move SSLSocketFactory to moa-id-commons

12 files changed, 312 insertions, 127 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/ConfigurationProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/ConfigurationProvider.java
index dc5ec430e..88ed7885f 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/ConfigurationProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/ConfigurationProvider.java
@@ -135,23 +135,11 @@ public class ConfigurationProvider {
 		return rootConfigFileDir;
 	}
 
-  /**
-     * Return the chaining mode for a given trust anchor.
-     * 
-     * @param trustAnchor The trust anchor for which the chaining mode should be
-     * returned.
-     * @return The chaining mode for the given trust anchor. If the trust anchor
-     * has not been configured separately, the system default will be returned.
-     */
-  public String getChainingMode(X509Certificate trustAnchor) {
-    Principal issuer = trustAnchor.getIssuerDN();
-    BigInteger serial = trustAnchor.getSerialNumber();
-    IssuerAndSerial issuerAndSerial = new IssuerAndSerial(issuer, serial);
-  
-    String mode = (String) chainingModes.get(issuerAndSerial);
-    return mode != null ? mode : defaultChainingMode;
+  public String getDefaultChainingMode() {
+	  return defaultChainingMode;
   }
-
+  
+  
   /**
    * Returns the trustedCACertificates.
    * @return String
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/SSLUtils.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/SSLUtils.java
index ed3f297c7..81abe3f5a 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/SSLUtils.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/SSLUtils.java
@@ -46,11 +46,7 @@
 
 package at.gv.egovernment.moa.id.util;
 
-import iaik.pki.PKIConfiguration;
 import iaik.pki.PKIException;
-import iaik.pki.PKIFactory;
-import iaik.pki.PKIProfile;
-import iaik.pki.jsse.IAIKX509TrustManager;
 import iaik.security.provider.IAIK;
 
 import java.io.BufferedInputStream;
@@ -62,26 +58,19 @@ import java.io.Reader;
 import java.net.URL;
 import java.security.GeneralSecurityException;
 import java.security.Security;
-import java.util.HashMap;
-import java.util.Map;
 
 import javax.net.ssl.HttpsURLConnection;
-import javax.net.ssl.KeyManager;
-import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLSocketFactory;
-import javax.net.ssl.TrustManager;
 
 import org.apache.regexp.RE;
 import org.apache.regexp.RESyntaxException;
 
+import at.gv.egovernment.moa.id.commons.utils.ssl.SSLConfigurationException;
 import at.gv.egovernment.moa.id.config.ConfigurationException;
 import at.gv.egovernment.moa.id.config.ConfigurationProvider;
 import at.gv.egovernment.moa.id.config.ConnectionParameter;
 import at.gv.egovernment.moa.id.config.ConnectionParameterInterface;
-import at.gv.egovernment.moa.id.iaik.config.PKIConfigurationImpl;
-import at.gv.egovernment.moa.id.iaik.pki.PKIProfileImpl;
-import at.gv.egovernment.moa.id.iaik.pki.jsse.MOAIDTrustManager;
-import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
 
 
 /**
@@ -94,14 +83,7 @@ import at.gv.egovernment.moa.logging.Logger;
  */
 public class SSLUtils {
   
-  /** SSLSocketFactory store, mapping URL->SSLSocketFactory **/
-  private static Map<String, SSLSocketFactory> sslSocketFactories = new HashMap<String, SSLSocketFactory>();
-
-  /**
-   * Initializes the SSLSocketFactory store.
-   */
   public static void initialize() {
-    sslSocketFactories = new HashMap<String, SSLSocketFactory>();
     // JSSE Abhängigkeit
     //Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
     Security.addProvider(new IAIK());
@@ -132,61 +114,38 @@ public class SSLUtils {
     ConnectionParameterInterface connParam)
     throws IOException, GeneralSecurityException, ConfigurationException, PKIException {
     
-    Logger.debug("Get SSLSocketFactory for " + connParam.getUrl());
-    // retrieve SSLSocketFactory if already created
-    SSLSocketFactory ssf = (SSLSocketFactory)sslSocketFactories.get(connParam.getUrl());
-    if (ssf != null) 
-      return ssf;
-    
-    // else create new SSLSocketFactory
-    String trustStoreURL = conf.getTrustedCACertificates();
-    
-    if (trustStoreURL == null)
-      throw new ConfigurationException(
-        "config.08", new Object[] {"TrustedCACertificates"});
-    String acceptedServerCertURL = connParam.getAcceptedServerCertificates();
-    
-    TrustManager[] tms = getTrustManagers(conf, trustStoreURL, acceptedServerCertURL);
-    
-    KeyManager[] kms = at.gv.egovernment.moa.util.SSLUtils.getKeyManagers(
-      "pkcs12", connParam.getClientKeyStore(), connParam.getClientKeyStorePassword());
-    SSLContext ctx = SSLContext.getInstance("TLS");
-    ctx.init(kms, tms, null);    ssf = ctx.getSocketFactory();
-    // store SSLSocketFactory
-    sslSocketFactories.put(connParam.getUrl(), ssf);
-    return ssf;
+	    // else create new SSLSocketFactory
+	    String trustStoreURL = conf.getTrustedCACertificates();
+	    
+	    if (trustStoreURL == null)
+	      throw new ConfigurationException(
+	        "config.08", new Object[] {"TrustedCACertificates"});
+	    
+	    String acceptedServerCertURL = connParam.getAcceptedServerCertificates();
+ 	    
+   	   //INFO: MOA-ID 2.x always use defaultChainingMode 
+	    
+	    try {	    
+	    	SSLSocketFactory ssf =  
+	    			at.gv.egovernment.moa.id.commons.utils.ssl.SSLUtils.getSSLSocketFactory(
+	    					connParam.getUrl(), 
+	    					conf.getCertstoreDirectory(), 
+	    					trustStoreURL, 
+	    					acceptedServerCertURL, 
+	    					AuthConfigurationProvider.getInstance().getDefaultChainingMode(), 
+	    					AuthConfigurationProvider.getInstance().isTrustmanagerrevoationchecking(), 
+	    					connParam.getClientKeyStore(), 
+	    					connParam.getClientKeyStorePassword(), 
+	    					"pkcs12");
+	    		    	
+	    	return ssf;
+	    	
+	    } catch (SSLConfigurationException e) {
+	    	throw new ConfigurationException(e.getErrorID(), e.getParameters(), e.getE());
+	    	
+	    }
   }
   
-  
-  /**
-   * Initializes an <code>IAIKX509TrustManager</code> for a given trust store,
-   * using configuration data.
-   * 
-   * @param conf MOA-ID configuration provider
-   * @param trustStoreURL trust store URL
-   * @param acceptedServerCertURL file URL pointing to directory containing accepted server SSL certificates
-   * @return <code>TrustManager</code> array containing the <code>IAIKX509TrustManager</code>
-   * @throws ConfigurationException on invalid configuration data
-   * @throws IOException on data-reading problems
-   * @throws PKIException while initializing the <code>IAIKX509TrustManager</code>
-   */
-  public static TrustManager[] getTrustManagers(
-    ConfigurationProvider conf, String trustStoreURL, String acceptedServerCertURL) 
-    throws ConfigurationException, PKIException, IOException, GeneralSecurityException {
-
-    PKIConfiguration cfg = null;
-    if (! PKIFactory.getInstance().isAlreadyConfigured())
-      cfg = new PKIConfigurationImpl(conf);
-    boolean checkRevocation = conf.isTrustmanagerrevoationchecking();
-    PKIProfile profile = new PKIProfileImpl(trustStoreURL, checkRevocation);
-    // This call fixes a bug occuring when PKIConfiguration is
-    // initialized by the MOA-SP initialization code, in case
-    // MOA-SP is called by API
-    MOAIDTrustManager.initializeLoggingContext();    
-    IAIKX509TrustManager tm = new MOAIDTrustManager(acceptedServerCertURL);
-    tm.init(cfg, profile);
-    return new TrustManager[] {tm};
-  }
   /**
    * Reads a file, given by URL, into a byte array, 
    * securing the connection by IAIKX509TrustManager.
diff --git a/id/server/moa-id-commons/pom.xml b/id/server/moa-id-commons/pom.xml
index 2fd8c4483..81513518f 100644
--- a/id/server/moa-id-commons/pom.xml
+++ b/id/server/moa-id-commons/pom.xml
@@ -70,6 +70,11 @@
             <type>jar</type>
         </dependency>
 
+				<dependency>
+					<groupId>iaik.prod</groupId>
+					<artifactId>iaik_X509TrustManager</artifactId>
+				</dependency>
+
         <!-- dependency>
             <groupId>com.sun.xml.bind</groupId>
             <artifactId>jaxb-xjc</artifactId>
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/config/CertStoreConfigurationImpl.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/CertStoreConfigurationImpl.java
index b6fe20a61..00e750f58 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/config/CertStoreConfigurationImpl.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/CertStoreConfigurationImpl.java
@@ -44,11 +44,8 @@
  */
 
 
-package at.gv.egovernment.moa.id.iaik.config;
+package at.gv.egovernment.moa.id.commons.utils.ssl;
 
-import at.gv.egovernment.moa.id.config.ConfigurationException;
-import at.gv.egovernment.moa.id.config.ConfigurationProvider;
-import at.gv.egovernment.moa.id.iaik.servertools.observer.ObservableImpl;
 import at.gv.egovernment.moa.logging.Logger;
 import iaik.pki.store.certstore.CertStoreConfiguration;
 import iaik.pki.store.certstore.CertStoreParameters;
@@ -69,10 +66,7 @@ public class CertStoreConfigurationImpl extends ObservableImpl
      * identifies the rootDirectory
      */
     private String rootDirectory;
-    /**
-     * ConfigurationProvider
-     */
-    private ConfigurationProvider conf;
+
     /**
      * Array for storing all CertStoreParameters
      */
@@ -85,13 +79,10 @@ public class CertStoreConfigurationImpl extends ObservableImpl
      * @throws ConfigurationException an any config-error
      *                                being read.
      */
-    public CertStoreConfigurationImpl(ConfigurationProvider conf) throws ConfigurationException {
-        this.conf = conf;
-
-        String certStoreRootDirParam = conf.getCertstoreDirectory();
+    public CertStoreConfigurationImpl(String certStoreRootDirParam) throws SSLConfigurationException {
 
         if (certStoreRootDirParam == null)
-            throw new ConfigurationException(
+            throw new SSLConfigurationException(
                     "config.08", new Object[]{"CertStoreDirectory"});
 
         //rootDirectory = FileUtils.makeAbsoluteURL(certStoreRootDirParam, conf.getRootConfigFileDir());
@@ -105,13 +96,13 @@ public class CertStoreConfigurationImpl extends ObservableImpl
 
         if (!f.exists()) {
             Logger.error("File does not exists: " + f.getAbsolutePath());
-            throw new ConfigurationException(
+            throw new SSLConfigurationException(
                     "config.05", new Object[]{"CertStoreDirectory"});
         }
 
         if (!f.isDirectory()) {
             Logger.error("File is not a directory: " + f.getAbsolutePath());
-            throw new ConfigurationException(
+            throw new SSLConfigurationException(
                     "config.05", new Object[]{"CertStoreDirectory"});
         }
 
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/pki/jsse/MOAIDTrustManager.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/MOAIDTrustManager.java
index 202be882e..eaef3f1d4 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/pki/jsse/MOAIDTrustManager.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/MOAIDTrustManager.java
@@ -44,7 +44,7 @@
  */
 
 
-package at.gv.egovernment.moa.id.iaik.pki.jsse;
+package at.gv.egovernment.moa.id.commons.utils.ssl;
 
 import java.io.File;
 import java.io.FileInputStream;
@@ -56,7 +56,6 @@ import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.List;
 
-import at.gv.egovernment.moa.id.util.MOAIDMessageProvider;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.logging.LoggingContext;
 import at.gv.egovernment.moa.logging.LoggingContextManager;
@@ -150,7 +149,7 @@ public class MOAIDTrustManager extends IAIKX509TrustManager {
         if (serverCert.equals(acceptedServerCert))
           return true;
       }
-      Logger.warn(MOAIDMessageProvider.getInstance().getMessage("ssl.01", null));
+      Logger.warn("SSL certificate validation FAILED.");
       return false;
     }
   }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/servertools/observer/ObservableImpl.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/ObservableImpl.java
index 16184502d..fa9cd879d 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/servertools/observer/ObservableImpl.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/ObservableImpl.java
@@ -44,7 +44,7 @@
  */
 
 
-package at.gv.egovernment.moa.id.iaik.servertools.observer;
+package at.gv.egovernment.moa.id.commons.utils.ssl;
 
 import iaik.pki.store.observer.NotificationData;
 import iaik.pki.store.observer.Observable;
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/config/PKIConfigurationImpl.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/PKIConfigurationImpl.java
index 064d8a835..5d8c7a54e 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/config/PKIConfigurationImpl.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/PKIConfigurationImpl.java
@@ -44,10 +44,8 @@
  */
 
 
-package at.gv.egovernment.moa.id.iaik.config;
+package at.gv.egovernment.moa.id.commons.utils.ssl;
 
-import at.gv.egovernment.moa.id.config.ConfigurationException;
-import at.gv.egovernment.moa.id.config.ConfigurationProvider;
 import iaik.pki.PKIConfiguration;
 import iaik.pki.pathvalidation.ValidationConfiguration;
 import iaik.pki.revocation.RevocationConfiguration;
@@ -74,11 +72,11 @@ public class PKIConfigurationImpl implements PKIConfiguration {
    * @param conf the Configuration for the PKIConfig
    * @throws ConfigurationException for any config error
    */
-  public PKIConfigurationImpl(ConfigurationProvider conf) throws ConfigurationException {
+  public PKIConfigurationImpl(String certStoreRootDirParam, String chainingMode) throws SSLConfigurationException {
     
-    certStoreConfiguration = new CertStoreConfigurationImpl(conf);
+    certStoreConfiguration = new CertStoreConfigurationImpl(certStoreRootDirParam);
     revocationConfiguration = new RevocationConfigurationImpl();
-    validationConfiguration = new ValidationConfigurationImpl(conf);
+    validationConfiguration = new ValidationConfigurationImpl(chainingMode);
   }
 
   /**
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/pki/PKIProfileImpl.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/PKIProfileImpl.java
index 8afba2a12..59994a257 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/pki/PKIProfileImpl.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/PKIProfileImpl.java
@@ -44,7 +44,7 @@
  */
 
 
-package at.gv.egovernment.moa.id.iaik.pki;
+package at.gv.egovernment.moa.id.commons.utils.ssl;
 
 import java.security.cert.X509Certificate;
 import java.util.Collections;
@@ -57,8 +57,6 @@ import iaik.pki.revocation.RevocationSourceTypes;
 import iaik.pki.store.truststore.TrustStoreProfile;
 import iaik.pki.store.truststore.TrustStoreTypes;
 
-import at.gv.egovernment.moa.id.iaik.servertools.observer.ObservableImpl;
-
 /**
  * Implementation of the <code>PKIProfile</code> interface and subinterfaces
  * providing information needed for certificate path validation.
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/config/RevocationConfigurationImpl.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/RevocationConfigurationImpl.java
index 2c24161f6..b5e0543db 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/config/RevocationConfigurationImpl.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/RevocationConfigurationImpl.java
@@ -44,7 +44,7 @@
  */
 
 
-package at.gv.egovernment.moa.id.iaik.config;
+package at.gv.egovernment.moa.id.commons.utils.ssl;
 
 import iaik.pki.revocation.RevocationConfiguration;
 
@@ -53,8 +53,6 @@ import java.util.Collections;
 import java.util.Date;
 import java.util.Set;
 
-import at.gv.egovernment.moa.id.iaik.servertools.observer.ObservableImpl;
-
 /**
  * Implementation of interface needed to initialize an IAIK JSSE <code>TrustManager</code>
  * @author Paul Ivancsics
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/SSLConfigurationException.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/SSLConfigurationException.java
new file mode 100644
index 000000000..b1334ad67
--- /dev/null
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/SSLConfigurationException.java
@@ -0,0 +1,71 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.commons.utils.ssl;
+
+/**
+ * @author tlenz
+ *
+ */
+public class SSLConfigurationException extends Exception {
+
+	private static final long serialVersionUID = -3705679559648920151L;
+
+	private String errorID = null;
+	private Object[] parameters = null;
+	private Throwable e = null;
+	
+	public SSLConfigurationException(String errorID, Object[] parameters) {
+		this.errorID = errorID;
+		this.parameters = parameters;
+	}
+	
+	public SSLConfigurationException(String errorID, Object[] parameters, Throwable e) {
+		this.errorID = errorID;
+		this.parameters = parameters;
+		this.e = e;
+	}
+
+	/**
+	 * @return the errorID
+	 */
+	public String getErrorID() {
+		return errorID;
+	}
+
+	/**
+	 * @return the parameters
+	 */
+	public Object[] getParameters() {
+		return parameters;
+	}
+
+	/**
+	 * @return the e
+	 */
+	public Throwable getE() {
+		return e;
+	}
+	
+	
+	
+}
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/SSLUtils.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/SSLUtils.java
new file mode 100644
index 000000000..eed8b25e0
--- /dev/null
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/SSLUtils.java
@@ -0,0 +1,178 @@
+/*******************************************************************************
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ * 
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ * 
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ ******************************************************************************/
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.commons.utils.ssl;
+
+import iaik.pki.PKIConfiguration;
+import iaik.pki.PKIException;
+import iaik.pki.PKIFactory;
+import iaik.pki.PKIProfile;
+import iaik.pki.jsse.IAIKX509TrustManager;
+import iaik.security.provider.IAIK;
+
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import java.security.Security;
+import java.util.HashMap;
+import java.util.Map;
+
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLSocketFactory;
+import javax.net.ssl.TrustManager;
+
+import at.gv.egovernment.moa.logging.Logger;
+
+
+/**
+ * Utility for a obtaining a secure socket factory using <code>IAIKX509TrustManager</code>.
+ * This <code>TrustManager</code> implementation features CRL checking.<br/>
+ * <code>SSLUtils</code> caches secure socket factories for given <code>ConnectionParameter</code>s. 
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class SSLUtils {
+  
+  /** SSLSocketFactory store, mapping URL->SSLSocketFactory **/
+  private static Map<String, SSLSocketFactory> sslSocketFactories = new HashMap<String, SSLSocketFactory>();
+
+  /**
+   * Initializes the SSLSocketFactory store.
+   */
+  public static void initialize() {
+    sslSocketFactories = new HashMap<String, SSLSocketFactory>();
+    // JSSE Abhängigkeit
+    //Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
+    Security.addProvider(new IAIK());
+    //System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");
+    
+    
+  }
+  
+  /**
+   * Creates an <code>SSLSocketFactory</code> which utilizes an
+   * <code>IAIKX509TrustManager</code> for the given trust store,
+   * and the given key store.
+   * 
+   * @param conf configuration provider providing a generic properties pointing 
+   *         to trusted CA store and certificate store root
+   * @param connParam connection parameter containing the client key store settings
+   *         to be used in case of client authentication; 
+   *         if <code>connParam.getClientKeyStore() == null</code>, client authentication
+   *         is assumed to be disabled
+   * @return <code>SSLSocketFactory</code> to be used by an <code>HttpsURLConnection</code>
+   * @throws IOException thrown while reading key store file
+   * @throws GeneralSecurityException thrown while creating the socket factory
+   * @throws ConfigurationException on invalid configuration data
+   * @throws PKIException while initializing the <code>IAIKX509TrustManager</code>
+   */
+  public static SSLSocketFactory getSSLSocketFactory(
+		  String url, 
+		  String certStoreRootDirParam, 
+		  String trustStoreURL, 
+		  String acceptedServerCertURL,
+		  String chainingMode,
+		  boolean checkRevocation,
+		  String clientKeyStoreURL,
+		  String clientKeyStorePassword,
+		  String clientKeyStoreType
+		  ) 
+    throws IOException, GeneralSecurityException, SSLConfigurationException, PKIException {
+    
+    Logger.debug("Get SSLSocketFactory for " + url);
+    // retrieve SSLSocketFactory if already created
+    SSLSocketFactory ssf = (SSLSocketFactory)sslSocketFactories.get(url);
+    if (ssf != null) 
+      return ssf;
+        
+    TrustManager[] tms = getTrustManagers(
+    		 certStoreRootDirParam,
+    		 chainingMode,    		 
+    		 trustStoreURL, 
+    		 acceptedServerCertURL,
+    		 checkRevocation);
+    
+    KeyManager[] kms = at.gv.egovernment.moa.util.SSLUtils.getKeyManagers(
+      clientKeyStoreType, clientKeyStoreURL, clientKeyStorePassword);
+    SSLContext ctx = SSLContext.getInstance("TLS");
+    ctx.init(kms, tms, null);    ssf = ctx.getSocketFactory();
+    // store SSLSocketFactory
+    sslSocketFactories.put(url, ssf);
+    return ssf;
+  }
+  
+  
+  /**
+   * Initializes an <code>IAIKX509TrustManager</code> for a given trust store,
+   * using configuration data.
+   * 
+   * @param conf MOA-ID configuration provider
+   * @param trustStoreURL trust store URL
+   * @param acceptedServerCertURL file URL pointing to directory containing accepted server SSL certificates
+   * @return <code>TrustManager</code> array containing the <code>IAIKX509TrustManager</code>
+   * @throws ConfigurationException on invalid configuration data
+   * @throws IOException on data-reading problems
+   * @throws PKIException while initializing the <code>IAIKX509TrustManager</code>
+   */
+  public static TrustManager[] getTrustManagers(String certStoreRootDirParam, 
+		  String chainingMode, String trustStoreURL, String acceptedServerCertURL,
+    boolean checkRevocation) 
+    throws SSLConfigurationException, PKIException, IOException, GeneralSecurityException {
+
+    PKIConfiguration cfg = null;
+    if (! PKIFactory.getInstance().isAlreadyConfigured())
+      cfg = new PKIConfigurationImpl(certStoreRootDirParam, chainingMode);
+    PKIProfile profile = new PKIProfileImpl(trustStoreURL, checkRevocation);
+    // This call fixes a bug occuring when PKIConfiguration is
+    // initialized by the MOA-SP initialization code, in case
+    // MOA-SP is called by API
+    MOAIDTrustManager.initializeLoggingContext();    
+    IAIKX509TrustManager tm = new MOAIDTrustManager(acceptedServerCertURL);
+    tm.init(cfg, profile);
+    return new TrustManager[] {tm};
+  }
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/config/ValidationConfigurationImpl.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/ValidationConfigurationImpl.java
index d230eef26..275aed4c4 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/iaik/config/ValidationConfigurationImpl.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/ValidationConfigurationImpl.java
@@ -44,15 +44,13 @@
  */
 
 
-package at.gv.egovernment.moa.id.iaik.config;
+package at.gv.egovernment.moa.id.commons.utils.ssl;
 
 import iaik.pki.pathvalidation.ValidationConfiguration;
 
 import java.security.cert.X509Certificate;
 import java.security.spec.AlgorithmParameterSpec;
 
-import at.gv.egovernment.moa.id.config.ConfigurationProvider;
-import at.gv.egovernment.moa.id.iaik.servertools.observer.ObservableImpl;
 
 /**
  * Implementation of interface needed to initialize an IAIK JSSE <code>TrustManager</code>
@@ -62,21 +60,23 @@ import at.gv.egovernment.moa.id.iaik.servertools.observer.ObservableImpl;
 public class ValidationConfigurationImpl extends ObservableImpl
   implements ValidationConfiguration {
   /** The ConfigurationProvider for the validation*/
-  private ConfigurationProvider conf;
+  private String chainingMode;
     
   /**
    * Constructor
    * @param conf with the configuration
    */
-  public ValidationConfigurationImpl(ConfigurationProvider conf) {
-    this.conf = conf;
+  public ValidationConfigurationImpl(String chainingMode) {
+    this.chainingMode = chainingMode;
   }
 
   /**
    * @see iaik.pki.pathvalidation.ValidationConfiguration#getChainingMode(java.security.cert.X509Certificate)
    */
   public String getChainingMode(X509Certificate trustAnchor) {
-    String chainingMode = conf.getChainingMode(trustAnchor);
+
+	  //INFO: MOA-ID 2.x always use defaultChainingMode
+	  
     return chainingMode;
   }