: 35%; 
+				float:right; 
+				margin-right: 25px; 
+				text-align: right;
+			}
+
+/*		input[type=button], .sendButton {
+				background: #BUTTON_BACKGROUNDCOLOR#;
+        color: #BUTTON_COLOR#;
+/*				border:1px solid #000;  */
+/*				cursor: pointer;
+/*        box-shadow: 3px 3px 3px #222222;  */
+/*			}
+			
+/*      button:hover, button:focus, button:active, 
+      .sendButton:hover , .sendButton:focus, .sendButton:active,
+      #mandateCheckBox:hover, #mandateCheckBox:focus, #mandateCheckBox:active {
+				background: #BUTTON_BACKGROUNDCOLOR_FOCUS#;
+        color: #BUTTON_COLOR#;
+/*				border:1px solid #000;                */
+/*				cursor: pointer;
+/*        box-shadow: -1px -1px 3px #222222;  */
+/*			}
+      
+*/      
+			input {
+				/*border:1px solid #000;*/
+				cursor: pointer;
+			}
+      
+      #localBKU input {
+/*        color: #BUTTON_COLOR#;  */
+        border: 0px;
+        display: inline-block;
+        
+      }
+			
+      #localBKU input:hover, #localBKU input:focus, #localBKU input:active {
+        text-decoration: underline;
+      }
+      
+			#installJava, #BrowserNOK {
+				clear:both;
+				font-size:0.8em;
+				padding:4px;
+			}
+						
+			.selectText{
+			
+			}
+			
+			.selectTextHeader{
+			
+			}
+			
+			.sendButton {
+        width: 30%;
+        margin-bottom: 1%;	
+			}
+			
+			#leftcontent a {
+				text-decoration:none; 
+				color: #000;
+			/*	display:block;*/
+				padding:4px;	
+			}
+			
+			#leftcontent a:hover, #leftcontent a:focus, #leftcontent a:active {
+				text-decoration:underline;
+				color: #000;	
+			}
+						
+			.infobutton {
+				background-color: #005a00;
+				color: white;
+				font-family: serif;
+				text-decoration: none;
+				padding-top: 2px;
+				padding-right: 4px;
+				padding-bottom: 2px;
+				padding-left: 4px;
+				font-weight: bold;
+			}
+			
+			.hell {
+				background-color : #MAIN_BACKGOUNDCOLOR#;
+        color: #MAIN_COLOR#;	
+			}
+			
+			.dunkel {
+				background-color: #HEADER_BACKGROUNDCOLOR#;
+        color: #HEADER_COLOR#;
+			}
+			      
+			.main_header {
+			   color: black;
+			    font-size: 32pt;
+			    position: absolute;
+			    right: 10%;
+			    top: 40px;
+				
+			}
+      
+     	#alert {
+		    margin: 100px 250px;
+		    font-family: Verdana, Arial, Helvetica, sans-serif;
+		    font-size: 14px;
+		    font-weight: normal;
+		    color: red;
+	    }
+	
+	    .reqframe {
+		    /*display: none;*/
+        visibility: hidden;
+		  
+	    }
+      			                        
+    </style> 
+
+	#if($timeoutURL)
+		<script type="text/javascript">
+			function sloTimeOut() {
+				window.location.href="$timeoutURL";
+			
+			}	
+	
+		</script>
+	#end
+
+
+  <title>Single Sign-On Session Transfer</title>
+</head>
+
+#if($timeoutURL)
+	<body onload='setTimeout(sloTimeOut, $timeout);'>
+#else
+	<body>
+#end
+  <noscript>
+		<p>
+			<strong>Note:</strong> Since your browser does not support
+			JavaScript, you must press the Continue button to resume 
+			the authentication process after the SSO session transfer from smartphone to application is complete.
+		</p>
+		
+		<a href="$timeoutURL">Press this link to resume</a>
+	</noscript>
+
+  <div id="page">
+		<div id="page1" class="case selected-case" role="main">
+			<h2 class="OA_header" role="heading">MOA-ID Single Sign-On Session Transfer Service</h2>
+			<div id="main">
+				<div id="leftcontent" class="hell" role="application">
+          
+          #if($errorMsg)
+	         <div class="alert">
+		        <p>$errorMsg</p> 
+	         </div>	
+	        #end
+
+	        #if($successMsg)
+	         <div>
+		        <p>$successMsg</p> 
+	         </div>	
+	        #end
+	        
+	        #if($QRImage)
+	         <div>
+	         	<img src="data:image/gif;base64,$QRImage">
+	         </div>	
+	        #end
+	        
+				</div>
+			</div>
+		</div>
+		<div id="validation">
+			<a href="http://validator.w3.org/check?uri="> <img
+				style="border: 0; width: 88px; height: 31px"
+				src="$contextpath/img/valid-html5-blue.png" alt="HTML5 ist valide!" />
+			</a> <a href="http://jigsaw.w3.org/css-validator/"> <img
+				style="border: 0; width: 88px; height: 31px"
+				src="http://jigsaw.w3.org/css-validator/images/vcss-blue"
+				alt="CSS ist valide!" />
+			</a>
+		</div>
+	</div>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/test/java/at/gv/egiz/tests/Tests.java b/id/server/modules/moa-id-module-ssoTransfer/src/test/java/at/gv/egiz/tests/Tests.java
new file mode 100644
index 000000000..0eb71ec92
--- /dev/null
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/test/java/at/gv/egiz/tests/Tests.java
@@ -0,0 +1,83 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the \"Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egiz.tests;
+
+import com.google.gson.JsonObject;
+
+import at.gv.egovernment.moa.id.auth.modules.ssotransfer.SSOTransferConstants;
+
+/**
+ * @author tlenz
+ *
+ */
+public class Tests {
+
+	/**
+	 * @param args
+	 */
+	public static void main(String[] args) {
+//		String json = 
+//			"{\"data\":{\"session\":{\"validTo\":\"2015-10-09T10:55:34.738Z\",\"entityID\":\"https://demo.egiz.gv.at/demoportal_moaid-2.0\",\"userID\":\"Thomas Georg Lenz\",\"sessionBlob\":\"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDJwOlJl\\u000ac3BvbnNlIHhtbG5zOnNhbWwycD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4w\\u000aOnByb3RvY29sIiBJRD0iXzQ5ZjgzMDIyZjRkZjFjODMyMDNlZGU1NTQxZDY1ODU4\\u000aIiBJc3N1ZUluc3RhbnQ9IjIwMTUtMTAtMDlUMTA6MzU6NTEuMDI0WiIgVmVyc2lv\\u000abj0iMi4wIj48c2FtbDI6SXNzdWVyIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFt\\u000aZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIiBGb3JtYXQ9InVybjpvYXNpczpuYW1l\\u000aczp0YzpTQU1MOjIuMDpuYW1laWQtZm9ybWF0OmVudGl0eSI+aHR0cHM6Ly9kZW1v\\u000aLmVnaXouZ3YuYXQvZGVtb3BvcnRhbF9tb2FpZC0yLjA8L3NhbWwyOklzc3Vlcj48\\u000aZHM6U2lnbmF0dXJlIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5\\u000aL3htbGRzaWcjIj48ZHM6U2lnbmVkSW5mbz48ZHM6Q2Fub25pY2FsaXphdGlvbk1l\\u000adGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4\\u000aYy1jMTRuIyIvPjxkczpTaWduYXR1cmVNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8v\\u000ad3d3LnczLm9yZy8yMDAxLzA0L3htbGRzaWctbW9yZSNyc2Etc2hhMjU2Ii8+PGRz\\u000aOlJlZmVyZW5jZSBVUkk9IiNfNDlmODMwMjJmNGRmMWM4MzIwM2VkZTU1NDFkNjU4\\u000aNTgiPjxkczpUcmFuc2Zvcm1zPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRw\\u000aOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjZW52ZWxvcGVkLXNpZ25hdHVy\\u000aZSIvPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8y\\u000aMDAxLzEwL3htbC1leGMtYzE0biMiLz48L2RzOlRyYW5zZm9ybXM+PGRzOkRpZ2Vz\\u000adE1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1s\\u000aZW5jI3NoYTI1NiIvPjxkczpEaWdlc3RWYWx1ZT44eE9qNmlYVzhIQzk5UGhETEZ0\\u000aOVp0M205VWliaVdrdHMzaWVQTS9CZlFZPTwvZHM6RGlnZXN0VmFsdWU+PC9kczpS\\u000aZWZlcmVuY2U+PC9kczpTaWduZWRJbmZvPjxkczpTaWduYXR1cmVWYWx1ZT5mNjM2\\u000aYjVBeGx6THdUL0I1SmdLdnhNN0haK1lEZGVldUdaRUlxc05KdHdiN05TVFhlbVFC\\u000aTExObDlJTk1aUW1Ybkx3ektCc0pra0tGTXl3MkpsNXVYcWlHWVBzMExTWTNiWTdj\\u000aTTZoeHpDaGdVVHRMWXlPcE9qemxxbE5CN2FKTVpZWU10Q2phcWNqSmxVM0wxTjBv\\u000aYUJ5QlRjaTRHdjd5TUJkdE9nRElHNVVpVEppVmVNOURZcUowZFVaZDNRcG1BK0Zm\\u000aUm10WFVzaVRzU0N0b3lWVHlXYTJWemJweTZxcDMwWkZSTU03LzU0Q0NWZHIvaDZW\\u000aTnZCQ1YydkFEMWdZaUg5VG41aTRSRmRWMFBKNTkrNS9HYXVUMm1HSVRUVmNreVk2\\u000aRlJQSjI2MUV0bmdScE8xK1FYRDZwQVZBM2V6Rm9ZbkkyQ2dYdHQ2K2EyTkV3cnBO\\u000aaHc9PTwvZHM6U2lnbmF0dXJlVmFsdWU+PGRzOktleUluZm8+PGRzOlg1MDlEYXRh\\u000aPjxkczpYNTA5Q2VydGlmaWNhdGU+TUlJREZUQ0NBZjBDQkZVQm5MNHdEUVlKS29a\\u000aSWh2Y05BUUVMQlFBd1R6RUxNQWtHQTFVRUJoTUNRVlF4RFRBTEJnTlZCQWNNQkVk\\u000aeQpZWG94RFRBTEJnTlZCQW9NQkVWSFNWb3hJakFnQmdOVkJBTU1HVTFQUVMxSlJD\\u000aQkpSRkFnS0ZSbGMzUXRWbVZ5YzJsdmJpa3dIaGNOCk1UVXdNekV5TVRRd016UXlX\\u000aaGNOTVRjeE1qQTFNVFF3TXpReVdqQlBNUXN3Q1FZRFZRUUdFd0pCVkRFTk1Bc0dB\\u000aMVVFQnd3RVIzSmgKZWpFTk1Bc0dBMVVFQ2d3RVJVZEpXakVpTUNBR0ExVUVBd3da\\u000aVFU5QkxVbEVJRWxFVUNBb1ZHVnpkQzFXWlhKemFXOXVLVENDQVNJdwpEUVlKS29a\\u000aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBSUp2MHFlOVVkdkZZU0w1STAy\\u000aR29rd0VWZnNJR2M3STdFaFZOT3hZCjltdFVlbm1ocU5yTHNMQkZnMUlpUGJrMElT\\u000aV2hPUndQeVZwL1AzK0d5R1AzMzlxWjY4VUNHVjM2MUUwUW03Y2pQZS9PMytyM0hB\\u000aTTIKWkJOOG9BWm9IbXBock5TNmZLZlk1OGt5Z3RyVWErWnlNellXVFRpUzMyU0NN\\u000aOEg1NWJsdUVGYmVaa3NuYlAwWTk0SWprZkpkZ3Z6bApNeHpybFN5b1YyeW1XQmp2\\u000aUzV3ZWxESGdiQ0t5anNqSWhUUmpKdS9vbEdKeWVuMDEvRXBJVnRTeURYTy8ySVMy\\u000adjJPOVVpRndBb3lCCllBalBubDNIeEsyQTU3N25SNjNNeGxnUDAvcytyODR1QnFP\\u000aQWxiNHFuYnBVN2x1NUd4bENQa1ptcFJvb0NRWVVSaW9DK3dqUzZsTUMKQXdFQUFU\\u000aQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFCcU83a2txL2dSYWhBdnBzUWc1TExa\\u000aUk9HRnI5cElQcnlOOXhtSkdnUG83agpLTmw3cnM3Z05TMGxtdWx1WVdXbkpjd0FQ\\u000aYndGZWI5NTRWTUI5eDlwOVFFdzVSblhhbVVZOXFhMExnY1MvdC9XWDZ2SmtaUE5o\\u000aV3BoCjhiWHdoME12bHNiZnJ2RFRKcjhjakgzcWZ4SVRwN3BhM3hiMXFFN3N1UmZm\\u000aVlVkRFhhd2lYWG5XSi9XSnIrdHdWVkhIRXFuWnoxbEEKclNETHhNOHNDakc4RGVK\\u000adzh2blF5NW1QR3JHVlRCYmE0dXBjOFVUWTFuUFY5VTJHQkpWWXVBa29WUmpiVGxO\\u000adnJMNUpxTnF5cEtjRwpiZWpqV3hncnpaa2VRZVUyaEZjanVubWd3R1ordWcyZnE0\\u000aa0trUWZ0d2NxZUpUenl6Qm9vMitPbzRUbWZic2gvb254UFdBPT08L2RzOlg1MDlD\\u000aZXJ0aWZpY2F0ZT48L2RzOlg1MDlEYXRhPjwvZHM6S2V5SW5mbz48L2RzOlNpZ25h\\u000adHVyZT48c2FtbDJwOlN0YXR1cz48c2FtbDJwOlN0YXR1c0NvZGUgVmFsdWU9InVy\\u000abjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpzdGF0dXM6U3VjY2VzcyIvPjwvc2Ft\\u000abDJwOlN0YXR1cz48c2FtbDI6RW5jcnlwdGVkQXNzZXJ0aW9uIHhtbG5zOnNhbWwy\\u000aPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj48eGVuYzpF\\u000abmNyeXB0ZWREYXRhIHhtbG5zOnhlbmM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEv\\u000aMDQveG1sZW5jIyIgSWQ9Il8zZmQzNTg5MmU5YThlYWNiOGUwOGYyODBhODNmY2I3\\u000aNCIgVHlwZT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjRWxlbWVu\\u000adCI+PHhlbmM6RW5jcnlwdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cu\\u000adzMub3JnLzIwMDEvMDQveG1sZW5jI2FlczEyOC1jYmMiIHhtbG5zOnhlbmM9Imh0\\u000adHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jIyIvPjxkczpLZXlJbmZvIHht\\u000abG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj48ZHM6\\u000aUmV0cmlldmFsTWV0aG9kIFR5cGU9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQv\\u000aeG1sZW5jI0VuY3J5cHRlZEtleSIgVVJJPSIjX2E3NDBjZjA5MTViZDE1MmRiNzRk\\u000aMDNjZDQ1NzUyMTM3Ii8+PC9kczpLZXlJbmZvPjx4ZW5jOkNpcGhlckRhdGEgeG1s\\u000abnM6eGVuYz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjIj48eGVu\\u000aYzpDaXBoZXJWYWx1ZT43R0hKY0NYYXlzME1pY2ZvYXc3cnFNeTZ1bUQyd0FEQmtH\\u000aOThKclJ2UUdMczJneTBOSWFvSlM2SWM1Z254RXBNcUZHZ2ZLNHBBWGxRUVh3K1h6\\u000aY0RNaURhY2tqS1c5ckptNTh0b3dxNmFEbWVIU2doTTRDVzhVb1RaQlFlazVvY1dU\\u000aNmRIT3hPVzFFOFUrTXprTEg1NjVXUWxLYkdHamVSSGNzb3V3MXFuNk1XS01EU0V4\\u000aRzQrZERzSVliMk1uaEc3OEh6TDNZK0VMVG40TWd1cXF4bmpTVC9rRkpTK2dSMm93\\u000aL2tHVHN2ZnlLWmdMZUVYTzRpVHlNM2RzRk1Ma05rM0tHSHVHRmhGeUxycUR3Sko2\\u000aTmY5OVZRTmlDZDlrUnpxOE1qWklpNWQ0SjlhSmgvRk93NFI0TXAveCsvaC9hYVhk\\u000acDVyQ09CcUVaZ3FZUXlqT2FIMlAxRHR0VkU5SU5xS2w1OXh5ZTJaR0tDd1p5TTgr\\u000adWdSRnVDbTJ2RFlRSUx1T1RTaVNpbkJsNnBpLzFYRktNL1lVbTRJMXA0N21LNDlE\\u000aeW9Ia0lBaUk0NjQ2ejNJZ0tMZTBnaFlQYUlvTHhNcDE1ZE83RHRDQzhsZnYwb3Qx\\u000aYVdvTy9TcGpXaVJiOEhCaXdleGxTdHV4dVorUGVqZDlzUS9neTNFOFp1MWJXRmsv\\u000aTDVrNTZqUTAxZStIcEdORW5FSml1c1RHWldMRTZBY1lvd1NCeEZidC9RUHhGTlhh\\u000aRFBmcmlGRGZMK1RuMngyc2Rwb1RlMVpZM1JnZXo5b1Y2QUtJQWZZWC8zMllsT0NK\\u000aTlV5Myt4OU5teHljOFdKNTBjQ2RTd3ZuNTRBc1Z2U0xYRi9sbHIwQmh2cWRWQ0dP\\u000aTy82WGQvdEtpblFPWHdmeEJBMDVJZSs5MFZhU1J2NGFrRXJ4dHhrekVIeXB3R01j\\u000aVStieTYybDh5Q2Qya01vMnpQK0hmZ3NkTU9Ba2hrbDUvRXB2NVdiZGMzeElKRUhK\\u000aOVptbitUdGNWR2FiOHNPeSsyblIwQWNwZDJxeVIvNkNUd3dodk5nbXF1TldiLy9P\\u000aaGNxdDMvR1dPZkt0NGhrRnQxeGE2allTSXVoNHVWMHJqcENvK21ISFk4ZFZaTGZ6\\u000aNE9oR3dpNGd4bDBlV3hYUWF3UGpMWlI5RzdpQ1NCT2ZPV0d5bkdydklKSFF2VUJD\\u000aUVUwLzh3eFNxRmkxcVdQVXN2ZWtxV012SFpYTGdMMGZNYUJEa1ZZTm5YT2FlalJU\\u000aVHNZeENZc1AxYlRCNDY5ZytjRkQ1bEd0VDErTi95S3dKOUJTTGhaenhzRVhVWkhG\\u000aQ1NJTk1vTTlnaVF4TzI2L0VLUENMdXp2bnkyN3orNWdxcURkVzhlVUFCUmEyeFpp\\u000aZ204YmFkSllGWE12dkdDUVBjcmhiN3c1c3dSL2I1TXNiZXV4L3F0RFQ4R3VWcUNG\\u000ac3JDL3E4MlZpOUd5b3VCWDdGRk50UWhWRDFFVWtCQWZTYWE2UDhKU2VPdE01TVYr\\u000aV21OcGJrQ0U2M2hZS2g4cHN5MUdMdlRZRVA3Slh3TmNIWXlmS3FtdXk5S1dOVmUv\\u000aT2JPZTM5azhCWE5tWE9DejRJay93ajZqaU1DWEsrblhwdTBZQ1Z2ODJXM1BMeGlR\\u000ab1liRURMMjNHV05sNFFHQzQ1dE45WUpwK29CSGZjRStmUHk4S1FrOFBDK0s4SFFr\\u000aK21HV3NkTVUxUitTaTExY0VYdzBKTTRTczJzTWpZb05tQXd6a2RvRHliVkdnK3B3\\u000aSnUrUmFmaEJrSmpIU0FMeVQ3Y1R3dncrOW56S1BIdUhvWW5wSTRLQSt6U2xrYkUr\\u000aQ0dSbzd1MUxXVFl0cGZTYnFtd1NjYVlxU01WaTZ5QVdkRnoyS001LzlkVHB6alBY\\u000aNGhOZW82ZE96eVRHUkFMVnVUZi9Ma0RqaElqWGJ0Z2J6ZnU0aWdrWXg3Q2d1RnZ0\\u000abVlkTEhNSE4yRnFOTkN1UWk2bTJLUGYyUG5HdmVrSFVwMEJYZ3NEOUhkZFJtNHBF\\u000aYnE1VEsvV05RTzBuS0g0M1owOU9NcWZZbHEybk5mTi84ZnMyTjc1c2h5NmtheElK\\u000aL0FZUlNkOUU5M1VjOWJmV2FIeUwraWNNTE1GelU5MytMZlhpREkyWDVScEVtSnFB\\u000aSUMwVlJ0NWtXdnlVNGVlWnhOdE8zWUtxUnN2YVo0dzhnZ0I3dkxheFFKUWtnMWhs\\u000acVAzQzhDQW5HWnkrdDR5alRVejA1LzlpQi9HRk1DdDNteEpPajUvaVdTOTZRRW54\\u000aVm8wdVYvYzhDRFd6OERHYzYvLzFBQzBWS0VmaGRsSmFGOHg1NzVHNTI2dHoxTVln\\u000aMHBaaitNRzlsRUxkNm12d011cVE3VEVZdEYyN0Y4Vk5iQ29ZWXUraDhJTCs1Y0Vr\\u000acnBjakUzMm9MbWx4ZjBjNnpZaDhwa3FsVTR2RHlQeGJJcm50WkFPcThMUzk5Vktr\\u000aUjdFL0w5OXNoZUxqd3I0bTJtQ21CZ2tGZVZhVG1Ca00vSFd4MUNEYjlIcVM0N25Z\\u000aSWJaQW94ampIK0QzR1EweXlES1R3aG1iSXNHMFQ4Ry96eStRR0pmNkg2MXg0M1ZJ\\u000abkNwRkxmQjNiQUNJay9OanhCeFdheGVwMXRMMTRBSlRMZlROTnA3K3dCT016THhm\\u000aSHBjSUlWT2dOeXJ6UVk2Q0x6eXlDM2hub212a0hadFJ2WmpBYmExMmJSZ3VoTUJX\\u000aOFZiaHNKMmZaekZ3TXp0amxzSEkwREc2OGs1R0JDemFDQVRPZlBBWnFPN2lEQ2JC\\u000aMW1KSEgzTmxvQ2xuL1pTY01rOUVqTERyTndIWHZ4ZEFTRFMwS1RrZVNxS21TZm54\\u000aUWlSQ3lLNjhrSEZNc0trUTRYS3JKZjZGMWRreVYrL3NFdzRsS1FFYW52VkVVSTJx\\u000aUExDSVZnVWVkQVFaeFAxeVp0dDA1V2ptSUdhZnhQMldWNE9PYm8vTGFaamo0YW9H\\u000aNjNxWkdGdGJyWUt4TVc1Ny9RL0ZkbjN5TUpmUlkxVGU0UCtpTTNHUjNRcU1QeVMr\\u000aZWZDMlRDNk9pYithOHZ2SVcxTFI4OGV0V2t4SHJzMEpVcVRpM1ZEY1lXNEcwUHVn\\u000aTFhsZEYwWVVod1RLaTlOUjZmWTNXMXBTQUlNRGYvbk5hcVBIUnNLVWU4Z3pwcll3\\u000aOUdWLytXWjkrNUxEQnYzWmNKVGlLcllOcG1TUHl2MDdvNWx2Mmo2MXJtaEdsQVJ6\\u000aODJzWlhDUzA5K0lyaUpmVUg4bko0NFRFUk8wb1pBd2RxZWhEVmQ2YzZIV044dlJI\\u000aeEVJZWhmeXJhUVZ5Q3FlQkU3d3VPcXZFSmI2R0Urc1czNlBMNGFwT2ZMcCtISU5V\\u000aMkRhbVBrWHJWdVV6Q1dWZWlXaGIzSVBPNk81WkNENVp5RHlQc0liV3RuMnc2bnpI\\u000aU3EyUDhOdmZZRHhTcmM2YlU1aThoQ0FOZFdudTliMWJia0tXTXhUazhjamQ2bk8w\\u000aN1FtZnJFZGJCQ1ptWmh6blJ2cmRYMDdHSXo0YXhtM0Z2UHBtazBvZ1FaUzBieDd1\\u000aSWhFTDhGR2ozQW9lSllpOFB0dFA3NmFKaTRPYndlUmhlWVE2L1p0NHlPcXhabUph\\u000aMEFnTjJieTlpT1kyZ2tLclg2RTY1UWMzM2Q0Wlh6aXdDc1BsNVlGQmY1bG9ndGFE\\u000acXFVU0p1TEQyUEMyZEZNeDAzaGkrcUpSNmxPZ3ozYjJrM3dUTjhGTjJBMnQycHo2\\u000aNjJSS3IyQVRuSklrZkdndHVTcFlicGdab05VL0pheS9qMERWMXRaMkFmODdsUU43\\u000ablphdmF0YjVvbWx1Vi8yU3ZVYk5rbW1HdUhrTmFjQnNuTjIza3FOTEFrMmZvQ0xZ\\u000aT1FZaG5uQm1ZTUdYdS9tOG9haXdmUzhxRlZyYllTc0tKSWpLU1ptaFZBU3hXa01t\\u000aT3lSVUcrYkhlQ3RuT3ljWmlhb25XZElvbFUzT2hJMi9JTkpDSUNzQjJNWGhtNkpa\\u000aOEFtcUlqSGQxR1JvVElRTDlFNlBUbGF1MVB5dDhmbnl0aERac2R5L1dmMGU2SGRy\\u000abXJleXBiaE5PYTh4NUF4ckhaRGxjemttaUJyOHEzU0dYU1JVWUt0YndGUk5DZjFX\\u000aYkVyci9uN3duVmlZOENiS0wxZGJzMzlDNmtaVGlUVE16b1NCaFVKcW0xeUpHZUM3\\u000aT2pLRC9VNUFUK2NmOXV3c2hVNDhKZHNUNDVOWjJnOFNkL21xODlyTFBRVTAxNG9h\\u000aNUhRbzV4bEkvaldPUE1MM0R3MmtFVkkyZ3R0eG5HamExVk9aZVlJSGM1amJWenBx\\u000aSDMxZ2ZNYkZLTTNqNHRyaFVKVmFyM29ZWndZWnR6c1IyNmg5NWxIVlNNQzJ2MGZH\\u000aZ29nRFBMYzROejFtelNUNzQ2OFFTeVJJTzZtOTVTOTV3UWxiWXFoRzhMLzJsZW13\\u000aS1JNMUNUSGVUeVFjQlRNb1lrdU9wNFRZaVlXZzAwMjlXelNyMkhCUlFXZm9zNzc0\\u000abWlBbjBEQWtxcysybzFOdUtjTmU3cVFmY1Vnd2lHNzZJK1FZcEZPbkJSeUh1d1px\\u000acHR1WmpKTWV5amtZWC9wRE5VRkxYMmNWRGgrT0FSRUFaT3NBSVlPbnU1OWZnRHVB\\u000aM2RrOVNHMGVIclNXVkR2dU5yTDJiWm1hUXJxQmZ4bXRaall2Q0lmdDFXcmQvUkFo\\u000aeUs4bEFMNWFJZ1pZajV4WjBtV2hXd2hHTFBKNXBnMXpCeHFmZ2hyNzhRSVBQNGEr\\u000aT3YwU21qTmdwbVNQQzc4d2RPNVh6N3NzeU1mUC9uWkhVZEVJbUNqUGVMM2lJalhn\\u000aVVY1SjRnckc1cWY3WHZJQzBpNGZBdktnZ01LYXFYWGRZclBCZzFWQm5vR3BNVWZm\\u000aUU9Wa29pcjNjL2hYNWxlN1BoQlp3OVlWaEN3UDg2VU1oeGFmclp6blQzbnVUV0lL\\u000aRUMxOWVXNDJSak0wU3V2dWlreFY0L1o1UUhxcUtvNmRPamJZL1NKR1FQU1VWczdx\\u000aU3owNks1bTF4Q3Mybk51QWR2V0lVS25leE1oRUxsRTVGbGJQVkZ0Nkc3d0dLNUxv\\u000aNkV0bVZPWnE3bXpxWS84RHdUMnpUbm1UbW1lZEdIZDlUUWRCM1gxU2orUHlFRDFr\\u000aT01kYUkvVlVOWCt4bFlmUkd4RHF1Rlp2YmdTVSsxaDJHSjQ5M3VsYk9KVmJjeXpP\\u000acFFmTks5UTNNNEp2V1hPRVUzT2NPVkMwbkZGUUVEbDFEZ2h2Wldoeit6dy9sZkg1\\u000ab3UvV0kvOUpmKzB6ajJNNDE2YytTbkpneCtaSVZUd0lTQlhDc1NicW5tbG54ZE9a\\u000aSnhrbElrWXlwMGVNZ0RkTzZscHdTbXlLc21KMFVaM3ZPUFRuQXBxdTROeUxLOXUw\\u000aNzFZRVB5WUhWWnRXOUdITm5LM3RvZm5TVVZpMSsrVEx5bDY4aWRqS0RCa2hFVWNy\\u000aeWU5QkFhak1VR3VSc00zQ0RNZGlrSEd6eDVwM2RoeGIwczJTcGhxREhFLzJMSlBj\\u000aU2kyQkFVWTA1WXNDUytiWDgzb3VESDRXSmozZDM0NFFTcnFwQnk0ek11UHJPdWdT\\u000aRWo1a1Z1MjhMT1RKcnZPL09jbmxoTUYvWndielBRVVI5TmhUV21GOFV4WEE0Vjd0\\u000aK2RQNDVnTFFvYnNnVHY4MXkrUDVuTnZ2alNtL2I3aVpzZXJhV0VaSHlwNGo0bis0\\u000aSWJJTmZrcXVYVG9pcTlyVHFvZFdyemN4TkJCdDBOMTFtRWpwM2ZvYjJiVFU5QkVn\\u000aalZlTHRFSGxqVFJJV1ovK1IvTHpTaXRJL241MlNvTUI4RlVZc2lXQzF3WVBOY2lR\\u000aeEJYdFRNZ2xLY3NiVkUyN0dxSEtueDVkMlVHSE9iQVVIOGpKdmVaZUNRYVExWEZu\\u000aZ1ROdXVNcVBzdERaSFNPQ1pWVXhJajkyQTFUNkVTaFo3cTY1VjhadFEwNmdYb3dB\\u000ab1ZDc2xjaUJEZHZwUEZCL2FlV3hjbHc3cFZBQ2xBQ0ltVmhMRG5YNEtGWUNIUE5n\\u000ac2FLYU9ua05SVVZSc0Vad1pad2x2bklRdXpBRW9KTmtremd3Z2dtdHgyL09EK0NY\\u000aaVlLdE5pT3hHWDlKZEUveVovUk9qbHlSNUo5Q09CL3JNMmdlY0FWZ2dmcXQ4RUc5\\u000aQUJNVHZhN3RpVHF0M2Q4V2NjREV5S1F0aTlySXhoNWZVWGkwbTFrNlJGblNEajZN\\u000aRXZBNjBULzRJY1hPUERtYTJ2WU9EZ0NBS21IMWtnNzY1dDI4MFNtcFNnMFlnQUpV\\u000adkphSXlsdGY4VWhPWE9DdE1RaXdEVlVjSCtDTHBiSXh4a25Pa2Q5K1hYNDU3bm1j\\u000adjc5S0FMbzRjbEp0RWpqS3h1aUIrK1ZwNGxzRVlENkI2RVkzMjJiNmk4ZExkQkJu\\u000aZ0JKdXUwMDFBSjlWUFlIWlJBeDNRNDh4UU11dUp3WWdZNmlEV3hzY3lheDdENkxu\\u000aS2czbnBaYmhmVzRlc1l2NjBqdkhTNDZwem1lSlVKVmNmVUFFeWQ4azFXK3huWHFi\\u000aN1dxRFRGNXhaTHgrZHRlQk90UmR5U1NIR2cvcUhQNEFvZ3VSc2JvVFU5OEJqOWIy\\u000aSysvSEU0ZTIveDk2bkg3VzRlU0tGRGsxaWxoNk9EckE5SE1uQ3h1QWFxZXB5VTFo\\u000aRGNsZjNEVXdGamdRR3Vnb29TNHpITElvbnpxVFVjcTRzcC9SZ0YzRk00TGxpL2NC\\u000aTDdSbTYxMHZBYUprcmZWRG1JZGZ0NHd0SVVTVysyRGtoQ2lyb21LL3RLckZUbC96\\u000aTk5HMGpBTmo3SjllRWhQaE9kdzFVMHRlN3ZlakVwMGRLb09NRkRTSTNaWWJieWNs\\u000aUHJ3bkw2ZW5ocmlrWHBzNXVMVDRqT2p2NFVJSVRQSjJLN2NjWUZmQzJqZlJKMDJt\\u000aRk1wRkc0MGplcEdHblJ3cTNRZzQ5NEVhVGN2dG13SVdjbEtlVmJ5MW04N3ppc3hV\\u000aT1JWQXlnUlljU3ZvVXdxdWMzakx3MGJYVzBmUkFYVTMyaFlWUWZJUTFwY01pSDRW\\u000aRStyL3AvRGpJWS9zYngzVm1Hc1dCTGhNOFIweElVWm5YSnJyejk3S09GQkE3NGdu\\u000abVluSXJQa3lmT2hQUGVFSDQyL2VpRHUybWRWL2U0UGEzS1VLZFhjeUo4cm85MjZC\\u000aSTF3aGk4Q2h4SVVtZzZNaDQrOHg4YjhjS3VpZWtFaWZ2cU52aG1KQ3hlaThTYSty\\u000aUVpQMEx2aHAvekEwRWIxY1d0ek1VTUlFdUhJcDREa1hhY1dNZ2NuV3U0L2d4Q3Vi\\u000aMXhHaE5xWDI5U2p4SUhHeFdJRkNvQU9lVkNkL2xiSlFPS3V4R3BnMmR2RjdDUUhM\\u000adGYxQVRQaEQxRVNsNnR5dTg0dndWcTk3U3lTcktweWJxenZydHdSTFhwb0kyUHA5\\u000aWEd6S3BtaXIrT1Fva1dwSUhZTElzU0hmditDWjJDaW5aaUpEWWdtL3ZyOUZWdFpv\\u000aU0JKN2puYlA2TkpKYTlidGd0QzBFZnRTcGxPSHpicm1nMVR4M3gvNytTRlRGc1Yz\\u000ac29yejcwTWxIZE43M1ZjK3B2a080LzM4ZVF6SEFqdkhlTVgybGFMT1Ntb2Z5Nmpw\\u000aOVBWV1RMWFJmSi9kOTRNbmhaK1lvQ04vSVl2cWsyTzlPcDlzWnY3SGNHdHBMYlFr\\u000aUkh3WG9od1VpSFRxVkhEQVVxbEszUkdHdDk3ZHZJY1owSUdlRFJROGtULytCUTZ4\\u000aVGpxN3pvQmpMaGwxT2M1cUxkYldUM2FLbVNoL09Tb1BPWlR1OG5QYXROdjFIektB\\u000aOUE1UGovaDlRTCtGeldrMXM1MzZYRzJHaXRwckdiMERQaUF6MzVaU3dCdVpGbFBs\\u000acmpZbVhONWdsOEpwSVh5c3R0SFdqNTVDSWlJbHYrSnhGOXBGaSs3M0pHNkNUVkNa\\u000acVEzM2p0SmVWLzVsTnFJcGhUUUQzcS9rbDlGNTNPMGRQa0UwM01lWDJkS3p2VkV3\\u000aYldDbnNQMm5rVEhDMDloVDdkSjhVU3NMaElCZnZ4dFJ3VG1nbnRoSE5seVZrR1pK\\u000aWmxVa21QMXFHZU9tdmU4RjgzYlpSMTBNK1dyZmV1ZEJYbVJZUHgzRW5FVHkvK3B4\\u000ad1d1cVczd21WV2JxM3BsRnJCNFd3eUZuc2NNUkNuSjNuQlJQK3ZCYXprb0hpVXk0\\u000aOEJPVkJvMm0zWFRUVmRVcWRmbksvUlpXc0RhaEZKYnpWQ3cvSTlJM0lySkFRa1N2\\u000aSG1qUkRsMW5aeDdCaHU2WTR2ODZKa2dmSk5UMzRocHlYQkRaUW1YNEh0NXZacnlj\\u000aVTE0cTJ4SWVoUGNVRmMyZmQxMmNkWERvazVrSi94ZWF4Zi9RbDMxRUFzQ0xDR0x6\\u000aWFI1b24zL1VaMGtGNEx2Y3IvTVJ0VjhJWWdjbDUxcHlMbjhnbnh0ZmErVmZpMStD\\u000aQ1kySXFJUkpTeGtmWGgvTlhWam5MeFZaem42d1pGWFZ4UXBBUE03TjR5V1pkT242\\u000aMFlXK3ZCTmRGVExKZkxnTVA2UDBZWFZNRlpUVFRtVE04eWRGd2tFZDF2OUUrcysx\\u000abDRzNU50Z01yaEZVTkwxOVo0VVdSNVE5YTQwSXhhK3hBbVdPTElDQjFuUmxkZHll\\u000aeDdmVmtYSDE2WUV3RnZDVlpTWGRZODdaK3JENmZCbEtKL2lvandRbnZPV1hPS1dj\\u000aTmdEemc2bFoyYnVtREJpM1FlSllkNnU1Vk1ybGIxYk81dGZMa0xvM25ZMXROL2ZO\\u000aWmF2NDY1MnM3K3dRaFh4eVZ5bzMzQmY5d0VxaGxwN2pmcnRmY011MS9zcEhwQ1ls\\u000aOWF0MFdVbTR4UytaN3gybkgxUWtJanh4U3RaUVNmQ21LbzdiN0pGUFloVGg4QktR\\u000aQ2U2VnYzemYrUlloMkVNR0d5RXFMdWIvdG1Od2FnRGdGYXk3L3NEaTNTNnUzSmpy\\u000aQlE2b2R2ZkNrU240cytaYUdqb1I2VkNtUHF3VlorTXZQRXBKQURRUm5HS1ludlhs\\u000aUVU4dUo2MWpZNXpUUE0rUExaYytCNmdpdzZlZmNIenp6ejJJUmRPWEJGNFE0RVFO\\u000aek55ZVFrYTNoUUk5TWtFbnc0SDlZV2ljTkV4NVpKazR2NmJzeVl6T0Y3dVdiMi84\\u000ab09NNnRhWHdOWWFTSWRyQ1JxVGl3MFZOR3hVOFgvNGNwU05lSmNsRGRxVXg4TEli\\u000aazdxaCtXYkkwSnNLdHE4d3c0VDlvN3Q5MExpSTl6RWdjUisrbGVvajhxV2Z1aDZp\\u000aL0tzRGtTNFBHMmw1VFBqUWhWMHJaY1FhdW1hRzU3dXc1eUl0RnM4QVVlbTF6VWxN\\u000adjcydDhSalNnTWdBOWdWdGNCcUNlWjIwZzk4ZThWc1FwQ1Y2SDlpSWRIalZTZkFK\\u000aMG5MbnJud1BucWJPZFdvL2xJYXR4dnFSb2hwWFhyR2loSjBPMEpNNkw4Y0JJQlFl\\u000adkZxSE9qVlRIVGFpSVhxL2dQcThVUzZtcTNIS0U0S2tUR09zMXdzV0ZFRmpKei9m\\u000aeUxmYk5sVklIQ0tRTjhjb1lKdFNlSEZUMTNZdm8reTNBa1VRb2hWTno4RXg1TUJ4\\u000aMkYyeGtoZ1BLdDl2aUlLWXdGRlpOQVU5ZzZDWVRjOVY3WmtHTFRBT1JqQ0IwNTVm\\u000aTnBkSGVvRWpydElMU1lTMjZhV3Q1TmtnVVJsV2dEalpTN0t1UWZuY1dXMjQrOVND\\u000ab0xCV1VzSXhVTWVsZTEwZDhwbGxsZ01YRUR6aWEyc0NEemxvOFdOa2h2M3hZZjFT\\u000aYXBjMk8wTnVmS1p2NEVWMXhzMy8wblIrMHc1b3ZHa1UyY0ZXMnpBVUcwaGU2azhZ\\u000aTjR6QVJRallUem4wajNVa3F3Vkl5dGZuUlRYUzZEODZkTVAxaG9ETWY3N0duMzI1\\u000aRUpKM1lGanpFbEFjaURlRkgvMS93Wm4ybm1ST3hDU0p5SUxXNnJiTUdyV1JDSjc0\\u000acFNyNkZUcXRsVFdNWkExL01ZeEk4a0JlWThHaEQwWGZ4bWdPaTI5NjcxSHI4SFVL\\u000admNLYk8zWUxHemhqaEtCWklEWkNwanlUY3p6VkN0MzVOcXpGUnMzM1Z6Y0VDU0I0\\u000aWmVZSCtxS1RDZEhPK0J6VE9HOVh1am5HazJVb3BkdldldkovdVh0SDlmTGhUQjJn\\u000abUQ4azZSa3FSTnUzUjZlN1NJTlhpejFuc3pqMmo3QTlDNXE1c1VkNThjVTdNRlg3\\u000aMGkzVHJ0NUh0MloyaFNQY1hPNTU3Sk1LRVdVcFZxS1l0WmhQTWN1a2hHb0hVekJJ\\u000aTUV1bDlSYXo5c3M2RndsZHo1QmFvWDZJcW5yd2pGaXRnTjVnWUZpaHJEbmlXUVhx\\u000aaXQyTWtETmFROTIvWUlHRlJGMm5iaUdPWDFUamxqQ0VDMU1DQUwvSWxqRU4vM0ZZ\\u000aOEJLWElpdkU0RTNNRGt0eXJzWC8zOGxUZjN0YXZOVk5aVnFESHMxUmxuRUM4WEZI\\u000aUVFNZXdXWjF1RlZVM3pGOVVlcXYzcTRxZUVQREZ5R2lFN2dEV2tNbW5xYnZURiti\\u000aVysyMVJzTHBpbUphS3dqclRMTWtoaCt4Z3hvK0paWml4c1NxNXgrK0NCdEtOQ3BC\\u000aNkUwTnc1SUlnUnVzL1kwMmxQMWZ5OFVsdjU4eHBNUjVETWRmeHZ1cjlPd05BTTY4\\u000aNi9zeUwrbHVwVDZhNnRhOC82YlNPVWphNGRtMXgxWHBhWkZ1Qy9EMGxkU3ZPdTZv\\u000aQmhVVUtuYXhCalpIeXl1UkNQVlpwY0tFZDFkemE4THdJcjY0Q09CeDl5OVJSZTlV\\u000abmN0L1dIanlQSnZsWWx5OTBLZ3JFOWYzMUdkeEFoK2hHVjZrbWhIUUhpRnB2ckRi\\u000ad05tRWdhNzZlTHRLdHpGNDh2cDdZYWdOaERjZlBCbzVJMW5pOGxZcFFDeW50WVB1\\u000aWnRIZWNyNWFDQS9RSWpGZGdUSkRXaGJkVW5rbzgwa1RGRTZ1czByVUNuLzNrcUhK\\u000aeC9Lc2R3S0VxQ2ZzNUVhWW5LbVhvQW5HZWZYYVdoNkU4Mm96Tk5qVzhBSUpJcENJ\\u000aTTZrbkFjWi9mVGVjL255azZmTisyeXltaWFXWkN1ai9lS0piMWZFK1MybWxpbjEw\\u000aM05oWmtNTkJHUDNqTUF2K0l6dGVuMFFDazdySmJ6cmlTeUFGYml2aFB4bjZqQnlx\\u000aaTJKRU4xd29KOU9MYWwvaURBSXNoRXUwQ0dwQ1JMRnUralI5WE9zdktjNTdGVVo0\\u000aSHo2Z0ZBYjEvNkszWnNWSXRGZElvL2tmbHJ3Ukttc0hTN2VuZ1phOVdYSVFHb3FR\\u000ablVaYXVjb1JRVWEwa0haN0UwK0szNVpZa1lZVFRwUHJuQWhQbTJBaXdmRUpzVmQy\\u000aM0tnWUx6QW9tQ0J4Wm41RkFFd3lMVUZSTFAzOGRZR0hlZnhyR1FiemNzOUtpS3I2\\u000aQUFVRTVSM09yMHdDTUpLV1Jmbk9QZjZQdmtIdlcrSFZhZStBeEV6ZXF4TzFwOVVU\\u000ab1hoVlcra3NoRzZ3QTIvL2NkR3Y0MHJrVEh1RFE1c0Y3Q0ZGckNodlJZb0MwMzJJ\\u000aS01qa1Rzc2FKS3dqSEZlSVMzc0tjbmdEL05WR3pTK2xOcGNwSDg2RkJGQTd5SzNq\\u000aVzBrZHRmblRaLzlSSkNXblV0YXFpM3BFaWFlak0rbEs2cXRuVzdVcHhVV2o2K21x\\u000aZzNtb1FCUjZ2Yk4vS0xrSkpsUjhsUWNnQzVLamJLOUd4YXpGZlErbGprcGhKRHBi\\u000adERUZThEZ3dBSmlraGlZT1YzYjU4aTA5MXo1V0JZSmFtQmxodS80MzF2TWIwNFJw\\u000aVVdOSlphSEdySWdCNXNwdFV2SVNxSDRBYm9xN0ZNMVZjZS9pOXpMcXlGVVhXZEhl\\u000aaDBmTWFKUVp1S3NPNDFmQUtsNHhLWE9icUF6eXo5ampGTnJjZDQ4MlNZVzhrVGlW\\u000aZklEUHN3eFc2aEVhd1psaUxRYUtIa1pSU1JYempUVE4wc1draXhmU0dPTDRYNXNy\\u000adXVuajQxNDJyRW80L0NYRzhwODRWTnBrVmRXYk1USEIwT3JmcDdvQWdiLzFRUlZt\\u000aUmpyaUhMZ0Jzb25sWUJvQmNKaVpjb1ljNFJoVmROSnVGdldUaUg5MWM5dXZkdUsz\\u000aeHhoMDNlUCtTRld3Wm44NDZjZ2lGL1pDZTY0d0tVemNPT0JvbkoyVm1JZlFWYUdq\\u000aTmUyY1ZDZVNhM0IwUi9PZXBBRk1ZQmozTTM4djdabFJRUXJMVnRzVXZXMEtjbnRJ\\u000aaHZWa2NYVkpZM3RRYkFKWm44aVUzWnhiN2VvUnF0MjFGem9raVVWbzV6d0FuNDV6\\u000aZVVWUUEwaFhaN0s2K2RmUnJCSGFaMkRob0RLc3FaYkFjVDhTTExxY3dJTlBsdHha\\u000aWkUrUUdMSGc2SXhHdWZmT1VEaEtmdUtoVUlOQ0dwSisycjJqSEZrZGJRaTl1R0Ux\\u000acWh5WmtrcGhEcDRnZ2Z4RjB6QkNQZWJDOHBXRDAxaEdSUFdDVkNzRjBMdGlQV1Mv\\u000aSnU2Q09MWXZKeWhlWURYeWNFLy8wOUkxYTdYRGFaLzBLSWlhNjY5YWNZQ3pGWnEv\\u000aYkxkZjZoWWg1UHp6RlZYNjI4eUJuRnRvbm9MMGlSdlo3eEkvbXQ1alBFc05CYXgx\\u000abGhhdXZJVXlNVEdvM0xGcHZrYStiN2dYZmFPZXgyajZwb0FDdVVZKzJtZmY5Und2\\u000aWitVQThheFB1N3NydUdCaEpJZ2JyeUx0QlNwL09ZZlIzZ0ZSdjA0a3l2bVdkL2w5\\u000aTGxRanVwQ2JvUm81RjFVb09Lb28vQ2l2dWp4WmVDd09QSmdEYndNVWZ1ZUZLazcr\\u000acjFCcktGdWNzbVlhc1dYYUNua0I2TUxOVDdoeHFqYk1hM3JXcVVFa1JyNXJzWWZq\\u000aSFo3SloxdGZacHVyK1Y4M2c5V01rSkFFclhaQnRibFJMM0UxamNicmdBRXQ5MzZP\\u000aR2U3MndPTUg4akNMU2FSSzVUSHlWZmdiUDluYlcxeWdsNHdIQ0tmQlh6RVZ3bWpa\\u000aSmdKWWxtbHp0SnBNcTZJNWJBc2Y2aWlKNFJyQUJmV1VKbkdGNEhuL1RoYTBVZi9p\\u000aMEQrSi9ZUE1RNWIrTmRvajNuSU15UFk3blJ5WWNNVEpaa1lFSWJ1dzd2MXhxUGJz\\u000aTmlSZkczMmJ3dll3QlBVNTduN2lLZXJFTmpnQll6RFVSZWtmVWVxYWZtUHBPWFU2\\u000aZDBBRDJTcjM4M1BnekhsdW0wWmhEUUlnaThycmkyNVU1eDEvdmEyK1YwZWlCdnhH\\u000aTE40b0dZQjZ4a2ZFa3NNTkV4ZlpYU1dCdzlzVnBMeEVxclVqV1NGdk4xbjV5c2Nk\\u000aTi9JY3EzTDhvWDZ6WmR6bFFqWFN4amZ0L0hMR3FrSTVZTTM2K0V0MStXUFFLcG5t\\u000acEpVVnFWemJ1ei9VK0dpcUhSVGVqRDY2a01lUUJnWHB1djFRY3FBU21Tcmtyd21E\\u000aRmVCbXA0amxHV1NCM0R6djBHb2tvK1VrRWxENmRhSGtjQkJCeTlPWEdCTXhKemt5\\u000admNhQkpOY1E5KzN0SjNnVUI2c2QzR3l6ZGNienhMcWFPcFh0bkkyRVZjYXlLekRL\\u000aZ0E5RGRUNHpva3hTTzhObVFOTVMrdFprQ0hJK2ErQW5iSFRvNlJQZ3JpRVg0TG0y\\u000aTGJsUy9UZjRKbjlHaVh0V2V0UWNpbU12UXJxd0UrbTRmTEpURGgxb0ViRFhXL3Vw\\u000aSDdFTktQV3F5bEhwTFZTV2ZJcjR0QVJMaEl4NlhLeXNwYTJvY1h1UWpzRXkvVmZ3\\u000aQUlyMi9NNVZOR3JDcEdmY2Y5U3U4NTBEWFMzVUg1Ri9KM1ZEWlYwL2tiOXNVT09s\\u000aa3dnZ3VGYXR0T3l2QmZFTnNOeklUd2V2VC9mOXgzMjlyL1MxYlhJbmRvM3NHRmNk\\u000aQnlKWUFROGM4OXFaaDJsSHkrWmRvWlRiTXZESFhKOTdJVERwb2dHOExrYU1EUWhv\\u000aaExjOUhHRFluVnkrRGsxWE56d1RlajJmWS9qZWRXcUxXVDcvNm1kSmlUL1NmZW55\\u000aQ0lzQ01TU0tTZ2pVenY0TmY3SUVyeUpvYXhET1UvRGRpOTBXWjlBZ29MUi9JK0F5\\u000acDZ4ZERMV1BUZGpsa0RYbHRaQlp5MXRmV3N0QWpqM0Y0Sm5xMHBHcDBqTVJNUXg3\\u000aQWtHMGpycVFpamh6NCsvd1lrNFhLUGtsZDlQQXQ3b1lQbHdWRERMSGtIVTBOeXBs\\u000aMTVNa1lvRks5TWhNVWdJZWpoTU1UZER0eHV5Q05PVWkzUHVrdmFFVmN6SWI2RXpM\\u000ad0JyYUpzNjN0VmhPQ3lMdXBuZ2VOajNLNHltSWxhVlpHVUdxWDlrRERzbG5oZmpi\\u000aeU1Gd3lVUERtUFM3VlpJdDFVRjJZTWE1ODBjNXFpZnF2YWxFZktlQmFXdUMvOStX\\u000aREgyM3VvYjRiazMxT1JxUjRvbTNrdzZRSzhkaDZETHllNTRoSFVhdnIwNkZ6SWF5\\u000aNkZNcDZhMUljbnpGT0tremtDeWk2OW8vdFZyWHg0alVnYnNtcDlQaFUweVpKRHFH\\u000aYWFINjJyeEcwZEpkNUh3ZkZkUnpXbnBSV0JEajlFbkFkaE5VYnpLNVRJaWZaZE5h\\u000aNnJ2aXBsUk1ZK2N6ZW9CSTU0VHd5d2FPZ0dCcjJIaUVqRUhCY3pvWXdkSXNrY3Rt\\u000aRjZtZTA1N3U1RS9uMFVkTmMzbENJZXNqZml5SVdDTUxkeFNnQktXalBjSnRDSjRR\\u000aTmFFK2p2bUpCbk13cFI3enhOMU85b2tCWHFZWnozWUFUY1ZtdTgvY3V0NWs1Rk12\\u000aZTkxUlF3MysyL0FTVnRmdU91L1JOMTBYWm40ZldiWEZjcDI3NG02OUs2RkRYOVcz\\u000aNXVSWEhZeHp6OHl1L1k2TitVNzBoOStXL0psRi8zTFh4S3FveVlwZUtXdlVWRG1r\\u000aT1ArMUhhNmxNbm1BQm1Cdy9KYVg2WWN3bk1ibkZuekFVWTJvRE9lT2o0dkt6cWly\\u000aMkZMQXVUSWo1Q0VWZStHa3ZHRU4wTFNkNlZzTzIrNXBVRHc3b0FmU0IrUXd6bzFx\\u000aN2Urbm8vWWtuancwOVdEeEtpVWxoWHRqN2s5K1p1VjVWYWhmczR2bExLaVBPbmhI\\u000aQTFlRHdXRFlVdDdRSDRQUWUrZjhaV2dtcTFaTnhVUzE2Q2d0ZU9MYjFJZXVucERN\\u000aeFZUSFZaVy9sQmlzakFCaEJpY2x6a3cvWTkrcTlEdU1hbGQvU3plVHZVaXpvaUVi\\u000aM1RTVGluVUozUUt6a2lJWityOFJrdnB0WDlnZks4VWdva1BFa0tleGd3bFdmTjRr\\u000aRzMrdDlsaGw4Mm1oZzQ3bTk3Z252Qnc0L1JtOGlaNXJXRzhqOWlEbHJaMkJWVzRz\\u000aMGNmdmZsaUFTVjMzRElNenJveWFFaXBFdlZMTW96a0loTm9OdkZpRXp3NWpUdWgv\\u000aWXB3c0NtaVJ0NDVnUURyUzF2WE9lRzNSdmdPdC9rMXdhUWZIQ0ZjNkFlWVRKdXd4\\u000aWENMOU1laDFhd05qd3BFZThBbU9oK1dkYk92ZklvVXRVcXRXb1pkR0NXdWZoY0d6\\u000aNldESUxpYmUrZ1Rsem1sTitEQml3ZXRNMGt0N2V4eGg5ank5MTA0a2pkdTMydkIz\\u000aa054WWtOaUVsWUNSMnBBSHNhWC9mczE4YjJzdTRUUlRUSG1MWFVrbXdwcmhSUXpG\\u000aMkpVOWlWV3NmbEVqN2d6SlBMNGRyckxsKzkrUUdGUG44VHZFY2U2TTdLRGZUWkNP\\u000aV3o4Y0FjcW9ibVJjNGZDVFRNN0ZKRXVGUklIcXdvaERRYXZlOFJSUG5BZk1XckZy\\u000aTUJOekpUTWllY3lpWWZIcGE2U2NseExoaU9aYm8wbWo4OGpLN2FXVXdqdng2THRJ\\u000aQ3RqbTk1LzZQcjV1L05lUDJORFZ5dXVBK1pCRjl0YXNhOVBLbVY5K25uMUg5bU11\\u000aR2pndlQvUHJmMS9RUGFMUEltUjhOTFlPamdhb3crRUEzWVBZMytIT0RDQzVlRnZF\\u000aOC9PNVg2QmRpTElzVU9uL21ReUZSS0JHNEpySThkSzRyZlJXTmgvYXg3a0h5amFB\\u000aVkNGV2pQdGp4TDJjaFZ5UjBUMDE5eWdGUGwrRVZUcDFML2UxWGo0RjhRTFZzZGYz\\u000aUXNaM2g0ZGpvREVUZ3V0OFZTOTFuSDRnMzJPYjJndnEzOWtQRjNERzRjUU1kRzha\\u000aeFZEaWtIbTJrU0RjMThaTE82RkFqeXpncmp4ZWVaeFhvVzc3QWZGM1YyaWt1Yi94\\u000aamQvOFhJZzFNZHkwVHNEbGorVEpBUVVwOVBOZkN4MmxUNlBuN0dZMVNBUGptSS9a\\u000aUkVJSEdncEx4cUcrSkdBVXlROTR6b1ZnM3ZYOTNkZStXV1JEWWpxaXRXYjlvbU9R\\u000aYXhmVDF5Mk5yeWtib1pXaWNTb3lMWnhZVFU2bktrbTdUb3lMU2F5ZFo2MWhzUlB6\\u000aZXNlcDA3S3NxTU1Zc2lRT0J4VHN5a1EwcHhVenRqczRJeVkxWWtmcUdvaXZPQW9E\\u000aVStxN1dOTEpuRDZnd2x3bklSSUR3aVpuREJrckNZc0JFK3c4QUNoaTBiN3RqR3Qy\\u000aaG4zVmRjd0FabmQzOWo2RlF2Z0JtWGZERzlJRi9SUTBTNWN1OFh4OTNFaGhoOE9B\\u000aK1hTNlkyci9rbTZwTm9NaVA3TERJSk02SmRrVlRGT1h6VWszdzVrS1liQVZwRy9r\\u000aandjRGJnZVlHUkNxVHBmMFBXeG1YTU4zWjZtS2J6MVFaNnd0TGx4L0FNYTA1Tkgx\\u000aYk1zbE14TE1WWlEwdHNsdVVqSWNVamRNdGlTb3BaYzBOOWZDY3pmN3VBMUl4Skc4\\u000adFIwdnltdkVQSGdKVXVSYXhxZ1crSHV5eDd4ZVAvNVJGS2VBZmdNcTBzaS85OHVS\\u000aSFlZZFVORUZSUmQ4WXluR2lqZFlxZ1lZZkNnZnM4bmcyWDlsdnUzaFNIMkdQM2Z0\\u000aVUdMS295L24ybE43ekdjMFdxQWxDYXh0WWdNMFVwMmpQWDd2N2ZySUlTc0sxYmdX\\u000aSnZXN0xEQThJMjVEVDZaVkdOY244WkZ6RWV3VGJSdlBFNk9oeDdSc1ZBL2JwbVBP\\u000aR3prQ3N1V3A5OVhSa2tQQTNaQmluejJ1RXIzQ0NTRU04eitIeTZrV2RRTExSTlpO\\u000aZnQyV3dBWFVwc25tL0YwNmpVZXU4Nk4yWnNMeEN4S28xYnNYYlorKzNCM0NTMFYz\\u000aYXVBYXN5aGwwa1NWczI4eTdYaTFSajFZV1VabHNmQVYvR282SXZyNE5YTklpK1hY\\u000aWVJtaXNRVGI0UzNHUXRvRmhvcXdOZ1p1L3A1dzBmc2lVTDBFK1BDMjRvVkIzNzlj\\u000aUG1pUXUzdTZ5eE0vUVVCVW4vNlQ1U215MEszaUFGdTJEVU5ZRkg5NllEdFNZK0RV\\u000aVDJJVTByK1F2K24rYUJ2SC9xRmVLWXhNZTZMVlF4KzRNTk8xZzh5M0ZvYTNzckZV\\u000aT0R5azM3YlVrQUZWUXNPUWNEV2d4S2l0TU1kbWdpc0JwQXNNeTRXQTAvTnVqVGZy\\u000aUmZWVFRWVjFxWFJZL2dMVVNGbmMxMjNkbW11WEF4UjM1cFVzWERwbk0vallRcHRM\\u000aSmtNcHpPWnZmTEhNVmpVQU05WUtSOUhxSFBxaWVoN1ZZT0t4ZnlTL21ZbnpVWE1T\\u000ad3l1VHdRL0VLaEFkaVo1bHdhYnBhcEYwb1RCWWN3ZkVnejRRZDZjZVgvOWh0S0xx\\u000ab3o3RGpMVVlqRThPK1JxanpVeGJTbThvMnpHWG5yL1B3Mm5COEw4bE1yQlpTaUN4\\u000aUkJuK3lkeHZ0UnRGSm4yMWZMVmlqYzVOVFpDUVZ1bThGUlpTa2FLc2JkQmVERFNJ\\u000aaVJ3NGErY09mc3FPZjNQa2ZScTNraDJ6TUd6Ylk5b1MzWnFxSTJHdGowUmJaMFZ5\\u000ac1VTVWJnVU5uQ0lSR1RtOHE0T3J0Skp6Rk1oYm5Yc0R1MUxJbFY4b3ZTaW9VanZr\\u000aU2I3bnhQUTQxMGljZEt2NkczNmx0VFhVVkhnM0RzMFFrK2Vha3ErUk85clhBYkxD\\u000aYzBxTDhkOUFELys5NFZ0eEZ3a1M4NzltUmhGZDlZQ1FPVU9HYWRXbzJUYnoxM0hs\\u000aRDNUUUVvQ3JkQ0lwdGdhVTZ3WURjZzRtbi9IcW1aK1RuMzFJTERDejlvb2pPM2dl\\u000aYVE2aUR2eTlhVEl2TUdrKy9GR1B1emRHYmhRWmorSFFvbWNDaVMvYWxES3h0c0Nx\\u000aU3RkaWRQTmZwa3ZVSHA5UmNERHorVmlMMUlKRGcwVkg4N1N6VmNjd3Bva0NIaW9B\\u000aZGsyLy9SQ1lwbHFQWGdHbFZSV05jK0w1M3BhVFpPT3IrQXpFNUI5dVNFRDI4c0lw\\u000aVnZIb0lBbGhpZFNDT3M5UzJjdGhqYTk5WlQzREFMbFRYcFd3NDdpZmhkZ09aVkZU\\u000aNFJEYUlpMm9TMVp0SStkNXJSQ21PN1lEa3liNjhkc201UGlLZUVGdHJNYm1mcUNV\\u000adDhSWUNEd0dnNHF1UEI3Z3V3bExhNnhHczNJQTV3VVNJN0FUWC9CME9Jc1NsSFRO\\u000aZU1TYjlVbTdQTGhieUc3T1JKaXNLUjMwWEtkVFVRUjJGMzZWdzErZDVHMTBUWisz\\u000aaE9XSEc2bWlHU2hPZkFJY1hBN205VkFNWXhJM2lSUFBqLzE2STRGeExTdVFDYmFa\\u000aUmptb1hDRGRidHRYNXFqS0NXRDBBTEl3RmZ1VEFMNlVQV0NDYzRKOHpnMnJpc2pm\\u000aZ09tU015RUJ6UHVBRkc1Uk1lZi9DNGJzdHVGd1JDaUc1WkZlNmhyMUE0RkxLODAw\\u000aemw2ZDVjYkQzN3Q3amxXNmIwVHZpaVFrUS81K2dqak5QaXdPTGxPRU8vWHhXN1gv\\u000ac00zWm1EZlovZUhLMDM3VXd0QkRpNTBGaURXSHJON2svNXladnZFL2lUcUh4OHBW\\u000aSjZ4UXF2QWdLRlpFamE1Y0hEcE5MdWFTb0RIMjBzelNNL0NmU3g1SyttZ2c4L2ht\\u000aRHlBbXVPT3RJVnk4N2RQY1phUWcyZ1d0K05vbnN5eXgwR2k0eGNuNWZEZzVPQ0xT\\u000aeC81dm95REJNQnltZFp3aS9QSEtBZlRMWlBlaGlvemRDb21vS01nQ21JQ2tJS0hl\\u000aM2M0TkFTN1B2S1hSWDI3V2gwbk1aNFo5TUQxVzlVeUIvMFVoVjJQUHdLVnpvY09w\\u000aT3NEZk1WWXI0TXdxZjlXTEtFME9BQ0E2T1ppZFJYRnBKN0lUNW8wMFNzNStXZTNh\\u000aa3dER0hRRVhPN1JQc0U5SzloVmJDUDBuUk1YUDU3bFZ4WXBPRG5pRS9lK21MekFT\\u000aVm5rVlYvWUM2N0ovM1E5ZXpQdlE5VzJYcDFRTzlRUjRkVGpnTTEyRVBmUEpyTDV3\\u000aaUxaeW0zeitVNlNpUFFXQTNMSDVOdzVCQlRGMGlGRGxOaEExTVorUlIzRXU5eEQ4\\u000aWkVaV0VMMkIySGR1L1JGcDRkaFI2VE9FZDNTTDhIaDJYcm9pRE1YVnBnWU5FS1lG\\u000abENQMnlDTUNsQkFEcnNuQWVRR1Q0bVh0Rm5aMmVCSGtHNEhTUVRtQkM1NVgzRjMv\\u000aYTAxRmtNcTBtelYwSWVzUGM2UTRVc1lMWHZIQkl4L1lrT2hhTnVMMmprWnRGejdL\\u000aTDFQblRESEt5bWJJcFc1RFZuVDlFU3pHbUlDSG0xZ0lleVRMN0x5MldSTCtBTFdw\\u000aOW1aaHhJS2FxdmdmK29jNWFGaGlQellEaDFjS3ZxVDdHakxBTHk1amJrbDI4QzhO\\u000aSlFXZU9QR0hFVjRsUXJmNy9oejEzK0VrTGRaUHJuM2tJOGVzVStURXVST3pkSXN4\\u000aWUgrU1hpOGhxeGt1ZVByN0Z2aEF6bXk1WWFXYTZJT3JHNkM1RTZNTndCcmhVYXNF\\u000aMlQ5bE5OcG05a0Ywc0o5aTFud2o3WW93S3BnTVR2cWJFWUszTE05SGUzMnhRN3ZI\\u000aN2dncHloVmhBYk85cCtBZHQzT0lsanVrTC9NUGxRM3dnWDNyS1lBM205RWlyaDJ4\\u000adHhQVWR6cTI2NzNabjMwaU9vcWRBQzhVaGZFN1R2RUdMS2dZb0FlSGlqMS8wekRC\\u000aUEJNUVkyaWNwblpyK2dNV2huRlBtN1dXUmNkQ00yOFhsZTVBa3ZoSGtmM25tOU9P\\u000aV0RESStERkRPOHJhQ0N5SzI0QVhMNWxMZWwySTRlTW8zNU5kT1dRaWtidU0vWlNW\\u000aM3Y1WUdSMjB1OHlSajdrZ2Uva2FvSXk5ck8xaFA1MDFxV0xOd2owUFpIZTZ3TDhI\\u000aT1d5WHhnMmZweFRlbjRpUVFRcDJqRmEzR3hJbDk5U042emJvcEVZL3FGa0hjR2t3\\u000aeFk5S3EyOE01Rzc0ek1xK1JaTFYxVFVRV1h0Sk9lOHZWUDFkMDZPRHFSMlZrOUla\\u000aaTRwSGd5Zk9XNlBWT01WcVRGRkpJWU53cW04alJCakV2OUZ3dUluajA3ekpXRUp2\\u000aMC9sdXdaRFQ4R3pEY0RoaHdyWVFFR3BaVkl1ZVlXbkRoZnRxVkloS25zTW5KREFG\\u000aQ04zSEhFTG1VbjdJRVpIdU9Sa3A0alpSc0x6dTliK1RmSDhGYmU1d0pJVHBiSDhB\\u000adzhweUx6VTdqMk5xd28vYU5oZ0FUUmcxL3BERWpOWlArcEJ1T3hIRy9ldVM4YTBz\\u000aeEVETXFTclUxSG5jaWxFSkpMRU9yZ0tURkx2ZDB0eE8wamRGUGFLOGttRWtmWVVn\\u000aSDdJbTNudVQxSjVScDEvRXR1d0E1Mmg3YTVHWEhaTmduR2hzbE9kN1ZRLzBCQ1dL\\u000aNG9OaHBTY0FybUZibEhVMDRLY1V4dlAzV2MwNGZJOEV5ZHdZczFDbm1iLzQ1TXU3\\u000abnRCM1RkUDJOdXVoZlZHQUJyOEF5eS9UTDBSYytZdTcyQUxFZ0w2MkNtekNyOG9R\\u000aaExEVkQ2RnRDM29PQ3lMNXJhbVNKTzVXZ2d4bTA1WlE1UFN0TWx2RmVrNnhnd216\\u000aeUNBSTRzUkc1SUV3NTQvM2N0TjZxUzRYTEFVVWNlRUg0eUQ3N1VyZEdmdWw0dU91\\u000aOGNJZEk3alFkcGZQMW5XSjZRZUgvRDFCUEZOREtwQkhCY3hRbjd3aTBGckZOSTZw\\u000aTFpEeTFZYjhYNHQxaVkvVzE1b0NQUGw1a0hoOGpyeXpUb2tRN3NSbWcvaHh0UEpv\\u000aaHNqM3dSeW9OS2ZWSHMzbzg4dExWTlpQYUNPKzhUWGxlRm5ycGU0N01QZE9ldU5n\\u000ac0luaWk4a0s4bDJ0UUVpMlVpTmtER1pGdGliR2pxdXE5cm9nUWpSMXZMNDF2czBy\\u000aaGdXL1I5OHp4RDgzUzV3c29qQndEWXpPTzBtNDB2WVFFUEVoV0NXV043SlRaWEN4\\u000aMXR2U0hDMmZUSDREa3RjaHkya29CZ28zUDdYTXZPUnYyU0w3ZGkrajlKdkVqVWxx\\u000aVkRFTWRQRDc2b1RYYXh5T3lLUzVVbE4xTDJYbWk3QlRYMmlxL2xueGwyd2VONEx6\\u000aWFBsTmdEaHN0KzRSS1VtYVB4a1QrdlJpdTZ6b3dEV0ZlNGQwUHE2azhRZU1HT1My\\u000aUFFETnhuWHNXUXZoc0UvWGJ1SEl2Y1ptUVlKTjh2bHdGSjBzdnFkV05URWlDNGdJ\\u000aWlJxWHJ1MnUybG03b2RCSVZrdjUwcVVnRENLVG9xS2tkdkYwOVhnKzZsOUNiZjJy\\u000aQWE3d1RjMlU0ZEVtR3VxZ1pyR3VYRnhVZmlKYVR5TFE5KzFLcDNnZFRJQTVFVVRZ\\u000aOUs4cWhnS2lHdjNlQmdIamU1VXhITUMvMGFwWGhiNkFySEM3RW5yOHhEbmN5YU5v\\u000aOXJmSTBjT3RCT1g1QVZsS0xZcVdnWEp1bDZTNmZSWWpvdVVjaVF2UHpBRU1iUERV\\u000aaU95ZVVTQzd6SHpHcTZ4LzlBQXFySEZrbkIxS1lYdFJYWk5zQlNJRCtTV2NNMEZG\\u000aK1B5amxJbVQ0K2pYOFJBVjVGdTNpL09hcjBJNk1NVldSZzhNQ1RsRzVWWDd3cmt4\\u000aQ2pGUW5scGs4U2NrbzlRZkNjb1FsTlhyK1Fuay9rcFROOHJHQktvQ0xZVkpNWS83\\u000aa2RYZlluOXBOWTJXejlYSlJXcXh1dFRoMXU0K0ZZUzcrY2h5b3g0Q3ZHTTZjR1BP\\u000adDFZY1BJMjl3cnlYOTFiMks1MWdOQkNzSThPQlJXTkdkdXhMUzA3aDh3eDFSOHVS\\u000aY2dETm9kWnJQQ0pnQ3ovYjd5R0EyMDFManUySEFqeUR4N0pnOUJzTmJ3dTZnZW1z\\u000ackNnOHpJQjdZOFdsQWZueUhuOWRma1dhNFRZMGx6VEZoUStOZUtEM1RaUklrV21J\\u000aQkpUcitwaW1FWmJUSFIxSk5PeUh4L0M0cFlTem94MXhGYmMxbndMck5rd1lyRElN\\u000aM3YxaDQ4eldub3Zad2hIUmk5d1kxdngzQ3RiVXVOMVYwZnVGU0U4K1pvYmNaYzd4\\u000aZDVNdUJ4RW1rYUFneWJSQ2JSRlZvUFgxdjdGMklkZGd3TFRYM1ozSGNZdG85eWJM\\u000acWowZ0FNbUpadTJGM3pYUkkxUFczc25STFpubTd6TnBCYVUrL1luQzRjSUlYL0Er\\u000aMy9zZ0tYeDR1U2tqTGlwN2lTU2xoTTRmZFQwcFBSaUVoTkRyTG16UzErWmM1UXpN\\u000aaVVFVGM5L3Q4bFJDa0E1UXhYZkdmZmJvTFNGT2VMNTV5NWEzYXhNMUtZK0VzOFBx\\u000aRnk0cGhYY0dLVHZ6dDcrdXRlOEVUdWJKUUR2cStFUnhTeWkwWm9kK2RyTC9zSmty\\u000aa2tMRnU0ZGEzOTlkS3VobGRMekM3MlZxS3VDTUN6eGtOU2NOT3ZRSlRYVHlEblkz\\u000aa3pXRnFKK2l6SXRvTm9ydVRNUEJTNkpOMEJWQmlBOFF2bjhWd1dyOXEySDBzWlJ2\\u000aNWxsUkZZZnM1bEZ5TkI5bkpONnVPZ2JMU0pNSm02ZGc2NHlITDdFOXE4OE5rZDVx\\u000aMXVhY21pd0VUN0VzVGpSUXdLMm5oN05lMC96VGVpSzdiVG1RMW1KUGpwZEEycXp6\\u000aZ3lIRGoxRVlNenhoZFZIb3lHQW4wWlhDak96T21SR0F3U05pY3VhR1I3aERpRzNU\\u000aZllxSkxLWUorUHBnYTh4NlRha0xwcnZyK2F4c01wSWNPWkFpQy9jQUV0REFQV1lN\\u000aQmZaeEI3cFdSR2NqVThPbDhzUnlwTXZ4ZDByWlpoZDR6K2NSQ0p4aEM2RDl4blMv\\u000aVHd5MWVxOFd5TmNLdDYyRkVaU0dMWXFCaWVUSUp6ODRLMnpTWFdYVzBDZnhrcDVu\\u000aZXlnbTc2eFlyWmJLUndPcmxuRVFwaEVUbVl1SzB6RjdtOERKOVBtNlBNeVl3SVVP\\u000aL2t5aVYwU0R3WW5CM05HMFdSNEtFN01jOUZOMWFtM3l2N2IvOFBPRWlNVDBpK2o5\\u000aWm5lajRMT2ZVcnVVTDBqc1UyRkxSLy9RVXpaZUpxL2NaenBKc1VEY2ZvcW1qNERI\\u000abTk1YW5IQXNPdnZJZXBqdDJsQ0dLZVExRm1yb1h1NzQyc1BQMndySmtyMDd1SThM\\u000abnN0R2xucFNPNzZ2ZnRDa2kvYjc4THJOc0VIRm42ZDgzM1JXbzUrWVhaUXllWWUw\\u000aUEovWUpad0c4bFkyRS9YZWFrTjAxSjJpT2tNK0lmVkhnYWsvUG5PRVhhOFFqOXdu\\u000aejBNKzY5eVFGVksyVDJxRW5PUmtEZmtacFJtM2x0WXdqcFhCbDJrdDVKUE5qVStH\\u000ad1A5SjJHdExWR2IyNmJleCs1QmlVNWtxbUQzaGdHUlRsVmp1WXFkS3pYL3Z5bVJP\\u000acm9MZWhHMEZtMjFpYXFvZitQd1I3ZmlOUHh4WitLa1Axb2JGb2xDalo3S2o0OWdj\\u000aR1JNSnE5U3lya3BWcVkwS21YMGw1SnpERE9QUWdiRDhlRlQ1ckhjbFc2SHVCZFdB\\u000aOHAyckhQNG5BaXhiazIrSGRsMG5Rd3QwalNwUHNsSmJrYkpYQWtaZnZJNVVwU0RY\\u000aZGpRQmlXOFNJRWY1QXhPaUFveEdGQksxKzZzS2xJMzMzNCtKYmlSOVZDQlE1akQx\\u000acjM0MnlPcDlzc2VjZEFGVmRNQXZOQk1jQlQ3Nmx1ZmVlRkNCUFRQOC9sZFF4dmxy\\u000ac1Z0SEZoRHBHa2FYSk9hck5TVlV6d25uU0djTTZUMEM3ZTJLV3l3VUpLb1pYdmwv\\u000ac3czdG5KaFhTaDE5SUJxS3BLYjBTV1piTTZFaHlPTmZHc0hqSkhuR28rVHlBQlRu\\u000abWtNY25tTkxPSjcxYzNnMjJKdk8zS0diMGRQZTNYMTEyS09LNmpEdFZPVjRIS1Ax\\u000aK3UzRkRCT2pqYWU2SC8vYjN4RVNXWTB0VmlNSEN2YUVVYkhKL0dyQXpNWElwNTNB\\u000aYVRoSXEzVlVOckJlTDVraFFjbDl3ejcxM3JLRHkzSG0wRWxnQUpYSEt2cHpYS3BC\\u000aUm1pUDFJVHdRQ1F6L3lTREF5ZldpK2pxT0hNdUxaR1oxcW9qT3V1UnhIdWFTeU95\\u000aQWFwU3F3TUtFQTlIeGlZeFB3UUEvcHFySENJS0JDRWtSUnRrNDloQlY2VXdsOVdv\\u000aMnlJQm11cC93UE9rRVVRRW9NckxKL1FMSlZyUzd0N3BaRkNXdmdwV3RoZXcwMjBj\\u000aNTQ4QmkreEl5UjdFeVFmaXB4NmFtM3JzUUNLdDdMTXIwTXkvNVBkL2d4bWVNRjlG\\u000aUmNCdUtEQ3FlWEwzeWZWZmhwMjZQQzZTenFBdmJsbzh2ZG9EWXZKenFkWGVlMXFw\\u000aYzJmeHF6bFBkMXpicEJzeTh5NjRMM2V6M1NqWDBubnMwU2NvaVVuQkozci9hUG1E\\u000aR2tzUU1UaFBlbzVOcWpVTmc2d3FUQXlDMThqc1ByNkd0VXFMQ3lSOU9UZW5RaDdM\\u000aNXVSK0FMTVRscC81N1pMMjJkc2liUUJEdmVhNEtISGhzWjZzbDBGKy9YdmR5a1gr\\u000aZWU1eExVMnFES1RlRVkwNmt3elNQSTVxWkYrTXRtVVJTUWtoYVRuRGJYRy9kd1Ir\\u000aaHdRb1RQcXpBeURLRi9ITmRZVDdzM0lxYS9zQkEyTjJZVXFJbElId3Y1TUFGclE5\\u000abXYwbFhrc0FHbzF6TUpKdVRNUFY4alFmdDh0NFB4aUY1Uml6b0s4cWI4TjBLK3RQ\\u000aTGRJdWJtcnlJRitYSXhkV0t6NDhvMWR5MWYyalFIV0V5eVJNZTNvM2NTSCtDRU5S\\u000aanM2aDdPUjhyekd3ZFJxVmlEeHRtR3FMc3lhYVZYWUoreVZ4Zm5kNmg1RGNTNlI2\\u000aclAzOS96WEtSS0dYU05zd0EyMjBjTy9ER3VsYVdtT0pLand1TkNFRHpFM01sWHc2\\u000aLzB1cllNUktsVUVVTmpDTVVxbEFPSUJ1Y3g5YnhEYmpzU0lHN0wrSDUzSFFXZnI4\\u000abVlaOXhjYnFidXc2Yk1PQi94Z28xK0RyZkQ3VzJ3YVdoOGpKUW03NFN1L1ltQldT\\u000aUjBOVEQyNXd5R21zTVJOYmZvS3VTbUZNM05pVXdOcU40eVNQa1FOaTZod1ErNmVC\\u000aT2lPcmY3aDJqdE1VUU1HVFk2dEYyZzhzUVRRZVRVa0NqRkordExVVXBlR3BRaTE2\\u000aKytHa0UwV1dJWlBzeGtuT2Q0U1lXdHZBUWxBWTV3RXlTejFYQVNLNU45cmx3TldX\\u000aWE4vSjVIaVZacE5tVDUycjkvSTlzRlhpeWN4d3NPL1prd3lMeWFnaUw1cE9hQ1g5\\u000aUzJuNmVDcmk0cjBpcUtSWTE0QlhaZEdrNGlnbHpQR2tPMU1zc3JEU2FsejZIdGJY\\u000aMWgyd1VSMHdTZGlETHpUc3o1QmR6USs1ZlVwOHMxNkFicWlxQU82Y2Y3WlpPRWFs\\u000aOFBVZlI1bzZQZ2llZVFqN1lQUjdqcmVtT1RwUDZqaXZZLzFyQzBJYThLQ2pyNzF1\\u000adVBEa3VVVlZ0MXJiZzNZaCtWVE00aWU5VS95U3lXSFUwejZIbU1icHZCZ3AzUTV5\\u000aaXN2azdtVFFDdE1uNkR5VTlKSWlDRHBhZWVGUGpaVWJiSXRqbytiWFV2SW5ZbUxu\\u000aankwaUVJYW80YmhOcERGSjAzcnltQ3NMeTRSb1ZZczQ4NWxMd3hEcEFLbG4vMWFY\\u000abUFiK0p2VFFlTE1xNmMrRUtqR1FITXJycmU2T3VaamxiKzRDVVlBYkdLclA3b2Mz\\u000aL0tVL0JrTGVpdm9lQjFXaUgvSHBncDZSNVh3VTNvUXBXTUtlc244UkhMU0NsYWUz\\u000aaW5ic2FsNUpGK25KUDFSaXZldnNya0IyMWU0OXcxU2NIbmJVdDgrZEJJc1ZqOGhD\\u000aT1p2SjdqTVR1YUJteDV6UnJGUk9OSHJuTjdOMlFPQklpUmxDVFRmSUJTci8zdkwr\\u000admxObm9GLzlMcTU5c1gxY0JrVk9qQmI5cEFJRm85TnFRMHFLdGw1YXZiSkxXdG02\\u000aa21lei9xcG9HT0FRWnF3VE4xeHpwTWtSRTBpVExPQk50TkcyazM1RUJwUUI4WmQr\\u000aekFJM3d2ZGFPV3FsRk1oSHVQTHVTejliaHhEa1RicTVwSzhMWGxNVldURFVUM29L\\u000aM0g5d1M4bTE4aW9IRnpPUUtSMnVXc0FrZ09yMEt5b0Iyb1pEN0cxejJOYWNLTmgr\\u000aOFlyZXdOanVnZTBSbDJaWmVSVkNLc015UTRqT0diSmV5K1hQWkVyWHRGNWtsMC8w\\u000aZDdMT3BVQjRUcWM2NVp3NmpBOTFRK0c0dURuN0xicXY5LzVoUFllblBHeHM2Snhl\\u000aQVNhTW41OVR4L2JYUlEyQVIrbnpyNDRMTG9xVEN2dzJCRzJ5ZlBzb3pwZlpITlIv\\u000aMWE3cGRRdjdvVzhwdWV2WjYrb1p5R3p1NDhPRmRTZjFjWnNVMUhXdnUxd2J0blgx\\u000aSGdFWU1hNm10MWR4WjlNMktzMWpMc252eDdyTjJBMHlUeXA3WndadTZCQlRTeHVS\\u000aSjJiYjY4THJFZDlSbU9FN0VKZkhpZjB1a0tKWnIwZndJM2o5bkNnWk1hMml2Yzk0\\u000ac0NSMXV5c2pWcGc3d2FoOGUyRkg5cFN4U2VZa3RqVzBnY3ZvVndLNmZiRThiWVp5\\u000aQU1DL1A0Z2JxSlRIWkZzeVA3dVVIaVhQdXoxTEhnNXdOSk5BdXYxSFEvVTlLQlBF\\u000ac1lKd1R3YmxEa0RqK0RCbE4yZEVtVHpaVkpWbGU4SGlINGhzT1NoNDQ1Q2xHREFn\\u000aL2hZTE1kYTBqSDJaS2NneVZSMnhNMVlYd3NMZTR3QnNBNUdLRkJTWERFQjZmMkIv\\u000adDJIU3VZczFmNldpbEFEaDBqaU1JcllTTnM0Z2tOTFJYU3IxbkxpaGxMV1FWNzZk\\u000aU09YOW55MTJONFFwZ2wxTzVSSzUwWjB4SktNNE0xN09xZldHcVVFNnlSYWx5V29D\\u000aakFjZzhSdE5TZzViSjhDUnRQaFJFcnNZeE51VzRVZHJSaEk5dThxU3dERTl5QmNQ\\u000aUWoyUzhodm9FYlRMbXV0SW9zRXdvdFFOeXVvU1NuN2lVQXJwSWpuVzhLc1U2VTAy\\u000aeCtzd2NYSDl4VU92ZE9ZczhCWE1tSC84bXFxV0UzMkpVcGJGNUlaWEw3TUIzMEc1\\u000aTTg2NFZmWG5HK1FUbmkzbFlSWEhyd0Z4R1FPUTY0M2hzVkZDSVVvYVhiczRkM2RE\\u000aajZPUVZhVGxtM0k4R0ttYVNNSSszR0pYNWZFVHNOYkdGcCs0ZStNZEZkak1Yb1hR\\u000abjZjSFVGN3NYd2FIVVRtekphNDZaZDBLSjVVeEdicU1oMUo5cWJLamUvWWJzNjNZ\\u000aTjAzanNWNGljZy9qNngzb1VvRWdnd2lDSW1td3pIbDZVd20zNGNmZ3g2WEFJM3BW\\u000aaTIxMHhBTll3K2M4WDNPbGxnbHlEWjlaOHE1bTZOMnV6UUZMTFRDYzVIUVU2eWkx\\u000aU2g5d2pjOUdkakJSSDErdFZ2cVVDbnUrZXZNanBZL1A4R1hDZXRIdEhGa2xER3dF\\u000aMnNQRUI1WkZVZFkvcm9WeDdRczVSWVpkMVdOVEovRkMxRk1YTkVtTkNqRFNUUk9X\\u000aVUZlaHF2d3RjUmVQVHdkdEdjVWdONmVqSXBOdTlzSWNoUFI3UkVOYWtRRWR2UERF\\u000adWl0dWpQc1g5a2ptV3A3TnB6MU1XQzV3MGlEOXdLVkhHc01jWGF1SlBwVFVCdzUz\\u000aS2M5RTNGc3F3Q0J1cGNscDRZMWpzRk94WkYrbTBweFlnSUxPS2JSTjBjZHFGT2ll\\u000aRzhKcVJidXBpaGovOEpwaVg2RlI4dWxXSXZzZ3RSU21pSVZodlo5L3V5cjVXbkxJ\\u000aNklDV1hWVHRWYVY0clF0QUFSV1VlY0JYY0FXRHcwOEhzL0sydGpNQ0t3WXIxYzg4\\u000aSU4veXdaVnBuT0lveHdxNU9wczg3cnBqS2hvaHlCMk9ORUlNZlBEM0hYZG9OQWRY\\u000aTlF0SysreG4xN05XNHF0WHFxQitFeFRDNWRGQVpvT0I3QnpiVFdKbjV4NGMvUTNw\\u000aeEMxY3Q4L291ZERnQ1drTGZpT0NYWEwxbzlqRjN4SEsvL3hhMEducFh3Nm1IRndw\\u000aNW5XZk5UMFFDSmRJcWRrM05WbklIcTJwRmhSTDFwSUptdHBTOUNuSlFiNWZLVkcr\\u000aNXFTM2pXMkNzdTZTTWFiSkpNQm5vT2l0cWpTRzJxL0pIMENKaElCZk5IeXVxK1NF\\u000aN3FhaEJmZ2dtNlRQUkMzWXFjc2V1R2Zqa1N2RnBXN3hNU3c2QlNvZWljdktVTUNp\\u000aQW1GQVB1MXBNam5MMUp3VkpFUkxHcVZrVFdZanZqanduY0pWZWhJQTFNeHNHWWsv\\u000ab0ZpbnF5TDVsSVUySmNYMi9kcXlKclB1dzR6eWxIU0ZXT0FPSWtsSEN6eVFSN0lr\\u000aeFphbGJDYmpjWGRFVFZFV1YxSnJsZzVaMHhNbG5jYnZjQnUyNWtUMC9oYmh0alNK\\u000aUnJMU0dqOGx0Vm9ONCtCWmt4Y1ZTVUtLVGhSTGtKeENBdlQwV0RkQjM4aDh3eWtD\\u000aODVib0ZmU092UWsvdXFWalczK3ZzY283V2NzRmE2OEVKdWN1Y1Y1QzhiOEJ2dFV4\\u000aRWRiUXZuMlNkcjNUTEFqazlsQ2ZtcUM2Mm05VEpHOXVxdi9Fc1BxNmxtWFNLdHpv\\u000aWmo2Z1Z5ZGd2T2FXajZLMnF2R20xSGZiOTlpWkdhWEV3Y1U1bUZGNVBZYlMrdVVl\\u000aTlRPODgwdTl1dVJlYzJlR2dBMVR4SlZTVHY3N3ZuRTI4cnBzQUZycWl0ZklwTXll\\u000aUW10RzAvQU05bTNMelJmT3dLNTRBeEdDRk5CV2txYmpRUll0bUlaa0hWdDVkQS9Z\\u000aaXF3KytQQjkxaWJIQ0l3WnAwdWYvL1AzdHRzVDRHUy9KNjBoZ2pWNEJwek5FVVJJ\\u000aODNkSEo2SGZHM2dlaXlNeGYwd0ZuNjVpd1loc2s0bng2WjlleDVEN0J6Y0U5K24z\\u000aWFVBVkJmcXV1V3d2Qitxb0RBK1RpMVRDQ1gzTElteVM2RkhJZU50Y0lOQTc0UldO\\u000ac3ZtY01mZTlYUi9IQ1RERzMydXk3QzhiR29RQ3JFcllreTRXTVlhSGZScXN2cjRa\\u000aWGV6TGpENTJkbHkrV3UxQVd0YmtxbzU4am9pNzgrYjhhaEREVG5ib2ZFOXdoeGxW\\u000abTdGYXB0Z2NET3E1TER1WDlNTHdZRmM2WGludDZIUGtHMUhoeE1rMGdIRk1xTzJs\\u000acm1lQ09nb2t2MndwYk1MZ0txRUxZR252amNzR3R3WDZQMzlWNnlFRmcrOCtFZzFP\\u000aR2tRUmkvbzRScTRjSm1QZ0x6ajZKVC9FK1VZV2NjQitLaXc4S29NOEJBVGVsNEsz\\u000aVFlhcHlBeUVyYW13d1NGWldKOGJDdUx6WWNRODVEWkxCRy9UaWtDUHA2RmZzQy9V\\u000aNDBCWGdzZ2IvOERKS3U4SnNQRWZ5WEhFR1I2cEZSVHoyVmE0YXRiL1hCc3NMcmpm\\u000aTUsrTVJ3dXZnTTZmQjBjbUh5eXRkbjVrdVBCUitSa0FnLzgwMVRhR3RJUml5UnlQ\\u000aYmU2aXZSa21tY29idTVGc3F4eFlCa3V0VUxoZm1JaE5Ma3EvQUhvWGZZTzdpZnRW\\u000aMkljTmE2QkZQU0NaajZ1SlY2MDBKN2swRjRnZ292UmVWZmlTMFFoSk5TeEZ2YUQ4\\u000aZVRuUHlVc21SWjY3blMvenp4QVFyN0FrTXN1S2xLVlBReVlVOTAwcFZsaGRlNEVH\\u000aalRTREcxTjYvV0crdWN0SFo3Mm1DM3VYQTdoUUVLZEdxbUs5WER6Qmp2MU1UWDQ1\\u000aakhFR3JWbU5GaytKVHJFSkVsdEdRTmJqRE96UklORklxMVgzalRtN1pZTWQ4MVNv\\u000aOS91Tk14Y2hDcXExUzkybHMrUkl0elJJSVRjZVVDMkp5NVdtQjUzUHNqdDNWYW4x\\u000aSThBaTN1OUxUa2djaGk4N2QyNXVRbEhFd0RGMWZydjgrb3NubUZBQy9GbXQ0YXA3\\u000abjRKenFzVUhDV0RucVU4RjNEVVBTRXBsSEY2UFFNc04wd0JnaEdDNmdpTDFVU2ti\\u000aci81UUlhNlZWV1B1MHE5OFdyVlNCT2dnMUxHVVZvUFVXOHdlaWdRelpXYW1PU1hs\\u000aY0FkL2lrQmVaSW9iVlY5VDlDZytWbUN4Ynk2eGhBL2kvRzZDSmVjc0c4UnpTM1dN\\u000aY1did3RyeFZicy82bVhoWGtRZWhCckhTSDZyUTdvckdMakljQk52WXRyR3FJeFF4\\u000aNDRKQjJIdUdyTUR2QW9rSEJCYXMvWlBsOGdOTVZ0L2ZqQm1ZbFdRSi84WFdBT0Rm\\u000aa0JHMG5HLzRBUldUanpkM1lsb2xKQW10Qnp0YkNGWWkvNTlaWFZvV1hBbVg2b0g3\\u000aNUhvZmcrRHdmQW1nalYzR0VvKzhUR3VnQ1BqMFRJRERvUEUzV0IvR0wvUlAyRHRz\\u000aZVZ3c0pxak1UM0tWYjVTTHZkdjNLWFJXdVF4K2JNaVZCckZQSy9uKzhZNTJENjJi\\u000aT1NPZHVka01jQVVnaHpuRUpNWUJPZGtZNnplUjRLbnljVW5wc2xiTXhVRUtsMGht\\u000aL0JiM0FCUWdzMXVGZmg5QUVEUjJ0ZmJKNEd5RE5lZSswVEVYbDlTRHFRazB1eFAv\\u000aTEFMTUp2Z1ZPdHZqaVg1bjQ5a21icVdQbldWRGo2OUxPNGgxN05IWFNhQU9uNHk4\\u000acnVrSnh0akw4VTZLdTNST0tjMnlEZVpwNUc0V1dUNVVndjJQSUdyencyM2FqMWNj\\u000abE0ycmpqeFF2V1RQS0cvaDl5bm9GWjMzWm5LNkdGSnRYUTJFQ21VTGZ4OVZ3UDZj\\u000adWpzdVNwRVQwUlo5NXk4Tzc1dmNBRnhXNnpubnZSNkkvRlBxbHE3MzM5UnBJRUFH\\u000aTFRuaUQvZkJLSi9hS1RyMXlaM0IveldiVmlsYkdYWlp3UW9uZnptYy9qS1orVTl6\\u000aWXlTMTZ2Yy9TV0k0aytiQmpNM2hoS1pKaWJFeGpGalpIQStVU2lQS2Z1VDV3T0tx\\u000aU2lsbWJLcWJNbWtNLzNKelZCTlJtSnZwNkxHdnRJdDVJMkYyRS9DTXlPMjRHQ3RQ\\u000aajdlYjlYNlA4cUd3SG81VHlmWm9Vb2VPaXNMVFFmZXpISHhXUHFGeVdKY2VmSE9B\\u000aM0VjVTgwWHhPdlhyUWlKR2laUlRWWVB6dnAzU1ovYnJRRk51bHM2Rm5FYW1hRER2\\u000aNDJqSTRyVi9TYVFPZ3dRTHdYMEd0MCtvdGRRbjd4S1diZVNHNWhNbzFXMkdFRC9r\\u000aelpJRGM5ay8vZXdkMXg0UGhGekRFcjMzSDVtQ09mYTcvTi9KR2wvYXpFUnl3Qm1j\\u000aTDZ1enBFQWd0YXRrSjViQytnVy9objM3WDRRZml6cnZzQURXVU5uMTljK3ZzZG9M\\u000aelNwUmVzNDB2azQxUk9SakZ6eFEraUZnRTluVXZLSEx2ZnpwSHVkeGZKRzlRZGQ3\\u000aTk9mU2NRaisvTzBHbnhOZDgySnBXZ1p0SnZHRzBGWkZ6Z29aaXhBcWorLzIrRHJJ\\u000aUjRYeUdQa29aVDJLVGYxU0RNbTR1dEhuRkYyRldtV0hxWVYxSjdwMkwxZ01kYW8z\\u000aeVA5TDFFME8xMWNBSVVNaGIvMWhvSEFIbldBYlF2OEJQUnNVTE9SdUI2dENWTGNj\\u000aenlEY3UrR01nYWU3bUdPWERaTmczM0gyTnNmV1RJMWpCd0JSYUhYaGoxUHhJc0tQ\\u000aOVdnWENNQkxlWHdHV0s0WUpDdmNUTjZoUlIzZWZ6aHd2UzZjM0k5clVDc05HaTBk\\u000aWEdIc0QyRWV5RjdtYm96cm9Zb0tSWDhXL0Ntejh4TnI2eitNS1RwSWZmb3QrZ0NP\\u000aaTN4QkJxQ2pLdmg5eTdLMVQ2MkdEVElqUjdOaXEwUkwxTEU0cVFSbDFmNkNWMGJI\\u000aMzQvMzMraERCWnJmREVmekRSNlpSTGhycmI0c01DU0ZiaUYyaXlqY1QycVJTZkVH\\u000aZENwanlHcVZQZWpWT3VvK0JZUkhoZURqVHZwNHUwV0NBS0cyNHViM0VQWnYwS3Ey\\u000aNHZGOEhQclJIcFBSVkNqdUZHa0dNK3NqWWlkeHh4VnBDa2hsZmxZZnJFUjJSMGtM\\u000aTW9Hamkway9wYnlRdEd1dnk3RDFQZ0V6UEhCUUVHSzZhaTc2U2pWNU9HUUdzMzFz\\u000aYzJKMFlRME14Ky9wNEZtb3hvek02bkxrVkNObUxWMStPSXZHaFV3cEFUd25XZTZP\\u000aUFBHeUVyVFpvalZlZXVqa3Q2ejFzNUtVdEo2YVRpMWZxRlRiY2tmUGpaaGt0K2Ru\\u000aTUdmNHVxdXhza0VDYmJTOEVEUm1DUlM4Z0poM05GQ3VGR0pzWW94OVBvWk5BaHhK\\u000abEYzaDhFNk1UWkxNUFRrWHhHS3B0VndqR3IxTmx0VGRycVNKRVFtSUZTWDQ4cUwx\\u000aeWtudXY3WEV0TWxxUGxVUVBrd1l2THhpeHNqTHJEV1R5UG5MY3RRR3EvVDJ0cFp1\\u000aYjc4cXM3Y0NoSFNMVWV5OEt3ejVxS0ZpS3ZBTjBBOEhvalhzOElZa0F0NDFJdVZm\\u000aYW9oTHVEcER2Nk5wTmtLaUV5ckZyclVuZjY4cFNybHNiTHpSTmgyek9DTitDaXZ0\\u000aOTB5S0JXbjlUeXkrdHhIcy9EL25qMzl3Y3ExWXc2VDhlR0txVDR1OExOUGJ3L05o\\u000aMm1ramxQaE5SR0R1SUZON3MyKzlmYjhlYmJQRG5LL2ozdUtieWRjNEM1QWhDbUFk\\u000aYWpzVXA0Q3dpNTVGTjJreXRZZkZ6TTlyZk95T0VlZ084bzdDOFB6WDVjcENIbHdo\\u000aZmtMWHFwMDBPUktXZ0RQQlZnaVkyT2JFaU1CeUFOZFVOK2k0dVJqUjZJUnBMMXlU\\u000aY1F4Z3JlWmVkK1hWK3BwWEtWb1dVMEowR3o1cE94MDRYY244UUh2Zno3MjdtN1NL\\u000aWDdKaVVwY1dJc1g5UmZjdFlJb1FxSkY1endSN0s0WDJYV252NVBtTk9YLzVGU2Qy\\u000abXcyN240WlFqRjZYdFRUbzZZeTF5d2dzOUpELzdnSmIwTkczMjhQcU5Hd3FFUzBo\\u000aUnBYR2RydHY5S21hbzFjWFNGN2drVHZ5RFRScXRYcHYzeER5bXROSW1pUlNOOXlk\\u000abHV4aFUydG50dXVUVlN1WEUrTkJ1QXovQXdPSU05cnNOL1F6QzZXT2hGWkNjd1lF\\u000aK3pGa0FLVUJLUzBvSG4xbmR5dVQ5d1ZqbnVDL3ZhbWNTVmwwWnhJODlpcTc1Tzd1\\u000aS0V1dGt3Wlhnei9YekdVS01NZmo4Qi9oYW40WlE3MFRidHZDNkszYUpLWXB5RlQ5\\u000aby9OazZkMzQ5MFV4Z3AyclZVQnprV3JucmtZUy8rRkV2VUd1cW51V3BrZzZra2Y2\\u000aWmFtbTVidVk2Rmx3WTJIODVxQkV5a0haWGc4RU5tWVBtc09QOFM1TU10bEZYbXgz\\u000adnJUVUlRY2RtUHV4V1RYNlArSEtvOWZyandLMkxFTmhYUXN0aldZbW5VWW93TUZH\\u000aY3l1NlR2TTdWZDUrb2VOU0tGaldQNGgxbUFMNVYyTHZWU0JSYTYxb29mQ3VPODZI\\u000aWmNQbzRPNEZoVlFXeFkrYzBLT0tFbzVlSjZiemlneTVvclM5WmY3OTlQTXdRbVJy\\u000aZmVjWDF6R3ZYMEZTeE9KdzZEM0FVZ1VhR3dSb3M3d1FlREd3QWdmUGJ3bTJLcFda\\u000aK3pGK204cTJXOHlUbitGR3J5czJ2bXJKczRTZ1YybU4yN28wRFRQV1p0a3h6Y3gx\\u000aU1JoUjM3Z3d1NUdreGVpL3A5NVdTeHNVdEozUUd4Rk91dnQ3T284V09rRjNlN3FK\\u000aSnQ5U2tYSVVpMVNGYzVRblZ6Mno1MmYzVStabzlwdlBVVnN2UlkwelFuSU1xVTFE\\u000aN2FwTEdhWGltMm84MWszQ1gwVmRJQXlaYmlGUHVEcGtZOWdvcE1FcjgrclFIQWRB\\u000aMlRZalpwQlhCV3NyNDg2Z202Um5tc1luVXlRRnFTSkNFcWhCUnhXekhBQk5GdVZS\\u000abEF6ZE5DV1Z2L1RLVXV4WmV2bTVCTWNyL3V4ZmgyTDNpUmh4Zm96cU5HMnh1RXFS\\u000adTFSR1pTRWFkVmUwaUdUVlhWcnQ1WHU5QXMxdXY0QlJGcm1GY0FpbWkxQ1ZqbUJq\\u000ad1pPNTVmeUdrL1haNGgrQklkaXJyK2Vxdm01ZmhZV1JKMmk1YmNUUE9WYTFpeXlm\\u000aZUlaNkppMC8wMk1BTVdlSzB4L0puWW90clJXblA1MGJFOC9XT3hTZ2VMRFNaLy90\\u000ad2pGaUpSTlpEQkdZcCszZGFrZ0R5VHo3Q1hWV1FRTFlGL0NLOGpXRXI4RE9ySUFp\\u000aVjNheFBaNG96YVlqWGVXNHNxQkpkTkdkZ1VzV203bmJnMDRNcCtIL2dDbmQva0py\\u000aOVNmSklaaXdtbnpJR1hXVHV6ZjlTV1ljYU5DK3dzTVBpQURPNjJsUDhoN29xWk5F\\u000ac1dpQmRTTEZ6ak9zdm5rM0Rvak1GeFFxTzlGaHF4ZWtFbmtiS0xoTFQ1d0hhZ1V6\\u000aNE43Vmk5ejNRMFI0VUoxV1pHVGF5dDVkVElYZVppWkpyc0dVc3BiVEFQTElndnM0\\u000aais4aXFwL2pGZWNpclpDRUpuOEo0V3R3UWYxYXROWC8yMlpQWWpZb2lqYXVWTm1l\\u000ac3lTUXRIbzNFYVZmVmljRzUrcHQxYm1ReE5rNlh2ZHUvbVlkVUpMSFZ6VHVpcDVO\\u000aYjdId2VYTFo5WjZwSnZMeEdJSndmR21HZjY5a3Ara2RZODhHN3JvQnN0bk9lMVZU\\u000aUjVuR0lyblhJRDlqcXdQZWF2RlAzV3BjWXRsdzJVQStZdUVVRkJkUkpDRiszdkx0\\u000aQ1pyUm4xNnlYU2tRN1FpSmdHeXV2V0p4QUdZRzYxZGJ4bG41d1ArejlWcUlyMUVr\\u000aY0pXcjZtME9takNJOCswL3lFNXdGbjdEbHlWRWxVRW5ZNzdyOGh6QXFJTUMwSTI5\\u000aNUpnc3BGY2lSaTI1eWRLMzE5c3dLc1dHVFEwZ0xFWlVnNDVxWjAyalBqRWRsM2ZJ\\u000aTm90VGl6TVBVWkdHeTlmK2JpOE9UYld6NlF1K2YxNFk5UkltbWx6N1BmUmltRzVJ\\u000aZ254ZUljRkpxcDBacW9WZ3NpeWtyTVdIaUdDVUMzejZ0d2FnT2lFZlU1bXJ0RGJn\\u000aVkU4NkFROVhWZ3hhZitpRzhYb1JVNmhIVkpNM2dhWk9EVmFYY0tiQkg5L1NaN3p4\\u000aZlI3UjBwVnJyc0U1UHE5cGJ0VUphRmRvK2hpQnpxdGRLdEJrUDdjYkFEVER2eHU4\\u000aYjhkSDdhYVMzUzlxS0dmaHUzMW0xK0hVSjZHYmhTRW9sYnlGcTJySVkyV1p1K3FX\\u000aUHVxU3NtV3NEeVRDSGJ0d2N6RVkvOCtUdEhUa1pFYmpkN0F0RGZ6dmlJRW1aazRh\\u000aRFpCdEdYMTc1NlFIb2hJT21KdGVPTWlqSEtqdk1VNHlYZVh3VkkwcFVwc09JZVhZ\\u000aNStSOWVGQVFFZUJTTG9FOU93ekpOYm1idFJvSHMyQVJWUFlaN0lZMUxOM1oxdnNI\\u000aYVY4czZVbnB6TXZNRjBMdGw1UmEycmxwa0NsOHR0a3p3bDF0T0NVYmRmc0d2UVhu\\u000aZktjVllNN3d3bXFQakFRdWJpK2dEcHZrcnVFZTFxekd1NlA4cFlsY28yN1o3WUFE\\u000aL2dzL0s2ZittSGI0VXlpeXI3cklaampSb2c5UWN4NDR3TXF3RWZvbWQwQXFlbWo0\\u000aQTZ3Q1ZVSjFUN1ZwVmYyc0FSWWVnLzAzbWMvTzZySTZtSTVTQ0tKZ0J2UWhvNEN2\\u000aWVYrNzNNbVg3Z1dNUHRkUExydE9vbk13M1V5aEtxODNuV05nSUFhbDZySlhaV1Bl\\u000aYXVVbjVVdm5jeElNZFMzWjFjRndsRHhVd0ltRytGWnJrTGpqWm1XaDRjdzVGOGNj\\u000aOXhSZk93WW5aaTJJMVRUeExLcTlDOUgrak1sOUxna2hoemtWZDFSZUFkcFpZYUdw\\u000aZnlSUzZsWlBWaDZiNlA3a0lsdlhremplcDhkZUprNm5ycWlQL2ZBdFNTQVNUcTdY\\u000aVVVQUEhnSW0rNTR4UWcrdlQ2MHVHY2ZPaHljN0owd29ia1lYMDJ1Q3p0c2lranRa\\u000aRW03WTEvOWRjekx2c2xodUZ0d1UzTWF5Q0QwakRmRkhKbVJCMmVLWmxRZHZmU1A0\\u000acmJ6SGdwMEpzQUJlNndTMlkzdDd2VTJDdklqM3djTlZRTkZCQnZYbmk5SWNxQVNm\\u000aREVWMGhYc3F4YWtQNFAvRTVDMCtkNVR6eDBIRlF6czk2ajNEcnlHNjl4eTByRzBV\\u000adGZLRDBmK3VMc3NQVERybWNhU1ppVXh0WmJqbGtpR0hDU2R5YVo2RlNSYWhMcXpH\\u000aWVJ3YW9wRENDVHhQNXh6WnZaMGIxWDlveWE5c2JRZWFEVEtJZmdmMnc3RVEyZEZn\\u000aLzdCN25lZUxJSVdWTXZvK1pzMUpsR0RuWWpvVUdRYU9ITWI4ZFlIWUJnbEZ6UjJp\\u000aZUN4SjFhU3haQkFQNGFtalErQWp2RDE0MXk3WWsrVnNMeG9jdHcrbzVCRndHOU5m\\u000aVHJzT3MyQ09IckRoZW43TzYwMFNuNWh6MVNhclJHbzBTQjZBOUxJdnc3OUwxZFJ1\\u000aeUc4aWVjaURhRmVVb0M3OERCTjFGRFJyNEpxYmlHTjdXZ0JLQUpyRmd0L1dZMjNV\\u000aSEJPTFpOSHBGZ2lwNnFmNEtTNENRWFFuL1o1MUx3MXhHQUFRSWc0RUxGbjlDcitz\\u000aME94czZkWXZmeVhMWVhiOXkwa3ZyTnZXZDVZUkFWWHZENkFpVTRtOUJZNmZEWFNa\\u000aWm9ma0w5em1BU3Q4anpVZnRPWU94OWVqNzRJeDRQdmRyYmdVV2MyV3hvOWc0U092\\u000aTy9jVlFjd1RPYmFxNkFuVjZIVkl4dGtpakRkeG96dDhYTEJCdVBncFlZWnRWcHJ4\\u000aTGlVb3g3ZGpDRml3cVVYZEo4Mzg1a1gvcXdVNXlYZWwyMnM2c1BHSU95RlI4REw1\\u000ac2ZacW1Qei95bDA1RGJMaTBoTjlBaU9jQStVQ1ExT1ByVllNZ3ZqUjl3ODIwemZh\\u000aTStmOTgvNC9FNW5mVWoxdXlwU3RpbC9tWTJqeWZxd2hnaUpjcFdhWWNZenFQYkY5\\u000aMDVsUkJpa0hNQTBzSGxyeVJpUVdBc1Baa0lxclN1SHg2aGpHSDNGeGpTSnYxZzhp\\u000aVHllL1V4MDBucGVYV1c2ZFg5cGJHYWlOcmZDeGZlOHQzWDcvc3dPTUJyR0VEdEhr\\u000aZWhoWWNybm16U01yZVY4dTV5dDVFL3dmUzJKejNTeGVoTmp5cHhEQUNFSDk4dTFJ\\u000aUUg2d0ZaanlHYVhSQWNqTnVqTTNPbk12NHFKSThzVTdHcE02VHZFcXdrSG0zUjF5\\u000aY3ZhSTRDd0l3d3FzUFlFdUQ4dkIrNks0WGIzQXJzTnd3Qm45ZjZqZzYzZlFvbERL\\u000aZG1zbEJiUGhkdXY3QzJYM21qVnJBUnl4bWdKZGhKckNmbG1hU05rTTIzTWxCZzRQ\\u000aSVR2ZTNhSGFxVnVFVy9jUHVPMTR3alBGdzNDa2RzSWtuancvWTNkOWJiQzl0UHVC\\u000abG0zcXRMQWhSWVJtT1dvWE9malFCUG93WldlMm1RQnJ1TFV1VzhhRG5WU0NTVUNw\\u000ab2lWWnVNYXhuVWpscTAzZ3V1OUcrOVRPZU8xMnJFQkY4cDhtWVA1STU3aWF2enVP\\u000aUjZQa3BWSU5ERVRrQWxqNjZOMDA3T1Zid0IzUk80bDJYTHV5emQxWDI2b1VFUTVl\\u000aamp4LzY1RUdZd0E5ajZpMFE0YTZkZzkxbDBMTndiaGhVbk4wM3dvM3BTRmoraU9F\\u000acUpMc2RUY3pkalllazFlMFlDYU1wVW9ITDlzVkFlcStld1A3VU9wdisxTlF1SnM3\\u000aTWQzUVJnNW9RSzN1NzhYdXNzaGpTZHFpd3RkQTcvVm5SQzN3Mk01bWJLd0VlVGNT\\u000abjl3Ri9GZXBGcTkwQ29wL0hGc1hxeXNVRU51NWtTY3E5dHpESmhnOGJpSmJkVXN4\\u000acU54NFRYWmExZnA2ZU52ZGFzdjVsOUo1bnBmWDZvbjA2MG9CelZvMk9JNXhRMTBH\\u000ac0J0MW5YNWIrQ2UySjk0ekVObXQrYnFLZ0VoNUlzWlZ0YTlhNnYzcWhtYmQvNGJK\\u000admdhTzVmNmd1Y1BRL3JxcjFVbGtDa2dQdnZyWm1zWWVyUDlzeWE2YWhBbDJHaGo0\\u000aekh6eTBDSytEdkxBU0s4MEhCN0tWZFc0dUpxRDYycGlLYkxKVUU5aUhoVTRRVVpu\\u000aeG14eGtNZmJnQS9pdVR0NG9vdy9LOWtIcDkrUWJVazlFUGc5Rno0TVE3bDNiTUxo\\u000aZzdVMjR1N1hTdlR4TUxuMis4ODB6TDNudUJhRUhkYTRic2VDYzBwaDdOS2s5YUFl\\u000aTWF0cWZycjNTSVpycklDZHVETkNhMmRVZXl1d0x1Lzd1Zi92Wm1oVEpaV3c2MjlG\\u000ad2thdjdhaGJRYU1NZ042NXBhL29BR2IwMXJrc1NYZ1hkRjdhc3JVR3YzSGM5ajhu\\u000aSXh1NThqWHh6TGM1d2l1WmIxRFB0OE9mSmdXYTBGeVJKajZBSEY1SEdicWFGTTlV\\u000aRU15SXU5Q3I4c3BGNHJURTVBNjRrb3hqZTNtWGZIVVNVanBUemtLMlllMkpLaFk2\\u000aY0dYc0t2aE4xbHlBblNQTEZ4Tm9sc2k2cHJDWTFaeUdQdVl2bm8ybDdQbFRGblAx\\u000aM1orMCtRMGxCdG02eHZCQm4rUGl5bWxtOWV2TUpoeHNOeGlaN2NZMzNPQnl3NGJ4\\u000aRlQvN2RmUngyUWxxT09BTHI2a1c2ZXI2WUVuQ21CNWdGWDVsSEZML3UzQTRPUFAz\\u000aZ3k2aUdjQ1pPVnJrOTdUQ0NZZDJ6UTVkZVFKSWlKeFFQQnlGbVlQTzg5eU40QlVI\\u000aOWtRVFNDZUdvbVYveWNIYVpkSGwyQ2JIVFd2aGdCcWFiTWJYSnhWRVdac1MrLzJN\\u000aaGttZE5aSThaV0VnYm5odFlXVHUybjhtOGZBREYwMll4UjFjTG9Fa25FN3p0TkpZ\\u000aZE1MZWUyOEMxRk5kbDNtUzVyRlYvclhXVUdtQXAzZ09Lb1NXUmJMRDNlSi9ybE9U\\u000aL1NwVGJFUDVJNGdsQ3AwOHYxOXBMK2krTDlpSkVhWmp3dHd2M1BXRElBekkrWWlr\\u000aZGJnR01uYitYeWwyUDk0R2c0cVk1RTRQN2ZTcFllaVZiVEJleUpRMG9JUzhuUDlI\\u000aUHpwV2NSRjNFOGkyVmhCSU1aYjdSNWtJSVdxa0lMbXJwNnBrejA2NUNKQlNDay9U\\u000aYkYzaVhadU1kcE9udFhMYk5Wc3VGdVJud2FYZkpwVE5LT3U2K2VTcC9rSDE1cFda\\u000adjVJMlFSN0FGaElXSHFCYXo4Z3k0QzdVcS9uVWVqN2ZHM0V2c2ozTVJ4YlNTUjhG\\u000aSnFGZDB4MSt4SzgxTnM4QmlqYUVPV2xBRDFvMU05WEFGTXFWM3pVNEVuQjIwaUl3\\u000aYW5DclBGemJidWNUcVU4RHMzb2k3Yy83emU5Z3ByRHFtK2hKcXRTYXEyNkIxeXZp\\u000acXl6VTd4UVZEczU5VCt0VGkvdDFwalZkclJIVWNWZVZSQ3h6NFl1N1k5TFVaWDA3\\u000aM2o4eXk1MktLZXk3dk95VzBkNWxKVHpkWEpmZkhlQlNhQ2ltMnVwZWZaeTZKeTla\\u000aZWkydDBOMENIUUtzRnkyQk90bTl0MnNUUXFQREJFR0dDdGVRTFB1Y1BOL1doZS93\\u000aZC9Ma0cyNXFOTit2MTJybUNWTE9CM1JiRFpOYnB2Yldxcks5azR0UFF4MkM3M0d4\\u000aeXNIMjNzNWhJOEtvWVVJSEgrQnUvMWF6SDVZTjVhanVXcTNKV1hZVHk1S1crOE4y\\u000aamdvNk9qTENIVzBzUzU5TXcrQU1MajFCaWl2WG5Uc0xTeHBTSVByb21Dei80c2Ri\\u000aM0N3a296akZSOUxLRUJTS0NNK3RxMXA4ZUtTZ3NqUzVuaCtwU2NNRkpxWjdhekRB\\u000aeEhXYVoyNTQ1bWpEdVJOV0Z2M1lsTEhXczZBM24xSExCdnVOUWs1ek05RnYzT2tm\\u000aTzBqOVlVUWFnWjdCMTlUVjVCNDhwQnAxNGdYNS9TR1VmOTZOaWQwWmdURVhQRU8x\\u000aM1JnRU45cWVsazRPQk1icXJQNlZ0d1FPT3BjNXVEWHgzcEdWQkhTejZrb2JRNDV5\\u000aU2l5SUI2L3BiUGlsbjlDdmhNSWVyNWp2YlZneEtCdkFyajB4RFRWWVpGcVVYZVhz\\u000abHRlSE5WN0czd0E2dG9DWU1ZZ3R5UHRtWjd6MDMxZGVEemtwQnBBV21HOW85OVEw\\u000aSC8yV0EwaXNQdVVhbU8zbjFFUG9BRFZQZHF6UFpUOThPeDRjS3kyQmdBWmJBZVgr\\u000aR3lRTzgyblhudE1hWmUwbVV3cnFPbE13clZZNGhlaXY0aFEwOG1VekdkVXRSY0lL\\u000aTGpITm1OcXZvdTdlY2ZHdVhTcnhvMXVJdkdIbzNuVlVZTWc2ZEFRRlpnWUh2ejdZ\\u000aREFKWTBEWGYzTHVFZTR6bVh1azhlNm4vVU5BbE1ZQUlvdEsxY2Z2TDV0bnQ0akVD\\u000aRFFjb3lZaDRjUlVFei9XUXdudEE4Wm5sQUxRMlJOUDY0NXhjU0JOMEVCYUkyb2tB\\u000aNXI5TEYzK1h2UjdxQTB4b3VoNEMrNWZRTnpHdTdwTjFUck9WblYvQXBsMlNaMmtD\\u000aTEJQN0hjWWt2b3ZBYWFick8zeGtrUmtsdFRCd01rR3RmRC9NTm13WW14NTN3U0RL\\u000aUjE3NG1uckRCRDdOb2d0S3NTNG03Yk5iZUZyTE1hdDYwYmZVWWsweFp0YWxuSDdP\\u000aU0xqcURHdmhYQlBDaVFLNzNNVXppdU1qWFZXMTVUWWJDempuMHV0Q3d4Szk4TVlv\\u000aY1lNV0o1UGQ3WG0zejRva2prNDVFTU9DZVRGRmdZclpVNzlWYmdERVFpbUd4a0Ni\\u000aOGR4ejRMZkh4N1NGUXVhSEpNSjh4SUxZTWFSL3doQ2F4ODUydlNRaElJWG0zZ05n\\u000aWHNyeTZ3M3EzLzQ1WDd4OHVPd0p1T29GUGd1NEtNVDBTUkUwSmZRaFhQUDdpTXVJ\\u000aYnRrd0ZXeWxGQno1SmhVMzhzZ2JGdjlaVnczQzcvbnFZVUVDMXZRWHRnbEs4bGJj\\u000aazlUMzU5YVFpclBkcHF3NjA5OFFGVktyNmliTlMySk0wTHFlM21neTBYQ1RTYXUx\\u000aVE4xeXN2SHBpdU1jSW5BZWFyL3d5b1lsek5BZU1kbUQxUTduaWNBK0pWTWM4elJn\\u000aZ1NKcnRoZDZ0emd4NTFFTUNoQUpFaGR6UkpjRG03Z2c5eE9TTzNPTGpRdW05K29k\\u000adjY0b3NZNVNtbDJHSkgzZ0pzRmdyc2d0TXpTMCt1dnYwdGlZY1BoY0VsL040Vlh6\\u000aV1FTNjByZERQMTlUMFFYREMxc1luSS9rZFREcG40WnNyNFZOUzRkM0cwaEQ2Rnh3\\u000aZzlVdXBzN3k0MjRzcmlOWDgzZS9CWFhZTzNBWlZCS3czUlBVWnl1RFRZY0V4cnFM\\u000ad1RPWnJNQUJrVTBuNnBpYVRqMWZhRDJpZUZxcEFycGxIZzdrTW5ZdVN2MVFDekl3\\u000aL21GR0VEWVFqSWFiWXNRelZMRzd4YjJxbkkvTWdTbUdGUFN1VkhKNDBMNzRPYTh5\\u000aSklyeUxvV29ZSDZYZGo2WkdqZXlpT25YcEJFOUgwT2RlMUJJMkJTTjVwWFFZc0hH\\u000abFUzQ1preHdHdUZ5WnVzamVDRW9kZURPQ2lveUJha2kwSzB0cE4wTWZYS0Zubjd0\\u000aVitWb2FXV0dQSEtBa2c0eGJIcjJnYWltWW43UlN5cVcvcUVkdzFVTEgrR1RMQVds\\u000aS0F0eG1LR0ZnNkhtNzFtY2kzNXBGTW1QakROeER0RktZWm40Y3RMZURIR2ZVSEI3\\u000aZlBEOHRjZ0c0VmxTSktwTWVYR2RRT21qMkJubFQrTFYvN2JLbFQ3aSsxTWk2QnVZ\\u000aUmNBbW1GZnU3ZGF2Z2IyVFRvMVM4aTNPdkNieTgyMW16OXNjZllyVjd1bWhYWTJU\\u000aU2ZIQllyeXFtTzlHOXBuSGpTejlsTko0aEdpdU1hR3hNSWhOYUE1Q0trNTd5OEE2\\u000aSW9hWjFWL01BRmJyNXB6RXNlckx4VzdLbld3cjB5WGE2U2hCSDVwSGFXR3hRRlBS\\u000aNEs2bEJKZXpjUlM1ZUcwdjV1SHBQWTYrR2J3dFBUNHBDcENIdHBKNk56dlNVNlFP\\u000aNGVHYUY4b1NEV3pPRXRJVEJCdlBuUWFxa010L2V3Vi9qZldMNVhJbll1aHV2RGtu\\u000aNnZhbTRzenBONWs2WFRYVjh1QXNWY3VaQ3dLRXBKZldSQ0V4dGZqZVIzZ2E4U28x\\u000aeWg4Qm1QSFNBd2FxOUVHc3pBcmdScm40QllKZ1B3VWZ2WkY2c0pIV0pKSm54YUdI\\u000adUNBK1dHejBrcFRpVlJLYVM0SkUvODBHOUxKZjcvTTlvWEVULzFTbWRUaWEzM3lY\\u000abFVSb0xGdVE2OWZuTzhDUzVNM0IxM01HTHN4Wll4aUdTUkpYYkxHVWQ2bnNsQzJ0\\u000aNlh5SUZNdVFtSFcvQVJSNXVNL0o0VStWSUdUZlFPTlowVnZoQStuNlUxNDRtR3Jk\\u000aU251dWROWEpXRk83N0JzZWp2dHMvRWJXNHFOcHE1NWNQQmY0MzFEQ0NoMVJNdTJ3\\u000aNnZUZUJRNitJcllOMGo3aTllcng1UFEvYXN1NkRvMnNRWFZhNTZHVXFNUmJKVUNs\\u000aaFBNM0F0SDFmZ3VucnAvODU3a290UEhkUURBM05hOURNT2lvTEpSM3puN0tiSWlU\\u000aNEo3THFtbUpET05WcW10LzdpeGwwTVlDTDh3azFHOXlnWUhxR0ZsWGoxUXpxTlVS\\u000acHhUU0pualYyTjZOejZmYy9MVW9NR1E5OE5yb1Q5YjhhclNBcVN1TmhCaGwvbEto\\u000aNDJ4QXp0UVdDNkZEY3Nmd2FrUUpGeGs4OEdWWk9hMHJ3UFNEM29LcUMxc05sc2VW\\u000adzVzMWRjK2dodzJKTGRmeUcwWk1yZ3NaQm5uV3RHanhEdFg1WmUxZ0VKbUo3cnN3\\u000aTGsvWW80S1VuWkZ2REF5d2t5VllMY2hwMVJ2ejJKeTNGcHVpWU5sRXRkMHZKRjlX\\u000aR2dkeUd2L1JpN1pEd2tybzYxS3lMallvMVhaelBmUTlscEVqMGRTKzBCZllZUjcv\\u000ac0crcW1qZEZFb2YybmJLRWVaU1N0K010UTdnR1ZGUy9ENmtvWmZNSlM3c0svSTBh\\u000aekVrdkxRR0hTWDN0QW13YXB6K284VDlEYUZxTDFDYjZSNXluUUNucjZ2Vk1QMG1F\\u000aRm5GbURxWVMzY2c4cldyeEdrQmFUcTFDTDZKblhzb0x4dHMxV2N3QmVmR3NyM2Yy\\u000adEZMcXN2TjFHOG9nYm1pN0JDSWthcFdEK3FzRUI2UmtNeStGRVQxaEhuMEZyNEk4\\u000ad2l2YnE0cVpsd0NncHZ4Ui9tYU9iRTZiTjBjK093a1dxcEpRTUl5aDZJcXZsTUtP\\u000aR1d5YmR2aWEzemJMNk5XY05IUnk5aWl0bERzdjJSNy9QMXNqR1I1ZmI1NGRkbXhO\\u000aMmlFVzZLdEFZRU5Bb2VwSUtrWkVDNUJ3QUNYajZrM1Y5dXBNYzcrZnlOSEFBbmZr\\u000aaTZ5amRVa1BZMzVsbmNhcTJRcDd6Q3BWdk1qbTlTK1dtWHV2ZlNwc3EwZlVxWlN3\\u000aNmluZnpncjhlNy9zZDhIc1hVL1BmSDY3S0ZzWElOQlpMVm41QXF5b01YTVVNY3dV\\u000aVCs3RjhnSGl3NUpRcnhELzhvcVhUL3dvLzIxcFJObXF2ZDQreG5hcGtDZnBpOUlv\\u000adFNjd054ZlpmelkrdDZyRmJyU3VWMXZQVHJaSWNrT2ZXNmt5MHp2UmRCL2hna2Ur\\u000aNVBvVGRnd0diSnp0Ylo5R1pYSGpGZFVLWFFKVWxscmJWRGhUTkNoakhxNGE2QzhH\\u000aWWRMV1hxNzZxWlEwWnhvRjJxdUtkM3NjazEvaUxIY3owMEVuRGExK3BXd2VTMVhU\\u000adUZaR1lFTXNGeUptWSt5QmdRK3Z4aHQ2bFArKzZzSW9pbUF4cUMweWU1SC9McHFM\\u000aaFBTQlVpZHppcnlTblZ2SjZmcjI3TVRQUTBoci9JYUFXRlZnUG1yNEdqd3gxdWh0\\u000ad1J4aVU3K0lwUUxNSVVZYU1nVldnaTZvbU5aM25mcHZyYUdwWWxvaE84Z3ZXK0lL\\u000aWFJNWEJBR0Y4TlQ5UG1ZazNXa3NPVU8rVS9XKzlOL1d2algzc2haZWpGd21GYVg1\\u000aWVhyREE1MS9icDRvQWlIMzd2TmZqTGxzd1piZ2o4NVFsbXBydlhuY1dnS1RZN1pP\\u000aSmMxcmhmQnA5ZUhuUm1nQkVyNHZXOGROdkxibVFSa1dhTmxrTFBSeGd5NHU3d1p3\\u000aN1dmZnYvOG5uWEhsbWoxNDVWQ0NxOHlJR2FiM2tqQ1dvQnFQbnh0Vko5VVFNME9D\\u000aSVFhay9mWjJvdDV6Vk92dGhJeE1pK0MzNVAwRjVkUi80RVBaS3g4a1AyVnZ6RkZy\\u000aN3hFUlBSZFJnbjRqWDlFREVZQTJoWVlwRWRLRUdGai9aZTlKRlJrNmxQZjlVY05Y\\u000aRkgxd0srMW5HZi83WnZzd3dSYnNzalZjRXlMODVQU2F5eVl1ZXQrMUZ5UFpKRk9J\\u000aRnVSRm9vMWhaYUp1cGlTdm5yL1VSSXlGWEhMQ1B2Sld5MnZQVzBibVphR1NRVEJZ\\u000aYlRMcVl0UzBvdTJxOHVBd01vZUYyT25FVDdaTENjMVhTV3lFWWErWFJ0MkduMHBl\\u000aUEkxUW91NGduby8yRGlrN3NxTERydnFRbVpTOFNISlFSQVJaSnh1UUJBWDUrNzgy\\u000aYU9uaWN1aUtTbmwyeHFkM2pYRTRuUS82S2phbmhlVXpzdVRrWHFQcG4xbWlPQi9H\\u000aTFNUQ3VaWHRXcjdlSFpFb3RhZ0pOQm9OSlBYdG5KSElQb1VTdHpGTG9HM01Vc3dY\\u000aeFlCMG0xc2FjaTdaRlJ5cU1sMGtvKytlN1VCSEZOMi9UNS9ybXdsbEhaZ3A3Mm8r\\u000aWjZzWERyVXdxMW8zSVVocnRYNkJPYzJKOWladTVaenVRNkxNNkRhY0Z4bEdtcXRh\\u000aeDB3SlQyZkxpblRRU1ZIeDZDeWRMU3dTcDREOHlPd00zUEc5Zks5VklSRm05S2VY\\u000aaEd3dWxyMXBHVTAwTDU4QUVBb2ZxRmt6eEZneE0vRlRBTVZ1NWxCd29QNDYycSt6\\u000aM3pHQXkyemFTcndJKzdiWnd2OHVTMnpKOEtPajU4MHpKb2JOdU9YdC8vVHlMOGFV\\u000aZ1BtVFB2aTV3eDJGMHRVUGlzL0tUemZoZkR1NTExQXJOS2szZXIva1BrUTVmL1BC\\u000aTVBBSEpPQ3crLzh6NEVDdE9tL3g0UkliR3VIbDExNzdhQkh2WDc1TzloYnBaSkhV\\u000ac1ZlWGJOa3VUQjU2YWVoVkl3T3hHQitDeTR5eGZDb1JJRENXdy9oa1FVNjlZUUhL\\u000aQ1dhUXYydE16eVRkOXFsMFlRc3VBR0h3TDJTWTVKeDJ3RjZ6elMwRUVCMGtCU281\\u000aNlhYZmVwRGZnclVleUlzV2Rwc2hrQUQ2T1NsVDVaQTFHMWtpZHMzRUZiSFlxbmJh\\u000aVzFTZUtoc05QamVBcWErWE4zNnFYQ0NVclIrNlJDK01xTVc5a29XWjFqSzZqMkNq\\u000abHNWVjhkVGI5OXY4alVuSEgrbCtrbituaWo1MllRRzk3eCsrQkVMZ0FZVWQ5Ykxi\\u000aMmI3OWYwSnJYc2s4V1psajZ4Q0l4VXI5ZnZ0c05aa3NEWTI2NXl1VGtoNzE3Smho\\u000aaXFaUHowVi9HcGdVaHJDSmdhbVR1WEo1SmdMdEtJZ1Y4WFVQWXd5QWFUdGpvcGJT\\u000aSmx0MDVJVGtka25LVEZidjNxd28xNWllS1ZBUHhvNVVoZEN6a0xUZ1hyWStjMldo\\u000aOGd1R0JPbFlSVGVRbUlHK1Qram0zRGpyMHVLSEx1U2lmQ3JlMXdyaHp6dUF6MTd4\\u000aaXVkbFczR1I2UGVmbDZOdUt5WG1VU25LL1F6MXJNZVVjT2p1UzBmTkdlWVQ5bHNz\\u000adGt0Mm5TVVdKZnBaQzhZRGlPWDd2TUZSUFZOSXo2Vk9lbHJDS0hHMXlTc3Vkc2JP\\u000aVTRiMEg2KzVPVWphYlJuOSt2YnQ4T1BNbE9BVDBEcDJ1TnMxNlBSYjJPMGp6NWlo\\u000aL3FwYjVZMENnK0VlYWFPMGdxdXN0WGdDUHJPbktYM3JLcU4wUG5lMXpmYkZqVklJ\\u000abWk4NjcvRGUyYmt0RThtdTQrWTJIeUg1K3JUVnBkMlRxWExaOUhEaUFMaWZ5NjJL\\u000aWFVjQ3NEanJEMGhyWTdYZzdTNnVjSW00ejNqSDV0amtOczZxMEFqMnhscG5zbi9D\\u000aejVmd2FPUS93ZEpPSjB5aTVtanRjOFBRdnJ6UFhNQ0tIZU9hUGJmVHZ1SmFwOC9Z\\u000aVmpTNkw2NjNxNVVkaFlGcTJlblp5ek1LYUwvU0RmYVhyZzZrREw4d1podXZuRlJx\\u000aYmthVmp5S0FQYlFFUGhvdmJCYW5DajVwUGh1MHJoeFh4T05rbkhmaDhneGxudWlx\\u000aKzdzTmxoeXBSUXk2N3NNSVluMmdnS3dRL0ZCVlZ4SXBRNG5oMUw0ZldOS29MY0tX\\u000aZFBCSktHUUQxNCtPUXRXcVEydDRKYS9KVlpxZVlQRFJxSUtPNStEeUdLemRPK2Q4\\u000adTJhNUZkaUo5UG9SUmJqekszbnhYa1A1TTgvYytCWkdMK1lURmtVOGREZW83L3I1\\u000aeDVVOWk2TEhpT1FhMDZMWlpGQWttSEdMbjhtNVRPbllWbGhzdUVlZUdWU1hscVVh\\u000aV1dhSFppc3FrWVl6am1Cako5T3JsUU55aEhRR3Q1cXFNM0FTandMQitoQ3dwaXZH\\u000aRXZ0aStHdy9IbDZiQlpFa3FoaDlCUlh0TU0zT2d4Rm9kd25nTmpHSUpDak1xZGhk\\u000aTkFjNWpBQWlsUlJ5dWRQdFFsQ2tObHpCV3gyZjhCMDBDVmZQNkwvd1J6WFRFOEhR\\u000aK2JiL0F6SkhCYnM0YjR4M2o1ZnpOS1doOFJZc0x2VklmVkdBUjJEcjlJTUp5NkpP\\u000aTzIzdlRmbWVPcFBudmpvdlhkbTI3WlcrdzdGSElrdU1peENqckh3NTgvQjkvWUx4\\u000aVGRoSzlFY1dOcXMvclA0TEYvMEJVSS8xdVdsa05pdTBJNjk5UHRkWTdzQThNVUdO\\u000aT3VhTTYveGNZN25DMGRjVXRCcjBXSmoyZmRtYmlTM0Nld0VrT2c2L2tQQkNHVHVi\\u000adVNSdUVLYUNWNXRFZktlZEtERStIaTFuK3g0U3h6U09KanhYZUJTb2hEWTdlNVVu\\u000aN2ZRcHdvVEdiTUVHUjZJc0pOaUNzR0dSbkR6ajd0aDFSOE94ckVLRWx1dXQ0Ym9u\\u000aOEo5ejlxWGRVSUtlQ09va0dQNStrWW5BbHBrNWVQNzltM1gwS2dSUW9kSGN1N1pP\\u000aeTRBdm9GTXpYd0pFVDdzYnNaQVB4Z21VeXZFbDVRdzNBQzhBaXRybmFBWm40Sml6\\u000aZTdKSEtFdXpHczlBa0IyVG9hWXcwRE5zbWdzSncwWElTSzFsSzBUWjVDUTlPQ1VN\\u000aeHFZYWNPRTEwa3VTVUtQTUpoTHo5UHhrRDhnbE0vZEV2OWFLc2VqczFXMkF1VytU\\u000adldzM0crZ0cwRkNHajljeEJBa3VRSDZNb0tOMG96VWExUTBxcU9JRjRiRFZJZFFI\\u000aTHE1ODRvbTluU1IvV0ZIRHY1dWxSeTZteWpIMU0xUFB6azJ6K1drQW84TFhRaXpM\\u000aWjZmblFpTEZ6OFVzZGQvTzVIM2xCcUFUZUpvRzRVdTRCMjVuRjhOK2JabEdoM2d6\\u000aK2xTZG16YVlUR0oxWFZPNTdNR0hla0dyZjJRZndoeU1zZFlsZFpQZXBNQnB5YU5R\\u000aOXpvR3ZNQ0ZnYlR4c0JFRmN4aWM5TmdZUWNDVk5xcTBnS1F6SmtxUHZtV2o3WnpP\\u000aMWZJS3Rnb1FmZ1k4a2JSSFRPMGJIRXlsNm5EcldRR2RXbkQ4d2ErNGNLSnU2bkpH\\u000aWng2QWVGdXI5QzJsZzBWdWZGNGlqVGVrcWlEb3U2Y2x3czkzRHdWa2VPNmxsQzJm\\u000acUpUcm1zQy9DTC9oYzZuckZ0RERsV3Buc0Jkc29ydEtxN2lVTGF1ekRIRnA5MVI3\\u000aaTdCanBuMTNWcXlZMjVUVXlSWUovYlN0NWVGR0FINnpQZHE5RkhqTWhyeGZpTURC\\u000aK3NTRUxqd2FJR2ZxWDBQSG82UmZ1Ky9tOWlpRWwzRWxrSWJpYVMycmdFWHkxZFgr\\u000admdBZkYzOWQzWEFTdmI5aElrNXg0OGltcHRtaDBPaHgwWENOMThtNnpvQndKajNw\\u000acmNnK2ZNWHE0UzZMdlJjQTdtV0MwRzcrdVdXdi9GblkxYUg0a3NPcHRmeWkydU16\\u000aS3kwQTJFbWNad3YyZktYdmljcnQ0Ry9yWU1ZZnlic2loQS8rcXhReTlERmlEek9n\\u000aZXZzZTZ2NnFTUE5TY1lYLzlYRUxKMzh2dmpMTTNjZHlQNEJOMVF3UENtRmFrVm1K\\u000aRTNKRzU0RXhycHRUdGdKTERaNW5FYTY4Mjc4dnRJL3JVR3k2OFFuNTJyMHVXc0ZX\\u000abk5obFRPR2RxYzZzdjdNTGdTYkQ3RUVmNWNiVHNKV3JQZ1ZHbUQ1Q2o5Y3ZmRjlR\\u000aakMvM1RiSXFWVE5QSkhhbXpnbUJsSFJZSGJQN1p0a3ZUZDBnTkF2SXllZGY1MkdY\\u000aUzhESkQwTStrSS8xNmF4dm0zSlB4RC9BVHE1Ri9xdmtIWFRUVStCSEtUTWk2dnk1\\u000aMkNEUmh0YkQ1dVNNa1YyQmROK0c5Y0xnL3hTeTc3TjBnTEc4WDZ6ODM1cllYbE0r\\u000aaGloeGx2UWtiSHR0eE9EN3VBYnpFcExEaC95NFFtZVRSK1FaQU9QeUc3azhGdENG\\u000aam5TM0lLWkFTVldFTVVFODlGTG1hdFhMNERvaHlXWnViSDJPVXlGUHp5ZnNvNWNF\\u000aNEpLVnBIb21NVWZWcjk5bUZnVk1ESUdyUEdFcFRmU2NqZ01wRmlDaEFxU1djUWFH\\u000aU2cwdlBrRkdlWXFIek15SENqMndxc3VDV3BIZWlyU25ncHNXa1RLMjFLRG42TDVx\\u000aaENpRk5wM3JWNUJFMkwwcEhqQnZEVmFrZXdqcnF0a1puZ3FKcHhZalhyV0dxUjVP\\u000aV3IraWhxZ0VJZ011WGhkdUxqR2wrWVZkU1d5ZTlER05OS29DN2FlUGhJMTJQRmg3\\u000aSlJoZjdIYWVlQUNPaGZaTndDWitXMndRb3hCZHpwYzltVCtDVlpxOUo2NkNyTlFI\\u000adTBtaStlaVRTdXNEVHR2b3RmQi9IQ20wMXVaZmgxbE1JQWdMNXozSTFHRVcvREpX\\u000aMk8wdWZBKzVPV2pnWFlzOG9aUlRCMnhYOWhmSW81eDREVXNiTFM1ZzgvbFBUVndF\\u000aamYxQlg2dU9vaTVvV2lJWVJqQmpmSWdVTEVURnhMTGtBUnJQTzJETzU1ekJnMi9Q\\u000adE9mdG00SzFjeWI3V0h2QkdrcmRYanlQUXlYYzRJVXU0SzR0aTlPSlE1eVRmWUN0\\u000aY2o1OWMya05BNHlOWmdwd3kxVnAvSytGdHVlZ0xsd2l4ZTRwakR5ekNJSnBnU0ZD\\u000acmtxREV1K0hqOFZWNXMweFFXc1d5ZWdOUUpldVBheWVSY0RGMzBoMWc2WmZGQjNa\\u000adE9RWWpFQnFyVWVZNkJndk5OWU42TWFrUndnRDBja2NDbEoyMUhZNGpvU2twcE9Z\\u000aZ3NUeTNrR1laNHFUelJNY0lsQ0REaXQ4ZENHZm9Cb3JKQ2t5NTUvNDFiV3FtbTdt\\u000aTElRVzJBTG9kdktQbVVXeFhibzN5WGNnSTRKdnFjZlAzRVVXTytjV3VIZEFSN2VF\\u000aOTc3MytSVUV2TXROdnMzWWxqeERrTmFNNzZ0VjhqanhRcFJZNEc0RWRSaUs0MTN3\\u000aWUkyWTE3UWE2ZEs4K2FhaHRad0JtVWpBSVkvREdZa2VOY2wzWjdxaWpJMTMvUnpn\\u000aNXlWcjl4VUsvSUFGUVlhNDlXQ1RRYTlzVWYzeEgzZUYvTW9HN0ZmMTdrOC8xMURx\\u000aTE5YQzUvSGhOeDJ2S09CTmx1RXJodURjYjNMZmJ5TGlRVllEMkhYeGRyTkc5M1E0\\u000aNGJPajRWb0xZV0hndTI5UG9sL0htRHhUSDFwdHBQVmM5K0U0R2RwN21yVmF1bHU1\\u000acXhDOWliRzlKV3ljUUdkMUJuMG9RMjluSGlMcGd4K25HOFlkZHdPVWRkRzRndkpq\\u000aS21iUTl5aTAwYXdUamhOUE9GZXEvejVuVFJHQ3liSDZsWW9MVGtueE9UQiszMkpy\\u000aQ2pBbDVMRG90amtDZWtBUllwbVVxOWhSY2I3c3l0ME1RY1BBZUg0VlBHNmhFMUpN\\u000aYkxpTXdUWVdKNWtTM3F1elp1SkZQSUl4SFp3UmtJUzFjTnBjL0FtSUpwZm04RCtL\\u000aYUEvVmdoRkJpdnZzZnlUNndoNVRybENBcE9DcHNOTlNWbWRLRHF5QVBFTENuaURj\\u000adTRwcmpZRU5JU2tKdExUTVdBSzVCWWdRZ1ZQOVcrekJyMjNuSGlZVnhLWWhjdm9M\\u000aYTh6dUdLYlJtY2xpL3o0cXpmWnk5RGlJNmoxdWFUT1FMQzEvMzIwT2xBRGtSOVUy\\u000aT3hYZFVuSTFaSzFyY0hRZnllS3BsbUFsRTJDM3MzYkFkR3V5bXRKTDQ2M1dqZm9P\\u000aUkhHWWpvZnZNQTI0cHhnY3hFRnU5YVRFamdFVVBNeHBzN2Y4TVMyaVJvL3dxU3pX\\u000aZ0lwN1EvZHVYY1FQb0dSS2JrR0FySnNJVGdVT3BSQ3hxTFlXbk5UUy8xbmxCeXk3\\u000aQVBjcGRaRmk1WjRqM1IvbGJ0T2Era1ZiYmo4ZC8wazMwTnlDVjJGRVZGV2tPbG9z\\u000aNTFQNUNOUiswNUh6QkhQM3V3N3VyODRZYkRGdHd2UjhNM29UMXNtbXljYUsxMkpE\\u000aZGNBOUQ2YWErY2k5Wmh0UWNhbUw0Z1pjZmVpZllHNEt6NWsyT3lpMlpUNkZKOUV4\\u000aMHQ1T1d5MjZUSjllQmlCcGRaV25XZDB3bzZOMU5ST0xLdFY5L052d3R1WlZSRkxS\\u000aRUg1WGNLMnRMcTFWczFaVkg4MXM4R29UOUQ4VkFEaGFwVDBCU0xsR3A4TkNZdUdK\\u000aeXI1YVVwODdPZEl4RCt3S244NTRteVlKaXlVZnIwWmtGNGhoOEtkTXcvemg3RVQv\\u000aYkxIWlVxUXozdUV3QkcvODRuR1E9PTwveGVuYzpDaXBoZXJWYWx1ZT48L3hlbmM6\\u000aQ2lwaGVyRGF0YT48L3hlbmM6RW5jcnlwdGVkRGF0YT48eGVuYzpFbmNyeXB0ZWRL\\u000aZXkgeG1sbnM6eGVuYz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMj\\u000aIiBJZD0iX2E3NDBjZjA5MTViZDE1MmRiNzRkMDNjZDQ1NzUyMTM3Ij48eGVuYzpF\\u000abmNyeXB0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAw\\u000aMS8wNC94bWxlbmMjcnNhLW9hZXAtbWdmMXAiIHhtbG5zOnhlbmM9Imh0dHA6Ly93\\u000ad3cudzMub3JnLzIwMDEvMDQveG1sZW5jIyI+PGRzOkRpZ2VzdE1ldGhvZCB4bWxu\\u000aczpkcz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyIgQWxnb3Jp\\u000adGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjc2hhMSIvPjwv\\u000aeGVuYzpFbmNyeXB0aW9uTWV0aG9kPjxkczpLZXlJbmZvIHhtbG5zOmRzPSJodHRw\\u000aOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj48ZHM6WDUwOURhdGE+PGRz\\u000aOlg1MDlDZXJ0aWZpY2F0ZT5NSUlERlRDQ0FmMENCRlVCbkw0d0RRWUpLb1pJaHZj\\u000aTkFRRUxCUUF3VHpFTE1Ba0dBMVVFQmhNQ1FWUXhEVEFMQmdOVkJBY01CRWR5CllY\\u000ab3hEVEFMQmdOVkJBb01CRVZIU1ZveElqQWdCZ05WQkFNTUdVMVBRUzFKUkNCSlJG\\u000aQWdLRlJsYzNRdFZtVnljMmx2Ymlrd0hoY04KTVRVd016RXlNVFF3TXpReVdoY05N\\u000aVGN4TWpBMU1UUXdNelF5V2pCUE1Rc3dDUVlEVlFRR0V3SkJWREVOTUFzR0ExVUVC\\u000ad3dFUjNKaAplakVOTUFzR0ExVUVDZ3dFUlVkSldqRWlNQ0FHQTFVRUF3d1pUVTlC\\u000aTFVsRUlFbEVVQ0FvVkdWemRDMVdaWEp6YVc5dUtUQ0NBU0l3CkRRWUpLb1pJaHZj\\u000aTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFJSnYwcWU5VWR2RllTTDVJMDJHb2t3\\u000aRVZmc0lHYzdJN0VoVk5PeFkKOW10VWVubWhxTnJMc0xCRmcxSWlQYmswSVNXaE9S\\u000ad1B5VnAvUDMrR3lHUDMzOXFaNjhVQ0dWMzYxRTBRbTdjalBlL08zK3IzSEFNMgpa\\u000aQk44b0Fab0htcGhyTlM2ZktmWTU4a3lndHJVYStaeU16WVdUVGlTMzJTQ004SDU1\\u000aYmx1RUZiZVprc25iUDBZOTRJamtmSmRndnpsCk14enJsU3lvVjJ5bVdCanZTNXdl\\u000abERIZ2JDS3lqc2pJaFRSakp1L29sR0p5ZW4wMS9FcElWdFN5RFhPLzJJUzJ2Mk85\\u000aVWlGd0FveUIKWUFqUG5sM0h4SzJBNTc3blI2M014bGdQMC9zK3I4NHVCcU9BbGI0\\u000acW5icFU3bHU1R3hsQ1BrWm1wUm9vQ1FZVVJpb0Mrd2pTNmxNQwpBd0VBQVRBTkJn\\u000aa3Foa2lHOXcwQkFRc0ZBQU9DQVFFQUJxTzdra3EvZ1JhaEF2cHNRZzVMTFpST0dG\\u000acjlwSVByeU45eG1KR2dQbzdqCktObDdyczdnTlMwbG11bHVZV1duSmN3QVBid0Zl\\u000aYjk1NFZNQjl4OXA5UUV3NVJuWGFtVVk5cWEwTGdjUy90L1dYNnZKa1pQTmhXcGgK\\u000aOGJYd2gwTXZsc2JmcnZEVEpyOGNqSDNxZnhJVHA3cGEzeGIxcUU3c3VSZmZWVWRE\\u000aWGF3aVhYbldKL1dKcit0d1ZWSEhFcW5aejFsQQpyU0RMeE04c0NqRzhEZUp3OHZu\\u000aUXk1bVBHckdWVEJiYTR1cGM4VVRZMW5QVjlVMkdCSlZZdUFrb1ZSamJUbE52ckw1\\u000aSnFOcXlwS2NHCmJlampXeGdyelprZVFlVTJoRmNqdW5tZ3dHWit1ZzJmcTRrS2tR\\u000aZnR3Y3FlSlR6eXpCb28yK09vNFRtZmJzaC9vbnhQV0E9PTwvZHM6WDUwOUNlcnRp\\u000aZmljYXRlPjwvZHM6WDUwOURhdGE+PC9kczpLZXlJbmZvPjx4ZW5jOkNpcGhlckRh\\u000adGEgeG1sbnM6eGVuYz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMj\\u000aIj48eGVuYzpDaXBoZXJWYWx1ZT5Sb1NHTGFDbDN3ZkRXdDlXMm9JSDNUQ3JPTVN4\\u000aL3Y1S0pQV2hndmhWNml2RmZXSWFJeDB5RnV2NVZTME5VZ2FUVGIwVjhUYnNGN1Vz\\u000aRllzQ0xldkVUa2lWbG5OeWE4dlVoL2lYTDYzT0JmdzR3T3pSNVZheVBuaWFwWFdM\\u000aa0RHTmQ5Y3E2QU8zR1JoTWJaZDdma2NhRWNJVTB2bGtZeUJJNmE0Yms4bHM3Mm0v\\u000aZkxKQS8vaWl5L2piODkzQkZ4dk9EMk5hT1pabXhzSlI4YlFmWWpBMHdXa1pBcW56\\u000aN0EzY3lhcHV3aXVTc01wc1hYSnFjVXp2TS9GS090dE1wTnhSUVprdk1RZlNnMCtM\\u000aUVM5M0IxN0ZUZFE2OHNRL3dZQmhubFBEZXFZK0NnY1VjeVYzOVdjTjAwcUtVYmNQ\\u000aM2kzSWRWUVRkcEJQUTdRS01HR2JmS1Y0RlE9PTwveGVuYzpDaXBoZXJWYWx1ZT48\\u000aL3hlbmM6Q2lwaGVyRGF0YT48eGVuYzpSZWZlcmVuY2VMaXN0Pjx4ZW5jOkRhdGFS\\u000aZWZlcmVuY2UgVVJJPSIjXzNmZDM1ODkyZTlhOGVhY2I4ZTA4ZjI4MGE4M2ZjYjc0\\u000aIi8+PC94ZW5jOlJlZmVyZW5jZUxpc3Q+PC94ZW5jOkVuY3J5cHRlZEtleT48L3Nh\\u000abWwyOkVuY3J5cHRlZEFzc2VydGlvbj48L3NhbWwycDpSZXNwb25zZT4=\",\"dateTimeCreated\":\"2015-10-09T10:36:02.075Z\",\"id\":1}}}";
+//		
+//		try {
+//			java.util.Map test1 = new ObjectMapper().readValue(json, java.util.Map.class);
+//			
+//		    JsonParser parser = new JsonParser();
+//		    JsonObject reveivedSession = null;
+//		    reveivedSession = (JsonObject) parser.parse(json);
+//
+//		    
+//		    
+//		    JsonObject test = reveivedSession.get("data").getAsJsonObject();
+//		    JsonObject test2 = test.get("session").getAsJsonObject();
+//		    JsonElement validTo = test2.get("validTo");
+//		    JsonElement entityID = test2.get("entityID");
+//		    JsonElement sessionBlob = test2.get("sessionBlob");
+
+		
+		
+		
+		JsonObject responseMsg = new JsonObject();
+		responseMsg.addProperty(
+    			SSOTransferConstants.SSOCONTAINER_KEY_STATUS, 
+    			"OK");
+		
+		
+		JsonObject levelTwo = new JsonObject();
+		levelTwo.addProperty("test", "12345");
+		
+		responseMsg.add("levelTwo", levelTwo );
+		
+		
+		System.out.println(responseMsg.toString());
+			
+//		} catch (IOException e) {
+//			// TODO Auto-generated catch block
+//			e.printStackTrace();
+//		}		
+		
+
+	    	    
+	}
+
+}
diff --git a/id/server/modules/moa-id-modules-federated_authentication/pom.xml b/id/server/modules/moa-id-modules-federated_authentication/pom.xml
new file mode 100644
index 000000000..7e8ac86af
--- /dev/null
+++ b/id/server/modules/moa-id-modules-federated_authentication/pom.xml
@@ -0,0 +1,24 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>MOA.id.server.modules</groupId>
+    <artifactId>moa-id-modules</artifactId>
+    <version>${moa-id-version}</version>
+  </parent>
+  <artifactId>moa-id-modules-federated_authentication</artifactId>
+  <description>PVP2 ServiceProvider implementation for federated authentication</description>
+  
+  <name>MOA ID-Module Federated-Authentication</name>
+
+	<properties>
+		<repositoryPath>${basedir}/../../../../repository</repositoryPath>
+	</properties>
+  
+  	<dependencies>
+  	  	<dependency>
+  					<groupId>MOA.id.server</groupId>
+  					<artifactId>moa-id-lib</artifactId>
+  			</dependency>
+  	</dependencies>
+  
+</project>
\ No newline at end of file
diff --git a/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/FederatedAuthConstants.java b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/FederatedAuthConstants.java
new file mode 100644
index 000000000..1f7f27617
--- /dev/null
+++ b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/FederatedAuthConstants.java
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.federatedauth;
+
+/**
+ * @author tlenz
+ *
+ */
+public class FederatedAuthConstants {
+
+	public static final String MODULE_NAME_FOR_LOGGING = "federated IDP";
+	
+	public static final int METADATA_VALIDUNTIL_IN_HOURS = 24; 
+	
+	public static final String ENDPOINT_POST = "/sp/federated/post";
+	public static final String ENDPOINT_REDIRECT = "/sp/federated/redirect";
+	public static final String ENDPOINT_METADATA = "/sp/federated/metadata";
+
+	public static final String CONFIG_PROPS_PREFIX = "modules.federatedAuth.";	
+	public static final String CONFIG_PROPS_KEYSTORE = CONFIG_PROPS_PREFIX + "keystore.path";
+	public static final String CONFIG_PROPS_KEYSTOREPASSWORD = CONFIG_PROPS_PREFIX + "keystore.password";
+	public static final String CONFIG_PROPS_SIGN_METADATA_KEY_PASSWORD = CONFIG_PROPS_PREFIX + "metadata.sign.password";
+	public static final String CONFIG_PROPS_SIGN_METADATA_ALIAS_PASSWORD = CONFIG_PROPS_PREFIX + "metadata.sign.alias";
+	public static final String CONFIG_PROPS_SIGN_SIGNING_KEY_PASSWORD = CONFIG_PROPS_PREFIX + "request.sign.password";
+	public static final String CONFIG_PROPS_SIGN_SIGNING_ALIAS_PASSWORD = CONFIG_PROPS_PREFIX + "request.sign.alias";
+	public static final String CONFIG_PROPS_ENCRYPTION_KEY_PASSWORD = CONFIG_PROPS_PREFIX + "response.encryption.password";
+	public static final String CONFIG_PROPS_ENCRYPTION_ALIAS_PASSWORD = CONFIG_PROPS_PREFIX + "response.encryption.alias";
+	
+	public static final String CONFIG_DEFAULT_QAA_STORK_LEVEL = "http://www.stork.gov.eu/1.0/citizenQAALevel/4";
+	public static final String CONFIG_DEFAULT_QAA_SECCLASS_LEVEL = "http://www.ref.gv.at/ns/names/agiz/pvp/secclass/0-3";
+	
+}
diff --git a/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/FederatedAuthenticationModuleImpl.java b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/FederatedAuthenticationModuleImpl.java
new file mode 100644
index 000000000..49275c6eb
--- /dev/null
+++ b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/FederatedAuthenticationModuleImpl.java
@@ -0,0 +1,68 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.federatedauth;
+
+import at.gv.egovernment.moa.id.auth.modules.AuthModule;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+
+/**
+ * @author tlenz
+ *
+ */
+public class FederatedAuthenticationModuleImpl implements AuthModule {
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.AuthModule#getPriority()
+	 */
+	@Override
+	public int getPriority() {
+		// TODO Auto-generated method stub
+		return 0;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.AuthModule#selectProcess(at.gv.egovernment.moa.id.process.api.ExecutionContext)
+	 */
+	@Override
+	public String selectProcess(ExecutionContext context) {
+		//select interfederation authentication if PERFORM_INTERFEDERATION_AUTH flag is set
+		Object performfedAuthObj = context.get(MOAIDAuthConstants.PROCESSCONTEXT_PERFORM_INTERFEDERATION_AUTH);
+		if (performfedAuthObj != null && performfedAuthObj instanceof Boolean) {
+			if ((boolean) performfedAuthObj)
+				return "SSOfederationAuthentication";
+			
+		}
+		
+		return null;		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.AuthModule#getProcessDefinitions()
+	 */
+	@Override
+	public String[] getProcessDefinitions() {
+		return new String[] { "classpath:at/gv/egovernment/moa/id/auth/modules/federatedauth/federated.Authentication.process.xml" };
+	}
+
+}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKTitleAttributBuilder.java b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/FederatedAuthenticationSpringResourceProvider.java
index 107386b5a..91d56ebed 100644
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKTitleAttributBuilder.java
+++ b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/FederatedAuthenticationSpringResourceProvider.java
@@ -1,4 +1,4 @@
-/*******************************************************************************
+/*
  * Copyright 2014 Federal Chancellery Austria
  * MOA-ID has been developed in a cooperation between BRZ, the Federal
  * Chancellery Austria - ICT staff unit, and Graz University of Technology.
@@ -19,31 +19,45 @@
  * file for details on the various modules and licenses.
  * The "NOTICE" text file is part of the distribution. Any derivative works
  * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.builder.attributes;
+ */
+package at.gv.egovernment.moa.id.auth.modules.federatedauth;
 
-import at.gv.egovernment.moa.id.auth.stork.STORKConstants;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
 
-public class STORKTitleAttributBuilder implements IPVPAttributeBuilder  {
+import at.gv.egiz.components.spring.api.SpringResourceProvider;
 
-	public String getName() {
-		return STORKConstants.TITLE_NAME;
-	}
+/**
+ * @author tlenz
+ *
+ */
+public class FederatedAuthenticationSpringResourceProvider implements SpringResourceProvider {
 
-	public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
-			IAttributeGenerator<ATT> g) throws AttributeException {
+	/* (non-Javadoc)
+	 * @see at.gv.egiz.components.spring.api.SpringResourceProvider#getResourcesToLoad()
+	 */
+	@Override
+	public Resource[] getResourcesToLoad() {
+		ClassPathResource federationAuthConfig = new ClassPathResource("/moaid_federated_auth.beans.xml", FederatedAuthenticationSpringResourceProvider.class);					
 		
-		return g.buildStringAttribute(STORKConstants.TITLE_FRIENDLYNAME, STORKConstants.TITLE_NAME, 
-				STORKAttributHelper.getAttribut(STORKConstants.TITLE_NAME, authData)); 
-					
+		return new Resource[] {federationAuthConfig};
 	}
 
-	public <ATT> ATT buildEmpty(IAttributeGenerator<ATT> g) {
-		return g.buildEmptyAttribute(STORKConstants.TITLE_FRIENDLYNAME, STORKConstants.TITLE_NAME);
+	/* (non-Javadoc)
+	 * @see at.gv.egiz.components.spring.api.SpringResourceProvider#getPackagesToScan()
+	 */
+	@Override
+	public String[] getPackagesToScan() {
+		// TODO Auto-generated method stub
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egiz.components.spring.api.SpringResourceProvider#getName()
+	 */
+	@Override
+	public String getName() {
+		return "MOA-ID Auth-module 'SSO Interfederation'";
 	}
 
 }
diff --git a/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/config/FederatedAuthMetadataConfiguration.java b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/config/FederatedAuthMetadataConfiguration.java
new file mode 100644
index 000000000..c3d5e8032
--- /dev/null
+++ b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/config/FederatedAuthMetadataConfiguration.java
@@ -0,0 +1,307 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.federatedauth.config;
+
+import java.util.Arrays;
+import java.util.List;
+
+import org.opensaml.saml2.core.Attribute;
+import org.opensaml.saml2.core.NameIDType;
+import org.opensaml.saml2.metadata.ContactPerson;
+import org.opensaml.saml2.metadata.Organization;
+import org.opensaml.saml2.metadata.RequestedAttribute;
+import org.opensaml.xml.security.credential.Credential;
+
+import at.gv.egovernment.moa.id.auth.modules.federatedauth.FederatedAuthConstants;
+import at.gv.egovernment.moa.id.auth.modules.federatedauth.utils.FederatedAuthCredentialProvider;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPMetadataBuilderConfiguration;
+import at.gv.egovernment.moa.id.protocols.pvp2x.config.PVPConfiguration;
+import at.gv.egovernment.moa.id.protocols.pvp2x.signer.CredentialsNotAvailableException;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+public class FederatedAuthMetadataConfiguration implements IPVPMetadataBuilderConfiguration {
+
+	
+	private static final int VALIDUNTIL_IN_HOURS = 24;
+	
+	private String authURL;
+	private FederatedAuthCredentialProvider credentialProvider;
+	
+	public FederatedAuthMetadataConfiguration(String authURL, FederatedAuthCredentialProvider credentialProvider) {
+		this.authURL = authURL;
+		this.credentialProvider = credentialProvider;
+				
+	}
+	
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getMetadataValidUntil()
+	 */
+	@Override
+	public int getMetadataValidUntil() {
+		return FederatedAuthConstants.METADATA_VALIDUNTIL_IN_HOURS;
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#buildEntitiesDescriptorAsRootElement()
+	 */
+	@Override
+	public boolean buildEntitiesDescriptorAsRootElement() {
+		return false;
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#buildIDPSSODescriptor()
+	 */
+	@Override
+	public boolean buildIDPSSODescriptor() {
+		return false;
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#buildSPSSODescriptor()
+	 */
+	@Override
+	public boolean buildSPSSODescriptor() {
+		return true;
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getEntityIDPostfix()
+	 */
+	@Override
+	public String getEntityID() {
+		return authURL + FederatedAuthConstants.ENDPOINT_METADATA;
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getEntityFriendlyName()
+	 */
+	@Override
+	public String getEntityFriendlyName() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getContactPersonInformation()
+	 */
+	@Override
+	public List<ContactPerson> getContactPersonInformation() {
+		try {
+			return PVPConfiguration.getInstance().getIDPContacts();
+			
+		} catch (ConfigurationException e) {
+			Logger.warn("Can not load Metadata entry: Contect Person", e);
+			return null;
+			
+		}
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getOrgansiationInformation()
+	 */
+	@Override
+	public Organization getOrgansiationInformation() {
+		try {
+			return PVPConfiguration.getInstance().getIDPOrganisation();
+			
+		} catch (ConfigurationException e) {
+			Logger.warn("Can not load Metadata entry: Organisation", e);
+			return null;
+			
+		}
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getMetadataSigningCredentials()
+	 */
+	@Override
+	public Credential getMetadataSigningCredentials() throws CredentialsNotAvailableException {
+		return credentialProvider.getIDPMetaDataSigningCredential();
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getRequestorResponseSigningCredentials()
+	 */
+	@Override
+	public Credential getRequestorResponseSigningCredentials() throws CredentialsNotAvailableException {
+		return credentialProvider.getIDPAssertionSigningCredential();
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getEncryptionCredentials()
+	 */
+	@Override
+	public Credential getEncryptionCredentials() throws CredentialsNotAvailableException {
+		return credentialProvider.getIDPAssertionEncryptionCredential();
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getIDPWebSSOPostBindingURL()
+	 */
+	@Override
+	public String getIDPWebSSOPostBindingURL() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getIDPWebSSORedirectBindingURL()
+	 */
+	@Override
+	public String getIDPWebSSORedirectBindingURL() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getIDPSLOPostBindingURL()
+	 */
+	@Override
+	public String getIDPSLOPostBindingURL() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getIDPSLORedirectBindingURL()
+	 */
+	@Override
+	public String getIDPSLORedirectBindingURL() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getSPAssertionConsumerServicePostBindingURL()
+	 */
+	@Override
+	public String getSPAssertionConsumerServicePostBindingURL() {
+		return authURL + FederatedAuthConstants.ENDPOINT_POST;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getSPAssertionConsumerServiceRedirectBindingURL()
+	 */
+	@Override
+	public String getSPAssertionConsumerServiceRedirectBindingURL() {
+		return authURL + FederatedAuthConstants.ENDPOINT_REDIRECT;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getSPSLOPostBindingURL()
+	 */
+	@Override
+	public String getSPSLOPostBindingURL() {
+		return authURL + FederatedAuthConstants.ENDPOINT_POST;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getSPSLORedirectBindingURL()
+	 */
+	@Override
+	public String getSPSLORedirectBindingURL() {
+		return authURL + FederatedAuthConstants.ENDPOINT_REDIRECT;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getSPSLOSOAPBindingURL()
+	 */
+	@Override
+	public String getSPSLOSOAPBindingURL() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getIDPPossibleAttributes()
+	 */
+	@Override
+	public List<Attribute> getIDPPossibleAttributes() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getIDPPossibleNameITTypes()
+	 */
+	@Override
+	public List<String> getIDPPossibleNameITTypes() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getSPRequiredAttributes()
+	 */
+	@Override
+	public List<RequestedAttribute> getSPRequiredAttributes() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.builder.AbstractPVPMetadataBuilder#getSPAllowedNameITTypes()
+	 */
+	@Override
+	public List<String> getSPAllowedNameITTypes() {
+		return Arrays.asList(NameIDType.PERSISTENT, 
+							 NameIDType.TRANSIENT,
+							 NameIDType.UNSPECIFIED);
+		
+	}
+
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPMetadataBuilderConfiguration#getSPNameForLogging()
+	 */
+	@Override
+	public String getSPNameForLogging() {
+		return FederatedAuthConstants.MODULE_NAME_FOR_LOGGING;
+	}
+
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPMetadataBuilderConfiguration#wantAssertionSigned()
+	 */
+	@Override
+	public boolean wantAssertionSigned() {
+		return false;
+	}
+
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPMetadataBuilderConfiguration#wantAuthnRequestSigned()
+	 */
+	@Override
+	public boolean wantAuthnRequestSigned() {
+		return true;
+	}
+
+}
diff --git a/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/config/FederatedAuthnRequestBuilderConfiguration.java b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/config/FederatedAuthnRequestBuilderConfiguration.java
new file mode 100644
index 000000000..000590923
--- /dev/null
+++ b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/config/FederatedAuthnRequestBuilderConfiguration.java
@@ -0,0 +1,211 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.federatedauth.config;
+
+import org.opensaml.saml2.core.AuthnContextComparisonTypeEnumeration;
+import org.opensaml.saml2.core.NameID;
+import org.opensaml.saml2.metadata.EntityDescriptor;
+import org.opensaml.xml.security.credential.Credential;
+import org.w3c.dom.Element;
+
+import at.gv.egovernment.moa.id.auth.modules.federatedauth.FederatedAuthConstants;
+import at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation;
+
+/**
+ * @author tlenz
+ *
+ */
+public class FederatedAuthnRequestBuilderConfiguration implements IPVPAuthnRequestBuilderConfiguruation {
+
+	private boolean isPassive;
+	private String SPEntityID;
+	private String QAA_Level;
+	private EntityDescriptor idpEntity;
+	private Credential signCred;
+	
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#isPassivRequest()
+	 */
+	@Override
+	public Boolean isPassivRequest() {
+		return this.isPassive;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getAssertionConsumerServiceId()
+	 */
+	@Override
+	public Integer getAssertionConsumerServiceId() {
+		return 0;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getEntityID()
+	 */
+	@Override
+	public String getSPEntityID() {
+		return this.SPEntityID;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getNameIDPolicy()
+	 */
+	@Override
+	public String getNameIDPolicyFormat() {
+		return NameID.TRANSIENT;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getNameIDPolicy()
+	 */
+	@Override
+	public boolean getNameIDPolicyAllowCreation() {
+		return true;
+	}
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getAuthnContextClassRef()
+	 */
+	@Override
+	public String getAuthnContextClassRef() {
+		return this.QAA_Level;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getAuthnContextComparison()
+	 */
+	@Override
+	public AuthnContextComparisonTypeEnumeration getAuthnContextComparison() {
+		return AuthnContextComparisonTypeEnumeration.MINIMUM;
+	}
+
+	/**
+	 * @param isPassive the isPassive to set
+	 */
+	public void setPassive(boolean isPassive) {
+		this.isPassive = isPassive;
+	}
+
+	/**
+	 * @param sPEntityID the sPEntityID to set
+	 */
+	public void setSPEntityID(String sPEntityID) {
+		SPEntityID = sPEntityID;
+	}
+
+	/**
+	 * @param qAA_Level the qAA_Level to set
+	 */
+	public void setQAA_Level(String qAA_Level) {
+		QAA_Level = qAA_Level;
+	}
+
+	/**
+	 * @param idpEntity the idpEntity to set
+	 */
+	public void setIdpEntity(EntityDescriptor idpEntity) {
+		this.idpEntity = idpEntity;
+	}
+
+	/**
+	 * @param signCred the signCred to set
+	 */
+	public void setSignCred(Credential signCred) {
+		this.signCred = signCred;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getAuthnRequestSigningCredential()
+	 */
+	@Override
+	public Credential getAuthnRequestSigningCredential() {
+		return this.signCred;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getIDPEntityDescriptor()
+	 */
+	@Override
+	public EntityDescriptor getIDPEntityDescriptor() {
+		return this.idpEntity;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getSubjectNameID()
+	 */
+	@Override
+	public String getSubjectNameID() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getSPNameForLogging()
+	 */
+	@Override
+	public String getSPNameForLogging() {
+		return FederatedAuthConstants.MODULE_NAME_FOR_LOGGING;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getSubjectNameIDFormat()
+	 */
+	@Override
+	public String getSubjectNameIDFormat() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getRequestID()
+	 */
+	@Override
+	public String getRequestID() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getSubjectNameIDQualifier()
+	 */
+	@Override
+	public String getSubjectNameIDQualifier() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getSubjectConformationMethode()
+	 */
+	@Override
+	public String getSubjectConformationMethode() {
+		return null;
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPAuthnRequestBuilderConfiguruation#getSubjectConformationDate()
+	 */
+	@Override
+	public Element getSubjectConformationDate() {
+		return null;
+	}
+
+	
+}
diff --git a/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/controller/FederatedAuthMetadataController.java b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/controller/FederatedAuthMetadataController.java
new file mode 100644
index 000000000..98240a636
--- /dev/null
+++ b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/controller/FederatedAuthMetadataController.java
@@ -0,0 +1,97 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.federatedauth.controller;
+
+import java.io.IOException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+import at.gv.egovernment.moa.id.auth.modules.federatedauth.FederatedAuthConstants;
+import at.gv.egovernment.moa.id.auth.modules.federatedauth.config.FederatedAuthMetadataConfiguration;
+import at.gv.egovernment.moa.id.auth.modules.federatedauth.utils.FederatedAuthCredentialProvider;
+import at.gv.egovernment.moa.id.auth.servlet.AbstractController;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.protocols.pvp2x.builder.PVPMetadataBuilder;
+import at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPMetadataBuilderConfiguration;
+import at.gv.egovernment.moa.id.util.HTTPUtils;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+@Controller
+public class FederatedAuthMetadataController extends AbstractController {
+	
+	@Autowired PVPMetadataBuilder metadatabuilder;
+	@Autowired AuthConfiguration authConfig;
+	@Autowired FederatedAuthCredentialProvider credentialProvider; 
+	
+	public FederatedAuthMetadataController() {
+		super();
+		Logger.debug("Registering servlet " + getClass().getName() 
+				+ " with mappings '" + FederatedAuthConstants.ENDPOINT_METADATA 
+				+ "'.");
+		
+	}
+	
+	@RequestMapping(value = "/sp/federated/metadata", 
+					method = {RequestMethod.GET})
+	public void getSPMetadata(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+		//check PublicURL prefix
+		try {
+			String authURL = HTTPUtils.extractAuthURLFromRequest(req);		
+			if (!authConfig.getPublicURLPrefix().contains(authURL)) {		
+				resp.sendError(HttpServletResponse.SC_FORBIDDEN, "No valid request URL");
+				return;
+				
+			} else {
+				//initialize metadata builder configuration
+				IPVPMetadataBuilderConfiguration metadataConfig = 
+						new FederatedAuthMetadataConfiguration(authURL, credentialProvider);
+				
+				//build metadata
+				String xmlMetadata = metadatabuilder.buildPVPMetadata(metadataConfig);
+				
+				//write response
+				resp.setContentType("text/xml");
+				resp.getOutputStream().write(xmlMetadata.getBytes("UTF-8"));
+				resp.getOutputStream().close();
+
+			}
+			
+		} catch (Exception e) {
+			Logger.warn("Build federated-authentication PVP metadata FAILED.", e);
+			handleErrorNoRedirect(e, req, resp, false);
+			
+		}
+		
+	}
+		
+}
diff --git a/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/controller/FederatedAuthSignalController.java b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/controller/FederatedAuthSignalController.java
new file mode 100644
index 000000000..431ed5ef1
--- /dev/null
+++ b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/controller/FederatedAuthSignalController.java
@@ -0,0 +1,67 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.federatedauth.controller;
+
+import java.io.IOException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.commons.lang3.StringEscapeUtils;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+import at.gv.egovernment.moa.id.auth.modules.federatedauth.FederatedAuthConstants;
+import at.gv.egovernment.moa.id.auth.servlet.AbstractProcessEngineSignalController;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+@Controller
+public class FederatedAuthSignalController extends AbstractProcessEngineSignalController {
+
+	public FederatedAuthSignalController() {
+		super();
+		Logger.debug("Registering servlet " + getClass().getName() 
+				+ " with mappings '" + FederatedAuthConstants.ENDPOINT_POST 
+				+ "' and '" + FederatedAuthConstants.ENDPOINT_REDIRECT + "'.");
+		
+	}
+	
+	@RequestMapping(value = {	"/sp/federated/post", 
+			 					"/sp/federated/redirect"
+							}, 
+					method = {RequestMethod.POST, RequestMethod.GET})
+	public void performCitizenCardAuthentication(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+		signalProcessManagement(req, resp);
+		
+	}
+	
+	public String getPendingRequestId(HttpServletRequest request) {
+		return StringEscapeUtils.escapeHtml4(request.getParameter("RelayState"));
+		
+	}
+}
diff --git a/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/tasks/CreateAuthnRequestTask.java b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/tasks/CreateAuthnRequestTask.java
new file mode 100644
index 000000000..d581e7e75
--- /dev/null
+++ b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/tasks/CreateAuthnRequestTask.java
@@ -0,0 +1,219 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.federatedauth.tasks;
+
+import java.lang.reflect.InvocationTargetException;
+import java.security.NoSuchAlgorithmException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.opensaml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml2.metadata.provider.MetadataProviderException;
+import org.opensaml.ws.message.encoder.MessageEncodingException;
+import org.opensaml.xml.security.SecurityException;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
+import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
+import at.gv.egovernment.moa.id.auth.modules.federatedauth.FederatedAuthConstants;
+import at.gv.egovernment.moa.id.auth.modules.federatedauth.config.FederatedAuthnRequestBuilderConfiguration;
+import at.gv.egovernment.moa.id.auth.modules.federatedauth.utils.FederatedAuthCredentialProvider;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.moduls.RequestImpl;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
+import at.gv.egovernment.moa.id.protocols.pvp2x.builder.PVPAuthnRequestBuilder;
+import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.AuthnRequestBuildException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.metadata.MOAMetadataProvider;
+import at.gv.egovernment.moa.id.util.PVPtoSTORKMapper;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.MiscUtil;
+
+/**
+ * @author tlenz
+ *
+ */
+@Component("CreateFederatedAuthnRequestTask")
+public class CreateAuthnRequestTask extends AbstractAuthServletTask {
+
+	@Autowired PVPAuthnRequestBuilder authnReqBuilder;
+	@Autowired FederatedAuthCredentialProvider credential;
+	
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask#execute(at.gv.egovernment.moa.id.process.api.ExecutionContext, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
+	 */
+	@Override
+	public void execute(ExecutionContext executionContext, HttpServletRequest request, HttpServletResponse response)
+			throws TaskExecutionException {
+		try{
+			// get IDP entityID
+			String idpEntityID = pendingReq.getGenericData(RequestImpl.DATAID_INTERFEDERATIOIDP_URL, String.class);
+					
+			if (MiscUtil.isEmpty(idpEntityID)) {
+				Logger.info("Interfederation not possible -> not inderfederation IDP EntityID found!");
+				throw new TaskExecutionException(pendingReq, "Interfederation not possible", new MOAIDException("No inderfederation-IDP EntityID found.", null));
+				
+			}
+			
+			//load IDP configuration from MOA-ID Configuration
+			IOAAuthParameters idpConfig = authConfig.getOnlineApplicationParameter(idpEntityID);
+			//validate IDP
+			if (!idpConfig.isInderfederationIDP() || !idpConfig.isInboundSSOInterfederationAllowed()) {
+				Logger.info("Requested interfederation IDP " + idpEntityID + " is not valid for interfederation.");
+				Logger.debug("isInderfederationIDP:" + String.valueOf(idpConfig.isInderfederationIDP())
+					+ " isInboundSSOAllowed:" + String.valueOf(idpConfig.isInboundSSOInterfederationAllowed()));
+			
+				handleAuthnRequestBuildProblem(executionContext, idpConfig, "sp.pvp2.01", new Object[]{FederatedAuthConstants.MODULE_NAME_FOR_LOGGING, idpEntityID}); 
+		
+				return;
+				
+			}
+			
+			//load IDP SAML2 entitydescriptor
+			EntityDescriptor idpEntity = MOAMetadataProvider.getInstance().
+					getEntityDescriptor(idpEntityID);			
+			if (idpEntity == null) {
+				Logger.warn("Requested IDP " + idpEntityID 
+						+ " has no valid metadata or metadata is not found");
+				
+				handleAuthnRequestBuildProblem(executionContext, idpConfig, "sp.pvp2.02", new Object[]{FederatedAuthConstants.MODULE_NAME_FOR_LOGGING, idpEntityID});		
+				return;
+				
+			}
+			
+			//setup AuthnRequestBuilder configuration
+			FederatedAuthnRequestBuilderConfiguration authnReqConfig = new FederatedAuthnRequestBuilderConfiguration();
+			authnReqConfig.setIdpEntity(idpEntity);
+			authnReqConfig.setPassive(idpConfig.isPassivRequestUsedForInterfederation());
+			authnReqConfig.setSignCred(credential.getIDPAssertionSigningCredential());
+			authnReqConfig.setSPEntityID(pendingReq.getAuthURL() + FederatedAuthConstants.ENDPOINT_METADATA);			
+			authnReqConfig.setQAA_Level(evaluateRequiredQAALevel());
+						
+			//build and transmit AuthnRequest
+			authnReqBuilder.buildAuthnRequest(pendingReq, authnReqConfig , response);
+			
+		} catch (MOAIDException | MetadataProviderException e) {
+			throw new TaskExecutionException(pendingReq, "Build PVP2.1 AuthnRequest for SSO inderfederation FAILED.", e);
+
+		} catch (MessageEncodingException | NoSuchAlgorithmException  | SecurityException e) {
+			Logger.error("Build PVP2.1 AuthnRequest for SSO inderfederation FAILED", e);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
+			
+		} catch (Exception e) {
+			Logger.error("Build PVP2.1 AuthnRequest for SSO inderfederation FAILED", e);
+			throw new TaskExecutionException(pendingReq, e.getMessage(), e);
+			
+		}
+	}
+	
+	/**
+	 * @param executionContext
+	 * @param idpConfig
+	 * @param message 
+	 * @param objects 
+	 * @throws AuthnRequestBuildException 
+	 */
+	private void handleAuthnRequestBuildProblem(ExecutionContext executionContext, IOAAuthParameters idpConfig, String msgCode, Object[] objects) throws AuthnRequestBuildException {
+
+		if (idpConfig.isPerformLocalAuthenticationOnInterfederationError()) {
+			Logger.info("Switch to local authentication on this IDP ... ");
+		
+			executionContext.put(MOAIDAuthConstants.PROCESSCONTEXT_REQUIRELOCALAUTHENTICATION, true);
+			executionContext.put(MOAIDAuthConstants.PROCESSCONTEXT_PERFORM_BKUSELECTION, true);
+		
+			executionContext.remove(MOAIDAuthConstants.PROCESSCONTEXT_PERFORM_INTERFEDERATION_AUTH);
+			
+		} else {
+			throw new AuthnRequestBuildException(msgCode, objects);
+			
+		}
+		
+	}
+	
+	private String evaluateRequiredQAALevel() {
+		IOAAuthParameters sp = pendingReq.getOnlineApplicationConfiguration();
+				
+		//check if STORK protocol module is in ClassPath
+		Object storkRequst = null;
+		Integer storkSecClass = null;
+		try {
+			storkRequst = Class.forName("at.gv.egovernment.moa.id.protocols.stork2.MOASTORKRequest").newInstance();
+			if (storkRequst != null && 
+					pendingReq.getClass().isInstance(storkRequst)) {
+				Object storkAuthnRequest = pendingReq.getClass().getMethod("getStorkAuthnRequest", null).invoke(pendingReq, null);
+				storkSecClass = (Integer) storkAuthnRequest.getClass().getMethod("getQaa", null).invoke(storkAuthnRequest, null);
+				
+			}
+									
+		} catch (ClassNotFoundException | InstantiationException | IllegalAccessException | IllegalArgumentException | InvocationTargetException | NoSuchMethodException | java.lang.SecurityException ex) {
+			
+			
+		}
+				
+		if (sp != null && sp.isSTORKPVPGateway()){
+			//use PVP SecClass instead of STORK QAA level
+			String secClass = null;
+			if (storkRequst != null && 
+					pendingReq.getClass().isInstance(storkRequst)) {
+				
+				try {									
+					secClass = PVPtoSTORKMapper.getInstance().mapToSecClass(
+							PVPConstants.STORK_QAA_PREFIX + String.valueOf(storkSecClass));
+				
+				} catch (Exception e) {
+					Logger.warn("STORK-QAA level can not read from STORK request. Use default QAA 4", e);
+
+				}							
+			}
+			
+			if (MiscUtil.isNotEmpty(secClass))
+				return secClass;
+			else
+				return FederatedAuthConstants.CONFIG_DEFAULT_QAA_SECCLASS_LEVEL;
+								
+		} else {
+			if (storkRequst != null && pendingReq.getClass().isInstance(storkRequst)) {
+				//use requested QAA level from STORK request
+				try {
+					String qaaLevel = PVPConstants.STORK_QAA_PREFIX + String.valueOf(storkSecClass);
+					Logger.debug("Use STORK-QAA level " + qaaLevel + " from STORK request");
+					return qaaLevel;
+					
+					
+				} catch (Exception e) {
+					Logger.warn("Read STORK-QAA level FAILED with an exception.", e);
+					
+				}				
+			}			
+			Logger.warn("STORK-QAA level can not read from STORK request. Use default QAA 4");
+			return FederatedAuthConstants.CONFIG_DEFAULT_QAA_STORK_LEVEL;
+			
+		}		
+	}
+
+}
diff --git a/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/tasks/ReceiveAuthnResponseTask.java b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/tasks/ReceiveAuthnResponseTask.java
new file mode 100644
index 000000000..1c3134b77
--- /dev/null
+++ b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/tasks/ReceiveAuthnResponseTask.java
@@ -0,0 +1,367 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.federatedauth.tasks;
+
+import java.io.IOException;
+import java.util.Collection;
+import java.util.List;
+import java.util.Set;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.xml.transform.TransformerException;
+
+import org.opensaml.saml2.core.Attribute;
+import org.opensaml.saml2.core.Response;
+import org.opensaml.saml2.core.StatusCode;
+import org.opensaml.ws.message.decoder.MessageDecodingException;
+import org.opensaml.xml.io.MarshallingException;
+import org.opensaml.xml.security.SecurityException;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
+import at.gv.egovernment.moa.id.auth.builder.AuthenticationDataBuilder;
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants;
+import at.gv.egovernment.moa.id.auth.exception.BuildException;
+import at.gv.egovernment.moa.id.auth.exception.InvalidProtocolRequestException;
+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
+import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
+import at.gv.egovernment.moa.id.auth.modules.federatedauth.FederatedAuthConstants;
+import at.gv.egovernment.moa.id.auth.modules.federatedauth.utils.FederatedAuthCredentialProvider;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.commons.api.exceptions.SessionDataStorageException;
+import at.gv.egovernment.moa.id.moduls.RequestImpl;
+import at.gv.egovernment.moa.id.moduls.SSOManager;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+import at.gv.egovernment.moa.id.protocols.pvp2x.PVPTargetConfiguration;
+import at.gv.egovernment.moa.id.protocols.pvp2x.binding.IDecoder;
+import at.gv.egovernment.moa.id.protocols.pvp2x.binding.MOAURICompare;
+import at.gv.egovernment.moa.id.protocols.pvp2x.binding.PostBinding;
+import at.gv.egovernment.moa.id.protocols.pvp2x.binding.RedirectBinding;
+import at.gv.egovernment.moa.id.protocols.pvp2x.builder.AttributQueryBuilder;
+import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.AssertionAttributeExtractorExeption;
+import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.AssertionValidationExeption;
+import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.AttributQueryException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.AuthnResponseValidationException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.messages.InboundMessage;
+import at.gv.egovernment.moa.id.protocols.pvp2x.messages.MOAResponse;
+import at.gv.egovernment.moa.id.protocols.pvp2x.metadata.MOAMetadataProvider;
+import at.gv.egovernment.moa.id.protocols.pvp2x.signer.CredentialsNotAvailableException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.utils.AssertionAttributeExtractor;
+import at.gv.egovernment.moa.id.protocols.pvp2x.utils.SAML2Utils;
+import at.gv.egovernment.moa.id.protocols.pvp2x.verification.SAMLVerificationEngineSP;
+import at.gv.egovernment.moa.id.protocols.pvp2x.verification.TrustEngineFactory;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.MiscUtil;
+
+/**
+ * @author tlenz
+ *
+ */
+@Component("ReceiveFederatedAuthnResponseTask")
+public class ReceiveAuthnResponseTask extends AbstractAuthServletTask {
+
+	@Autowired private SAMLVerificationEngineSP samlVerificationEngine;
+	@Autowired private FederatedAuthCredentialProvider credentialProvider;
+	@Autowired private SSOManager ssoManager;
+	@Autowired private AttributQueryBuilder attributQueryBuilder;
+	@Autowired private AuthenticationDataBuilder authDataBuilder;
+	
+	
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask#execute(at.gv.egovernment.moa.id.process.api.ExecutionContext, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
+	 */
+	@Override
+	public void execute(ExecutionContext executionContext, HttpServletRequest request, HttpServletResponse response)
+			throws TaskExecutionException {		
+		InboundMessage msg = null;
+		
+		try {
+			
+			IDecoder decoder = null;
+			MOAURICompare comperator = null;
+			//select Response Binding
+			if (request.getMethod().equalsIgnoreCase("POST")) {
+				decoder = new PostBinding();
+				comperator = new MOAURICompare(pendingReq.getAuthURL() + FederatedAuthConstants.ENDPOINT_POST);
+				Logger.trace("Receive PVP Response from federated IDP, by using POST-Binding.");
+				
+			}  else if (request.getMethod().equalsIgnoreCase("GET")) {
+				decoder = new RedirectBinding();
+				comperator = new MOAURICompare(pendingReq.getAuthURL() + FederatedAuthConstants.ENDPOINT_REDIRECT);
+				Logger.trace("Receive PVP Response from federated IDP, by using Redirect-Binding.");
+				
+			} else {
+				Logger.warn("Receive PVP Response, but Binding (" 
+						+ request.getMethod() + ") is not supported.");
+				throw new AuthnResponseValidationException("sp.pvp2.03", new Object[] {FederatedAuthConstants.MODULE_NAME_FOR_LOGGING});
+				
+			}
+			
+			//decode PVP response object
+			msg = (InboundMessage) decoder.decode(
+					request, response, MOAMetadataProvider.getInstance(), true,
+					comperator);
+			 
+			if (MiscUtil.isEmpty(msg.getEntityID())) {
+				throw new InvalidProtocolRequestException("sp.pvp2.04", new Object[] {FederatedAuthConstants.MODULE_NAME_FOR_LOGGING});
+				
+			}
+
+			//validate response signature
+			if(!msg.isVerified()) {
+				samlVerificationEngine.verify(msg, TrustEngineFactory.getSignatureKnownKeysTrustEngine(MOAMetadataProvider.getInstance()));
+				msg.setVerified(true);
+								
+			}
+			
+			revisionsLogger.logEvent(pendingReq, MOAIDEventConstants.AUTHPROTOCOL_PVP_REQUEST_AUTHRESPONSE);
+			
+			//validate assertion
+			MOAResponse processedMsg = preProcessAuthResponse((MOAResponse) msg);
+			
+			//load IDP and SP configuration
+			IOAAuthParameters idpConfig = authConfig.getOnlineApplicationParameter(msg.getEntityID());
+			IOAAuthParameters spConfig = pendingReq.getOnlineApplicationConfiguration();
+			
+			//check if response Entity is valid
+			if (!idpConfig.isInderfederationIDP()) {
+				Logger.warn("Response Issuer is not a federated IDP. Stopping federated authentication ...");
+				throw new AuthnResponseValidationException("sp.pvp2.08", 
+						new Object[] {FederatedAuthConstants.MODULE_NAME_FOR_LOGGING,
+								msg.getEntityID()});
+				
+			}
+			
+			//load MOASession from database
+			defaultTaskInitialization(request, executionContext);
+			
+			//initialize Attribute extractor
+			AssertionAttributeExtractor extractor = 
+					new AssertionAttributeExtractor((Response) processedMsg.getResponse());
+			
+			//check if SP is also a federated IDP
+			if (spConfig.isInderfederationIDP()) {
+				//SP is a federated IDP  --> answer only with nameID and wait for attribute-Query
+				pendingReq.setGenericDataToSession(
+						PVPTargetConfiguration.DATAID_INTERFEDERATION_MINIMAL_FRONTCHANNEL_RESP, true);				
+				pendingReq.setGenericDataToSession(
+						PVPTargetConfiguration.DATAID_INTERFEDERATION_NAMEID, extractor.getNameID());
+				pendingReq.setGenericDataToSession(
+						PVPTargetConfiguration.DATAID_INTERFEDERATION_QAALEVEL, extractor.getQAALevel());
+
+				authenticatedSessionStorage.
+				addFederatedSessionInformation(pendingReq, 
+						idpConfig.getPublicURLPrefix(), extractor);
+				
+			} else {
+				//SP is real Service-Provider  --> check attributes in response 
+				// and start Attribute-Query if required 
+												
+				getAuthDataFromInterfederation(extractor, pendingReq.getOnlineApplicationConfiguration(), 
+						idpConfig);	
+
+				//store federatedIDP to MOASession
+				if (idpConfig.isInterfederationSSOStorageAllowed())
+					authenticatedSessionStorage.
+						addFederatedSessionInformation(pendingReq, 
+								idpConfig.getPublicURLPrefix(), extractor);
+				
+				//update MOASession			
+				authenticatedSessionStorage.storeSession(moasession);
+
+			}
+
+			//store valid assertion into pending-request
+			pendingReq.setGenericDataToSession(RequestImpl.DATAID_INTERFEDERATIOIDP_RESPONSE, processedMsg);
+			pendingReq.setGenericDataToSession(RequestImpl.DATAID_INTERFEDERATIOIDP_ENTITYID, processedMsg.getEntityID());
+			
+			//store pending-request
+			requestStoreage.storePendingRequest(pendingReq);
+			
+			//write log entries
+			revisionsLogger.logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_INTERFEDERATION_REVEIVED);				
+			Logger.info("Receive a valid assertion from IDP " + msg.getEntityID()); 
+											
+		} catch (MessageDecodingException | SecurityException e) {
+			String samlRequest = request.getParameter("SAMLRequest");			
+			Logger.warn("Receive INVALID PVP Response from federated IDP: " + samlRequest, e);
+			throw new TaskExecutionException(pendingReq, "Receive INVALID PVP Response from federated IDP", e);
+
+		} catch (IOException | MarshallingException | TransformerException e) {
+			Logger.warn("Processing PVP response from federated IDP FAILED.", e);
+			throw new TaskExecutionException(pendingReq, "Processing PVP response from federated IDP FAILED.", e);
+			
+		} catch (CredentialsNotAvailableException e) {
+			Logger.error("PVP response decrytion FAILED. No credential found.", e);
+			throw new TaskExecutionException(pendingReq, "PVP response decrytion FAILED. No credential found.", e);
+
+		} catch (AssertionValidationExeption | AuthnResponseValidationException e) {
+			Logger.info("PVP response validation FAILED. Msg:" + e.getMessage());			
+			if (msg != null) {
+				IOAAuthParameters idpConfig = authConfig.getOnlineApplicationParameter(msg.getEntityID());
+				
+				//remove federated IDP from SSO session if exists
+				ssoManager.removeInterfederatedSSOIDP(msg.getEntityID(), request);
+				
+				//select next step
+				handleAuthnResponseValidationProblem(executionContext, idpConfig, e);
+								
+			} else
+				throw new TaskExecutionException(pendingReq, "PVP response validation FAILED.", e);
+									
+		} catch (Exception e) {
+			
+			
+		}
+
+	}
+	
+	private void getAuthDataFromInterfederation(AssertionAttributeExtractor extractor, IOAAuthParameters spConfig, 
+			IOAAuthParameters idpConfig) throws BuildException, ConfigurationException{
+		
+		try {
+			Logger.debug("Service Provider is no federated IDP --> start Attribute validation or requesting ... ");
+			Collection<String> requestedAttr = pendingReq.getRequestedAttributes();
+						
+			//check if SAML2 Assertion contains a minimal set of attributes
+			if (!extractor.containsAllRequiredAttributes()) {
+				Logger.info("Received assertion does no contain a minimum set of attributes. Starting AttributeQuery process ...");				
+				
+				//build attributQuery request
+				List<Attribute> attributs = 
+						attributQueryBuilder.buildSAML2AttributeList(spConfig, requestedAttr.iterator());
+			
+				//request IDP to get additional attributes
+				extractor = authDataBuilder.getAuthDataFromAttributeQuery(attributs, extractor.getNameID(), idpConfig);
+								
+			} else {
+				Logger.info("Interfedation response include a minimal set of attributes with are required. Skip AttributQuery request step. ");
+				
+			}														
+			
+			//check if all attributes are include
+			if (!extractor.containsAllRequiredAttributes(
+					pendingReq.getRequestedAttributes())) {
+				Logger.warn("PVP Response from federated IDP contains not all requested attributes.");
+				throw new AssertionValidationExeption("sp.pvp2.06", new Object[]{FederatedAuthConstants.MODULE_NAME_FOR_LOGGING});
+				
+			}
+			
+			//copy attributes into MOASession
+			Set<String> includedAttrNames = extractor.getAllIncludeAttributeNames();
+			for (String el : includedAttrNames) {
+				moasession.setGenericDataToSession(el, extractor.getSingleAttributeValue(el));
+				Logger.debug("Add PVP-attribute " + el + " into MOASession");
+				
+			}
+			
+			//set validTo from this federated IDP response
+			moasession.setGenericDataToSession(
+					AuthenticationSessionStorageConstants.FEDERATION_RESPONSE_VALIDE_TO, 
+					extractor.getAssertionNotOnOrAfter());
+									
+		} catch (AttributQueryException e) {
+			throw new BuildException("builder.06", null, e);
+			
+		} catch (SessionDataStorageException e) {
+			throw new BuildException("builder.06", null, e);
+			
+		} catch (AssertionValidationExeption e) {
+			throw new BuildException("builder.06", null, e);
+			
+		} catch (AssertionAttributeExtractorExeption e) {
+			throw new BuildException("builder.06", null, e);
+			
+		} catch (MOAIDException e) {
+			throw new BuildException("builder.06", null, e);
+			
+		}
+	}
+	
+	/**
+	 * @param executionContext
+	 * @param idpConfig
+	 * @param message 
+	 * @param objects 
+	 * @throws TaskExecutionException 
+	 * @throws Throwable 
+	 */
+	private void handleAuthnResponseValidationProblem(ExecutionContext executionContext, IOAAuthParameters idpConfig, Throwable e) throws TaskExecutionException {
+
+		if (idpConfig != null && idpConfig.isPerformLocalAuthenticationOnInterfederationError()) {
+			Logger.info("Switch to local authentication on this IDP ... ");
+		
+			executionContext.put(MOAIDAuthConstants.PROCESSCONTEXT_REQUIRELOCALAUTHENTICATION, true);
+			executionContext.put(MOAIDAuthConstants.PROCESSCONTEXT_PERFORM_BKUSELECTION, true);
+		
+			executionContext.remove(MOAIDAuthConstants.PROCESSCONTEXT_PERFORM_INTERFEDERATION_AUTH);
+			
+		} else {
+			throw new TaskExecutionException(pendingReq, "PVP response validation FAILED.", e);
+			
+		}
+		
+	}
+	
+	/**
+	 * PreProcess AuthResponse and Assertion 
+	 * @param msg
+	 * @throws TransformerException 
+	 * @throws MarshallingException 
+	 * @throws IOException 
+	 * @throws CredentialsNotAvailableException 
+	 * @throws AssertionValidationExeption 
+	 * @throws AuthnResponseValidationException 
+	 */
+	private MOAResponse preProcessAuthResponse(MOAResponse msg) throws IOException, MarshallingException, TransformerException, AssertionValidationExeption, CredentialsNotAvailableException, AuthnResponseValidationException {
+		Logger.debug("Start PVP21 assertion processing... ");
+		Response samlResp = (Response) msg.getResponse();
+
+		// check SAML2 response status-code
+		if (samlResp.getStatus().getStatusCode().getValue().equals(StatusCode.SUCCESS_URI)) {				
+			//validate PVP 2.1 assertion
+			samlVerificationEngine.validateAssertion(samlResp, true, 
+					credentialProvider.getIDPAssertionEncryptionCredential(),
+					pendingReq.getAuthURL() + FederatedAuthConstants.ENDPOINT_METADATA,
+					FederatedAuthConstants.MODULE_NAME_FOR_LOGGING);
+
+			msg.setSAMLMessage(SAML2Utils.asDOMDocument(samlResp).getDocumentElement());
+			return msg;
+				
+		} else {
+			Logger.info("Receive StatusCode " + samlResp.getStatus().getStatusCode().getValue() 
+				+ " from federated IDP.");
+			throw new AuthnResponseValidationException("sp.pvp2.05", 
+					new Object[]{FederatedAuthConstants.MODULE_NAME_FOR_LOGGING, samlResp.getIssuer().getValue(), samlResp.getStatus().getStatusCode().getValue()});
+					
+		}
+								
+	}	
+
+}
diff --git a/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/utils/FederatedAuthCredentialProvider.java b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/utils/FederatedAuthCredentialProvider.java
new file mode 100644
index 000000000..aac253083
--- /dev/null
+++ b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/utils/FederatedAuthCredentialProvider.java
@@ -0,0 +1,123 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.federatedauth.utils;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import at.gv.egovernment.moa.id.auth.modules.federatedauth.FederatedAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider;
+import at.gv.egovernment.moa.util.FileUtils;
+
+/**
+ * @author tlenz
+ *
+ */
+@Service("FederatedAuthCredentialProvider")
+public class FederatedAuthCredentialProvider extends AbstractCredentialProvider {
+
+	@Autowired AuthConfiguration authConfig;
+	
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getKeyStoreFilePath()
+	 */
+	@Override
+	public String getKeyStoreFilePath() {
+		return FileUtils.makeAbsoluteURL(
+					authConfig.getBasicMOAIDConfiguration(FederatedAuthConstants.CONFIG_PROPS_KEYSTORE), 
+					authConfig.getRootConfigFileDir());
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getKeyStorePassword()
+	 */
+	@Override
+	public String getKeyStorePassword() {
+		return authConfig.getBasicMOAIDConfiguration(FederatedAuthConstants.CONFIG_PROPS_KEYSTOREPASSWORD).trim();
+
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getMetadataKeyAlias()
+	 */
+	@Override
+	public String getMetadataKeyAlias() {
+		return authConfig.getBasicMOAIDConfiguration(
+				FederatedAuthConstants.CONFIG_PROPS_SIGN_METADATA_ALIAS_PASSWORD).trim();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getMetadataKeyPassword()
+	 */
+	@Override
+	public String getMetadataKeyPassword() {
+		return authConfig.getBasicMOAIDConfiguration(
+				FederatedAuthConstants.CONFIG_PROPS_SIGN_METADATA_KEY_PASSWORD).trim();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getSignatureKeyAlias()
+	 */
+	@Override
+	public String getSignatureKeyAlias() {
+		return authConfig.getBasicMOAIDConfiguration(
+				FederatedAuthConstants.CONFIG_PROPS_SIGN_SIGNING_ALIAS_PASSWORD).trim();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getSignatureKeyPassword()
+	 */
+	@Override
+	public String getSignatureKeyPassword() {
+		return authConfig.getBasicMOAIDConfiguration(
+				FederatedAuthConstants.CONFIG_PROPS_SIGN_SIGNING_KEY_PASSWORD).trim();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getEncryptionKeyAlias()
+	 */
+	@Override
+	public String getEncryptionKeyAlias() {
+		return authConfig.getBasicMOAIDConfiguration(
+				FederatedAuthConstants.CONFIG_PROPS_ENCRYPTION_ALIAS_PASSWORD).trim();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getEncryptionKeyPassword()
+	 */
+	@Override
+	public String getEncryptionKeyPassword() {
+		return authConfig.getBasicMOAIDConfiguration(
+				FederatedAuthConstants.CONFIG_PROPS_ENCRYPTION_KEY_PASSWORD).trim();
+	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider#getCredentialName()
+	 */
+	@Override
+	public String getFriendlyName() {
+		return "FederatedAuth-SP";
+	}
+
+}
diff --git a/id/server/modules/moa-id-modules-federated_authentication/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider b/id/server/modules/moa-id-modules-federated_authentication/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider
new file mode 100644
index 000000000..28e4ae944
--- /dev/null
+++ b/id/server/modules/moa-id-modules-federated_authentication/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider
@@ -0,0 +1 @@
+at.gv.egovernment.moa.id.auth.modules.federatedauth.FederatedAuthenticationSpringResourceProvider
\ No newline at end of file
diff --git a/id/server/modules/moa-id-modules-federated_authentication/src/main/resources/at/gv/egovernment/moa/id/auth/modules/federatedauth/federated.Authentication.process.xml b/id/server/modules/moa-id-modules-federated_authentication/src/main/resources/at/gv/egovernment/moa/id/auth/modules/federatedauth/federated.Authentication.process.xml
new file mode 100644
index 000000000..c5c491ff8
--- /dev/null
+++ b/id/server/modules/moa-id-modules-federated_authentication/src/main/resources/at/gv/egovernment/moa/id/auth/modules/federatedauth/federated.Authentication.process.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<pd:ProcessDefinition id="SSOfederationAuthentication" xmlns:pd="http://reference.e-government.gv.at/namespace/moa/process/definition/v1">
+
+
+	<pd:Task id="createInterfederationAuthnRequest" 	class="CreateFederatedAuthnRequestTask" />
+	<pd:Task id="receiveInterfederationAuthnResponse"	class="ReceiveFederatedAuthnResponseTask" async="true" />
+	<pd:Task id="finalizeAuthentication" 							class="FinalizeAuthenticationTask" />	
+	<pd:Task id="restartAuthProzessManagement"  			class="RestartAuthProzessManagement"/>
+
+	<pd:StartEvent id="start" />	
+	
+	<pd:Transition from="start"	to="createInterfederationAuthnRequest" />	
+	
+	<!-- Switch to local authentication -->
+	<pd:Transition from="createInterfederationAuthnRequest" 	to="restartAuthProzessManagement" conditionExpression="ctx['requireLocalAuthentication']"/>
+	<pd:Transition from="receiveInterfederationAuthnResponse" to="restartAuthProzessManagement" conditionExpression="ctx['requireLocalAuthentication']"/>
+	<pd:Transition from="restartAuthProzessManagement"    		to="end" />
+	
+	<!-- Perform federated authentication -->
+	<pd:Transition from="createInterfederationAuthnRequest" 	to="receiveInterfederationAuthnResponse"/>
+	<pd:Transition from="receiveInterfederationAuthnResponse" to="finalizeAuthentication"/>	
+	<pd:Transition from="finalizeAuthentication"    					to="end" />
+			
+	<pd:EndEvent id="end" />
+
+</pd:ProcessDefinition>
\ No newline at end of file
diff --git a/id/server/modules/moa-id-modules-federated_authentication/src/main/resources/moaid_federated_auth.beans.xml b/id/server/modules/moa-id-modules-federated_authentication/src/main/resources/moaid_federated_auth.beans.xml
new file mode 100644
index 000000000..4933504f0
--- /dev/null
+++ b/id/server/modules/moa-id-modules-federated_authentication/src/main/resources/moaid_federated_auth.beans.xml
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xmlns:tx="http://www.springframework.org/schema/tx"
+	xmlns:aop="http://www.springframework.org/schema/aop"
+	xsi:schemaLocation="http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.1.xsd
+		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd
+		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd">
+ 
+
+<!-- Federated authentication services -->
+	<bean id="FederatedAuthCredentialProvider"
+	      class="at.gv.egovernment.moa.id.auth.modules.federatedauth.utils.FederatedAuthCredentialProvider"/>
+
+	<bean	id="FederatedAuthMetadataController"
+				class="at.gv.egovernment.moa.id.auth.modules.federatedauth.controller.FederatedAuthMetadataController"/>
+				
+	<bean	id="FederatedAuthModule"
+				class="at.gv.egovernment.moa.id.auth.modules.federatedauth.FederatedAuthenticationModuleImpl"/>				
+	
+	<bean	id="FederatedAuthSignalController"
+				class="at.gv.egovernment.moa.id.auth.modules.federatedauth.controller.FederatedAuthSignalController"/>
+	
+	
+<!-- Federated Authentication Process Tasks -->
+	<bean id="CreateFederatedAuthnRequestTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.federatedauth.tasks.CreateAuthnRequestTask"
+				scope="prototype"/>
+				
+	<bean id="ReceiveFederatedAuthnResponseTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.federatedauth.tasks.ReceiveAuthnResponseTask"
+				scope="prototype"/>
+																								
+</beans>
\ No newline at end of file
diff --git a/id/server/modules/moa-id-modules-saml1/pom.xml b/id/server/modules/moa-id-modules-saml1/pom.xml
index 9c43ae277..323edee8d 100644
--- a/id/server/modules/moa-id-modules-saml1/pom.xml
+++ b/id/server/modules/moa-id-modules-saml1/pom.xml
@@ -8,7 +8,6 @@
   
   <groupId>MOA.id.server.modules</groupId>
 	<artifactId>moa-id-module-saml1</artifactId>
-	<version>${moa-id-version}</version>
 	<packaging>jar</packaging>
 
 	<name>MOA ID-Module SAML1</name>
@@ -24,20 +23,50 @@
   		<artifactId>moa-id-lib</artifactId>
   		<scope>test</scope>
   		<type>test-jar</type>
-  		<version>3.0.3-Snapshot</version>
+  	</dependency>
+
+  	<dependency>
+  		<groupId>MOA.id.server</groupId>
+  		<artifactId>moa-id-lib</artifactId>
   	</dependency>
   
-    <dependency>
+  	<!-- Only for development to use SAML1 protocol
+  			 SAML1 is removed from official OPB release -->
+  	<dependency>
+  		<groupId>MOA.id.server.modules</groupId>
+  		<artifactId>moa-id-module-eIDAS</artifactId>
+  	</dependency>
+  
+<!--     <dependency>
 			<groupId>MOA</groupId>
 			<artifactId>moa-common</artifactId>
 			<type>test-jar</type>
 			<scope>test</scope>
-		</dependency>
+		</dependency> -->
+  
+    <dependency>
+  		<groupId>MOA.id.server</groupId>
+  		<artifactId>moa-id-commons</artifactId>
+  		<scope>test</scope>
+  		<type>test-jar</type>
+  	</dependency>
   
   	<dependency>
   		 <groupId>MOA.id.server.modules</groupId>
   		 <artifactId>moa-id-modul-citizencard_authentication</artifactId>
   	</dependency>
+  	
+  	<dependency>
+  		 <groupId>MOA.id.server.modules</groupId>
+  		 <artifactId>moa-id-module-eIDAS</artifactId>
+  	</dependency>
+  	
+  	    <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+  	
   </dependencies>
   
   
diff --git a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/GetArtifactAction.java b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/GetArtifactAction.java
index d4e73690f..c421bf8cc 100644
--- a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/GetArtifactAction.java
+++ b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/GetArtifactAction.java
@@ -27,22 +27,29 @@ import java.util.List;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants;
 import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttribute;
 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
 import at.gv.egovernment.moa.id.auth.servlet.RedirectServlet;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
 import at.gv.egovernment.moa.id.data.IAuthData;
 import at.gv.egovernment.moa.id.data.SLOInformationImpl;
 import at.gv.egovernment.moa.id.data.SLOInformationInterface;
 import at.gv.egovernment.moa.id.moduls.IAction;
-import at.gv.egovernment.moa.id.moduls.IRequest;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.URLEncoder;
+import eu.eidas.auth.commons.IPersonalAttributeList;
 
+@Service("SAML1_GetArtifactAction")
 public class GetArtifactAction implements IAction {
 
+	@Autowired private SAML1AuthenticationServer saml1server;
+	
 	public SLOInformationInterface processRequest(IRequest req, HttpServletRequest httpReq,
 			HttpServletResponse httpResp, IAuthData obj) throws AuthenticationException {
 			
@@ -65,14 +72,14 @@ public class GetArtifactAction implements IAction {
 		}
 					
 		try {
-			OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance()
-					.getOnlineApplicationParameter(oaURL);
-			
-			SAML1AuthenticationServer saml1server = SAML1AuthenticationServer.getInstace();
-						
+			IOAAuthParameters oaParam = req.getOnlineApplicationConfiguration();
+								
 			// add other stork attributes to MOA assertion if available
-			if(null != authData.getStorkAttributes()) {
-				List<ExtendedSAMLAttribute> moaExtendedSAMLAttibutes = SAML1AuthenticationServer.addAdditionalSTORKAttributes(authData.getStorkAttributes());
+			IPersonalAttributeList storkAttributes = authData.getGenericData(
+					AuthenticationSessionStorageConstants.STORK_ATTRIBUTELIST, 
+					IPersonalAttributeList.class);
+			if(null != storkAttributes) {
+				List<ExtendedSAMLAttribute> moaExtendedSAMLAttibutes = saml1server.addAdditionalSTORKAttributes(storkAttributes);
 				authData.getExtendedSAMLAttributesOA().addAll(moaExtendedSAMLAttibutes);
 				Logger.info("MOA assertion assembled and SAML Artifact generated.");
 			}
@@ -83,7 +90,8 @@ public class GetArtifactAction implements IAction {
 				String url = req.getAuthURL() + "/RedirectServlet";
 				url = addURLParameter(url, RedirectServlet.REDIRCT_PARAM_URL, URLEncoder.encode(oaURL, "UTF-8"));
 				if (!oaParam.getBusinessService())
-					url = addURLParameter(url, MOAIDAuthConstants.PARAM_TARGET, URLEncoder.encode(req.getTarget(), "UTF-8"));
+					url = addURLParameter(url, MOAIDAuthConstants.PARAM_TARGET, 
+							URLEncoder.encode(req.getGenericData(SAML1Protocol.REQ_DATA_TARGET, String.class), "UTF-8"));
 				url = addURLParameter(url, MOAIDAuthConstants.PARAM_SAMLARTIFACT, URLEncoder.encode(samlArtifactBase64, "UTF-8"));
 				url = httpResp.encodeRedirectURL(url);
 				
@@ -95,7 +103,7 @@ public class GetArtifactAction implements IAction {
 				String redirectURL = oaURL;		
 				if (!oaParam.getBusinessService()) {
 					redirectURL = addURLParameter(redirectURL, MOAIDAuthConstants.PARAM_TARGET,
-					URLEncoder.encode(req.getTarget(), "UTF-8"));
+					URLEncoder.encode(req.getGenericData(SAML1Protocol.REQ_DATA_TARGET, String.class), "UTF-8"));
 
 				}
 				
@@ -109,7 +117,7 @@ public class GetArtifactAction implements IAction {
 			}
 
 			SLOInformationInterface sloInformation = 
-					new SLOInformationImpl(req.getAuthURL(), authData.getAssertionID(), null, null, req.requestedModule());
+					new SLOInformationImpl(req.getAuthURL(), oaParam.getPublicURLPrefix(), authData.getAssertionID(), null, null, req.requestedModule());
 			
 			return sloInformation;
 			
diff --git a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/GetAuthenticationDataService.java b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/GetAuthenticationDataService.java
index 2b4aaf458..b01ea666d 100644
--- a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/GetAuthenticationDataService.java
+++ b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/GetAuthenticationDataService.java
@@ -46,19 +46,39 @@
 
 package at.gv.egovernment.moa.id.protocols.saml1;
 
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.StringWriter;
 import java.util.Calendar;
 
-import org.apache.axis.AxisFault;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.transform.TransformerException;
+
 import org.apache.commons.lang3.StringEscapeUtils;
+import org.apache.velocity.VelocityContext;
+import org.apache.velocity.app.VelocityEngine;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
 import org.w3c.dom.Element;
 import org.w3c.dom.NodeList;
+import org.xml.sax.SAXException;
 
 import at.gv.egovernment.moa.id.auth.builder.SAMLResponseBuilder;
 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
+import at.gv.egovernment.moa.id.auth.frontend.velocity.VelocityProvider;
+import at.gv.egovernment.moa.id.auth.servlet.AbstractController;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
+import at.gv.egovernment.moa.id.commons.utils.MOAIDMessageProvider;
 import at.gv.egovernment.moa.id.util.ErrorResponseUtils;
-import at.gv.egovernment.moa.id.util.MOAIDMessageProvider;
+import at.gv.egovernment.moa.id.util.HTTPUtils;
 import at.gv.egovernment.moa.id.util.Random;
+import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.Constants;
 import at.gv.egovernment.moa.util.DOMUtils;
 import at.gv.egovernment.moa.util.DateTimeUtils;
@@ -67,147 +87,262 @@ import at.gv.egovernment.moa.util.XPathUtils;
 /**
  * Web service for picking up authentication data created in the MOA-ID Auth component.
  * 
- * @author Paul Ivancsics
- * @version $Id: GetAuthenticationDataService.java 1233 2012-01-26 21:59:33Z kstranacher $
- * @see at.gv.egovernment.moa.id.auth.AuthenticationServer#getAuthenticationData
+ * This getAssertion WebService implementations a hacked solution to integrate SAML1 into
+ * the new Spring based MOA-ID implementation.
+ *  
+ * @deprecated
+ * It is too bad about the time to implement a better solution, 
+ * since SAML1 is deprecated MOA-ID >= 2.0.0 
+ * 
+ * @author tlenz
  */
-public class GetAuthenticationDataService implements Constants {
+@Controller
+public class GetAuthenticationDataService extends AbstractController implements Constants {
 
-  /**
-   * Constructor for GetAuthenticationDataService.
-   */
-  public GetAuthenticationDataService() {
-    super();
-  }
+	@Autowired private SAML1AuthenticationServer saml1AuthServer;
+	
+	private static final String PARAM_WSDL="wsdl";
+	private static final String PARAM_XSD="xsd";
+  
+	private static final String TEMPLATE_PLAIN_INFO="plain_info.vm";
+	private static final String TEMPLATE_WSDL="wsdl/MOA-ID-1.x.vm";
+	private static final String TEMPLATE_XSD="wsdl/MOA-SPSS-1.2.vm";	
+	private static final String TEMPLATE_SOAP_ERROR="soap_error.vm";
+	private static final String TEMPLATE_SOAP_SUCCESS="soap_success.vm";
+	
+	private static final String SERVICE_ENDPOINT = "/services/GetAuthenticationData";
+	
+	private static final String CONTEXT_ENDPOINT = "endpoint";
+	private static final String CONTEXT_ERROR = "error";
+	
+	private static final String CONTEXT_SOAP_RESPONSEID = "responseID";
+	private static final String CONTEXT_SOAP_REQUESTEID = "requestID";
+	private static final String CONTEXT_SOAP_ISSUEINSTANT = "issueInstant";
+	private static final String CONTEXT_SOAP_ERRORMESSAGE = "errorMsg";
+	private static final String CONTEXT_SOAP_STATUSCODE = "statusCode";
+	private static final String CONTEXT_SOAP_ASSERTION = "assertion";
+	
+	@RequestMapping(value = "/services/GetAuthenticationData", method = {RequestMethod.POST})
+	public void getAuthenticationData(HttpServletRequest req, HttpServletResponse resp)
+		    throws IOException {
+		InputStream is = null;
+		VelocityContext context = new VelocityContext();
+		try { 
+			is = req.getInputStream();		
+			Element soapReq = DOMUtils.parseXmlNonValidating(is);
 
-	/**
-	 * Takes a <code>lt;samlp:Request&gt;</code> containing a 
-	 * <code>SAML artifact</code> and returns the corresponding 
-	 * authentication data <code>lt;saml:Assertion&gt;</code> 
-	 * (obtained from the <code>AuthenticationServer</code>),
-	 * enclosed in a <code>lt;samlp:Response&gt;</code>.
-	 * <br/>Bad requests are mapped into various <code>lt;samlp:StatusCode&gt;</code>s,
-	 * possibly containing enclosed sub-<code>lt;samlp:StatusCode&gt;</code>s.
-	 * The status codes are defined in the SAML specification.
-	 * 
-	 * @param requests request elements of type <code>lt;samlp:Request&gt;</code>;
-	 * 				 only 1 request element is allowed
-	 * @return response element of type <code>lt;samlp:Response&gt;</code>,
-	 * 				  packed into an <code>Element[]</code>
-	 * @throws AxisFault thrown when an error occurs in assembling the 
-	 * 					<code>lt;samlp:Response&gt;</code>
-	 */
-  public Element[] Request(Element[] requests) 
-  	throws AxisFault {
-  		
-		Element request = requests[0];
-		Element[] responses = new Element[1];
+			//process request
+			Element soapResp = processRequest(soapReq); 
+		    
+			String respString = DOMUtils.serializeNode(soapResp, true);
+			
+			resp.setContentType("text/xml;charset=UTF-8");
+			context.put(CONTEXT_SOAP_ASSERTION, respString);
+			evaluateTemplate(context, resp, TEMPLATE_SOAP_SUCCESS);
+						
+		} catch (ParserConfigurationException | SAXException | IOException | TransformerException e) {
+			Logger.error("SAML1 GetAuthenticationData receive a non-valid request.", e);
+			resp.setContentType("text/xml;charset=UTF-8");
+					
+			context.put(CONTEXT_SOAP_ISSUEINSTANT, DateTimeUtils.buildDateTimeUTC(Calendar.getInstance()));
+			context.put(CONTEXT_SOAP_RESPONSEID, Random.nextRandom());
+			context.put(CONTEXT_SOAP_STATUSCODE, "samlp:Requester");
+			context.put(CONTEXT_SOAP_ERRORMESSAGE, e.getMessage());
+			
+			evaluateTemplate(context, resp, TEMPLATE_SOAP_ERROR);
+			
+		} catch (SAML1AssertionResponseBuildException e) {
+			Logger.error("SAML1 GetAuthenticationData response build failed..", e);
+			resp.setContentType("text/xml;charset=UTF-8");
+			
+			context.put(CONTEXT_SOAP_ISSUEINSTANT, e.getIssueInstant());
+			context.put(CONTEXT_SOAP_REQUESTEID, e.getRequestID());
+			context.put(CONTEXT_SOAP_RESPONSEID, e.getResponseID());
+			context.put(CONTEXT_SOAP_STATUSCODE, "samlp:Responder");
+			context.put(CONTEXT_SOAP_ERRORMESSAGE, e.getMessage());
+			
+			evaluateTemplate(context, resp, TEMPLATE_SOAP_ERROR);
+			
+		} finally {
+			try {
+				if (is != null)
+					is.close();
+				
+			} catch (Exception e) {
+								
+			}			
+		}		
+	}
+		
+	@RequestMapping(value = "/services/GetAuthenticationData", method = {RequestMethod.GET})
+	public void getAuthenticationDataWSDL(HttpServletRequest req, HttpServletResponse resp)
+		    throws Exception {		
+		String wsdl_param = req.getParameter(PARAM_WSDL);
+		String xsd_param = req.getParameter(PARAM_XSD);
+				
+		String fullServiceEndPoint = HTTPUtils.extractAuthURLFromRequest(req) + SERVICE_ENDPOINT;
+		
+		VelocityContext context = new VelocityContext();		
+		context.put(CONTEXT_ENDPOINT, fullServiceEndPoint);
+		
+		if (wsdl_param != null) {
+			//print wsdl
+			resp.setContentType("text/xml;charset=UTF-8");
+			evaluateTemplate(context, resp, TEMPLATE_WSDL);
+			
+		} else if (xsd_param != null){
+			//print xsd
+			resp.setContentType("text/xml;charset=UTF-8");
+			evaluateTemplate(context, resp, TEMPLATE_XSD);
+						
+		} else {
+			//print plain info
+			resp.setContentType("text/html;charset=UTF-8");
+			evaluateTemplate(context, resp, TEMPLATE_PLAIN_INFO);
+			
+		}
+				
+	}
+	
+	private Element processRequest(Element soapReq) throws ParserConfigurationException, IOException, SAXException, TransformerException, SAML1AssertionResponseBuildException {
 		String requestID = "";
 		String statusCode = "";
 		String subStatusCode = null;
 		String statusMessageCode = null;
 		String statusMessage = null;
 		String samlAssertion = "";
-		if (requests.length > 1) {
-			// more than 1 request given as parameter
-			statusCode = "samlp:Requester";
-			subStatusCode = "samlp:TooManyResponses";
-			statusMessageCode = "1201";
-		}
+		Element responses;
+
+		//select soap-body element
+		NodeList saml1ReqList = soapReq.getElementsByTagNameNS(soapReq.getNamespaceURI(), "Body");;				
+		if (saml1ReqList.getLength() != 1) {
+			saml1ReqList = soapReq.getElementsByTagNameNS(soapReq.getNamespaceURI(), "body");;
+			if (saml1ReqList.getLength() != 1) {
+				throw new SAXException("No unique 'soap-env:Body' element.");
+				
+			}	
+		} 
+		
+		//get first child from body --> should be the SAML1 Request element 
+		Element saml1Req;
+		if (saml1ReqList.item(0).getFirstChild() instanceof Element)
+			saml1Req = (Element) saml1ReqList.item(0).getFirstChild();
+			
 		else {
-			try {
-				DOMUtils.validateElement(request, ALL_SCHEMA_LOCATIONS, null);
-				NodeList samlArtifactList = XPathUtils.selectNodeList(request, "samlp:AssertionArtifact");
-				if (samlArtifactList.getLength() == 0) {
-					// no SAML artifact given in request
-					statusCode = "samlp:Requester";
-					statusMessageCode = "1202";
-				}
-				else if (samlArtifactList.getLength() > 1) {
-					// too many SAML artifacts given in request
-					statusCode = "samlp:Requester";
-					subStatusCode = "samlp:TooManyResponses";
-					statusMessageCode = "1203";
-				}
+			throw new SAXException("First child of 'soap-env:Body' element has a wrong type.");
 				
-				else {
-					Element samlArtifactElem = (Element)samlArtifactList.item(0);
-                    requestID = request.getAttribute("RequestID");
-					String samlArtifact = DOMUtils.getText(samlArtifactElem);
-					SAML1AuthenticationServer saml1server = SAML1AuthenticationServer.getInstace();
+		}
+
+		//validate the SAML1 request element, which we selected above 
+		DOMUtils.validateElement(saml1Req, ALL_SCHEMA_LOCATIONS, null);	
+		
+		//parse inforamtion from SAML1 request
+		try {
+			NodeList samlArtifactList = XPathUtils.selectNodeList(saml1Req, "samlp:AssertionArtifact");
+			if (samlArtifactList.getLength() == 0) {
+				// no SAML artifact given in request
+				statusCode = "samlp:Requester";
+				statusMessageCode = "1202";
+				
+			} else if (samlArtifactList.getLength() > 1) {
+				// too many SAML artifacts given in request
+				statusCode = "samlp:Requester";
+				subStatusCode = "samlp:TooManyResponses";
+				statusMessageCode = "1203";
+				
+			} else {
+				Element samlArtifactElem = (Element)samlArtifactList.item(0);
+                requestID = saml1Req.getAttribute("RequestID");
+				String samlArtifact = DOMUtils.getText(samlArtifactElem);
+								
+				try {
+					samlAssertion = saml1AuthServer.getSaml1AuthenticationData(samlArtifact);
+                    
+					// success
+					statusCode = "samlp:Success";
+					statusMessageCode = "1200";
 					
+				} catch (ClassCastException ex) {				
 					try {
+						Throwable error = saml1AuthServer.getErrorResponse(samlArtifact);
+						statusCode = "samlp:Responder";
+						
+						ErrorResponseUtils errorUtils = ErrorResponseUtils.getInstance();
+						
+						if (error instanceof MOAIDException) {
+							statusMessageCode = ((MOAIDException)error).getMessageId();
+							statusMessage = StringEscapeUtils.escapeXml(((MOAIDException)error).getMessage());
 							
-						samlAssertion = saml1server.getSaml1AuthenticationData(samlArtifact);
-                        
-						// success
-						statusCode = "samlp:Success";
-						statusMessageCode = "1200";
-					}
-					
-					catch (ClassCastException ex) {
-					
-						try {
-							Throwable error = saml1server.getErrorResponse(samlArtifact);
-							statusCode = "samlp:Responder";
-							
-							ErrorResponseUtils errorUtils = ErrorResponseUtils.getInstance();
+						} else {
+							statusMessage = StringEscapeUtils.escapeXml(error.getMessage());
 							
-							if (error instanceof MOAIDException) {
-								statusMessageCode = ((MOAIDException)error).getMessageId();
-								statusMessage = StringEscapeUtils.escapeXml(((MOAIDException)error).getMessage());
-								
-							} else {
-								statusMessage = StringEscapeUtils.escapeXml(error.getMessage());
-							}							
-							subStatusCode = errorUtils.getResponseErrorCode(error);
-																
-						} catch (Exception e) {
-							//no authentication data for given SAML artifact
-							statusCode = "samlp:Requester";
-							subStatusCode = "samlp:ResourceNotRecognized";
-							statusMessage = ex.toString();
-						}
-						
-					}
-					
-					catch (AuthenticationException ex) {
+						}							
+						subStatusCode = errorUtils.getResponseErrorCode(error);
+															
+					} catch (Exception e) {
 						//no authentication data for given SAML artifact
 						statusCode = "samlp:Requester";
 						subStatusCode = "samlp:ResourceNotRecognized";
 						statusMessage = ex.toString();
 					}
+					
+				} catch (AuthenticationException ex) {
+					//no authentication data for given SAML artifact
+					statusCode = "samlp:Requester";
+					subStatusCode = "samlp:ResourceNotRecognized";
+					statusMessage = ex.toString();
 				}
 			}
-	    catch (Throwable t) {
-	    	// invalid request format
-				statusCode = "samlp:Requester";
-				statusMessageCode = "1204";
-	    }
+			
+			
+		} catch (Throwable t) {
+			// invalid request format
+			statusCode = "samlp:Requester";
+			statusMessageCode = "1204";
+			
+		}
+
+		String responseID = Random.nextRandom();			
+		String issueInstant = DateTimeUtils.buildDateTimeUTC(Calendar.getInstance());
+
+		try {		
+			if (statusMessage == null)
+				statusMessage = MOAIDMessageProvider.getInstance().getMessage(statusMessageCode, null);
+				responses = new SAMLResponseBuilder().build(
+						responseID, requestID, issueInstant, statusCode, subStatusCode, statusMessage, samlAssertion);			
+				return responses;
+				
+		} catch (Throwable e) {
+			throw new SAML1AssertionResponseBuildException(responseID, issueInstant, 
+					requestID, "1299", e.getMessage(), e);
+			
+		}
 	}
+	
+	
+	private void evaluateTemplate(VelocityContext context, HttpServletResponse httpResp, String templateURL) throws IOException {
+		InputStream is = null;
+		try {
+			is = Thread.currentThread()
+					.getContextClassLoader()
+					.getResourceAsStream(templateURL);	
+		
+			VelocityEngine engine = VelocityProvider.getClassPathVelocityEngine();		
+			BufferedReader reader = new BufferedReader(new InputStreamReader(is ));				
+			StringWriter writer = new StringWriter();						
+			engine.evaluate(context, writer, "SAML1 GetAuthenticationData", reader);		            
+			httpResp.getOutputStream().write(writer.toString().getBytes("UTF-8"));
+			
+		} catch (Exception e) {
+			Logger.error("SAML1 GetAuthenticationData has an error:", e);
+			throw new IOException(e);
+			
+		} finally {
+			if (is != null) 
+				is.close();
+			
+		} 
 		
-    try {
-			String responseID = Random.nextRandom();			
-			String issueInstant = DateTimeUtils.buildDateTimeUTC(Calendar.getInstance());
-			
-      if (statusMessage == null)
-			  statusMessage = MOAIDMessageProvider.getInstance().getMessage(statusMessageCode, null);
-	    responses[0] = new SAMLResponseBuilder().build(
-	    	responseID, requestID, issueInstant, statusCode, subStatusCode, statusMessage, samlAssertion);
-    
-  	}
-    catch (MOAIDException e) {
-	    AxisFault fault = AxisFault.makeFault(e);
-	    fault.setFaultDetail(new Element[] { e.toErrorResponse()});
-	    throw fault;
-    } 
-    catch (Throwable t) {
-	    MOAIDException e = new MOAIDException("1299", null, t);
-	    AxisFault fault = AxisFault.makeFault(e);
-	    fault.setFaultDetail(new Element[] { e.toErrorResponse()});
-	    throw fault;
-    }
-    return responses;
-  }
-  	
+	}  	
 }
+
diff --git a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1AssertionResponseBuildException.java b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1AssertionResponseBuildException.java
new file mode 100644
index 000000000..0c06a94df
--- /dev/null
+++ b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1AssertionResponseBuildException.java
@@ -0,0 +1,86 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.protocols.saml1;
+
+/**
+ * @author tlenz
+ *
+ */
+public class SAML1AssertionResponseBuildException extends Exception {
+
+	private static final long serialVersionUID = -394698807368683821L;
+	
+	private String responseID;
+	private String issueInstant;
+	private String requestID;
+	private String errorCode;
+	
+	/**
+	 * @param responseID
+	 * @param issueInstant
+	 * @param requestID
+	 * @param string
+	 * @param message
+	 */
+	public SAML1AssertionResponseBuildException(String responseID, String issueInstant, String requestID, String errorCode,
+			String errorMsg, Throwable throwable) {
+		super(errorMsg, throwable);
+		
+		this.requestID = requestID;
+		this.issueInstant = issueInstant;
+		this.responseID = responseID;
+		this.errorCode = errorCode;
+	}
+
+	/**
+	 * @return the responseID
+	 */
+	public String getResponseID() {
+		return responseID;
+	}
+
+	/**
+	 * @return the issueInstant
+	 */
+	public String getIssueInstant() {
+		return issueInstant;
+	}
+
+	/**
+	 * @return the requestID
+	 */
+	public String getRequestID() {
+		return requestID;
+	}
+
+	/**
+	 * @return the errorCode
+	 */
+	public String getErrorCode() {
+		return errorCode;
+	}
+
+	
+	
+
+}
diff --git a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1AuthenticationServer.java b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1AuthenticationServer.java
index eb869756e..0ec0d95a2 100644
--- a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1AuthenticationServer.java
+++ b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1AuthenticationServer.java
@@ -26,21 +26,25 @@ import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.util.List;
 import java.util.Vector;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 import javax.xml.bind.JAXBContext;
 import javax.xml.bind.JAXBElement;
+import javax.xml.bind.JAXBException;
 import javax.xml.bind.Marshaller;
 import javax.xml.namespace.QName;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.transform.TransformerException;
 
 import org.apache.commons.lang3.StringEscapeUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
 import org.w3c.dom.Element;
 import org.xml.sax.SAXException;
 
-import eu.stork.peps.auth.commons.IPersonalAttributeList;
-import eu.stork.peps.auth.commons.PersonalAttribute;
-
+import at.gv.e_government.reference.namespace.mandates._20040701_.Mandate;
+import at.gv.e_government.reference.namespace.mandates._20040701_.Mandator;
 import at.gv.egovernment.moa.id.auth.AuthenticationServer;
 import at.gv.egovernment.moa.id.auth.builder.AuthenticationDataAssertionBuilder;
 import at.gv.egovernment.moa.id.auth.builder.BPKBuilder;
@@ -49,7 +53,6 @@ import at.gv.egovernment.moa.id.auth.builder.SAMLArtifactBuilder;
 import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
 import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttribute;
 import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttributeImpl;
-import at.gv.egovernment.moa.id.auth.data.IdentityLink;
 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
 import at.gv.egovernment.moa.id.auth.exception.BuildException;
 import at.gv.egovernment.moa.id.auth.exception.ParseException;
@@ -57,14 +60,16 @@ import at.gv.egovernment.moa.id.auth.exception.ServiceException;
 import at.gv.egovernment.moa.id.auth.exception.ValidateException;
 import at.gv.egovernment.moa.id.auth.parser.SAMLArtifactParser;
 import at.gv.egovernment.moa.id.auth.validator.parep.ParepUtils;
+import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.api.data.SAML1ConfigurationParameters;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
-import at.gv.egovernment.moa.id.config.ConfigurationException;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.config.auth.data.SAML1ConfigurationParameters;
 import at.gv.egovernment.moa.id.data.AuthenticationData;
-import at.gv.egovernment.moa.id.moduls.IRequest;
-import at.gv.egovernment.moa.id.storage.AssertionStorage;
-//import at.gv.egovernment.moa.id.util.IdentityLinkReSigner;
+import at.gv.egovernment.moa.id.data.IAuthData;
+import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
+import at.gv.egovernment.moa.id.storage.ITransactionStorage;
 import at.gv.egovernment.moa.id.util.Random;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.Base64Utils;
@@ -77,20 +82,14 @@ import at.gv.util.xsd.persondata.IdentificationType.Value;
 import at.gv.util.xsd.persondata.PersonNameType;
 import at.gv.util.xsd.persondata.PersonNameType.FamilyName;
 import at.gv.util.xsd.persondata.PhysicalPersonType;
+import eu.eidas.auth.commons.IPersonalAttributeList;
+import eu.eidas.auth.commons.PersonalAttribute;
+//import at.gv.egovernment.moa.id.util.IdentityLinkReSigner;
 
+@Service("SAML1AuthenticationServer")
 public class SAML1AuthenticationServer extends AuthenticationServer {
-	
-	private static SAML1AuthenticationServer instance;
-	
-	public static SAML1AuthenticationServer getInstace() {
-		if (instance == null)
-			instance = new SAML1AuthenticationServer();
 		
-		return instance;
-	}
-	
-	private static AssertionStorage authenticationDataStore =  AssertionStorage.getInstance();
-	
+	@Autowired private ITransactionStorage authenticationDataStore;
 	
 	/**
 	 * time out in milliseconds used by {@link cleanup} for authentication data
@@ -108,20 +107,23 @@ public class SAML1AuthenticationServer extends AuthenticationServer {
 					samlArtifact, ex.toString() });
 		}
 		Throwable error = null;
-		synchronized (authenticationDataStore) {
-			try {
-				error = authenticationDataStore
-						.get(samlArtifact, Throwable.class);
+		try {
+			error = authenticationDataStore
+					.get(samlArtifact, Throwable.class);
 			
-				authenticationDataStore.remove(samlArtifact);
-				
-			} catch (MOADatabaseException e) {
+			if (error == null) {
 				Logger.error("Assertion not found for SAML Artifact: " + samlArtifact);
 				throw new AuthenticationException("1206", new Object[] { samlArtifact });
+					
 			}
-			
+				
+			authenticationDataStore.remove(samlArtifact);
+				
+		} catch (MOADatabaseException e) {
+			Logger.error("Assertion not found for SAML Artifact: " + samlArtifact);
+			throw new AuthenticationException("1206", new Object[] { samlArtifact });
 		}
-		
+			
 		return error;
 	}
 	
@@ -130,7 +132,7 @@ public class SAML1AuthenticationServer extends AuthenticationServer {
 	 * @param iPersonalAttributeList STORK attribute list
 	 * @return
 	 */
-	public static List<ExtendedSAMLAttribute> addAdditionalSTORKAttributes(IPersonalAttributeList iPersonalAttributeList) {
+	public List<ExtendedSAMLAttribute> addAdditionalSTORKAttributes(IPersonalAttributeList iPersonalAttributeList) {
 		List<ExtendedSAMLAttribute> moaExtendedSAMLAttributeList = new Vector<ExtendedSAMLAttribute>();
 		
 		if(null == iPersonalAttributeList)
@@ -178,22 +180,24 @@ public class SAML1AuthenticationServer extends AuthenticationServer {
 			throw new AuthenticationException("1205", new Object[] {
 					samlArtifact, ex.toString() });
 		}
-		String authData = null;
-		synchronized (authenticationDataStore) {
-			// System.out.println("assertionHandle: " + assertionHandle);
-						
-			try {
-				authData = authenticationDataStore
-						.get(samlArtifact, String.class, authDataTimeOut);
+		String authData = null;						
+		try {
+			authData = authenticationDataStore
+					.get(samlArtifact, String.class, authDataTimeOut);
 				
-			} catch (MOADatabaseException e) {
+			if (authData == null) {
 				Logger.error("Assertion not found for SAML Artifact: " + samlArtifact);
 				throw new AuthenticationException("1206", new Object[] { samlArtifact });
-			}		
-		}
+					
+			}
 				
-		authenticationDataStore.remove(samlArtifact);
 				
+		} catch (MOADatabaseException e) {
+			Logger.error("Assertion not found for SAML Artifact: " + samlArtifact);
+			throw new AuthenticationException("1206", new Object[] { samlArtifact });
+		}		
+						
+		authenticationDataStore.remove(samlArtifact);				
 		Logger.debug("Assertion delivered for SAML Artifact: " + samlArtifact);
 		
 		return authData;
@@ -211,7 +215,7 @@ public class SAML1AuthenticationServer extends AuthenticationServer {
 		return samlArtifact;
 	}
 	
-	public String BuildSAMLArtifact(OAAuthParameter oaParam, 
+	public String BuildSAMLArtifact(IOAAuthParameters oaParam, 
 			SAML1AuthenticationData authData, String sourceID) 
 					throws ConfigurationException, BuildException, AuthenticationException {
 		
@@ -265,15 +269,20 @@ public class SAML1AuthenticationServer extends AuthenticationServer {
 				person.getIdentification().add(id );
 				Value value = new Value();
 				id.setValue(value  );
-				
-				id.setType(authData.getIdentificationType());
-				//add baseID if it is requested and available
-				if ( MiscUtil.isNotEmpty(authData.getIdentificationValue()) && 
-						saml1parameter.isProvideIdentityLink() )
+								
+				if ( MiscUtil.isNotEmpty(authData.getIdentificationValue()) &&  
+						saml1parameter.isProvideIdentityLink() && !authData.isBusinessService()) {					
+					//add baseID if it is requested and available and SP is publicService 
 					value.setValue(authData.getIdentificationValue());
-				else
-					value.setValue("");
-				
+					id.setType(authData.getIdentificationType());
+					
+				} else {
+					//otherwise add bPK
+					value.setValue(authData.getBPK());
+					id.setType(authData.getBPKType());
+					
+				}
+								
 				familyName.setValue(authData.getFamilyName());
 				familyName.setPrimary("undefined");
 				name.getGivenName().add(authData.getGivenName());
@@ -313,14 +322,15 @@ public class SAML1AuthenticationServer extends AuthenticationServer {
 				
 			}
 			
-			String samlAssertion;			
+			String samlAssertion;
+			
+			//add mandate info's
 			if (authData.isUseMandate()) {
 				List<ExtendedSAMLAttribute> oaAttributes = authData.getExtendedSAMLAttributesOA();
 				
-				//only provide full mandate if it is included. 
-				//In case of federation only a short mandate could be include 
+				//only provide full mandate if it is included.  
 				if (saml1parameter.isProvideFullMandatorData() 
-						&& authData.getMISMandate().isFullMandateIncluded()) {
+						&& authData.getMISMandate() != null) {
 					
 					try {
 															
@@ -436,7 +446,7 @@ public class SAML1AuthenticationServer extends AuthenticationServer {
 
 	}
 
-	private String generateMandateDate(OAAuthParameter oaParam, AuthenticationData authData
+	private String generateMandateDate(IOAAuthParameters oaParam, AuthenticationData authData
 			) throws AuthenticationException, BuildException,
 			ParseException, ConfigurationException, ServiceException,
 			ValidateException {
@@ -445,33 +455,36 @@ public class SAML1AuthenticationServer extends AuthenticationServer {
 			throw new AuthenticationException("auth.10", new Object[] {
 					REQ_VERIFY_AUTH_BLOCK, PARAM_SESSIONID });
 		
-		IdentityLink tempIdentityLink = null;
-
+		Element prPerson = null;
+		String identificationType = "";
+		String identificationValue = "";
+		
 		Element mandate = authData.getMandate();
+		if (mandate == null) {
+			//no full-mandate include
+			Logger.info("AuthData contains no full-mandate. Starting 'mandateDate' generation from PVP attributes ...");
+			mandate = generateMandateDateFromPVPMandateAttributes(authData);
+			
+		}
 		
-		if (authData.isUseMandate()) {
-			tempIdentityLink = new IdentityLink();
+		if (mandate != null) {
 			Element mandator = ParepUtils.extractMandator(mandate);
 			String dateOfBirth = "";
-			Element prPerson = null;
 			String familyName = "";
 			String givenName = "";
-			String identificationType = "";
-			String identificationValue = "";
 			if (mandator != null) {
 				boolean physical = ParepUtils.isPhysicalPerson(mandator);
 				if (physical) {
-					familyName = ParepUtils.extractText(mandator,
-							"descendant-or-self::pr:Name/pr:FamilyName/text()");
-					givenName = ParepUtils.extractText(mandator,
-							"descendant-or-self::pr:Name/pr:GivenName/text()");
-					dateOfBirth = ParepUtils
-							.extractMandatorDateOfBirth(mandator);
+					familyName = ParepUtils.extractText(mandator, "descendant-or-self::pr:Name/pr:FamilyName/text()");
+					givenName = ParepUtils.extractText(mandator, "descendant-or-self::pr:Name/pr:GivenName/text()");
+					dateOfBirth = ParepUtils.extractMandatorDateOfBirth(mandator);
+					
 				} else {
 					familyName = ParepUtils.extractMandatorFullName(mandator);
+					
 				}
-				identificationType = ParepUtils.getIdentification(mandator,
-						"Type");
+				
+				identificationType = ParepUtils.getIdentification(mandator, "Type");
 				identificationValue = ParepUtils.extractMandatorWbpk(mandator);
 				
 				prPerson = ParepUtils.extractPrPersonOfMandate(mandate);
@@ -498,33 +511,19 @@ public class SAML1AuthenticationServer extends AuthenticationServer {
 					ParepUtils
 							.HideStammZahlen(prPerson, true, null, null, true);
 				}
-
-				tempIdentityLink.setDateOfBirth(dateOfBirth);
-				tempIdentityLink.setFamilyName(familyName);
-				tempIdentityLink.setGivenName(givenName);
-				tempIdentityLink.setIdentificationType(identificationType);
-				tempIdentityLink.setIdentificationValue(identificationValue);
-				tempIdentityLink.setPrPerson(prPerson);
-				try {
-					tempIdentityLink.setSamlAssertion(authData.getIdentityLink()
-							.getSamlAssertion());
-				} catch (Exception e) {
-					throw new ValidateException("validator.64", null);
-				}
-
 			}
-
+			
 		}
-
-		Element mandatePerson = tempIdentityLink.getPrPerson();
-
-		String mandateData = null;
-		try {			
+		
+		if (prPerson == null) {
+			Logger.warn("Mandates are enabled, but no mandate-information is found in authData.");
+			throw new AuthenticationException("auth.16", new Object[] { "Mandates are enabled, but no mandate information is included" });
 			
+		}
+		
+		try {						
 			boolean provideStammzahl = oaParam.getSAML1Parameter().isProvideStammzahl();
-
-			String oatargetType;
-			
+			String oatargetType;			
 	        if(oaParam.getBusinessService()) {
 	        	if (oaParam.getIdentityLinkDomainIdentifier().startsWith(AuthenticationSession.REGISTERANDORDNR_PREFIX_))
 	        		oatargetType = oaParam.getIdentityLinkDomainIdentifier();
@@ -533,64 +532,166 @@ public class SAML1AuthenticationServer extends AuthenticationServer {
 	        	
 	        } else {
 	        	oatargetType = AuthenticationSession.TARGET_PREFIX_ + oaParam.getTarget();
+	        	
 	        }
 			
-			Element prIdentification = (Element) mandatePerson
-			.getElementsByTagNameNS(Constants.PD_NS_URI,
-					"Identification").item(0);
+			Element prIdentification = (Element) prPerson.
+					getElementsByTagNameNS(Constants.PD_NS_URI,"Identification").item(0);
 	        
-			if (!oatargetType.equals(tempIdentityLink.getIdentificationType())) {
-			
-				String isPrPerson = mandatePerson.getAttribute("xsi:type");
+			if (!oatargetType.equals(identificationType)) {			
+				String isPrPerson = prPerson.getAttribute("xsi:type");
 		
 				if (!StringUtils.isEmpty(isPrPerson)) {
 					if (isPrPerson.equalsIgnoreCase("pr:PhysicalPerson")) {
-						String baseid = getBaseId(mandatePerson);
-						Element identificationBpK = createIdentificationBPK(mandatePerson,
-						baseid, oaParam.getTarget());
-				
-						if (!provideStammzahl) {
-							prIdentification.getFirstChild().setTextContent("");
+						
+						String baseid = getBaseId(prPerson);
+						Element identificationBpK;
+						if (MiscUtil.isNotEmpty(baseid)) {
+							identificationBpK = createIdentificationBPK(prPerson, baseid, oaParam.getTarget());
+							
+							if (!provideStammzahl) {
+								prIdentification.getFirstChild().setTextContent("");
+							}
+							
+							prPerson.insertBefore(identificationBpK,
+									prIdentification);
+						
+						} else {
+							Logger.info("No baseID included. --> Build 'MandateDate' without baseID");
+							
 						}
+				
+						
 		
-						mandatePerson.insertBefore(identificationBpK,
-								prIdentification);
+						
 					}
 				}
 				
 			} else {
-				
-//				Element identificationBpK = mandatePerson.getOwnerDocument()
-//						.createElementNS(Constants.PD_NS_URI, "Identification");
-//				Element valueBpK = mandatePerson.getOwnerDocument().createElementNS(
-//						Constants.PD_NS_URI, "Value");
-//
-//				valueBpK.appendChild(mandatePerson.getOwnerDocument().createTextNode(
-//						tempIdentityLink.getIdentificationValue()));
-//				Element typeBpK = mandatePerson.getOwnerDocument().createElementNS(
-//						Constants.PD_NS_URI, "Type");
-//				typeBpK.appendChild(mandatePerson.getOwnerDocument().createTextNode(
-//						"urn:publicid:gv.at:cdid+bpk"));
-//				identificationBpK.appendChild(valueBpK);
-//				identificationBpK.appendChild(typeBpK);
-//				
-//				mandatePerson.insertBefore(identificationBpK, prIdentification);
+				;
 			}
 			
-
-			mandateData = DOMUtils.serializeNode(mandatePerson);
+			return DOMUtils.serializeNode(prPerson);
 
 		} catch (TransformerException e1) {
-			throw new AuthenticationException("auth.16",
-					new Object[] { GET_MIS_SESSIONID });
+			throw new AuthenticationException("auth.16", new Object[] { GET_MIS_SESSIONID });
 		} catch (IOException e1) {
-			throw new AuthenticationException("auth.16",
-					new Object[] { GET_MIS_SESSIONID });
+			throw new AuthenticationException("auth.16", new Object[] { GET_MIS_SESSIONID });
 		}
 
-		return mandateData;
 	}
 	
+	private Element generateMandateDateFromPVPMandateAttributes(IAuthData authdata) throws BuildException {
+		String legalSourcePin = authdata.getGenericData(PVPConstants.MANDATE_LEG_PER_SOURCE_PIN_NAME, String.class);
+		String legalSourceType = authdata.getGenericData(PVPConstants.MANDATE_LEG_PER_SOURCE_PIN_TYPE_NAME, String.class);
+		String legalCommonName = authdata.getGenericData(PVPConstants.MANDATE_LEG_PER_FULL_NAME_NAME, String.class);
+		
+		String natSourcePin = authdata.getGenericData(PVPConstants.MANDATE_NAT_PER_SOURCE_PIN_NAME, String.class);
+		String natSourcePinType = authdata.getGenericData(PVPConstants.MANDATE_NAT_PER_SOURCE_PIN_TYPE_NAME, String.class);
+		String natbPK = authdata.getGenericData(PVPConstants.MANDATE_NAT_PER_BPK_NAME, String.class);
+		
+		String natGivenName = authdata.getGenericData(PVPConstants.MANDATE_NAT_PER_GIVEN_NAME_NAME, String.class);
+		String natFamilyName = authdata.getGenericData(PVPConstants.MANDATE_NAT_PER_FAMILY_NAME_NAME, String.class);
+		String natDateOfBirth = authdata.getGenericData(PVPConstants.MANDATE_NAT_PER_BIRTHDATE_NAME, String.class);
+		
+		Mandate mandateObject = new Mandate();
+		Mandator mandator = new Mandator();
+		mandateObject.setMandator(mandator);
+		
+		if (MiscUtil.isNotEmpty(legalCommonName) && MiscUtil.isNotEmpty(legalSourceType) 
+				&& MiscUtil.isNotEmpty(legalSourcePin)) {
+			Logger.debug("Build 'mandateDate' element for legal person ...");
+			at.gv.e_government.reference.namespace.persondata._20020228_.CorporateBodyType legalperson = 
+					new at.gv.e_government.reference.namespace.persondata._20020228_.CorporateBodyType();
+			at.gv.e_government.reference.namespace.persondata._20020228_.IdentificationType legalID = 
+					new at.gv.e_government.reference.namespace.persondata._20020228_.IdentificationType();
+			at.gv.e_government.reference.namespace.persondata._20020228_.IdentificationType.Value idvalue = 
+					new at.gv.e_government.reference.namespace.persondata._20020228_.IdentificationType.Value();
+			
+			legalID.setValue(idvalue );
+			legalperson.getIdentification().add(legalID );
+			mandator.setCorporateBody(legalperson);			
+			legalperson.setFullName(legalCommonName);
+			legalID.setType(legalSourceType);
+			idvalue.setValue(legalSourcePin);			
+						
+		} else if (MiscUtil.isNotEmpty(natFamilyName) && MiscUtil.isNotEmpty(natGivenName) && MiscUtil.isNotEmpty(natDateOfBirth)
+				&& (MiscUtil.isNotEmpty(natSourcePin) || MiscUtil.isNotEmpty(natbPK))){
+			Logger.debug("Build 'mandateDate' element for natural person ...");
+			at.gv.e_government.reference.namespace.persondata._20020228_.PhysicalPersonType physPerson = 
+					new at.gv.e_government.reference.namespace.persondata._20020228_.PhysicalPersonType();
+			at.gv.e_government.reference.namespace.persondata._20020228_.PersonNameType persName = 
+					new at.gv.e_government.reference.namespace.persondata._20020228_.PersonNameType();						
+			at.gv.e_government.reference.namespace.persondata._20020228_.PersonNameType.FamilyName familyName = 
+					new at.gv.e_government.reference.namespace.persondata._20020228_.PersonNameType.FamilyName();
+			at.gv.e_government.reference.namespace.persondata._20020228_.IdentificationType persID = 
+					new at.gv.e_government.reference.namespace.persondata._20020228_.IdentificationType();
+			at.gv.e_government.reference.namespace.persondata._20020228_.IdentificationType.Value idValue = 
+					new at.gv.e_government.reference.namespace.persondata._20020228_.IdentificationType.Value();
+			
+			physPerson.setName(persName );			
+			persName.getFamilyName().add(familyName );
+			physPerson.getIdentification().add(persID );
+			persID.setValue(idValue );
+			mandator.setPhysicalPerson(physPerson);
+			
+			String[] pvp2GivenName = natGivenName.split(" ");
+			for(int i=0; i<pvp2GivenName.length; i++)
+				persName.getGivenName().add(pvp2GivenName[i]);
+			
+			familyName.setValue(natFamilyName);			
+			physPerson.setDateOfBirth(natDateOfBirth);
+			
+			if (MiscUtil.isNotEmpty(natSourcePin)) {
+				persID.setType(Constants.URN_PREFIX_BASEID);
+				idValue.setValue(natSourcePin);
+				
+			} else {
+				String[] pvp2bPK = natbPK.split(":");
+				if (pvp2bPK.length == 2) {
+					idValue.setValue(pvp2bPK[1]);					
+					Pattern pattern = Pattern.compile(MOAIDAuthConstants.REGEX_PATTERN_TARGET);
+					Matcher matcher = pattern.matcher(pvp2bPK[0]);
+					if (matcher.matches())
+						persID.setType(Constants.URN_PREFIX_CDID + "+" +  pvp2bPK[0]);
+					
+						//TODO: maybe change to this, because original SAML1 response has 
+						// target Constants.URN_PREFIX_BPK
+						//persID.setType(Constants.URN_PREFIX_BPK);
+					
+					
+					else
+						persID.setType(Constants.URN_PREFIX_WBPK + "+" +  pvp2bPK[0]);
+					
+				} else {
+					Logger.warn("Receive mandator bPK from federation with an unsupported format. " + natbPK);
+					throw new BuildException("auth.16", new Object[]{"Receive mandator bPK from federation with an unsupported format."});
+					
+				}					
+			}
+						
+		} else {
+			Logger.error("mandateDate' elemente could not generated. AuthData contains not all PVP-attributes which are necessary.");
+			throw new BuildException("auth.16", new Object[]{"'mandateDate' elemente could not generated. AuthData contains not all PVP-attributes which are necessary."});
+			
+		}
+		
+		try {
+			JAXBContext jc = JAXBContext.newInstance("at.gv.e_government.reference.namespace.mandates._20040701_");
+			Marshaller m = jc.createMarshaller();
+			ByteArrayOutputStream stream = new ByteArrayOutputStream();
+			m.marshal(mandateObject, stream);				
+			stream.close();	
+			
+			return DOMUtils.parseDocument(new String(stream.toByteArray(), "UTF-8"), false, null, null).getDocumentElement();
+						
+		} catch (JAXBException | IOException | SAXException | ParserConfigurationException e) {
+			Logger.error("Failed to parse short mandate", e);
+			throw new BuildException("auth.16", new Object[]{"Failed to parse 'mandateDate element'"}, e);
+			
+		}
+		
+	}
 	
 	
 	
@@ -617,11 +718,11 @@ public class SAML1AuthenticationServer extends AuthenticationServer {
 						new Object[] { samlArtifact });
 			parser.parseAssertionHandle();
 			
-			synchronized (authenticationDataStore) {
+			//synchronized (authenticationDataStore) {
 				Logger.debug("Assertion stored for SAML Artifact: "
 						+ samlArtifact);
 				authenticationDataStore.put(samlArtifact, samlAssertion);
-			}
+			//}
 			
 		} catch (AuthenticationException ex) {
 			throw ex;
diff --git a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1Protocol.java b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1Protocol.java
index 6573270e4..37d66d29b 100644
--- a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1Protocol.java
+++ b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1Protocol.java
@@ -22,37 +22,52 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.protocols.saml1;
 
+import java.io.IOException;
 import java.util.Arrays;
-import java.util.HashMap;
 import java.util.List;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.lang.StringEscapeUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
 
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
-import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
-import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
 import at.gv.egovernment.moa.id.auth.exception.InvalidProtocolRequestException;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.auth.exception.ProtocolNotActiveException;
 import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
 import at.gv.egovernment.moa.id.auth.servlet.RedirectServlet;
+import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
+import at.gv.egovernment.moa.id.commons.api.IRequest;
+import at.gv.egovernment.moa.id.commons.api.data.SAML1ConfigurationParameters;
+import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.config.auth.data.SAML1ConfigurationParameters;
-import at.gv.egovernment.moa.id.moduls.IAction;
-import at.gv.egovernment.moa.id.moduls.IModulInfo;
-import at.gv.egovernment.moa.id.moduls.IRequest;
+import at.gv.egovernment.moa.id.protocols.AbstractAuthProtocolModulController;
 import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
 import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.MiscUtil;
 import at.gv.egovernment.moa.util.URLEncoder;
 
-public class SAML1Protocol extends MOAIDAuthConstants implements IModulInfo {
+/**
+ * SAML1 authentication protocol implementation
+ * 
+ * @deprecated
+ * @author tlenz
+ *
+ */
+
+@Controller
+public class SAML1Protocol extends AbstractAuthProtocolModulController {
 
+	@Autowired private SAML1AuthenticationServer saml1AuthServer;
+	
+	public static final String REQ_DATA_SOURCEID = "saml1_sourceID";
+	public static final String REQ_DATA_TARGET = "saml1_target";
+	
 	public static final String NAME = SAML1Protocol.class.getName();
 	public static final String PATH = "id_saml1";
 
@@ -72,24 +87,6 @@ public class SAML1Protocol extends MOAIDAuthConstants implements IModulInfo {
 					PVPConstants.EID_SOURCE_PIN_TYPE_NAME
 			});
 	
-	private static HashMap<String, IAction> actions = new HashMap<String, IAction>();
-		
-	static {
-
-		actions.put(GETARTIFACT, new GetArtifactAction());
-		
-		instance = new SAML1Protocol();
-	}
-
-	private static SAML1Protocol instance = null;
-
-	public static SAML1Protocol getInstance() {
-		if (instance == null) {
-			instance = new SAML1Protocol();
-		}
-		return instance;
-	}
-
 	public String getName() {
 		return NAME;
 	}
@@ -98,92 +95,135 @@ public class SAML1Protocol extends MOAIDAuthConstants implements IModulInfo {
 		return PATH;
 	}
 
-	public IRequest preProcess(HttpServletRequest request,
-			HttpServletResponse response, String action,
-			String sessionId, String transactionId) throws MOAIDException {
-		SAML1RequestImpl config = new SAML1RequestImpl(request);
-		
+	
+	@RequestMapping(value = "/StartAuthentication", method = {RequestMethod.POST, RequestMethod.GET})
+	public void SAML1AuthnRequest(HttpServletRequest req, HttpServletResponse resp) throws MOAIDException, IOException {		
 		if (!AuthConfigurationProviderFactory.getInstance().getAllowedProtocols().isSAML1Active()) {
 			Logger.info("SAML1 is deaktivated!");
 			throw new ProtocolNotActiveException("auth.22", new Object[] { "SAML 1" });
 			
 		}
-			
-		String oaURL = (String) request.getParameter(PARAM_OA);
-		//oaURL = StringEscapeUtils.escapeHtml(oaURL);
 		
-		String target = (String) request.getParameter(PARAM_TARGET);
-		target = StringEscapeUtils.escapeHtml(target);
-		
-		String sourceID = request.getParameter(PARAM_SOURCEID);
-		sourceID = StringEscapeUtils.escapeHtml(sourceID);
-		
-		//the target parameter is used to define the OA in SAML1 standard
-		if (target != null && target.startsWith("http")) {
-			oaURL = target;
-			target = null;
-		}
+		SAML1RequestImpl pendingReq = applicationContext.getBean(SAML1RequestImpl.class);
+		pendingReq.initialize(req);
+		pendingReq.setModule(NAME);
+	
+		revisionsLogger.logEvent(MOAIDEventConstants.SESSION_CREATED, pendingReq.getUniqueSessionIdentifier());
+		revisionsLogger.logEvent(MOAIDEventConstants.TRANSACTION_CREATED, pendingReq.getUniqueTransactionIdentifier());						
+		revisionsLogger.logEvent(
+				pendingReq.getUniqueSessionIdentifier(), 
+				pendingReq.getUniqueTransactionIdentifier(), 
+				MOAIDEventConstants.TRANSACTION_IP, 
+				req.getRemoteAddr());
 		
-		if (MiscUtil.isEmpty(oaURL)) {
-			Logger.info("Receive SAML1 request with no OA parameter. Authentication STOPPED!");
-			throw new WrongParametersException("StartAuthentication", PARAM_OA,
-					"auth.12");
+		//preProcess SAML1 Request
+		preProcess(req, resp, pendingReq);
 			
-		}
-		
-		if (!ParamValidatorUtils.isValidOA(oaURL))
-			throw new WrongParametersException("StartAuthentication", PARAM_OA,
-					"auth.12");
-		
-		config.setOAURL(oaURL);
-		
-		Logger.info("Dispatch SAML1 Request: OAURL=" + oaURL);
-		
-	    if (!ParamValidatorUtils.isValidSourceID(sourceID))
-            throw new WrongParametersException("StartAuthentication", PARAM_SOURCEID, "auth.12");
-		
-		
-		//load Target only from OA config
-		OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance()
-				.getOnlineApplicationParameter(oaURL);
-		
-		if (oaParam == null)
-			throw new InvalidProtocolRequestException("auth.00",
-					new Object[] { null });
+		performAuthentication(req, resp, pendingReq);
+		return;
 				
-		SAML1ConfigurationParameters saml1 = oaParam.getSAML1Parameter();
-		if (saml1 == null || !(saml1.isIsActive() != null && saml1.isIsActive()) ) {
-			Logger.info("Online-Application " + oaURL + " can not use SAML1 for authentication.");
-			throw new InvalidProtocolRequestException("auth.00",
-					new Object[] { null });
-		}
-		config.setOnlineApplicationConfiguration(oaParam);
-		config.setSourceID(sourceID);
-		
-		MOAReversionLogger.getInstance().logEvent(sessionId, transactionId, MOAIDEventConstants.AUTHPROTOCOL_SAML1_AUTHNREQUEST);
-		
-		if (MiscUtil.isNotEmpty(target))
-			config.setTarget(target);
-		
-		else
-			config.setTarget(oaParam.getTarget());
+	}
+	
+	
+	public void preProcess(HttpServletRequest request,
+			HttpServletResponse response, SAML1RequestImpl pendingRequest) throws MOAIDException {
+		try {	
+			String oaURL = (String) request.getParameter(PARAM_OA);
+			//oaURL = StringEscapeUtils.escapeHtml(oaURL);
+			
+			String target = (String) request.getParameter(PARAM_TARGET);
+			target = StringEscapeUtils.escapeHtml(target);
+			
+			String sourceID = request.getParameter(PARAM_SOURCEID);
+			sourceID = StringEscapeUtils.escapeHtml(sourceID);
+			
+			//the target parameter is used to define the OA in SAML1 standard
+			if (target != null && target.startsWith("http")) {
+				oaURL = target;
+				target = null;
+			}
+			
+			if (MiscUtil.isEmpty(oaURL)) {
+				Logger.info("Receive SAML1 request with no OA parameter. Authentication STOPPED!");
+				throw new WrongParametersException("StartAuthentication", PARAM_OA,
+						"auth.12");
+				
+			}
+			
+			if (!ParamValidatorUtils.isValidOA(oaURL))
+				throw new WrongParametersException("StartAuthentication", PARAM_OA,
+						"auth.12");
+			
+			pendingRequest.setOAURL(oaURL);
+			
+			Logger.info("Dispatch SAML1 Request: OAURL=" + oaURL);
+			
+		    if (!ParamValidatorUtils.isValidSourceID(sourceID))
+	            throw new WrongParametersException("StartAuthentication", PARAM_SOURCEID, "auth.12");
+			
+			
+			//load Target only from OA config
+			IOAAuthParameters oaParam = authConfig.getOnlineApplicationParameter(oaURL);
+			
+			if (oaParam == null)
+				throw new InvalidProtocolRequestException("auth.00",
+						new Object[] { null });
+					
+			SAML1ConfigurationParameters saml1 = oaParam.getSAML1Parameter();
+			if (saml1 == null || !(saml1.isIsActive() != null && saml1.isIsActive()) ) {
+				Logger.info("Online-Application " + oaURL + " can not use SAML1 for authentication.");
+				throw new InvalidProtocolRequestException("auth.00",
+						new Object[] { null });
+			}
+			pendingRequest.setOnlineApplicationConfiguration(oaParam);
 			
+			
+			//check and set SourceID
+			if (oaParam.getSAML1Parameter() != null && 
+					MiscUtil.isNotEmpty(oaParam.getSAML1Parameter().getSourceID())) {
+				pendingRequest.setSourceID(oaParam.getSAML1Parameter().getSourceID());
+				
+			} else
+				pendingRequest.setSourceID(sourceID);
+			
+			revisionsLogger.logEvent(pendingRequest, MOAIDEventConstants.AUTHPROTOCOL_SAML1_AUTHNREQUEST);
+			
+			if (MiscUtil.isNotEmpty(target)) {
+				pendingRequest.setGenericDataToSession(REQ_DATA_TARGET, target);
+				pendingRequest.setTarget(target);
 				
-		return config;
+			}
+			else {
+				pendingRequest.setGenericDataToSession(REQ_DATA_TARGET, oaParam.getTarget());
+				pendingRequest.setTarget(oaParam.getTarget());
+				
+			}
+	
+			//AuthnRequest needs authentication
+			pendingRequest.setNeedAuthentication(true);
+	
+			//set protocol action, which should be executed after authentication
+			pendingRequest.setAction(GetArtifactAction.class.getName());
+			
+		} catch (WrongParametersException e) {
+			throw new InvalidProtocolRequestException(e.getMessageId(), e.getParameters());
+			
+		} catch (InvalidProtocolRequestException e) {
+			throw e;
+			
+		}
+						
 	}
 
 	public boolean generateErrorMessage(Throwable e,
 			HttpServletRequest request, HttpServletResponse response,
 			IRequest protocolRequest) 
 					throws Throwable{
-		
-		OAAuthParameter oa = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(protocolRequest.getOAURL());
-		if (!oa.getSAML1Parameter().isProvideAllErrors())
+		if (!protocolRequest.getOnlineApplicationConfiguration().getSAML1Parameter().isProvideAllErrors())
 			return false;
 		
-		else {
-			SAML1AuthenticationServer saml1authentication = SAML1AuthenticationServer.getInstace();			
-			String samlArtifactBase64 = saml1authentication.BuildErrorAssertion(e, protocolRequest);
+		else {	
+			String samlArtifactBase64 = saml1AuthServer.BuildErrorAssertion(e, protocolRequest);
 		
 			String url = protocolRequest.getAuthURL() + "/RedirectServlet";
 			url = addURLParameter(url, RedirectServlet.REDIRCT_PARAM_URL, URLEncoder.encode(protocolRequest.getOAURL(), "UTF-8"));
@@ -199,15 +239,6 @@ public class SAML1Protocol extends MOAIDAuthConstants implements IModulInfo {
 		}
 	}
 
-	public IAction getAction(String action) {
-		return actions.get(action);
-	}
-
-	public IAction canHandleRequest(HttpServletRequest request,
-			HttpServletResponse response) {
-		return null;
-	}
-
 	public boolean validate(HttpServletRequest request,
 			HttpServletResponse response, IRequest pending) {
 		
diff --git a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1RequestImpl.java b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1RequestImpl.java
index 3da7cab80..42fafc01e 100644
--- a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1RequestImpl.java
+++ b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1RequestImpl.java
@@ -23,41 +23,30 @@
 package at.gv.egovernment.moa.id.protocols.saml1;
 
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.List;
 
-import javax.servlet.http.HttpServletRequest;
+import org.springframework.beans.factory.config.BeanDefinition;
+import org.springframework.context.annotation.Scope;
+import org.springframework.stereotype.Component;
 
-import org.opensaml.saml2.core.Attribute;
-
-import at.gv.egovernment.moa.id.config.ConfigurationException;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.config.auth.data.SAML1ConfigurationParameters;
+import at.gv.egovernment.moa.id.commons.api.data.SAML1ConfigurationParameters;
 import at.gv.egovernment.moa.id.moduls.RequestImpl;
 import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.AttributQueryBuilder;
-import at.gv.egovernment.moa.logging.Logger;
 
 /**
  * @author tlenz
  *
  */
+@Component("SAML1RequestImpl")
+@Scope(value = BeanDefinition.SCOPE_PROTOTYPE)
 public class SAML1RequestImpl extends RequestImpl {
-	
-	/**
-	 * @param req
-	 * @throws ConfigurationException
-	 */
-	public SAML1RequestImpl(HttpServletRequest req)
-			throws ConfigurationException {
-		super(req);
-		
-	}
 
 	private static final long serialVersionUID = -4961979968425683115L;
 	
 	private String sourceID = null;
-
+	private String target = null;
+	
 	/**
 	 * @return the sourceID
 	 */
@@ -72,36 +61,44 @@ public class SAML1RequestImpl extends RequestImpl {
 		this.sourceID = sourceID;
 	}
 
+	
+	
+	/**
+	 * @return the target
+	 */
+	public String getTarget() {
+		return target;
+	}
+
+	/**
+	 * @param target the target to set
+	 */
+	public void setTarget(String target) {
+		this.target = target;
+	}
+
 	/* (non-Javadoc)
 	 * @see at.gv.egovernment.moa.id.moduls.RequestImpl#getRequestedAttributes()
 	 */
 	@Override
-	public List<Attribute> getRequestedAttributes() {
+	public Collection<String> getRequestedAttributes() {
 		
 		List<String> reqAttr = new ArrayList<String>();
 		reqAttr.addAll(SAML1Protocol.DEFAULTREQUESTEDATTRFORINTERFEDERATION);
 		
-		try {
-			OAAuthParameter oa = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(getOAURL());
-			SAML1ConfigurationParameters saml1 = oa.getSAML1Parameter();
-			if (saml1 != null) {
-				if (saml1.isProvideAUTHBlock())
-					reqAttr.add(PVPConstants.EID_AUTH_BLOCK_NAME);
-				
-				if (saml1.isProvideCertificate())
-					reqAttr.add(PVPConstants.EID_SIGNER_CERTIFICATE_NAME);
-				
-				if (saml1.isProvideFullMandatorData())
-					reqAttr.add(PVPConstants.MANDATE_FULL_MANDATE_NAME);
-			}
-					
-			return AttributQueryBuilder.buildSAML2AttributeList(oa, reqAttr.iterator());
+		SAML1ConfigurationParameters saml1 = this.getOnlineApplicationConfiguration().getSAML1Parameter();
+		if (saml1 != null) {
+			if (saml1.isProvideAUTHBlock())
+				reqAttr.add(PVPConstants.EID_AUTH_BLOCK_NAME);
+			
+			if (saml1.isProvideCertificate())
+				reqAttr.add(PVPConstants.EID_SIGNER_CERTIFICATE_NAME);
 			
-		} catch (ConfigurationException e) {
-			Logger.error("Load configuration for OA " + getOAURL() + " FAILED", e);
-			return null;
+			if (saml1.isProvideFullMandatorData())
+				reqAttr.add(PVPConstants.MANDATE_FULL_MANDATE_NAME);
 		}
-		
+				
+		return reqAttr;
 		
 	}
 
diff --git a/id/server/modules/moa-id-modules-saml1/src/main/resources/META-INF/services/at.gv.egovernment.moa.id.moduls.IModulInfo b/id/server/modules/moa-id-modules-saml1/src/main/resources/META-INF/services/at.gv.egovernment.moa.id.moduls.IModulInfo
deleted file mode 100644
index 5bff0dbc2..000000000
--- a/id/server/modules/moa-id-modules-saml1/src/main/resources/META-INF/services/at.gv.egovernment.moa.id.moduls.IModulInfo
+++ /dev/null
@@ -1 +0,0 @@
-at.gv.egovernment.moa.id.protocols.saml1.SAML1Protocol
\ No newline at end of file
diff --git a/id/server/modules/moa-id-modules-saml1/src/main/resources/plain_info.vm b/id/server/modules/moa-id-modules-saml1/src/main/resources/plain_info.vm
new file mode 100644
index 000000000..dfc11820f
--- /dev/null
+++ b/id/server/modules/moa-id-modules-saml1/src/main/resources/plain_info.vm
@@ -0,0 +1,14 @@
+<html>
+<head>
+<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
+</head>
+<body>
+<h1>GetAuthenticationData</h1>
+<p>Hi there, this is an Web service!</p>
+#if($error)
+	<i>Your request has an error: $error</i>
+#else
+	<i>Perhaps there will be a form for invoking the service here...</i>
+#end
+</body>
+</html>
diff --git a/id/server/modules/moa-id-modules-saml1/src/main/resources/soap_error.vm b/id/server/modules/moa-id-modules-saml1/src/main/resources/soap_error.vm
new file mode 100644
index 000000000..65945e2de
--- /dev/null
+++ b/id/server/modules/moa-id-modules-saml1/src/main/resources/soap_error.vm
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+ <soapenv:Body><samlp:Response #if($requestID) InResponseTo="$requestID" #end IssueInstant="$issueInstant" MajorVersion="1" MinorVersion="0" ResponseID="$responseID" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol">  <samlp:Status>    <samlp:StatusCode Value="$statusCode"/>    <samlp:StatusMessage>$errorMsg</samlp:StatusMessage>  </samlp:Status>  </samlp:Response> </soapenv:Body>
+</soapenv:Envelope>
\ No newline at end of file
diff --git a/id/server/modules/moa-id-modules-saml1/src/main/resources/soap_success.vm b/id/server/modules/moa-id-modules-saml1/src/main/resources/soap_success.vm
new file mode 100644
index 000000000..7dad2c259
--- /dev/null
+++ b/id/server/modules/moa-id-modules-saml1/src/main/resources/soap_success.vm
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+ <soapenv:Body>$assertion</soapenv:Body>
+</soapenv:Envelope>
\ No newline at end of file
diff --git a/id/server/modules/moa-id-modules-saml1/src/main/resources/wsdl/MOA-ID-1.x.vm b/id/server/modules/moa-id-modules-saml1/src/main/resources/wsdl/MOA-ID-1.x.vm
new file mode 100644
index 000000000..74be59723
--- /dev/null
+++ b/id/server/modules/moa-id-modules-saml1/src/main/resources/wsdl/MOA-ID-1.x.vm
@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<definitions name="MOA" targetNamespace="http://reference.e-government.gv.at/namespace/moa/20020822#" xmlns="http://schemas.xmlsoap.org/wsdl/" xmlns:tns="http://reference.e-government.gv.at/namespace/moa/20020822#" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:moa="http://reference.e-government.gv.at/namespace/moa/20020822#" xmlns:xsd="http://www.w3.org/1999/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.xmlsoap.org/wsdl/ http://schemas.xmlsoap.org/wsdl/">
+	<import namespace="http://reference.e-government.gv.at/namespace/moa/20020822#" location="$endpoint?xsd"/>
+	<message name="GetAuthenticationDataInput">
+		<part name="body" element="samlp:Request"/>
+	</message>
+	<message name="GetAuthenticationDataOutput">
+		<part name="body" element="samlp:Response"/>
+	</message>
+	<message name="MOAFault">
+		<part name="body" element="moa:ErrorResponse"/>
+	</message>
+	<portType name="IdentificationPortType">
+		<operation name="getAuthenticationData">
+			<input message="tns:GetAuthenticationDataInput"/>
+			<output message="tns:GetAuthenticationDataOutput"/>
+			<fault name="MOAFault" message="tns:MOAFault"/>
+		</operation>
+	</portType>
+	<binding name="IdentificationBinding" type="tns:IdentificationPortType" xsi:schemaLocation="http://schemas.xmlsoap.org/wsdl/soap/ http://schemas.xmlsoap.org/wsdl/soap/">
+		<soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+		<operation name="getAuthenticationData">
+			<soap:operation soapAction="urn:GetAuthenticationDataAction"/>
+			<input>
+				<soap:body use="literal" namespace="http://reference.e-government.gv.at/namespace/moa/20020822#"/>
+			</input>
+			<output>
+				<soap:body use="literal" namespace="http://reference.e-government.gv.at/namespace/moa/20020822#"/>
+			</output>
+			<fault name="MOAFault">
+				<soap:fault name="MOAFault" use="literal" namespace="http://reference.e-government.gv.at/namespace/moa/20020822#"/>
+			</fault>
+		</operation>
+	</binding>
+	<service name="GetAuthenticationDataService">
+		<port name="IdentificationPort" binding="tns:IdentificationBinding">
+			<soap:address location="$endpoint"/>
+		</port>
+	</service>
+</definitions>
diff --git a/id/server/modules/moa-id-modules-saml1/src/main/resources/wsdl/MOA-SPSS-1.2.vm b/id/server/modules/moa-id-modules-saml1/src/main/resources/wsdl/MOA-SPSS-1.2.vm
new file mode 100644
index 000000000..4c86626a0
--- /dev/null
+++ b/id/server/modules/moa-id-modules-saml1/src/main/resources/wsdl/MOA-SPSS-1.2.vm
@@ -0,0 +1,528 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- MOA SP/SS 1.2 Schema -->
+<xsd:schema
+	targetNamespace="http://reference.e-government.gv.at/namespace/moa/20020822#"
+	xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+	xmlns="http://reference.e-government.gv.at/namespace/moa/20020822#"
+	elementFormDefault="qualified" attributeFormDefault="unqualified"
+	version="1.2">
+	<xsd:import namespace="http://www.w3.org/2000/09/xmldsig#"
+		schemaLocation="http://www.w3.org/TR/xmldsig-core/xmldsig-core-schema.xsd" />
+	<xsd:import namespace="http://www.w3.org/XML/1998/namespace"
+		schemaLocation="http://www.w3.org/2001/xml.xsd" />
+	<!--########## Create XML Signature ### -->
+	<!--### Create XML Signature Request ### -->
+	<xsd:element name="CreateXMLSignatureRequest">
+		<xsd:complexType>
+			<xsd:complexContent>
+				<xsd:extension base="CreateXMLSignatureRequestType" />
+			</xsd:complexContent>
+		</xsd:complexType>
+	</xsd:element>
+	<xsd:complexType name="CreateXMLSignatureRequestType">
+		<xsd:sequence>
+			<xsd:element name="KeyIdentifier" type="KeyIdentifierType" />
+			<xsd:element name="SingleSignatureInfo" maxOccurs="unbounded">
+				<xsd:annotation>
+					<xsd:documentation>Ermöglichung der Stapelsignatur durch
+						wiederholte Angabe dieses Elements</xsd:documentation>
+				</xsd:annotation>
+				<xsd:complexType>
+					<xsd:sequence>
+						<xsd:element name="DataObjectInfo" maxOccurs="unbounded">
+							<xsd:complexType>
+								<xsd:complexContent>
+									<xsd:extension base="DataObjectInfoType">
+										<xsd:attribute name="ChildOfManifest" type="xsd:boolean"
+											use="optional" default="false" />
+									</xsd:extension>
+								</xsd:complexContent>
+							</xsd:complexType>
+						</xsd:element>
+						<xsd:element name="CreateSignatureInfo" minOccurs="0">
+							<xsd:complexType>
+								<xsd:sequence>
+									<xsd:element name="CreateSignatureEnvironment"
+										type="ContentOptionalRefType" />
+									<xsd:choice>
+										<xsd:annotation>
+											<xsd:documentation>Auswahl: Entweder explizite Angabe des
+												Signaturorts sowie ggf. sinnvoller Supplements im Zshg. mit
+												der Signaturumgebung, oder Verweis auf ein benanntes Profil
+											</xsd:documentation>
+										</xsd:annotation>
+										<xsd:element ref="CreateSignatureEnvironmentProfile" />
+										<xsd:element name="CreateSignatureEnvironmentProfileID"
+											type="ProfileIdentifierType" />
+									</xsd:choice>
+								</xsd:sequence>
+							</xsd:complexType>
+						</xsd:element>
+					</xsd:sequence>
+					<xsd:attribute name="SecurityLayerConformity" type="xsd:boolean"
+						use="optional" default="true" />
+				</xsd:complexType>
+			</xsd:element>
+		</xsd:sequence>
+	</xsd:complexType>
+	<!--### Create XML Signature Response ### -->
+	<xsd:complexType name="CreateXMLSignatureResponseType">
+		<xsd:choice maxOccurs="unbounded">
+			<xsd:annotation>
+				<xsd:documentation>Kardinalität 1..oo erlaubt die Antwort auf eine
+					Stapelsignatur-Anfrage</xsd:documentation>
+			</xsd:annotation>
+			<xsd:element name="SignatureEnvironment">
+				<xsd:annotation>
+					<xsd:documentation>Resultat, falls die Signaturerstellung
+						erfolgreich war</xsd:documentation>
+				</xsd:annotation>
+				<xsd:complexType>
+					<xsd:sequence>
+						<xsd:any namespace="##any" processContents="lax" />
+					</xsd:sequence>
+				</xsd:complexType>
+			</xsd:element>
+			<xsd:element ref="ErrorResponse" />
+		</xsd:choice>
+	</xsd:complexType>
+	<xsd:element name="CreateXMLSignatureResponse" type="CreateXMLSignatureResponseType" />
+	<!--########## Verify CMS Signature ### -->
+	<!--### Verifiy CMS Signature Request ### -->
+	<xsd:element name="VerifyCMSSignatureRequest">
+		<xsd:complexType>
+			<xsd:complexContent>
+				<xsd:extension base="VerifyCMSSignatureRequestType">
+					<xsd:attribute name="Signatories" type="SignatoriesType"
+						use="optional" default="1" />
+				</xsd:extension>
+			</xsd:complexContent>
+		</xsd:complexType>
+	</xsd:element>
+	<xsd:complexType name="VerifyCMSSignatureRequestType">
+		<xsd:sequence>
+			<xsd:element name="DateTime" type="xsd:dateTime"
+				minOccurs="0" />
+			<xsd:element name="CMSSignature" type="xsd:base64Binary" />
+			<xsd:element name="DataObject" type="CMSDataObjectOptionalMetaType"
+				minOccurs="0" />
+			<xsd:element name="TrustProfileID">
+				<xsd:annotation>
+					<xsd:documentation>mit diesem Profil wird eine Menge von
+						vertrauenswürdigen Wurzelzertifikaten spezifiziert
+					</xsd:documentation>
+				</xsd:annotation>
+			</xsd:element>
+		</xsd:sequence>
+	</xsd:complexType>
+	<!--### Verify CMS Signature Response ### -->
+	<xsd:element name="VerifyCMSSignatureResponse" type="VerifyCMSSignatureResponseType" />
+	<xsd:complexType name="VerifyCMSSignatureResponseType">
+		<xsd:sequence maxOccurs="unbounded">
+			<xsd:element name="SignerInfo" type="dsig:KeyInfoType">
+				<xsd:annotation>
+					<xsd:documentation>only ds:X509Data and RetrievalMethod is
+						supported; QualifiedCertificate is included as
+						X509Data/any;publicAuthority is included as X509Data/any
+					</xsd:documentation>
+				</xsd:annotation>
+			</xsd:element>
+			<xsd:element name="SignatureCheck" type="CheckResultType" />
+			<xsd:element name="CertificateCheck" type="CheckResultType" />
+		</xsd:sequence>
+	</xsd:complexType>
+	<!--########## Verify XML Signature ### -->
+	<!--### Verify XML Signature Request ### -->
+	<xsd:element name="VerifyXMLSignatureRequest" type="VerifyXMLSignatureRequestType" />
+	<xsd:complexType name="VerifyXMLSignatureRequestType">
+		<xsd:sequence>
+			<xsd:element name="DateTime" type="xsd:dateTime"
+				minOccurs="0" />
+			<xsd:element name="VerifySignatureInfo">
+				<xsd:complexType>
+					<xsd:sequence>
+						<xsd:element name="VerifySignatureEnvironment" type="ContentOptionalRefType" />
+						<xsd:element name="VerifySignatureLocation" type="xsd:token" />
+					</xsd:sequence>
+				</xsd:complexType>
+			</xsd:element>
+			<xsd:choice minOccurs="0" maxOccurs="unbounded">
+				<xsd:element ref="SupplementProfile" />
+				<xsd:element name="SupplementProfileID" type="xsd:string" />
+			</xsd:choice>
+			<xsd:element name="SignatureManifestCheckParams"
+				minOccurs="0">
+				<xsd:complexType>
+					<xsd:sequence>
+						<xsd:element name="ReferenceInfo" type="VerifyTransformsDataType"
+							maxOccurs="unbounded">
+							<xsd:annotation>
+								<xsd:documentation>Pro dsig:Reference-Element in der zu
+									überprüfenden XML-Signatur muss hier ein ReferenceInfo-Element
+									erscheinen. Die Reihenfolge der einzelnen ReferenceInfo
+									Elemente entspricht jener der dsig:Reference Elemente in der
+									XML-Signatur.</xsd:documentation>
+							</xsd:annotation>
+						</xsd:element>
+					</xsd:sequence>
+					<xsd:attribute name="ReturnReferenceInputData" type="xsd:boolean"
+						use="optional" default="true" />
+				</xsd:complexType>
+			</xsd:element>
+			<xsd:element name="ReturnHashInputData" minOccurs="0" />
+			<xsd:element name="TrustProfileID">
+				<xsd:annotation>
+					<xsd:documentation>mit diesem Profil wird eine Menge von
+						vertrauenswürdigen Wurzelzertifikaten spezifiziert
+					</xsd:documentation>
+				</xsd:annotation>
+			</xsd:element>
+		</xsd:sequence>
+	</xsd:complexType>
+	<!--### Verify XML Signature Response ### -->
+	<xsd:element name="VerifyXMLSignatureResponse" type="VerifyXMLSignatureResponseType" />
+	<xsd:complexType name="VerifyXMLSignatureResponseType">
+		<xsd:sequence>
+			<xsd:element name="SignerInfo" type="dsig:KeyInfoType">
+				<xsd:annotation>
+					<xsd:documentation>only ds:X509Data and ds:RetrievalMethod is
+						supported; QualifiedCertificate is included as X509Data/any;
+						PublicAuthority is included as X509Data/any</xsd:documentation>
+				</xsd:annotation>
+			</xsd:element>
+			<xsd:element name="HashInputData" type="ContentExLocRefBaseType"
+				minOccurs="0" maxOccurs="unbounded" />
+			<xsd:element name="ReferenceInputData" type="ContentExLocRefBaseType"
+				minOccurs="0" maxOccurs="unbounded" />
+			<xsd:element name="SignatureCheck" type="ReferencesCheckResultType" />
+			<xsd:element name="SignatureManifestCheck" type="ReferencesCheckResultType"
+				minOccurs="0" />
+			<xsd:element name="XMLDSIGManifestCheck" type="ManifestRefsCheckResultType"
+				minOccurs="0" maxOccurs="unbounded" />
+			<xsd:element name="CertificateCheck" type="CheckResultType" />
+		</xsd:sequence>
+	</xsd:complexType>
+	<xsd:simpleType name="ProfileIdentifierType">
+		<xsd:restriction base="xsd:token" />
+	</xsd:simpleType>
+	<xsd:complexType name="MetaInfoType">
+		<xsd:sequence>
+			<xsd:element name="MimeType" type="MimeTypeType" />
+			<xsd:element name="Description" type="xsd:anyURI"
+				minOccurs="0" />
+			<xsd:any namespace="##other" minOccurs="0" maxOccurs="unbounded" />
+		</xsd:sequence>
+	</xsd:complexType>
+	<xsd:complexType name="FinalDataMetaInfoType">
+		<xsd:complexContent>
+			<xsd:extension base="MetaInfoType">
+				<xsd:sequence>
+					<xsd:element name="Type" type="xsd:anyURI" minOccurs="0" />
+				</xsd:sequence>
+			</xsd:extension>
+		</xsd:complexContent>
+	</xsd:complexType>
+	<xsd:complexType name="DataObjectInfoType">
+		<xsd:sequence>
+			<xsd:element name="DataObject">
+				<xsd:complexType>
+					<xsd:complexContent>
+						<xsd:extension base="ContentOptionalRefType" />
+					</xsd:complexContent>
+				</xsd:complexType>
+			</xsd:element>
+			<xsd:choice>
+				<xsd:annotation>
+					<xsd:documentation>Auswahl: Entweder explizite Angabe EINER
+						Transformationskette inklusive ggf. sinnvoller Supplements oder
+						Verweis auf ein benanntes Profil</xsd:documentation>
+				</xsd:annotation>
+				<xsd:element ref="CreateTransformsInfoProfile" />
+				<xsd:element name="CreateTransformsInfoProfileID" type="ProfileIdentifierType" />
+			</xsd:choice>
+		</xsd:sequence>
+		<xsd:attribute name="Structure" use="required">
+			<xsd:simpleType>
+				<xsd:restriction base="xsd:string">
+					<xsd:enumeration value="detached" />
+					<xsd:enumeration value="enveloping" />
+				</xsd:restriction>
+			</xsd:simpleType>
+		</xsd:attribute>
+	</xsd:complexType>
+	<xsd:complexType name="TransformsInfoType">
+		<xsd:sequence>
+			<xsd:element ref="dsig:Transforms" minOccurs="0" />
+			<xsd:element name="FinalDataMetaInfo" type="FinalDataMetaInfoType" />
+		</xsd:sequence>
+	</xsd:complexType>
+	<xsd:complexType name="XMLDataObjectAssociationType">
+		<xsd:sequence>
+			<xsd:element name="MetaInfo" type="MetaInfoType"
+				minOccurs="0" />
+			<xsd:element name="Content" type="ContentRequiredRefType" />
+		</xsd:sequence>
+	</xsd:complexType>
+	<xsd:complexType name="CMSDataObjectOptionalMetaType">
+		<xsd:sequence>
+			<xsd:element name="MetaInfo" type="MetaInfoType"
+				minOccurs="0" />
+			<xsd:element name="Content" type="CMSContentBaseType" />
+		</xsd:sequence>
+	</xsd:complexType>
+	<xsd:complexType name="CMSContentBaseType">
+		<xsd:complexContent>
+			<xsd:restriction base="ContentOptionalRefType">
+				<xsd:choice minOccurs="0">
+					<xsd:element name="Base64Content" type="xsd:base64Binary" />
+				</xsd:choice>
+			</xsd:restriction>
+		</xsd:complexContent>
+	</xsd:complexType>
+	<xsd:complexType name="CheckResultType">
+		<xsd:sequence>
+			<xsd:element name="Code" type="xsd:nonNegativeInteger" />
+			<xsd:element name="Info" type="AnyChildrenType"
+				minOccurs="0" />
+		</xsd:sequence>
+	</xsd:complexType>
+	<xsd:complexType name="ReferencesCheckResultType">
+		<xsd:complexContent>
+			<xsd:restriction base="CheckResultType">
+				<xsd:sequence>
+					<xsd:element name="Code" type="xsd:nonNegativeInteger" />
+					<xsd:element name="Info" type="ReferencesCheckResultInfoType"
+						minOccurs="0" />
+				</xsd:sequence>
+			</xsd:restriction>
+		</xsd:complexContent>
+	</xsd:complexType>
+	<xsd:complexType name="ReferencesCheckResultInfoType"
+		mixed="true">
+		<xsd:complexContent mixed="true">
+			<xsd:restriction base="AnyChildrenType">
+				<xsd:sequence>
+					<xsd:any namespace="##other" processContents="lax"
+						minOccurs="0" maxOccurs="unbounded" />
+					<xsd:element name="FailedReference" type="xsd:positiveInteger"
+						minOccurs="0" maxOccurs="unbounded" />
+				</xsd:sequence>
+			</xsd:restriction>
+		</xsd:complexContent>
+	</xsd:complexType>
+	<xsd:complexType name="ManifestRefsCheckResultType">
+		<xsd:complexContent>
+			<xsd:restriction base="CheckResultType">
+				<xsd:sequence>
+					<xsd:element name="Code" type="xsd:nonNegativeInteger" />
+					<xsd:element name="Info" type="ManifestRefsCheckResultInfoType" />
+				</xsd:sequence>
+			</xsd:restriction>
+		</xsd:complexContent>
+	</xsd:complexType>
+	<xsd:complexType name="ManifestRefsCheckResultInfoType"
+		mixed="true">
+		<xsd:complexContent mixed="true">
+			<xsd:restriction base="AnyChildrenType">
+				<xsd:sequence>
+					<xsd:any namespace="##other" processContents="lax"
+						minOccurs="0" maxOccurs="unbounded" />
+					<xsd:element name="FailedReference" type="xsd:positiveInteger"
+						minOccurs="0" maxOccurs="unbounded" />
+					<xsd:element name="ReferringSigReference" type="xsd:positiveInteger" />
+				</xsd:sequence>
+			</xsd:restriction>
+		</xsd:complexContent>
+	</xsd:complexType>
+	<!--########## Error Response ### -->
+	<xsd:element name="ErrorResponse" type="ErrorResponseType">
+		<xsd:annotation>
+			<xsd:documentation>Resultat, falls die Signaturerstellung gescheitert
+				ist</xsd:documentation>
+		</xsd:annotation>
+	</xsd:element>
+	<xsd:complexType name="ErrorResponseType">
+		<xsd:sequence>
+			<xsd:element name="ErrorCode" type="xsd:integer" />
+			<xsd:element name="Info" type="xsd:string" />
+		</xsd:sequence>
+	</xsd:complexType>
+	<!--########## Auxiliary Types ### -->
+	<xsd:simpleType name="KeyIdentifierType">
+		<xsd:restriction base="xsd:string" />
+	</xsd:simpleType>
+	<xsd:simpleType name="KeyStorageType">
+		<xsd:restriction base="xsd:string">
+			<xsd:enumeration value="Software" />
+			<xsd:enumeration value="Hardware" />
+		</xsd:restriction>
+	</xsd:simpleType>
+	<xsd:simpleType name="MimeTypeType">
+		<xsd:restriction base="xsd:token" />
+	</xsd:simpleType>
+	<xsd:complexType name="AnyChildrenType" mixed="true">
+		<xsd:sequence>
+			<xsd:any namespace="##any" processContents="lax" minOccurs="0"
+				maxOccurs="unbounded" />
+		</xsd:sequence>
+	</xsd:complexType>
+	<xsd:complexType name="XMLContentType" mixed="true">
+		<xsd:complexContent mixed="true">
+			<xsd:extension base="AnyChildrenType">
+				<xsd:attribute ref="xml:space" use="optional" />
+			</xsd:extension>
+		</xsd:complexContent>
+	</xsd:complexType>
+	<xsd:complexType name="ContentBaseType">
+		<xsd:choice minOccurs="0">
+			<xsd:element name="Base64Content" type="xsd:base64Binary" />
+			<xsd:element name="XMLContent" type="XMLContentType" />
+			<xsd:element name="LocRefContent" type="xsd:anyURI" />
+		</xsd:choice>
+	</xsd:complexType>
+	<xsd:complexType name="ContentExLocRefBaseType">
+		<xsd:complexContent>
+			<xsd:restriction base="ContentBaseType">
+				<xsd:choice minOccurs="0">
+					<xsd:element name="Base64Content" type="xsd:base64Binary" />
+					<xsd:element name="XMLContent" type="XMLContentType" />
+				</xsd:choice>
+			</xsd:restriction>
+		</xsd:complexContent>
+	</xsd:complexType>
+	<xsd:complexType name="ContentOptionalRefType">
+		<xsd:complexContent>
+			<xsd:extension base="ContentBaseType">
+				<xsd:attribute name="Reference" type="xsd:anyURI" use="optional" />
+			</xsd:extension>
+		</xsd:complexContent>
+	</xsd:complexType>
+	<xsd:complexType name="ContentRequiredRefType">
+		<xsd:complexContent>
+			<xsd:restriction base="ContentOptionalRefType">
+				<xsd:choice minOccurs="0">
+					<xsd:element name="Base64Content" type="xsd:base64Binary" />
+					<xsd:element name="XMLContent" type="XMLContentType" />
+					<xsd:element name="LocRefContent" type="xsd:anyURI" />
+				</xsd:choice>
+				<xsd:attribute name="Reference" type="xsd:anyURI" use="required" />
+			</xsd:restriction>
+		</xsd:complexContent>
+	</xsd:complexType>
+	<xsd:complexType name="VerifyTransformsDataType">
+		<xsd:choice maxOccurs="unbounded">
+			<xsd:annotation>
+				<xsd:documentation>Ein oder mehrere Transformationswege können von
+					der Applikation an MOA mitgeteilt werden. Die zu prüfende Signatur
+					hat zumindest einem dieser Transformationswege zu entsprechen. Die
+					Angabe kann explizit oder als Profilbezeichner erfolgen.
+				</xsd:documentation>
+			</xsd:annotation>
+			<xsd:element ref="VerifyTransformsInfoProfile" />
+			<xsd:element name="VerifyTransformsInfoProfileID" type="xsd:string">
+				<xsd:annotation>
+					<xsd:documentation>Profilbezeichner für einen Transformationsweg
+					</xsd:documentation>
+				</xsd:annotation>
+			</xsd:element>
+		</xsd:choice>
+	</xsd:complexType>
+	<xsd:element name="QualifiedCertificate" />
+	<xsd:element name="PublicAuthority" type="PublicAuthorityType" />
+	<xsd:complexType name="PublicAuthorityType">
+		<xsd:sequence>
+			<xsd:element name="Code" type="xsd:string" minOccurs="0" />
+		</xsd:sequence>
+	</xsd:complexType>
+	<xsd:simpleType name="SignatoriesType">
+		<xsd:union memberTypes="AllSignatoriesType">
+			<xsd:simpleType>
+				<xsd:list itemType="xsd:positiveInteger" />
+			</xsd:simpleType>
+		</xsd:union>
+	</xsd:simpleType>
+	<xsd:simpleType name="AllSignatoriesType">
+		<xsd:restriction base="xsd:string">
+			<xsd:enumeration value="all" />
+		</xsd:restriction>
+	</xsd:simpleType>
+	<xsd:complexType name="CreateSignatureLocationType">
+		<xsd:simpleContent>
+			<xsd:extension base="xsd:token">
+				<xsd:attribute name="Index" type="xsd:nonNegativeInteger"
+					use="required" />
+			</xsd:extension>
+		</xsd:simpleContent>
+	</xsd:complexType>
+	<xsd:complexType name="TransformParameterType">
+		<xsd:choice minOccurs="0">
+			<xsd:annotation>
+				<xsd:documentation>Die Angabe des Transformationsparameters
+					(explizit oder als Hashwert) kann unterlassen werden, wenn die
+					Applikation von der Unveränderlichkeit des Inhalts der in
+					"Transformationsparamter", Attribut "URI" angegebenen URI ausgehen
+					kann.</xsd:documentation>
+			</xsd:annotation>
+			<xsd:element name="Base64Content" type="xsd:base64Binary">
+				<xsd:annotation>
+					<xsd:documentation>Der Transformationsparameter explizit angegeben.
+					</xsd:documentation>
+				</xsd:annotation>
+			</xsd:element>
+			<xsd:element name="Hash">
+				<xsd:annotation>
+					<xsd:documentation>Der Hashwert des Transformationsparameters.
+					</xsd:documentation>
+				</xsd:annotation>
+				<xsd:complexType>
+					<xsd:sequence>
+						<xsd:element ref="dsig:DigestMethod" />
+						<xsd:element ref="dsig:DigestValue" />
+					</xsd:sequence>
+				</xsd:complexType>
+			</xsd:element>
+		</xsd:choice>
+		<xsd:attribute name="URI" type="xsd:anyURI" use="required" />
+	</xsd:complexType>
+	<xsd:element name="CreateSignatureEnvironmentProfile">
+		<xsd:complexType>
+			<xsd:sequence>
+				<xsd:element name="CreateSignatureLocation" type="CreateSignatureLocationType" />
+				<xsd:element name="Supplement" type="XMLDataObjectAssociationType"
+					minOccurs="0" maxOccurs="unbounded" />
+			</xsd:sequence>
+		</xsd:complexType>
+	</xsd:element>
+	<xsd:element name="VerifyTransformsInfoProfile">
+		<xsd:annotation>
+			<xsd:documentation>Explizite Angabe des Transformationswegs
+			</xsd:documentation>
+		</xsd:annotation>
+		<xsd:complexType>
+			<xsd:sequence>
+				<xsd:element ref="dsig:Transforms" minOccurs="0" />
+				<xsd:element name="TransformParameter" type="TransformParameterType"
+					minOccurs="0" maxOccurs="unbounded">
+					<xsd:annotation>
+						<xsd:documentation>Alle impliziten Transformationsparameter, die
+							zum Durchlaufen der oben angeführten Transformationskette bekannt
+							sein müssen, müssen hier angeführt werden. Das Attribut "URI"
+							bezeichnet den Transformationsparameter in exakt jener Weise, wie
+							er in der zu überprüfenden Signatur gebraucht wird.
+						</xsd:documentation>
+					</xsd:annotation>
+				</xsd:element>
+			</xsd:sequence>
+		</xsd:complexType>
+	</xsd:element>
+	<xsd:element name="Supplement" type="XMLDataObjectAssociationType" />
+	<xsd:element name="SupplementProfile" type="XMLDataObjectAssociationType" />
+	<xsd:element name="CreateTransformsInfoProfile">
+		<xsd:complexType>
+			<xsd:sequence>
+				<xsd:element name="CreateTransformsInfo" type="TransformsInfoType" />
+				<xsd:element ref="Supplement" minOccurs="0" maxOccurs="unbounded" />
+			</xsd:sequence>
+		</xsd:complexType>
+	</xsd:element>
+</xsd:schema>
diff --git a/id/server/modules/module-monitoring/src/main/java/at/gv/egovernment/moa/id/auth/servlet/MonitoringServlet.java b/id/server/modules/module-monitoring/src/main/java/at/gv/egovernment/moa/id/auth/servlet/MonitoringServlet.java
index a7d7b9759..70448ef09 100644
--- a/id/server/modules/module-monitoring/src/main/java/at/gv/egovernment/moa/id/auth/servlet/MonitoringServlet.java
+++ b/id/server/modules/module-monitoring/src/main/java/at/gv/egovernment/moa/id/auth/servlet/MonitoringServlet.java
@@ -28,35 +28,38 @@ import java.util.Arrays;
 import java.util.List;
 
 import javax.servlet.ServletException;
-import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import at.gv.egovernment.moa.id.config.ConfigurationException;
-import at.gv.egovernment.moa.id.config.auth.AuthConfiguration;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 import at.gv.egovernment.moa.id.monitoring.TestManager;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.MiscUtil;
 
-@WebServlet(name = "MonitoringServlet", value = "/MonitoringServlet")
-public class MonitoringServlet extends AuthServlet {
+@Controller
+public class MonitoringServlet {
 
-	private static final long serialVersionUID = 1L;
 	private static final String REQUEST_ATTR_MODULE = "module";
 	
+	@Autowired private AuthConfiguration authConfig;
+	
 	  public MonitoringServlet() {
 		super();
 		Logger.debug("Registering servlet " + getClass().getName() + " with mapping '/MonitoringServlet'.");
 	}
 
-	protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+	@RequestMapping(value = "/MonitoringServlet", method = RequestMethod.GET)
+	public void getStatusInformation(HttpServletRequest req, HttpServletResponse resp)
 			    throws ServletException, IOException {
 		  
-		  try {
-			AuthConfiguration config = AuthConfigurationProviderFactory.getInstance();
-			
-			if (config.isMonitoringActive()) {
+		  try {			
+			if (authConfig.isMonitoringActive()) {
 				Logger.debug("Monitoring Servlet received request");
 
 				TestManager tests = TestManager.getInstance();
@@ -71,7 +74,7 @@ public class MonitoringServlet extends AuthServlet {
 					} else {
 						resp.setStatus(HttpServletResponse.SC_OK);
 						resp.setContentType("text/html;charset=UTF-8");
-						resp.getWriter().write(getHtml(config.getMonitoringMessageSuccess()));
+						resp.getWriter().write(getHtml(authConfig.getMonitoringMessageSuccess()));
 						Logger.info("Monitoring Servlet finished without errors");
 					}
 					
@@ -84,7 +87,7 @@ public class MonitoringServlet extends AuthServlet {
 						} else {
 							resp.setStatus(HttpServletResponse.SC_OK);
 							resp.setContentType("text/html;charset=UTF-8");
-							resp.getWriter().write(getHtml(config.getMonitoringMessageSuccess()));
+							resp.getWriter().write(getHtml(authConfig.getMonitoringMessageSuccess()));
 							Logger.info("Monitoring Servlet finished without errors");
 						}
 						
diff --git a/id/server/modules/module-monitoring/src/main/java/at/gv/egovernment/moa/id/monitoring/DatabaseTestModule.java b/id/server/modules/module-monitoring/src/main/java/at/gv/egovernment/moa/id/monitoring/DatabaseTestModule.java
index 13fb59038..5e4183146 100644
--- a/id/server/modules/module-monitoring/src/main/java/at/gv/egovernment/moa/id/monitoring/DatabaseTestModule.java
+++ b/id/server/modules/module-monitoring/src/main/java/at/gv/egovernment/moa/id/monitoring/DatabaseTestModule.java
@@ -29,11 +29,11 @@ import java.util.List;
 import org.hibernate.Query;
 import org.hibernate.Session;
 
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
 import at.gv.egovernment.moa.id.commons.db.MOASessionDBUtils;
 import at.gv.egovernment.moa.id.commons.db.StatisticLogDBUtils;
 import at.gv.egovernment.moa.id.commons.db.dao.session.AssertionStore;
 import at.gv.egovernment.moa.id.commons.db.dao.statistic.StatisticLog;
-import at.gv.egovernment.moa.id.config.auth.AuthConfiguration;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.MiscUtil;
diff --git a/id/server/modules/module-monitoring/src/main/java/at/gv/egovernment/moa/id/monitoring/IdentityLinkTestModule.java b/id/server/modules/module-monitoring/src/main/java/at/gv/egovernment/moa/id/monitoring/IdentityLinkTestModule.java
index 824791797..7994e7a06 100644
--- a/id/server/modules/module-monitoring/src/main/java/at/gv/egovernment/moa/id/monitoring/IdentityLinkTestModule.java
+++ b/id/server/modules/module-monitoring/src/main/java/at/gv/egovernment/moa/id/monitoring/IdentityLinkTestModule.java
@@ -37,9 +37,8 @@ import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser;
 import at.gv.egovernment.moa.id.auth.parser.VerifyXMLSignatureResponseParser;
 import at.gv.egovernment.moa.id.auth.validator.IdentityLinkValidator;
 import at.gv.egovernment.moa.id.auth.validator.VerifyXMLSignatureResponseValidator;
-import at.gv.egovernment.moa.id.config.auth.AuthConfiguration;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
 import at.gv.egovernment.moa.id.config.auth.data.DynamicOAAuthParameters;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.MiscUtil;
@@ -71,7 +70,7 @@ public class IdentityLinkTestModule implements TestModuleInterface {
 						.getMoaSpIdentityLinkTrustProfileID(false));
 
 		// invokes the call
-		Element domVerifyXMLSignatureResponse = new SignatureVerificationInvoker()
+		Element domVerifyXMLSignatureResponse = SignatureVerificationInvoker.getInstance()
 				.verifyXMLSignature(domVerifyXMLSignatureRequest);
 		// parses the <VerifyXMLSignatureResponse>
 		try {
diff --git a/id/server/modules/module-monitoring/src/main/java/at/gv/egovernment/moa/id/monitoring/TestManager.java b/id/server/modules/module-monitoring/src/main/java/at/gv/egovernment/moa/id/monitoring/TestManager.java
index 3c2b143b3..b25eed520 100644
--- a/id/server/modules/module-monitoring/src/main/java/at/gv/egovernment/moa/id/monitoring/TestManager.java
+++ b/id/server/modules/module-monitoring/src/main/java/at/gv/egovernment/moa/id/monitoring/TestManager.java
@@ -27,8 +27,8 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
-import at.gv.egovernment.moa.id.config.ConfigurationException;
-import at.gv.egovernment.moa.id.config.auth.AuthConfiguration;
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.FileUtils;
diff --git a/id/server/modules/module-stork/pom.xml b/id/server/modules/module-stork/pom.xml
deleted file mode 100644
index b52c10391..000000000
--- a/id/server/modules/module-stork/pom.xml
+++ /dev/null
@@ -1,66 +0,0 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
-	<modelVersion>4.0.0</modelVersion>
-
-	<parent>
-		<groupId>MOA.id.server.modules</groupId>
-		<artifactId>moa-id-modules</artifactId>
-		<version>${moa-id-version}</version>
-	</parent>
-
-	<groupId>MOA.id.server.modules</groupId>
-	<artifactId>moa-id-module-stork</artifactId>
-	<version>${moa-id-version}</version>
-	<packaging>jar</packaging>
-
-	<name>MOA ID-Module STORK</name>
-
-	<properties>
-		<repositoryPath>${basedir}/../../../../repository</repositoryPath>
-	</properties>
-
-	<dependencies>
-
-		<dependency>
-			<groupId>eu.stork</groupId>
-			<artifactId>DocumentService</artifactId>
-			<version>0.0.1-SNAPSHOT</version>
-			<classifier>classes</classifier>
-			<exclusions>
-				<exclusion>
-					<artifactId>axis</artifactId>
-					<groupId>org.apache.axis</groupId>
-				</exclusion>
-				<exclusion>
-					<artifactId>bcprov-jdk16</artifactId>
-					<groupId>org.bouncycastle</groupId>
-				</exclusion>
-				<exclusion>
-					<artifactId>jaxws-tools</artifactId>
-					<groupId>com.sun.xml.ws</groupId>
-				</exclusion>
-			</exclusions>
-		</dependency>
-
-        <dependency>
-            <groupId>eu.stork</groupId>
-            <artifactId>SamlEngine</artifactId>
-            <version>1.5.1</version>
-        </dependency>
-
-		<dependency>
-			<groupId>org.springframework</groupId>
-			<artifactId>spring-test</artifactId>
-			<scope>test</scope>
-		</dependency>
-
-		<dependency>
-			<groupId>junit</groupId>
-			<artifactId>junit</artifactId>
-			<version>${junit.version}</version>
-			<scope>test</scope>
-		</dependency>
-
-	</dependencies>
-
-</project>
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/STORKAuthModuleImpl.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/STORKAuthModuleImpl.java
deleted file mode 100644
index 41384690e..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/STORKAuthModuleImpl.java
+++ /dev/null
@@ -1,39 +0,0 @@
-package at.gv.egovernment.moa.id.auth.modules.stork;

-

-import org.apache.commons.lang3.StringUtils;

-

-import at.gv.egovernment.moa.id.auth.modules.AuthModule;

-import at.gv.egovernment.moa.id.process.api.ExecutionContext;

-

-/**

- * Module descriptor for an auth module providing stork authentication related processes.

- * @author tknall

- */

-public class STORKAuthModuleImpl implements AuthModule {

-	

-	private int priority = 0;

-

-	@Override

-	public int getPriority() {

-		return priority;

-	}

-

-	/**

-	 * Sets the priority of this module. Default value is {@code 0}.

-	 * @param priority The priority.

-	 */

-	public void setPriority(int priority) {

-		this.priority = priority;

-	}

-

-	@Override

-	public String selectProcess(ExecutionContext context) {

-		return StringUtils.isNotBlank((String) context.get("ccc")) ? "STORKAuthentication" : null;

-	}

-

-	@Override

-	public String[] getProcessDefinitions() {

-		return new String[] { "classpath:at/gv/egovernment/moa/id/auth/modules/stork/STORKAuthentication.process.xml" };

-	}

-

-}

diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/STORKProcessEngineSignalServlet.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/STORKProcessEngineSignalServlet.java
deleted file mode 100644
index efc1cd498..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/STORKProcessEngineSignalServlet.java
+++ /dev/null
@@ -1,113 +0,0 @@
-package at.gv.egovernment.moa.id.auth.modules.stork;

-

-import java.io.ByteArrayInputStream;

-import java.io.IOException;

-import java.io.InputStream;

-

-import javax.servlet.annotation.WebServlet;

-import javax.servlet.http.HttpServletRequest;

-import javax.xml.parsers.DocumentBuilder;

-import javax.xml.parsers.DocumentBuilderFactory;

-import javax.xml.parsers.ParserConfigurationException;

-import javax.xml.xpath.XPath;

-import javax.xml.xpath.XPathConstants;

-import javax.xml.xpath.XPathExpression;

-import javax.xml.xpath.XPathFactory;

-

-import org.apache.commons.lang.StringEscapeUtils;

-import org.apache.commons.lang3.StringUtils;

-import org.springframework.util.xml.SimpleNamespaceContext;

-import org.w3c.dom.Document;

-import org.xml.sax.SAXException;

-

-import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;

-import at.gv.egovernment.moa.id.auth.servlet.ProcessEngineSignalServlet;

-import at.gv.egovernment.moa.logging.Logger;

-import at.gv.egovernment.moa.util.Base64Utils;

-

-/**

- * STORK module specific servlet, overloading {@link ProcessEngineSignalServlet}'s method

- * {@linkplain ProcessEngineSignalServlet#getMoaSessionId(HttpServletRequest) getMoaSessionId(HttpServletRequest)}

- * extending its capabilities for retrieving the current moa session id.

- * <p/>

- * This {@code STORKProcessEngineSignalServlet} tries to resolve the moa session id using the following strategy:

- * <ul>

- * <li>Use the super class' approach, looking at the HttpServletRequest parameter

- * {@link MOAIDAuthConstants#PARAM_SESSIONID}.</li>

- * <li>Evaluate the request parameter "{@code RelayState}".

- * <li>Finally evaluate the SAML response, which should come base64 encoded as request parameter "{@code SAMLResponse}".</li>

- * </ul>

- * 

- * @author tknall

- * 

- */

-@WebServlet(urlPatterns = { "/PEPSConnectorWithLocalSigning", "/PEPSConnector" }, loadOnStartup = 1)

-public class STORKProcessEngineSignalServlet extends ProcessEngineSignalServlet {

-

-	private static final long serialVersionUID = 1L;

-

-	public STORKProcessEngineSignalServlet() {

-		super();

-		Logger.debug("Registering servlet " + getClass().getName() + " with mappings '/PEPSConnectorWithLocalSigning', '/PEPSConnector'.");

-	}

-

-	@Override

-	public String getMoaSessionId(HttpServletRequest request) {

-		String sessionId = super.getMoaSessionId(request);

-

-		try {

-

-			// use SAML2 relayState

-			if (sessionId == null) {

-				sessionId = StringEscapeUtils.escapeHtml(request.getParameter("RelayState"));

-			}

-

-			// take from InResponseTo attribute of SAMLResponse

-			if (sessionId == null) {

-				String base64SamlToken = request.getParameter("SAMLResponse");

-				if (base64SamlToken != null) {

-					byte[] samlToken = Base64Utils.decode(base64SamlToken, false);

-					Document samlResponse = parseDocument(new ByteArrayInputStream(samlToken));

-

-					XPath xPath = XPathFactory.newInstance().newXPath();

-					SimpleNamespaceContext nsContext = new SimpleNamespaceContext();

-					nsContext.bindNamespaceUri("saml2p", "urn:oasis:names:tc:SAML:2.0:protocol");

-					xPath.setNamespaceContext(nsContext);

-					XPathExpression expression = xPath.compile("string(/saml2p:Response/@InResponseTo)");

-					sessionId = (String) expression.evaluate(samlResponse, XPathConstants.STRING);

-					sessionId = StringEscapeUtils.escapeHtml(StringUtils.trimToNull(sessionId));

-				} else {

-					Logger.warn("No parameter 'SAMLResponse'. Unable to retrieve MOA session id.");

-				}

-			}

-

-		} catch (Exception e) {

-			Logger.warn("Unable to retrieve moa session id.", e);

-		}

-

-		return sessionId;

-	}

-

-	/**

-	 * Parses a xml document (namespace aware).

-	 * 

-	 * @param in

-	 *            The input stream.

-	 * @return The DOM document.

-	 * @throws ParserConfigurationException

-	 *             Thrown in case of configuration error.

-	 * @throws IOException

-	 *             Thrown in case of error reading from the input stream.

-	 * @throws SAXException

-	 *             Thrown in case of error parsing the document.

-	 */

-	public static Document parseDocument(InputStream in) throws ParserConfigurationException, SAXException, IOException {

-		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();

-		documentBuilderFactory.setNamespaceAware(true);

-		documentBuilderFactory.setIgnoringElementContentWhitespace(false);

-		documentBuilderFactory.setValidating(false);

-		DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder();

-		return documentBuilder.parse(in);

-	}

-

-}

diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/AbstractPepsConnectorWithLocalSigningTask.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/AbstractPepsConnectorWithLocalSigningTask.java
deleted file mode 100644
index 939390847..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/AbstractPepsConnectorWithLocalSigningTask.java
+++ /dev/null
@@ -1,225 +0,0 @@
-package at.gv.egovernment.moa.id.auth.modules.stork.tasks;

-

-import iaik.x509.X509Certificate;

-

-import java.io.IOException;

-import java.io.InputStream;

-import java.io.UnsupportedEncodingException;

-import java.security.cert.CertificateException;

-import java.util.HashMap;

-

-import javax.activation.DataSource;

-import javax.xml.bind.JAXBContext;

-import javax.xml.bind.JAXBElement;

-import javax.xml.bind.JAXBException;

-import javax.xml.parsers.ParserConfigurationException;

-import javax.xml.transform.TransformerConfigurationException;

-import javax.xml.transform.TransformerException;

-import javax.xml.transform.TransformerFactoryConfigurationError;

-

-import org.apache.commons.io.IOUtils;

-import org.xml.sax.SAXException;

-

-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

-import at.gv.egovernment.moa.id.auth.data.IdentityLink;

-import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;

-import at.gv.egovernment.moa.id.auth.exception.BKUException;

-import at.gv.egovernment.moa.id.auth.exception.BuildException;

-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

-import at.gv.egovernment.moa.id.auth.exception.ParseException;

-import at.gv.egovernment.moa.id.auth.exception.ServiceException;

-import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;

-import at.gv.egovernment.moa.id.auth.stork.STORKException;

-import at.gv.egovernment.moa.id.auth.stork.STORKResponseProcessor;

-import at.gv.egovernment.moa.id.config.ConfigurationException;

-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;

-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;

-import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;

-import at.gv.egovernment.moa.logging.Logger;

-import at.gv.egovernment.moa.spss.MOAException;

-import at.gv.egovernment.moa.spss.api.SPSSFactory;

-import at.gv.egovernment.moa.spss.api.SignatureVerificationService;

-import at.gv.egovernment.moa.spss.api.common.Content;

-import at.gv.egovernment.moa.spss.api.xmlverify.VerifySignatureInfo;

-import at.gv.egovernment.moa.spss.api.xmlverify.VerifySignatureLocation;

-import at.gv.egovernment.moa.spss.api.xmlverify.VerifyXMLSignatureRequest;

-import at.gv.egovernment.moa.spss.api.xmlverify.VerifyXMLSignatureResponse;

-import at.gv.util.xsd.xmldsig.SignatureType;

-import at.gv.util.xsd.xmldsig.X509DataType;

-import eu.stork.oasisdss.api.LightweightSourceResolver;

-import eu.stork.oasisdss.api.exceptions.ApiUtilsException;

-import eu.stork.oasisdss.api.exceptions.UtilsException;

-import eu.stork.oasisdss.profile.SignResponse;

-import eu.stork.peps.auth.commons.IPersonalAttributeList;

-

-public abstract class AbstractPepsConnectorWithLocalSigningTask extends AbstractAuthServletTask {

-

-	public static final String PEPSCONNECTOR_SERVLET_URL_PATTERN = "/PEPSConnectorWithLocalSigning";

-	

-	String getCitizienSignatureFromSignResponse(SignResponse dssSignResponse) throws IllegalArgumentException,

-			TransformerConfigurationException, UtilsException, TransformerException,

-			TransformerFactoryConfigurationError, IOException, ApiUtilsException {

-		// fetch signed doc

-		DataSource ds = LightweightSourceResolver.getDataSource(dssSignResponse);

-		if (ds == null) {

-			throw new ApiUtilsException("No datasource found in response");

-		}

-

-		InputStream incoming = ds.getInputStream();

-		String citizenSignature = IOUtils.toString(incoming);

-		incoming.close();

-

-		return citizenSignature;

-	}

-

-	void SZRGInsertion(AuthenticationSession moaSession, IPersonalAttributeList personalAttributeList,

-			String authnContextClassRef, String citizenSignature) throws STORKException, MOAIDException {

-		Logger.debug("Foregin Citizen signature successfully extracted from STORK Assertion (signedDoc)");

-		Logger.debug("Citizen signature will be verified by SZR Gateway!");

-

-		Logger.debug("fetching OAParameters from database");

-

-		OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(

-				moaSession.getPublicOAURLPrefix());

-		if (oaParam == null)

-			throw new AuthenticationException("auth.00", new Object[] { moaSession.getPublicOAURLPrefix() });

-

-		// retrieve target

-		// TODO: check in case of SSO!!!

-		String targetType = null;

-		if (oaParam.getBusinessService()) {

-			String id = oaParam.getIdentityLinkDomainIdentifier();

-			if (id.startsWith(AuthenticationSession.REGISTERANDORDNR_PREFIX_))

-				targetType = id;

-			else

-				targetType = AuthenticationSession.REGISTERANDORDNR_PREFIX_ + moaSession.getDomainIdentifier();

-		} else {

-			targetType = AuthenticationSession.TARGET_PREFIX_ + oaParam.getTarget();

-		}

-

-		Logger.debug("Starting connecting SZR Gateway");

-		// contact SZR Gateway

-		IdentityLink identityLink = null;

-

-		identityLink = STORKResponseProcessor.connectToSZRGateway(personalAttributeList, oaParam.getFriendlyName(),

-				targetType, null, oaParam.getMandateProfiles(), citizenSignature);

-		Logger.debug("SZR communication was successfull");

-

-		if (identityLink == null) {

-			Logger.error("SZR Gateway did not return an identity link.");

-			throw new MOAIDException("stork.10", null);

-		}

-		Logger.info("Received Identity Link from SZR Gateway");

-		moaSession.setIdentityLink(identityLink);

-

-		Logger.debug("Adding addtional STORK attributes to MOA session");

-		moaSession.setStorkAttributes(personalAttributeList);

-

-		// We don't have BKUURL, setting from null to "Not applicable"

-		moaSession.setBkuURL("Not applicable (STORK Authentication)");

-

-		// free for single use

-		moaSession.setAuthenticatedUsed(false);

-

-		// stork did the authentication step

-		moaSession.setAuthenticated(true);

-

-		// TODO: found better solution, but QAA Level in response could be not supported yet

-		try {

-			if (authnContextClassRef == null)

-				authnContextClassRef = PVPConstants.STORK_QAA_PREFIX + oaParam.getQaaLevel();

-			moaSession.setQAALevel(authnContextClassRef);

-

-		} catch (Throwable e) {

-			Logger.warn("STORK QAA-Level is not found in AuthnResponse. Set QAA Level to requested level");

-			moaSession.setQAALevel(PVPConstants.STORK_QAA_PREFIX + oaParam.getQaaLevel());

-

-		}

-

-	}

-

-	X509Certificate getSignerCertificate(String citizenSignature) throws CertificateException, JAXBException,

-			UnsupportedEncodingException {

-		JAXBContext ctx = JAXBContext.newInstance(SignatureType.class.getPackage().getName());

-		SignatureType root = ((JAXBElement<SignatureType>) ctx.createUnmarshaller().unmarshal(

-				IOUtils.toInputStream(citizenSignature))).getValue();

-

-		// extract certificate

-		for (Object current : root.getKeyInfo().getContent())

-			if (((JAXBElement<?>) current).getValue() instanceof X509DataType) {

-				for (Object currentX509Data : ((JAXBElement<X509DataType>) current).getValue()

-						.getX509IssuerSerialOrX509SKIOrX509SubjectName()) {

-					JAXBElement<?> casted = ((JAXBElement<?>) currentX509Data);

-					if (casted.getName().getLocalPart().equals("X509Certificate")) {

-						return new X509Certificate(((String) casted.getValue()).getBytes("UTF-8"));

-					}

-				}

-			}

-		return null;

-	}

-

-	VerifyXMLSignatureResponse verifyXMLSignature(String signature) throws AuthenticationException, ParseException,

-			BKUException, BuildException, ConfigurationException, ServiceException, UnsupportedEncodingException,

-			SAXException, IOException, ParserConfigurationException, MOAException {

-		// Based on MOA demo client

-		// Factory und Service instanzieren

-		SPSSFactory spssFac = SPSSFactory.getInstance();

-		SignatureVerificationService sigVerifyService = SignatureVerificationService.getInstance();

-

-		Content sigDocContent1 = spssFac.createContent(IOUtils.toInputStream(signature, "UTF-8"), null);

-

-		// Position der zu prüfenden Signatur im Dokument angeben

-		// (Nachdem im XPath-Ausdruck ein NS-Präfix verwendet wird, muss in einer Lookup-Tabelle

-		// der damit bezeichnete Namenraum mitgegeben werden)

-		HashMap nSMap = new HashMap();

-		nSMap.put("dsig", "http://www.w3.org/2000/09/xmldsig#");

-		VerifySignatureLocation sigLocation = spssFac.createVerifySignatureLocation("//dsig:Signature", nSMap);

-

-		// Zu prüfendes Dokument und Signaturposition zusammenfassen

-

-		VerifySignatureInfo sigInfo = spssFac.createVerifySignatureInfo(sigDocContent1, sigLocation);

-

-		// Prüfrequest zusammenstellen

-		VerifyXMLSignatureRequest verifyRequest = spssFac.createVerifyXMLSignatureRequest(null, // Wird Prüfzeit nicht

-																								// angegeben, wird

-																								// aktuelle Zeit

-																								// verwendet

-				sigInfo, null, // Keine Ergänzungsobjekte notwendig

-				null, // Signaturmanifest-Prüfung soll nicht durchgeführt werden

-				false, // Hash-Inputdaten, d.h. tatsächlich signierte Daten werden nicht zurückgeliefert

-				"MOAIDBuergerkartePersonenbindungMitTestkarten");// TODO load from config

-		// "Test-Signaturdienste"); // ID des verwendeten Vertrauensprofils

-

-		VerifyXMLSignatureResponse verifyResponse = null;

-		try {

-			// Aufruf der Signaturprüfung

-			verifyResponse = sigVerifyService.verifyXMLSignature(verifyRequest);

-		} catch (MOAException e) {

-			// Service liefert Fehler

-			System.err.println("Die Signaturprüfung hat folgenden Fehler geliefert:");

-			System.err.println("Fehlercode: " + e.getMessageId());

-			System.err.println("Fehlernachricht: " + e.getMessage());

-			throw e;

-		}

-

-		return verifyResponse;

-	}

-

-	at.gv.egovernment.moa.id.auth.data.VerifyXMLSignatureResponse convert(

-			VerifyXMLSignatureResponse xMLVerifySignatureResponse) {

-		at.gv.egovernment.moa.id.auth.data.VerifyXMLSignatureResponse response = new at.gv.egovernment.moa.id.auth.data.VerifyXMLSignatureResponse();

-		response.setCertificateCheckCode(xMLVerifySignatureResponse.getCertificateCheck().getCode());

-		response.setPublicAuthority(xMLVerifySignatureResponse.getSignerInfo().isPublicAuthority());

-		// response.setPublicAuthorityCode(publicAuthorityCode)

-		response.setQualifiedCertificate(xMLVerifySignatureResponse.getSignerInfo().isQualifiedCertificate());

-		response.setSignatureCheckCode(xMLVerifySignatureResponse.getSignatureCheck().getCode());

-		response.setSignatureManifestCheckCode(xMLVerifySignatureResponse.getSignatureManifestCheck().getCode());

-		// response.setSigningDateTime()

-		// response.setX509certificate(x509certificate)

-		response.setXmlDSIGManifestCheckCode(xMLVerifySignatureResponse.getSignatureManifestCheck().getCode());

-		// response.setXmlDSIGManigest(xMLVerifySignatureResponse.getSignatureManifestCheck())

-		// response.setXmlDsigSubjectName(xmlDsigSubjectName)

-		return response;

-	}

-

-}

diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/CreateStorkAuthRequestFormTask.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/CreateStorkAuthRequestFormTask.java
deleted file mode 100644
index 138776976..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/CreateStorkAuthRequestFormTask.java
+++ /dev/null
@@ -1,447 +0,0 @@
-package at.gv.egovernment.moa.id.auth.modules.stork.tasks;

-

-import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.PARAM_SESSIONID;

-

-import java.io.IOException;

-import java.io.StringWriter;

-import java.math.BigInteger;

-import java.net.URL;

-import java.security.NoSuchAlgorithmException;

-import java.text.SimpleDateFormat;

-import java.util.ArrayList;

-import java.util.Collection;

-import java.util.Date;

-import java.util.List;

-

-import javax.servlet.http.HttpServletRequest;

-import javax.servlet.http.HttpServletResponse;

-

-import org.apache.commons.io.IOUtils;

-import org.apache.commons.lang3.BooleanUtils;

-import org.apache.commons.lang3.StringUtils;

-import org.apache.velocity.Template;

-import org.apache.velocity.VelocityContext;

-import org.apache.velocity.app.VelocityEngine;

-import org.opensaml.common.IdentifierGenerator;

-import org.opensaml.common.impl.SecureRandomIdentifierGenerator;

-import org.w3c.dom.DOMException;

-

-import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;

-import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;

-import at.gv.egovernment.moa.id.auth.BaseAuthenticationServer;

-import at.gv.egovernment.moa.id.auth.builder.CreateXMLSignatureRequestBuilder;

-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

-import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;

-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

-import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

-import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;

-import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;

-import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;

-import at.gv.egovernment.moa.id.config.ConfigurationException;

-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;

-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;

-import at.gv.egovernment.moa.id.config.stork.CPEPS;

-import at.gv.egovernment.moa.id.config.stork.STORKConfig;

-import at.gv.egovernment.moa.id.config.stork.StorkAttribute;

-import at.gv.egovernment.moa.id.moduls.IRequest;

-import at.gv.egovernment.moa.id.moduls.RequestStorage;

-import at.gv.egovernment.moa.id.process.api.ExecutionContext;

-import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;

-import at.gv.egovernment.moa.id.util.ParamValidatorUtils;

-import at.gv.egovernment.moa.id.util.VelocityProvider;

-import at.gv.egovernment.moa.logging.Logger;

-import eu.stork.oasisdss.api.AdditionalProfiles;

-import eu.stork.oasisdss.api.ApiUtils;

-import eu.stork.oasisdss.api.Profiles;

-import eu.stork.oasisdss.api.QualityLevels;

-import eu.stork.oasisdss.api.SignatureTypes;

-import eu.stork.oasisdss.api.exceptions.ApiUtilsException;

-import eu.stork.oasisdss.profile.AnyType;

-import eu.stork.oasisdss.profile.DocumentType;

-import eu.stork.oasisdss.profile.SignRequest;

-import eu.stork.peps.auth.commons.PEPSUtil;

-import eu.stork.peps.auth.commons.PersonalAttribute;

-import eu.stork.peps.auth.commons.PersonalAttributeList;

-import eu.stork.peps.auth.commons.STORKAuthnRequest;

-import eu.stork.peps.auth.engine.STORKSAMLEngine;

-import eu.stork.peps.exceptions.STORKSAMLEngineException;

-

-/**

- * Creates a SAML2 STORK authentication request, embeds it in a form (in order to satisfy saml post binging) and returns the form withing the HttpServletResponse.<p/>

- * In detail:

- * <ul>

- * <li>Validates the stork configuration in order to make sure the selected country is supported.</li>

- * <li>Puts a flag ({@link #PROCESS_CTX_KEY_CPEPS_ISXMLSIGSUPPORTED}) into the ExecutionContext reflecting the capability of the C-PEPS to create xml signatures.</li>

- * <li>Invokes {@link AuthenticationServer#startSTORKAuthentication(HttpServletRequest, HttpServletResponse, AuthenticationSession)} which</li>

- * <ul>

- * <li>Creates and signs a SAML2 stork authentication request.</li>

- * <li>Creates a signature request for auth block signature (either to be performed by the C-PEPS or locally).</li>

- * <li>Using the velocity template engine in order to create a form with the embedded stork request.</li>

- * <li>Writes the form to the response output stream.</li>

- * </ul>

- * </ul>

- * Expects:

- * <ul>

- * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>

- * <li>Property {@code ccc} set within the moa session.</li>

- * </ul>

- * Result:

- * <ul>

- * <li>Form containing a SAML2 Stork authentication request and an action url pointing to the selected C-PEPS.</li>

- * <li>Assertion consumer URL for C-PEPS set either to {@code /PEPSConnector} in case of a C-PEPS supporting xml signatures or {@code /PEPSConnectorWithLocalSigning} if the selected C-PEPS does not support xml signatures.</li>

- * <li>In case of a C-PEPS not supporting xml signature: moasession with set signedDoc property (containing the signature request for local signing).</li>

- * <li>ExecutionContext contains the boolean flag {@link #PROCESS_CTX_KEY_CPEPS_ISXMLSIGSUPPORTED}.

- * </ul>

- * Code taken from {@link StartAuthenticationBuilder#build(AuthenticationSession, HttpServletRequest, HttpServletResponse)}.<br/>

- * Using {@link AuthenticationServer#startSTORKAuthentication(HttpServletRequest, HttpServletResponse, AuthenticationSession)}

- * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)

- */

-public class CreateStorkAuthRequestFormTask extends AbstractAuthServletTask {

-

-	/**

-	 * Boolean value reflecting the capability of the selected c-peps of creating xml signatures.

-	 */

-	public static final String PROCESS_CTX_KEY_CPEPS_ISXMLSIGSUPPORTED = "C-PEPS:XMLSignatureSupported";

-

-	@Override

-	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)

-			throws TaskExecutionException {

-

-		String pendingRequestID = null;

-		String sessionID = null;

-		try {

-			setNoCachingHeaders(resp);

-

-			sessionID = (String) executionContext.get(PARAM_SESSIONID);

-			pendingRequestID = (String) executionContext.get("pendingRequestID");

-			String ccc = (String) executionContext.get("CCC");

-			

-			

-			// check parameter

-			if (!ParamValidatorUtils.isValidSessionID(sessionID)) {

-				throw new WrongParametersException("CreateStorkAuthRequestFormTask", PARAM_SESSIONID, "auth.12");

-			}

-			AuthenticationSession moasession = BaseAuthenticationServer.getSession(sessionID);			

-			IRequest pendingReq = RequestStorage.getPendingRequest(pendingRequestID);

-			

-			if (StringUtils.isEmpty(ccc)) {

-				// illegal state; task should not have been executed without a selected country

-				throw new AuthenticationException("stork.22", new Object[] { sessionID });

-				

-			}

-			MOAReversionLogger.getInstance().logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_STORK_REQUESTED);

-			

-			STORKConfig storkConfig = AuthConfigurationProviderFactory.getInstance().getStorkConfig();

-			if (!storkConfig.isSTORKAuthentication(moasession.getCcc())) {

-				throw new AuthenticationException("stork.23", new Object[] { moasession.getCcc(), sessionID });

-			}

-

-			// STORK authentication

-			// cpeps cannot be null

-			CPEPS cpeps = storkConfig.getCPEPS(ccc);

-			Logger.debug("Found C-PEPS configuration for citizen of country: " + moasession.getCcc());

-			executionContext.put(PROCESS_CTX_KEY_CPEPS_ISXMLSIGSUPPORTED, cpeps.isXMLSignatureSupported());

-

-			//add selected Country-Code to MOASession DAO 

-			moasession.setCcc(ccc);

-			

-			Logger.info("Starting STORK authentication for a citizen of country: " + moasession.getCcc());

-			startSTORKAuthentication(req, resp, moasession, pendingReq);

-

-		} catch (MOAIDException ex) {

-			throw new TaskExecutionException(ex.getMessage(), ex);

-

-		} catch (Exception e) {

-			Logger.error("CreateStorkAuthRequestFormTask has an interal Error.", e);

-			throw new TaskExecutionException("CreateStorkAuthRequestFormTask has an interal Error.", e);

-			

-		}

-

-		finally {

-			

-		}

-	}

-	

-	/**

-	 * Starts a MOA-ID authentication process using STORK

-	 *

-	 * @param req                HttpServletRequest

-	 * @param resp               HttpServletResponse

-	 * @param pendingReq 

-	 * @param ccc                Citizen country code

-	 * @param oaURL              URL of the online application

-	 * @param target             Target parameter

-	 * @param targetFriendlyName Friendly Name of Target

-	 * @param authURL            Authentication URL

-	 * @param sourceID           SourceID parameter

-	 * @throws MOAIDException

-	 * @throws AuthenticationException

-	 * @throws WrongParametersException

-	 * @throws ConfigurationException

-	 */

-	public void startSTORKAuthentication(

-			HttpServletRequest req,

-			HttpServletResponse resp,

-			AuthenticationSession moasession, IRequest pendingReq) throws MOAIDException, AuthenticationException, WrongParametersException, ConfigurationException {

-

-		if (moasession == null) {

-			throw new AuthenticationException("auth.18", new Object[]{});

-		}

-

-		//read configuration paramters of OA

-		OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(moasession.getPublicOAURLPrefix());

-		if (oaParam == null)

-			throw new AuthenticationException("auth.00", new Object[]{moasession.getPublicOAURLPrefix()});

-

-		//Start of STORK Processing

-		STORKConfig storkConfig = AuthConfigurationProviderFactory.getInstance().getStorkConfig();

-

-		CPEPS cpeps = storkConfig.getCPEPS(moasession.getCcc());

-

-		Logger.debug("Preparing to assemble STORK AuthnRequest with the following values:");

-		String destination = cpeps.getPepsURL().toExternalForm();

-		Logger.debug("C-PEPS URL: " + destination);

-

-

-		String issuerValue = pendingReq.getAuthURL();

-		//        String acsURL = new DataURLBuilder().buildDataURL(issuerValue, 

-		//    			PEPSConnectorServlet.PEPSCONNECTOR_SERVLET_URL_PATTERN, moasession.getSessionID());

-

-

-		String providerName = oaParam.getFriendlyName();

-		Logger.debug("Issuer value: " + issuerValue);

-

-		// prepare collection of required attributes

-		// - attributes for online application

-		Collection<StorkAttribute> attributesFromConfig = oaParam.getRequestedSTORKAttributes();

-

-		// - prepare attribute list

-		PersonalAttributeList attributeList = new PersonalAttributeList();

-

-		// - fill container

-		for (StorkAttribute current : attributesFromConfig) {

-			PersonalAttribute newAttribute = new PersonalAttribute();

-			newAttribute.setName(current.getName());

-

-			boolean globallyMandatory = false;

-			for (StorkAttribute currentGlobalAttribute : storkConfig.getStorkAttributes())

-				if (current.getName().equals(currentGlobalAttribute.getName())) {

-					globallyMandatory = BooleanUtils.isTrue(currentGlobalAttribute.getMandatory());

-					break;

-				}

-

-			newAttribute.setIsRequired(current.getMandatory() || globallyMandatory);

-			attributeList.add(newAttribute);

-		}

-

-		// add sign request

-		PersonalAttribute newAttribute = new PersonalAttribute();

-		newAttribute.setName("signedDoc");

-		newAttribute.setIsRequired(true);

-		List<String> value = new ArrayList<String>();

-

-		Logger.debug("PEPS supports XMLSignatures:"+cpeps.isXMLSignatureSupported());

-		String acsURL;

-		if(cpeps.isXMLSignatureSupported())//Send SignRequest to PEPS

-		{

-			//solve Problem with sessionIDs 

-			acsURL = issuerValue + PepsConnectorTask.PEPSCONNECTOR_SERVLET_URL_PATTERN;

-			

-			value.add(generateDssSignRequest(CreateXMLSignatureRequestBuilder.buildForeignIDTextToBeSigned("wie im  Signaturzertifikat (as in my signature certificate)", oaParam, moasession),

-					"application/xhtml+xml", moasession.getCcc()));

-			newAttribute.setValue(value);

-			attributeList.add(newAttribute);

-			

-			// TODO[branch]: STORK AuthReq CPEPS acsURL "/PEPSConnector"

-		}

-		else//Process SignRequest locally with MOCCA

-		{

-			String target = moasession.getTarget();

-			moasession.setTarget("AT");

-			String signedDoc = (generateDssSignRequest(CreateXMLSignatureRequestBuilder.buildForeignIDTextToBeSigned("wie im  Signaturzertifikat (as in my signature certificate)", oaParam, moasession),

-					"application/xhtml+xml", "AT"));//moasession.getCcc()

-			moasession.setTarget(target);

-			Logger.warn("signedDoc to store:"+signedDoc);

-			//attributeList.add(newAttribute);

-

-			//store SignRequest for later...

-			moasession.setSignedDoc(signedDoc);

-

-			acsURL = issuerValue + AbstractPepsConnectorWithLocalSigningTask.PEPSCONNECTOR_SERVLET_URL_PATTERN;

-			// TODO[branch]: STORK AuthReq acsURL "/PEPSConnectorWithLocalSigning"

-			try {

-				AuthenticationSessionStoreage.storeSession(moasession);

-			} catch (MOADatabaseException e) {

-				// TODO Auto-generated catch block

-				e.printStackTrace();

-			}

-

-		}

-		Logger.debug("MOA Assertion Consumer URL (PEPSConnctor): " + acsURL);

-

-		if (Logger.isDebugEnabled()) {

-			Logger.debug("The following attributes are requested for this OA:");

-			for (StorkAttribute logReqAttr : attributesFromConfig)

-				Logger.debug("OA specific requested attribute: " + logReqAttr.getName() + ", isRequired: " + logReqAttr.getMandatory());

-		}

-

-		//TODO: check Target in case of SSO!!

-		String spSector = StringUtils.isEmpty(moasession.getTarget()) ? "Business" : moasession.getTarget();

-		String spInstitution = StringUtils.isEmpty(oaParam.getFriendlyName()) ? "UNKNOWN" : oaParam.getFriendlyName();

-		String spApplication = spInstitution;

-		String spCountry = "AT";  // intentionally set AT - the flow is limited on that use case only

-

-		//generate AuthnRquest

-		STORKAuthnRequest authnRequest = new STORKAuthnRequest();

-		authnRequest.setDestination(destination);

-		authnRequest.setAssertionConsumerServiceURL(acsURL);//PEPSConnectorWithLocalSigning

-		authnRequest.setProviderName(providerName);

-		authnRequest.setIssuer(issuerValue);

-		authnRequest.setQaa(oaParam.getQaaLevel());

-		authnRequest.setSpInstitution(spInstitution);

-		authnRequest.setSpCountry(spCountry);

-		authnRequest.setSpApplication(spApplication);

-		authnRequest.setSpSector(spSector);

-		authnRequest.setPersonalAttributeList(attributeList);

-

-		//TODO change

-		authnRequest.setEIDCrossBorderShare(true);

-		authnRequest.setEIDCrossSectorShare(true);

-		authnRequest.setEIDSectorShare(true);

-

-		authnRequest.setCitizenCountryCode(moasession.getCcc());

-

-		Logger.debug("STORK AuthnRequest succesfully assembled.");

-

-		STORKSAMLEngine samlEngine = STORKSAMLEngine.getInstance("outgoing");

-

-		if (samlEngine == null) {

-			Logger.error("Could not initalize STORK SAML engine.");

-			throw new MOAIDException("stork.00", null);

-		}

-

-		try {

-			authnRequest = samlEngine.generateSTORKAuthnRequest(authnRequest);

-		} catch (STORKSAMLEngineException e) {

-			Logger.error("Could not sign STORK SAML AuthnRequest.", e);

-			throw new MOAIDException("stork.00", null);

-		}

-

-		Logger.info("STORK AuthnRequest successfully signed!");

-

-		//validate AuthnRequest

-		try {

-			samlEngine.validateSTORKAuthnRequest(authnRequest.getTokenSaml());

-		} catch (STORKSAMLEngineException e) {

-			Logger.error("STORK SAML AuthnRequest not valid.", e);

-			throw new MOAIDException("stork.01", null);

-		}

-

-		Logger.debug("STORK AuthnRequest successfully internally validated.");

-

-		//send

-		moasession.setStorkAuthnRequest(authnRequest);

-

-		// do PEPS-conform logging for easier evaluation

-		try {

-			// 2015-03-12 16:44:27.144#S-PEPS receives request from SP#spurl#spepsurl#spapp#spdomain#citizen country#qaa#msghash#msg_id id1#

-			Logger.info(new SimpleDateFormat("yyyy-MM-dd HH:mm:ss.SSS").format(new Date()) + "#S-PEPS receives request from SP#" + 

-					moasession.getPublicOAURLPrefix() + "#" + issuerValue + "#" + spApplication + "#" + 

-					new URL(moasession.getPublicOAURLPrefix()).getHost() + "#" + moasession.getCcc() + "#" + oaParam.getQaaLevel() +

-					"#_hash_#" + moasession.getProcessInstanceId() + "#");

-		} catch (Exception e1) {

-			Logger.info("STORK PEPS conform logging failed because of: " + e1.getMessage());

-		}

-

-		AuthenticationSessionStoreage.changeSessionID(moasession, authnRequest.getSamlId());

-

-

-		Logger.info("Preparing to send STORK AuthnRequest.");

-		Logger.info("prepared STORKAuthnRequest: ");

-		Logger.info(new String(authnRequest.getTokenSaml()));

-

-		try {

-			Logger.trace("Initialize VelocityEngine...");

-

-			VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();

-			Template template = velocityEngine.getTemplate("/resources/templates/saml2-post-binding-moa.vm");

-			VelocityContext context = new VelocityContext();

-			context.put("SAMLRequest", PEPSUtil.encodeSAMLToken(authnRequest.getTokenSaml()));

-			context.put("RelayState", moasession.getSessionID());

-			context.put("action", destination);

-

-			StringWriter writer = new StringWriter();

-			template.merge(context, writer);

-

-			// TODO[branch]: SAML2 Form Submit to CPEPS, response to acsURL Servlet

-			

-			resp.setContentType("text/html;charset=UTF-8");            

-			resp.getOutputStream().write(writer.toString().getBytes("UTF-8"));

-

-		} catch (Exception e) {

-			Logger.error("Error sending STORK SAML AuthnRequest.", e);

-			throw new MOAIDException("stork.02", new Object[]{destination});

-

-		}

-

-		Logger.info("STORK AuthnRequest successfully successfully prepared for client with target location: " + authnRequest.getDestination());

-		MOAReversionLogger.getInstance().logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_PEPS_REQUESTED, authnRequest.getDestination());

-		

-		// do PEPS-conform logging for easier evaluation

-		try {

-			// 2015-03-12 16:44:27.144#S-PEPS generates request to C-PEPS#spepsurl#cpepsurl#spapp#spdomain#citizen country#qaa#msghash#msg_id id1#id2#

-			Logger.info(new SimpleDateFormat("yyyy-MM-dd HH:mm:ss.SSS").format(new Date()) + "#S-PEPS generates request to C-PEPS#" + 

-					issuerValue + "#" + destination + "#" + spApplication + "#" + 

-					new URL(moasession.getPublicOAURLPrefix()).getHost() + "#" + moasession.getCcc() + "#" + oaParam.getQaaLevel() +

-					"#_hash_#" + moasession.getProcessInstanceId() + "#" + authnRequest.getSamlId() + "#");

-		} catch (Exception e1) {

-			Logger.info("STORK PEPS conform logging failed because of: " + e1.getMessage());

-		}

-	}

-

-	private String generateDssSignRequest(String text, String mimeType, String citizenCountry) {

-		IdentifierGenerator idGenerator;

-		try {

-			idGenerator = new SecureRandomIdentifierGenerator();

-

-			DocumentType doc = new DocumentType();

-			doc.setBase64XML(text.getBytes("UTF-8"));

-			doc.setID(idGenerator.generateIdentifier());

-

-			SignRequest request = new SignRequest();

-			request.setInputDocuments(ApiUtils.createInputDocuments(doc));

-

-			String id = idGenerator.generateIdentifier();

-			request.setRequestID(id);

-			request.setDocUI(id);

-

-			request.setProfile(Profiles.XADES_BES.toString());

-			request.setNumberOfSigners(BigInteger.ONE);

-			request.setTargetCountry(citizenCountry);

-

-			// no, no todo. PEPS will alter this value anyhow.

-			request.setReturnURL("http://invalid_return");

-

-			AnyType required = new AnyType();

-			required.getAny().add(ApiUtils.createSignatureType(SignatureTypes.XMLSIG_RFC3275.toString()));

-			required.getAny().add(ApiUtils.createAdditionalProfile(AdditionalProfiles.XADES.toString()));

-			required.getAny().add(ApiUtils.createQualityRequirements(QualityLevels.QUALITYLEVEL_QUALIFIEDSIG));

-			required.getAny().add(ApiUtils.createIncludeObject(doc));

-			request.setOptionalInputs(required);

-

-			return IOUtils.toString(ApiUtils.marshalToInputStream(request));

-		} catch (NoSuchAlgorithmException e) {

-			Logger.error("Cannot generate id", e);

-			throw new RuntimeException(e);

-		} catch (ApiUtilsException e) {

-			Logger.error("Could not create SignRequest", e);

-			throw new RuntimeException(e);

-		} catch (DOMException e) {

-			Logger.error("Could not create SignRequest", e);

-			throw new RuntimeException(e);

-		} catch (IOException e) {

-			Logger.error("Could not create SignRequest", e);

-			throw new RuntimeException(e);

-		}

-	}

-}

diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorHandleLocalSignResponseTask.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorHandleLocalSignResponseTask.java
deleted file mode 100644
index 7b9fa3f12..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorHandleLocalSignResponseTask.java
+++ /dev/null
@@ -1,228 +0,0 @@
-package at.gv.egovernment.moa.id.auth.modules.stork.tasks;

-

-import iaik.x509.X509Certificate;

-

-import java.io.IOException;

-import java.io.StringWriter;

-import java.util.ArrayList;

-import java.util.List;

-

-import javax.servlet.http.HttpServletRequest;

-import javax.servlet.http.HttpServletResponse;

-import javax.xml.transform.Source;

-import javax.xml.transform.stream.StreamSource;

-

-import org.apache.commons.codec.binary.Base64;

-import org.apache.velocity.Template;

-import org.apache.velocity.VelocityContext;

-import org.apache.velocity.app.VelocityEngine;

-

-import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;

-import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;

-import at.gv.egovernment.moa.id.auth.BaseAuthenticationServer;

-import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;

-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

-import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;

-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

-import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;

-import at.gv.egovernment.moa.id.auth.stork.STORKException;

-

-import at.gv.egovernment.moa.id.moduls.IRequest;

-import at.gv.egovernment.moa.id.moduls.ModulUtils;

-import at.gv.egovernment.moa.id.moduls.RequestStorage;

-import at.gv.egovernment.moa.id.process.api.ExecutionContext;

-import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;

-import at.gv.egovernment.moa.id.util.VelocityProvider;

-import at.gv.egovernment.moa.logging.Logger;

-import at.gv.egovernment.moa.spss.api.xmlverify.VerifyXMLSignatureResponse;

-import at.gv.egovernment.moa.util.Base64Utils;

-import eu.stork.oasisdss.api.ApiUtils;

-import eu.stork.oasisdss.profile.SignResponse;

-import eu.stork.peps.auth.commons.IPersonalAttributeList;

-import eu.stork.peps.auth.commons.PersonalAttribute;

-

-/**

- * Processes the citizen's signature, creates identity link using szr gateway and finalizes authentication.

- * <p/>

- * In detail:

- * <ul>

- * <li>Changes moa session id.</li>

- * <li>Decodes and validates the sign response, extracting the citizen's signature.</li>

- * <li>Verifies the citizen's signature.</li>

- * <li>Create {@code signedDoc} attribute.</li>

- * <li>Retrieve identity link from SZR gateway using the citizen's signature.</li>

- * <li>If the S-PEPS did not provide any gender information, the szr gateway will not be able to issue an identity link.

- * Therefore a form is presented asking for the subject's gender. The form finally submits the user back to the

- * {@code /PepsConnectorWithLocalSigning} servlet (this task).</li>

- * <li>The moa session is updated with authentication information.</li>

- * <li>Change moa session id.</li>

- * <li>Redirects back to {@code /dispatcher} in order to finalize the authentication.</li>

- * </ul>

- * Expects:

- * <ul>

- * <li>HttpServletRequest parameter {@code moaSessionID}</li>

- * <li>HttpServletRequest parameter {@code signresponse}</li>

- * </ul>

- * Result:

- * <ul>

- * <li>Updated moa id session (signed auth block, signer certificate etc.)</li>

- * <li>Redirect to {@code /dispatcher}.</li>

- * <li>{@link ExecutionContext} contains boolean flag {@code identityLinkAvailable} indicating if an identitylink has been successfully creates or not.</li>

- * </ul>

- * Possible branches:

- * <ul>

- * <li>In case the szr gateway throws exception due to missing gender information:

- * <ul>

- * <li>Returns a form for gender selection with action url back to this servlet/task.</li>

- * </ul>

- * </li>

- * </ul>

- * Code taken from {@link at.gv.egovernment.moa.id.auth.servlet.PEPSConnectorWithLocalSigningServlet}.<br/>

- *

- * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)

- */

-public class PepsConnectorHandleLocalSignResponseTask extends AbstractPepsConnectorWithLocalSigningTask {

-

-	@Override

-	public void execute(ExecutionContext executionContext, HttpServletRequest request, HttpServletResponse response)

-			throws TaskExecutionException {

-		String moaSessionID = request.getParameter("moaSessionID");

-		String signResponse = request.getParameter("signresponse");

-		Logger.info("moaSessionID:" + moaSessionID);

-		Logger.info("signResponse:" + signResponse);

-

-		if (moaSessionID != null && signResponse != null) {

-			// redirect from oasis with signresponse

-			handleSignResponse(executionContext, request, response);

-		} else {

-			// should not occur

-			throw new TaskExecutionException("Parsing mulitpart/form-data request parameters failed", null);

-		}

-		return;

-	}

-

-	private void handleSignResponse(ExecutionContext executionContext, HttpServletRequest request,

-			HttpServletResponse response) throws TaskExecutionException {

-		Logger.info("handleSignResponse started");

-		String moaSessionID = request.getParameter("moaSessionID");

-		String signResponse = request.getParameter("signresponse");

-		Logger.info("moaSessionID:" + moaSessionID);

-		Logger.info("signResponse:" + signResponse);

-		String pendingRequestID = null;

-		try {

-

-			// load MOASession from database

-			AuthenticationSession moaSession = BaseAuthenticationServer.getSession(moaSessionID);

-			// change MOASessionID

-			moaSessionID = AuthenticationSessionStoreage.changeSessionID(moaSession);

-

-			pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(moaSessionID);

-			IRequest pendingReq = RequestStorage.getPendingRequest(pendingRequestID);

-			

-			Logger.info("pendingRequestID:" + pendingRequestID);

-			String signResponseString = new String(Base64Utils.decode(signResponse, false), "UTF8");

-			Logger.info("RECEIVED signresponse:" + signResponseString);

-			// create SignResponse object

-			Source response1 = new StreamSource(new java.io.StringReader(signResponseString));

-			SignResponse dssSignResponse = ApiUtils.unmarshal(response1, SignResponse.class);

-

-			// SignResponse dssSignResponse = (SignResponse) ApiUtils.unmarshal(new StreamSource(new

-			// java.io.StringReader(Base64.signResponse)));

-

-			String citizenSignature = getCitizienSignatureFromSignResponse(dssSignResponse);

-

-			// memorize signature into authblock

-			moaSession.setAuthBlock(citizenSignature);

-

-			X509Certificate cert = getSignerCertificate(citizenSignature);

-			moaSession.setSignerCertificate(cert);

-			VerifyXMLSignatureResponse xMLVerifySignatureResponse = verifyXMLSignature(citizenSignature);

-			at.gv.egovernment.moa.id.auth.data.VerifyXMLSignatureResponse tmp = convert(xMLVerifySignatureResponse);

-

-			moaSession.setXMLVerifySignatureResponse(tmp);

-			executionContext.put("identityLinkAvailable", false);

-			try {

-				IPersonalAttributeList personalAttributeList = moaSession.getAuthnResponseGetPersonalAttributeList();

-				// Add SignResponse TODO Add signature (extracted from signResponse)?

-				List<String> values = new ArrayList<String>();

-				values.add(signResponseString);

-				// values.add(citizenSignature);

-				Logger.debug("Assembling signedDoc attribute");

-				PersonalAttribute signedDocAttribute = new PersonalAttribute("signedDoc", false, values, "Available");

-				personalAttributeList.add(signedDocAttribute);

-

-				String authnContextClassRef = moaSession.getAuthnContextClassRef();

-				SZRGInsertion(moaSession, personalAttributeList, authnContextClassRef, citizenSignature);

-				executionContext.put("identityLinkAvailable", true);

-			} catch (STORKException e) {

-				// this is really nasty but we work against the system here. We are supposed to get the gender attribute

-				// from

-				// stork. If we do not, we cannot register the person in the ERnP - we have to have the

-				// gender for the represented person. So here comes the dirty hack.

-				if (e.getCause() instanceof STORKException

-						&& e.getCause().getMessage().equals("gender not found in response")) {

-					try {

-						Logger.trace("Initialize VelocityEngine...");

-

-						VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();

-						Template template = velocityEngine.getTemplate("/resources/templates/fetchGender.html");

-						VelocityContext context = new VelocityContext();

-						context.put("SAMLResponse", request.getParameter("SAMLResponse"));

-						context.put("action", request.getRequestURL());

-

-						StringWriter writer = new StringWriter();

-						template.merge(context, writer);

-						response.getOutputStream().write(writer.toString().getBytes("UTF-8"));

-					} catch (Exception e1) {

-						Logger.error("Error sending gender retrival form.", e1);

-						// httpSession.invalidate();

-						throw new MOAIDException("stork.10", null);

-					}

-

-					return;

-				}

-

-				Logger.error("Error connecting SZR Gateway", e);

-				throw new MOAIDException("stork.10", null);

-			}

-

-			Logger.debug("Add full STORK AuthnResponse to MOA session");

-			moaSession.setStorkAuthnResponse(request.getParameter("SAMLResponse"));// TODO ask Florian/Thomas

-																					// authnResponse?

-			

-			MOAReversionLogger.getInstance().logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_PEPS_RECEIVED);

-			

-			moaSession.setForeigner(true);

-

-			// session is implicit stored in changeSessionID!!!!

-			String newMOASessionID = AuthenticationSessionStoreage.changeSessionID(moaSession);

-

-			Logger.info("Changed MOASession " + moaSessionID + " to Session " + newMOASessionID);

-

-			// redirect

-			String redirectURL = null;

-			redirectURL = new DataURLBuilder().buildDataURL(moaSession.getAuthURL(),

-					ModulUtils.buildAuthURL(moaSession.getModul(), moaSession.getAction(), pendingRequestID),

-					newMOASessionID);

-			redirectURL = response.encodeRedirectURL(redirectURL);

-

-			response.sendRedirect(redirectURL);

-			Logger.info("REDIRECT TO: " + redirectURL);

-

-		} catch (AuthenticationException e) {

-			throw new TaskExecutionException(e.getMessage(), e);

-

-		} catch (MOAIDException e) {

-			throw new TaskExecutionException(e.getMessage(), e);

-

-		} catch (Exception e) {

-			Logger.error("PEPSConnector has an interal Error.", e);

-			throw new TaskExecutionException(e.getMessage(), e);

-		}

-

-		finally {

-			

-		}

-	}

-

-}

diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorHandleResponseWithoutSignatureTask.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorHandleResponseWithoutSignatureTask.java
deleted file mode 100644
index e84c33d5d..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorHandleResponseWithoutSignatureTask.java
+++ /dev/null
@@ -1,451 +0,0 @@
-package at.gv.egovernment.moa.id.auth.modules.stork.tasks;

-

-import iaik.x509.X509Certificate;

-

-import java.io.IOException;

-import java.io.StringWriter;

-import java.util.ArrayList;

-import java.util.Collection;

-import java.util.List;

-

-import javax.servlet.http.HttpServletRequest;

-import javax.servlet.http.HttpServletResponse;

-import javax.xml.transform.Source;

-import javax.xml.transform.stream.StreamSource;

-

-import org.apache.commons.codec.binary.Base64;

-import org.apache.commons.io.IOUtils;

-import org.apache.commons.lang.StringEscapeUtils;

-import org.apache.velocity.Template;

-import org.apache.velocity.VelocityContext;

-import org.apache.velocity.app.VelocityEngine;

-import org.opensaml.saml2.core.StatusCode;

-

-import at.gv.egovernment.moa.id.auth.BaseAuthenticationServer;

-import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;

-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

-import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;

-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

-import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;

-import at.gv.egovernment.moa.id.auth.stork.STORKException;

-import at.gv.egovernment.moa.id.auth.stork.STORKResponseProcessor;

-

-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;

-import at.gv.egovernment.moa.id.config.stork.StorkAttributeProviderPlugin;

-import at.gv.egovernment.moa.id.moduls.IRequest;

-import at.gv.egovernment.moa.id.moduls.ModulUtils;

-import at.gv.egovernment.moa.id.moduls.RequestStorage;

-import at.gv.egovernment.moa.id.process.api.ExecutionContext;

-import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;

-import at.gv.egovernment.moa.id.util.HTTPUtils;

-import at.gv.egovernment.moa.id.util.VelocityProvider;

-import at.gv.egovernment.moa.logging.Logger;

-import at.gv.egovernment.moa.util.Base64Utils;

-import at.gv.egovernment.moa.util.StringUtils;

-import eu.stork.oasisdss.api.ApiUtils;

-import eu.stork.oasisdss.profile.SignRequest;

-import eu.stork.oasisdss.profile.SignResponse;

-import eu.stork.peps.auth.commons.IPersonalAttributeList;

-import eu.stork.peps.auth.commons.PEPSUtil;

-import eu.stork.peps.auth.commons.PersonalAttribute;

-import eu.stork.peps.auth.commons.STORKAuthnRequest;

-import eu.stork.peps.auth.commons.STORKAuthnResponse;

-import eu.stork.peps.auth.engine.STORKSAMLEngine;

-import eu.stork.peps.exceptions.STORKSAMLEngineException;

-

-/**

- * Validates the SAML response from C-PEPS.

- * <p/>

- * In detail:

- * <ul>

- * <li>Decodes and validates SAML response from C-PEPS.</li>

- * <li>Retrieves the moa session using the session id provided by HttpServletRequest parameter {@code RelayState} or by {@code inResponseTo} attribute of the saml response.</li>

- * <li>Store saml response in moa session.</li>

- * <li>Change moa session id.</li>

- * <li>Redirect to {@code /PEPSConnectorWithLocalSigning}, with providing the moa session id as request parameter.</li>

- * </ul>

- * Expects:

- * <ul>

- * <li>HttpServletRequest parameter {@code moaSessionID} <strong>to be {@code null}</strong></li>

- * <li>HttpServletRequest parameter {@code signresponse} <strong>to be {@code null}</strong></li>

- * <li>HttpServletRequest parameter {@code SAMLResponse}</li>

- * <li>Either HttpServletRequest parameter {@code RelayState} or {@code inResponseTo} attribute within the saml response, both reflecting the moa session id.</li>

- * </ul>

- * Result:

- * <ul>

- * <li>Updated moa session (with saml response).</li>

- * <li>Redirect to {@code /PEPSConnectorWithLocalSigning}, with providing the moa session id as request parameter.</li>

- * </ul>

- * Code taken from {@link at.gv.egovernment.moa.id.auth.servlet.PEPSConnectorWithLocalSigningServlet}.<br/>

- *

- * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)

- */

-public class PepsConnectorHandleResponseWithoutSignatureTask extends AbstractPepsConnectorWithLocalSigningTask {

-

-	private String oasisDssWebFormURL = "https://testvidp.buergerkarte.at/oasis-dss/DSSWebFormServlet";

-	// load from config below

-

-	@Override

-	public void execute(ExecutionContext executionContext, HttpServletRequest request, HttpServletResponse response)

-			throws TaskExecutionException {

-		String moaSessionID = request.getParameter("moaSessionID");

-		String signResponse = request.getParameter("signresponse");

-		Logger.info("moaSessionID:" + moaSessionID);

-		Logger.info("signResponse:" + signResponse);

-

-		if (moaSessionID == null && signResponse == null) {

-			// normal saml response

-			handleSAMLResponse(executionContext, request, response);

-

-		} else {

-			// should not occur

-			throw new TaskExecutionException("Parsing mulitpart/form-data request parameters failed", null);

-		}

-		return;

-	}

-

-	private void handleSAMLResponse(ExecutionContext executionContext, HttpServletRequest request,

-			HttpServletResponse response) throws TaskExecutionException {

-		Logger.info("handleSAMLResponse started");

-		String pendingRequestID = null;

-

-		setNoCachingHeaders(response);

-		try {

-			Logger.info("PEPSConnector Servlet invoked, expecting C-PEPS message.");

-			Logger.debug("This ACS endpoint is: " + HTTPUtils.getBaseURL(request));

-

-			Logger.trace("No Caching headers set for HTTP response");

-

-			// check if https or only http

-			super.checkIfHTTPisAllowed(request.getRequestURL().toString());

-

-			Logger.debug("Beginning to extract SAMLResponse out of HTTP Request");

-

-			// extract STORK Response from HTTP Request

-			// Decodes SAML Response

-			byte[] decSamlToken;

-			try {

-				decSamlToken = PEPSUtil.decodeSAMLToken(request.getParameter("SAMLResponse"));

-				Logger.debug("SAMLResponse: " + new String(decSamlToken));

-

-			} catch (NullPointerException e) {

-				Logger.error("Unable to retrieve STORK Response", e);

-				throw new MOAIDException("stork.04", null);

-			}

-

-			// Get SAMLEngine instance

-			STORKSAMLEngine engine = STORKSAMLEngine.getInstance("outgoing");

-

-			STORKAuthnResponse authnResponse = null;

-			try {

-				// validate SAML Token

-				Logger.debug("Starting validation of SAML response");

-				authnResponse = engine.validateSTORKAuthnResponseWithQuery(decSamlToken, (String) request.getRemoteHost());

-				Logger.info("SAML response succesfully verified!");

-			} catch (STORKSAMLEngineException e) {

-				Logger.error("Failed to verify STORK SAML Response", e);

-				throw new MOAIDException("stork.05", null);

-			}

-

-			Logger.info("STORK SAML Response message succesfully extracted");

-			Logger.debug("STORK response: ");

-			Logger.debug(authnResponse.toString());

-

-			Logger.debug("Trying to find MOA Session-ID ...");

-			// String moaSessionID = request.getParameter(PARAM_SESSIONID);

-			// first use SAML2 relayState

-			String moaSessionID = request.getParameter("RelayState");

-

-			// escape parameter strings

-			moaSessionID = StringEscapeUtils.escapeHtml(moaSessionID);

-

-			// check if SAML2 relaystate includes a MOA sessionID

-			if (StringUtils.isEmpty(moaSessionID)) {

-				// if relaystate is emtpty, use SAML response -> inResponseTo element as session identifier

-

-				moaSessionID = authnResponse.getInResponseTo();

-				moaSessionID = StringEscapeUtils.escapeHtml(moaSessionID);

-

-				if (StringUtils.isEmpty(moaSessionID)) {

-					// No authentication session has been started before

-					Logger.error("MOA-SessionID was not found, no previous AuthnRequest had been started");

-					Logger.debug("PEPSConnectorURL was: " + request.getRequestURL());

-					throw new AuthenticationException("auth.02", new Object[] { moaSessionID });

-

-				} else

-					Logger.trace("Use MOA SessionID " + moaSessionID + " from AuthnResponse->inResponseTo attribute.");

-

-			} else

-				// Logger.trace("MOA SessionID " + moaSessionID + " is found in http GET parameter.");

-				Logger.trace("MOA SessionID " + moaSessionID + " is found in SAML2 relayState.");

-

-			/*

-			 * INFO!!!! SAML message IDs has an different format then MOASessionIDs This is only a workaround because

-			 * many PEPS does not support SAML2 relayState or MOASessionID as AttributConsumerServiceURL GET parameter

-			 */

-			// if (!ParamValidatorUtils.isValidSessionID(moaSessionID))

-			// throw new WrongParametersException("VerifyAuthenticationBlock", PARAM_SESSIONID, "auth.12");

-

-			pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(moaSessionID);

-			IRequest pendingReq = RequestStorage.getPendingRequest(pendingRequestID);

-			

-			// load MOASession from database

-			AuthenticationSession moaSession = BaseAuthenticationServer.getSession(moaSessionID);

-			// change MOASessionID

-			moaSessionID = AuthenticationSessionStoreage.changeSessionID(moaSession);

-

-			Logger.info("Found MOA sessionID: " + moaSessionID);

-

-			String statusCodeValue = authnResponse.getStatusCode();

-

-			if (!statusCodeValue.equals(StatusCode.SUCCESS_URI)) {

-				Logger.error("Received ErrorResponse from PEPS: " + statusCodeValue);

-				throw new MOAIDException("stork.06", new Object[] { statusCodeValue });

-			}

-

-			Logger.info("Got SAML response with authentication success message.");

-

-			Logger.debug("MOA session is still valid");

-

-			STORKAuthnRequest storkAuthnRequest = moaSession.getStorkAuthnRequest();

-

-			if (storkAuthnRequest == null) {

-				Logger.error("Could not find any preceeding STORK AuthnRequest to this MOA session: " + moaSessionID);

-				throw new MOAIDException("stork.07", null);

-			}

-

-			Logger.debug("Found a preceeding STORK AuthnRequest to this MOA session: " + moaSessionID);

-

-

-			// first, try to fetch the attributes from the list of total attributes. Note that this very list is only filled

-			// with ALL attributes when there is more than one assertion in the SAML2 STORK message.  

-			IPersonalAttributeList attributeList = authnResponse.getTotalPersonalAttributeList();

-

-			// if the list is empty, there was just one assertion... probably

-			if(attributeList.isEmpty())

-				attributeList = authnResponse.getPersonalAttributeList();

-

-			// //////////// incorporate gender from parameters if not in stork response

-			// but first, check if we have a representation case

-			if (STORKResponseProcessor.hasAttribute("mandateContent", attributeList)

-					|| STORKResponseProcessor.hasAttribute("representative", attributeList)

-					|| STORKResponseProcessor.hasAttribute("represented", attributeList)) {

-				// in a representation case...

-				moaSession.setUseMandate("true");

-

-				// and check if we have the gender value

-				PersonalAttribute gender = attributeList.get("gender");

-				if (null == gender) {

-					String gendervalue = (String) request.getParameter("gender");

-					if (null != gendervalue) {

-						gender = new PersonalAttribute();

-						gender.setName("gender");

-						ArrayList<String> tmp = new ArrayList<String>();

-						tmp.add(gendervalue);

-						gender.setValue(tmp);

-

-						attributeList.add(gender);

-					}

-				}

-			}

-

-			

-			

-			// ////////////////////////////////////////////////////////////////////////

-

-			Logger.debug("Starting extraction of signedDoc attribute");

-			// extract signed doc element and citizen signature

-			String citizenSignature = null;

-			try {

-				PersonalAttribute signedDoc = attributeList.get("signedDoc");

-				String signatureInfo = null;

-				// FIXME: Remove nonsense code (signedDoc attribute... (throw Exception for "should not occur" situations)), adjust error messages in order to reflect the true problem...

-				if (signedDoc != null) {

-					signatureInfo = signedDoc.getValue().get(0);

-					// should not occur

-				} else {

-

-					// store SAMLResponse

-					moaSession.setSAMLResponse(request.getParameter("SAMLResponse"));

-					// store authnResponse

-

-					// moaSession.setAuthnResponse(authnResponse);//not serializable

-					moaSession.setAuthnResponseGetPersonalAttributeList(attributeList);

-

-					String authnContextClassRef = null;

-					try {

-						authnContextClassRef = authnResponse.getAssertions().get(0).getAuthnStatements().get(0)

-								.getAuthnContext().getAuthnContextClassRef().getAuthnContextClassRef();

-					} catch (Throwable e) {

-						Logger.warn("STORK QAA-Level is not found in AuthnResponse. Set QAA Level to requested level");

-					}

-

-					moaSession.setAuthnContextClassRef(authnContextClassRef);

-					moaSession.setReturnURL(request.getRequestURL());

-

-					// load signedDoc

-					String signRequest = moaSession.getSignedDoc();

-

-					// session is implicit stored in changeSessionID!!!!

-					String newMOASessionID = AuthenticationSessionStoreage.changeSessionID(moaSession);

-

-					// set return url to PEPSConnectorWithLocalSigningServlet and add newMOASessionID

-					// signRequest

-

-					String issuerValue = pendingReq.getAuthURL();

-					String acsURL = issuerValue

-							+ AbstractPepsConnectorWithLocalSigningTask.PEPSCONNECTOR_SERVLET_URL_PATTERN;

-

-					String url = acsURL + "?moaSessionID=" + newMOASessionID;

-					// redirect to OASIS module and sign there

-

-					boolean found = false;

-					try {

-						Collection<StorkAttributeProviderPlugin> aps = AuthConfigurationProviderFactory.getInstance()

-								.getOnlineApplicationParameter(moaSession.getPublicOAURLPrefix()).getStorkAPs();

-						Logger.info("Found AttributeProviderPlugins:" + aps.size());

-						for (StorkAttributeProviderPlugin ap : aps) {

-							Logger.info("Found AttributeProviderPlugin attribute:" + ap.getAttributes());

-							if (ap.getAttributes().equalsIgnoreCase("signedDoc")) {

-								// FIXME: A servlet's class field is not thread safe!!!

-								oasisDssWebFormURL = ap.getUrl();

-								found = true;

-								Logger.info("Loaded signedDoc attribute provider url from config:" + oasisDssWebFormURL);

-								break;

-							}

-						}

-					} catch (Exception e) {

-						e.printStackTrace();

-						Logger.error("Loading the signedDoc attribute provider url from config failed");

-					}

-					if (!found) {

-						Logger.error("Failed to load the signedDoc attribute provider url from config");

-					}

-					performRedirect(url, request, response, signRequest);

-

-					return;

-				}

-				

-				// FIXME: This servlet/task is intended to handle peps responses without signature, so why do we try to process that signature here?

-				SignResponse dssSignResponse = (SignResponse) ApiUtils.unmarshal(new StreamSource(

-						new java.io.StringReader(signatureInfo)));

-

-				citizenSignature = getCitizienSignatureFromSignResponse(dssSignResponse);

-

-				// memorize signature into authblock

-				moaSession.setAuthBlock(citizenSignature);

-

-				X509Certificate cert = getSignerCertificate(citizenSignature);

-				moaSession.setSignerCertificate(cert);

-				moaSession.setForeigner(true);

-

-			} catch (Throwable e) {

-				Logger.error("Could not extract citizen signature from C-PEPS", e);

-				throw new MOAIDException("stork.09", null);

-			}

-

-			// FIXME: Same here; we do not have the citizen's signature, so this code might be regarded as dead code.

-			try {

-				SZRGInsertion(moaSession, attributeList, authnResponse.getAssertions()

-						.get(0).getAuthnStatements().get(0).getAuthnContext().getAuthnContextClassRef()

-						.getAuthnContextClassRef(), citizenSignature);

-			} catch (STORKException e) {

-				// this is really nasty but we work against the system here. We are supposed to get the gender attribute

-				// from

-				// stork. If we do not, we cannot register the person in the ERnP - we have to have the

-				// gender for the represented person. So here comes the dirty hack.

-				if (e.getCause() instanceof STORKException

-						&& e.getCause().getMessage().equals("gender not found in response")) {

-					try {

-						Logger.trace("Initialize VelocityEngine...");

-

-						VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();

-						Template template = velocityEngine.getTemplate("/resources/templates/fetchGender.html");

-						VelocityContext context = new VelocityContext();

-						context.put("SAMLResponse", request.getParameter("SAMLResponse"));

-						context.put("action", request.getRequestURL());

-

-						StringWriter writer = new StringWriter();

-						template.merge(context, writer);

-

-						response.getOutputStream().write(writer.toString().getBytes("UTF-8"));

-					} catch (Exception e1) {

-						Logger.error("Error sending gender retrival form.", e1);

-						// httpSession.invalidate();

-						throw new MOAIDException("stork.10", null);

-					}

-

-					return;

-				}

-

-				Logger.error("Error connecting SZR Gateway", e);

-				throw new MOAIDException("stork.10", null);

-			}

-

-			Logger.debug("Add full STORK AuthnResponse to MOA session");

-			moaSession.setStorkAuthnResponse(request.getParameter("SAMLResponse"));// TODO ask Florian/Thomas

-																					// authnResponse?

-

-			// session is implicit stored in changeSessionID!!!!

-			String newMOASessionID = AuthenticationSessionStoreage.changeSessionID(moaSession);

-

-			Logger.info("Changed MOASession " + moaSessionID + " to Session " + newMOASessionID);

-

-			// redirect

-			String redirectURL = null;

-			redirectURL = new DataURLBuilder().buildDataURL(moaSession.getAuthURL(),

-					ModulUtils.buildAuthURL(moaSession.getModul(), moaSession.getAction(), pendingRequestID),

-					newMOASessionID);

-			redirectURL = response.encodeRedirectURL(redirectURL);

-

-			response.setContentType("text/html");

-			response.setStatus(302);

-			response.addHeader("Location", redirectURL);

-			Logger.info("REDIRECT TO: " + redirectURL);

-

-		} catch (AuthenticationException e) {

-			throw new TaskExecutionException(e.getMessage(), e);

-

-		} catch (MOAIDException e) {

-			throw new TaskExecutionException(e.getMessage(), e);

-

-		} catch (Exception e) {

-			Logger.error("PEPSConnector has an interal Error.", e);

-			throw new TaskExecutionException(e.getMessage(), e);

-		}

-

-		finally {

-			

-		}

-

-	}

-

-	private void performRedirect(String url, HttpServletRequest req, HttpServletResponse resp, String signRequestString)

-			throws MOAIDException {

-

-		try {

-			Logger.trace("Initialize VelocityEngine...");

-

-			VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();

-			Template template = velocityEngine.getTemplate("/resources/templates/oasis_dss_webform_binding.vm");

-			VelocityContext context = new VelocityContext();

-

-			Logger.debug("performRedirect, signrequest:" + signRequestString);

-			Source signDoc = new StreamSource(new java.io.StringReader(signRequestString));

-			SignRequest signRequest = ApiUtils.unmarshal(signDoc, SignRequest.class);

-			signRequest.setReturnURL("TODO");

-			signRequestString = IOUtils.toString(ApiUtils.marshalToInputStream(signRequest));

-			context.put("signrequest", Base64Utils.encode(signRequestString.getBytes("UTF8")));

-			context.put("clienturl", url);

-			context.put("action", oasisDssWebFormURL);

-

-			StringWriter writer = new StringWriter();

-			template.merge(context, writer);

-

-			resp.getOutputStream().write(writer.toString().getBytes("UTF-8"));

-		} catch (Exception e) {

-			Logger.error("Error sending DSS signrequest.", e);

-			throw new MOAIDException("stork.11", null);

-		}

-	}

-}

diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorTask.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorTask.java
deleted file mode 100644
index b505605ab..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorTask.java
+++ /dev/null
@@ -1,791 +0,0 @@
-package at.gv.egovernment.moa.id.auth.modules.stork.tasks;

-

-import iaik.x509.X509Certificate;

-

-import java.io.IOException;

-import java.io.InputStream;

-import java.io.StringWriter;

-import java.net.URL;

-import java.text.SimpleDateFormat;

-import java.util.ArrayList;

-import java.util.Arrays;

-import java.util.Date;

-import java.util.List;

-import java.util.Properties;

-

-import javax.activation.DataSource;

-import javax.servlet.http.HttpServletRequest;

-import javax.servlet.http.HttpServletResponse;

-import javax.xml.bind.JAXBContext;

-import javax.xml.bind.JAXBElement;

-import javax.xml.namespace.QName;

-import javax.xml.transform.stream.StreamSource;

-import javax.xml.ws.BindingProvider;

-import javax.xml.ws.Service;

-import javax.xml.ws.soap.SOAPBinding;

-

-import org.apache.commons.io.IOUtils;

-import org.apache.commons.lang.StringEscapeUtils;

-import org.apache.velocity.Template;

-import org.apache.velocity.VelocityContext;

-import org.apache.velocity.app.VelocityEngine;

-import org.opensaml.saml2.core.StatusCode;

-import org.w3c.dom.Element;

-import org.w3c.dom.Node;

-

-import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;

-import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;

-

-import at.gv.egovernment.moa.id.auth.BaseAuthenticationServer;

-import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;

-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

-import at.gv.egovernment.moa.id.auth.data.IdentityLink;

-import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;

-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

-import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;

-import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;

-import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser;

-import at.gv.egovernment.moa.id.auth.stork.STORKException;

-import at.gv.egovernment.moa.id.auth.stork.STORKResponseProcessor;

-

-import at.gv.egovernment.moa.id.config.auth.AuthConfiguration;

-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;

-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;

-import at.gv.egovernment.moa.id.moduls.IRequest;

-import at.gv.egovernment.moa.id.moduls.ModulUtils;

-import at.gv.egovernment.moa.id.moduls.RequestStorage;

-import at.gv.egovernment.moa.id.process.api.ExecutionContext;

-import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;

-import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;

-import at.gv.egovernment.moa.id.util.HTTPUtils;

-import at.gv.egovernment.moa.id.util.IdentityLinkReSigner;

-import at.gv.egovernment.moa.id.util.VelocityProvider;

-import at.gv.egovernment.moa.logging.Logger;

-import at.gv.egovernment.moa.util.DOMUtils;

-import at.gv.egovernment.moa.util.StringUtils;

-import at.gv.egovernment.moa.util.XPathUtils;

-import at.gv.util.xsd.xmldsig.SignatureType;

-import at.gv.util.xsd.xmldsig.X509DataType;

-import eu.stork.documentservice.DocumentService;

-import eu.stork.oasisdss.api.ApiUtils;

-import eu.stork.oasisdss.api.LightweightSourceResolver;

-import eu.stork.oasisdss.profile.DocumentType;

-import eu.stork.oasisdss.profile.DocumentWithSignature;

-import eu.stork.oasisdss.profile.SignResponse;

-import eu.stork.peps.auth.commons.IPersonalAttributeList;

-import eu.stork.peps.auth.commons.PEPSUtil;

-import eu.stork.peps.auth.commons.PersonalAttribute;

-import eu.stork.peps.auth.commons.PersonalAttributeList;

-import eu.stork.peps.auth.commons.STORKAttrQueryRequest;

-import eu.stork.peps.auth.commons.STORKAuthnRequest;

-import eu.stork.peps.auth.commons.STORKAuthnResponse;

-import eu.stork.peps.auth.engine.STORKSAMLEngine;

-import eu.stork.peps.exceptions.STORKSAMLEngineException;

-

-/**

- * Evaluates the SAML response from the C-PEPS and authenticates the user.

- * <p/>

- * In detail:

- * <ul>

- * <li>Decodes and validates the SAML response from the C-PEPS.</li>

- * <li>Change moa session id.</li>

- * <li>Extracts the subject's gender from request parameter {@code gender} if not available from the saml response.</li>

- * <li>Extracts the {@code signedDoc} attribute from the response, get signed doc payload using stork attribute query request.</li>

- * <li>Request SZR gateway for verification of the citizen's signature and for creating of an identity link.</li>

- * <li>In case of mandate mode: If the S-PEPS did not provide any gender information, the szr gateway will not be able to issue an identity link. Therefore a form is presented asking for the subject's gender. The form submits the user back to the {@code /PepsConnector} servlet (this task).</li>

- * <li>The moa session is updated with authentication information.</li>

- * <li>Change moa session id.</li>

- * <li>Redirects back to {@code /dispatcher} in order to finalize the authentication.</li>

- * </ul>

- * Expects:

- * <ul>

- * <li>HttpServletRequest parameter {@code SAMLResponse}</li>

- * <li>Either HttpServletRequest parameter {@code RelayState} or {@code inResponseTo} attribute from the SAML response (both depicting the moa session id)</li>

- * <li>HttpServletRequest parameter {@code gender} in case the request comes from the gender selection form</li>

- * <li>{@code signedDoc} attribute within the SAML response.</li>

- * </ul>

- * Result:

- * <ul>

- * <li>Updated moa id session (identity link, stork attributes...)</li>

- * <li>{@link ExecutionContext} contains boolean flag {@code identityLinkAvailable} indicating if an identitylink has been successfully creates or not.</li>

- * <li>Redirect to {@code /dispatcher}.</li> 

- * </ul>

- * Possible branches:

- * <ul>

- * <li>In case the szr gateway throws exception due to missing gender information:

- * <ul>

- * <li>Returns a form for gender selection with action url back to this servlet/task.</li>

- * </ul>

- * </li>

- * </ul>

- * Code taken from {@link at.gv.egovernment.moa.id.auth.servlet.PEPSConnectorServlet}.<br/>

- *

- * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)

- */

-public class PepsConnectorTask extends AbstractAuthServletTask {

-

-	public static final String PEPSCONNECTOR_SERVLET_URL_PATTERN = "/PEPSConnector";

-	

-	public PepsConnectorTask() {

-		super();

-		

-	}

-

-	@Override

-	public void execute(ExecutionContext executionContext, HttpServletRequest request, HttpServletResponse response)

-			throws TaskExecutionException {

-		String pendingRequestID = null;

-

-		setNoCachingHeaders(response);

-

-		try {

-

-			Logger.info("PEPSConnector Servlet invoked, expecting C-PEPS message.");

-			Logger.debug("This ACS endpoint is: " + HTTPUtils.getBaseURL(request));

-

-			// check if https or only http

-			super.checkIfHTTPisAllowed(request.getRequestURL().toString());

-

-			Logger.debug("Beginning to extract SAMLResponse out of HTTP Request");

-

-			// extract STORK Response from HTTP Request

-			// Decodes SAML Response

-			byte[] decSamlToken;

-			try {

-				decSamlToken = PEPSUtil.decodeSAMLToken(request.getParameter("SAMLResponse"));

-				Logger.debug("SAMLResponse: " + new String(decSamlToken));

-

-			} catch (NullPointerException e) {

-				Logger.error("Unable to retrieve STORK Response", e);

-				throw new MOAIDException("stork.04", null);

-			}

-

-			// Get SAMLEngine instance

-			STORKSAMLEngine engine = STORKSAMLEngine.getInstance("outgoing");

-

-			STORKAuthnResponse authnResponse = null;

-			try {

-				// validate SAML Token

-				Logger.debug("Starting validation of SAML response");

-				authnResponse = engine.validateSTORKAuthnResponseWithQuery(decSamlToken, (String) request.getRemoteHost());

-				Logger.info("SAML response succesfully verified!");

-			} catch (STORKSAMLEngineException e) {

-				Logger.error("Failed to verify STORK SAML Response", e);

-				throw new MOAIDException("stork.05", null);

-			}

-

-			Logger.info("STORK SAML Response message succesfully extracted");

-			Logger.debug("STORK response: ");

-			Logger.debug(authnResponse.toString());

-

-			// do PEPS-conform logging for easier evaluation

-			try {

-				// 2015-03-12 16:44:27.144#S-PEPS receives response from C-PEPS#orig_msg_id id2 (in response to)#orig_msg_id id1 (in response to)#status#msghash#msg_id id3#

-				Logger.info(new SimpleDateFormat("yyyy-MM-dd HH:mm:ss.SSS").format(new Date()) + "#S-PEPS receives response from C-PEPS#" + 

-						authnResponse.getInResponseTo() + "#NA#" + authnResponse.getMessage() + "#_hash_#" + authnResponse.getSamlId() + "#");

-			} catch (Exception e1) {

-				Logger.info("STORK PEPS conform logging failed because of: " + e1.getMessage());

-			}

-

-			Logger.debug("Trying to find MOA Session-ID ...");

-			// String moaSessionID = request.getParameter(PARAM_SESSIONID);

-			// first use SAML2 relayState

-			String moaSessionID = request.getParameter("RelayState");

-

-			// escape parameter strings

-			moaSessionID = StringEscapeUtils.escapeHtml(moaSessionID);

-

-			// check if SAML2 relaystate includes a MOA sessionID

-			if (StringUtils.isEmpty(moaSessionID)) {

-				// if relaystate is emtpty, use SAML response -> inResponseTo element as session identifier

-

-				moaSessionID = authnResponse.getInResponseTo();

-				moaSessionID = StringEscapeUtils.escapeHtml(moaSessionID);

-

-				if (StringUtils.isEmpty(moaSessionID)) {

-					// No authentication session has been started before

-					Logger.error("MOA-SessionID was not found, no previous AuthnRequest had been started");

-					Logger.debug("PEPSConnectorURL was: " + request.getRequestURL());

-					throw new AuthenticationException("auth.02", new Object[] { moaSessionID });

-

-				} else

-					Logger.trace("Use MOA SessionID " + moaSessionID + " from AuthnResponse->inResponseTo attribute.");

-

-			} else

-				// Logger.trace("MOA SessionID " + moaSessionID + " is found in http GET parameter.");

-				Logger.trace("MOA SessionID " + moaSessionID + " is found in SAML2 relayState.");

-

-			/*

-			 * INFO!!!! SAML message IDs has an different format then MOASessionIDs This is only a workaround because

-			 * many PEPS does not support SAML2 relayState or MOASessionID as AttributConsumerServiceURL GET parameter

-			 */

-			// if (!ParamValidatorUtils.isValidSessionID(moaSessionID))

-			// throw new WrongParametersException("VerifyAuthenticationBlock", PARAM_SESSIONID, "auth.12");

-

-			pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(moaSessionID);

-			IRequest pendingReq = RequestStorage.getPendingRequest(pendingRequestID);

-			

-			// load MOASession from database

-			AuthenticationSession moaSession = BaseAuthenticationServer.getSession(moaSessionID);

-			// change MOASessionID

-			moaSessionID = AuthenticationSessionStoreage.changeSessionID(moaSession);

-

-			Logger.info("Found MOA sessionID: " + moaSessionID);

-

-			String statusCodeValue = authnResponse.getStatusCode();

-

-			if (!statusCodeValue.equals(StatusCode.SUCCESS_URI)) {

-				Logger.error("Received ErrorResponse from PEPS: " + statusCodeValue);

-				throw new MOAIDException("stork.06", new Object[] { statusCodeValue });

-			}

-

-			Logger.info("Got SAML response with authentication success message.");

-

-			Logger.debug("MOA session is still valid");

-

-			STORKAuthnRequest storkAuthnRequest = moaSession.getStorkAuthnRequest();

-

-			if (storkAuthnRequest == null) {

-				Logger.error("Could not find any preceeding STORK AuthnRequest to this MOA session: " + moaSessionID);

-				throw new MOAIDException("stork.07", null);

-			}

-

-			OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(moaSession.getPublicOAURLPrefix());

-    		if (oaParam == null)

-    				throw new AuthenticationException("auth.00", new Object[] { moaSession.getPublicOAURLPrefix() });

-    		

-			//================== Check QAA level start ====================

-			int reqQaa = -1;

-			int authQaa = -1;

-			String authQaaStr = null; 

-			try {

-				reqQaa = storkAuthnRequest.getQaa();

-				

-				//TODO: found better solution, but QAA Level in response could be not supported yet

-				try {

-

-					authQaaStr = authnResponse.getAssertions().get(0).

-							getAuthnStatements().get(0).getAuthnContext().

-							getAuthnContextClassRef().getAuthnContextClassRef();

-					moaSession.setQAALevel(authQaaStr);

-					

-				} catch (Throwable e) {

-					Logger.warn("STORK QAA-Level is not found in AuthnResponse. Set QAA Level to requested level");

-					moaSession.setQAALevel(PVPConstants.STORK_QAA_PREFIX + oaParam.getQaaLevel());

-					authQaaStr = PVPConstants.STORK_QAA_PREFIX + oaParam.getQaaLevel();

-				}

-				if(authQaaStr != null)//Check value only if set

-				{

-					authQaa = Integer.valueOf(authQaaStr.substring(PVPConstants.STORK_QAA_PREFIX.length()));

-//					authQaa = Integer.valueOf(authQaaStr);

-					if (reqQaa > authQaa) {

-						Logger.warn("Requested QAA level does not match to authenticated QAA level");

-						throw new MOAIDException("stork.21", new Object[]{reqQaa, authQaa});

-	

-					}

-				}

-			} catch (MOAIDException e) {

-				throw e;

-

-			} catch (Exception e) {

-				if (Logger.isDebugEnabled())

-					Logger.warn("STORK QAA Level evaluation error", e);

-

-				else

-					Logger.warn("STORK QAA Level evaluation error (ErrorMessage=" 

-							+  e.getMessage() + ")");

-

-				throw new MOAIDException("stork.21", new Object[]{reqQaa, authQaa});

-

-			}

-			//================== Check QAA level end ====================

-			

-			

-			Logger.debug("Found a preceeding STORK AuthnRequest to this MOA session: " + moaSessionID);

-

-			// fetch attribute list from response

-			IPersonalAttributeList attributeList = authnResponse.getPersonalAttributeList();

-			if(authnResponse.getAssertions().size() > 1) {

-				for(IPersonalAttributeList currentList : authnResponse.getPersonalAttributeLists()) {

-					for(PersonalAttribute currentAttribute : currentList.values()) {

-						if(!attributeList.containsKey(currentAttribute.getName()))

-							attributeList.add((PersonalAttribute) currentAttribute.clone());

-						else {

-							if(!attributeList.get(currentAttribute.getName()).getValue().equals(currentAttribute.getValue()))

-								throw new TaskExecutionException("data integrity failure", new Exception("data integrity failure: found non-matching values in multiple attributes of type " + currentAttribute.getName()));

-						}

-					}

-				}

-			}

-

-			// //////////// incorporate gender from parameters if not in stork response

-

-			// but first, check if we have a representation case

-			if (STORKResponseProcessor.hasAttribute("mandateContent", attributeList)

-					|| STORKResponseProcessor.hasAttribute("representative", attributeList)

-					|| STORKResponseProcessor.hasAttribute("represented", attributeList)) {

-				// in a representation case...

-				moaSession.setUseMandate("true");

-

-				// and check if we have the gender value

-				PersonalAttribute gender = attributeList.get("gender"); // TODO Do we need to check gender value if

-																		// there is no representation case?

-				if (null == gender) {

-					String gendervalue = (String) request.getParameter("gender");

-					if (null != gendervalue) {

-						gender = new PersonalAttribute();

-						gender.setName("gender");

-						ArrayList<String> tmp = new ArrayList<String>();

-						tmp.add(gendervalue);

-						gender.setValue(tmp);

-

-						attributeList.add(gender);

-					}

-				}

-			}

-

-			// ////////////////////////////////////////////////////////////////////////

-

-			MOAReversionLogger.getInstance().logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_PEPS_RECEIVED);

-			

-			AuthConfiguration config = AuthConfigurationProviderFactory.getInstance();

-			String citizenSignature = null;

-			if(config.isStorkFakeIdLActive() && config.getStorkNoSignatureCountries().contains(storkAuthnRequest.getCitizenCountryCode()) && config.getStorkFakeIdLCountries().contains(storkAuthnRequest.getCitizenCountryCode())) {

-				Logger.debug("signedDoc extraction skipped due to configuration");

-			} else {

-			Logger.debug("Starting extraction of signedDoc attribute");

-			// extract signed doc element and citizen signature

-			try {

-

-				if (attributeList.get("signedDoc") == null 

-						|| attributeList.get("signedDoc").getValue() == null

-						|| attributeList.get("signedDoc").getValue().get(0) == null) {

-					Logger.info("STORK Response include NO signedDoc attribute!");

-					throw new STORKException("STORK Response include NO signedDoc attribute.");

-					

-				}

-				

-				String signatureInfo = attributeList.get("signedDoc").getValue().get(0);

-					

-									

-				Logger.debug("signatureInfo:" + signatureInfo);

-

-				SignResponse dssSignResponse = (SignResponse) ApiUtils.unmarshal(new StreamSource(

-						new java.io.StringReader(signatureInfo)));

-

-				// fetch signed doc

-				DataSource ds = null;

-				try{

-					ds = LightweightSourceResolver.getDataSource(dssSignResponse);

-				}catch(Exception e)

-				{

-					e.printStackTrace();

-				}

-				if(ds == null){

-					//Normal DocumentServices return a http-page, but the SI DocumentService returns HTTP error 500 

-					//which results in an exception and ds==null

-					

-					//try to load document from documentservice

-					citizenSignature = loadDocumentFromDocumentService(dssSignResponse);

-					//throw new ApiUtilsException("No datasource found in response");

-				}		

-				else

-				{

-					InputStream incoming  = ds.getInputStream();

-					citizenSignature = IOUtils.toString(incoming);

-					incoming.close();

-					

-					Logger.debug("citizenSignature:"+citizenSignature);

-					if(isDocumentServiceUsed(citizenSignature)==true)

-					{

-						citizenSignature = loadDocumentFromDocumentService(dssSignResponse);

-	//					Logger.debug("Loading document from DocumentService.");

-	//					String url = getDtlUrlFromResponse(dssSignResponse);

-	//					//get Transferrequest

-	//					String transferRequest = getDocTransferRequest(dssSignResponse.getDocUI(), url);

-	//					//Load document from DocumentService

-	//					byte[] data = getDocumentFromDtl(transferRequest, url);

-	//					citizenSignature = new String(data, "UTF-8");

-	//					Logger.debug("Overridung citizenSignature with:"+citizenSignature);

-					}

-				}

-				

-				JAXBContext ctx = JAXBContext.newInstance(SignatureType.class.getPackage().getName());

-				SignatureType root = ((JAXBElement<SignatureType>) ctx.createUnmarshaller().unmarshal(

-						IOUtils.toInputStream(citizenSignature))).getValue();

-

-				// memorize signature into authblock

-				moaSession.setAuthBlock(citizenSignature);

-

-				// extract certificate

-				for (Object current : root.getKeyInfo().getContent())

-					if (((JAXBElement<?>) current).getValue() instanceof X509DataType) {

-						for (Object currentX509Data : ((JAXBElement<X509DataType>) current).getValue()

-								.getX509IssuerSerialOrX509SKIOrX509SubjectName()) {

-							JAXBElement<?> casted = ((JAXBElement<?>) currentX509Data);

-							if (casted.getName().getLocalPart().equals("X509Certificate")) {

-								moaSession.setSignerCertificate(new X509Certificate(((String) casted.getValue())

-										.getBytes("UTF-8")));

-								break;

-							}

-						}

-					}

-

-			} catch (Throwable e) {

-				Logger.error("Could not extract citizen signature from C-PEPS", e);

-				throw new MOAIDException("stork.09", null);

-			}

-			}

-			Logger.debug("Foregin Citizen signature successfully extracted from STORK Assertion (signedDoc)");

-			Logger.debug("Citizen signature will be verified by SZR Gateway!");

-

-			Logger.debug("fetching OAParameters from database");

-

-			// //read configuration paramters of OA

-			// AuthenticationSession moasession;

-			// try {

-			// moasession = AuthenticationSessionStoreage.getSession(moaSessionID);

-			// } catch (MOADatabaseException e2) {

-			// Logger.error("could not retrieve moa session");

-			// throw new AuthenticationException("auth.01", null);

-			// }

-			

-			// retrieve target

-			// TODO: check in case of SSO!!!

-			String targetType = null;

-			if (oaParam.getBusinessService()) {

-				String id = oaParam.getIdentityLinkDomainIdentifier();

-				if (id.startsWith(AuthenticationSession.REGISTERANDORDNR_PREFIX_))

-					targetType = id;

-				else

-					targetType = AuthenticationSession.REGISTERANDORDNR_PREFIX_ + moaSession.getDomainIdentifier();

-			} else {

-				targetType = AuthenticationSession.TARGET_PREFIX_ + oaParam.getTarget();

-			}

-

-			Logger.debug("Starting connecting SZR Gateway");

-			// contact SZR Gateway

-			IdentityLink identityLink = null;

-			executionContext.put("identityLinkAvailable", false);

-			try {

-				if(config.isStorkFakeIdLActive() && config.getStorkFakeIdLCountries().contains(storkAuthnRequest.getCitizenCountryCode())) {

-					// create fake IdL

-					// - fetch IdL template from resources

-					InputStream s = PepsConnectorTask.class.getResourceAsStream("/resources/xmldata/fakeIdL_IdL_template.xml");

-					Element idlTemplate = DOMUtils.parseXmlValidating(s);

-

-				    identityLink = new IdentityLinkAssertionParser(idlTemplate).parseIdentityLink();

-

-				    // replace data

-		            Element idlassertion = identityLink.getSamlAssertion();

-		            // - set bpk/wpbk;

-			        Node prIdentification = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_IDENT_VALUE_XPATH);

-			        if(!STORKResponseProcessor.hasAttribute("eIdentifier", attributeList))

-			        	throw new STORKException("eIdentifier is missing");

-			        String eIdentifier = STORKResponseProcessor.getAttributeValue("eIdentifier", attributeList, false);

-			        prIdentification.getFirstChild().setNodeValue(eIdentifier);

-

-			        // - set last name

-			        Node prFamilyName = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_FAMILY_NAME_XPATH);

-			        if(!STORKResponseProcessor.hasAttribute("surname", attributeList))

-			        	throw new STORKException("surname is missing");

-					String familyName = STORKResponseProcessor.getAttributeValue("surname", attributeList, false);

-					prFamilyName.getFirstChild().setNodeValue(familyName);

-

-			        // - set first name

-			        Node prGivenName = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_GIVEN_NAME_XPATH);

-			        if(!STORKResponseProcessor.hasAttribute("givenName", attributeList))

-			        	throw new STORKException("givenName is missing");

-					String givenName = STORKResponseProcessor.getAttributeValue("givenName", attributeList, false);

-					prGivenName.getFirstChild().setNodeValue(givenName);

-

-			        // - set date of birth

-			        Node prDateOfBirth = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_DATE_OF_BIRTH_XPATH);

-			        if(!STORKResponseProcessor.hasAttribute("dateOfBirth", attributeList))

-			        	throw new STORKException("dateOfBirth is missing");

-					String dateOfBirth = STORKResponseProcessor.getAttributeValue("dateOfBirth", attributeList, false);

-					dateOfBirth = new SimpleDateFormat("yyyy-MM-dd").format(new SimpleDateFormat("yyyyMMdd").parse(dateOfBirth));

-					prDateOfBirth.getFirstChild().setNodeValue(dateOfBirth);

-

-		            identityLink = new IdentityLinkAssertionParser(idlassertion).parseIdentityLink();

-

-		            //resign IDL

-					IdentityLinkReSigner identitylinkresigner = IdentityLinkReSigner.getInstance();

-					Element resignedilAssertion = identitylinkresigner.resignIdentityLink(identityLink.getSamlAssertion(), config.getStorkFakeIdLResigningKey());

-					identityLink = new IdentityLinkAssertionParser(resignedilAssertion).parseIdentityLink();

-					

-				} else {

-					//contact SZR Gateway

-					Logger.debug("Starting connecting SZR Gateway");

-				

-					identityLink = STORKResponseProcessor.connectToSZRGateway(

-							attributeList,

-							oaParam.getFriendlyName(), 

-							targetType, 

-							null, 

-							oaParam.getMandateProfiles(), 

-							citizenSignature);

-					

-				}

-				

-			} catch (STORKException e) {

-				// this is really nasty but we work against the system here. We are supposed to get the gender attribute

-				// from

-				// stork. If we do not, we cannot register the person in the ERnP - we have to have the

-				// gender for the represented person. So here comes the dirty hack.

-				if (e.getCause() instanceof STORKException

-						&& e.getCause().getMessage().equals("gender not found in response")) {

-					try {

-						Logger.trace("Initialize VelocityEngine...");

-

-						VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();

-						Template template = velocityEngine.getTemplate("/resources/templates/fetchGender.html");

-						VelocityContext context = new VelocityContext();

-						context.put("SAMLResponse", request.getParameter("SAMLResponse"));

-						context.put("action", request.getRequestURL());

-

-						StringWriter writer = new StringWriter();

-						template.merge(context, writer);

-

-						response.getOutputStream().write(writer.toString().getBytes("UTF-8"));

-					} catch (Exception e1) {

-						Logger.error("Error sending gender retrival form.", e1);

-						// httpSession.invalidate();

-						throw new MOAIDException("stork.10", null);

-					}

-

-					return;

-				}

-

-				Logger.error("Error connecting SZR Gateway", e);

-				throw new MOAIDException("stork.10", null);

-			}

-			Logger.debug("SZR communication was successfull");

-

-			if (identityLink == null) {

-				Logger.error("SZR Gateway did not return an identity link.");

-				throw new MOAIDException("stork.10", null);

-			}

-			

-			MOAReversionLogger.getInstance().logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_PEPS_IDL_RECEIVED);			

-			moaSession.setForeigner(true);

-

-			Logger.info("Received Identity Link from SZR Gateway");

-			executionContext.put("identityLinkAvailable", true);

-			moaSession.setIdentityLink(identityLink);

-

-			Logger.debug("Adding addtional STORK attributes to MOA session");

-			moaSession.setStorkAttributes(attributeList);

-

-			Logger.debug("Add full STORK AuthnResponse to MOA session");

-			moaSession.setStorkAuthnResponse(request.getParameter("SAMLResponse"));

-

-			// We don't have BKUURL, setting from null to "Not applicable"

-			moaSession.setBkuURL("Not applicable (STORK Authentication)");

-

-			// free for single use

-			moaSession.setAuthenticatedUsed(false);

-

-			// stork did the authentication step

-			moaSession.setAuthenticated(true);

-

-			// do PEPS-conform logging for easier evaluation

-			try {

-				// 2015-03-12 16:44:27.144#S-PEPS generates response to SP#orig_msg_id id1 (in response to)#status#msghash#msg_id id4#

-				Logger.info(new SimpleDateFormat("yyyy-MM-dd HH:mm:ss.SSS").format(new Date()) + "#S-PEPS generates response to SP#" + 

-						"#" + moaSession.getProcessInstanceId() + "#" + authnResponse.getMessage() + "#_hash_#" + moaSession.getProcessInstanceId() + "#");

-			} catch (Exception e1) {

-				Logger.info("STORK PEPS conform logging failed because of: " + e1.getMessage());

-			}

-

-			// TODO: found better solution, but QAA Level in STORK response is not be supported yet

-//			try {

-//

-//				moaSession.setQAALevel(authnResponse.getAssertions().get(0).getAuthnStatements().get(0)

-//						.getAuthnContext().getAuthnContextClassRef().getAuthnContextClassRef());

-//

-//			} catch (Throwable e) {

-//				Logger.warn("STORK QAA-Level is not found in AuthnResponse. Set QAA Level to requested level");

-//				moaSession.setQAALevel(PVPConstants.STORK_QAA_PREFIX + oaParam.getQaaLevel());

-//

-//			}

-

-			// session is implicit stored in changeSessionID!!!!

-			String newMOASessionID = AuthenticationSessionStoreage.changeSessionID(moaSession);

-

-			Logger.info("Changed MOASession " + moaSessionID + " to Session " + newMOASessionID);

-

-			// redirect

-			String redirectURL = null;

-			redirectURL = new DataURLBuilder().buildDataURL(moaSession.getAuthURL(),

-					ModulUtils.buildAuthURL(moaSession.getModul(), moaSession.getAction(), pendingRequestID),

-					newMOASessionID);

-			redirectURL = response.encodeRedirectURL(redirectURL);

-

-			// response.setContentType("text/html");

-			// response.setStatus(302);

-			// response.addHeader("Location", redirectURL);

-			response.sendRedirect(redirectURL);

-			Logger.info("REDIRECT TO: " + redirectURL);

-

-		} catch (AuthenticationException e) {

-			throw new TaskExecutionException(e.getMessage(), e);

-

-		} catch (MOAIDException e) {

-			throw new TaskExecutionException(e.getMessage(), e);

-

-		} catch (Exception e) {

-			Logger.error("PEPSConnector has an interal Error.", e);

-			throw new TaskExecutionException(e.getMessage(), e);

-		}

-

-		finally {

-			

-		}

-

-	}

-

-	private boolean isDocumentServiceUsed(String citizenSignature) // TODo add better check

-	{

-		if (citizenSignature

-				.contains("<table border=\"0\"><tr><td>Service Name:</td><td>{http://stork.eu}DocumentService</td></tr><tr><td>Port Name:</td><td>{http://stork.eu}DocumentServicePort</td></tr></table>")) {

-			Logger.trace("isDocumentServiceUsed => true");

-			return true;

-		}

-		

-		Logger.trace("isDocumentServiceUsed => false");

-		return false;

-	}

-

-	/**

-	 * Get DTL uril from the oasis sign response

-	 * 

-	 * @param signRequest

-	 *            The signature response

-	 * @return The URL of DTL service

-	 * @throws SimpleException

-	 */

-	private String getDtlUrlFromResponse(SignResponse dssSignResponse) {

-		List<DocumentWithSignature> documents = ApiUtils.findNamedElement(dssSignResponse.getOptionalOutputs(),

-				ApiUtils.OPTIONAL_OUTPUT_DOCUMENTWITHSIGNATURE, DocumentWithSignature.class);

-		DocumentType sourceDocument = documents.get(0).getDocument();

-

-		if (sourceDocument.getDocumentURL() != null)

-			return sourceDocument.getDocumentURL();

-		else

-			return null;// throw new Exception("No document url found");

-	}

-

-	// From DTLPEPSUTIL

-

-	/**

-	 * Get document from DTL

-	 * 

-	 * @param transferRequest

-	 *            The transfer request (attribute query)

-	 * @param eDtlUrl

-	 *            The DTL url of external DTL

-	 * @return the document data

-	 * @throws SimpleException

-	 */

-	private byte[] getDocumentFromDtl(String transferRequest, String eDtlUrl) throws Exception {

-		URL url = null;

-		try {

-			

-			Logger.trace("getDocumentFromDtl, dtlUrl:'"+getdtlUrl()+"' eDtlUrl:'"+eDtlUrl+"'");

-			url = new URL(getdtlUrl());

-			QName qname = new QName("http://stork.eu", "DocumentService");

-

-			Service service = Service.create(url, qname);

-			DocumentService docservice = service.getPort(DocumentService.class);

-

-			BindingProvider bp = (BindingProvider) docservice;

-			SOAPBinding binding = (SOAPBinding) bp.getBinding();

-			binding.setMTOMEnabled(true);

-

-			if (eDtlUrl.equalsIgnoreCase(getdtlUrl()))

-				return docservice.getDocument(transferRequest, "");

-			else

-				return docservice.getDocument(transferRequest, eDtlUrl);

-		} catch (Exception e) {

-			e.printStackTrace();

-			throw new Exception("Error in getDocumentFromDtl", e);

-		}

-	}

-

-	/**

-	 * Get a document transfer request (attribute query)

-	 * 

-	 * @param docId

-	 * @return

-	 * @throws SimpleException

-	 */

-	private String getDocTransferRequest(String docId, String destinationUrl) throws Exception {

-		String spCountry = docId.substring(0, docId.indexOf("/"));

-		final STORKSAMLEngine engine = STORKSAMLEngine.getInstance("VIDP");

-		STORKAttrQueryRequest req = new STORKAttrQueryRequest();

-		req.setAssertionConsumerServiceURL(getdtlUrl());

-		req.setDestination(destinationUrl);

-		req.setSpCountry(spCountry);

-		req.setQaa(3);// TODO

-		PersonalAttributeList pal = new PersonalAttributeList();

-		PersonalAttribute attr = new PersonalAttribute();

-		attr.setName("docRequest");

-		attr.setIsRequired(true);

-		attr.setValue(Arrays.asList(docId));

-		pal.add(attr);

-		req.setPersonalAttributeList(pal);

-

-		STORKAttrQueryRequest req1;

-		try {

-			req1 = engine.generateSTORKAttrQueryRequest(req);

-			return PEPSUtil.encodeSAMLTokenUrlSafe(req1.getTokenSaml());

-		} catch (STORKSAMLEngineException e) {

-			e.printStackTrace();

-			throw new Exception("Error in doc request attribute query generation", e);

-		}

-	}

-	

-	private String getdtlUrl() {

-		String dtlUrl;

-		try {

-			AuthConfiguration authConfigurationProvider = AuthConfigurationProviderFactory.getInstance();

-			dtlUrl = authConfigurationProvider.getDocumentServiceUrl();

-			Logger.info ("PEPSConnectorServlet, using dtlUrl:"+dtlUrl);

-			

-		} catch (Exception e) {

-			dtlUrl = "http://testvidp.buergerkarte.at/DocumentService/DocumentService";

-			Logger.error("Loading documentservice url failed, using default value:"+dtlUrl, e);

-			

-		}

-	

-		

-//		Properties props = new Properties();

-//		try {

-//			props.load(DatabaseConnectorMySQLImpl.class.getResourceAsStream("docservice.properties"));

-//			dtlUrl = props.getProperty("docservice.url");

-//		} catch (IOException e) {

-//			dtlUrl = "http://testvidp.buergerkarte.at/DocumentService/DocumentService";

-//			Logger.error("Loading DTL config failed, using default value:" + dtlUrl);

-//			e.printStackTrace();

-//		}

-	

-		return dtlUrl;

-		

-	}

-	

-	private String loadDocumentFromDocumentService(SignResponse dssSignResponse) throws Exception

-	{ 

-		Logger.debug("Loading document from DocumentService.");

-		String url = getDtlUrlFromResponse(dssSignResponse);

-		Logger.debug("Loading document from DocumentService, url:"+url);

-		//get Transferrequest

-		String transferRequest = getDocTransferRequest(dssSignResponse.getDocUI(), url);

-		//Load document from DocumentService

-		byte[] data = getDocumentFromDtl(transferRequest, url);

-		String citizenSignature = new String(data, "UTF-8");

-		Logger.debug("Overridung citizenSignature with:"+citizenSignature);

-		return citizenSignature;

-	}

-

-}

diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/stork/STORKResponseProcessor.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/stork/STORKResponseProcessor.java
deleted file mode 100644
index 65a3637a9..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/stork/STORKResponseProcessor.java
+++ /dev/null
@@ -1,286 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- * 
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- * 
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- ******************************************************************************/
-/**
- * 
- */
-package at.gv.egovernment.moa.id.auth.stork;
-
-import java.io.ByteArrayInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.List;
-import java.util.Vector;
-
-import javax.activation.DataSource;
-import javax.xml.transform.Source;
-import javax.xml.transform.TransformerConfigurationException;
-import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactoryConfigurationError;
-import javax.xml.transform.stream.StreamSource;
-
-import org.apache.commons.io.IOUtils;
-import org.apache.commons.lang3.StringEscapeUtils;
-
-import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttribute;
-import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttributeImpl;
-import at.gv.egovernment.moa.id.auth.data.IdentityLink;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.auth.exception.ParseException;
-import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser;
-import at.gv.egovernment.moa.id.client.SZRGWClientException;
-import at.gv.egovernment.moa.id.client.utils.SZRGWClientUtils;
-import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.Constants;
-import at.gv.egovernment.moa.util.DateTimeUtils;
-import at.gv.egovernment.moa.util.StringUtils;
-import at.gv.util.xsd.srzgw.CreateIdentityLinkResponse;
-import eu.stork.oasisdss.api.ApiUtils;
-import eu.stork.oasisdss.api.LightweightSourceResolver;
-import eu.stork.oasisdss.api.exceptions.ApiUtilsException;
-import eu.stork.oasisdss.api.exceptions.UtilsException;
-import eu.stork.oasisdss.profile.SignResponse;
-import eu.stork.peps.auth.commons.IPersonalAttributeList;
-import eu.stork.peps.auth.commons.PersonalAttribute;
-
-/**
- * 
- * Handles all functionality for the processing of a STORK response
- * @author bzwattendorfer
- *
- */
-public class STORKResponseProcessor {
-	
-	/** OASIS DSS Namespace */
-	public static final String OASIS_DSS_NS = "urn:oasis:names:tc:dss:1.0:core:schema";
-	
-	/** OASIS DSS Success Message */
-	public static final String OASIS_DSS_SUCCESS_MSG = "urn:oasis:names:tc:dss:1.0:resultmajor:Success";
-	
-	/**
-	 * Checks for attribute.
-	 *
-	 * @param attributeName the attribute name
-	 * @param attributeList the attribute list
-	 * @return true, if successful
-	 */
-	public static boolean hasAttribute(String attributeName, IPersonalAttributeList attributeList) {
-		try {
-			getAttributeValue(attributeName, attributeList);
-			return true;
-		} catch(STORKException e) {
-			return false;
-		}
-	}
-
-	/**
-	 * helper for reading attributes. Handles logging and error handling.
-	 *
-	 * @param attributeName the attribute name
-	 * @param attributeList the attribute list
-	 * @return the attribute value
-	 * @throws STORKException the sTORK exception
-	 */
-	private static String getAttributeValue(String attributeName, IPersonalAttributeList attributeList) throws STORKException {
-		return getAttributeValue(attributeName, attributeList, true);
-	}
-	public static String getAttributeValue(String attributeName, IPersonalAttributeList attributeList, boolean throwException) throws STORKException {
-		try {
-			String result = attributeList.get(attributeName).getValue().get(0);
-			Logger.trace(attributeName + " : " + result);
-			return result;
-		} catch(Exception e) {
-			Logger.error(attributeName + " not found in response");
-			if(throwException)
-				throw new STORKException(attributeName + " not found in response");
-			else
-				return null;
-		}
-	}
-
-	/**
-	 * Handels connection to SZR-GW and returns Identity Link on success.
-	 *
-	 * @param attributeList the attribute list
-	 * @param oaFriendlyName the oa friendly name
-	 * @param targetType the target type
-	 * @param targetValue the target value
-	 * @param filters the filters
-	 * @param citizenSignature2 
-	 * @return Identity Link
-	 * @throws STORKException the sTORK exception
-	 * @throws MOAIDException 
-	 */
-	public static IdentityLink connectToSZRGateway(IPersonalAttributeList attributeList, String oaFriendlyName, String targetType, String targetValue, List<String> filters, String citizenSignature) throws STORKException, MOAIDException {
-		Logger.trace("Calling SZR Gateway with the following attributes:");
-
-		CreateIdentityLinkResponse identityLinkResponse = null;
-		IdentityLink identityLink = null;
-		try {
-			Logger.trace("Starting call...");
-
-			// if there is no signedDoc attribute, we cannot go on
-			if(citizenSignature==null || citizenSignature.length()==0)
-			{
-				String signResponseString = getAttributeValue("signedDoc", attributeList);
-				
-				//Extract signature from SIgnResponse
-				Source response1 = new StreamSource(new java.io.StringReader(signResponseString));
-				SignResponse dssSignResponse = ApiUtils.unmarshal(response1, SignResponse.class);
-				citizenSignature = getCitizienSignatureFromSignResponse(dssSignResponse);
-			}
-			
-			String fiscalNumber = getAttributeValue("fiscalNumber", attributeList, false);
-			
-			// if we have a signedDoc we test for a representation case
-			// - according to stork samlengine and commons
-			if(hasAttribute("mandate", attributeList)) {
-				// we have a representation case
-				String mandate = getAttributeValue("mandate", attributeList, false);
-				
-				if(!hasAttribute("dateOfBirth", attributeList)) {
-					// if we get here, we have a natural person representing a legal person
-					String organizationAddress = getAttributeValue("canonicalRegisteredAddress", attributeList, false);
-					String organizationType = getAttributeValue("translateableType", attributeList, false);
-					
-					identityLinkResponse = SZRGWClientUtils.getIdentityLink(citizenSignature, null, null, mandate, organizationAddress, organizationType, targetType, targetValue, oaFriendlyName, filters, fiscalNumber);
-				} else {
-					// if we get here, we have a natural person representing another natural person
-					String eIdentifier = getAttributeValue("eIdentifier", attributeList, false);
-					String givenName = getAttributeValue("givenName", attributeList, false);
-					String lastName = getAttributeValue("surname", attributeList, false);
-					String dateOfBirth = getAttributeValue("dateOfBirth", attributeList, false);
-					
-					// gender attribute is mandatory here because of some legal stuff
-					String gender = getAttributeValue("gender", attributeList, false);
-					
-					if (!StringUtils.isEmpty(dateOfBirth))
-						dateOfBirth = DateTimeUtils.formatPEPSDateToMOADate(dateOfBirth);
-
-					identityLinkResponse = SZRGWClientUtils.getIdentityLink(eIdentifier, 
-							givenName, lastName, dateOfBirth, gender, citizenSignature, null,
-							null, mandate, targetType, targetValue, oaFriendlyName, filters, fiscalNumber);
-				}
-			}
-			// - according to stork spec
-			else if(hasAttribute("mandateContent", attributeList) || hasAttribute("representative", attributeList) || hasAttribute("represented", attributeList)) {
-				// we have a representation case
-				String representative = getAttributeValue("representative", attributeList, false);
-				String represented = getAttributeValue("represented", attributeList, false);
-				String mandate = getAttributeValue("mandateContent", attributeList, false);
-				
-				if(!hasAttribute("dateOfBirth", attributeList)) {
-					// if we get here, we have a natural person representing a legal person
-					String organizationAddress = getAttributeValue("canonicalRegisteredAddress", attributeList, false);
-					String organizationType = getAttributeValue("translateableType", attributeList, false);
-									
-					identityLinkResponse = SZRGWClientUtils.getIdentityLink(citizenSignature, representative, represented, mandate, organizationAddress, organizationType, targetType, targetValue, oaFriendlyName, filters, fiscalNumber);
-				} else {
-					// if we get here, we have a natural person representing another natural person
-					String eIdentifier = getAttributeValue("eIdentifier", attributeList, false);
-					String givenName = getAttributeValue("givenName", attributeList, false);
-					String lastName = getAttributeValue("surname", attributeList, false);
-					String dateOfBirth = getAttributeValue("dateOfBirth", attributeList, false);
-			
-					// gender attribute is mandatory here because of some legal stuff
-					String gender = getAttributeValue("gender", attributeList, false);
-					
-					if (!StringUtils.isEmpty(dateOfBirth))
-						dateOfBirth = DateTimeUtils.formatPEPSDateToMOADate(dateOfBirth);
-
-					identityLinkResponse = SZRGWClientUtils.getIdentityLink(eIdentifier, 
-							givenName, lastName, dateOfBirth, gender, citizenSignature, representative,
-							represented, mandate, targetType, targetValue, oaFriendlyName, filters, fiscalNumber);
-				}
-			} else {
-				// we do not have a representation case
-				String eIdentifier = getAttributeValue("eIdentifier", attributeList, false);
-				String givenName = getAttributeValue("givenName", attributeList, false);
-				String lastName = getAttributeValue("surname", attributeList, false);
-				String dateOfBirth = getAttributeValue("dateOfBirth", attributeList, false);
-				if (!StringUtils.isEmpty(dateOfBirth))
-					dateOfBirth = DateTimeUtils.formatPEPSDateToMOADate(dateOfBirth);
-				identityLinkResponse = SZRGWClientUtils.getIdentityLink(eIdentifier, givenName, lastName, dateOfBirth, citizenSignature, fiscalNumber);
-			}
-	    	
-	    	if (null != identityLinkResponse.getErrorResponse()){
-	    		throw new SZRGWClientException("service.08", (String)identityLinkResponse.getErrorResponse().getErrorCode(), 
-	    				(String)identityLinkResponse.getErrorResponse().getInfo());
-	    	}
-	    	else {
-		    	IdentityLinkAssertionParser ilParser = new IdentityLinkAssertionParser(new ByteArrayInputStream(identityLinkResponse.getIdentityLink()));
-		    	identityLink = ilParser.parseIdentityLink();
-		    	
-		    	Logger.debug("Received Identity Link from SZR Gateway");
-		    	//TODO: is this ok?
-//		    	if (StringUtils.isEmpty(identityLink.getDateOfBirth())) {
-//		    		identityLink.setDateOfBirth("9999-12-31");
-//				}
-
-	    	}
-			
-		} catch (ParseException e) {
-			Logger.error("Error parsing IdentityLink received from SZR-Gateway: ", e);
-			throw new MOAIDException("auth.25", null, e);
-		} catch (ApiUtilsException e) {
-			Logger.error("Error parsing IdentityLink received from SZR-Gateway: ", e);
-			throw new MOAIDException("auth.25", null, e);
-		} catch (IllegalArgumentException e) {
-			Logger.error("Error parsing IdentityLink received from SZR-Gateway: ", e);
-			throw new MOAIDException("auth.25", null, e);
-		} catch (TransformerConfigurationException e) {
-			Logger.error("Error parsing IdentityLink received from SZR-Gateway: ", e);
-			throw new MOAIDException("auth.25", null, e);
-		} catch (UtilsException e) {
-			Logger.error("Error parsing IdentityLink received from SZR-Gateway: ", e);
-			throw new MOAIDException("auth.25", null, e);
-		} catch (TransformerException e) {
-			Logger.error("Error parsing IdentityLink received from SZR-Gateway: ", e);
-			throw new MOAIDException("auth.25", null, e);
-		} catch (TransformerFactoryConfigurationError e) {
-			Logger.error("Error parsing IdentityLink received from SZR-Gateway: ", e);
-			throw new MOAIDException("auth.25", null, e);
-		} catch (IOException e) {
-			Logger.error("Error parsing IdentityLink received from SZR-Gateway: ", e);
-			throw new MOAIDException("auth.25", null, e);
-		} 
-    		    
-    	return identityLink;
-		
-	}
-		
-	private static String getCitizienSignatureFromSignResponse(SignResponse dssSignResponse) throws IllegalArgumentException, TransformerConfigurationException, UtilsException, TransformerException, TransformerFactoryConfigurationError, IOException, ApiUtilsException
-	{
-		// fetch signed doc
-		DataSource ds = LightweightSourceResolver.getDataSource(dssSignResponse);
-		if(ds == null){
-			throw new ApiUtilsException("No datasource found in response");
-		}				
-
-		InputStream incoming  = ds.getInputStream();
-		String citizenSignature = IOUtils.toString(incoming);
-		incoming.close();
-
-		return citizenSignature;
-	}
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKAdoptedFamilyNameAttributBuilder.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKAdoptedFamilyNameAttributBuilder.java
deleted file mode 100644
index 124e490f2..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKAdoptedFamilyNameAttributBuilder.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.builder.attributes;
-
-import at.gv.egovernment.moa.id.auth.stork.STORKConstants;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
-
-public class STORKAdoptedFamilyNameAttributBuilder implements IPVPAttributeBuilder  {
-
-	public String getName() {
-		return STORKConstants.ADOPTEDFAMILYNAME_NAME;
-	}
-
-	public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
-			IAttributeGenerator<ATT> g) throws AttributeException {
-		
-		return g.buildStringAttribute(STORKConstants.ADOPTEDFAMILYNAME_FRIENDLYNAME, STORKConstants.ADOPTEDFAMILYNAME_NAME, 
-				STORKAttributHelper.getAttribut(STORKConstants.ADOPTEDFAMILYNAME_NAME, authData)); 
-					
-	}
-
-	public <ATT> ATT buildEmpty(IAttributeGenerator<ATT> g) {
-		return g.buildEmptyAttribute(STORKConstants.ADOPTEDFAMILYNAME_FRIENDLYNAME, STORKConstants.ADOPTEDFAMILYNAME_NAME);
-	}
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKAttributHelper.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKAttributHelper.java
deleted file mode 100644
index 9a0598cf6..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKAttributHelper.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- */
-package at.gv.egovernment.moa.id.protocols.builder.attributes;
-
-import eu.stork.peps.auth.commons.IPersonalAttributeList;
-import eu.stork.peps.auth.commons.PersonalAttribute;
-import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
-import at.gv.egovernment.moa.id.auth.stork.STORKConstants;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.UnavailableAttributeException;
-import at.gv.egovernment.moa.logging.Logger;
-
-/**
- * @author tlenz
- *
- */
-public class STORKAttributHelper {
-
-	public static String getAttribut(String attributName,
-			IAuthData authSession) throws UnavailableAttributeException {
-		
-		if (!authSession.isForeigner()) {
-			throw new UnavailableAttributeException(attributName);
-			
-		} else {
-			IPersonalAttributeList storkAttributes = authSession.getStorkAttributes();
-			
-			if ( storkAttributes == null ) {
-				throw new UnavailableAttributeException(attributName);
-				
-			}
-
-			try {
-				PersonalAttribute attribut = storkAttributes.get(attributName);
-				if (attribut != null) {
-					
-					return attribut.getValue().get(0);					 
-					
-				} else
-					throw new UnavailableAttributeException(attributName);
-				
-			} catch (Exception e) {
-				Logger.warn("Attribut " + attributName + " generation error", e);
-				throw new UnavailableAttributeException(attributName);
-			}
-		}
-		
-	}
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKCanonicalResidenceAddressAttributBuilder.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKCanonicalResidenceAddressAttributBuilder.java
deleted file mode 100644
index 66d8a6bc1..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKCanonicalResidenceAddressAttributBuilder.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.builder.attributes;
-
-import at.gv.egovernment.moa.id.auth.stork.STORKConstants;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
-
-public class STORKCanonicalResidenceAddressAttributBuilder implements IPVPAttributeBuilder  {
-
-	public String getName() {
-		return STORKConstants.CANONICALRESIDENCEADDRESS_NAME;
-	}
-
-	public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
-			IAttributeGenerator<ATT> g) throws AttributeException {
-		
-		return g.buildStringAttribute(STORKConstants.CANONICALRESIDENCEADDRESS_FRIENDLYNAME, STORKConstants.CANONICALRESIDENCEADDRESS_NAME, 
-				STORKAttributHelper.getAttribut(STORKConstants.CANONICALRESIDENCEADDRESS_NAME, authData)); 
-					
-	}
-
-	public <ATT> ATT buildEmpty(IAttributeGenerator<ATT> g) {
-		return g.buildEmptyAttribute(STORKConstants.CANONICALRESIDENCEADDRESS_FRIENDLYNAME, STORKConstants.CANONICALRESIDENCEADDRESS_NAME);
-	}
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKCountryCodeOfBirthAttributBuilder.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKCountryCodeOfBirthAttributBuilder.java
deleted file mode 100644
index 706f5dd3a..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKCountryCodeOfBirthAttributBuilder.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.builder.attributes;
-
-import at.gv.egovernment.moa.id.auth.stork.STORKConstants;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
-
-public class STORKCountryCodeOfBirthAttributBuilder implements IPVPAttributeBuilder  {
-
-	public String getName() {
-		return STORKConstants.CONTRYCODEOFBIRTH_NAME;
-	}
-
-	public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
-			IAttributeGenerator<ATT> g) throws AttributeException {
-		
-		return g.buildStringAttribute(STORKConstants.CONTRYCODEOFBIRTH_FRIENDLYNAME, STORKConstants.CONTRYCODEOFBIRTH_NAME, 
-				STORKAttributHelper.getAttribut(STORKConstants.CONTRYCODEOFBIRTH_NAME, authData)); 
-					
-	}
-
-	public <ATT> ATT buildEmpty(IAttributeGenerator<ATT> g) {
-		return g.buildEmptyAttribute(STORKConstants.CONTRYCODEOFBIRTH_FRIENDLYNAME, STORKConstants.CONTRYCODEOFBIRTH_NAME);
-	}
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKFiscalNumberAttributBuilder.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKFiscalNumberAttributBuilder.java
deleted file mode 100644
index adc1d28da..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKFiscalNumberAttributBuilder.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.builder.attributes;
-
-import at.gv.egovernment.moa.id.auth.stork.STORKConstants;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
-
-public class STORKFiscalNumberAttributBuilder implements IPVPAttributeBuilder  {
-
-	public String getName() {
-		return STORKConstants.FISCALNUMBER_NAME;
-	}
-
-	public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
-			IAttributeGenerator<ATT> g) throws AttributeException {
-		
-		return g.buildStringAttribute(STORKConstants.FISCALNUMBER_FRIENDLYNAME, STORKConstants.FISCALNUMBER_NAME, 
-				STORKAttributHelper.getAttribut(STORKConstants.FISCALNUMBER_NAME, authData)); 
-					
-	}
-
-	public <ATT> ATT buildEmpty(IAttributeGenerator<ATT> g) {
-		return g.buildEmptyAttribute(STORKConstants.FISCALNUMBER_FRIENDLYNAME, STORKConstants.FISCALNUMBER_NAME);
-	}
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKGenderAttributBuilder.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKGenderAttributBuilder.java
deleted file mode 100644
index 2faeaf2d7..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKGenderAttributBuilder.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.builder.attributes;
-
-import at.gv.egovernment.moa.id.auth.stork.STORKConstants;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
-
-public class STORKGenderAttributBuilder implements IPVPAttributeBuilder  {
-
-	public String getName() {
-		return STORKConstants.GENDER_NAME;
-	}
-
-	public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
-			IAttributeGenerator<ATT> g) throws AttributeException {
-		
-		return g.buildStringAttribute(STORKConstants.GENDER_FRIENDLYNAME, STORKConstants.GENDER_NAME, 
-				STORKAttributHelper.getAttribut(STORKConstants.GENDER_NAME, authData)); 
-					
-	}
-
-	public <ATT> ATT buildEmpty(IAttributeGenerator<ATT> g) {
-		return g.buildEmptyAttribute(STORKConstants.GENDER_FRIENDLYNAME, STORKConstants.GENDER_NAME);
-	}
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKInhertedFamilyNameAttributBuilder.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKInhertedFamilyNameAttributBuilder.java
deleted file mode 100644
index b6d29d42f..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKInhertedFamilyNameAttributBuilder.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.builder.attributes;
-
-import at.gv.egovernment.moa.id.auth.stork.STORKConstants;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
-
-public class STORKInhertedFamilyNameAttributBuilder implements IPVPAttributeBuilder  {
-
-	public String getName() {
-		return STORKConstants.INHERITEDFAMILYNAME_NAME;
-	}
-
-	public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
-			IAttributeGenerator<ATT> g) throws AttributeException {
-		
-		return g.buildStringAttribute(STORKConstants.INHERITEDFAMILYNAME_FRIENDLYNAME, STORKConstants.INHERITEDFAMILYNAME_NAME, 
-				STORKAttributHelper.getAttribut(STORKConstants.INHERITEDFAMILYNAME_NAME, authData)); 
-					
-	}
-
-	public <ATT> ATT buildEmpty(IAttributeGenerator<ATT> g) {
-		return g.buildEmptyAttribute(STORKConstants.INHERITEDFAMILYNAME_FRIENDLYNAME, STORKConstants.INHERITEDFAMILYNAME_NAME);
-	}
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKIsAgeOverAttributBuilder.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKIsAgeOverAttributBuilder.java
deleted file mode 100644
index 2ac3e2aaa..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKIsAgeOverAttributBuilder.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.builder.attributes;
-
-import at.gv.egovernment.moa.id.auth.stork.STORKConstants;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
-
-public class STORKIsAgeOverAttributBuilder implements IPVPAttributeBuilder  {
-
-	public String getName() {
-		return STORKConstants.ISAGEOVER_NAME;
-	}
-
-	public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
-			IAttributeGenerator<ATT> g) throws AttributeException {
-		
-		return g.buildStringAttribute(STORKConstants.ISAGEOVER_FRIENDLYNAME, STORKConstants.ISAGEOVER_NAME, 
-				STORKAttributHelper.getAttribut(STORKConstants.ISAGEOVER_NAME, authData)); 
-					
-	}
-
-	public <ATT> ATT buildEmpty(IAttributeGenerator<ATT> g) {
-		return g.buildEmptyAttribute(STORKConstants.ISAGEOVER_FRIENDLYNAME, STORKConstants.ISAGEOVER_NAME);
-	}
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKMaritalStatusAttributBuilder.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKMaritalStatusAttributBuilder.java
deleted file mode 100644
index c4e42029e..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKMaritalStatusAttributBuilder.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.builder.attributes;
-
-import at.gv.egovernment.moa.id.auth.stork.STORKConstants;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
-
-public class STORKMaritalStatusAttributBuilder implements IPVPAttributeBuilder  {
-
-	public String getName() {
-		return STORKConstants.MARITALSTATUS_NAME;
-	}
-
-	public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
-			IAttributeGenerator<ATT> g) throws AttributeException {
-		
-		return g.buildStringAttribute(STORKConstants.MARITALSTATUS_FRIENDLYNAME, STORKConstants.MARITALSTATUS_NAME, 
-				STORKAttributHelper.getAttribut(STORKConstants.MARITALSTATUS_NAME, authData)); 
-					
-	}
-
-	public <ATT> ATT buildEmpty(IAttributeGenerator<ATT> g) {
-		return g.buildEmptyAttribute(STORKConstants.MARITALSTATUS_FRIENDLYNAME, STORKConstants.MARITALSTATUS_NAME);
-	}
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKNationalityCodeAttributBuilder.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKNationalityCodeAttributBuilder.java
deleted file mode 100644
index 47fbdd145..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKNationalityCodeAttributBuilder.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.builder.attributes;
-
-import at.gv.egovernment.moa.id.auth.stork.STORKConstants;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
-
-public class STORKNationalityCodeAttributBuilder implements IPVPAttributeBuilder  {
-
-	public String getName() {
-		return STORKConstants.NATIONALITYCODE_NAME;
-	}
-
-	public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
-			IAttributeGenerator<ATT> g) throws AttributeException {
-		
-		return g.buildStringAttribute(STORKConstants.NATIONALITYCODE_FRIENDLYNAME, STORKConstants.NATIONALITYCODE_NAME, 
-				STORKAttributHelper.getAttribut(STORKConstants.NATIONALITYCODE_NAME, authData)); 
-					
-	}
-
-	public <ATT> ATT buildEmpty(IAttributeGenerator<ATT> g) {
-		return g.buildEmptyAttribute(STORKConstants.NATIONALITYCODE_FRIENDLYNAME, STORKConstants.NATIONALITYCODE_NAME);
-	}
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKPseudonymAttributBuilder.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKPseudonymAttributBuilder.java
deleted file mode 100644
index 6b079b8d4..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKPseudonymAttributBuilder.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.builder.attributes;
-
-import at.gv.egovernment.moa.id.auth.stork.STORKConstants;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
-
-public class STORKPseudonymAttributBuilder implements IPVPAttributeBuilder  {
-
-	public String getName() {
-		return STORKConstants.PSEUDONYM_NAME;
-	}
-
-	public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
-			IAttributeGenerator<ATT> g) throws AttributeException {
-		
-		return g.buildStringAttribute(STORKConstants.PSEUDONYM_FRIENDLYNAME, STORKConstants.PSEUDONYM_NAME, 
-				STORKAttributHelper.getAttribut(STORKConstants.PSEUDONYM_NAME, authData)); 
-					
-	}
-
-	public <ATT> ATT buildEmpty(IAttributeGenerator<ATT> g) {
-		return g.buildEmptyAttribute(STORKConstants.PSEUDONYM_FRIENDLYNAME, STORKConstants.PSEUDONYM_NAME);
-	}
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKResidencePermitAttributBuilder.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKResidencePermitAttributBuilder.java
deleted file mode 100644
index 5728a3979..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKResidencePermitAttributBuilder.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.builder.attributes;
-
-import at.gv.egovernment.moa.id.auth.stork.STORKConstants;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
-
-public class STORKResidencePermitAttributBuilder implements IPVPAttributeBuilder  {
-
-	public String getName() {
-		return STORKConstants.RESIDENCEPERMIT_NAME;
-	}
-
-	public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
-			IAttributeGenerator<ATT> g) throws AttributeException {
-		
-		return g.buildStringAttribute(STORKConstants.RESIDENCEPERMIT_FRIENDLYNAME, STORKConstants.RESIDENCEPERMIT_NAME, 
-				STORKAttributHelper.getAttribut(STORKConstants.RESIDENCEPERMIT_NAME, authData)); 
-					
-	}
-
-	public <ATT> ATT buildEmpty(IAttributeGenerator<ATT> g) {
-		return g.buildEmptyAttribute(STORKConstants.RESIDENCEPERMIT_FRIENDLYNAME, STORKConstants.RESIDENCEPERMIT_NAME);
-	}
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKTextResidenceAddressAttributBuilder.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKTextResidenceAddressAttributBuilder.java
deleted file mode 100644
index 1879eb42a..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKTextResidenceAddressAttributBuilder.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.builder.attributes;
-
-import at.gv.egovernment.moa.id.auth.stork.STORKConstants;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.AttributeException;
-
-public class STORKTextResidenceAddressAttributBuilder implements IPVPAttributeBuilder  {
-
-	public String getName() {
-		return STORKConstants.TEXTRESIDENCEADDRESS_NAME;
-	}
-
-	public <ATT> ATT build(IOAAuthParameters oaParam, IAuthData authData,
-			IAttributeGenerator<ATT> g) throws AttributeException {
-		
-		return g.buildStringAttribute(STORKConstants.TEXTRESIDENCEADDRESS_FRIENDLYNAME, STORKConstants.TEXTRESIDENCEADDRESS_NAME, 
-				STORKAttributHelper.getAttribut(STORKConstants.TEXTRESIDENCEADDRESS_NAME, authData)); 
-					
-	}
-
-	public <ATT> ATT buildEmpty(IAttributeGenerator<ATT> g) {
-		return g.buildEmptyAttribute(STORKConstants.TEXTRESIDENCEADDRESS_FRIENDLYNAME, STORKConstants.TEXTRESIDENCEADDRESS_NAME);
-	}
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AttributeCollector.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AttributeCollector.java
deleted file mode 100644
index 2e72f216a..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AttributeCollector.java
+++ /dev/null
@@ -1,367 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2;
-
-import java.util.ArrayList;
-import java.util.Iterator;
-import java.util.List;
-
-import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.data.SLOInformationImpl;
-import at.gv.egovernment.moa.id.data.SLOInformationInterface;
-import at.gv.egovernment.moa.id.moduls.IAction;
-import at.gv.egovernment.moa.id.moduls.IRequest;
-import at.gv.egovernment.moa.id.protocols.stork2.attributeproviders.AttributeProvider;
-import at.gv.egovernment.moa.id.storage.AssertionStorage;
-import at.gv.egovernment.moa.logging.Logger;
-import eu.stork.peps.auth.commons.*;
-import eu.stork.peps.auth.engine.STORKSAMLEngine;
-import eu.stork.peps.complex.attributes.eu.stork.names.tc.stork._1_0.assertion.AttributeStatusType;
-import eu.stork.peps.exceptions.STORKSAMLEngineException;
-
-import org.opensaml.common.impl.SecureRandomIdentifierGenerator;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-/**
- * The AttributeCollector Action tries to get all requested attributes from a set of {@link AttributeProvider} Plugins.
- * The class is called whenever the {@link AuthenticationRequest} Action is invoked and checks for missing attributes.
- * Furthermore, the class can handle direct posts. That is when the class triggers an attribute query which needs user
- * interaction, redirect to another portal, etc. The redirect will hit here and the class can continue to fetch attributes.
- * 
- * TODO how do we treat mandatory and optional attributes?
- */
-public class AttributeCollector implements IAction {
-
-    /**
-     * The Constant ARTIFACT_ID.
-     */
-    private static final String ARTIFACT_ID = "artifactId";
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.moduls.IAction#processRequest(at.gv.egovernment.moa.id.moduls.IRequest, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, at.gv.egovernment.moa.id.auth.data.AuthenticationSession)
-     */
-    public SLOInformationInterface processRequest(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp, IAuthData authData) throws MOAIDException {
-
-		// - fetch the container
-		String artifactId = (String) httpReq.getParameter(ARTIFACT_ID);
-		DataContainer container;
-		try {
-			container = AssertionStorage.getInstance().get(artifactId, DataContainer.class);
-		} catch (MOADatabaseException e) {
-			Logger.error("Error fetching incomplete Stork response from temporary storage. Most likely a timeout occured.", e);
-			throw new MOAIDException("stork.11", null);
-		}
-
-
-        if (httpReq.getParameter("SAMLResponse") != null) {
-            Logger.info("Got SAML response from external attribute provider.");
-
-            MOASTORKResponse STORK2Response = new MOASTORKResponse(httpReq);
-
-            //extract STORK Response from HTTP Request
-            byte[] decSamlToken;
-            try {
-                decSamlToken = PEPSUtil.decodeSAMLToken(httpReq.getParameter("SAMLResponse"));
-            } catch (NullPointerException e) {
-                if (httpReq.getRemoteHost().contains("129.27.142")) {
-                    Logger.warn("Availability check by " + httpReq.getRemoteHost() + " on URI: " + httpReq.getRequestURI());
-                } else {
-                    Logger.error("Unable to retrieve STORK Request for host: " + httpReq.getRemoteHost() + " and URI: " + httpReq.getRequestURI(), e);
-                }
-                throw new MOAIDException("stork.04", null);
-            }
-
-            //Get SAMLEngine instance
-            STORKSAMLEngine engine = STORKSAMLEngine.getInstance("VIDP");
-
-            STORKAuthnResponse authnResponse = null;
-
-
-            // check if valid authn response is contained
-            try {
-                authnResponse = engine.validateSTORKAuthnResponse(decSamlToken, httpReq.getRemoteAddr());
-            } catch (STORKSAMLEngineException ex) {
-                Logger.error("Unable to validate Stork AuthenticationResponse: " + ex.getMessage());
-            }
-
-            STORK2Response.setSTORKAuthnResponseToken(decSamlToken);
-
-            // check if the attributes are provided for the same person from request
-            // requires presence of eIdentifier for unambigious correlation
-            Logger.debug("Checking if the attribute relates to the correct person..");
-            try {
-                String remoteEIdentifier= authnResponse.getPersonalAttributeList().get("eIdentifier").getValue().get(0);
-                String localEidentifier= container.getResponse().getStorkAuthnResponse().getPersonalAttributeList().get("eIdentifier").getValue().get(0);
-                    if (!remoteEIdentifier.equals(localEidentifier)) {
-                        Logger.error("The attribute is not provided for the same person!");
-                        throw new MOAIDException("stork.25", null);
-                    }
-            } catch (NullPointerException ex) {
-                Logger.warn("Could not check the correlation of attributes from external provider. Ignoring the check.");
-                //Logger.debug(ex);
-                //throw new MOAIDException("stork.04", null); // TODO revise message, raise exception when ehvd checked
-            }
-
-            if (authnResponse.getPersonalAttributeList().size() > 0) {
-                Logger.info("Response from external attribute provider contains " + authnResponse.getPersonalAttributeList().size() + " attributes.");
-                container.getResponse().setPersonalAttributeList(addOrUpdateAll(container.getResponse().getPersonalAttributeList(), authnResponse.getPersonalAttributeList()));
-            }
-
-        }
-
-        // end addition
-
-
-        // read configuration parameters of OA
-        OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(container.getRequest().getAssertionConsumerServiceURL());
-        if (oaParam == null)
-            throw new AuthenticationException("stork.12", new Object[]{container.getRequest().getAssertionConsumerServiceURL()});
-
-        // find the attribute provider plugin that can handle the response
-        IPersonalAttributeList newAttributes = null;
-        
-        Iterator<AttributeProvider> attibuteProvidersInterator = AttributeProviderFactory.getConfiguredPlugins(oaParam.getStorkAPs());        
-        while(attibuteProvidersInterator.hasNext())
-            try {
-                newAttributes = attibuteProvidersInterator.next().parse(httpReq);
-                
-                // stop as soon as we hit a capable plugin
-                break;
-            } catch (UnsupportedAttributeException e1) {
-                // the current provider cannot find anything familiar within the
-                // provided httpreq. Try the next one.
-            }
-
-        if (null == newAttributes) {
-            // we do not have a provider which is capable of fetching something
-            // from the received httpreq.
-            Logger.error("No attribute could be retrieved from the response the attribute provider gave us.");
-        }
-
-        // - insert the embedded attribute(s) into the container
-        if (null != newAttributes)
-        	container.getResponse().setPersonalAttributeList(addOrUpdateAll(container.getResponse().getPersonalAttributeList(), newAttributes));
-
-        // see if we need some more attributes
-        SLOInformationImpl sloInfo = (SLOInformationImpl) processRequest(container, httpReq, httpResp, authData, oaParam);
-        
-        if (sloInfo == null) {
-        	sloInfo = new SLOInformationImpl(req.getAuthURL(), null, null, null, req.requestedModule());
-        }
-        
-        return sloInfo;
-        
-    }
-
-    /**
-     * Checks if there are missing attributes and tries to fetch them. If there are no more attribute to fetch,
-     * this very method creates and sends the protocol result to the asking S-PEPS.
-     *
-     * @param container the {@link DataContainer} representing the status of the overall query.
-     * @return the string
-     * @throws MOAIDException
-     */
-    public SLOInformationInterface processRequest(DataContainer container, HttpServletRequest request, HttpServletResponse response, IAuthData authData, OAAuthParameter oaParam) throws MOAIDException {
-        // check if there are attributes we need to fetch
-
-        IPersonalAttributeList requestAttributeList = container.getRequest().getPersonalAttributeList();
-        IPersonalAttributeList responseAttributeList = container.getResponse().getPersonalAttributeList();
-        List<PersonalAttribute> missingAttributes = new ArrayList<PersonalAttribute>();
-        Logger.debug("aquire list of missing attributes");
-        for (PersonalAttribute current : requestAttributeList)
-            if (!responseAttributeList.containsKey(current.getName())) {
-                if(null == current.getStatus() || (null != current.getStatus() && !current.getStatus().equals(AttributeStatusType.WITHHELD.value()))) {
-                    // add the ones we need
-                    missingAttributes.add(current);
-                    Logger.debug("add " + current.getName() + " to the list of missing attributes");
-                }
-            } else {
-                // remove the ones we do not want to share from the response list
-                if(null != current.getStatus() && current.getStatus().equals(AttributeStatusType.WITHHELD.value())) {
-                    responseAttributeList.remove(current.getName());
-                    Logger.debug("remove " + current.getName() + " from the list of resulting attributes because the user does not want to disclose the data");
-                }
-            }
-
-        Logger.info("collecting attributes...");
-		Logger.debug("found " + missingAttributes.size() + " missing attributes");
-
-        // Try to get all missing attributes
-        try {
-            // for each attribute still missing
-            for (PersonalAttribute currentAttribute : missingAttributes) {
-            	
-				/*
-				 * prefill attributes with "notAvailable". If we get them later, we override the value and status.
-				 * This way, there is no error case in which an attribute is left unanswered.
-				 */
-				IPersonalAttributeList aquiredAttributes = new PersonalAttributeList();
-				currentAttribute.setStatus(AttributeStatusType.NOT_AVAILABLE.value());
-				aquiredAttributes.add((PersonalAttribute) currentAttribute.clone());
-				container.getResponse().setPersonalAttributeList(
-						addOrUpdateAll(container.getResponse().getPersonalAttributeList(), aquiredAttributes));
-            	// - check if we can find a suitable AttributeProvider Plugin
-
-		        Iterator<AttributeProvider> attibuteProvidersInterator = AttributeProviderFactory.getConfiguredPlugins(oaParam.getStorkAPs());        
-		        while(attibuteProvidersInterator.hasNext()) {
-		        	AttributeProvider currentProvider = attibuteProvidersInterator.next();
-
-                    // build a section of attribute provider's predefined attributes and missing attributes
-                    // only missing attributes that can be handled by attribute provider will be sent to it
-                    List<PersonalAttribute> currentProviderConfiguredAttributes = new ArrayList<PersonalAttribute>();
-                    for (String attributeName : currentProvider.getSupportedAttributeNames())  {
-                        for (PersonalAttribute missingAttribute : missingAttributes) {
-                            if (missingAttribute.getName().equals(attributeName)) {
-                                currentProviderConfiguredAttributes.add(missingAttribute);
-                                break;
-                            }
-                        }
-                    }
-
-                    try {
-                        // - hand over control to the suitable plugin
-                    	Logger.info(currentProvider.getClass().getSimpleName() + " called to handle attribute '" + currentAttribute.getName() + "'");
-
-                        //aquiredAttributes = currentProvider.acquire(currentAttribute, container.getRequest().getSpCountry(), moasession);
-                        //aquiredAttributes = currentProvider.acquire(missingAttributes, container.getRequest().getSpCountry(), moasession);
-                        aquiredAttributes = currentProvider.acquire(currentProviderConfiguredAttributes, container.getRequest(), authData);
-
-                        Logger.info(currentProvider.getClass().getSimpleName() + " can handle attribute '" + currentAttribute.getName() + "'");
-                        break;
-                    } catch (UnsupportedAttributeException e) {
-                        // ok, try the next attributeprovider
-                    	Logger.info(currentProvider.getClass().getSimpleName() + " could not handle attribute '" + currentAttribute.getName() + "'");
-                    } catch (MOAIDException e) {
-                        // the current plugin had an error. Try the next one.
-                    	Logger.info(currentProvider.getClass().getSimpleName() + " could not handle attribute '" + currentAttribute.getName() + "' due to an error");
-                    }
-                }
-                
-				// check if we could fetch the attribute
-				if (null == aquiredAttributes) {
-					// if not
-					Logger.error("We have no suitable plugin for obtaining the attribute '" + currentAttribute.getName() + "'");
-				} else
-					// else, update any existing attributes
-					container.getResponse().setPersonalAttributeList(addOrUpdateAll(container.getResponse().getPersonalAttributeList(), aquiredAttributes));
-            }
-            Logger.info("collecting attributes done");
-            
-            // ask for consent if necessary
-            new ConsentEvaluator().generateSTORKResponse(response, container);
-
-            return null; // AssertionId
-                            // TODO
-
-        } catch (ExternalAttributeRequestRequiredException e) {
-            // the attribute request is ongoing and requires an external service.
-            try {
-                // memorize the container again
-				Logger.debug("prepare putting the container into temporary storage...");
-
-                // - generate new key
-                String newArtifactId = new SecureRandomIdentifierGenerator()
-                        .generateIdentifier();
-                // - put container in temporary store.
-                AssertionStorage.getInstance().put(newArtifactId, container);
-
-				Logger.debug("...successful");
-
-				Logger.info(e.getAp().getClass().getSimpleName() + " is going to ask an external service provider for the requested attributes");
-
-                // add container-key to redirect embedded within the return URL
-                e.getAp().performRedirect(AuthConfigurationProviderFactory.getInstance().getPublicURLPrefix().get(0) + "/stork2/ResumeAuthentication?" + ARTIFACT_ID + "=" + newArtifactId, request, response, oaParam);
-
-            } catch (Exception e1) {
-                // TODO should we return the response as is to the PEPS?
-                Logger.error("Error putting incomplete Stork response into temporary storage", e1);
-                e1.printStackTrace();
-                throw new MOAIDException("stork.11", null);
-            }
-
-            //TODO: in case of Single LogOut -> SLO information has to be stored
-            return null; // TODO what to do here?
-        }
-    }
-
-    /**
-     * Adds or updates all {@link PersonalAttribute} objects given in {@code source} to/in {@code target}.
-     *
-     * @param target the target
-     * @param source the source
-     * @return 
-     * @throws MOAIDException 
-     */
-	private PersonalAttributeList addOrUpdateAll(IPersonalAttributeList target, IPersonalAttributeList source) throws MOAIDException {
-
-		PersonalAttributeList updatedList = new PersonalAttributeList();
-		for (PersonalAttribute el : target)
-			updatedList.add(el);
-		
-		Logger.debug("Updating " + source.size() + " attributes...");
-		for (PersonalAttribute current : source) {
-			Logger.debug("treating " + current.getName());
-	        
-			// check if we need to update the current pa
-			if (updatedList.containsKey(current.getName())) {
-				PersonalAttribute existing = target.get(current.getName());
-				if(!(existing.isEmptyValue() && existing.isEmptyComplexValue()))
-					if(!(existing.getValue().equals(current.getValue()) || existing.getComplexValue().equals(current.getComplexValue()))) {
-		                Logger.error("Attribute Value does not match the value from first authentication!");
-		                throw new MOAIDException("stork.16", new Object[] {existing.getName()});
-					}
-
-				updatedList.get(current.getName()).setStatus(current.getStatus());
-				updatedList.get(current.getName()).setValue(current.getValue());
-				updatedList.get(current.getName()).setComplexValue(current.getComplexValue());
-			} else
-				updatedList.add(current);
-
-			Logger.debug("...successfully treated " + current.getName());			
-		}
-		
-		return updatedList;
-	}
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.moduls.IAction#needAuthentication(at.gv.egovernment.moa.id.moduls.IRequest, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
-     */
-    public boolean needAuthentication(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp) {
-    	// this action does not need any authentication. The authentication is already done by the preceding AuthenticationRequest-Action.
-        return false;
-    }
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.moduls.IAction#getDefaultActionName()
-     */
-    public String getDefaultActionName() {
-        return STORKProtocol.ATTRIBUTE_COLLECTOR;
-    }
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AttributeProviderFactory.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AttributeProviderFactory.java
deleted file mode 100644
index aadbbd959..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AttributeProviderFactory.java
+++ /dev/null
@@ -1,101 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2;
-
-import at.gv.egovernment.moa.id.commons.MOAIDConstants;
-import at.gv.egovernment.moa.id.config.stork.StorkAttributeProviderPlugin;
-import at.gv.egovernment.moa.id.protocols.stork2.attributeproviders.AttributeProvider;
-import at.gv.egovernment.moa.id.protocols.stork2.attributeproviders.EHvdAttributeProviderPlugin;
-import at.gv.egovernment.moa.id.protocols.stork2.attributeproviders.MandateAttributeRequestProvider;
-import at.gv.egovernment.moa.id.protocols.stork2.attributeproviders.PVPAuthenticationProvider;
-import at.gv.egovernment.moa.id.protocols.stork2.attributeproviders.SignedDocAttributeRequestProvider;
-import at.gv.egovernment.moa.id.protocols.stork2.attributeproviders.StorkAttributeRequestProvider;
-import at.gv.egovernment.moa.logging.Logger;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Iterator;
-import java.util.List;
-import java.util.PriorityQueue;
-
-/**
- * A factory for creating AttributeProvider objects.
- */
-public class AttributeProviderFactory {
-
-    /**
-     * Gets the available plugins.
-     *
-     * @return the available plugins
-     */
-    public static List<String> getAvailablePlugins() {
-        return MOAIDConstants.ALLOWED_STORKATTRIBUTEPROVIDERS;
-    }
-
-    /**
-     * Creates an AttributeProvider object for the given shortname. Returns
-     * {@code null} if there is no such provider available.
-     *
-     * @param shortname the simpleName for the providers class
-     * @return the attribute provider
-     */
-    public static AttributeProvider create(String shortname, String url, String attributes) {
-        if (shortname.equals("StorkAttributeRequestProvider")) {
-            return new StorkAttributeRequestProvider(url, attributes);
-        } else if (shortname.equals("EHvdAttributeProvider")) {
-            return new EHvdAttributeProviderPlugin(url, attributes);
-        } else if (shortname.equals("SignedDocAttributeRequestProvider")) {
-            return new SignedDocAttributeRequestProvider(url, attributes);
-        } else if (shortname.equals("MandateAttributeRequestProvider")) {
-            try {
-                return new MandateAttributeRequestProvider(url, attributes);
-            } catch (Exception ex) {
-                ex.printStackTrace();
-                return null;
-            }
-        } else if (shortname.equals("PVPAuthenticationProvider")) {
-        	return new PVPAuthenticationProvider(url, attributes);
-        } else {
-            return null;
-        }
-    }
-
-    /**
-     * Gets fresh instances of the configured plugins.
-     *
-     * @param collection the configured a ps
-     * @return the configured plugins
-     */
-    public static Iterator<AttributeProvider> getConfiguredPlugins(
-            Collection<StorkAttributeProviderPlugin> collection) {
-
-    	PriorityQueue<AttributeProvider> result = new PriorityQueue<AttributeProvider>();
-        for (StorkAttributeProviderPlugin current : collection) {
-
-            result.add(create(current.getName(), current.getUrl(), current.getAttributes()));
-            Logger.debug("Adding configured attribute provider: " + current.getClass().getName() + current.getName() + " at " + current.getUrl());
-        }
-
-        return result.iterator();
-    }
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AuthenticationRequest.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AuthenticationRequest.java
deleted file mode 100644
index f16f7c9a8..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/AuthenticationRequest.java
+++ /dev/null
@@ -1,531 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2;
-
-import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.data.MISMandate;
-import at.gv.egovernment.moa.id.data.SLOInformationImpl;
-import at.gv.egovernment.moa.id.data.SLOInformationInterface;
-import at.gv.egovernment.moa.id.moduls.IAction;
-import at.gv.egovernment.moa.id.moduls.IRequest;
-import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
-import at.gv.egovernment.moa.id.storage.AssertionStorage;
-import at.gv.egovernment.moa.id.util.VelocityProvider;
-import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.MiscUtil;
-import eu.stork.peps.auth.commons.*;
-import eu.stork.peps.auth.engine.STORKSAMLEngine;
-import eu.stork.peps.exceptions.STORKSAMLEngineException;
-import org.apache.velocity.Template;
-import org.apache.velocity.VelocityContext;
-import org.apache.velocity.app.VelocityEngine;
-import org.apache.velocity.runtime.RuntimeConstants;
-import org.w3c.dom.Element;
-import org.w3c.dom.NamedNodeMap;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import java.io.IOException;
-import java.io.StringWriter;
-import java.net.MalformedURLException;
-import java.net.URL;
-
-
-/**
- * Second request step - after authentication of the user is done and moasession obtained,
- * process request and forward the user further to PEPS and/or other entities
- *
- * @author bsuzic
- */
-
-public class AuthenticationRequest implements IAction {
-
-
-    private VelocityEngine velocityEngine;
-    private MOASTORKRequest moaStorkRequest = null;
-
-
-    public SLOInformationInterface processRequest(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp, IAuthData authData) throws MOAIDException {
-
-        if ((req instanceof MOASTORKRequest)) { // && ( ((MOASTORKRequest) req).getCitizenCountryCode() == null || ((MOASTORKRequest) req).getCitizenCountryCode().equals("AT") )) {
-
-            this.moaStorkRequest = (MOASTORKRequest) req;
-
-            Logger.debug("Entering MOASTORKRequest");
-            httpResp.reset();
-
-            //TODO: CHECK: req.getOAURL() should return the unique OA identifier
-            OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(req.getOAURL());
-            if (oaParam == null)
-                throw new AuthenticationException("stork.12", new Object[]{req.getOAURL()});
-
-            MOASTORKResponse moaStorkResponse = new MOASTORKResponse(httpReq);
-
-            // check if it is attribute query
-            if (moaStorkRequest.isAttrRequest()) {
-                Logger.debug("Starting AttrQueryRequest");
-
-                moaStorkResponse.setSTORKAttrResponse(new STORKAttrQueryResponse());
-            }
-            // check if we have authentication request
-            else if (moaStorkRequest.isAuthnRequest()) {
-                Logger.debug("Starting AuthenticationRequest");
-                moaStorkResponse.setSTORKAuthnResponse(new STORKAuthnResponse());
-
-                //STORKSAMLEngine engine = STORKSAMLEngine.getInstance("VIDP");
-
-               // Logger.debug("Starting generation of SAML response");
-               // try {
-               //     moaStorkResponse.setSTORKAuthnResponse(engine.generateSTORKAuthnResponse(moaStorkRequest.getStorkAuthnRequest(), moaStorkResponse.getStorkAuthnResponse(), httpReq.getRemoteAddr(), false));
-               // } catch (STORKSAMLEngineException ex) {
-               //     Logger.error("Failed to generate STORK SAML Response", ex);
-               //     throw new MOAIDException("stork.05", null);                  // TODO
-               // }
-
-                // Get personal attributtes from MOA/IdentityLink
-                
-                //build STORK attributes from local authentication information
-                if (authData != null) {
-                	int reqQaa = -1;
-                	int authQaa = -1;
-                	try {
-                		reqQaa = moaStorkRequest.getStorkAuthnRequest().getQaa();
-                		authQaa = Integer.valueOf(
-                				authData.getQAALevel().substring(PVPConstants.STORK_QAA_PREFIX.length()));
-                		
-                		if (reqQaa > authQaa) {
-                			Logger.warn("Requested QAA level does not match to authenticated QAA level");
-                			throw new MOAIDException("stork.21", new Object[]{reqQaa, authQaa});
-                			
-                		}
-                	
-                	} catch (MOAIDException e) {
-                		throw e;
-                		
-                	} catch (Exception e) {
-                		if (Logger.isDebugEnabled())
-                			Logger.warn("STORK QAA Level evaluation error", e);
-                		
-                		else
-                			Logger.warn("STORK QAA Level evaluation error (ErrorMessage=" 
-                					+  e.getMessage() + ")");
-                		
-                		throw new MOAIDException("stork.21", new Object[]{reqQaa, authQaa});
-                		
-                	}
-                	                	
-                	moaStorkResponse.setPersonalAttributeList(populateAttributes(authData, oaParam));
-                	
-                }
-            }
-
-            //moaStorkResponse.setCountry(moaStorkRequest.getSpCountry());
-
-            // Prepare extended attributes
-            Logger.debug("Preparing data container");
-
-            // create fresh container
-            DataContainer container = new DataContainer();
-
-            // - fill in the request we extracted above
-            container.setRequest(moaStorkRequest);
-
-            // - fill in the partial response created above
-            container.setResponse(moaStorkResponse);
-
-            container.setRemoteAddress(httpReq.getRemoteAddr());
-
-            Logger.debug("Data container prepared");
-
-            if(oaParam.isRequireConsentForStorkAttributes())
-                new ConsentEvaluator().requestConsent(container, httpReq, httpResp, authData, oaParam);
-            else
-                new AttributeCollector().processRequest(container, httpReq, httpResp, authData, oaParam);
-
-            return null;
-        }
-//        // check if we are getting request for citizen of some other country
-//        else if (req instanceof MOASTORKRequest) {
-//            return handleMOAStorkRequest("VIDP", (MOASTORKRequest) req, httpReq.getRemoteAddr(), httpResp);
-//        }
-
-        // Check if we got the response from PEPS
-        // If so then process it and forward to SP
-        else if ((req instanceof MOASTORKResponse)) {
-            return handleMOAStorkResponse("VIDP", (MOASTORKResponse) req, httpReq.getRemoteAddr(), httpResp);
-        } else {
-            Logger.error("Could not recognize request.");
-            throw new MOAIDException("stork.15", null);
-        }
-    }
-
-    /*
-    Handles STORKAuthnRequeste received for citizens of other countries
-     */
-    private SLOInformationInterface handleMOAStorkRequest(String instanceName, MOASTORKRequest moastorkRequest, String remoteAddr, HttpServletResponse httpResp) throws MOAIDException {
-
-        STORKAuthnRequest spAuthnRequest = moastorkRequest.getStorkAuthnRequest();
-        STORKAuthnRequest storkAuthnRequest = null;
-
-        String citizenCountryCode = spAuthnRequest.getCitizenCountryCode();
-        Logger.info("Got authentication request for citizen of " + citizenCountryCode);
-
-        try {
-            storkAuthnRequest = (STORKAuthnRequest) spAuthnRequest.clone();
-        } catch (CloneNotSupportedException e) {
-            Logger.error("Could not clone AuthnRequest ", e);
-            throw new MOAIDException("stork.05", null); // TODO
-        }
-
-            //TODO: in case of Single LogOut -> SLO information has to be stored
-        // check if citizen country is configured in the system
-        if (!(AuthConfigurationProviderFactory.getInstance().getStorkConfig().getCpepsMap().containsKey(citizenCountryCode))) {
-            Logger.error("Citizen country PEPS not configured in MOA instance: " + citizenCountryCode);
-            throw new MOAIDException("stork.05", null); // TODO
-        }
-
-        // extracting basic settings and adjusting assertion consumer
-        String issuer = null;
-        String assertionConsumerURL = null;
-        String publicURLPrefix = null;
-        String destinationURL = null;
-
-        try {
-            issuer = new URL(moaStorkRequest.getAuthURL()).toString();
-            destinationURL = AuthConfigurationProviderFactory.getInstance().getStorkConfig().getCPEPS(citizenCountryCode).getPepsURL().toString();
-            publicURLPrefix = moaStorkRequest.getAuthURL();
-            assertionConsumerURL = publicURLPrefix + "/stork2/SendPEPSAuthnRequest";
-        } catch (MalformedURLException ex) {
-            Logger.error("Wrong PublicURLPrefix setting of MOA instance: " + AuthConfigurationProviderFactory.getInstance().getPublicURLPrefix(), ex);
-            throw new MOAIDException("stork.05", null); // TODO
-        } catch (Exception ex) {
-            Logger.error("Problem with PEPS configuration of MOA instance.", ex);
-            throw new MOAIDException("stork.05", null); // TODO
-        }
-
-
-        // drop if we do not have publicprefix url configured on the instance
-        if (publicURLPrefix == null)
-            throw new AuthenticationException("stork.12", new String[]{"PublicURLPrefix"});
-
-        // adjusting request
-        storkAuthnRequest.setEIDCrossBorderShare(spAuthnRequest.isEIDCrossBorderShare());
-        storkAuthnRequest.setEIDSectorShare(spAuthnRequest.isEIDSectorShare());
-        storkAuthnRequest.setEIDCrossSectorShare(spAuthnRequest.isEIDCrossSectorShare());
-        storkAuthnRequest.setCitizenCountryCode(spAuthnRequest.getCitizenCountryCode());
-        storkAuthnRequest.setIssuer(issuer);
-        storkAuthnRequest.setAssertionConsumerServiceURL(assertionConsumerURL);
-        storkAuthnRequest.setDestination(destinationURL);
-
-        // regenerate request
-        try {
-            //Get SAMLEngine instance
-            STORKSAMLEngine engine = STORKSAMLEngine.getInstance("VIDP");
-            Logger.debug("Starting generation of SAML request");
-            storkAuthnRequest = engine.generateSTORKAuthnRequest(storkAuthnRequest);
-
-            //generateSAML Token
-            Logger.info("SAML response succesfully generated!");
-        } catch (STORKSAMLEngineException e) {
-            Logger.error("Failed to generate STORK SAML Response", e);
-            throw new MOAIDException("stork.05", null);
-        }
-
-        // store original request from SP in order to be able to extract it in later iteration/response
-        DataContainer spRequestContainer = new DataContainer();
-        spRequestContainer.setRequest(moastorkRequest);
-
-        try {
-            AssertionStorage.getInstance().put(storkAuthnRequest.getSamlId(), spRequestContainer);
-            Logger.info("Storing artifactId " + storkAuthnRequest.getSamlId() + " of SP authentication request with id " + spAuthnRequest.getSamlId());
-        } catch (MOADatabaseException e) {
-            e.printStackTrace();
-        }
-
-        // preparing redirection for the client        
-        performRedirection("SAMLRequest", destinationURL, storkAuthnRequest.getTokenSaml(), httpResp);
-               
-        SLOInformationImpl sloInfo = new SLOInformationImpl();
-        sloInfo.setProtocolType(moastorkRequest.requestedModule());
-        return sloInfo;
-    }
-
-    /*
-    Handles STORKAuthnResponse received from PEPS (return to SP)
-     */
-    private SLOInformationInterface handleMOAStorkResponse(String instanceName, MOASTORKResponse moastorkResponse, String remoteAddr, HttpServletResponse httpResp) throws MOAIDException {
-
-        STORKAuthnResponse authnResponse = null;
-
-        //Get SAMLEngine instance
-        STORKSAMLEngine engine = STORKSAMLEngine.getInstance(instanceName);
-
-        try {
-            authnResponse = engine.validateSTORKAuthnResponse(moastorkResponse.getSTORKAuthnResponseToken(), remoteAddr);
-        } catch (STORKSAMLEngineException ex) {
-            Logger.error("Unable to validate Stork AuthenticationResponse: " + ex.getMessage());
-            throw new MOAIDException("stork.15", null); // TODO
-        }
-
-        Logger.debug("Requesting artifactId " + authnResponse.getInResponseTo() + " from store.");
-
-        DataContainer dataContainer = null;
-        try {
-            dataContainer = AssertionStorage.getInstance().get(authnResponse.getInResponseTo(), DataContainer.class);
-        } catch (MOADatabaseException e) {
-            Logger.error("Unable to retrieve datacontainer with reference authentication request. Database exception.");
-            throw new MOAIDException("stork.15", null); // TODO
-        }
-
-        // setting new reference request and return url
-        authnResponse.setInResponseTo(dataContainer.getRequest().getStorkAuthnRequest().getSamlId());
-        authnResponse.setAudienceRestriction(dataContainer.getRequest().getAssertionConsumerServiceURL());
-        //AudienceRestrictionBuilder audienceRestrictionBuilder = new AudienceRestrictionBuilder();
-        //AudienceRestriction audienceRestriction = audienceRestrictionBuilder.buildObject(dataContainer.getRequest().getAssertionConsumerServiceURL(), "localname", "nameprefix");
-
-        //authnResponse.getAssertions().get(0).getConditions().getAudienceRestrictions().add(audienceRestriction);
-
-        Logger.debug("Starting generation of SAML response");
-        try {
-            authnResponse = engine.generateSTORKAuthnResponse(dataContainer.getRequest().getStorkAuthnRequest(), authnResponse, remoteAddr, false);
-        } catch (STORKSAMLEngineException e) {
-            Logger.error("Failed to generate STORK SAML Response", e);
-            throw new MOAIDException("stork.05", null);        // TODO check
-        }
-
-        Logger.info("SAML response succesfully generated.");
-
-        // preparing redirection for the client
-        performRedirection("SAMLResponse", dataContainer.getRequest().getAssertionConsumerServiceURL(), authnResponse.getTokenSaml(), httpResp);
-                
-        return null;
-    }
-
-    /*
-    Perform redirection of the client based on post binding
-     */
-    private void performRedirection(String actionType, String assertionConsumerURL, byte[] tokenSaml, HttpServletResponse httpResp) throws MOAIDException {
-        Logger.info("Performing redirection, using action type: " + actionType);
-
-        try {
-            VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
-            Template template = velocityEngine.getTemplate("/resources/templates/stork2_postbinding_template.html");
-            VelocityContext context = new VelocityContext();
-
-            context.put(actionType, PEPSUtil.encodeSAMLToken(tokenSaml));
-            Logger.debug("Encoded " + actionType + " original: " + new String(tokenSaml));
-
-            Logger.debug("Using assertion consumer url as action: " + assertionConsumerURL);
-            context.put("action", assertionConsumerURL);
-
-            Logger.debug("Starting template merge");
-            StringWriter writer = new StringWriter();
-
-            Logger.debug("Doing template merge");
-            template.merge(context, writer);
-            Logger.debug("Template merge done");
-
-            Logger.debug("Sending html content: " + writer.getBuffer().toString());
-            Logger.debug("Sending html content2  : " + new String(writer.getBuffer()));
-
-            httpResp.getOutputStream().write(writer.getBuffer().toString().getBytes("UTF-8"));
-
-        } catch (IOException e) {
-            Logger.error("Velocity IO error: " + e.getMessage());
-            throw new MOAIDException("stork.15", null); // TODO
-        } catch (Exception e) {
-            Logger.error("Velocity general error: " + e.getMessage());
-            throw new MOAIDException("stork.15", null); // TODO
-        }
-
-    }
-
-    public void generatePEPSRedirect(HttpServletResponse httpResp, DataContainer container) throws MOAIDException {
-        MOASTORKRequest request = container.getRequest();
-        MOASTORKResponse response = container.getResponse();
-
-        Logger.info("generating stork response...");
-
-        try {
-            //Get SAMLEngine instance
-            STORKSAMLEngine engine = STORKSAMLEngine.getInstance("VIDP");
-            Logger.debug("Starting generation of SAML response");
-            if (response.isAuthnResponse())
-                response.setSTORKAuthnResponse(engine.generateSTORKAuthnResponse(request.getStorkAuthnRequest(), response.getStorkAuthnResponse(), container.getRemoteAddress(), false));
-            else
-                response.setSTORKAttrResponse(engine.generateSTORKAttrQueryResponse(request.getStorkAttrQueryRequest(), response.getStorkAttrQueryResponse(), container.getRemoteAddress(), "", false));
-
-
-            //generateSAML Token
-            Logger.info("SAML response succesfully generated!");
-        } catch (STORKSAMLEngineException e) {
-            Logger.error("Failed to generate STORK SAML Response", e);
-            throw new MOAIDException("stork.05", null);
-        }
-
-        // preparing redirection for the client
-        try {
-            VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
-            Template template = velocityEngine.getTemplate("/resources/templates/stork2_postbinding_template.html");
-            VelocityContext context = new VelocityContext();
-
-            byte[] blob;
-            if (request.isAttrRequest())
-                blob = response.getStorkAttrQueryResponse().getTokenSaml();
-            else
-                blob = response.getStorkAuthnResponse().getTokenSaml();
-
-            context.put("SAMLResponse", PEPSUtil.encodeSAMLToken(blob));
-            Logger.debug("SAMLResponse original: " + new String(blob));
-
-            Logger.debug("Putting assertion consumer url as action: " + request.getAssertionConsumerServiceURL());
-            context.put("action", request.getAssertionConsumerServiceURL());
-            Logger.trace("Starting template merge");
-            StringWriter writer = new StringWriter();
-
-            Logger.trace("Doing template merge");
-            template.merge(context, writer);
-            Logger.trace("Template merge done");
-
-            Logger.trace("Sending html content: " + writer.getBuffer().toString());
-            Logger.trace("Sending html content2  : " + new String(writer.getBuffer()));
-
-            httpResp.getOutputStream().write(writer.getBuffer().toString().getBytes("UTF-8"));
-
-        } catch (Exception e) {
-            Logger.error("Velocity error: " + e.getMessage());
-        }
-    }
-
-
-    public boolean needAuthentication(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp) {
-
-    	//redirect to national PVP IDP infrastructure if special attributes are requested
-    	if (MiscUtil.isEmpty(req.getRequestedIDP()) && req instanceof MOASTORKRequest)
-    		return !STORKPVPUtilits.performAuthenticationOnNationalIDP((MOASTORKRequest) req);
-    	    	
-//        // authentication is not needed if we have authentication request from SP for citizen of configured PEPS country
-//        if (req instanceof MOASTORKRequest) {
-//            MOASTORKRequest moastorkRequest = (MOASTORKRequest) req;
-//            if (moastorkRequest.getStorkAuthnRequest() != null) {
-//                String citizenCountryCode = moastorkRequest.getStorkAuthnRequest().getCitizenCountryCode();
-//                // check if citizen country is configured in the system
-//                try {
-//                    if (AuthConfigurationProvider.getInstance().getStorkConfig().getCpepsMap().containsKey(citizenCountryCode)) {
-//                        return false;
-//                    }
-//                } catch (MOAIDException e) {
-//                    Logger.error("Could not initialize AuthConfigurationProvider");
-//                }
-//            }
-//            // authentication is not required if received authentication response
-//        } else if (req instanceof MOASTORKResponse) {
-//            return false;
-//        }
-
-        return true;
-    }
-
-
-    private void iterate(NamedNodeMap attributesList) {
-        for (int j = 0; j < attributesList.getLength(); j++) {
-            Logger.debug("--Attribute: "
-                    + attributesList.item(j).getNodeName() + " = "
-                    + attributesList.item(j).getNodeValue());
-        }
-    }
-
-
-    // does nothing
-    public void mandate(IAuthData authData) {
-
-        if (authData.isUseMandate()) {
-            try {
-                MISMandate mandate = authData.getMISMandate();
-                String owbpk = mandate.getOWbPK();
-                byte[] mand = mandate.getMandate();
-                String profprep = mandate.getProfRep();
-                //String textdesc = mandate.getTextualDescriptionOfOID();
-                Element mndt = authData.getMandate();
-
-                iterate(mndt.getAttributes());
-                Logger.debug("mandate encoded: " + new String(org.bouncycastle.util.encoders.Base64.encode(mand)));
-            } catch (Exception x) {
-                Logger.debug("There is no mandate used in transaction");
-            }
-        }
-
-
-    }
-
-    public PersonalAttributeList populateAttributes(IAuthData authData, IOAAuthParameters oaParam) {
-
-        IPersonalAttributeList attrLst = moaStorkRequest.getStorkAuthnRequest().getPersonalAttributeList();
-        Logger.info("Found " + attrLst.size() + " personal attributes in the request.");
-        
-        // Define attribute list to be populated
-        PersonalAttributeList attributeList = new PersonalAttributeList();
-        MOAAttributeProvider moaAttributeProvider = new MOAAttributeProvider(authData, moaStorkRequest);
-
-        try {
-            for (PersonalAttribute personalAttribute : attrLst) {
-            	 try {
-                Logger.debug("Personal attribute found in request: " + personalAttribute.getName() + " isRequired: " + personalAttribute.isRequired());
-                moaAttributeProvider.populateAttribute(attributeList, personalAttribute);
-            	 } catch (Exception e) {
-                     Logger.error("Exception, attributes: " + e.getMessage(), e);
-                 }
-            }
-        } catch (Exception e) {
-            Logger.error("Exception, attributes: " + e.getMessage(), e);
-        }
-
-        Logger.trace("AUTHBLOCK " + authData.getAuthBlock());
-        Logger.debug("SESSION IDENTIFIER " + authData.getCcc() + " " + oaParam.getIdentityLinkDomainIdentifier());
-
-        return attributeList;
-    }
-
-    public String getDefaultActionName() {
-        return STORKProtocol.AUTHENTICATIONREQUEST;
-    }
-
-
-    private void initVelocityEngine() throws Exception {
-        velocityEngine = new VelocityEngine();
-        velocityEngine.setProperty(RuntimeConstants.ENCODING_DEFAULT, "UTF-8");
-        velocityEngine.setProperty(RuntimeConstants.OUTPUT_ENCODING, "UTF-8");
-        velocityEngine.setProperty(RuntimeConstants.RESOURCE_LOADER, "classpath");
-        velocityEngine.setProperty("classpath.resource.loader.class",
-                "org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader");
-
-        velocityEngine.init();
-    }
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/ConsentEvaluator.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/ConsentEvaluator.java
deleted file mode 100644
index 2b7d4e045..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/ConsentEvaluator.java
+++ /dev/null
@@ -1,249 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2;
-
-import java.io.StringWriter;
-
-import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
-
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.Map.Entry;
-
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.data.SLOInformationInterface;
-import at.gv.egovernment.moa.id.moduls.IAction;
-import at.gv.egovernment.moa.id.moduls.IRequest;
-import at.gv.egovernment.moa.id.storage.AssertionStorage;
-import at.gv.egovernment.moa.id.util.VelocityProvider;
-import at.gv.egovernment.moa.logging.Logger;
-import eu.stork.peps.auth.commons.PEPSUtil;
-import eu.stork.peps.auth.commons.PersonalAttribute;
-import eu.stork.peps.auth.engine.STORKSAMLEngine;
-import eu.stork.peps.complex.attributes.eu.stork.names.tc.stork._1_0.assertion.AttributeStatusType;
-import eu.stork.peps.exceptions.STORKSAMLEngineException;
-
-import org.apache.velocity.Template;
-import org.apache.velocity.VelocityContext;
-import org.apache.velocity.app.VelocityEngine;
-import org.opensaml.common.impl.SecureRandomIdentifierGenerator;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-/**
- * The ConsentEvaluator assists with fetching user consent on the list of attributes to be sent to the asking S-PEPS.
- */
-public class ConsentEvaluator implements IAction {
-
-    /**
-     * The Constant ARTIFACT_ID.
-     */
-    private static final String ARTIFACT_ID = "artifactId";
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.moduls.IAction#processRequest(at.gv.egovernment.moa.id.moduls.IRequest, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, at.gv.egovernment.moa.id.auth.data.AuthenticationSession)
-     */
-    public SLOInformationInterface processRequest(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp, IAuthData authData) throws MOAIDException {
-
-		// - fetch the container
-		String artifactId = (String) httpReq.getParameter(ARTIFACT_ID);
-		DataContainer container;
-		try {
-			container = AssertionStorage.getInstance().get(artifactId, DataContainer.class);
-			req = container.getRequest();
-		} catch (MOADatabaseException e) {
-			Logger.error("Error fetching incomplete Stork response from temporary storage. Most likely a timeout occured.", e);
-			throw new MOAIDException("stork.17", null);
-		}
-
-		// evaluate response
-		for(PersonalAttribute current : container.getRequest().getPersonalAttributeList()) {
-			if(null == httpReq.getParameter(current.getName())) {
-				current.setStatus(AttributeStatusType.WITHHELD.value());
-				current.setValue(new ArrayList<String>());
-				current.setComplexValue(new HashMap<String, String>());
-			}
-		}
-
-        //TODO: CHECK: req.getOAURL() should return the unique OA identifier
-		OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(req.getOAURL());
-		if (oaParam == null)
-			throw new AuthenticationException("stork.12", new Object[]{req.getOAURL()});
-
-		new AttributeCollector().processRequest(container, httpReq, httpResp, authData, oaParam);
-
-        return null; // AssertionId
-    }
-
-	/**
-	 * Fills the given HttpResponse with the required web page.
-	 *
-	 * @param container the container
-	 * @param authData 
-	 * @param response the response
-	 * @param oaParam the oa param
-	 * @return the string
-	 * @throws MOAIDException the mOAID exception
-	 */
-	public String requestConsent(DataContainer container, HttpServletRequest httpReq, HttpServletResponse httpResp, IAuthData authData, OAAuthParameter oaParam) throws MOAIDException {
-		//check if we need to collect consent
-        if(!oaParam.isRequireConsentForStorkAttributes()) {
-            (new AttributeCollector()).processRequest(container, httpReq, httpResp, authData, oaParam);
-            return "";
-        }
-
-		// prepare redirect
-		String newArtifactId;
-		try {
-
-			// memorize the container again
-			Logger.debug("prepare putting the container into temporary storage...");
-
-			// - generate new key
-			newArtifactId = new SecureRandomIdentifierGenerator().generateIdentifier();
-
-			// - put container in temporary store.
-			AssertionStorage.getInstance().put(newArtifactId, container);
-
-			Logger.debug("...successful");
-
-		} catch (Exception e1) {
-			// TODO should we return the response as is to the PEPS?
-			e1.printStackTrace();
-            Logger.error("Error putting incomplete Stork response into temporary storage", e1);
-			throw new MOAIDException("stork.17", null);
-		}
-
-		// ask for consent
-		try {
-			VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
-			Template template = velocityEngine.getTemplate("/resources/templates/stork2_consent.html");
-			VelocityContext context = new VelocityContext();
-
-			context.put("action", AuthConfigurationProviderFactory.getInstance().getPublicURLPrefix().get(0) + "/stork2/GetConsent?" + ARTIFACT_ID + "=" + newArtifactId);
-
-			// assemble table
-			String table = "";
-			for (PersonalAttribute current : container.getRequest().getPersonalAttributeList())
-				table += "<tr><td><input type=\"checkbox\" checked=\"yes\" name=\"" + current.getName() + "\"></td><td>" + current.getName() + (current.isRequired() ? "" : " (optional)") + "</td></tr>\n";
-
-			context.put("tablecontent", table);
-			for(Entry<String, String> current : oaParam.getFormCustomizaten().entrySet())
-				context.put(current.getKey().replace("#", ""), current.getValue());
-
-			StringWriter writer = new StringWriter();
-			template.merge(context, writer);
-			httpResp.getOutputStream().write(writer.getBuffer().toString().getBytes("UTF-8"));
-
-		} catch (Exception e) {
-			Logger.error("Velocity error: " + e.getMessage());
-			throw new MOAIDException("stork.17", null);
-		}
-
-		return "12345"; // AssertionId
-	}
-
-    /**
-     * generates binary response from given response class and fill the given HttpResponse with a SAML Post Binding template.
-     *
-     * @param httpResp the http resp
-     * @param container the container
-     * @throws MOAIDException the mOAID exception
-     */
-    public void generateSTORKResponse(HttpServletResponse httpResp, DataContainer container) throws MOAIDException {
-    	MOASTORKRequest request = container.getRequest();
-        MOASTORKResponse response = container.getResponse();
-        
-        Logger.info("generating stork response...");
-
-        try {
-            //Get SAMLEngine instance
-            STORKSAMLEngine engine = STORKSAMLEngine.getInstance("VIDP");
-            Logger.debug("Starting generation of SAML response");
-			if(response.isAuthnResponse())
-				response.setSTORKAuthnResponse(engine.generateSTORKAuthnResponse(request.getStorkAuthnRequest(), response.getStorkAuthnResponse(), container.getRemoteAddress(), false));
-			else
-				response.setSTORKAttrResponse(engine.generateSTORKAttrQueryResponse(request.getStorkAttrQueryRequest(), response.getStorkAttrQueryResponse(), container.getRemoteAddress(), "", false));
-
-
-            //generateSAML Token
-            Logger.info("SAML response succesfully generated!");
-        } catch (STORKSAMLEngineException e) {
-            Logger.error("Failed to generate STORK SAML Response", e);
-            throw new MOAIDException("stork.05", null);
-        }
-
-        // preparing redirection for the client
-        try {
-            VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
-            Template template = velocityEngine.getTemplate("/resources/templates/stork2_postbinding_template.html");
-            VelocityContext context = new VelocityContext();
-            
-            byte[] blob;
-			if(request.isAttrRequest())
-            	blob = response.getStorkAttrQueryResponse().getTokenSaml();
-            else
-            	blob = response.getStorkAuthnResponse().getTokenSaml();
-
-            context.put("SAMLResponse", PEPSUtil.encodeSAMLToken(blob));
-            Logger.debug("SAMLResponse original: " + new String(blob));
-
-            Logger.debug("Putting assertion consumer url as action: " + request.getAssertionConsumerServiceURL());
-            context.put("action", request.getAssertionConsumerServiceURL());
-            Logger.trace("Starting template merge");
-            StringWriter writer = new StringWriter();
-
-            Logger.trace("Doing template merge");
-            template.merge(context, writer);
-            Logger.trace("Template merge done");
-
-            Logger.trace("Sending html content: " + writer.getBuffer().toString());
-            Logger.trace("Sending html content2  : " + new String(writer.getBuffer()));
-
-            httpResp.getOutputStream().write(writer.getBuffer().toString().getBytes("UTF-8"));
-
-        } catch (Exception e) {
-            Logger.error("Velocity error: " + e.getMessage());
-        }
-    }
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.moduls.IAction#needAuthentication(at.gv.egovernment.moa.id.moduls.IRequest, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
-     */
-    public boolean needAuthentication(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp) {
-    	// this action does not need any authentication. The authentication is already done by the preceding AuthenticationRequest-Action.
-        return false;
-    }
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.moduls.IAction#getDefaultActionName()
-     */
-    public String getDefaultActionName() {
-        return STORKProtocol.CONSENT_EVALUATOR;
-    }
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/CorporateBodyMandateContainer.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/CorporateBodyMandateContainer.java
deleted file mode 100644
index acbf1678a..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/CorporateBodyMandateContainer.java
+++ /dev/null
@@ -1,115 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2;
-
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.logging.Logger;
-import org.xml.sax.InputSource;
-
-import javax.xml.xpath.XPathExpressionException;
-import java.io.StringReader;
-/**
- * Physical person representing corporate body
- *
- * @author bsuzic
- *         Date: 4/29/14, Time: 3:40 PM
- */
-public class CorporateBodyMandateContainer extends MandateContainer {
-
-    protected String corpMandatorIdentificationValue = null;
-    protected String corpMandatorIdentificationType = null;
-    protected String corpMandatorFullName = null;
-
-
-    String localMethods[] = new String[]{"getCorpMandatorIdentificationValue", "getCorpMandatorIdentificationType", "getCorpMandatorFullName",
-            "getMandateIssuePlace", "getMandateIssueDate", "getMandateIssueTime", "getSimpleMandateContent", "getMandateValidFrom",
-            "getMandateValidTo", "getPhysicalRepresentativeIdentificationValue", "getPhysicalRepresentativeIdentificationType", "getAnnotation",
-            "getPhysicalRepresentativeGivenName", "getPhysicalRepresentativeFamilyName", "getPhysicalRepresentativeBirthDate"
-    };
-
-    public CorporateBodyMandateContainer(String mandate) throws XPathExpressionException, MOAIDException {
-        super(mandate);
-        Logger.debug("Initializing corporate body mandate container.");
-
-        setAnnotation(xPath.evaluate(S2Constants.MANDATE_ANNOTATION_QUERY, new InputSource(new StringReader(mandate))));
-        setCorpMandatorFullName(xPath.evaluate(S2Constants.MANDATE_MANDATOR_CORPBODY_FULLNAME_QUERY, new InputSource(new StringReader(mandate))));
-        setCorpMandatorIdentificationType(xPath.evaluate(S2Constants.MANDATE_MANDATOR_CORPBODY_IDTYPE_QUERY, new InputSource(new StringReader(mandate))));
-        setCorpMandatorIdentificationValue(xPath.evaluate(S2Constants.MANDATE_MANDATOR_CORPBODY_IDVALUE_QUERY, new InputSource(new StringReader(mandate))));
-        setMandateIssueDate(xPath.evaluate(S2Constants.MANDATE_ISSUEDDATE_QUERY, new InputSource(new StringReader(mandate))));
-        setMandateIssuePlace(xPath.evaluate(S2Constants.MANDATE_ISSUEDPLACE_QUERY, new InputSource(new StringReader(mandate))));
-        setMandateIssueTime(xPath.evaluate(S2Constants.MANDATE_ISSUEDTIME_QUERY, new InputSource(new StringReader(mandate))));
-        setMandateValidFrom(xPath.evaluate(S2Constants.MANDATE_SIMPLEMANDATECONTENT_VALIDFROM_QUERY, new InputSource(new StringReader(mandate))));
-        setMandateValidTo(xPath.evaluate(S2Constants.MANDATE_SIMPLEMANDATECONTENT_VALIDTO_QUERY, new InputSource(new StringReader(mandate))));
-        setPhysicalRepresentativeBirthDate(xPath.evaluate(S2Constants.MANDATE_REPRESENTATIVE_PHYPERS_DATEOFBIRTH_QUERY, new InputSource(new StringReader(mandate))));
-        setPhysicalRepresentativeFamilyName(xPath.evaluate(S2Constants.MANDATE_REPRESENTATIVE_PHYPERS_FAMILYNAME_QUERY, new InputSource(new StringReader(mandate))));
-        setPhysicalRepresentativeGivenName(xPath.evaluate(S2Constants.MANDATE_REPRESENTATIVE_PHYPERS_GIVENNAME_QUERY, new InputSource(new StringReader(mandate))));
-        setPhysicalRepresentativeIdentificationType(xPath.evaluate(S2Constants.MANDATE_REPRESENTATIVE_PHYPERS_IDTYPE_QUERY, new InputSource(new StringReader(mandate))));
-        setPhysicalRepresentativeIdentificationValue(xPath.evaluate(S2Constants.MANDATE_REPRESENTATIVE_PHYPERS_IDVALUE_QUERY, new InputSource(new StringReader(mandate))));
-        setSimpleMandateContent(xPath.evaluate(S2Constants.MANDATE_SIMPLEMANDATECONTENT_TXTDESC_QUERY, new InputSource(new StringReader(mandate))));
-
-        // check if all necessary fields are present
-        Logger.debug("Starting mandate structure validation");
-        try {
-            validateMandateStructure(localMethods); // TODO
-        } catch (Exception e) {
-
-            if (e instanceof MOAIDException)  {
-            Logger.error("Could not validate mandate structure.");
-                throw new MOAIDException("stork.16", new Object[] {e.getMessage()}); // TODO
-            } else {
-                Logger.error("Error during mandate structure validation.");
-                throw new MOAIDException("stork.16", new Object[] {e.getMessage()}); // TODO
-            }
-
-        }
-
-    }
-
-    public String getCorpMandatorIdentificationValue() {
-        return corpMandatorIdentificationValue;
-    }
-
-    public void setCorpMandatorIdentificationValue(String corpMandatorIdentificationValue) {
-        Logger.debug("Setting corpMandatorIdentificationValue to AT/" + corpMandatorIdentificationValue);
-        this.corpMandatorIdentificationValue = "AT/" + corpMandatorIdentificationValue;
-    }
-
-    public String getCorpMandatorIdentificationType() {
-        return corpMandatorIdentificationType;
-    }
-
-    public void setCorpMandatorIdentificationType(String corpMandatorIdentificationType) {
-        this.corpMandatorIdentificationType = corpMandatorIdentificationType;
-    }
-
-    public String getCorpMandatorFullName() {
-        return corpMandatorFullName;
-    }
-
-    public void setCorpMandatorFullName(String corpMandatorFullName) {
-        this.corpMandatorFullName = corpMandatorFullName;
-    }
-
-
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/DataContainer.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/DataContainer.java
deleted file mode 100644
index e01a7526a..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/DataContainer.java
+++ /dev/null
@@ -1,100 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2;
-
-import java.io.Serializable;
-
-/**
- * Holds info about an ongoing but yet incomplete stork authnrequest process.
- */
-public class DataContainer implements Serializable {
-	
-	/** The Constant serialVersionUID. */
-	private static final long serialVersionUID = -8765997480582363012L;
-
-	/** The incoming request. */
-	private MOASTORKRequest request;
-	
-	/** The yet incomplete response. */
-	private MOASTORKResponse response;
-	
-	/** The target. */
-	private String target;
-	
-	/** The remote address. */
-	private String remoteAddress;
-	
-	/**
-	 * Gets the request.
-	 *
-	 * @return the request
-	 */
-	public MOASTORKRequest getRequest() {
-		return request;
-	}
-
-	/**
-	 * Sets the request.
-	 *
-	 * @param moaStorkRequest the new request
-	 */
-	public void setRequest(MOASTORKRequest moaStorkRequest) {
-		this.request = moaStorkRequest;
-	}
-
-	/**
-	 * Gets the response.
-	 *
-	 * @return the response
-	 */
-	public MOASTORKResponse getResponse() {
-		return response;
-	}
-
-	/**
-	 * Sets the response.
-	 *
-	 * @param moaStorkResponse the new response
-	 */
-	public void setResponse(MOASTORKResponse moaStorkResponse) {
-		this.response = moaStorkResponse;
-	}
-
-	/**
-	 * Gets the remote address.
-	 *
-	 * @return the remote address
-	 */
-	public String getRemoteAddress() {
-		return remoteAddress;
-	}
-
-	/**
-	 * Sets the remote address.
-	 *
-	 * @param remoteAddress the new remote address
-	 */
-	public void setRemoteAddress(String remoteAddress) {
-		this.remoteAddress = remoteAddress;
-	}
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOAAttributeProvider.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOAAttributeProvider.java
deleted file mode 100644
index 2c7e5b539..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOAAttributeProvider.java
+++ /dev/null
@@ -1,248 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2;
-
-import at.gv.egovernment.moa.id.auth.builder.BPKBuilder;
-import at.gv.egovernment.moa.id.auth.exception.BuildException;
-import at.gv.egovernment.moa.id.data.AuthenticationRole;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
-import at.gv.egovernment.moa.id.util.PVPtoSTORKMapper;
-import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.MiscUtil;
-import eu.stork.peps.auth.commons.PersonalAttribute;
-import eu.stork.peps.auth.commons.PersonalAttributeList;
-import eu.stork.peps.complex.attributes.eu.stork.names.tc.stork._1_0.assertion.AttributeStatusType;
-import org.joda.time.Period;
-
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.text.DateFormat;
-import java.text.SimpleDateFormat;
-import java.util.*;
-
-/**
- * @author bsuzic
- *         Date: 2/19/14, Time: 4:42 PM
- *         
- * @author tlenz
- * 		   Date: 23.10.14
- */
-public class MOAAttributeProvider {
-    private final IAuthData authData;
-    private static final Map<String, String> storkAttributeSimpleMapping;
-    private static final Map<String, String> storkAttributeFunctionMapping;
-    private final MOASTORKRequest moastorkRequest;
-
-    // mappings for attribute population methods
-    // based on mapping of moa authndata and executing functions to extract attributes
-    static {
-        Map<String, String> tempSimpleMap = new HashMap<String, String>();
-        tempSimpleMap.put("givenName", "getGivenName");
-        tempSimpleMap.put("surname", "getFamilyName");        
-        tempSimpleMap.put("MSOrganization", "getPvpAttribute_OU");
-        storkAttributeSimpleMapping = Collections.unmodifiableMap(tempSimpleMap);
-                
-        Map<String, String> tempFunctionMap = new HashMap<String, String>();
-        tempFunctionMap.put("eIdentifier", "geteIdentifier");
-        tempFunctionMap.put("ECApplicationRole","getECApplicationRole");
-        tempFunctionMap.put("dateOfBirth", "getFormatedDateOfBirth");
-        tempFunctionMap.put("MSOrganization", "getMSOrganization");
-        tempFunctionMap.put("age", "getAge");
-        tempFunctionMap.put("isAgeOver", "getIsAgeOver");
-        tempFunctionMap.put("citizenQAALevel", "getQAALevel");
-        storkAttributeFunctionMapping = Collections.unmodifiableMap(tempFunctionMap);
-        
-    }
-
-    public MOAAttributeProvider(IAuthData authData, MOASTORKRequest moastorkRequest) {
-        this.authData = authData;
-        this.moastorkRequest = moastorkRequest;
-        
-    }
-
-    public void populateAttribute(PersonalAttributeList attributeList, PersonalAttribute requestedAttribute ) {
-        String storkAttribute = requestedAttribute.getName();
-
-        // TODO: check if authData gets populated with stork attributtes during previous steps; it seems it is not
-        if (null != authData && null != authData.getStorkAttributes() && authData.getStorkAttributes().containsKey(requestedAttribute.getName())) {
-            Logger.debug("Trying to get value for attribute directly from STORK2 response [" + storkAttribute + "]");
-            try {
-                PersonalAttribute tmp = authData.getStorkAttributes().get(requestedAttribute.getName());
-                attributeList.add((PersonalAttribute) tmp.clone());
-            } catch(Exception e) {
-                Logger.error("Could not retrieve attribute from STORK2 response: " + storkAttribute);
-                Logger.debug(e);
-            }
-        } else if (storkAttributeSimpleMapping.containsKey(storkAttribute)) {
-            Logger.debug("Trying to get value for attribute using simple mapping [" + storkAttribute + "]");
-            try {
-                Method method = authData.getClass().getDeclaredMethod(storkAttributeSimpleMapping.get(storkAttribute));
-                populateAttributeWithMethod(method, authData, attributeList, storkAttribute, requestedAttribute);
-            } catch (NoSuchMethodException e) {
-                Logger.error("Could not found MOA extraction method while getting attribute: " + storkAttribute);
-                Logger.debug(e);
-            } catch (NullPointerException e) {
-                Logger.error("Error getting MOA extraction method while getting attribute: " + storkAttribute);
-                Logger.debug(e);
-            }
-
-        } else if (storkAttributeFunctionMapping.containsKey(storkAttribute)) {
-
-            Logger.debug("Trying to get value for attribute using function mapping [" + storkAttribute + "]");
-            try {
-                Method method = this.getClass().getDeclaredMethod(storkAttributeFunctionMapping.get(storkAttribute), PersonalAttribute.class);
-                populateAttributeWithMethod(method, this, attributeList, storkAttribute, requestedAttribute);
-            } catch (NoSuchMethodException e) {
-                Logger.error("Could not found MOA extraction method while getting attribute: " + storkAttribute);
-            }
-        } else {
-            Logger.debug("MOA method for extraction of attribute " + storkAttribute + " not defined.");
-        }
-    }
-
-    private String getAge(PersonalAttribute personalAttribute) {
-        if (authData.getDateOfBirth() != null) {
-            Integer age = new Period(authData.getDateOfBirth().getTime(), Calendar.getInstance().getTime().getTime()).getYears();
-            return age >= 0 ? age.toString() : null;
-        }
-        return null; // WP4 D4.2, Table 12:age, description - considerations
-    }
-
-    private String getIsAgeOver(PersonalAttribute personalAttribute)
-    {
-        try {
-            if ((authData.getDateOfBirth() != null) && (personalAttribute.getValue() != null) && (personalAttribute.getValue().size() > 0)) {
-                Integer ageOver = Integer.parseInt(personalAttribute.getValue().get(0));
-                Integer age = new Period(authData.getDateOfBirth().getTime(), Calendar.getInstance().getTime().getTime()).getYears();
-                return age >= ageOver ? ageOver.toString() : "";
-            }
-        } catch (Exception ex) {
-            Logger.error("Error encountered when determining isAgeOver");
-            Logger.debug(ex);
-        }
-        return null;
-    }
-
-    public String getQAALevel(PersonalAttribute personalAttribute) {
-        if (authData.getQAALevel().startsWith(PVPConstants.STORK_QAA_PREFIX))
-            return authData.getQAALevel().substring(PVPConstants.STORK_QAA_PREFIX.length());
-        else
-            return null;
-    }
-
-
-    private String geteIdentifier(PersonalAttribute personalAttribute) {
-        Logger.debug("Using base urn for identification value: " + authData.getIdentificationType() + " and target country: " + moastorkRequest.getStorkAuthnRequest().getSpCountry());
-        try {
-            return new BPKBuilder().buildStorkeIdentifier(authData.getIdentificationType(), authData.getIdentificationValue(),
-                    moastorkRequest.getStorkAuthnRequest().getSpCountry());
-        } catch (BuildException be) {
-            Logger.error("Stork eid could not be constructed; " + be.getMessage());
-            return null; // TODO error
-        }
-    }
-
-    private List<String> getECApplicationRole(PersonalAttribute personalAttribute) {
-    	List<String> storkRoles = null;
-    	    	
-    	if (authData.getAuthenticationRoles() != null 
-    			&& authData.getAuthenticationRoles().size() > 0) {
-
-    		storkRoles = new ArrayList<String>();
-    		PVPtoSTORKMapper mapper = PVPtoSTORKMapper.getInstance();
-    		for (AuthenticationRole el : authData.getAuthenticationRoles()) {
-    			String storkRole = mapper.map(el);
-    			if (MiscUtil.isNotEmpty(storkRole))
-    				storkRoles.add(storkRole);
-    		}    		
-    	}    	
-    	return storkRoles;
-    }
-    
-    private String getFormatedDateOfBirth(PersonalAttribute personalAttribute) {
-		if (authData.getDateOfBirth() != null) {
-			DateFormat fmt = new SimpleDateFormat("yyyyMMdd");
-    		return  fmt.format(authData.getDateOfBirth());
-		}
-   		else
-   			return null;
-    }
-    
-    private void populateAttributeWithMethod(Method method, Object object, PersonalAttributeList attributeList, String storkAttribute, PersonalAttribute requestedAttribute) {
-        try {
-            Object attributeValue;
-            if (storkAttributeSimpleMapping.containsValue(method.getName())) {
-                attributeValue = method.invoke(object, new Class[]{});
-            }  else {
-                attributeValue = method.invoke(object, requestedAttribute);
-            }
-
-            PersonalAttribute newAttribute = new PersonalAttribute();
-            newAttribute.setName(storkAttribute);
-            newAttribute.setIsRequired(requestedAttribute.isRequired());
-            
-            if (attributeValue != null) {
-            	newAttribute.setStatus(AttributeStatusType.AVAILABLE.value());
-            	Logger.info("Got attribute value: " + attributeValue);
-            
-            	if (attributeValue instanceof String)            
-            		newAttribute.setValue(new ArrayList<String>(Collections.singletonList((String)attributeValue)));
-            
-            	else if (attributeValue instanceof List<?>) {
-            		List<?> attributeValueList = (List<?>) attributeValue;
-            		if (attributeValueList.size() > 0 && attributeValueList.get(0) instanceof String) {
-            			newAttribute.setValue((List<String>) attributeValueList);
-            		
-            		} else {
-            			Logger.info("Attribute " + storkAttribute + " is not available.");
-                    	newAttribute.setStatus(AttributeStatusType.NOT_AVAILABLE.value());
-            			
-            		}
-            			            	
-            	} else {
-            		Logger.error("Receive an unsupported type for attribute " + storkAttribute);
-            	
-            	}            
-            	attributeList.add(newAttribute);
-            	
-            } else {
-            	Logger.info("Attribute " + storkAttribute + " is not available.");
-            	newAttribute.setStatus(AttributeStatusType.NOT_AVAILABLE.value());
-            }
-            
-        } catch (InvocationTargetException e) {
-            Logger.error("Invocation target exception while getting attribute: " + storkAttribute);
-            Logger.debug(e);
-        } catch (IllegalAccessException e) {
-            Logger.error("Illegal access exception while getting attribute: " + storkAttribute);
-            Logger.debug(e);
-        } catch (NullPointerException e) {
-            Logger.error("Could not find method: " + storkAttribute);
-            Logger.debug(e);
-        }
-    }
-
-
-}
-
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOASTORKRequest.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOASTORKRequest.java
deleted file mode 100644
index 4e666c21c..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOASTORKRequest.java
+++ /dev/null
@@ -1,265 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2;
-
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-
-import javax.servlet.http.HttpServletRequest;
-
-import org.opensaml.saml2.core.Attribute;
-
-import at.gv.egovernment.moa.id.auth.builder.DynamicOAAuthParameterBuilder;
-import at.gv.egovernment.moa.id.config.ConfigurationException;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.config.auth.data.DynamicOAAuthParameters;
-import at.gv.egovernment.moa.id.moduls.RequestImpl;
-import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
-import at.gv.egovernment.moa.id.protocols.pvp2x.builder.AttributQueryBuilder;
-import at.gv.egovernment.moa.id.protocols.pvp2x.messages.MOAResponse;
-import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.Constants;
-import eu.stork.peps.auth.commons.IPersonalAttributeList;
-import eu.stork.peps.auth.commons.STORKAttrQueryRequest;
-import eu.stork.peps.auth.commons.STORKAuthnRequest;
-import eu.stork.peps.auth.commons.STORKAuthnResponse;
-
-/**
- * Implements MOA request and stores StorkAuthn/Attr-Request related data.
- *
- * @author bsuzic
- */
-public class MOASTORKRequest extends RequestImpl {
-	
-	/**
-	 * @param req
-	 * @throws ConfigurationException
-	 */
-	public MOASTORKRequest(HttpServletRequest req)
-			throws ConfigurationException {
-		super(req);
-	}
-
-	public static final List<String> DEFAULTREQUESTEDATTRFORINTERFEDERATION = Arrays.asList(
-			new String[] {
-					PVPConstants.BPK_NAME,
-					PVPConstants.EID_SECTOR_FOR_IDENTIFIER_NAME,
-					PVPConstants.GIVEN_NAME_NAME,
-					PVPConstants.PRINCIPAL_NAME_NAME,
-					PVPConstants.BIRTHDATE_NAME,
-					PVPConstants.EID_CITIZEN_QAA_LEVEL_NAME,
-			});
-	
-	/** The Constant serialVersionUID. */
-	private static final long serialVersionUID = 4581953368724501376L;
-	
-	/** The request id. */
-	private String requestID;
-    
-    /** The stork authn request. */
-    private STORKAuthnRequest storkAuthnRequest;
-    
-    /** The stork attr query request. */
-    private STORKAttrQueryRequest storkAttrQueryRequest;
-
-
-    /**
-     * Sets the sTORK authn request.
-     *
-     * @param request the new sTORK authn request
-     */
-    public void setSTORKAuthnRequest(STORKAuthnRequest request) {
-        this.storkAuthnRequest = request;
-    }
-
-    /**
-     * Sets the sTORK attr request.
-     *
-     * @param request the new sTORK attr request
-     */
-    public void setSTORKAttrRequest(STORKAttrQueryRequest request) {
-        this.storkAttrQueryRequest = request;
-    }
-
-    /**
-     * Checks if the container holds an AttrQueryRequest
-     *
-     * @return true, if is attr request
-     */
-    public boolean isAttrRequest() {
-        return null != storkAttrQueryRequest;
-    }
-
-    /**
-     * Checks if the container holds an AuthnRequest
-     *
-     * @return true, if is authn request
-     */
-    public boolean isAuthnRequest() {
-        return null != storkAuthnRequest;
-    }
-
-    /**
-     * Gets the stork authn request.
-     *
-     * @return the stork authn request
-     */
-    public STORKAuthnRequest getStorkAuthnRequest() {
-        return this.storkAuthnRequest;
-    }
-
-    /**
-     * Gets the stork attr query request.
-     *
-     * @return the stork attr query request
-     */
-    public STORKAttrQueryRequest getStorkAttrQueryRequest() {
-        return this.storkAttrQueryRequest;
-    }
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.moduls.IRequest#getOAURL()
-     */
-    public String getOAURL() {
-        if (isAuthnRequest())
-            return storkAuthnRequest.getAssertionConsumerServiceURL();
-        else if (isAttrRequest())
-            return storkAttrQueryRequest.getAssertionConsumerServiceURL();
-        else {
-            Logger.error("There is no authentication or attribute request contained in MOASTORKRequest.");
-            return null;
-        }
-    }
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.moduls.IRequest#isPassiv()
-     */
-    public boolean isPassiv() {
-        return false;
-    }
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.moduls.IRequest#forceAuth()
-     */
-    public boolean forceAuth() {
-        return false;
-    }
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.moduls.IRequest#isSSOSupported()
-     */
-    public boolean isSSOSupported() {
-        return false;
-    }
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.moduls.IRequest#setRequestID(java.lang.String)
-     */
-    public void setRequestID(String id) {
-        this.requestID = id;
-    }
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.moduls.IRequest#getRequestID()
-     */
-    public String getRequestID() {
-        return this.requestID;
-    }
-    
-    /**
-     * Gets the personal attribute list.
-     *
-     * @return the personal attribute list
-     */
-    public IPersonalAttributeList getPersonalAttributeList() {
-    	if(isAttrRequest())
-    		return this.storkAttrQueryRequest.getPersonalAttributeList();
-    	else
-    		return this.storkAuthnRequest.getPersonalAttributeList();
-    }
-
-	/**
-	 * Gets the sp country.
-	 *
-	 * @return the sp country
-	 */
-	public String getSpCountry() {
-    	if(isAttrRequest())
-    		return this.storkAttrQueryRequest.getSpCountry();
-    	else
-    		return this.storkAuthnRequest.getSpCountry();
-	}
-
-	/**
-	 * Gets the assertion consumer service url.
-	 *
-	 * @return the assertion consumer service url
-	 */
-	public String getAssertionConsumerServiceURL() {
-    	if(isAttrRequest())
-    		return this.storkAttrQueryRequest.getAssertionConsumerServiceURL();
-    	else
-    		return this.storkAuthnRequest.getAssertionConsumerServiceURL();
-	}
-
-	/**
-	 * Gets the citizen country code.
-	 *
-	 * @return the citizen country code
-	 */
-	public String getCitizenCountryCode() {
-		if(isAttrRequest())
-			return this.storkAttrQueryRequest.getCitizenCountryCode();
-		else
-			return this.storkAuthnRequest.getCitizenCountryCode();
-	}
-
-	/* (non-Javadoc)
-	 * @see at.gv.egovernment.moa.id.moduls.RequestImpl#getRequestedAttributes()
-	 */
-	@Override
-	public List<Attribute> getRequestedAttributes() {
-		//TODO: only for testing with MOA-ID as PVP Stammportal		
-		IOAAuthParameters oa;
-		try {			
-			oa = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(getOAURL());
-			oa = DynamicOAAuthParameterBuilder.buildFromAuthnRequest(oa, this);
-			
-			DynamicOAAuthParameters tmp = (DynamicOAAuthParameters) oa;
-			tmp.setBusinessTarget(Constants.URN_PREFIX_CDID + "+BF");
-			
-			return AttributQueryBuilder.buildSAML2AttributeList(tmp, DEFAULTREQUESTEDATTRFORINTERFEDERATION.iterator());
-			
-		} catch (ConfigurationException e) {
-			// TODO Auto-generated catch block
-			e.printStackTrace();
-			return null;
-		}
-		
-		//return new ArrayList<Attribute>();
-		
-	}
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOASTORKResponse.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOASTORKResponse.java
deleted file mode 100644
index a233835bf..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOASTORKResponse.java
+++ /dev/null
@@ -1,308 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2;
-
-import at.gv.egovernment.moa.id.config.ConfigurationException;
-import at.gv.egovernment.moa.id.moduls.IRequest;
-import at.gv.egovernment.moa.id.moduls.RequestImpl;
-import at.gv.egovernment.moa.logging.Logger;
-import eu.stork.peps.auth.commons.IPersonalAttributeList;
-import eu.stork.peps.auth.commons.PersonalAttributeList;
-import eu.stork.peps.auth.commons.STORKAttrQueryResponse;
-import eu.stork.peps.auth.commons.STORKAuthnResponse;
-
-import java.io.Serializable;
-import java.util.List;
-
-import javax.servlet.http.HttpServletRequest;
-
-import org.opensaml.saml2.core.Attribute;
-
-/**
- * Implements MOA request and stores StorkAuthn/Attr-Request related data.
- *
- * @author bsuzic
- */
-public class MOASTORKResponse extends RequestImpl {
-
-    /**
-	 * @param req
-	 * @throws ConfigurationException
-	 */
-	public MOASTORKResponse(HttpServletRequest req)
-			throws ConfigurationException {
-		super(req);
-	}
-
-	/**
-     * The Constant serialVersionUID.
-     */
-    private static final long serialVersionUID = -5798803155055518747L;
-
-    /**
-     * The stork authn request.
-     */
-    private STORKAuthnResponse storkAuthnResponse;
-
-    /**
-     * The stork attr query request.
-     */
-    private STORKAttrQueryResponse storkAttrQueryResponse;
-
-    /**
-     * The action.
-     */
-    String action = null;
-
-    /**
-     * The token
-     */
-    private byte[] storkAuthnResponseToken = null;
-
-    /**
-     * The request id.
-     */
-    private String requestID;
-
-
-    /**
-     * The module.
-     */
-    String module = null;
-
-    /**
-     * The target.
-     */
-    private String target = null;
-
-
-    /* (non-Javadoc)
-   * @see at.gv.egovernment.moa.id.moduls.IRequest#requestedModule()
-   */
-    public String requestedModule() {
-        return this.module;
-    }
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.moduls.IRequest#requestedAction()
-     */
-    public String requestedAction() {
-        return action;
-    }
-
-
-    /* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.moduls.IRequest#getRequestID()
- */
-    public String getRequestID() {
-        return this.requestID;
-    }
-
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.moduls.IRequest#getTarget()
-     */
-    public String getTarget() {
-        return this.target;
-    }
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.moduls.IRequest#isSSOSupported()
-     */
-    public boolean isSSOSupported() {
-        return false;
-    }
-
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.moduls.IRequest#forceAuth()
-     */
-    public boolean forceAuth() {
-        return false;
-    }
-
-
-    /* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.moduls.IRequest#setModule(java.lang.String)
- */
-    public void setModule(String module) {
-        this.module = module;
-    }
-
-
-    /* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.moduls.IRequest#setRequestID(java.lang.String)
- */
-    public void setRequestID(String id) {
-        this.requestID = id;
-    }
-
-    /**
-     * Sets the sTORK authn response.
-     *
-     * @param request the new sTORK authn response
-     */
-    public void setSTORKAuthnResponse(STORKAuthnResponse request) {
-        this.storkAuthnResponse = request;
-    }
-
-    /**
-     * Sets the sTORK authn response token
-     *
-     * @param request the new sTORK authn response token
-     */
-    public void setSTORKAuthnResponseToken(byte[] token) {
-        this.storkAuthnResponseToken = token;
-    }
-
-    /**
-     * Gets the sTORK authn response token .
-     *
-     * @param request the new sTORK authn response
-     */
-    public byte[] getSTORKAuthnResponseToken() {
-        return this.storkAuthnResponseToken;
-    }
-    /**
-     * Sets the sTORK attr response.
-     *
-     * @param request the new sTORK attr response
-     */
-    public void setSTORKAttrResponse(STORKAttrQueryResponse request) {
-        this.storkAttrQueryResponse = request;
-    }
-
-    /**
-     * Checks if the container holds an AttrQuery
-     *
-     * @return true, if is attr response
-     */
-    public boolean isAttrResponse() {
-        return null != storkAttrQueryResponse;
-    }
-
-    /**
-     * Checks if the container holds an AuthnRequest
-     *
-     * @return true, if is authn response
-     */
-    public boolean isAuthnResponse() {
-        return null != storkAuthnResponse;
-    }
-
-
-    /**
-     * Gets the AuthnResponse.
-     *
-     * @return the stork authn response
-     */
-    public STORKAuthnResponse getStorkAuthnResponse() {
-        return this.storkAuthnResponse;
-    }
-
-    /**
-     * Gets the AttrQueryResponse.
-     *
-     * @return the stork attr query response
-     */
-    public STORKAttrQueryResponse getStorkAttrQueryResponse() {
-        return this.storkAttrQueryResponse;
-    }
-
-    /**
-     * Gets the personal attribute list.
-     *
-     * @return the personal attribute list
-     */
-    public IPersonalAttributeList getPersonalAttributeList() {
-        if (isAttrResponse())
-            return this.storkAttrQueryResponse.getPersonalAttributeList();
-        else
-            return this.storkAuthnResponse.getPersonalAttributeList();
-    }
-
-    /**
-     * Sets the personal attribute list.
-     *
-     * @param populateAttributes the new personal attribute list
-     */
-    public void setPersonalAttributeList(PersonalAttributeList populateAttributes) {
-        if (isAttrResponse())
-            this.storkAttrQueryResponse.setPersonalAttributeList(populateAttributes);
-        else
-            this.storkAuthnResponse.setPersonalAttributeList(populateAttributes);
-    }
-
-    /**
-     * Sets the country.
-     *
-     * @param spCountry the new country
-     */
-    public void setCountry(String spCountry) {
-        if (isAttrResponse())
-            this.storkAttrQueryResponse.setCountry(spCountry);
-        else
-            this.storkAuthnResponse.setCountry(spCountry);
-    }
-
-
-    /* (non-Javadoc)
-    * @see at.gv.egovernment.moa.id.moduls.IRequest#getOAURL()
-    */
-    public String getOAURL() {
-        if (isAuthnResponse())
-            return storkAuthnResponse.getAudienceRestriction();
-        else if (isAttrResponse())
-            return storkAttrQueryResponse.getAudienceRestriction();
-        else {
-            Logger.error("There is no authentication or attribute request contained in MOASTORKRequest.");
-            return null;
-        }
-    }
-
-    /* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.moduls.IRequest#isPassiv()
- */
-    public boolean isPassiv() {
-        return false;
-    }
-
-
-    /* (non-Javadoc)
- * @see at.gv.egovernment.moa.id.moduls.IRequest#setAction(java.lang.String)
- */
-    public void setAction(String action) {
-        this.action = action;
-    }
-
-	/* (non-Javadoc)
-	 * @see at.gv.egovernment.moa.id.moduls.RequestImpl#getRequestedAttributes()
-	 */
-	@Override
-	public List<Attribute> getRequestedAttributes() {
-		// TODO Auto-generated method stub
-		return null;
-	}
-
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MandateContainer.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MandateContainer.java
deleted file mode 100644
index a3fac0f6e..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MandateContainer.java
+++ /dev/null
@@ -1,182 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2;
-
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.logging.Logger;
-
-import javax.xml.xpath.XPath;
-import javax.xml.xpath.XPathExpressionException;
-import javax.xml.xpath.XPathFactory;
-
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.util.HashMap;
-
-/**
- * @author bsuzic
- *         Date: 5/5/14, Time: 2:35 PM
- */
-public abstract class MandateContainer {
-    protected String mandateIssuePlace = null;
-    protected String mandateIssueDate = null;
-    protected String mandateIssueTime = null;
-    protected String simpleMandateContent = null;
-    protected String mandateValidFrom = null;
-    protected String mandateValidTo = null;
-    protected String annotation = null;
-    protected String physicalRepresentativeIdentificationValue = null;
-    protected String physicalRepresentativeIdentificationType = null;
-    protected String physicalRepresentativeGivenName = null;
-    protected String physicalRepresentativeFamilyName = null;
-    protected String physicalRepresentativeBirthDate = null;
-    protected XPath xPath = null;
-
-
-    public MandateContainer(String mandate) throws XPathExpressionException, MOAIDException {
-        Logger.debug("Received mandate content for processing: " + mandate);
-
-        xPath = XPathFactory.newInstance().newXPath();
-        HashMap<String, String> prefMap = new HashMap<String, String>() {{
-            put(S2Constants.MANDATE_PREFIX, S2Constants.MANDATE_NS);
-            put(S2Constants.PERSONDATA_PREFIX, S2Constants.PERSONDATA_NS);
-            put(S2Constants.XMLDSIG_PREFIX, S2Constants.XMLDSIG_NS);
-        }};
-
-        SimpleNamespaceContext namespace = new SimpleNamespaceContext(prefMap);
-        xPath.setNamespaceContext(namespace);
-    }
-
-
-    public void validateMandateStructure(String localMethods[]) throws NoSuchMethodException, InvocationTargetException, IllegalAccessException, MOAIDException {
-        for (String localMethod : localMethods) {
-            Method method = this.getClass().getMethod(localMethod);
-            Object x = method.invoke(this);
-            if ((x == null) || x.toString().length() == 0) {
-                throw new MOAIDException("stork.16", new Object[] {localMethod}); // TODO
-            }
-        }
-        Logger.debug("Mandate structure validated");
-    }
-
-
-    public String getMandateIssuePlace() {
-        return mandateIssuePlace;
-    }
-
-    public void setMandateIssuePlace(String mandateIssuePlace) {
-        this.mandateIssuePlace = mandateIssuePlace;
-    }
-
-    public String getMandateIssueDate() {
-        return mandateIssueDate;
-    }
-
-    public void setMandateIssueDate(String mandateIssueDate) {
-        this.mandateIssueDate = mandateIssueDate;
-    }
-
-    public String getMandateIssueTime() {
-        return mandateIssueTime;
-    }
-
-    public void setMandateIssueTime(String mandateIssueTime) {
-        this.mandateIssueTime = mandateIssueTime;
-    }
-
-    public String getSimpleMandateContent() {
-        return simpleMandateContent;
-    }
-
-    public void setSimpleMandateContent(String simpleMandateContent) {
-        this.simpleMandateContent = simpleMandateContent;
-    }
-
-    public String getMandateValidFrom() {
-        return mandateValidFrom;
-    }
-
-    public void setMandateValidFrom(String mandateValidFrom) {
-        this.mandateValidFrom = mandateValidFrom;
-    }
-
-    public String getMandateValidTo() {
-        return mandateValidTo;
-    }
-
-    public void setMandateValidTo(String mandateValidTo) {
-        this.mandateValidTo = mandateValidTo;
-    }
-
-    public String getPhysicalRepresentativeIdentificationValue() {
-        return physicalRepresentativeIdentificationValue;
-    }
-
-    public void setPhysicalRepresentativeIdentificationValue(String physicalRepresentativeIdentificationValue) {
-        this.physicalRepresentativeIdentificationValue = physicalRepresentativeIdentificationValue;
-    }
-
-    public String getPhysicalRepresentativeIdentificationType() {
-        return physicalRepresentativeIdentificationType;
-    }
-
-    public void setPhysicalRepresentativeIdentificationType(String physicalRepresentativeIdentificationType) {
-        this.physicalRepresentativeIdentificationType = physicalRepresentativeIdentificationType;
-    }
-
-    public String getPhysicalRepresentativeGivenName() {
-        return physicalRepresentativeGivenName;
-    }
-
-    public void setPhysicalRepresentativeGivenName(String physicalRepresentativeGivenName) {
-        this.physicalRepresentativeGivenName = physicalRepresentativeGivenName;
-    }
-
-    public String getPhysicalRepresentativeFamilyName() {
-        return physicalRepresentativeFamilyName;
-    }
-
-    public void setPhysicalRepresentativeFamilyName(String physicalRepresentativeFamilyName) {
-        this.physicalRepresentativeFamilyName = physicalRepresentativeFamilyName;
-    }
-
-    public String getPhysicalRepresentativeBirthDate() {
-        return physicalRepresentativeBirthDate;
-    }
-
-    public void setPhysicalRepresentativeBirthDate(String physicalRepresentativeBirthDate) {
-        // making it conform to STORK dateOfBirth specifications, removing dash
-        this.physicalRepresentativeBirthDate = physicalRepresentativeBirthDate.replaceAll("-","");
-    }
-
-    public String getAnnotation() {
-        return annotation;
-    }
-
-    public void setAnnotation(String annotation) {
-        this.annotation = annotation;
-    }
-
-
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MandateRetrievalRequest.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MandateRetrievalRequest.java
deleted file mode 100644
index 2351450e4..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MandateRetrievalRequest.java
+++ /dev/null
@@ -1,602 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2;
-
-import at.gv.egovernment.moa.id.auth.builder.BPKBuilder;
-import at.gv.egovernment.moa.id.auth.data.IdentityLink;
-import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
-import at.gv.egovernment.moa.id.auth.exception.BuildException;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.data.SLOInformationInterface;
-import at.gv.egovernment.moa.id.moduls.IAction;
-import at.gv.egovernment.moa.id.moduls.IRequest;
-import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
-import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.Constants;
-import eu.stork.peps.auth.commons.IPersonalAttributeList;
-import eu.stork.peps.auth.commons.PersonalAttribute;
-import eu.stork.peps.auth.commons.PersonalAttributeList;
-import eu.stork.peps.auth.commons.STORKAttrQueryResponse;
-import eu.stork.peps.complex.attributes.eu.stork.names.tc.stork._1_0.assertion.*;
-import org.apache.commons.codec.binary.StringUtils;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.xml.bind.JAXBContext;
-import javax.xml.bind.JAXBElement;
-import javax.xml.bind.Marshaller;
-import javax.xml.datatype.DatatypeConfigurationException;
-import javax.xml.datatype.DatatypeFactory;
-import javax.xml.datatype.XMLGregorianCalendar;
-import javax.xml.namespace.QName;
-import java.io.StringWriter;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.HashMap;
-import java.util.regex.Pattern;
-
-/**
- * Entry point for mandate retrieval. Processes MIS data and transforms into STORK mandate attribute.
- * Additionally provides eIdentifier attribute (if requested) in order to enable identity correlation
- */
-public class MandateRetrievalRequest implements IAction {
-
-    private IAuthData authData;
-    private MOASTORKRequest moaStorkRequest;
-    private IdentityLink representingIdentityLink;
-    private Integer QAALevel;
-    private byte[] originalContent;
-
-    public SLOInformationInterface processRequest(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp, IAuthData authData) throws MOAIDException {
-        Logger.debug("Entering AttributeRequest for MandateProvider");
-        httpResp.reset();
-        this.representingIdentityLink = authData.getIdentityLink();
-        this.QAALevel = translateQAALevel(authData.getQAALevel());
-
-        // preparing original content and removing sensitive data from it
-        try {
-            this.originalContent = authData.getMISMandate().getMandate();
-        } catch (Exception e) {
-            Logger.error("Could not extract mandate");
-            Logger.debug(e);
-            throw new MOAIDException("stork.26", new Object[]{});
-        }
-        String originalMandate = StringUtils.newStringUtf8(authData.getMISMandate().getMandate()).replaceAll("<pd:Value>.*?==</pd:Value><pd:Type>urn:publicid:gv.at:baseid</pd:Type>","<pd:Value></pd:Value><pd:Type></pd:Type>");;
-        Logger.debug("Removing personal identification value and type from original mandate ");
-        originalContent = StringUtils.getBytesUtf8(originalMandate);
-
-        OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(req.getOAURL());
-        if (oaParam == null)
-            throw new AuthenticationException("stork.12", new Object[]{req.getOAURL()});
-
-        MOASTORKResponse moaStorkResponse = new MOASTORKResponse(httpReq);
-        STORKAttrQueryResponse attrResponse = new STORKAttrQueryResponse();
-
-        this.authData = authData;
-
-        if ((req instanceof MOASTORKRequest)) {
-            this.moaStorkRequest = (MOASTORKRequest) req;
-        } else {
-            Logger.error("Internal error - did not receive MOASTORKRequest as expected");
-            throw new MOAIDException("stork.27", new Object[]{});
-        }
-
-
-        if (!(moaStorkRequest.isAttrRequest() || moaStorkRequest.getStorkAttrQueryRequest() == null)) {
-            Logger.error("Did not receive attribute request as expected");
-            throw new MOAIDException("stork.27", new Object[]{});
-        }
-
-        MandateContainer mandateContainer = null;
-
-        try {
-            mandateContainer = new CorporateBodyMandateContainer(new String(authData.getMISMandate().getMandate(), "UTF-8"));
-        } catch (Exception ex) {
-            try {
-                mandateContainer = new PhyPersonMandateContainer(new String(authData.getMISMandate().getMandate(), "UTF-8"));
-            } catch (Exception ex2) {
-                Logger.error("Could not extract data and create mandate container.");
-                throw new MOAIDException("stork.27", new Object[]{});
-            }
-        }
-
-        IPersonalAttributeList sourceAttributeList = moaStorkRequest.getStorkAttrQueryRequest().getPersonalAttributeList();
-
-        IPersonalAttributeList attributeList = new PersonalAttributeList();
-
-        // according to new mapping, only mandate attribute is directly relevant
-        for (PersonalAttribute currentAttribute : sourceAttributeList) {
-            Logger.debug("Evaluating attributes, current attribute: " + currentAttribute.getName());
-            if (currentAttribute.getName().equals("mandateContent")) {   // deprecated
-                MandateContentType mandateContent = getMandateContent(mandateContainer, currentAttribute);
-                attributeList.add(marshallComplexAttribute(currentAttribute, mandateContent));
-            } else if (currentAttribute.getName().equals("representative")) {  //  deprecated
-                RepresentationPersonType representative = getRepresentative(mandateContainer, currentAttribute);
-                attributeList.add(marshallComplexAttribute(currentAttribute, representative));
-            } else if (currentAttribute.getName().equals("represented")) {
-                RepresentationPersonType represented = getRepresented(mandateContainer, currentAttribute);
-                attributeList.add(marshallComplexAttribute(currentAttribute, represented));
-            } else if (currentAttribute.getName().equals("mandate")) {
-                MandateType mandateType = getMandateType(mandateContainer, currentAttribute);
-                attributeList.add(marshallComplexAttribute(currentAttribute, mandateType));
-            } else if (currentAttribute.getName().equals("legalName")) {
-                String legalName = getLegalName(mandateContainer, currentAttribute);
-                if (legalName.length() > 0) {
-                    attributeList.add(new PersonalAttribute(currentAttribute.getName(), currentAttribute.isRequired(), Arrays.asList(legalName), AttributeStatusType.AVAILABLE.value()));
-                } else {
-                    attributeList.add(new PersonalAttribute(currentAttribute.getName(), currentAttribute.isRequired(), Arrays.asList(legalName), AttributeStatusType.NOT_AVAILABLE.value()));
-                }
-            } else if (currentAttribute.getName().equals("eLPIdentifier")) {
-                String eLPIdentifier = geteLPIdentifier(mandateContainer, currentAttribute);
-                if (eLPIdentifier.length() > 0) {
-                    attributeList.add(new PersonalAttribute(currentAttribute.getName(), currentAttribute.isRequired(), Arrays.asList(eLPIdentifier), AttributeStatusType.AVAILABLE.value()));
-                } else {
-                    attributeList.add(new PersonalAttribute(currentAttribute.getName(), currentAttribute.isRequired(), Arrays.asList(eLPIdentifier), AttributeStatusType.NOT_AVAILABLE.value()));
-                }
-            } else if (currentAttribute.getName().equals("type")) {
-                String type = getCompanyType(mandateContainer, currentAttribute);
-                if (type.length() > 0) {
-                    attributeList.add(new PersonalAttribute(currentAttribute.getName(), currentAttribute.isRequired(), Arrays.asList(type), AttributeStatusType.AVAILABLE.value()));
-                } else {
-                    attributeList.add(new PersonalAttribute(currentAttribute.getName(), currentAttribute.isRequired(), Arrays.asList(type), AttributeStatusType.NOT_AVAILABLE.value()));
-                }
-            } else if (currentAttribute.getName().equals("status")) {
-                String status = getCompanyStatus(mandateContainer, currentAttribute);
-                if (status.length() > 0) {
-                    attributeList.add(new PersonalAttribute(currentAttribute.getName(), currentAttribute.isRequired(), Arrays.asList(status), AttributeStatusType.AVAILABLE.value()));
-                } else {
-                    attributeList.add(new PersonalAttribute(currentAttribute.getName(), currentAttribute.isRequired(), Arrays.asList(status), AttributeStatusType.NOT_AVAILABLE.value()));
-                }
-            } else if (currentAttribute.getName().equals("translatableType")) {
-                String translatableType = getCompanyTranslatableType(mandateContainer, currentAttribute);
-                if (translatableType.length() > 0) {
-                    attributeList.add(new PersonalAttribute(currentAttribute.getName(), currentAttribute.isRequired(), Arrays.asList(translatableType), AttributeStatusType.AVAILABLE.value()));
-                } else {
-                    attributeList.add(new PersonalAttribute(currentAttribute.getName(), currentAttribute.isRequired(), Arrays.asList(translatableType), AttributeStatusType.NOT_AVAILABLE.value()));
-                }
-            }
-
-            if (currentAttribute.getName().equals("eIdentifier")) {
-                attributeList.add(new PersonalAttribute(currentAttribute.getName(), currentAttribute.isRequired(), Arrays.asList(geteIdentifier(authData.getIdentificationType(), authData.getIdentificationValue(), moaStorkRequest.getStorkAttrQueryRequest().getSpCountry())), AttributeStatusType.AVAILABLE.value()));
-                Logger.info("Adding eIdentifier for mandate holder using SP country: " + moaStorkRequest.getStorkAttrQueryRequest().getSpCountry());
-            }
-
-        }
-
-
-//            if (attrResponse.getPersonalAttributeList().size() == 0) {
-//                Logger.error("AttributeList empty - could not retrieve attributes");
-//                throw new MOAIDException("stork.16", new Object[]{}); // TODO MESSAGE
-//            }
-
-        attrResponse.setPersonalAttributeList(attributeList);
-        moaStorkResponse.setSTORKAttrResponse(attrResponse);
-
-        Logger.debug("Attributes retrieved: " + moaStorkResponse.getStorkAttrQueryResponse().getPersonalAttributeList().size() + " for SP country " + attrResponse.getCountry());
-
-        // Prepare extended attributes
-        Logger.debug("Preparing data container");
-
-        // create fresh container
-        DataContainer container = new DataContainer();
-
-        // - fill in the request we extracted above
-        container.setRequest(moaStorkRequest);
-
-        // - fill in the partial response created above
-        container.setResponse(moaStorkResponse);
-
-        container.setRemoteAddress(httpReq.getRemoteAddr());
-
-        Logger.debug("Data container prepared");
-
-        // ask for consent if necessary
-        if (oaParam.isRequireConsentForStorkAttributes())
-            new ConsentEvaluator().requestConsent(container, httpReq, httpResp, authData, oaParam);
-        else
-            new ConsentEvaluator().generateSTORKResponse(httpResp, container);
-
-        return null;
-    }
-
-    private Integer translateQAALevel(String qaaLevel) throws MOAIDException {
-        if (qaaLevel.equals(PVPConstants.STORK_QAA_1_1))
-            return 1;
-        if (qaaLevel.equals(PVPConstants.STORK_QAA_1_2))
-            return 2;
-        if (qaaLevel.equals(PVPConstants.STORK_QAA_1_3))
-            return 3;
-        if (qaaLevel.equals(PVPConstants.STORK_QAA_1_4))
-            return 4;
-        Logger.error("Wrong QAA Number format");
-        throw new MOAIDException("stork.28", new Object[]{});
-    }
-
-    private String geteLPIdentifier(MandateContainer mandateContainer, PersonalAttribute currentAttribute) throws MOAIDException {
-        RepresentationPersonType represented = getRepresented(mandateContainer, currentAttribute);
-        if (mandateContainer instanceof CorporateBodyMandateContainer) {
-            return represented.getELPIdentifier();
-        } else if (currentAttribute.isRequired()) {
-            Logger.error("Cannot provide eLPIdentifier for natural person.");
-            throw new MOAIDException("stork.29", new Object[]{currentAttribute.getName()});
-        }
-        return "";
-    }
-
-    private String geteIdentifier(String identificationType, String identificationValue, String destinationCountry) throws MOAIDException {
-        BPKBuilder bpkBuilder = new BPKBuilder();
-        try {
-            return bpkBuilder.buildStorkeIdentifier(identificationType, identificationValue, destinationCountry);
-        } catch (BuildException be) {
-            Logger.error("Could not build STORK eIdentifier while generating mandate assertion.");
-            throw new MOAIDException("stork.29", new Object[]{});
-        }
-    }
-
-    private PersonalAttribute marshallComplexAttribute(PersonalAttribute currentAttribute, Object obj) {    // TODO refactor
-        StringWriter stringWriter = new StringWriter();
-        try {
-            if (obj instanceof MandateContentType) {
-                final Marshaller marshaller = JAXBContext.newInstance(MandateContentType.class).createMarshaller();
-                marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, Boolean.TRUE);
-                marshaller.marshal(new JAXBElement<MandateContentType>(new QName("urn:eu:stork:names:tc:STORK:1.0:assertion", currentAttribute.getName()), MandateContentType.class, null, (MandateContentType) obj), stringWriter);
-            } else if (obj instanceof MandateType) {
-                final Marshaller marshaller = JAXBContext.newInstance(MandateType.class).createMarshaller();
-                marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, Boolean.TRUE);
-                marshaller.marshal(new JAXBElement<MandateType>(new QName("urn:eu:stork:names:tc:STORK:1.0:assertion", currentAttribute.getName()), MandateType.class, null, (MandateType) obj), stringWriter);
-            } else if (obj instanceof RepresentationPersonType) {
-                final Marshaller marshaller = JAXBContext.newInstance(RepresentationPersonType.class).createMarshaller();
-                marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, Boolean.TRUE);
-                marshaller.marshal(new JAXBElement<RepresentationPersonType>(new QName("urn:eu:stork:names:tc:STORK:1.0:assertion", currentAttribute.getName()), RepresentationPersonType.class, null, (RepresentationPersonType) obj), stringWriter);
-            }
-
-        } catch (Exception ex) {
-            Logger.error("Could not marshall atrribute: " + currentAttribute.getName() + ", " + ex.getMessage());
-            return new PersonalAttribute(currentAttribute.getName(), currentAttribute.isRequired(), new ArrayList<String>(), AttributeStatusType.NOT_AVAILABLE.value());
-        }
-        ArrayList<String> value = new ArrayList<String>();
-        value.add(stringWriter.toString());
-
-        PersonalAttribute personalAttribute = new PersonalAttribute(currentAttribute.getName(), currentAttribute.isRequired(), value, AttributeStatusType.AVAILABLE.value());
-        return personalAttribute;
-    }
-
-
-    private String mapPowersType(MandateContainer mandateContainer) {
-        Logger.debug("Analyzing mandate of type: " + mandateContainer.getAnnotation() + ".");
-        // using if for java 6 compatibility if necessary
-        if (mandateContainer.getAnnotation().equals("ELGABilateral")) {
-            return "6"; // Health Powers
-        } else if (mandateContainer.getAnnotation().equals("ERsB")) {
-            return "0"; // General Powers
-        } else if (mandateContainer.getAnnotation().equals("Gesetzliche Vollmacht auf Basis Ergäzungsregister für sonstige Betroffene")) {
-            return "0"; // General Powers
-        } else if (mandateContainer.getAnnotation().equals("Gesetzliche Vollmacht auf Basis Ergänzungsregister für sonstige Betroffene")) {
-            return "0"; // General Powers
-        } else if (mandateContainer.getAnnotation().contains("Gesetzliche Vollmacht auf Basis Erg")) {
-            return "0"; // General Powers
-        } else if (mandateContainer.getAnnotation().equals("GeneralvollmachtBilateral")) {
-            return "0"; // General Powers
-        } else if (mandateContainer.getAnnotation().contains("Gesetzliche Vollmacht auf Basis Firmenbuch")) {
-            return "0"; // General Powers
-        } else if (mandateContainer.getAnnotation().equals("ERsBMitPostvollmacht")) {
-            return "0"; // General Powers
-        } else if (mandateContainer.getAnnotation().equals("ZVR")) {
-            return "0"; // General Powers
-        } else if (mandateContainer.getAnnotation().equals("ZVRMitPostvollmacht")) {
-            return "0"; // General Powers
-        } else if (mandateContainer.getAnnotation().equals("EVB")) {
-            return "0"; // General Powers
-        } else if (mandateContainer.getAnnotation().equals("Einzelvertretungsbefugnis")) {
-            return "0"; // General Powers
-        }  else if (mandateContainer.getAnnotation().equals("Prokura")) {
-            return "0"; // General Powers
-        }  else if (mandateContainer.getAnnotation().equals("Notar")) {
-            return "0"; // General Powers
-        } else if (mandateContainer.getAnnotation().equals("Organwalter")) {
-            return "0"; // General Powers
-        } else if (mandateContainer.getAnnotation().equals("Rechtsanwalt")) {
-            return "0"; // General Powers
-        } else if (mandateContainer.getAnnotation().equals("Ziviltechniker")) {
-            return "0"; // General Powers
-        }
-        Logger.debug("Returning other type of mandate");
-        return "9";
-    }
-
-    private MandateType getMandateType(MandateContainer mandateContainer, PersonalAttribute sourceAttribute) throws MOAIDException {
-        MandateType mandateType = new MandateType();
-        RepresentationPersonType representative = getRepresentative(mandateContainer, sourceAttribute);
-        RepresentationPersonType represented = getRepresented(mandateContainer, sourceAttribute);
-        MandateContentType mandateContent = getMandateContent(mandateContainer, sourceAttribute);
-        mandateType.setRepresentative(representative);
-        mandateType.setRepresented(represented);
-        mandateType.getMandateContent().add(mandateContent);
-        Logger.debug("Complex attribute extracted: " + sourceAttribute.getName());
-        return mandateType;
-    }
-
-    private String getLegalName(MandateContainer mandateContainer, PersonalAttribute sourceAttribute) throws MOAIDException {
-        RepresentationPersonType represented = getRepresented(mandateContainer, sourceAttribute);
-        if (mandateContainer instanceof CorporateBodyMandateContainer) {
-            represented.getLegalName();
-            //return represented.getName();
-        } else if (sourceAttribute.isRequired()) {
-            Logger.error("Cannot provide legalName for natural person.");
-            throw new MOAIDException("stork.19", new Object[]{sourceAttribute.getName()});
-        }
-        return "";
-    }
-
-
-    private String getLegalIdentificationType(MandateContainer mandateContainer, PersonalAttribute sourceAttribute) throws MOAIDException {
-        if (mandateContainer instanceof CorporateBodyMandateContainer) {
-            return ((CorporateBodyMandateContainer) mandateContainer).getCorpMandatorIdentificationType();
-        } else if (sourceAttribute.isRequired()) {
-            Logger.error("Cannot provide type for natural person.");
-            throw new MOAIDException("stork.19", new Object[]{sourceAttribute.getName()}); // TODO
-        }
-        return "";
-    }
-
-    private String getCompanyStatus(MandateContainer mandateContainer, PersonalAttribute sourceAttribute) throws MOAIDException {
-        String legalName = getLegalName(mandateContainer, sourceAttribute);
-        if (legalName.contains("in Liquidation") || legalName.contains("in Liqu.")) {
-            return "L"; // liqudation
-        }
-        return "R";
-    }
-
-    private String getCompanyType(String legalName, String legalIdentificationType, PersonalAttribute sourceAttrivbute) throws MOAIDException {
-        // compile patterns for different organisation types
-        // sources: USP, WKO, LexAndTax
-
-        // gmbh patterns
-        ArrayList<Pattern> gmbhPatterns = new ArrayList<Pattern>();
-        gmbhPatterns.add(Pattern.compile(".+ GmbH(( in Liquidation)|( in Liqu.)){0,1}$"));
-        gmbhPatterns.add(Pattern.compile(".+ GesmbH$"));
-        gmbhPatterns.add(Pattern.compile(".+ Gesellschaft mit beschränkter Haftung$"));
-        gmbhPatterns.add(Pattern.compile(".+ Ges\\.m\\.b\\.H\\.$"));
-        gmbhPatterns.add(Pattern.compile(".+ G\\.m\\.b\\.H\\.$"));
-        gmbhPatterns.add(Pattern.compile(".+ Handelsges\\.m\\.b\\.H\\.$"));
-        gmbhPatterns.add(Pattern.compile(".+ Gesellschaft m\\.b\\.H\\.$"));
-
-        // ag patterns
-        ArrayList<Pattern> agPatterns = new ArrayList<Pattern>();
-        agPatterns.add(Pattern.compile(".+ AG$"));
-        agPatterns.add(Pattern.compile(".+ Aktiengesellschaft$"));
-
-        // og patterns
-        ArrayList<Pattern> ogPatterns = new ArrayList<Pattern>();
-        ogPatterns.add(Pattern.compile(".+ OG$"));
-        ogPatterns.add(Pattern.compile(".+ OHG$"));
-        ogPatterns.add(Pattern.compile(".+ offene Gesellschaft$"));
-
-        // kg patterns
-        ArrayList<Pattern> kgPatterns = new ArrayList<Pattern>();
-        kgPatterns.add(Pattern.compile(".+ KG$"));
-        kgPatterns.add(Pattern.compile(".+ Kommanditgesellschaft$"));
-
-        // eu patterns
-        ArrayList<Pattern> euPatterns = new ArrayList<Pattern>();
-        euPatterns.add(Pattern.compile(".+ eingetragene Unternehmerin$"));
-        euPatterns.add(Pattern.compile(".+ eingetragener Unternehmer$"));
-        euPatterns.add(Pattern.compile(".+ e\\.U\\.$"));
-
-
-        // company patterns
-        HashMap<String, ArrayList<Pattern>> companyPatterns = new HashMap<String, ArrayList<Pattern>>();
-        companyPatterns.put("GmbH", gmbhPatterns);
-        companyPatterns.put("AG", agPatterns);
-        companyPatterns.put("OG", ogPatterns);
-        companyPatterns.put("KG", kgPatterns);
-        companyPatterns.put("e.U.", euPatterns);
-
-        // iterate over different types of companies and check if the name ending matches
-        if (S2Constants.IDENTIFICATION_TYPE_COMPANY.equals(legalIdentificationType)) {
-            for (String companyType : companyPatterns.keySet()) {
-                for (Pattern pattern : companyPatterns.get(companyType)) {
-                    if (pattern.matcher(legalName).matches()) {
-                        return companyType;
-                    }
-                }
-            }
-        }
-
-        // check if the subject is association
-        if (S2Constants.IDENTIFICATION_TYPE_ASSOCIATION.equals(legalIdentificationType)) {
-            return "Verein";
-        }
-
-        // check if the subject falls under category of others
-        if (S2Constants.IDENTIFICATION_TYPE_OTHERS.equals(legalIdentificationType)) {
-            return "ERsB";
-        }
-
-        return "";
-    }
-
-    private String getCompanyType(MandateContainer mandateContainer, PersonalAttribute sourceAttribute) throws MOAIDException {
-        // retrieve the registered subject name and identification type
-        String legalName = getLegalName(mandateContainer, sourceAttribute);
-        String legalIdentificationType = getLegalIdentificationType(mandateContainer, sourceAttribute);
-        return getCompanyType(legalName, legalIdentificationType, sourceAttribute);
-    }
-
-    private String getCompanyTranslatableType(MandateContainer mandateContainer, PersonalAttribute sourceAttribute) throws MOAIDException {
-        // retrieve first the company type
-        String companyType = getCompanyType(mandateContainer, sourceAttribute);
-
-        // translate company type based on the section 5.6 in STORK 2 D4.11
-        if (companyType.length() == 0) {
-            return "";
-        } else if (companyType.equals("GmbH")) {
-            return "G";
-        } else if (companyType.equals("AG")) {
-            return "A";
-        } else if (companyType.equals("OG")) {
-            return "O";
-        } else if (companyType.equals("KG")) {
-            return "K";
-        } else {
-            return "";
-        }
-    }
-
-
-    private String getRepresentedStorkeIdentifier(MandateContainer mandateContainer) throws MOAIDException {
-
-        if (!(mandateContainer instanceof PhyPersonMandateContainer)) {
-            Logger.error("Physical person mandate container missing");
-            throw new MOAIDException("stork.20", new Object[]{}); // TODO
-        }
-
-        PhyPersonMandateContainer phyPersonMandateContainer = (PhyPersonMandateContainer) mandateContainer;
-
-        if (!phyPersonMandateContainer.getPhyPersMandatorIdentificationType().equals(Constants.URN_PREFIX_BASEID)) {
-            Logger.error("Identification type of represented person from MIS is not correct");
-            throw new MOAIDException("stork.20", new Object[]{}); // TODO
-        }
-
-        if (phyPersonMandateContainer.getPhyPersMandatorIdentificationValue().length() != 24) {
-            Logger.error("Identification value of represented person from MIS is not correct");
-            throw new MOAIDException("stork.20", new Object[]{}); // TODO
-        }
-
-        if ((this.moaStorkRequest.getStorkAttrQueryRequest().getSpCountry() == null) || (this.moaStorkRequest.getStorkAttrQueryRequest().getSpCountry().length() == 0)) {
-            Logger.error("Error accessing SP country code");
-            throw new MOAIDException("stork.20", new Object[]{}); // TODO
-        }
-
-        return geteIdentifier(phyPersonMandateContainer.getPhyPersMandatorIdentificationType(), phyPersonMandateContainer.getPhyPersMandatorIdentificationValue(), this.moaStorkRequest.getStorkAttrQueryRequest().getSpCountry());
-    }
-
-    private String getRepresentingStorkeIdentifier(MandateContainer mandateContainer) throws MOAIDException {
-        if ((this.representingIdentityLink == null)) {
-            Logger.error("Error accessing identityLink while fetching mandate attribute");
-            throw new MOAIDException("stork.20", new Object[]{}); // TODO
-        }
-
-        if ((this.moaStorkRequest.getStorkAttrQueryRequest().getSpCountry() == null) || (this.moaStorkRequest.getStorkAttrQueryRequest().getSpCountry().length() == 0)) {
-            Logger.error("Error accessing SP country code");
-            throw new MOAIDException("stork.20", new Object[]{}); // TODO
-        }
-
-        if (!this.representingIdentityLink.getIdentificationType().equals(Constants.URN_PREFIX_BASEID)) {
-            Logger.error("Incorrect identity link (local): identification type is not correct! Got: " + this.representingIdentityLink.getIdentificationType());
-            throw new MOAIDException("stork.20", new Object[]{}); // TODO
-        }
-
-        if (!mandateContainer.getPhysicalRepresentativeIdentificationType().equals(Constants.URN_PREFIX_BASEID)) {
-            Logger.error("Incorrect identity link (MIS): identification type is not correct! Got: " + this.representingIdentityLink.getIdentificationType() + " (representingIdentityLink) and " + mandateContainer.getPhysicalRepresentativeIdentificationType() + " (mandateContainer.phyRepresentative)");
-            Logger.debug("mandatecontainervalue: " + mandateContainer.getPhysicalRepresentativeIdentificationValue() +  ", representingidentitylinkvalue: " + this.representingIdentityLink.getIdentificationValue());
-            throw new MOAIDException("stork.20", new Object[]{}); // TODO
-        }
-
-        if (!mandateContainer.getPhysicalRepresentativeIdentificationValue().equals(this.representingIdentityLink.getIdentificationValue())) {
-            Logger.error("Identification values from MIS and local service are not equal!");
-            throw new MOAIDException("stork.20", new Object[]{}); // TODO
-        }
-
-        BPKBuilder bpkBuilder = new BPKBuilder();
-        try {
-            return bpkBuilder.buildStorkeIdentifier(this.representingIdentityLink, this.moaStorkRequest.getStorkAttrQueryRequest().getSpCountry());
-        } catch (BuildException be) {
-            Logger.error("Could not build STORK eIdentifier while generating mandate assertion.");
-            throw new MOAIDException("stork.20", new Object[]{}); // TODO
-        }
-
-    }
-
-    private RepresentationPersonType getRepresentative(MandateContainer mandateContainer, PersonalAttribute sourceAttribute) throws MOAIDException {
-        RepresentationPersonType representative = new RepresentationPersonType();
-
-        representative.setEIdentifier(getRepresentingStorkeIdentifier(mandateContainer));
-        representative.setGivenName(mandateContainer.getPhysicalRepresentativeGivenName());
-        representative.setSurname(mandateContainer.getPhysicalRepresentativeFamilyName());
-        representative.setDateOfBirth(mandateContainer.getPhysicalRepresentativeBirthDate());
-
-        Logger.debug("Complex attribute extracted: " + sourceAttribute.getName());
-        return representative;
-    }
-
-    private RepresentationPersonType getRepresented(MandateContainer mandateContainer, PersonalAttribute sourceAttribute) throws MOAIDException {
-        RepresentationPersonType represented = new RepresentationPersonType();
-
-        if (mandateContainer instanceof CorporateBodyMandateContainer) {
-            CorporateBodyMandateContainer corporateBodyMandateContainer = (CorporateBodyMandateContainer) mandateContainer;
-            represented.setELPIdentifier(corporateBodyMandateContainer.getCorpMandatorIdentificationValue());
-            represented.setLegalName(corporateBodyMandateContainer.getCorpMandatorFullName());
-            represented.setTextRegisteredAddress(null);
-            represented.setCanonicalRegisteredAddress(new CanonicalAddressType());
-            represented.setLegalForm(getCompanyType(corporateBodyMandateContainer.corpMandatorFullName, corporateBodyMandateContainer.corpMandatorIdentificationType, sourceAttribute));
-        } else if (mandateContainer instanceof PhyPersonMandateContainer) {
-            PhyPersonMandateContainer phyPersonMandateContainer = (PhyPersonMandateContainer) mandateContainer;
-            represented.setEIdentifier(getRepresentedStorkeIdentifier(mandateContainer));
-            represented.setGivenName(phyPersonMandateContainer.getPhyPersMandatorGivenName());
-            represented.setSurname(phyPersonMandateContainer.getPhyPersMandatorFamilyName());
-            represented.setDateOfBirth(phyPersonMandateContainer.getPhyPersMandatorBirthDate());
-        }
-
-        Logger.debug("Complex attribute extracted: " + sourceAttribute.getName());
-
-        return represented;
-    }
-
-
-    private MandateContentType getMandateContent(MandateContainer mandateContainer, PersonalAttribute sourceAttribute) throws MOAIDException {
-        MandateContentType mandateContent = new MandateContentType();
-        try {
-            XMLGregorianCalendar validFrom = DatatypeFactory.newInstance().newXMLGregorianCalendar(mandateContainer.getMandateValidFrom());
-            XMLGregorianCalendar validTo = DatatypeFactory.newInstance().newXMLGregorianCalendar(mandateContainer.getMandateValidTo());
-            TimeRestrictionType timeRestriction = new TimeRestrictionType();
-            timeRestriction.setValidFrom(validFrom);
-            timeRestriction.setValidTo(validTo);
-            mandateContent.setTimeRestriction(timeRestriction);
-        } catch (DatatypeConfigurationException dte) {
-            Logger.error("Error converting date from mandate: " + mandateContainer.getMandateValidFrom() + ", " + mandateContainer.getMandateValidTo());
-            throw new MOAIDException("stork.20", new Object[]{});
-        }
-        mandateContent.setAQAA(this.QAALevel);
-        mandateContent.setOriginalMandate(originalContent);
-        mandateContent.setOriginalMandateType("application/xml");
-        TransactionLimitRestrictionType transactionLimit = new TransactionLimitRestrictionType();
-        mandateContent.setTransactionLimit(transactionLimit);
-        mandateContent.setIsJoint("");
-        mandateContent.setIsChained(false);
-        mandateContent.setTypeOfPower(mapPowersType(mandateContainer));     // TODO check
-        Logger.debug("Complex attribute extracted: " + sourceAttribute.getName());
-        return mandateContent;
-    }
-
-    public boolean needAuthentication(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp) {
-        return true;
-    }
-
-    public String getDefaultActionName() {
-        return STORKProtocol.MANDATERETRIEVALREQUEST;
-    }
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/PhyPersonMandateContainer.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/PhyPersonMandateContainer.java
deleted file mode 100644
index c715b65eb..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/PhyPersonMandateContainer.java
+++ /dev/null
@@ -1,132 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2;
-
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.logging.Logger;
-import org.xml.sax.InputSource;
-
-import javax.xml.xpath.XPathExpressionException;
-import java.io.StringReader;
-
-/**
- * Physical person representing physical person
- * @author bsuzic
- *         Date: 4/30/14, Time: 11:29 AM
- */
-public class PhyPersonMandateContainer extends MandateContainer {
-
-    private String phyPersMandatorIdentificationValue = null;
-    private String phyPersMandatorIdentificationType = null;
-    private String phyPersMandatorGivenName = null;
-    private String phyPersMandatorFamilyName = null;
-    private String phyPersMandatorBirthDate = null;
-
-    String localMethods[] = new String[]{"getPhyPersMandatorGivenName", "getPhyPersMandatorFamilyName", "getPhyPersMandatorBirthDate", "getPhyPersMandatorIdentificationValue",
-            "getPhyPersMandatorIdentificationType", "getMandateIssuePlace", "getMandateIssueDate", "getMandateIssueTime", "getSimpleMandateContent", "getMandateValidFrom",
-            "getMandateValidTo", "getPhysicalRepresentativeIdentificationValue", "getPhysicalRepresentativeIdentificationType", "getAnnotation",
-            "getPhysicalRepresentativeGivenName", "getPhysicalRepresentativeFamilyName", "getPhysicalRepresentativeBirthDate"
-    };
-
-
-    public PhyPersonMandateContainer(String mandate) throws XPathExpressionException, MOAIDException {
-        super(mandate);
-
-        setAnnotation(xPath.evaluate(S2Constants.MANDATE_ANNOTATION_QUERY, new InputSource(new StringReader(mandate))));
-        setPhyPersMandatorIdentificationType(xPath.evaluate(S2Constants.MANDATE_MANDATOR_PHYPERS_IDTYPE_QUERY, new InputSource(new StringReader(mandate))));
-        setPhyPersMandatorIdentificationValue(xPath.evaluate(S2Constants.MANDATE_MANDATOR_PHYPERS_IDVALUE_QUERY, new InputSource(new StringReader(mandate))));
-        setPhyPersMandatorGivenName(xPath.evaluate(S2Constants.MANDATE_MANDATOR_PHYPERS_GIVENNAME_QUERY, new InputSource(new StringReader(mandate))));
-        setPhyPersMandatorFamilyName(xPath.evaluate(S2Constants.MANDATE_MANDATOR_PHYPERS_FAMILYNAME_QUERY, new InputSource(new StringReader(mandate))));
-        setPhyPersMandatorBirthDate(xPath.evaluate(S2Constants.MANDATE_MANDATOR_PHYPERS_DATEOFBIRTH_QUERY, new InputSource(new StringReader(mandate))));
-        setMandateIssueDate(xPath.evaluate(S2Constants.MANDATE_ISSUEDDATE_QUERY, new InputSource(new StringReader(mandate))));
-        setMandateIssuePlace(xPath.evaluate(S2Constants.MANDATE_ISSUEDPLACE_QUERY, new InputSource(new StringReader(mandate))));
-        setMandateIssueTime(xPath.evaluate(S2Constants.MANDATE_ISSUEDTIME_QUERY, new InputSource(new StringReader(mandate))));
-        setMandateValidFrom(xPath.evaluate(S2Constants.MANDATE_SIMPLEMANDATECONTENT_VALIDFROM_QUERY, new InputSource(new StringReader(mandate))));
-        setMandateValidTo(xPath.evaluate(S2Constants.MANDATE_SIMPLEMANDATECONTENT_VALIDTO_QUERY, new InputSource(new StringReader(mandate))));
-        setPhysicalRepresentativeBirthDate(xPath.evaluate(S2Constants.MANDATE_REPRESENTATIVE_PHYPERS_DATEOFBIRTH_QUERY, new InputSource(new StringReader(mandate))));
-        setPhysicalRepresentativeFamilyName(xPath.evaluate(S2Constants.MANDATE_REPRESENTATIVE_PHYPERS_FAMILYNAME_QUERY, new InputSource(new StringReader(mandate))));
-        setPhysicalRepresentativeGivenName(xPath.evaluate(S2Constants.MANDATE_REPRESENTATIVE_PHYPERS_GIVENNAME_QUERY, new InputSource(new StringReader(mandate))));
-        setPhysicalRepresentativeIdentificationType(xPath.evaluate(S2Constants.MANDATE_REPRESENTATIVE_PHYPERS_IDTYPE_QUERY, new InputSource(new StringReader(mandate))));
-        setPhysicalRepresentativeIdentificationValue(xPath.evaluate(S2Constants.MANDATE_REPRESENTATIVE_PHYPERS_IDVALUE_QUERY, new InputSource(new StringReader(mandate))));
-        setSimpleMandateContent(xPath.evaluate(S2Constants.MANDATE_SIMPLEMANDATECONTENT_TXTDESC_QUERY, new InputSource(new StringReader(mandate))));
-
-        // check if all necessary fields are present
-        Logger.debug("Starting mandate structure validation");
-        try {
-            validateMandateStructure(localMethods); // TODO
-        } catch (Exception e) {
-            if (e instanceof MOAIDException)  {
-                Logger.error("Could not validate mandate structure.");
-                throw new MOAIDException("stork.16", new Object[] {e.getMessage()}); // TODO
-            } else {
-                Logger.error("Error during mandate structure validation.");
-                throw new MOAIDException("stork.16", new Object[] {e.getMessage()}); // TODO
-            }
-
-        }
-    }
-
-
-
-    public String getPhyPersMandatorGivenName() {
-        return phyPersMandatorGivenName;
-    }
-
-    public void setPhyPersMandatorGivenName(String phyPersMandatorGivenName) {
-        this.phyPersMandatorGivenName = phyPersMandatorGivenName;
-    }
-
-    public String getPhyPersMandatorFamilyName() {
-        return phyPersMandatorFamilyName;
-    }
-
-    public void setPhyPersMandatorFamilyName(String phyPersMandatorFamilyName) {
-        this.phyPersMandatorFamilyName = phyPersMandatorFamilyName;
-    }
-
-    public String getPhyPersMandatorBirthDate() {
-        return phyPersMandatorBirthDate;
-    }
-
-    public void setPhyPersMandatorBirthDate(String phyPersMandatorBirthDate) {
-        // making it conform to STORK dateOfBirth specifications, removing dash
-        this.phyPersMandatorBirthDate = phyPersMandatorBirthDate.replaceAll("-","");
-    }
-
-    public String getPhyPersMandatorIdentificationValue() {
-        return phyPersMandatorIdentificationValue;
-    }
-
-    public void setPhyPersMandatorIdentificationValue(String phyPersMandatorIdentificationValue) {
-        this.phyPersMandatorIdentificationValue = phyPersMandatorIdentificationValue;
-    }
-
-    public String getPhyPersMandatorIdentificationType() {
-        return phyPersMandatorIdentificationType;
-    }
-
-    public void setPhyPersMandatorIdentificationType(String phyPersMandatorIdentificationType) {
-        this.phyPersMandatorIdentificationType = phyPersMandatorIdentificationType;
-    }
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/S2Constants.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/S2Constants.java
deleted file mode 100644
index a560bdaff..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/S2Constants.java
+++ /dev/null
@@ -1,66 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2;
-
-/**
- * @author bsuzic
- *         Date: 4/29/14, Time: 5:34 PM
- */
-public interface S2Constants {
-    public static final String MANDATE_PREFIX = "mandate";
-    public static final String PERSONDATA_PREFIX = "persondata";
-    public static final String XMLDSIG_PREFIX = "xmldsig";
-
-    public static final String MANDATE_NS = "http://reference.e-government.gv.at/namespace/mandates/20040701#";
-    public static final String PERSONDATA_NS = "http://reference.e-government.gv.at/namespace/persondata/20020228#";
-    public static final String XMLDSIG_NS = "http://www.w3.org/2000/09/xmldsig#";
-
-    public static final String MANDATE_ANNOTATION_QUERY = "/mandate:Mandate/mandate:Annotation/text()";
-    public static final String MANDATE_REPRESENTATIVE_PHYPERS_IDVALUE_QUERY = "/mandate:Mandate/mandate:Representative/persondata:PhysicalPerson/persondata:Identification/persondata:Value/text()";
-    public static final String MANDATE_REPRESENTATIVE_PHYPERS_IDTYPE_QUERY = "/mandate:Mandate/mandate:Representative/persondata:PhysicalPerson/persondata:Identification/persondata:Type/text()";
-    public static final String MANDATE_REPRESENTATIVE_PHYPERS_GIVENNAME_QUERY = "/mandate:Mandate/mandate:Representative/persondata:PhysicalPerson/persondata:Name/persondata:GivenName/text()";
-    public static final String MANDATE_REPRESENTATIVE_PHYPERS_FAMILYNAME_QUERY = "/mandate:Mandate/mandate:Representative/persondata:PhysicalPerson/persondata:Name/persondata:FamilyName/text()";
-    public static final String MANDATE_REPRESENTATIVE_PHYPERS_DATEOFBIRTH_QUERY = "/mandate:Mandate/mandate:Representative/persondata:PhysicalPerson/persondata:DateOfBirth/text()";
-    public static final String MANDATE_MANDATOR_CORPBODY_IDVALUE_QUERY = "/mandate:Mandate/mandate:Mandator/persondata:CorporateBody/persondata:Identification/persondata:Value/text()";
-    public static final String MANDATE_MANDATOR_CORPBODY_IDTYPE_QUERY = "/mandate:Mandate/mandate:Mandator/persondata:CorporateBody/persondata:Identification/persondata:Type/text()";
-    public static final String MANDATE_MANDATOR_CORPBODY_FULLNAME_QUERY = "/mandate:Mandate/mandate:Mandator/persondata:CorporateBody/persondata:FullName/text()";
-    public static final String MANDATE_ISSUEDPLACE_QUERY = "/mandate:Mandate/mandate:Issued/mandate:Place/text()";
-    public static final String MANDATE_ISSUEDDATE_QUERY = "/mandate:Mandate/mandate:Issued/mandate:Date/text()";
-    public static final String MANDATE_ISSUEDTIME_QUERY = "/mandate:Mandate/mandate:Issued/mandate:Time/text()";
-    public static final String MANDATE_SIMPLEMANDATECONTENT_TXTDESC_QUERY = "/mandate:Mandate/mandate:SimpleMandateContent/mandate:TextualDescription/text()";
-    public static final String MANDATE_SIMPLEMANDATECONTENT_VALIDFROM_QUERY = "/mandate:Mandate/mandate:SimpleMandateContent/mandate:TimeConstraint/mandate:ValidFrom/text()";
-    public static final String MANDATE_SIMPLEMANDATECONTENT_VALIDTO_QUERY = "/mandate:Mandate/mandate:SimpleMandateContent/mandate:TimeConstraint/mandate:ValidTo/text()";
-
-    public static final String MANDATE_MANDATOR_PHYPERS_IDVALUE_QUERY = "/mandate:Mandate/mandate:Mandator/persondata:PhysicalPerson/persondata:Identification/persondata:Value/text()";
-    public static final String MANDATE_MANDATOR_PHYPERS_IDTYPE_QUERY = "/mandate:Mandate/mandate:Mandator/persondata:PhysicalPerson/persondata:Identification/persondata:Type/text()";
-    public static final String MANDATE_MANDATOR_PHYPERS_GIVENNAME_QUERY = "/mandate:Mandate/mandate:Mandator/persondata:PhysicalPerson/persondata:Name/persondata:GivenName/text()";
-    public static final String MANDATE_MANDATOR_PHYPERS_FAMILYNAME_QUERY = "/mandate:Mandate/mandate:Mandator/persondata:PhysicalPerson/persondata:Name/persondata:FamilyName/text()";
-    public static final String MANDATE_MANDATOR_PHYPERS_DATEOFBIRTH_QUERY = "/mandate:Mandate/mandate:Mandator/persondata:PhysicalPerson/persondata:DateOfBirth/text()";
-
-    public static final String IDENTIFICATION_TYPE_COMPANY = "urn:publicid:gv.at:baseid+XFN";
-    public static final String IDENTIFICATION_TYPE_ASSOCIATION = "urn:publicid:gv.at:baseid+XZVR";
-    public static final String IDENTIFICATION_TYPE_OTHERS = "urn:publicid:gv.at:baseid+XERSB";
-
-
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/STORKProtocol.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/STORKProtocol.java
deleted file mode 100644
index c4f9658e4..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/STORKProtocol.java
+++ /dev/null
@@ -1,233 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2;
-
-import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
-import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.moduls.IAction;
-import at.gv.egovernment.moa.id.moduls.IModulInfo;
-import at.gv.egovernment.moa.id.moduls.IRequest;
-import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.MiscUtil;
-import eu.stork.peps.auth.commons.*;
-import eu.stork.peps.auth.engine.STORKSAMLEngine;
-import eu.stork.peps.exceptions.STORKSAMLEngineException;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import java.util.HashMap;
-
-/**
- * Stork 2 Protocol Support
- *
- * @author bsuzic
- */
-public class STORKProtocol extends MOAIDAuthConstants implements IModulInfo {
-
-    public static final String NAME = STORKProtocol.class.getName();
-    public static final String PATH = "id_stork2";
-
-    public static final String AUTHENTICATIONREQUEST = "AuthenticationRequest";
-    public static final String ATTRIBUTE_COLLECTOR = "AttributeCollector";
-    public static final String MANDATERETRIEVALREQUEST = "MandateRetrievalRequest";
-    public static final String CONSENT_EVALUATOR = "ConsentEvaluator";
-
-    private static HashMap<String, IAction> actions = new HashMap<String, IAction>();
-
-    static {
-        actions.put(AUTHENTICATIONREQUEST, new AuthenticationRequest());
-        actions.put(ATTRIBUTE_COLLECTOR, new AttributeCollector());
-        actions.put(CONSENT_EVALUATOR, new ConsentEvaluator());
-        actions.put(MANDATERETRIEVALREQUEST, new MandateRetrievalRequest());
-    }
-
-    public String getName() {
-        return NAME;
-    }
-
-    public String getPath() {
-        return PATH;
-    }
-
-    public IAction getAction(String action) {
-        return actions.get(action);
-    }
-
-    public STORKProtocol() {
-        super();
-    }
-
-    /*
-        First request step - send it to BKU selection for user authentication. After the user credentials
-        and other info are obtained, in the second step the request will be processed and the user redirected
-         */
-    public IRequest preProcess(HttpServletRequest request, HttpServletResponse response, String action,
-			String sessionId, String transactionId) throws MOAIDException {
-        Logger.info("Starting preprocessing for Stork2 protocol");
-        Logger.debug("Request method: " + request.getMethod());
-        Logger.debug("Request content length: " + request.getContentLength());
-        Logger.debug("Initiating action: " + action);
-
-        MOASTORKRequest STORK2Request = new MOASTORKRequest(request);
-        MOASTORKResponse STORK2Response = new MOASTORKResponse(request);
-
-
-        if (AttributeCollector.class.getSimpleName().equals(action) || ConsentEvaluator.class.getSimpleName().equals(action))
-            return STORK2Request;
-
-
-        if (request.getParameter("SAMLResponse") != null) {        // TODO check attribute collector
-            //extract STORK Response from HTTP Request
-            byte[] decSamlToken;
-            try {
-                decSamlToken = PEPSUtil.decodeSAMLToken(request.getParameter("SAMLResponse"));
-            } catch (NullPointerException e) {
-                if (request.getRemoteHost().contains("129.27.142")) {
-                    Logger.warn("Availability check by " + request.getRemoteHost() + " on URI: " + request.getRequestURI());
-                } else {
-                    Logger.error("Unable to retrieve STORK Request for host: " + request.getRemoteHost() + " and URI: " + request.getRequestURI(), e);
-                }
-                throw new MOAIDException("stork.04", null);
-            }
-
-            //Get SAMLEngine instance
-            STORKSAMLEngine engine = STORKSAMLEngine.getInstance("VIDP");
-
-            STORKAuthnResponse authnResponse = null;
-
-
-            // check if valid authn request is contained
-            try {
-                authnResponse = engine.validateSTORKAuthnResponse(decSamlToken, request.getRemoteAddr());
-            } catch (STORKSAMLEngineException ex) {
-                Logger.error("Unable to validate Stork AuthenticationResponse: " + ex.getMessage());
-            }
-
-            STORK2Response.setSTORKAuthnResponseToken(decSamlToken);
-
-            return STORK2Response;
-
-        } else if (request.getParameter("SAMLRequest") != null) {
-
-            //extract STORK Response from HTTP Request
-            byte[] decSamlToken;
-            try {
-                decSamlToken = PEPSUtil.decodeSAMLToken(request.getParameter("SAMLRequest"));
-            } catch (NullPointerException e) {
-                if (request.getRemoteHost().contains("129.27.142")) {
-                    Logger.warn("Availability check by " + request.getRemoteHost() + " on URI: " + request.getRequestURI());
-                } else {
-                    Logger.error("Unable to retrieve STORK Request for host: " + request.getRemoteHost() + " and URI: " + request.getRequestURI(), e);
-                }
-                throw new MOAIDException("stork.04", null);
-            }
-
-            //Get SAMLEngine instance
-            STORKSAMLEngine engine = STORKSAMLEngine.getInstance("VIDP");
-
-            STORKAuthnRequest authnRequest = null;
-            STORKAttrQueryRequest attrRequest = null;
-            
-            // check if valid authn request is contained
-            try {
-                authnRequest = engine.validateSTORKAuthnRequest(decSamlToken);
-                
-            } catch (STORKSAMLEngineException ex) {
-                Logger.error("Unable to validate Stork AuthenticationRequest: " + ex.getMessage());
-                
-            } catch (ClassCastException e) {
-                // we do not have a authnRequest
-                // check if a valid attr request is container
-                try {
-                    attrRequest = engine.validateSTORKAttrQueryRequest(decSamlToken);
-                    
-                } catch (STORKSAMLEngineException ex) {
-                    Logger.error("Unable to validate Stork AuthenticationRequest: " + ex.getMessage());
-                    
-                }
-            }
-
-            // if there is no authn or attr request, raise error
-            if ((authnRequest == null) && (attrRequest == null)) {
-                Logger.error("There is no authentication or attribute request contained.");
-                throw new MOAIDException("stork.14", null);
-            }
-            // list attributes in the request
-            try {
-                for (PersonalAttribute personalAttribute : authnRequest.getPersonalAttributeList()) {
-                    Logger.debug("Personal attribute found in request: " + personalAttribute.getName() + " isRequired: " + personalAttribute.isRequired());
-                }
-            } catch (Exception e) {
-                Logger.error("Exception, attributes: " + e.getMessage());
-            }
-
-            STORK2Request.setSTORKAuthnRequest(authnRequest);
-            STORK2Request.setSTORKAttrRequest(attrRequest);
-            
-            //check if OA is instance of VIDP or STORKPVPGateway
-            OAAuthParameter oaParam = AuthConfigurationProviderFactory.getInstance().getOnlineApplicationParameter(STORK2Request.getOAURL());
-            if (oaParam == null)
-                throw new AuthenticationException("stork.12", new Object[]{STORK2Request.getOAURL()});
-            
-            else {
-            	STORK2Request.setOnlineApplicationConfiguration(oaParam);            	
-            	if (oaParam.isSTORKPVPGateway()) {
-            		if (MiscUtil.isNotEmpty(oaParam.getSTORKPVPForwardEntity())) {
-            			Logger.info("Received request for STORK->PVP gateway. " +
-            					"Forward to PVP portal with entiyID " + oaParam.getSTORKPVPForwardEntity() +
-            					" ..." );
-            			STORK2Request.setRequestedIDP(oaParam.getSTORKPVPForwardEntity());
-            			
-            		} else {
-            			Logger.error("InterfederatedGateway configuration with ID " + STORK2Request.getOAURL() +
-            					" not configure a forward entityID.");
-            			throw new MOAIDException("", null);
-            			
-            		}
-            	}
-            	
-            }
-            
-            return STORK2Request;
-        } else {
-            throw new MOAIDException("stork.14", null);  // TODO Specify message
-        }
-    }
-
-    public IAction canHandleRequest(HttpServletRequest request, HttpServletResponse response) {
-        return null;
-    }
-
-    public boolean generateErrorMessage(Throwable e, HttpServletRequest request, HttpServletResponse response, IRequest protocolRequest) throws Throwable {
-        return false;
-    }
-
-    public boolean validate(HttpServletRequest request, HttpServletResponse response, IRequest pending) {
-        return false;
-    }
-}
-
-
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/AttributeProvider.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/AttributeProvider.java
deleted file mode 100644
index aaf13a779..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/AttributeProvider.java
+++ /dev/null
@@ -1,139 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2.attributeproviders;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.stork2.ExternalAttributeRequestRequiredException;
-import at.gv.egovernment.moa.id.protocols.stork2.MOASTORKRequest;
-import at.gv.egovernment.moa.id.protocols.stork2.UnsupportedAttributeException;
-import eu.stork.peps.auth.commons.IPersonalAttributeList;
-import eu.stork.peps.auth.commons.PersonalAttribute;
-
-/**
- * An {@link AttributeProvider} can fetch a set of stork attributes. It might complete the query within one method call,
- * but might also need to redirect to another webservice to accomplish its task.
- */
-public abstract class AttributeProvider implements Comparable<AttributeProvider>{
-
-	protected String attributes;
-	
-	public AttributeProvider(String attributes){
-		this.attributes = attributes;
-	}
-	
-	/**
-	 * Acquire the specified attribute. Returns {@code null} when attribute retrieval is in progress, but requires for
-	 * for redirecting the user to an external service. Use {@link AttributeProvider#parse(HttpServletRequest)} to parse
-	 * the response.
-	 *
-	 * @param currentProviderConfiguredAttributes the list of attributes to be acquired
-	 * @param moastorkRequest the sp county code
-	 * @param authData the moasession
-	 * @return the personal attribute
-	 * @throws UnsupportedAttributeException the unsupported attribute exception
-	 * @throws ExternalAttributeRequestRequiredException an attribute request to an external service has to be done
-	 * @throws MOAIDException the mOAID exception
-	 */
-	protected abstract IPersonalAttributeList acquire(PersonalAttribute currentProviderConfiguredAttributes, MOASTORKRequest moastorkRequest, IAuthData authData) throws UnsupportedAttributeException, ExternalAttributeRequestRequiredException, MOAIDException;
-
-    public IPersonalAttributeList acquire(List<PersonalAttribute> attributes, MOASTORKRequest moastorkRequest, IAuthData authData) throws UnsupportedAttributeException, ExternalAttributeRequestRequiredException, MOAIDException {
-        if (attributes.size() == 1) {
-            return acquire(attributes.get(0), moastorkRequest, authData);
-        } else {
-            throw new MOAIDException("stork.13", new Object[] {  });  // TODO message only one attribute supported by this provider
-
-        }
-    }
-
-    /**
-	 * Perform redirect.
-	 *
-	 * @param url the return URL ending with ?artifactId=...
-	 * @param req the request we got from the S-PEPS and for which we have to ask our APs
-	 * @param resp the response to the preceding request
-	 * @param oaParam the oa param
-	 * @throws MOAIDException the mOAID exception
-	 */
-	public abstract void performRedirect(String url, HttpServletRequest req, HttpServletResponse resp, OAAuthParameter oaParam) throws MOAIDException;
-	
-	/**
-	 * Parses the response we got from the external attribute provider.
-	 *
-	 * @param httpReq the http req
-	 * @return a list of attributes
-	 * @throws UnsupportedAttributeException if the provider cannot find anything familiar in the provided httpReq
-	 * @throws MOAIDException if something went wrong
-	 */
-	public abstract IPersonalAttributeList parse(HttpServletRequest httpReq) throws UnsupportedAttributeException, MOAIDException;
-
-    /**
-     * Returns the list of supported attributes
-     *
-     * @return a list of attributes
-     * @throws MOAIDException if something went wrong
-     */
-    public List<String> getSupportedAttributeNames() throws MOAIDException {
-        ArrayList<String> supportedAttributeNames = new ArrayList<String>();
-        for (String attributeName : this.attributes.split(",")) {
-            supportedAttributeNames.add(attributeName);
-        }
-        return supportedAttributeNames;
-    }
-
-    
-    /**
-     * Returns the sequence priority of this attribute provider.
-     * Providers with small numbers are requested first. 
-     * 
-     * @return a sequence priority of this provider
-     */
-    public abstract int getPriority();
- 
-    /**
-     * Compare the sequence priority of two attribute providers 
-     * @param o attribute provider
-     * @return 0 if priority is equal
-     * @return -1 if priority if this is higher then from o
-     * @return +1 if priority if o is higher then from this
-     */
-	@Override
-	public int compareTo(AttributeProvider o) {
-    	if (this.getPriority() == o.getPriority())
-    		return 0;
-    	
-    	if (this.getPriority() < o.getPriority())
-    		return -1;
-    	
-    	else
-    		return +1;
-	}
-    
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/EHvdAttributeProviderPlugin.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/EHvdAttributeProviderPlugin.java
deleted file mode 100644
index bd1576020..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/EHvdAttributeProviderPlugin.java
+++ /dev/null
@@ -1,254 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2.attributeproviders;
-
-import java.io.StringWriter;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.Iterator;
-import java.util.Map;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.xml.bind.JAXBContext;
-import javax.xml.bind.Marshaller;
-import javax.xml.soap.MessageFactory;
-import javax.xml.soap.SOAPBody;
-import javax.xml.soap.SOAPConnection;
-import javax.xml.soap.SOAPConnectionFactory;
-import javax.xml.soap.SOAPElement;
-import javax.xml.soap.SOAPEnvelope;
-import javax.xml.soap.SOAPMessage;
-import javax.xml.soap.SOAPPart;
-
-import at.gv.egovernment.moa.id.auth.builder.BPKBuilder;
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.stork2.ExternalAttributeRequestRequiredException;
-import at.gv.egovernment.moa.id.protocols.stork2.MOASTORKRequest;
-import at.gv.egovernment.moa.id.protocols.stork2.UnsupportedAttributeException;
-import at.gv.egovernment.moa.logging.Logger;
-import eu.stork.peps.auth.commons.IPersonalAttributeList;
-import eu.stork.peps.auth.commons.PersonalAttribute;
-import eu.stork.peps.auth.commons.PersonalAttributeList;
-import eu.stork.peps.complex.attributes.eu.stork.names.tc.stork._1_0.assertion.AttributeStatusType;
-import eu.stork.peps.complex.attributes.eu.stork.names.tc.stork._1_0.assertion.IsHealthCareProfessionalType;
-import eu.stork.peps.complex.attributes.eu.stork.names.tc.stork._1_0.assertion.ObjectFactory;
-
-/**
- * Fetches the attribute IsHealthcareProfessional from the BAGDAD SOAP service
- */
-public class EHvdAttributeProviderPlugin extends AttributeProvider {
-	
-	/** The destination. */
-	private Object destination;
-	
-	/**
-	 * Instantiates a new e hvd attribute provider plugin.
-	 *
-	 * @param url the service url
-	 * @param supportedAttributes
-	 */
-	public EHvdAttributeProviderPlugin(String url, String supportedAttributes) {
-		super(supportedAttributes);
-		destination = url;
-	}
-
-	/* (non-Javadoc)
-	 * @see at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#acquire(eu.stork.peps.auth.commons.PersonalAttribute)
-	 */
-	@Override
-	protected IPersonalAttributeList acquire(PersonalAttribute attribute, MOASTORKRequest moastorkRequest, IAuthData authData)
-			throws UnsupportedAttributeException,
-			ExternalAttributeRequestRequiredException, MOAIDException {
-
-		// break when we cannot handle the requested attribute
-		if(!attributes.contains(attribute.getName()))
-			throw new UnsupportedAttributeException();
-		
-		try {
-	    	Logger.debug("initializing SOAP connections...");
-			// create SOAP connection
-			SOAPConnection soapConnection = SOAPConnectionFactory.newInstance().createConnection();
-			
-			// assemble SOAP request
-			MessageFactory messageFactory = MessageFactory.newInstance();
-			SOAPMessage requestMessage = messageFactory.createMessage();
-			SOAPPart requestPart = requestMessage.getSOAPPart();
-
-			// (soap 1.1 relevant part. could not find a solution to use soap 1.2 in time.
-			requestMessage.getMimeHeaders().setHeader("SOAPAction", "http://gesundheit.gv.at/BAGDAD/DataAccessService/IsHealthcareProfessional");
-
-            /*
-            Construct SOAP Request Message:
-			<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
-			  <soap:Body>
-			    <IsHealthcareProfessional xmlns="http://gesundheit.gv.at/BAGDAD/DataAccessService">
-			      <bPK>string</bPK>
-			    </IsHealthcareProfessional>
-			  </soap:Body>
-			</soap:Envelope>
-
-			see https://stork.ehealth.gv.at/GDAService.asmx?op=IsHealthcareProfessional
-             */
-
-			// SOAP Envelope
-			SOAPEnvelope envelope = requestPart.getEnvelope();
-
-			// SOAP Body
-			SOAPBody requestBody = envelope.getBody();
-			SOAPElement requestBodyElem = requestBody.addChildElement("IsHealthcareProfessional");
-			requestBodyElem.addAttribute(envelope.createName("xmlns"), "http://gesundheit.gv.at/BAGDAD/DataAccessService");
-
-			SOAPElement requestBodyElem1 = requestBodyElem.addChildElement("bPK");
-			
-			//TODO: CHECK: IdentificationValue containts wbPK if MOA-ID is used as VIDP 
-			requestBodyElem1.addTextNode(new BPKBuilder().buildBPK(authData.getIdentificationValue(), "GH"));
-
-			requestMessage.saveChanges();
-
-			// perform SOAP call
-	    	Logger.debug("call...");
-			SOAPMessage responseMessage = soapConnection.call(requestMessage, destination);
-
-			// parse SOAP response
-
-            /*
-			<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
-			  <soap:Body>
-			    <IsHealthcareProfessionalResponse xmlns="http://gesundheit.gv.at/BAGDAD/DataAccessService">
-			      <IsHealthcareProfessionalResult>
-			        <RequestOK>boolean</RequestOK>
-			        <Message>string</Message>
-			        <IsHealthcareProfessional>boolean</IsHealthcareProfessional>
-			        <NameOfOrganisation>string</NameOfOrganisation>
-			        <Type>string</Type>
-			        <Specialization>string</Specialization>
-			      </IsHealthcareProfessionalResult>
-			    </IsHealthcareProfessionalResponse>
-			  </soap:Body>
-			</soap:Envelope>
-
-			see https://stork.ehealth.gv.at/GDAService.asmx?op=IsHealthcareProfessional
-             */
-	    	Logger.debug("call successful. Parse...");
-			SOAPBody responseBody = responseMessage.getSOAPBody();
-
-			// iterate through tree
-			SOAPElement responseElement = (SOAPElement) responseBody.getChildElements().next();
-			SOAPElement resultElement = (SOAPElement) responseElement.getChildElements().next();
-
-			// collect all info in a map
-			Iterator<?> it = resultElement.getChildElements();
-			Map<String, String> collection = new HashMap<String, String>();
-			while (it.hasNext()) {
-				SOAPElement current = (SOAPElement) it.next();
-
-				collection.put(current.getNodeName(), current.getTextContent());
-			}
-
-			// check if there is anything valid in the map
-			if (collection.isEmpty() || collection.size() != 6) {
-				Logger.warn("eHVD returned an unexpected count of values. Expected 6 got " + collection.size());
-				throw new IndexOutOfBoundsException("response attributes not like specified");
-			}
-
-			// - fetch request validity
-			if (collection.get("RequestOK").equals("false")) {
-				Logger.warn("eHVD reported an invalid request. The error message is: " + collection.get("Message"));
-				throw new Exception("eHVD reported an invalid request");
-			}
-
-			PersonalAttribute acquiredAttribute = null;
-
-			if (collection.get("IsHealthcareProfessional").equals("false") || !collection.get("Type").equals("Medical doctor")) {
-				// the citizen is no HCP
-				acquiredAttribute = new PersonalAttribute("isHealthCareProfessional", false, new ArrayList<String>(), AttributeStatusType.NOT_AVAILABLE.value());
-			} else {
-				// go on and parse the data
-				IsHealthCareProfessionalType result = new IsHealthCareProfessionalType();
-
-				// TODO: we do not have any list of possible values yet. Fix as soon as we get some.
-//				if (collection.get("Type").equals("Medical doctor"))
-					result.setTypeOfHCP("physician");
-
-				result.setNameOfOrganisation(collection.get("NameOfOrganisation"));
-				//result.setTypeOfOrganisation("Unknown"); // TODO used in previous version, check what to do with this
-
-				result.setAQAA(4);
-
-				final Marshaller m = JAXBContext.newInstance(IsHealthCareProfessionalType.class).createMarshaller();
-			    m.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, true);
-			    
-			    StringWriter stringWriter = new StringWriter();
-			    m.marshal(new ObjectFactory().createIsHealthCareProfessional(result), stringWriter);		    
-				
-				ArrayList<String> value = new ArrayList<String>();
-				value.add(stringWriter.toString());
-
-				acquiredAttribute = new PersonalAttribute("isHealthCareProfessional", false, value, AttributeStatusType.AVAILABLE.value());
-			}
-
-			// pack and return the result
-			PersonalAttributeList result = new PersonalAttributeList();
-			result.add(acquiredAttribute);
-
-			// add stork id for verification
-			ArrayList<String> value = new ArrayList<String>();
-			value.add(new BPKBuilder().buildStorkeIdentifier(authData.getIdentityLink(), moastorkRequest.getSpCountry()));
-			result.add(new PersonalAttribute("eIdentifier", false, value, AttributeStatusType.AVAILABLE.value()));
-
-			return result;
-		} catch (Exception e) {
-			throw new MOAIDException("stork.13", new Object[] { e });
-		}
-	}
-
-    /* (non-Javadoc)
-     * @see at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#performRedirect(java.lang.String, java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, at.gv.egovernment.moa.id.config.auth.OAAuthParameter)
-     */
-	public void performRedirect(String url,
-			HttpServletRequest req, HttpServletResponse resp,
-			OAAuthParameter oaParam) throws MOAIDException {
-		// there is no redirect required
-	}
-
-	/* (non-Javadoc)
-	 * @see at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#parse(javax.servlet.http.HttpServletRequest)
-	 */
-	public IPersonalAttributeList parse(HttpServletRequest httpReq)
-			throws UnsupportedAttributeException, MOAIDException {
-		// there is no redirect required, so we throw an exception when someone asks us to parse a response
-		throw new UnsupportedAttributeException();
-	}
-
-	/* (non-Javadoc)
-	 * @see at.gv.egovernment.moa.id.protocols.stork2.attributeproviders.AttributeProvider#getPriority()
-	 */
-	@Override
-	public int getPriority() {
-		return 99;
-	}
-
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/MandateAttributeRequestProvider.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/MandateAttributeRequestProvider.java
deleted file mode 100644
index f671f0807..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/MandateAttributeRequestProvider.java
+++ /dev/null
@@ -1,231 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2.attributeproviders;
-
-import java.io.StringWriter;
-import java.util.List;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import org.apache.velocity.Template;
-import org.apache.velocity.VelocityContext;
-import org.apache.velocity.app.VelocityEngine;
-
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.stork2.ExternalAttributeRequestRequiredException;
-import at.gv.egovernment.moa.id.protocols.stork2.MOASTORKRequest;
-import at.gv.egovernment.moa.id.protocols.stork2.UnsupportedAttributeException;
-import at.gv.egovernment.moa.id.util.HTTPUtils;
-import at.gv.egovernment.moa.id.util.VelocityProvider;
-import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.StringUtils;
-import eu.stork.peps.auth.commons.IPersonalAttributeList;
-import eu.stork.peps.auth.commons.PEPSUtil;
-import eu.stork.peps.auth.commons.PersonalAttribute;
-import eu.stork.peps.auth.commons.PersonalAttributeList;
-import eu.stork.peps.auth.commons.STORKAttrQueryRequest;
-import eu.stork.peps.auth.engine.STORKSAMLEngine;
-import eu.stork.peps.exceptions.STORKSAMLEngineException;
-
-/**
- * Provides mandate attribute from MIS
- */
-public class MandateAttributeRequestProvider extends AttributeProvider {
-    /**
-     * The destination.
-     */
-    private String destination;
-
-    private String spCountryCode;
-
-    private PersonalAttributeList requestedAttributes;
-
-    public MandateAttributeRequestProvider(String aPurl, String supportedAttributes) throws MOAIDException {
-    	super(supportedAttributes);
-        destination = aPurl;
-
-    }
-
-    public String getAttrProviderName() {
-        return "MandateAttributeRequestProvider";
-    }
-
-    // TODO check if used
-    @Override
-	protected IPersonalAttributeList acquire(PersonalAttribute attribute, MOASTORKRequest moastorkRequest, IAuthData authData) throws UnsupportedAttributeException, ExternalAttributeRequestRequiredException, MOAIDException {
-        Logger.info("Acquiring attribute: " + attribute.getName() + ", by: " + getAttrProviderName());
-        this.spCountryCode = moastorkRequest.getSpCountry();
-        requestedAttributes = new PersonalAttributeList(1);
-        requestedAttributes.add(attribute);
-
-        // break if we cannot handle the requested attribute
-        if (!attributes.contains(attribute.getName())) {
-            Logger.info("Attribute " + attribute.getName() + " not supported by the provider: " + getAttrProviderName());
-            throw new UnsupportedAttributeException();
-        }
-
-        // check if there is eIdentifier included and add if necessary
-//        if (!requestedAttributes.containsKey("eIdentifier")) {
-//            PersonalAttribute eIdentifier = new PersonalAttribute();
- //           eIdentifier.setName("eIdentifier");
-//            eIdentifier.setIsRequired(true);
-//            requestedAttributes.add(eIdentifier);
-//        }
-
-        Logger.info("Thrown external request by: " + getAttrProviderName());
-        throw new ExternalAttributeRequestRequiredException(this);
-    }
-
-    @Override
-    public IPersonalAttributeList acquire(List<PersonalAttribute> attributes, MOASTORKRequest moastorkRequest, IAuthData moasession) throws UnsupportedAttributeException, ExternalAttributeRequestRequiredException, MOAIDException {
-        Logger.info("Acquiring " + attributes.size() + "  attributes, by: " + getAttrProviderName());
-        this.spCountryCode = moastorkRequest.getSpCountry();
-        requestedAttributes = new PersonalAttributeList(attributes.size());
-
-        for (PersonalAttribute personalAttribute : attributes) {
-            // break if we cannot handle the requested attribute
-            if (!this.attributes.contains(personalAttribute.getName())) {
-                Logger.info("Attribute " + personalAttribute.getName() + " not supported by the provider: " + getAttrProviderName());
-                throw new UnsupportedAttributeException();
-            }
-            requestedAttributes.add(personalAttribute);
-        }
-
-        // continue with other attribute providers if there are no attributes current provider is able to handle
-        if (requestedAttributes.size() == 0) {
-            Logger.info("Attribute(s) " + attributes.toString() + " not supported by the provider: " + getAttrProviderName());
-            throw new UnsupportedAttributeException();
-        }
-
-
-
-        Logger.info("Thrown external request by: " + getAttrProviderName());
-        throw new ExternalAttributeRequestRequiredException(this);
-    }
-
-
-
-
-    public void performRedirect(String url, HttpServletRequest req, HttpServletResponse resp, OAAuthParameter oaParam) throws MOAIDException {
-
-        String spSector = "Business";
-        String spInstitution = StringUtils.isEmpty(oaParam.getFriendlyName()) ? "UNKNOWN" : oaParam.getFriendlyName();
-        String spApplication = spInstitution;
-
-        if ((spCountryCode == null) || (spCountryCode.length()<2)) {
-            spCountryCode = oaParam.getTarget();
-            Logger.info("Setting spcountry target: " + oaParam.getTarget());
-            Logger.info("idlink ident " + oaParam.getIdentityLinkDomainIdentifier());
-            Logger.info("idlink type " + oaParam.getIdentityLinkDomainIdentifierType());
-            Logger.info("Setting spcountry target friendly : " + oaParam.getTargetFriendlyName());
-            Logger.info("Oatype : " + oaParam.getOaType());
-            Logger.info("puburl : " + oaParam.getPublicURLPrefix());
-            if ("STORK".equals(oaParam.getIdentityLinkDomainIdentifierType())) {
-
-                spCountryCode =  oaParam.getIdentityLinkDomainIdentifier().substring(oaParam.getIdentityLinkDomainIdentifier().length()-2);
-                Logger.info("Set to " +spCountryCode);
-            }
-
-        }
-
-        // TODO ensure that other providers request eidentifier
-        // check if there is eIdentifier included and add if necessary
-        if (!requestedAttributes.containsKey("eIdentifier")) {
-            PersonalAttribute eIdentifier = new PersonalAttribute();
-            eIdentifier.setName("eIdentifier");
-            eIdentifier.setIsRequired(true);
-            requestedAttributes.add(eIdentifier);
-        }
-
-        //generate AttrQueryRequest
-        STORKAttrQueryRequest attributeRequest = new STORKAttrQueryRequest();
-        attributeRequest.setDestination(destination);
-        attributeRequest.setAssertionConsumerServiceURL(url);
-        attributeRequest.setIssuer(HTTPUtils.getBaseURL(req));
-        attributeRequest.setQaa(oaParam.getQaaLevel());
-        attributeRequest.setSpInstitution(spInstitution);
-        attributeRequest.setCountry(spCountryCode);
-        attributeRequest.setSpCountry(spCountryCode);
-        attributeRequest.setSpApplication(spApplication);
-        attributeRequest.setSpSector(spSector);
-        attributeRequest.setPersonalAttributeList(requestedAttributes);
-
-        attributeRequest.setCitizenCountryCode("AT");
-        attributeRequest.setQaa(oaParam.getQaaLevel());
-
-        if (attributeRequest.getQaa() == 0 )  {
-            attributeRequest.setQaa(4); // workaround
-        }
-
-
-
-        Logger.info("STORK AttrRequest successfully assembled.");
-
-        STORKSAMLEngine samlEngine = STORKSAMLEngine.getInstance("VIDP");
-        try {
-
-            attributeRequest = samlEngine.generateSTORKAttrQueryRequest(attributeRequest);
-        } catch (STORKSAMLEngineException e) {
-            Logger.error("Could not sign STORK SAML AttrRequest.", e);
-            throw new MOAIDException("stork.00", null);
-        }
-
-        Logger.info("STORK AttrRequest successfully signed!");
-
-        try {
-            Logger.trace("Initialize VelocityEngine...");
-
-            VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
-            Template template = velocityEngine.getTemplate("/resources/templates/saml2-post-binding-moa.vm");
-            VelocityContext context = new VelocityContext();
-            context.put("SAMLRequest", PEPSUtil.encodeSAMLToken(attributeRequest.getTokenSaml()));
-            context.put("action", destination);
-
-            StringWriter writer = new StringWriter();
-            template.merge(context, writer);
-
-            resp.getOutputStream().write(writer.toString().getBytes("UTF-8"));
-        } catch (Exception e) {
-            Logger.error("Error sending STORK SAML AttrRequest.", e);
-            throw new MOAIDException("stork.11", null);
-        }
-        Logger.info("STORK AttrRequest successfully rendered!");
-
-    }
-
-    public IPersonalAttributeList parse(HttpServletRequest httpReq) throws UnsupportedAttributeException, MOAIDException {
-        return null;  //
-    }
-
-	/* (non-Javadoc)
-	 * @see at.gv.egovernment.moa.id.protocols.stork2.attributeproviders.AttributeProvider#getPriority()
-	 */
-	@Override
-	public int getPriority() {
-		return 99;
-	}
-}
-
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/PVPAuthenticationProvider.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/PVPAuthenticationProvider.java
deleted file mode 100644
index 7f06c604b..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/PVPAuthenticationProvider.java
+++ /dev/null
@@ -1,238 +0,0 @@
-/*
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- */
-package at.gv.egovernment.moa.id.protocols.stork2.attributeproviders;
-
-import java.io.StringWriter;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import org.apache.velocity.Template;
-import org.apache.velocity.VelocityContext;
-import org.apache.velocity.app.VelocityEngine;
-
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.stork2.ExternalAttributeRequestRequiredException;
-import at.gv.egovernment.moa.id.protocols.stork2.MOASTORKRequest;
-import at.gv.egovernment.moa.id.protocols.stork2.UnsupportedAttributeException;
-import at.gv.egovernment.moa.id.util.HTTPUtils;
-import at.gv.egovernment.moa.id.util.VelocityProvider;
-import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.StringUtils;
-import eu.stork.peps.auth.commons.IPersonalAttributeList;
-import eu.stork.peps.auth.commons.PEPSUtil;
-import eu.stork.peps.auth.commons.PersonalAttribute;
-import eu.stork.peps.auth.commons.STORKAttrQueryRequest;
-import eu.stork.peps.auth.commons.STORKAttrQueryResponse;
-import eu.stork.peps.auth.commons.STORKAuthnRequest;
-import eu.stork.peps.auth.commons.STORKAuthnResponse;
-import eu.stork.peps.auth.engine.STORKSAMLEngine;
-import eu.stork.peps.exceptions.STORKSAMLEngineException;
-
-/**
- * @author tlenz
- *
- */
-public class PVPAuthenticationProvider extends AttributeProvider {
-
-	private String destination = null;
-	private MOASTORKRequest moastorkRequest = null;
-	
-	/**
-	 * @param attributes
-	 * @param attributes2 
-	 */
-	public PVPAuthenticationProvider(String url, String attributes) {
-		super(attributes);
-		this.destination = url;
-	}
-
-	/* (non-Javadoc)
-	 * @see at.gv.egovernment.moa.id.protocols.stork2.attributeproviders.AttributeProvider#acquire(eu.stork.peps.auth.commons.PersonalAttribute, java.lang.String, at.gv.egovernment.moa.id.data.IAuthData)
-	 */
-	@Override
-	protected IPersonalAttributeList acquire(PersonalAttribute attribute,
-			MOASTORKRequest moastorkRequest, IAuthData authData)
-			throws UnsupportedAttributeException,
-			ExternalAttributeRequestRequiredException, MOAIDException {
-		
-		this.moastorkRequest = moastorkRequest;
-        // break if we cannot handle the requested attribute
-        if (!getSupportedAttributeNames().contains(attribute.getName())) {
-            Logger.info("Attribute " + attribute.getName() + " not supported by the provider: " + getAttrProviderName());
-            throw new UnsupportedAttributeException();
-            
-        }
-                     
-        Logger.info("Thrown external request by: " + getAttrProviderName());
-        throw new ExternalAttributeRequestRequiredException(this);
-	}
-
-	/* (non-Javadoc)
-	 * @see at.gv.egovernment.moa.id.protocols.stork2.attributeproviders.AttributeProvider#performRedirect(java.lang.String, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, at.gv.egovernment.moa.id.config.auth.OAAuthParameter)
-	 */
-	@Override
-	public void performRedirect(String url, HttpServletRequest req,
-			HttpServletResponse resp, OAAuthParameter oaParam)
-			throws MOAIDException {
-		
-        String spSector = "Business";
-        String spInstitution = StringUtils.isEmpty(oaParam.getFriendlyName()) ? "UNKNOWN" : oaParam.getFriendlyName();
-        String spApplication = spInstitution;
-        String spCountryCode = moastorkRequest.getSpCountry();
-
-        if ((spCountryCode == null) || (spCountryCode.length()<2)) {
-            spCountryCode = oaParam.getTarget();
-            Logger.info("Setting spcountry target: " + oaParam.getTarget());
-            Logger.info("idlink ident " + oaParam.getIdentityLinkDomainIdentifier());
-            Logger.info("idlink type " + oaParam.getIdentityLinkDomainIdentifierType());
-            Logger.info("Setting spcountry target friendly : " + oaParam.getTargetFriendlyName());
-            Logger.info("Oatype : " + oaParam.getOaType());
-            Logger.info("puburl : " + oaParam.getPublicURLPrefix());
-            if ("STORK".equals(oaParam.getIdentityLinkDomainIdentifierType())) {
-
-                spCountryCode =  oaParam.getIdentityLinkDomainIdentifier().substring(oaParam.getIdentityLinkDomainIdentifier().length()-2);
-                Logger.info("Set to " +spCountryCode);
-            }
-
-        }
-		
-        //generate AttrQueryRequest
-        STORKAuthnRequest authRequest = new STORKAuthnRequest();
-        authRequest.setDestination(destination);
-        authRequest.setAssertionConsumerServiceURL(url);
-        authRequest.setIssuer(HTTPUtils.getBaseURL(req));
-        authRequest.setQaa(oaParam.getQaaLevel());
-        authRequest.setSpInstitution(spInstitution);
-        authRequest.setCountry(spCountryCode);
-        authRequest.setSpCountry(spCountryCode);
-        authRequest.setSpApplication(spApplication);
-        authRequest.setProviderName(spApplication);
-        authRequest.setSpSector(spSector);               
-        authRequest.setPersonalAttributeList(moastorkRequest.getPersonalAttributeList());
-
-        authRequest.setCitizenCountryCode("AT");
-        //authRequest.setQaa(oaParam.getQaaLevel());
-       	authRequest.setQaa(moastorkRequest.getStorkAuthnRequest().getQaa());
-
-
-
-
-        Logger.info("STORK AttrRequest successfully assembled.");
-
-        STORKSAMLEngine samlEngine = STORKSAMLEngine.getInstance("VIDP");
-        try {
-
-        	authRequest = samlEngine.generateSTORKAuthnRequest(authRequest);
-        } catch (STORKSAMLEngineException e) {
-            Logger.error("Could not sign STORK SAML AttrRequest.", e);
-            throw new MOAIDException("stork.00", null);
-        }
-
-        Logger.info("STORK AttrRequest successfully signed!");
-
-		//validate AuthnRequest
-		try {
-			samlEngine.validateSTORKAuthnRequest(authRequest.getTokenSaml());
-		} catch (STORKSAMLEngineException e) {
-			Logger.error("STORK SAML AuthnRequest not valid.", e);
-			throw new MOAIDException("stork.01", null);
-		}
-
-		Logger.debug("STORK AuthnRequest successfully internally validated.");
-        
-        try {
-            Logger.trace("Initialize VelocityEngine...");
-
-            VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
-            Template template = velocityEngine.getTemplate("/resources/templates/saml2-post-binding-moa.vm");
-            VelocityContext context = new VelocityContext();
-            context.put("SAMLRequest", PEPSUtil.encodeSAMLToken(authRequest.getTokenSaml()));
-            context.put("action", destination);
-
-            StringWriter writer = new StringWriter();
-            template.merge(context, writer);
-
-            resp.getOutputStream().write(writer.toString().getBytes("UTF-8"));
-            
-        } catch (Exception e) {
-            Logger.error("Error sending STORK SAML AttrRequest.", e);
-            throw new MOAIDException("stork.11", null);
-            
-        }
-        Logger.info("STORK AttrRequest successfully rendered!");
-		
-	}
-
-	/* (non-Javadoc)
-	 * @see at.gv.egovernment.moa.id.protocols.stork2.attributeproviders.AttributeProvider#parse(javax.servlet.http.HttpServletRequest)
-	 */
-	@Override
-	public IPersonalAttributeList parse(HttpServletRequest httpReq)
-			throws UnsupportedAttributeException, MOAIDException {
-		
-		throw new UnsupportedAttributeException();
-		
-//		Logger.info(this.getClass().getSimpleName() + " tries to extract SAMLResponse out of HTTP Request");		
-//		//extract STORK Response from HTTP Request
-//		//Decodes SAML Response
-//		byte[] decSamlToken;
-//		try {
-//			decSamlToken = PEPSUtil.decodeSAMLToken(httpReq.getParameter("SAMLResponse"));
-//		} catch(NullPointerException e) {
-//			throw new UnsupportedAttributeException();
-//		}
-//
-//		//Get SAMLEngine instance
-//		STORKSAMLEngine engine = STORKSAMLEngine.getInstance("VIDP");
-//
-//		STORKAuthnResponse authnResponse = null;
-//		try {
-//			//validate SAML Token
-//			Logger.debug("Starting validation of SAML response");
-//			authnResponse = engine.validateSTORKAuthnResponse(decSamlToken, (String) httpReq.getRemoteHost());
-//			Logger.info("SAML response successfully verified!");
-//			
-//		}catch(STORKSAMLEngineException e){
-//			Logger.error("Failed to verify STORK SAML Response", e);
-//			throw new MOAIDException("stork.05", null);
-//		}
-//		
-//		return authnResponse.getPersonalAttributeList();
-			
-	}
-
-	/* (non-Javadoc)
-	 * @see at.gv.egovernment.moa.id.protocols.stork2.attributeproviders.AttributeProvider#getPriority()
-	 */
-	@Override
-	public int getPriority() {
-		return 1;
-	}
-	
-    public String getAttrProviderName() {
-        return this.getClass().getName();
-    }
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/SignedDocAttributeRequestProvider.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/SignedDocAttributeRequestProvider.java
deleted file mode 100644
index def89d0d9..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/SignedDocAttributeRequestProvider.java
+++ /dev/null
@@ -1,688 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2.attributeproviders;
-
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.StringWriter;
-import java.io.UnsupportedEncodingException;
-import java.net.URL;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-
-import javax.activation.DataSource;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.xml.namespace.QName;
-import javax.xml.transform.Source;
-import javax.xml.transform.stream.StreamSource;
-import javax.xml.ws.Service;
-import javax.xml.ws.soap.SOAPBinding;
-import javax.xml.ws.BindingProvider;
-
-import eu.stork.peps.complex.attributes.eu.stork.names.tc.stork._1_0.assertion.AttributeStatusType;
-
-import org.apache.commons.io.IOUtils;
-import org.apache.commons.lang.NotImplementedException;
-import org.apache.velocity.Template;
-import org.apache.velocity.VelocityContext;
-import org.apache.velocity.app.VelocityEngine;
-
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.config.auth.AuthConfiguration;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.stork2.ExternalAttributeRequestRequiredException;
-import at.gv.egovernment.moa.id.protocols.stork2.MOASTORKRequest;
-import at.gv.egovernment.moa.id.protocols.stork2.UnsupportedAttributeException;
-import at.gv.egovernment.moa.id.util.VelocityProvider;
-import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.Base64Utils;
-import eu.stork.oasisdss.api.ApiUtils;
-import eu.stork.oasisdss.api.LightweightSourceResolver;
-import eu.stork.oasisdss.api.ResultMajor;
-import eu.stork.oasisdss.api.exceptions.ApiUtilsException;
-import eu.stork.oasisdss.profile.AnyType;
-import eu.stork.oasisdss.profile.Base64Data;
-import eu.stork.oasisdss.profile.DocumentType;
-import eu.stork.oasisdss.profile.DocumentWithSignature;
-import eu.stork.oasisdss.profile.IncludeObject;
-import eu.stork.oasisdss.profile.SignRequest;
-import eu.stork.oasisdss.profile.SignResponse;
-import eu.stork.peps.auth.commons.IPersonalAttributeList;
-import eu.stork.peps.auth.commons.PEPSUtil;
-import eu.stork.peps.auth.commons.PersonalAttribute;
-import eu.stork.peps.auth.commons.PersonalAttributeList;
-import eu.stork.peps.auth.commons.STORKAttrQueryRequest;
-import eu.stork.peps.auth.engine.STORKSAMLEngine;
-import eu.stork.peps.exceptions.STORKSAMLEngineException;
-import eu.stork.documentservice.DocumentService;
-/**
- * Forwards a signedDoc attribute request to the oasis-dss service instance
- */
-public class SignedDocAttributeRequestProvider extends AttributeProvider {
-
-	private String dtlUrl = null;
-	private PersonalAttribute requestedAttribute;
-
-	/**
-	 * The URL of the service listening for the oasis dss webform post request
-	 */
-	private String oasisDssWebFormURL;
-
-	/**
-	 * Instantiates a new signed doc attribute request provider.
-	 * 
-	 * @param oasisDssWebFormURL
-	 *            the AP location
-	 * @param attributes 
-	 */
-	public SignedDocAttributeRequestProvider(String oasisDssWebFormURL, String attributes) {
-		super(attributes);
-		this.oasisDssWebFormURL = oasisDssWebFormURL;
-
-		try {
-			AuthConfiguration authConfigurationProvider = AuthConfigurationProviderFactory.getInstance();
-			dtlUrl = authConfigurationProvider.getDocumentServiceUrl();
-			Logger.info ("SignedDocAttributeRequestProvider, using dtlUrl:"+dtlUrl);
-		} catch (Exception e) {
-			dtlUrl = "http://testvidp.buergerkarte.at/DocumentService/DocumentService";
-			e.printStackTrace();
-			Logger.error("Loading documentservice url failed, using default value:"+dtlUrl);
-		}
-		
-//		Properties props = new Properties();
-//		try {
-//			props.load(DatabaseConnectorMySQLImpl.class.getResourceAsStream("docservice.properties"));
-//			dtlUrl = props.getProperty("docservice.url");
-//		} catch (IOException e) {
-//			dtlUrl = "http://testvidp.buergerkarte.at/DocumentService/DocumentService";
-//			Logger.error("Loading DTL config failed, using default value:"+dtlUrl);
-//			e.printStackTrace();
-//		}		
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see
-	 * at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#acquire(java
-	 * .lang.String)
-	 */
-	@Override
-	protected IPersonalAttributeList acquire(PersonalAttribute attribute, MOASTORKRequest moastorkRequest, IAuthData authData) throws UnsupportedAttributeException,
-			ExternalAttributeRequestRequiredException {
-		if(!attributes.contains(attribute.getName())) {
-			throw new UnsupportedAttributeException();
-		}
-		
-		requestedAttribute = attribute;
-		try
-		{
-			 String tmp = requestedAttribute.getValue().get(0);
-		}catch(Exception e)
-		{
-			Logger.info("SignedDocAttributeProvide failed:"+e.toString());
-			throw new UnsupportedAttributeException();
-		}
-
-		throw new ExternalAttributeRequestRequiredException(this);
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see
-	 * at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#parse(javax
-	 * .servlet.http.HttpServletRequest)
-	 */
-	public IPersonalAttributeList parse(HttpServletRequest httpReq) throws MOAIDException, UnsupportedAttributeException {
-		Logger.debug("Beginning to extract OASIS-DSS response out of HTTP Request");
-
-		try {
-			String base64 = httpReq.getParameter("signresponse");
-			Logger.debug("signresponse url: " + httpReq.getRequestURI().toString());
-			Logger.debug("signresponse querystring: " + httpReq.getQueryString());
-			Logger.debug("signresponse method: " + httpReq.getMethod());
-			Logger.debug("signresponse content type: " + httpReq.getContentType());
-			Logger.debug("signresponse parameter:"+base64);
-			String signResponseString = new String(Base64Utils.decode(base64, false), "UTF8");
-			Logger.debug("RECEIVED signresponse:"+signResponseString);
-			//create SignResponse object
-			Source response = new StreamSource(new java.io.StringReader(signResponseString));
-			SignResponse signResponse = ApiUtils.unmarshal(response, SignResponse.class);
-			//Check if Signing was successfully or not
-			
-			if(!signResponse.getResult().getResultMajor().equals(ResultMajor.RESULT_MAJOR_SUCCESS))
-			{
-				//Pass unmodifed or unmarshal & marshal??
-				InputStream istr = ApiUtils.marshalToInputStream(signResponse);
-				StringWriter writer = new StringWriter();
-				IOUtils.copy(istr, writer, "UTF-8");
-				signResponseString = writer.toString();
-				Logger.info("SignResponse with error (unmodified):"+signResponseString);
-				istr.close();
-			}
-			else
-			{
-				//extract doc from signresponse
-				DataSource dataSource = LightweightSourceResolver.getDataSource(signResponse);
-							
-				ByteArrayOutputStream baos = new ByteArrayOutputStream();
-				IOUtils.copy(dataSource.getInputStream(), baos);
-				byte[] data = baos.toByteArray();
-				baos.close();
-				
-				//update doc in DTL
-				String docId, dssId = "";	
-				docId = signResponse.getDocUI();
-				//For reference dssId equals docId
-				dssId = docId;
-				if (dssId != null && data!=null)
-				{
-					boolean success = false;
-					try{
-						success = updateDocumentInDtl(data, docId, signResponseString);
-					}catch(Exception e){//No document service used?
-						Logger.info("No document service used?");
-						e.printStackTrace();
-						success = false;
-					}
-						if(success)
-						{					
-							// set the url in the SignResponse
-							DocumentWithSignature documentWithSignature = new DocumentWithSignature();
-							DocumentType value = new DocumentType();
-							if(dtlUrl.endsWith("?wsdl"))
-							{
-								String tmp = dtlUrl.replace("?wsdl", "");
-								Logger.debug("DocumentUrl ends with ? wsdl, using "+tmp+" instead.");
-								value.setDocumentURL(tmp);
-							}
-							else
-							{
-								value.setDocumentURL(dtlUrl);
-							}
-							documentWithSignature.setDocument(value);
-							if(signResponse.getOptionalOutputs()!=null)
-							{
-								//signResponse.getOptionalOutputs().getAny().add(documentWithSignature);	
-								for(Object o :signResponse.getOptionalOutputs().getAny())
-								{
-									if(o instanceof DocumentWithSignature)
-									{
-										signResponse.getOptionalOutputs().getAny().remove(o);
-										signResponse.getOptionalOutputs().getAny().add(documentWithSignature);	
-										break;
-									}
-								}
-							}
-							else
-							{
-								AnyType anytype = new AnyType();
-								anytype.getAny().add(documentWithSignature);
-								signResponse.setOptionalOutputs(anytype );	
-							}
-	
-	//						System.out.println("overwriting:"+signResponse.getResult().getResultMessage()+" with DTL url:"+dtlUrl);
-							InputStream istr = ApiUtils.marshalToInputStream(signResponse);
-							StringWriter writer = new StringWriter();
-							IOUtils.copy(istr, writer, "UTF-8");
-							signResponseString = writer.toString();
-							Logger.info("SignResponse overwritten:"+signResponseString);
-							istr.close();
-						}
-						else
-						{
-							//No document service used?
-							// do nothing....
-							//TODO temporary fix because document is deleted after fetching => SP can't download Doc
-							//Add doc to Signresponse
-	
-							DocumentWithSignature documentWithSignature = new DocumentWithSignature();
-							DocumentType value = new DocumentType();
-							if(signResponse.getProfile().toLowerCase().contains("xades"))
-							{
-								value.setBase64XML(data);
-							}
-							else
-							{
-								Base64Data base64data = new Base64Data();
-								base64data.setValue(data);
-								base64data.setMimeType(dataSource.getContentType());
-								value.setBase64Data(base64data);
-							}
-							documentWithSignature.setDocument(value);
-							if(signResponse.getOptionalOutputs()!=null)
-							{
-								//signResponse.getOptionalOutputs().getAny().add(documentWithSignature);
-								for(Object o :signResponse.getOptionalOutputs().getAny())
-								{
-									if(o instanceof DocumentWithSignature)
-									{
-										signResponse.getOptionalOutputs().getAny().remove(o);
-										signResponse.getOptionalOutputs().getAny().add(documentWithSignature);
-										break;
-									}
-								}
-							}
-							else
-							{
-								AnyType anytype = new AnyType();
-								anytype.getAny().add(documentWithSignature);
-								signResponse.setOptionalOutputs(anytype );
-							}
-	
-	//						System.out.println("overwriting:"+signResponse.getResult().getResultMessage()+" with DTL url:"+dtlUrl);
-							InputStream istr = ApiUtils.marshalToInputStream(signResponse);
-							StringWriter writer = new StringWriter();
-							IOUtils.copy(istr, writer, "UTF-8");
-							signResponseString = writer.toString();
-							Logger.info("SignResponse overwritten:"+signResponseString);
-							istr.close();
-						}
-				}
-				else
-					throw new Exception("No DSS id found.");
-			}
-			
-			//alter signresponse
-			//done
-			List<String> values = new ArrayList<String>();
-			values.add(signResponseString);
-
-			Logger.debug("Assembling signedDoc attribute");
-			PersonalAttribute signedDocAttribute = new PersonalAttribute("signedDoc", false, values,
-                    AttributeStatusType.AVAILABLE.value());
-
-			// pack and return the result
-			PersonalAttributeList result = new PersonalAttributeList();
-			result.add(signedDocAttribute);
-			return result;
-		} catch (UnsupportedEncodingException e) {
-			Logger.error("Failed to assemble signedDoc attribute");
-			throw new MOAIDException("stork.05", null);
-		} catch (ApiUtilsException e) {
-			e.printStackTrace();
-			Logger.error("Failed to assemble signedDoc attribute");
-			throw new MOAIDException("stork.05", null);
-		} catch (IOException e) {
-			e.printStackTrace();
-			Logger.error("Failed to assemble signedDoc attribute");
-			throw new MOAIDException("stork.05", null);
-		} catch (Exception e) {
-		e.printStackTrace();
-		Logger.error("Failed to assemble signedDoc attribute");
-		//throw new MOAIDException("stork.05", null);
-            throw new UnsupportedAttributeException();
-        }
-	}
-
-	/*
-	 * (non-Javadoc)
-	 * 
-	 * @see
-	 * at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#performRedirect
-	 * (java.lang.String)
-	 */
-	public void performRedirect(String url, HttpServletRequest req, HttpServletResponse resp, OAAuthParameter oaParam)
-			throws MOAIDException {
-
-		try {
-			Logger.trace("Initialize VelocityEngine...");
-			Logger.info("performRedirect url:"+url);
-			VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
-			Template template = velocityEngine.getTemplate("/resources/templates/oasis_dss_webform_binding.vm");
-			VelocityContext context = new VelocityContext();
-			
-			//Parse SignRequest
-			String signRequestString = requestedAttribute.getValue().get(0);
-			Logger.debug("performRedirect, signrequest:"+signRequestString);
-			Source signDoc = new StreamSource(new java.io.StringReader(signRequestString));
-			SignRequest signRequest = ApiUtils.unmarshal(signDoc, SignRequest.class);
-			try{
-				//search for DTL link
-				String dtlURL = getDtlUrlFromRequest(signRequest);
-				String docId = signRequest.getDocUI();
-				
-				if(dtlURL!=null)
-				{
-					String docRequest = getDocTransferRequest(docId, dtlURL);//dtlUrl
-									
-					byte[] data = getDocumentFromDtl(docRequest, dtlURL);//dtlUrl
-					
-					//load doc from DTL
-					Logger.debug("data:"+data+" "+data.length);
-					try{
-						Logger.trace("data:"+new String(data,"UTF-8"));
-					}catch(Exception e)
-					{
-						Logger.trace("data: creating String failed:"+e);
-					}
-					String mime = getDocumentMimeFromDtl(docId, dtlURL);//dtlUrl
-					Logger.debug("mime:"+mime);
-					
-					//add doc as base64* to signrequest => post doc to oasis
-					try{
-						List<IncludeObject> includeObjects = ApiUtils.findNamedElement(
-								signRequest.getOptionalInputs(), "IncludeObject",
-								IncludeObject.class);
-						signRequest.getOptionalInputs().getAny().removeAll(includeObjects);
-	
-						String documentId = null;
-						Object objDoc = signRequest.getInputDocuments().getDocumentOrTransformedDataOrDocumentHash().get(0);
-						if (objDoc != null && objDoc instanceof DocumentType)
-						{
-							DocumentType document = (DocumentType)objDoc;
-							documentId = document.getID();
-						}
-						DocumentType document = new DocumentType();
-						if(documentId != null)
-							document.setID(documentId);
-						if(signRequest.getProfile().toLowerCase().contains("xades"))
-						{
-							document.setBase64XML(data);
-						}
-						else
-						{
-							Base64Data b64data = new Base64Data();
-							b64data.setValue(data);
-							b64data.setMimeType(mime);
-							document.setBase64Data(b64data);
-						}
-						
-						signRequest.setInputDocuments(ApiUtils.createInputDocuments(document));
-						//override old signRequestString
-	
-						InputStream istr = ApiUtils.marshalToInputStream(signRequest);
-						StringWriter writer = new StringWriter();
-						IOUtils.copy(istr, writer, "UTF-8");
-						signRequestString = writer.toString();
-						Logger.info("Signrequest overwritten");	
-						Logger.debug("Signrequest overwritten:"+signRequestString);	
-						istr.close();
-					} catch (Exception e) {
-						e.printStackTrace();
-						throw new Exception("Could not marshall sign request", e);
-					}	
-				}
-				else//Do not modify signRequest, document is already included
-				{
-					
-				}
-			}catch(Exception e)
-			{
-				Logger.info("No documentservice used?");
-				e.printStackTrace();
-			}
-			
-			context.put("signrequest", Base64Utils.encode(signRequestString.getBytes("UTF8")));
-			context.put("clienturl", url);
-			context.put("action", oasisDssWebFormURL);
-
-			StringWriter writer = new StringWriter();
-			template.merge(context, writer);
-
-			resp.getOutputStream().write(writer.toString().getBytes("UTF-8"));
-		} catch (Exception e) {
-			Logger.error("Error sending DSS signrequest.", e);
-			throw new MOAIDException("stork.11", null);
-		}
-	}
-
-
-	/* (non-Javadoc)
-	 * @see at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#getSupportedAttributeNames()
-	 */
-    @Override
-    public List<String> getSupportedAttributeNames() throws MOAIDException {
-        ArrayList<String> supportedAttributeNames = new ArrayList<String>();
-        for (String attributeName : this.attributes.split(",")) {
-            supportedAttributeNames.add(attributeName);
-        }
-        return supportedAttributeNames;
-    }
-    
-    
-    //From DTLPEPSUTIL
-    
-    /**
-	 * Get DTL uril from the oasis sign request
-	 * @param signRequest The signature request
-	 * @return The URL of DTL service
-	 * @throws SimpleException
-	 */
-	private String getDtlUrlFromRequest(SignRequest signRequest) throws Exception
-	{
-		if (signRequest == null)
-			throw new Exception("Signature request is empty");
-		else
-		{
-			try
-			{
-				Object objDoc = signRequest.getInputDocuments().getDocumentOrTransformedDataOrDocumentHash().get(0);
-				if (objDoc instanceof DocumentType)
-				{
-					DocumentType document = (DocumentType)objDoc;
-					if (document.getDocumentURL() != null)
-						return document.getDocumentURL();
-					else
-						return null;//throw new Exception("No document url found");
-				}
-				else
-					throw new Exception("No input document found");
-			}
-			catch (Exception ex)
-			{
-				throw new Exception("Unable to parse xml.", ex);
-			}
-		}
-	}
-	
-	/**
-  	 * Get document from DTL
-  	 * @param transferRequest The transfer request (attribute query)
-  	 * @param eDtlUrl The DTL url of external DTL
-  	 * @return the document data
-  	 * @throws SimpleException
-  	 */
-  	private byte[] getDocumentFromDtl(String transferRequest, String eDtlUrl) throws Exception
-	{	
-  		URL url = null;
-		try 
-		{
-			Logger.debug("getDocumentFromDtl:"+dtlUrl);
-			url = new URL(dtlUrl);
-			QName qname = new QName("http://stork.eu",
-				    "DocumentService");
-
-			Service service = Service.create(url, qname);
-			DocumentService docservice = service.getPort(DocumentService.class);
-			
-			BindingProvider bp = (BindingProvider) docservice;
-			SOAPBinding binding = (SOAPBinding) bp.getBinding();
-			binding.setMTOMEnabled(true);
-							
-	        if (eDtlUrl.equalsIgnoreCase(dtlUrl))
-	        	return docservice.getDocument(transferRequest, "");
-	        else
-	      		return docservice.getDocument(transferRequest, eDtlUrl);
-		}
-	    catch (Exception e)
-	    {
-	    	  e.printStackTrace();
-	    	  throw new Exception("Error in getDocumentFromDtl", e);
-	    }		      
-	}
-  	
-  	/**
-	   * Get a document transfer request (attribute query)
-	   * @param docId
-	   * @return
-	 * @throws SimpleException 
-	   */
-	  private String getDocTransferRequest(String docId, String destinationUrl) throws Exception
-	  {
-		  String spCountry = docId.substring(0, docId.indexOf("/"));
-		  final STORKSAMLEngine engine =  STORKSAMLEngine.getInstance("VIDP");
-		  STORKAttrQueryRequest req = new STORKAttrQueryRequest();
-		  req.setAssertionConsumerServiceURL(dtlUrl);
-		  req.setDestination(destinationUrl);
-		  req.setSpCountry(spCountry);
-		  req.setQaa(3);//TODO
-		  PersonalAttributeList pal = new PersonalAttributeList();
-		  PersonalAttribute attr = new PersonalAttribute();
-		  attr.setName("docRequest");
-		  attr.setIsRequired(true);
-		  attr.setValue(Arrays.asList(docId));
-		  pal.add(attr);
-		  req.setPersonalAttributeList(pal);
-		  
-		  STORKAttrQueryRequest req1;
-		try {
-			req1 = engine.generateSTORKAttrQueryRequest(req);
-			return PEPSUtil.encodeSAMLTokenUrlSafe(req1.getTokenSaml());
-		} catch (STORKSAMLEngineException e) {			
-			e.printStackTrace();
-			throw new Exception("Error in doc request attribute query generation", e);
-		}		
-	  }
-    
-	  	/**
-	  	 * Get mime type of document from DTL
-	  	 * @param docId The document id
-	  	 * @param dtlUrl The url of dtl
-	  	 * @return The mime type
-	  	 */
-	  	private String getDocumentMimeFromDtl(String docId, String eDtlUrl) throws Exception
-	  	{
-	  		URL url = null;
-			try 
-			{
-				url = new URL(dtlUrl);
-				QName qname = new QName("http://stork.eu",
-					    "DocumentService");
-
-				Service service = Service.create(url, qname);
-				DocumentService docservice = service.getPort(DocumentService.class);
-					  
-				BindingProvider bp = (BindingProvider) docservice;
-				SOAPBinding binding = (SOAPBinding) bp.getBinding();
-				binding.setMTOMEnabled(true);
-								
-		        if (eDtlUrl.equalsIgnoreCase(dtlUrl))
-		        	return docservice.getDocumentMime(docId, "");
-		        else
-		      		return docservice.getDocumentMime(docId, eDtlUrl);
-			}
-		    catch (Exception e)
-		    {
-		    	  e.printStackTrace();
-		    	  throw new Exception("Error in getDocumentFromDtl", e);
-		    }
-	  	}
-	  	
-	  	/**
-	  	 * Add document to DTL service
-	  	 * @param docData the document data
-	  	 * @param mime the mime type of data
-	  	 * @param signRequest the sign request
-	  	 * @return the document id
-	  	 * @throws SimpleException
-	  	 */
-	  	private String addDocumentToDtl(byte[] docData, String mime, String signRequest, String destCountry, String spId) throws Exception
-		{
-	  		throw new NotImplementedException();
-//			URL url = null;
-//			String docID = null;
-//			try 
-//			{				
-//				url = new URL(dtlUrl);
-//				QName qname = new QName("http://stork.eu",
-//					    "DocumentService");
-//
-//				Service service = Service.create(url, qname);
-//				DocumentService docservice = service.getPort(DocumentService.class);
-//					  
-//				BindingProvider bp = (BindingProvider) docservice;
-//				SOAPBinding binding = (SOAPBinding) bp.getBinding();
-//				binding.setMTOMEnabled(true);
-//				
-//				docID = docservice.addDocument(docData, signRequest, destCountry, spId, mime, "");
-//			}
-//		    catch (Exception e)
-//		    {
-//		    	  e.printStackTrace();
-//		    	  throw new Exception("Error in addDocumentToDtl", e);
-//		    }
-//		      
-//		      return docID;
-		}
-	  	
-	  	/**
-	  	 * Update document in DTL
-	  	 * @param docData The docment data
-	  	 * @param docId The document ID
-	  	 * @param signResponse The signature response
-	  	 * @return True if successful
-	  	 * @throws SimpleException
-	  	 */
-	  	private boolean updateDocumentInDtl(byte[] docData, String docId, String signResponse) throws Exception
-		{
-	  		boolean success = false;
-			URL url = null;
-			try 
-			{				
-				url = new URL(dtlUrl);
-				QName qname = new QName("http://stork.eu",
-					    "DocumentService");
-
-				Service service = Service.create(url, qname);
-				DocumentService docservice = service.getPort(DocumentService.class);
-					  
-				BindingProvider bp = (BindingProvider) docservice;
-				SOAPBinding binding = (SOAPBinding) bp.getBinding();
-				binding.setMTOMEnabled(true);
-				
-				success = docservice.updateDocument(docId, signResponse, docData);
-			}
-		    catch (Exception e)
-		    {
-		    	  e.printStackTrace();
-		    	  throw new Exception("Error in updateDocumentInDtl", e);
-		    }
-		      
-		      return success;
-		}
-	  	
-		/* (non-Javadoc)
-		 * @see at.gv.egovernment.moa.id.protocols.stork2.attributeproviders.AttributeProvider#getPriority()
-		 */
-		@Override
-		public int getPriority() {
-			return 99;
-		}
-}
diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/StorkAttributeRequestProvider.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/StorkAttributeRequestProvider.java
deleted file mode 100644
index 5ee0e380e..000000000
--- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/attributeproviders/StorkAttributeRequestProvider.java
+++ /dev/null
@@ -1,193 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.protocols.stork2.attributeproviders;
-
-import java.io.StringWriter;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import org.apache.velocity.Template;
-import org.apache.velocity.VelocityContext;
-import org.apache.velocity.app.VelocityEngine;
-
-import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
-import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
-import at.gv.egovernment.moa.id.data.IAuthData;
-import at.gv.egovernment.moa.id.protocols.stork2.ExternalAttributeRequestRequiredException;
-import at.gv.egovernment.moa.id.protocols.stork2.MOASTORKRequest;
-import at.gv.egovernment.moa.id.protocols.stork2.UnsupportedAttributeException;
-import at.gv.egovernment.moa.id.util.HTTPUtils;
-import at.gv.egovernment.moa.id.util.VelocityProvider;
-import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.StringUtils;
-import eu.stork.peps.auth.commons.IPersonalAttributeList;
-import eu.stork.peps.auth.commons.PEPSUtil;
-import eu.stork.peps.auth.commons.PersonalAttribute;
-import eu.stork.peps.auth.commons.PersonalAttributeList;
-import eu.stork.peps.auth.commons.STORKAttrQueryRequest;
-import eu.stork.peps.auth.commons.STORKAttrQueryResponse;
-import eu.stork.peps.auth.engine.STORKSAMLEngine;
-import eu.stork.peps.exceptions.STORKSAMLEngineException;
-
-/**
- * creates a STORK attribute request for a configurable set of attributes
- */
-public class StorkAttributeRequestProvider extends AttributeProvider {
-
-	private PersonalAttributeList requestedAttributes;
-	
-	/** The destination. */
-	private String destination;
-
-	/** The sp country code. */
-	private String spCountryCode;
-
-	/**
-	 * Instantiates a new stork attribute request provider.
-	 *
-	 * @param apUrl the AP location
-	 * @param supportedAttributes the supported attributes as csv
-	 */
-	public StorkAttributeRequestProvider(String apUrl, String supportedAttributes) {
-		super(supportedAttributes);
-		destination = apUrl;		
-	}
-
-	/* (non-Javadoc)
-	 * @see at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#acquire(java.lang.String)
-	 */
-	@Override
-	protected IPersonalAttributeList acquire(PersonalAttribute attribute, MOASTORKRequest moastorkRequest, IAuthData authData)
-			throws UnsupportedAttributeException, ExternalAttributeRequestRequiredException {
-
-		if (!attributes.contains(attribute.getName()))
-			throw new UnsupportedAttributeException();
-		
-		this.spCountryCode = moastorkRequest.getSpCountry();
-
-		requestedAttributes = new PersonalAttributeList(1);
-		requestedAttributes.add(attribute);
-		throw new ExternalAttributeRequestRequiredException(this);
-	}
-
-	/* (non-Javadoc)
-	 * @see at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#parse(javax.servlet.http.HttpServletRequest)
-	 */
-	public IPersonalAttributeList parse(HttpServletRequest httpReq) throws MOAIDException, UnsupportedAttributeException {
-
-		Logger.info(this.getClass().getSimpleName() + " tries to extract SAMLResponse out of HTTP Request");
-		
-		//extract STORK Response from HTTP Request
-		//Decodes SAML Response
-		byte[] decSamlToken;
-		try {
-			decSamlToken = PEPSUtil.decodeSAMLToken(httpReq.getParameter("SAMLResponse"));
-		} catch(NullPointerException e) {
-			throw new UnsupportedAttributeException();
-		}
-
-		//Get SAMLEngine instance
-		STORKSAMLEngine engine = STORKSAMLEngine.getInstance("VIDP");
-
-		STORKAttrQueryResponse attrResponse = null;
-		try {
-			//validate SAML Token
-			Logger.debug("Starting validation of SAML response");
-			attrResponse = engine.validateSTORKAttrQueryResponse(decSamlToken, (String) httpReq.getRemoteHost());
-			Logger.info("SAML response successfully verified!");
-		}catch(STORKSAMLEngineException e){
-			Logger.error("Failed to verify STORK SAML Response", e);
-			throw new MOAIDException("stork.05", null);
-		}
-		
-		return attrResponse.getPersonalAttributeList();
-	}
-
-	/* (non-Javadoc)
-	 * @see at.gv.egovernment.moa.id.protocols.stork2.AttributeProvider#performRedirect(java.lang.String)
-	 */
-	public void performRedirect(String url, HttpServletRequest req, HttpServletResponse resp, OAAuthParameter oaParam) throws MOAIDException {
-
-    	String spSector = "Business";
-    	String spInstitution = StringUtils.isEmpty(oaParam.getFriendlyName()) ? "UNKNOWN" : oaParam.getFriendlyName();
-    	String spApplication = spInstitution;
-
-    	//generate AuthnRquest
-    	STORKAttrQueryRequest attributeRequest = new STORKAttrQueryRequest();
-    	attributeRequest.setDestination(destination);
-    	attributeRequest.setAssertionConsumerServiceURL(url);
-    	attributeRequest.setIssuer(HTTPUtils.getBaseURL(req));
-    	attributeRequest.setQaa(oaParam.getQaaLevel());
-    	attributeRequest.setSpInstitution(spInstitution);
-    	attributeRequest.setCountry(spCountryCode);
-    	attributeRequest.setSpCountry(spCountryCode);
-    	attributeRequest.setSpApplication(spApplication);
-    	attributeRequest.setSpSector(spSector);
-    	attributeRequest.setPersonalAttributeList(requestedAttributes);
-
-    	attributeRequest.setCitizenCountryCode("AT");
-
-
-    	Logger.debug("STORK AttrRequest successfully assembled.");
-
-    	STORKSAMLEngine samlEngine = STORKSAMLEngine.getInstance("VIDP");
-    	try {
-    		attributeRequest = samlEngine.generateSTORKAttrQueryRequest(attributeRequest);
-    	} catch (STORKSAMLEngineException e) {
-			Logger.error("Could not sign STORK SAML AttrRequest.", e);
-			throw new MOAIDException("stork.00", null);
-		}
-        Logger.info("Using citizen country code: " + attributeRequest.getCitizenCountryCode());
-		Logger.info("STORK AttrRequest successfully signed!");
-		
-		try {
-			Logger.trace("Initialize VelocityEngine...");
-
-			VelocityEngine velocityEngine = VelocityProvider.getClassPathVelocityEngine();
-			Template template = velocityEngine.getTemplate("/resources/templates/saml2-post-binding-moa.vm");
-			VelocityContext context = new VelocityContext();
-			context.put("SAMLRequest", PEPSUtil.encodeSAMLToken(attributeRequest.getTokenSaml()));
-			context.put("action", destination);
-
-			StringWriter writer = new StringWriter();
-			template.merge(context, writer);
-
-			resp.getOutputStream().write(writer.toString().getBytes("UTF-8"));
-		} catch (Exception e) {
-			Logger.error("Error sending STORK SAML AttrRequest.", e);
-			throw new MOAIDException("stork.11", null);
-		}
-		Logger.info("STORK AttrRequest successfully rendered!");
-	}
-
-	/* (non-Javadoc)
-	 * @see at.gv.egovernment.moa.id.protocols.stork2.attributeproviders.AttributeProvider#getPriority()
-	 */
-	@Override
-	public int getPriority() {
-		return 99;
-	}
-
-}
-
diff --git a/id/server/modules/module-stork/src/main/resources/META-INF/services/at.gv.egovernment.moa.id.moduls.IModulInfo b/id/server/modules/module-stork/src/main/resources/META-INF/services/at.gv.egovernment.moa.id.moduls.IModulInfo
deleted file mode 100644
index 5d7af87d5..000000000
--- a/id/server/modules/module-stork/src/main/resources/META-INF/services/at.gv.egovernment.moa.id.moduls.IModulInfo
+++ /dev/null
@@ -1 +0,0 @@
-at.gv.egovernment.moa.id.protocols.stork2.STORKProtocol
\ No newline at end of file
diff --git a/id/server/modules/module-stork/src/main/resources/META-INF/services/at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder b/id/server/modules/module-stork/src/main/resources/META-INF/services/at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder
deleted file mode 100644
index 540802dce..000000000
--- a/id/server/modules/module-stork/src/main/resources/META-INF/services/at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeBuilder
+++ /dev/null
@@ -1,14 +0,0 @@
-at.gv.egovernment.moa.id.protocols.builder.attributes.STORKAdoptedFamilyNameAttributBuilder
-at.gv.egovernment.moa.id.protocols.builder.attributes.STORKAgeAttributBuilder
-at.gv.egovernment.moa.id.protocols.builder.attributes.STORKCanonicalResidenceAddressAttributBuilder
-at.gv.egovernment.moa.id.protocols.builder.attributes.STORKCountryCodeOfBirthAttributBuilder
-at.gv.egovernment.moa.id.protocols.builder.attributes.STORKFiscalNumberAttributBuilder
-at.gv.egovernment.moa.id.protocols.builder.attributes.STORKGenderAttributBuilder
-at.gv.egovernment.moa.id.protocols.builder.attributes.STORKInhertedFamilyNameAttributBuilder
-at.gv.egovernment.moa.id.protocols.builder.attributes.STORKIsAgeOverAttributBuilder
-at.gv.egovernment.moa.id.protocols.builder.attributes.STORKMaritalStatusAttributBuilder
-at.gv.egovernment.moa.id.protocols.builder.attributes.STORKNationalityCodeAttributBuilder
-at.gv.egovernment.moa.id.protocols.builder.attributes.STORKPseudonymAttributBuilder
-at.gv.egovernment.moa.id.protocols.builder.attributes.STORKResidencePermitAttributBuilder
-at.gv.egovernment.moa.id.protocols.builder.attributes.STORKTextResidenceAddressAttributBuilder
-at.gv.egovernment.moa.id.protocols.builder.attributes.STORKTitleAttributBuilder
\ No newline at end of file
diff --git a/id/server/modules/module-stork/src/main/resources/at/gv/egovernment/moa/id/auth/modules/stork/STORKAuthentication.process.xml b/id/server/modules/module-stork/src/main/resources/at/gv/egovernment/moa/id/auth/modules/stork/STORKAuthentication.process.xml
deleted file mode 100644
index 60989e638..000000000
--- a/id/server/modules/module-stork/src/main/resources/at/gv/egovernment/moa/id/auth/modules/stork/STORKAuthentication.process.xml
+++ /dev/null
@@ -1,29 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>

-<pd:ProcessDefinition id="STORKAuthentication" xmlns:pd="http://reference.e-government.gv.at/namespace/moa/process/definition/v1">

-

-<!--

-	STORK authentication both with C-PEPS supporting xml signatures and with C-PEPS not supporting xml signatures.

--->

-	<pd:Task id="createStorkAuthRequestForm"      class="at.gv.egovernment.moa.id.auth.modules.stork.tasks.CreateStorkAuthRequestFormTask" />

-	<pd:Task id="pepsConnector"                   class="at.gv.egovernment.moa.id.auth.modules.stork.tasks.PepsConnectorTask"                               async="true" />

-	<pd:Task id="pepsConnectorWithoutSignature"   class="at.gv.egovernment.moa.id.auth.modules.stork.tasks.PepsConnectorHandleResponseWithoutSignatureTask" async="true" />

-	<pd:Task id="pepsConnectorWithLocalSignature" class="at.gv.egovernment.moa.id.auth.modules.stork.tasks.PepsConnectorHandleLocalSignResponseTask"        async="true" />

-

-	<!-- Process is triggered either by GenerateIFrameTemplateServlet (upon bku selection) or by AuthenticationManager (upon legacy authentication start using legacy parameters. -->

-	<pd:StartEvent id="start" />

-	

-	<pd:Transition from="start" to="createStorkAuthRequestForm" />

-	

-	<pd:Transition from="createStorkAuthRequestForm" to="pepsConnector" conditionExpression="ctx['C-PEPS:XMLSignatureSupported']" />

-	<pd:Transition from="createStorkAuthRequestForm" to="pepsConnectorWithoutSignature" />

-	

-	<pd:Transition from="pepsConnector" to="pepsConnector" conditionExpression="!ctx['identityLinkAvailable']" /> <!-- honor strange intermediate step of asking for the subject's gender -->

-	<pd:Transition from="pepsConnector" to="end" />

-	

-	<pd:Transition from="pepsConnectorWithoutSignature"   to="pepsConnectorWithLocalSignature" />

-	<pd:Transition from="pepsConnectorWithLocalSignature" to="pepsConnectorWithoutSignature" conditionExpression="!ctx['identityLinkAvailable']" /> <!-- honor strange intermediate step of asking for the subject's gender -->

-	<pd:Transition from="pepsConnectorWithLocalSignature" to="end" />

-	

-	<pd:EndEvent id="end" />

-

-</pd:ProcessDefinition>

diff --git a/id/server/modules/module-stork/src/test/java/at/gv/egovernment/moa/id/auth/modules/stork/STORKProcessEngineSignalServletTest.java b/id/server/modules/module-stork/src/test/java/at/gv/egovernment/moa/id/auth/modules/stork/STORKProcessEngineSignalServletTest.java
deleted file mode 100644
index ab2d3071f..000000000
--- a/id/server/modules/module-stork/src/test/java/at/gv/egovernment/moa/id/auth/modules/stork/STORKProcessEngineSignalServletTest.java
+++ /dev/null
@@ -1,27 +0,0 @@
-package at.gv.egovernment.moa.id.auth.modules.stork;

-

-import static org.junit.Assert.*;

-

-import java.io.IOException;

-import java.io.InputStream;

-

-import org.apache.commons.io.IOUtils;

-import org.junit.Test;

-import org.springframework.mock.web.MockHttpServletRequest;

-

-public class STORKProcessEngineSignalServletTest {

-

-	@Test

-	public void testGetMoaSessionId() throws IOException {

-		try (InputStream in = getClass().getResourceAsStream("SAMLResponse.base64")) {

-			String samlResponse = IOUtils.toString(in);

-

-			MockHttpServletRequest request = new MockHttpServletRequest("GET", "/service/createTransactionId");

-			request.addParameter("SAMLResponse", samlResponse);

-			assertEquals("_f2358f2f4db445bd1ac75ce415d76a95",

-					new STORKProcessEngineSignalServlet().getMoaSessionId(request));

-		}

-

-	}

-

-}

diff --git a/id/server/modules/module-stork/src/test/resources/at/gv/egovernment/moa/id/auth/modules/stork/SAMLResponse.base64 b/id/server/modules/module-stork/src/test/resources/at/gv/egovernment/moa/id/auth/modules/stork/SAMLResponse.base64
deleted file mode 100644
index e4061a705..000000000
--- a/id/server/modules/module-stork/src/test/resources/at/gv/egovernment/moa/id/auth/modules/stork/SAMLResponse.base64
+++ /dev/null
@@ -1 +0,0 @@
-PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDJwOlJlc3BvbnNlIHhtbG5zOnNhbWwycD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiB4bWxuczpkcz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyIgeG1sbnM6c2FtbDI9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iIHhtbG5zOnN0b3JrPSJ1cm46ZXU6c3Rvcms6bmFtZXM6dGM6U1RPUks6MS4wOmFzc2VydGlvbiIgeG1sbnM6c3RvcmtwPSJ1cm46ZXU6c3Rvcms6bmFtZXM6dGM6U1RPUks6MS4wOnByb3RvY29sIiB4bWxuczp4cz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEiIENvbnNlbnQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjb25zZW50Om9idGFpbmVkIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9sb2NhbGhvc3Q6ODQ0My9tb2EtaWQtYXV0aC9QRVBTQ29ubmVjdG9yIiBJRD0iXzY0MjUzODBkMjdlNjViY2I3NDc0OGE1ZjFjOWU2Yzk5IiBJblJlc3BvbnNlVG89Il9mMjM1OGYyZjRkYjQ0NWJkMWFjNzVjZTQxNWQ3NmE5NSIgSXNzdWVJbnN0YW50PSIyMDE1LTAyLTIzVDE2OjEzOjA4LjYxMVoiIFZlcnNpb249IjIuMCI+PHNhbWwyOklzc3VlciBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpuYW1laWQtZm9ybWF0OmVudGl0eSI+aHR0cDovL0MtUEVQUy5nb3YueHg8L3NhbWwyOklzc3Vlcj48ZHM6U2lnbmF0dXJlIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj48ZHM6U2lnbmVkSW5mbz48ZHM6Q2Fub25pY2FsaXphdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjxkczpTaWduYXR1cmVNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGRzaWctbW9yZSNyc2Etc2hhMjU2Ii8+PGRzOlJlZmVyZW5jZSBVUkk9IiNfNjQyNTM4MGQyN2U2NWJjYjc0NzQ4YTVmMWM5ZTZjOTkiPjxkczpUcmFuc2Zvcm1zPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjZW52ZWxvcGVkLXNpZ25hdHVyZSIvPjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiPjxlYzpJbmNsdXNpdmVOYW1lc3BhY2VzIHhtbG5zOmVjPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiIFByZWZpeExpc3Q9InhzIi8+PC9kczpUcmFuc2Zvcm0+PC9kczpUcmFuc2Zvcm1zPjxkczpEaWdlc3RNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjc2hhMSIvPjxkczpEaWdlc3RWYWx1ZT5Ha2czSHZoemNSMjlEdko2U1U5TmI2bUlNb009PC9kczpEaWdlc3RWYWx1ZT48L2RzOlJlZmVyZW5jZT48L2RzOlNpZ25lZEluZm8+PGRzOlNpZ25hdHVyZVZhbHVlPkJUOVY0SVNWa2kwdExRUk1OZU1WaTc2QTB5VHpGRXRkdGIwS1VvQVpQUTNNWkcwSmlrL09wRnhoRFdjQ2gxSFR6am5PVzhsa21sVnpJcENGQ2l2cm9GOTZoN2ZLWmloODdLNi9JL084bEhKOGR0R0NobXFERUgrQ2liNEM3K3hsaUNna0luMGZoZzhDYTVBWWtJSzBIZTVHWm9VSk5uOWNKbnFNalNuQ2ZRRzNsUHRLOURPSTVsMU9oTkdYWGIrY3JVVHo2eUVlZFB1OENNUUpiWG1PVFFsb21ud00rN2VxV0RMWnd4dzJ3VHUrV252clpvYUJ4cG8rMlNrMTRhV0gxcytzVDJYbE1URE5ubVpzb21WalYzdTUrWlhxWlZFcm9TYkNkZW9BbmFZM3o2OGkxdWYzQzYvNFRBbzhBbENkbVBYMlNUUSs1Y21OUHMvRHhCM3RrZz09PC9kczpTaWduYXR1cmVWYWx1ZT48ZHM6S2V5SW5mbz48ZHM6WDUwOURhdGE+PGRzOlg1MDlDZXJ0aWZpY2F0ZT5NSUlGYkRDQ0JGU2dBd0lCQWdJRVFMSzU5ekFOQmdrcWhraUc5dzBCQVFVRkFEQStNUXN3Q1FZRFZRUUdFd0p6YVRFYk1Ca0dBMVVFCkNoTVNjM1JoZEdVdGFXNXpkR2wwZFhScGIyNXpNUkl3RUFZRFZRUUxFd2x6YVhSbGMzUXRZMkV3SGhjTk1UQXdNek13TVRNd09USXoKV2hjTk1UVXdNek13TVRNek9USXpXakNCaGpFTE1Ba0dBMVVFQmhNQ2Mya3hHekFaQmdOVkJBb1RFbk4wWVhSbExXbHVjM1JwZEhWMAphVzl1Y3pFU01CQUdBMVVFQ3hNSlUwbFVSVk5VTFVOQk1Sa3dGd1lEVlFRTEV4QmpaWEowYVdacFkyRjBaWE10ZDJWaU1Tc3dFd1lEClZRUURFd3hVUlZOVUlGQkZVRk1nVTBrd0ZBWURWUVFGRXcwek1EQXpNakF4TURBd01EQXhNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUYKQUFPQ0FROEFNSUlCQ2dLQ0FRRUE0aDZMOVB2MVRLN2Z6NUs2VXVyMFJsaTZFS3pad1R0djl4WGhTdDJ4bEk0d0ZXenpGaUN5NS9PLwpRNUdQUmExMFlvTWM4czdXbU1kTTV5SS9iVTBCRjJ0NVNZdEVIN013YkdhRlpGS0p0MTdPdGJwWkFhQ1NvaDZmbTF5TzBIdFZWa0c5ClVkSDRtc3dTM3dIcC9kMUM5MWxRTmJhMmVuVmMycDlOZDRnWW9wL3picm9FdG9GZUR5SHhUbDBtWU4vY1VIUUZUNEgyNGh6QWZXWGgKMkZPQmZOU252TmwySG5QSk9UNkhuclVCc2R5emtTekxOMEVpczJSMUc1K21Ra3pBd1c2VU9yb29qdk1jbEVKSzN6MW9la2oyT1dqMQpGaGFsVE5tQTVEOWRrRHltVFJuNG8zQlcyUzdvdm1XUG14WVVXOXMyNmJrUGh6L0NiQ1F3SUY5eVBRSURBUUFCbzRJQ0p6Q0NBaU13CkRnWURWUjBQQVFIL0JBUURBZ1dnTUNzR0ExVWRFQVFrTUNLQUR6SXdNVEF3TXpNd01UTXdPVEl6V29FUE1qQXhOVEF6TXpBeE16TTUKTWpOYU1Fc0dBMVVkSUFSRU1FSXdOZ1lMS3dZQkJBR3ZXUUlCQVFJd0p6QWxCZ2dyQmdFRkJRY0NBUllaYUhSMGNEb3ZMM2QzZHk1agpZUzVuYjNZdWMya3ZZM0J6THpBSUJnWUVBSXN3QVFJd0dBWUlLd1lCQlFVSEFRTUVEREFLTUFnR0JnUUFqa1lCQVRBZUJnTlZIUkVFCkZ6QVZnUk4wWlhOMExuTnBMWEJsY0hOQVoyOTJMbk5wTUlIMkJnTlZIUjhFZ2U0d2dlc3dWYUJUb0ZHa1R6Qk5NUXN3Q1FZRFZRUUcKRXdKemFURWJNQmtHQTFVRUNoTVNjM1JoZEdVdGFXNXpkR2wwZFhScGIyNXpNUkl3RUFZRFZRUUxFd2x6YVhSbGMzUXRZMkV4RFRBTApCZ05WQkFNVEJFTlNURE13Z1pHZ2dZNmdnWXVHV0d4a1lYQTZMeTk0TlRBd0xtZHZkaTV6YVM5dmRUMXphWFJsYzNRdFkyRXNiejF6CmRHRjBaUzFwYm5OMGFYUjFkR2x2Ym5Nc1l6MXphVDlqWlhKMGFXWnBZMkYwWlZKbGRtOWpZWFJwYjI1TWFYTjBQMkpoYzJXR0wyaDAKZEhBNkx5OTNkM2N1YzJsblpXNHRZMkV1YzJrdlkzSnNMM05wZEdWemRDOXphWFJsYzNRdFkyRXVZM0pzTUI4R0ExVWRJd1FZTUJhQQpGRlJKQjBhSHp4MkpuY3F1Y3Flb29LQnB0eUhuTUIwR0ExVWREZ1FXQkJReVNlbWVEaTEwRGJlVFlqMXRrR1o1Wm80bXdqQUpCZ05WCkhSTUVBakFBTUJrR0NTcUdTSWIyZlFkQkFBUU1NQW9iQkZZM0xqRURBZ09vTUEwR0NTcUdTSWIzRFFFQkJRVUFBNElCQVFBU1E0bDEKVmQrTVJETEZvMkE2cVlZV0xWcVR2dFBMSWs3djdCc3dtcTJTRkFMMlhtUG9MNXhiUUZlRFcrTGlXaFFCbXJsZ1d5STdnYmkvMS9ycwoxRTAwWjRTa244bDk3dHVJeXV4dkNLVEZoSkR4OXB6Z1VRR293b0NZbzlJemNNTlFweHg2bGtlcHJlQ0R1YytlMGZBYnZUTkdFcHZRCjdEa2dyd0pkY3NVQUVsUTRPSjBpZkVMb2FoMURIOHdwVTMxenI3RDNZc2l6WmdwdTVURUlHUDU0QU9oYkZlWkVtWmxUVTZnd053NGkKVGY2blZRa0dheHNKdDZnR0dzeUw4UlV1dndwVlJSM1dtcGxDdGpYcnlHQ2U0Qi9hZ0FlM0VLVWgxNUlhUHZXcWRpeFNqeVN4akJJMQpiTjhJRUZIWVBabXV3aDdZMUZRdU9ZUUdqdVNMc0p5OTwvZHM6WDUwOUNlcnRpZmljYXRlPjwvZHM6WDUwOURhdGE+PC9kczpLZXlJbmZvPjwvZHM6U2lnbmF0dXJlPjxzYW1sMnA6U3RhdHVzPjxzYW1sMnA6U3RhdHVzQ29kZSBWYWx1ZT0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnN0YXR1czpTdWNjZXNzIi8+PHNhbWwycDpTdGF0dXNNZXNzYWdlPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpzdGF0dXM6U3VjY2Vzczwvc2FtbDJwOlN0YXR1c01lc3NhZ2U+PC9zYW1sMnA6U3RhdHVzPjxzYW1sMjpBc3NlcnRpb24gSUQ9Il8zNzhiMGNjNTk0YThkMzhmMzJjN2M3NjQ5NTQ0OWQ1ZCIgSXNzdWVJbnN0YW50PSIyMDE1LTAyLTIzVDE2OjEzOjA4LjYxMVoiIFZlcnNpb249IjIuMCIgeG1sbnM6eHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIj48c2FtbDI6SXNzdWVyIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm5hbWVpZC1mb3JtYXQ6ZW50aXR5Ij5odHRwOi8vQy1QRVBTLmdvdi54eDwvc2FtbDI6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPjxkczpTaWduZWRJbmZvPjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZHNpZy1tb3JlI3JzYS1zaGEyNTYiLz48ZHM6UmVmZXJlbmNlIFVSST0iI18zNzhiMGNjNTk0YThkMzhmMzJjN2M3NjQ5NTQ0OWQ1ZCI+PGRzOlRyYW5zZm9ybXM+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyI+PGVjOkluY2x1c2l2ZU5hbWVzcGFjZXMgeG1sbnM6ZWM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIgUHJlZml4TGlzdD0ieHMiLz48L2RzOlRyYW5zZm9ybT48L2RzOlRyYW5zZm9ybXM+PGRzOkRpZ2VzdE1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNzaGExIi8+PGRzOkRpZ2VzdFZhbHVlPnJCYTMrbTU0RXVVZzgzSzhpTnVPVDlTaktQcz08L2RzOkRpZ2VzdFZhbHVlPjwvZHM6UmVmZXJlbmNlPjwvZHM6U2lnbmVkSW5mbz48ZHM6U2lnbmF0dXJlVmFsdWU+RGlZc3UxRXRzMzFocEJySEtvT2IvVnloRisxL1dxYjI5akE4T1J6cnZZb2h1WUlUdjV2V3oxcjhKdkpkK2NubVRNSFlZSU9hQ2V6SXd6L08yUlZ1K3IwWHEwdWNKbmhhcnQ3aUcwTTdFSGR4MVdFaGVzMWtHcHd2c1VjbnlLbm9tdnlSVklNVC80YmU3YTJLRTJZNzJkMGg3bVBsZmV4bVNvUENiaGJYSDIzc0grNTlVYjM1d3pwaXRUUFFtREFmOU5ibVAzV1I2OHpFS0VMTnRuaEZ2VUIyMHZVaGxGNi9hN3pPMlhRTmdFbzFaZW53RlBtWjdYbFhIK29BT3Q1cnFwUXNyMjN4R0tpYXV5YUpjRXpzQ0E5Z0I4YVhMYlQxR0xta1IwTndVa0RMWWxzcWwyeVZ2M01ZaHI5VjU3enk2T3dDR0dzUEltNTdlYnZ1d3RSbE5RPT08L2RzOlNpZ25hdHVyZVZhbHVlPjxkczpLZXlJbmZvPjxkczpYNTA5RGF0YT48ZHM6WDUwOUNlcnRpZmljYXRlPk1JSUZiRENDQkZTZ0F3SUJBZ0lFUUxLNTl6QU5CZ2txaGtpRzl3MEJBUVVGQURBK01Rc3dDUVlEVlFRR0V3SnphVEViTUJrR0ExVUUKQ2hNU2MzUmhkR1V0YVc1emRHbDBkWFJwYjI1ek1SSXdFQVlEVlFRTEV3bHphWFJsYzNRdFkyRXdIaGNOTVRBd016TXdNVE13T1RJegpXaGNOTVRVd016TXdNVE16T1RJeldqQ0JoakVMTUFrR0ExVUVCaE1DYzJreEd6QVpCZ05WQkFvVEVuTjBZWFJsTFdsdWMzUnBkSFYwCmFXOXVjekVTTUJBR0ExVUVDeE1KVTBsVVJWTlVMVU5CTVJrd0Z3WURWUVFMRXhCalpYSjBhV1pwWTJGMFpYTXRkMlZpTVNzd0V3WUQKVlFRREV3eFVSVk5VSUZCRlVGTWdVMGt3RkFZRFZRUUZFdzB6TURBek1qQXhNREF3TURBeE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRgpBQU9DQVE4QU1JSUJDZ0tDQVFFQTRoNkw5UHYxVEs3Zno1SzZVdXIwUmxpNkVLelp3VHR2OXhYaFN0MnhsSTR3Rld6ekZpQ3k1L08vClE1R1BSYTEwWW9NYzhzN1dtTWRNNXlJL2JVMEJGMnQ1U1l0RUg3TXdiR2FGWkZLSnQxN090YnBaQWFDU29oNmZtMXlPMEh0VlZrRzkKVWRING1zd1Mzd0hwL2QxQzkxbFFOYmEyZW5WYzJwOU5kNGdZb3AvemJyb0V0b0ZlRHlIeFRsMG1ZTi9jVUhRRlQ0SDI0aHpBZldYaAoyRk9CZk5TbnZObDJIblBKT1Q2SG5yVUJzZHl6a1N6TE4wRWlzMlIxRzUrbVFrekF3VzZVT3Jvb2p2TWNsRUpLM3oxb2VrajJPV2oxCkZoYWxUTm1BNUQ5ZGtEeW1UUm40bzNCVzJTN292bVdQbXhZVVc5czI2YmtQaHovQ2JDUXdJRjl5UFFJREFRQUJvNElDSnpDQ0FpTXcKRGdZRFZSMFBBUUgvQkFRREFnV2dNQ3NHQTFVZEVBUWtNQ0tBRHpJd01UQXdNek13TVRNd09USXpXb0VQTWpBeE5UQXpNekF4TXpNNQpNak5hTUVzR0ExVWRJQVJFTUVJd05nWUxLd1lCQkFHdldRSUJBUUl3SnpBbEJnZ3JCZ0VGQlFjQ0FSWVphSFIwY0RvdkwzZDNkeTVqCllTNW5iM1l1YzJrdlkzQnpMekFJQmdZRUFJc3dBUUl3R0FZSUt3WUJCUVVIQVFNRUREQUtNQWdHQmdRQWprWUJBVEFlQmdOVkhSRUUKRnpBVmdSTjBaWE4wTG5OcExYQmxjSE5BWjI5MkxuTnBNSUgyQmdOVkhSOEVnZTR3Z2Vzd1ZhQlRvRkdrVHpCTk1Rc3dDUVlEVlFRRwpFd0p6YVRFYk1Ca0dBMVVFQ2hNU2MzUmhkR1V0YVc1emRHbDBkWFJwYjI1ek1SSXdFQVlEVlFRTEV3bHphWFJsYzNRdFkyRXhEVEFMCkJnTlZCQU1UQkVOU1RETXdnWkdnZ1k2Z2dZdUdXR3hrWVhBNkx5OTROVEF3TG1kdmRpNXphUzl2ZFQxemFYUmxjM1F0WTJFc2J6MXoKZEdGMFpTMXBibk4wYVhSMWRHbHZibk1zWXoxemFUOWpaWEowYVdacFkyRjBaVkpsZG05allYUnBiMjVNYVhOMFAySmhjMldHTDJoMApkSEE2THk5M2QzY3VjMmxuWlc0dFkyRXVjMmt2WTNKc0wzTnBkR1Z6ZEM5emFYUmxjM1F0WTJFdVkzSnNNQjhHQTFVZEl3UVlNQmFBCkZGUkpCMGFIengySm5jcXVjcWVvb0tCcHR5SG5NQjBHQTFVZERnUVdCQlF5U2VtZURpMTBEYmVUWWoxdGtHWjVabzRtd2pBSkJnTlYKSFJNRUFqQUFNQmtHQ1NxR1NJYjJmUWRCQUFRTU1Bb2JCRlkzTGpFREFnT29NQTBHQ1NxR1NJYjNEUUVCQlFVQUE0SUJBUUFTUTRsMQpWZCtNUkRMRm8yQTZxWVlXTFZxVHZ0UExJazd2N0Jzd21xMlNGQUwyWG1Qb0w1eGJRRmVEVytMaVdoUUJtcmxnV3lJN2diaS8xL3JzCjFFMDBaNFNrbjhsOTd0dUl5dXh2Q0tURmhKRHg5cHpnVVFHb3dvQ1lvOUl6Y01OUXB4eDZsa2VwcmVDRHVjK2UwZkFidlROR0VwdlEKN0RrZ3J3SmRjc1VBRWxRNE9KMGlmRUxvYWgxREg4d3BVMzF6cjdEM1lzaXpaZ3B1NVRFSUdQNTRBT2hiRmVaRW1abFRVNmd3Tnc0aQpUZjZuVlFrR2F4c0p0NmdHR3N5TDhSVXV2d3BWUlIzV21wbEN0alhyeUdDZTRCL2FnQWUzRUtVaDE1SWFQdldxZGl4U2p5U3hqQkkxCmJOOElFRkhZUFptdXdoN1kxRlF1T1lRR2p1U0xzSnk5PC9kczpYNTA5Q2VydGlmaWNhdGU+PC9kczpYNTA5RGF0YT48L2RzOktleUluZm8+PC9kczpTaWduYXR1cmU+PHNhbWwyOlN1YmplY3Q+PHNhbWwyOk5hbWVJRCBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjEuMTpuYW1laWQtZm9ybWF0OnVuc3BlY2lmaWVkIiBOYW1lUXVhbGlmaWVyPSJodHRwOi8vQy1QRVBTLmdvdi54eCI+dXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6dW5zcGVjaWZpZWQ8L3NhbWwyOk5hbWVJRD48c2FtbDI6U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxzYW1sMjpTdWJqZWN0Q29uZmlybWF0aW9uRGF0YSBBZGRyZXNzPSI5MS4xNDMuMTA1LjM3IiBJblJlc3BvbnNlVG89Il9mMjM1OGYyZjRkYjQ0NWJkMWFjNzVjZTQxNWQ3NmE5NSIgTm90T25PckFmdGVyPSIyMDE1LTAyLTIzVDE2OjE4OjA4LjYxMVoiIFJlY2lwaWVudD0iaHR0cHM6Ly9sb2NhbGhvc3Q6ODQ0My9tb2EtaWQtYXV0aC9QRVBTQ29ubmVjdG9yIi8+PC9zYW1sMjpTdWJqZWN0Q29uZmlybWF0aW9uPjwvc2FtbDI6U3ViamVjdD48c2FtbDI6Q29uZGl0aW9ucyBOb3RCZWZvcmU9IjIwMTUtMDItMjNUMTY6MTM6MDguNjExWiIgTm90T25PckFmdGVyPSIyMDE1LTAyLTIzVDE2OjE4OjA4LjYxMVoiPjxzYW1sMjpBdWRpZW5jZVJlc3RyaWN0aW9uPjxzYW1sMjpBdWRpZW5jZT5odHRwczovL2xvY2FsaG9zdDo4NDQzL21vYS1pZC1hdXRoPC9zYW1sMjpBdWRpZW5jZT48L3NhbWwyOkF1ZGllbmNlUmVzdHJpY3Rpb24+PHNhbWwyOk9uZVRpbWVVc2UvPjwvc2FtbDI6Q29uZGl0aW9ucz48c2FtbDI6QXV0aG5TdGF0ZW1lbnQgQXV0aG5JbnN0YW50PSIyMDE1LTAyLTIzVDE2OjEzOjA4LjYxMloiPjxzYW1sMjpTdWJqZWN0TG9jYWxpdHkgQWRkcmVzcz0iOTEuMTQzLjEwNS4zNyIvPjxzYW1sMjpBdXRobkNvbnRleHQ+PHNhbWwyOkF1dGhuQ29udGV4dERlY2wvPjwvc2FtbDI6QXV0aG5Db250ZXh0Pjwvc2FtbDI6QXV0aG5TdGF0ZW1lbnQ+PHNhbWwyOkF0dHJpYnV0ZVN0YXRlbWVudD48c2FtbDI6QXR0cmlidXRlIE5hbWU9Imh0dHA6Ly93d3cuc3RvcmsuZ292LmV1LzEuMC9lSWRlbnRpZmllciIgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDp1cmkiIHN0b3JrOkF0dHJpYnV0ZVN0YXR1cz0iQXZhaWxhYmxlIj48c2FtbDI6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOmFueVR5cGUiPlNJL0FUL1E4Ny93WkcrYWYxOGZ3d1orUjJ6SlNVOG5rSGFOVWh0QW9KRTJ6RTF5SldQdjBvWjRGd2srRFJUYTZNPTwvc2FtbDI6QXR0cmlidXRlVmFsdWU+PC9zYW1sMjpBdHRyaWJ1dGU+PHNhbWwyOkF0dHJpYnV0ZSBOYW1lPSJodHRwOi8vd3d3LnN0b3JrLmdvdi5ldS8xLjAvZ2l2ZW5OYW1lIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OnVyaSIgc3Rvcms6QXR0cmlidXRlU3RhdHVzPSJBdmFpbGFibGUiPjxzYW1sMjpBdHRyaWJ1dGVWYWx1ZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4c2k6dHlwZT0ieHM6YW55VHlwZSI+SmFuZXo8L3NhbWwyOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDI6QXR0cmlidXRlPjxzYW1sMjpBdHRyaWJ1dGUgTmFtZT0iaHR0cDovL3d3dy5zdG9yay5nb3YuZXUvMS4wL2RhdGVPZkJpcnRoIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OnVyaSIgc3Rvcms6QXR0cmlidXRlU3RhdHVzPSJBdmFpbGFibGUiPjxzYW1sMjpBdHRyaWJ1dGVWYWx1ZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4c2k6dHlwZT0ieHM6YW55VHlwZSI+MTk5OTA2MDM8L3NhbWwyOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDI6QXR0cmlidXRlPjxzYW1sMjpBdHRyaWJ1dGUgTmFtZT0iaHR0cDovL3d3dy5zdG9yay5nb3YuZXUvMS4wL3NpZ25lZERvYyIgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDp1cmkiIHN0b3JrOkF0dHJpYnV0ZVN0YXR1cz0iQXZhaWxhYmxlIj48c2FtbDI6QXR0cmlidXRlVmFsdWUgeG1sbnM6eHNpPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYS1pbnN0YW5jZSIgeHNpOnR5cGU9InhzOmFueVR5cGUiPjxuczI6U2lnblJlc3BvbnNlIHhtbG5zOm5zMj0idXJuOm9hc2lzOm5hbWVzOnRjOmRzczoxLjA6Y29yZTpzY2hlbWEiIHhtbG5zPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoxLjA6YXNzZXJ0aW9uIiB4bWxuczpuczM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiIERvY1VJPSJMT0NBTC9TSS83NDljOWNiOS01YzAzLTQwY2UtYmZmOC00NTc4MDJiMzk2OTUiIFByb2ZpbGU9InVybjpvYXNpczpuYW1lczp0Yzpkc3M6MS4wOnByb2ZpbGVzOlhBZEVTOmZvcm1zOkJFUyIgUmVxdWVzdElEPSJfMWUxNjkyODliZjEwMmNlMmViYzYyMDY4Nzc4OTNjMjQiPjxuczI6UmVzdWx0PjxuczI6UmVzdWx0TWFqb3I+dXJuOm9hc2lzOm5hbWVzOnRjOmRzczoxLjA6cmVzdWx0bWFqb3I6U3VjY2VzczwvbnMyOlJlc3VsdE1ham9yPjwvbnMyOlJlc3VsdD48bnMyOk9wdGlvbmFsT3V0cHV0cz48bnMyOkRvY3VtZW50V2l0aFNpZ25hdHVyZT48bnMyOkRvY3VtZW50PjxuczI6RG9jdW1lbnRVUkw+aHR0cHM6Ly9wZXBzLXRlc3QubWp1Lmdvdi5zaS9Eb2N1bWVudFNlcnZpY2UvRG9jdW1lbnRTZXJ2aWNlPC9uczI6RG9jdW1lbnRVUkw+PC9uczI6RG9jdW1lbnQ+PC9uczI6RG9jdW1lbnRXaXRoU2lnbmF0dXJlPjwvbnMyOk9wdGlvbmFsT3V0cHV0cz48L25zMjpTaWduUmVzcG9uc2U+PC9zYW1sMjpBdHRyaWJ1dGVWYWx1ZT48L3NhbWwyOkF0dHJpYnV0ZT48c2FtbDI6QXR0cmlidXRlIE5hbWU9Imh0dHA6Ly93d3cuc3RvcmsuZ292LmV1LzEuMC9zdXJuYW1lIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OnVyaSIgc3Rvcms6QXR0cmlidXRlU3RhdHVzPSJBdmFpbGFibGUiPjxzYW1sMjpBdHRyaWJ1dGVWYWx1ZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4c2k6dHlwZT0ieHM6YW55VHlwZSI+VnpvcmVjPC9zYW1sMjpBdHRyaWJ1dGVWYWx1ZT48L3NhbWwyOkF0dHJpYnV0ZT48L3NhbWwyOkF0dHJpYnV0ZVN0YXRlbWVudD48L3NhbWwyOkFzc2VydGlvbj48L3NhbWwycDpSZXNwb25zZT4=
\ No newline at end of file
diff --git a/id/server/modules/pom.xml b/id/server/modules/pom.xml
index c164252c7..3ca3497a0 100644
--- a/id/server/modules/pom.xml
+++ b/id/server/modules/pom.xml
@@ -19,12 +19,19 @@
 		<repositoryPath>${basedir}/../../../repository</repositoryPath>
 	</properties>
 	
-	<modules>
-		<module>module-stork</module>
+	<modules>	
+		<module>moa-id-modul-citizencard_authentication</module>
+		
 		<module>module-monitoring</module>
+
 		<module>moa-id-modules-saml1</module>
 		<module>moa-id-module-openID</module>
-		<module>moa-id-modul-citizencard_authentication</module>
+		
+		<module>moa-id-module-eIDAS</module>		
+		<module>moa-id-modules-federated_authentication</module>
+		<module>moa-id-module-elga_mandate_service</module>
+		
+		<module>moa-id-module-ssoTransfer</module>
 	</modules>
 	
 	<dependencies>