Merge branch 'eIDAS_node_implementation_remote' into moapid-3.2-opb-redis

Conflicts:
	id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractController.java
	id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/dao/session/AssertionStore.java

140 files changed, 3736 insertions, 2936 deletions

diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java
index f549db9f3..3062a61e3 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/Constants.java
@@ -22,11 +22,10 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.configuration;
 
+import java.util.Collections;
 import java.util.Hashtable;
 import java.util.Map;
 
-import java.util.Collections;
-
 public class Constants {
 	
 	public static final String DEFAULT_VERSION = "1.x";
@@ -96,6 +95,7 @@ public class Constants {
 	public static final String IDENIFICATIONTYPE_ERSB = "ERSB";
 	public static final String IDENIFICATIONTYPE_ZVR = "ZVR";
     public static final String IDENIFICATIONTYPE_STORK = "STORK";
+    public static final String IDENIFICATIONTYPE_EIDAS = "eIDAS";
     public static final String IDENIFICATIONTYPE_BASEID = "urn:publicid:gv.at:baseid+";
 	
 	public static final String IDENIFICATIONTYPE_BASEID_FN = IDENIFICATIONTYPE_BASEID + "X" + IDENIFICATIONTYPE_FN;
@@ -103,6 +103,7 @@ public class Constants {
 			
 	public static final String PREFIX_WPBK = "urn:publicid:gv.at:wbpk+";
     public static final String PREFIX_STORK = "urn:publicid:gv.at:storkid+";
+    public static final String PREFIX_EIDAS = "urn:publicid:gv.at:eidasid+";
 
 
     public static final Map<String, String> BUSINESSSERVICENAMES;
@@ -113,6 +114,7 @@ public class Constants {
 		tmp.put(IDENIFICATIONTYPE_ZVR, "Vereinsnummer");
 		tmp.put(IDENIFICATIONTYPE_ERSB, "ERsB Kennzahl");
         tmp.put(IDENIFICATIONTYPE_STORK, "STORK");
+        tmp.put(IDENIFICATIONTYPE_EIDAS, "eIDAS");
 
         BUSINESSSERVICENAMES = Collections.unmodifiableMap(tmp);
 	}
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java
index ab6c22858..41a82fe1e 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java
@@ -22,8 +22,6 @@
  *******************************************************************************/
 package at.gv.egovernment.moa.id.configuration.config;
 
-import iaik.x509.X509Certificate;
-
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileNotFoundException;
@@ -65,6 +63,7 @@ import at.gv.egovernment.moa.id.configuration.config.usermanagement.FileBasedUse
 import at.gv.egovernment.moa.id.configuration.utils.UserRequestCleaner;
 import at.gv.egovernment.moa.util.FileUtils;
 import at.gv.egovernment.moa.util.MiscUtil;
+import iaik.x509.X509Certificate;
 
 
 public class ConfigurationProvider {
@@ -590,7 +589,7 @@ public class ConfigurationProvider {
 				}
 			}
 			
-			idpMetadataProvider = new HTTPMetadataProvider(new Timer(), httpClient, metadataurl);  
+			idpMetadataProvider = new HTTPMetadataProvider(new Timer(true), httpClient, metadataurl);  
 			idpMetadataProvider.setRequireValidMetadata(true);  
 			idpMetadataProvider.setParserPool(new BasicParserPool());
 			idpMetadataProvider.setMetadataFilter(new MetaDataVerificationFilter(idpCredential));
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/GeneralMOAIDConfig.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/GeneralMOAIDConfig.java
index 95af93af3..ebd2d6283 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/GeneralMOAIDConfig.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/GeneralMOAIDConfig.java
@@ -281,7 +281,7 @@ public class GeneralMOAIDConfig {
 					
 					OAuth oauth = protocols.getOAuth();
 					if (oauth != null) {
-						protocolActiveOAuth = saml1.isIsActive();
+						protocolActiveOAuth = oauth.isIsActive();
 						
 					}
 					
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/GeneralStorkConfig.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/GeneralStorkConfig.java
index d8bb0179c..e71bad299 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/GeneralStorkConfig.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/GeneralStorkConfig.java
@@ -25,6 +25,8 @@ package at.gv.egovernment.moa.id.configuration.data;
 import java.util.ArrayList;
 import java.util.List;
 
+import org.apache.log4j.Logger;
+
 import at.gv.egovernment.moa.id.commons.db.dao.config.deprecated.AuthComponentGeneral;
 import at.gv.egovernment.moa.id.commons.db.dao.config.deprecated.CPEPS;
 import at.gv.egovernment.moa.id.commons.db.dao.config.deprecated.ForeignIdentities;
@@ -34,8 +36,6 @@ import at.gv.egovernment.moa.id.commons.db.dao.config.deprecated.StorkAttribute;
 import at.gv.egovernment.moa.id.config.webgui.exception.ConfigurationException;
 import at.gv.egovernment.moa.id.configuration.config.ConfigurationProvider;
 
-import org.apache.log4j.Logger;
-
 public class GeneralStorkConfig {
 
 	private List<CPEPS> cpepslist;
@@ -61,7 +61,9 @@ public class GeneralStorkConfig {
     	
     public void parse(MOAIDConfiguration config) {
         log.info("Initializing general Stork config");
-
+  
+        cpepslist = new ArrayList<CPEPS>();
+		attributes = new ArrayList<StorkAttribute>();
 
 		if (config != null) {
 			AuthComponentGeneral auth = config.getAuthComponentGeneral();
@@ -71,15 +73,14 @@ public class GeneralStorkConfig {
 
 				if (foreign != null) {
 					STORK stork = foreign.getSTORK();
-					cpepslist = new ArrayList<CPEPS>();
-					attributes = new ArrayList<StorkAttribute>();
-					
+										
 					if (stork != null) {
 						// deep clone all the things
-						// to foreclose lazyloading session timeouts
-						
-						for(CPEPS current : stork.getCPEPS()) {
-							cpepslist.add(current);
+						// to foreclose lazyloading session timeouts						
+						if (stork.getCPEPS() != null) {
+							for(CPEPS current : stork.getCPEPS()) {
+								cpepslist.add(current);
+							}
 						}
 						
 						List<StorkAttribute> tmp = stork.getAttributes();
@@ -91,19 +92,26 @@ public class GeneralStorkConfig {
 
 						try {
 							qaa = stork.getQualityAuthenticationAssuranceLevel();
+							
 						} catch(NullPointerException e) {
 							qaa = 4;
 						}
 					}
 					
-					if (cpepslist.isEmpty())
-						cpepslist = null;
-					
-					if(attributes.isEmpty())
-						attributes.add(new StorkAttribute());
 				}
 			}
 		}
+		
+		if (cpepslist.isEmpty()) {
+			CPEPS defaultCPEPS = new CPEPS();
+			defaultCPEPS.setCountryCode("CC");
+			defaultCPEPS.setURL("http://");
+			defaultCPEPS.setSupportsXMLSignature(true);
+			cpepslist.add(defaultCPEPS );
+		
+		}
+		if(attributes.isEmpty())
+			attributes.add(new StorkAttribute());
 	}
 
     public List<CPEPS> getRawCPEPSList() {
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OASTORKConfig.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OASTORKConfig.java
index 33277af07..c0e1eaaf7 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OASTORKConfig.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OASTORKConfig.java
@@ -41,6 +41,7 @@ import at.gv.egovernment.moa.id.config.webgui.exception.ConfigurationException;
 import at.gv.egovernment.moa.id.configuration.auth.AuthenticatedUser;
 import at.gv.egovernment.moa.id.configuration.config.ConfigurationProvider;
 import at.gv.egovernment.moa.id.configuration.validation.oa.OASTORKConfigValidation;
+import at.gv.egovernment.moa.util.MiscUtil;
 //import at.gv.egovernment.moa.id.protocols.stork2.AttributeProviderFactory;
 
 public class OASTORKConfig implements IOnlineApplicationData{
@@ -120,8 +121,10 @@ public class OASTORKConfig implements IOnlineApplicationData{
 				
 
 				enabledCitizenCountries = new ArrayList<String>();
-				for(CPEPS current : config.getCPEPS())
-					enabledCitizenCountries.add(current.getCountryCode());
+				if (config.getCPEPS() != null) {
+					for(CPEPS current : config.getCPEPS())
+						enabledCitizenCountries.add(current.getCountryCode());
+				}
 
 				// prepare attribute helper list
 				attributes = new ArrayList<AttributeHelper>();
@@ -130,9 +133,11 @@ public class OASTORKConfig implements IOnlineApplicationData{
                 		for(StorkAttribute current : dbconfig.getAuthComponentGeneral().getForeignIdentities().getSTORK().getAttributes()) {
                 			AttributeHelper tmp = null;
 
-                			for(OAStorkAttribute sepp : config.getOAAttributes())
-                				if(sepp.getName().equals(current.getName()))
-                					tmp = new AttributeHelper(sepp);
+                			if (config.getOAAttributes() != null) {
+                				for(OAStorkAttribute sepp : config.getOAAttributes())
+                					if(sepp.getName() != null && sepp.getName().equals(current.getName()))
+                						tmp = new AttributeHelper(sepp);
+                			}
 
                 			if(null == tmp)
                 				tmp = new AttributeHelper(current);
@@ -248,12 +253,14 @@ public class OASTORKConfig implements IOnlineApplicationData{
 			
 			if (generalConfStorkAttr != null) {
 				for(StorkAttribute currentAttribute : generalConfStorkAttr)
-					if(currentAttribute.getName().equals(current.getName())) {
+					if(MiscUtil.isNotEmpty(currentAttribute.getName()) && 
+							currentAttribute.getName().equals(current.getName())) {
 						if(current.isUsed() || currentAttribute.isMandatory()) {
 							OAStorkAttribute tmp = new OAStorkAttribute();
 							tmp.setName(current.getName());
 							tmp.setMandatory(current.isMandatory());
 							result.add(tmp);
+							
 						}
 						break;
 					}
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OATargetConfiguration.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OATargetConfiguration.java
index 19671e502..f660b5feb 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OATargetConfiguration.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/data/oa/OATargetConfiguration.java
@@ -65,7 +65,8 @@ public class OATargetConfiguration implements IOnlineApplicationData {
 				 Constants.IDENIFICATIONTYPE_FN,
 				 Constants.IDENIFICATIONTYPE_ZVR,
 				 Constants.IDENIFICATIONTYPE_ERSB,
-                Constants.IDENIFICATIONTYPE_STORK);
+                Constants.IDENIFICATIONTYPE_STORK,
+                Constants.IDENIFICATIONTYPE_EIDAS);
 	}
 	
 	
@@ -120,6 +121,12 @@ public class OATargetConfiguration implements IOnlineApplicationData {
 					if (Constants.PREFIX_WPBK.startsWith(split[0]) && split.length >= 2) {
 						identificationType = split[1];
 						identificationNumber = split[2];
+					
+					} else if (Constants.PREFIX_EIDAS.startsWith(split[0]) && split.length >= 2) {
+                        //identificationType = split[1]; // setting at as iden category ?
+                        identificationType = Constants.IDENIFICATIONTYPE_EIDAS;
+                        identificationNumber = split[1] + "+" + split[2]; // setting sp country as ident type -> sp ident						
+						
 					} else if (Constants.PREFIX_STORK.startsWith(split[0]) && split.length >= 2) {
                         //identificationType = split[1]; // setting at as iden category ?
                         identificationType = Constants.IDENIFICATIONTYPE_STORK;
@@ -185,7 +192,11 @@ public class OATargetConfiguration implements IOnlineApplicationData {
 			if (idnumber == null)
 				idnumber = new IdentificationNumber();
 
-            if (getIdentificationType().equals(Constants.IDENIFICATIONTYPE_STORK)) {
+            if (getIdentificationType().equals(Constants.IDENIFICATIONTYPE_EIDAS)) {
+                idnumber.setValue(Constants.PREFIX_EIDAS + num);
+                idnumber.setType(Constants.BUSINESSSERVICENAMES.get(getIdentificationType()));
+			
+            } else if (getIdentificationType().equals(Constants.IDENIFICATIONTYPE_STORK)) {
                 idnumber.setValue(Constants.PREFIX_STORK + "AT" + "+" + num);
                 idnumber.setType(Constants.BUSINESSSERVICENAMES.get(getIdentificationType()));
             } else {
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/BasicOAAction.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/BasicOAAction.java
index c80bc1925..5022be915 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/BasicOAAction.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/BasicOAAction.java
@@ -29,6 +29,8 @@ import java.io.FileInputStream;
 import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.io.StringWriter;
+import java.io.UnsupportedEncodingException;
+import java.net.URI;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Iterator;
@@ -84,7 +86,7 @@ public class BasicOAAction extends BasicAction {
     private boolean newOA;
     private boolean isMetaDataRefreshRequired = false;
     
-    private InputStream stream;
+    private InputStream stream = null;
     
     /**
 	 * 
@@ -303,7 +305,10 @@ public class BasicOAAction extends BasicAction {
 	                    if (onlineapplication != null) {
 	                        log.info("The OAIdentifier is not unique");
 	                    	throw new BasicOAActionException(
-	                    			LanguageHelper.getErrorString("validation.general.oaidentifier.notunique", request), 
+	                    			LanguageHelper.getErrorString(
+	                    					"validation.general.oaidentifier.notunique", 
+	                    					new Object[]{onlineapplication.getPublicURLPrefix()}, 
+	                    					request), 
 	                        		Constants.STRUTS_ERROR_VALIDATION);
 	                    	
 	                    } else	                    
@@ -326,7 +331,10 @@ public class BasicOAAction extends BasicAction {
 	                        if ( (dbOA != null && !dbOA.getHjid().equals(oaid))) {
 	                        	log.info("The OAIdentifier is not unique");
 	                        	throw new BasicOAActionException(
-	                        			LanguageHelper.getErrorString("validation.general.oaidentifier.notunique", request), 
+	                        			LanguageHelper.getErrorString(
+	                        					"validation.general.oaidentifier.notunique",
+	                        					new Object[]{dbOA.getPublicURLPrefix()},
+	                        					request), 
 	                        			Constants.STRUTS_ERROR_VALIDATION);
 	                           
 	                        }
@@ -587,8 +595,8 @@ public class BasicOAAction extends BasicAction {
                 ConfigurationProvider config = ConfigurationProvider.getInstance();
                 String templateURL = config.getConfigRootDir() + ConfigurationProvider.HTMLTEMPLATE_DIR
                         + ConfigurationProvider.HTMLTEMPLATE_FILE;
-
-                File file = new File(templateURL);
+                
+                File file = new File(new URI(templateURL));
                 input = new FileInputStream(file);
 
                 String contextpath = config.getMOAIDInstanceURL();
@@ -656,6 +664,15 @@ public class BasicOAAction extends BasicAction {
 
         }
 
+        if (stream == null && MiscUtil.isNotEmpty(preview)) {
+			try {
+				stream = new ByteArrayInputStream(preview.getBytes("UTF-8"));
+				
+			} catch (UnsupportedEncodingException e) {
+				e.printStackTrace();
+				
+			}
+        }
         
 
         return Constants.STRUTS_SUCCESS;
@@ -699,12 +716,13 @@ public class BasicOAAction extends BasicAction {
     public void setPvp2OA(OAPVP2Config pvp2oa) {
     	formList.put(pvp2oa.getName(), pvp2oa);
     }
-    
-    /**
-     * @return the stream
-     */
-    public InputStream getStream() {
-        return stream;
-    }
-    
+
+	/**
+	 * @return the stream
+	 */
+	public InputStream getStream() {
+		return stream;
+	}
+
+
 }
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditGeneralConfigAction.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditGeneralConfigAction.java
index 504b598c0..40e9b1a90 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditGeneralConfigAction.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/struts/action/EditGeneralConfigAction.java
@@ -542,42 +542,71 @@ public class EditGeneralConfigAction extends BasicAction {
 			forcon.setURL(moaconfig.getSzrgwURL());
 		}
 		
-            ForeignIdentities foreign = dbauth.getForeignIdentities();
-			if (foreign != null) {
-				STORK stork = foreign.getSTORK();
-				if (stork == null) {
-					stork = new STORK();
-					foreign.setSTORK(stork);
-					
-				}
-
-                try {
-                log.error("QAAAA " + storkconfig.getDefaultQaa());
-				stork.setQualityAuthenticationAssuranceLevel(storkconfig.getDefaultQaa());
+        ForeignIdentities foreign = dbauth.getForeignIdentities();
+		if (foreign != null) {
+			STORK stork = foreign.getSTORK();
+			if (stork == null) {
+				stork = new STORK();
+				foreign.setSTORK(stork);
 				
-				if (storkconfig.getAttributes() != null)
-					stork.setAttributes(storkconfig.getAttributes());
-				
-				else
+			}
+
+            try {
+            	log.error("QAAAA " + storkconfig.getDefaultQaa());
+            	stork.setQualityAuthenticationAssuranceLevel(storkconfig.getDefaultQaa());
+			
+				if (storkconfig.getAttributes() != null) {
+					List<StorkAttribute> dbStorkAttr = new ArrayList<StorkAttribute>();
+					stork.setAttributes(dbStorkAttr);
+						
+					
+					for (StorkAttribute attr : storkconfig.getAttributes()) {
+						if (attr != null && MiscUtil.isNotEmpty(attr.getName()))
+							dbStorkAttr.add(attr);
+						
+						else
+							log.info("Remove null or empty STORK attribute");
+					}
+											
+				} else
 					stork.setAttributes((List<StorkAttribute>) (new ArrayList<StorkAttribute>()));
 				
-				if (storkconfig.getCpepslist() != null)
-
-					stork.setCPEPS(storkconfig.getCpepslist());
-				else
-					stork.setCPEPS((List<CPEPS>) (new ArrayList<CPEPS>()));
+				if (storkconfig.getCpepslist() != null) {
+					List<CPEPS> dbStorkCPEPS = new ArrayList<CPEPS>();
+					stork.setCPEPS(dbStorkCPEPS);
+					
+					for (CPEPS cpeps : storkconfig.getCpepslist()) {
+						if (cpeps != null && MiscUtil.isNotEmpty(cpeps.getURL()) &&
+								MiscUtil.isNotEmpty(cpeps.getCountryCode())) {
+							
+							if (cpeps.getCountryCode().equals("CC") && 
+									cpeps.getURL().equals("http://"))
+								log.info("Remove dummy STORK CPEPS entry.");
+								
+							else							
+								dbStorkCPEPS.add(cpeps);
+							
+						} else
+							log.info("Remove null or emtpy STORK CPEPS configuration");
+					}
 				
-                } catch (Exception e) {
-                    e.printStackTrace();
-                }
-
-                try{
-                   log.info("CPEPS LIST: " + storkconfig.getCpepslist().size() );
-                    log.trace("CPEPS 1:" + storkconfig.getCpepslist().get(0).getCountryCode() +storkconfig.getCpepslist().get(0).getURL());
-                }   catch (Exception ex) {
-                    log.info("CPEPS LIST is null");
-                }
-			}
+				} else
+					stork.setCPEPS((List<CPEPS>) (new ArrayList<CPEPS>()));
+			
+            } catch (Exception e) {
+                e.printStackTrace();
+                
+            }
+
+            try{
+               log.info("CPEPS LIST: " + storkconfig.getCpepslist().size() );
+               log.trace("CPEPS 1:" + storkconfig.getCpepslist().get(0).getCountryCode() +storkconfig.getCpepslist().get(0).getURL());
+               
+            }   catch (Exception ex) {
+                log.info("CPEPS LIST is null");
+                
+            }
+		}
 
 		if (MiscUtil.isNotEmpty(moaconfig.getMandateURL())) {
 			OnlineMandates dbmandate = dbauth.getOnlineMandates();
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/UserDatabaseFormValidator.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/UserDatabaseFormValidator.java
index 7b49275b3..44afd0599 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/UserDatabaseFormValidator.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/UserDatabaseFormValidator.java
@@ -29,7 +29,6 @@ import javax.servlet.http.HttpServletRequest;
 
 import org.apache.log4j.Logger;
 
-import at.gv.egovernment.moa.id.commons.db.NewConfigurationDBRead;
 import at.gv.egovernment.moa.id.commons.db.dao.config.UserDatabase;
 import at.gv.egovernment.moa.id.commons.validation.ValidationHelper;
 import at.gv.egovernment.moa.id.config.webgui.exception.ConfigurationException;
@@ -188,10 +187,10 @@ public class UserDatabaseFormValidator {
 				
 		check = form.getBpk();
 		if (MiscUtil.isNotEmpty(check)) {
-			if (ValidationHelper.containsPotentialCSSCharacter(check, false)) {
+			if (ValidationHelper.isNotValidIdentityLinkSigner(check)) {
 				log.warn("BPK contains potentail XSS characters: " + check);
 				errors.add(LanguageHelper.getErrorString("validation.edituser.bpk.valid", 
-						new Object[] {ValidationHelper.getPotentialCSSCharacter(false)}, request ));
+						new Object[] {ValidationHelper.getNotValidIdentityLinkSignerCharacters()}, request ));
 			}
 		}
 		
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/moaconfig/MOAConfigValidator.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/moaconfig/MOAConfigValidator.java
index d4e8e957d..617e9cf51 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/moaconfig/MOAConfigValidator.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/moaconfig/MOAConfigValidator.java
@@ -367,7 +367,7 @@ public class MOAConfigValidator {
 		check = form.getSsoTarget();
 		if (MiscUtil.isEmpty(check)) {
 			log.info("Empty SSO Target");
-			errors.add(LanguageHelper.getErrorString("validation.general.sso.target.empty", request));
+			//errors.add(LanguageHelper.getErrorString("validation.general.sso.target.empty", request));
 			
 		} else {
 			if (!ValidationHelper.isValidAdminTarget(check)) {
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/moaconfig/StorkConfigValidator.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/moaconfig/StorkConfigValidator.java
index b73859d81..6b5c51e3f 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/moaconfig/StorkConfigValidator.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/moaconfig/StorkConfigValidator.java
@@ -47,31 +47,33 @@ public class StorkConfigValidator {
 							errors.add(LanguageHelper.getErrorString("validation.stork.cpeps.cc",
 									new Object[] {check}, request ));
 					}
+					
+					// check url
+					check = current.getURL();
+					if (MiscUtil.isNotEmpty(check)) {
+						if (!ValidationHelper.validateURL(check)) {
+							log.info("CPEPS config URL is invalid : " + check);
+							errors.add(LanguageHelper.getErrorString("validation.stork.cpeps.url", request));
+						}
+					} else {
+						log.warn("CPEPS config url is empty : " + check);
+						errors.add(LanguageHelper.getErrorString("validation.stork.cpeps.empty",
+								new Object[] {check}, request ));
+					}
+					
 				} else {
 					log.warn("CPEPS config countrycode is empty : " + check);
-					errors.add(LanguageHelper.getErrorString("validation.stork.cpeps.empty",
-							new Object[] {check}, request ));
+//					errors.add(LanguageHelper.getErrorString("validation.stork.cpeps.empty",
+//							new Object[] {check}, request ));
 				}
 
-				// check url
-				check = current.getURL();
-				if (MiscUtil.isNotEmpty(check)) {
-					if (!ValidationHelper.validateURL(check)) {
-						log.info("CPEPS config URL is invalid : " + check);
-						errors.add(LanguageHelper.getErrorString("validation.stork.cpeps.url", request));
-					}
-				} else {
-					log.warn("CPEPS config url is empty : " + check);
-					errors.add(LanguageHelper.getErrorString("validation.stork.cpeps.empty",
-							new Object[] {check}, request ));
-				}
 			}
 
 			if (form.getCpepslist() != null) {
 				// ensure uniqueness of country code
 				for (CPEPS one : form.getCpepslist())
 					for (CPEPS another : form.getCpepslist())
-						if (null != one && null != another)
+						if (null != one && null != another && one.getCountryCode() != null)
 							if (!one.equals(another) && one.getCountryCode().equals(another.getCountryCode())) {
 								errors.add(LanguageHelper.getErrorString("validation.stork.cpeps.duplicate", request));
 								break;
@@ -90,17 +92,20 @@ public class StorkConfigValidator {
 		// check attributes
 		if (MiscUtil.isNotEmpty(form.getAttributes())) {
 			for(StorkAttribute check : form.getAttributes()) {
-				String tmp = check.getName().replace("eidas/attributes/", ""); // since eIDaS attributes come with a "/", we need to exclude them from validation. TODO Or should we require the admin to escape them in the UI?
-				if (ValidationHelper.containsPotentialCSSCharacter(tmp, true)) { 
-					log.warn("default attributes contains potentail XSS characters: " + check);
-					errors.add(LanguageHelper.getErrorString("validation.stork.requestedattributes",
-							new Object[] {ValidationHelper.getPotentialCSSCharacter(true)}, request ));
-				}
-				if(!tmp.toLowerCase().matches("^[A-Za-z]*$")) {
-						log.warn("default attributes do not match the requested format : " + check);
+				if (check != null && MiscUtil.isNotEmpty(check.getName())) {
+					String tmp = check.getName().replace("eidas/attributes/", ""); // since eIDaS attributes come with a "/", we need to exclude them from validation. TODO Or should we require the admin to escape them in the UI?
+					if (ValidationHelper.containsPotentialCSSCharacter(tmp, true)) { 
+						log.warn("default attributes contains potentail XSS characters: " + check);
 						errors.add(LanguageHelper.getErrorString("validation.stork.requestedattributes",
-								new Object[] {check}, request ));
-				}
+								new Object[] {ValidationHelper.getPotentialCSSCharacter(true)}, request ));
+					}
+					if(!tmp.toLowerCase().matches("^[A-Za-z]*$")) {
+							log.warn("default attributes do not match the requested format : " + check);
+							errors.add(LanguageHelper.getErrorString("validation.stork.requestedattributes",
+									new Object[] {check}, request ));
+					}
+					
+				} 
 			}
 			
 		//TODO: STORK attributes check if no attribute is set	
diff --git a/id/ConfigWebTool/src/main/resources/applicationResources_de.properties b/id/ConfigWebTool/src/main/resources/applicationResources_de.properties
index ab404f65b..b77097e70 100644
--- a/id/ConfigWebTool/src/main/resources/applicationResources_de.properties
+++ b/id/ConfigWebTool/src/main/resources/applicationResources_de.properties
@@ -475,7 +475,7 @@ validation.general.identificationnumber.valid=Die Identifikationsnummer f\u00FCr
 validation.general.identificationnumber.fn.valid=Die Firmenbuchnummer hat kein g\u00FCltiges Format.
 validation.general.oaidentifier.empty=Es wurde kein eindeutiger Identifier f\u00FCr die Online-Applikation angegeben.
 validation.general.oaidentifier.valid=Der eindeutige Identifier f\u00FCr die Online-Applikation ist keine g\u00FCltige URL.
-validation.general.oaidentifier.notunique=Der gew\u00E4hlte eindeutige Identifier ist bereits vorhanden. Eine Eintragung der Online-Applikation ist nicht m\u00F6glich.
+validation.general.oaidentifier.notunique=Der gew\u00E4hlte eindeutige Identifier ist bereits vorhanden (kollision mit {0}). Eine Eintragung der Online-Applikation ist nicht m\u00F6glich.
 validation.general.stork.sptarget=Der STORK SP-Target ist leer.
 validation.general.stork.sptargetsize=Die Definition von STORK SP-Target ist nicht korrekt: zu viele Buchstaben.
 validation.general.bkuselection.filename.valid=Der Dateiname des BKU-Selektion Templates enth\u00E4lt nicht erlaubte Zeichen. Folgende Zeichen sind nicht erlaubt\: {0}
diff --git a/id/ConfigWebTool/src/main/resources/applicationResources_en.properties b/id/ConfigWebTool/src/main/resources/applicationResources_en.properties
index 29db35a0e..d62ce3807 100644
--- a/id/ConfigWebTool/src/main/resources/applicationResources_en.properties
+++ b/id/ConfigWebTool/src/main/resources/applicationResources_en.properties
@@ -473,7 +473,7 @@ validation.general.identificationnumber.valid=The identification number for the
 validation.general.identificationnumber.fn.valid=The identification number has invalid format.
 validation.general.oaidentifier.empty=There is no unique identifier for the Online-Application provided.
 validation.general.oaidentifier.valid=The unique identifier for the Online-Application is not valid URL.
-validation.general.oaidentifier.notunique=The selected unique identifier is already available. Registration of the Online-Application was not possible.
+validation.general.oaidentifier.notunique=The selected unique identifier is already available (collision with {0}). Registration of the Online-Application was not possible.
 validation.general.stork.sptarget=STORK SP-Target is blank.
 validation.general.stork.sptargetsize=The Definition of STORK SP-Target is incorrect: too many characters.
 validation.general.bkuselection.filename.valid=The file name of CCE-selection template contains forbidden characters. The following characters are not allowed\: {0}
diff --git a/id/ConfigWebTool/src/main/webapp/jsp/editMOAConfig.jsp b/id/ConfigWebTool/src/main/webapp/jsp/editMOAConfig.jsp
index ac2c8de5a..254418415 100644
--- a/id/ConfigWebTool/src/main/webapp/jsp/editMOAConfig.jsp
+++ b/id/ConfigWebTool/src/main/webapp/jsp/editMOAConfig.jsp
@@ -284,11 +284,16 @@
 								labelposition="left" />
 							<h4><%=LanguageHelper.getGUIString("webpages.moaconfig.stork.pepslist", request) %></h4>
               <table id="stork_pepslist">
-								<tr><td>Country Shortcode</td><td style="text-align:center;">PEPS URL</td><td>Supports XMLSignatures</td></tr>
+								<tr><td>Country Shortcode</td><td style="text-align:center;">PEPS URL</td><td>Supports XMLEncryption</td></tr>
 								<s:iterator value="storkconfig.cpepslist" status="stat">
 								  <tr>
 								  	<td style="display:none;"><s:textfield name="storkconfig.cpepslist[%{#stat.index}].hjid" value="%{hjid}" cssStyle="display:none;"/></td>
-								  	<td><s:property value="%{countryCode}" /></td>
+								  	<s:if test="%{countryCode == 'CC'}">
+									  	<td><s:textfield name="storkconfig.cpepslist[%{#stat.index}].countryCode" value="%{countryCode}" cssClass="textfield_short"/></td>
+								  	</s:if>
+								  	<s:else>
+								  		<td><s:property value="%{countryCode}" /></td>
+								  	</s:else>
 								    <td><s:textfield name="storkconfig.cpepslist[%{#stat.index}].URL" value="%{URL}" cssClass="textfield_long"/></td>
 								    <td><s:checkbox name="storkconfig.cpepslist[%{#stat.index}].supportsXMLSignature" value="%{supportsXMLSignature}" /></td>								    
 								    <td><input class="button_narrow" type="button" value="<%=LanguageHelper.getGUIString("webpages.moaconfig.stork.removepeps", request) %>" onclick='this.parentNode.parentNode.parentNode.removeChild(this.parentNode.parentNode);'/></td>
diff --git a/id/history.txt b/id/history.txt
index ab081c9d5..5c43ac4b0 100644
--- a/id/history.txt
+++ b/id/history.txt
@@ -1,5 +1,30 @@
 Dieses Dokument zeigt die Veränderungen und Erweiterungen von MOA-ID auf.

 

+Version MOA-ID Release 3.1.2: Änderungen seit Version MOA-ID 3.1.1

+- Änderungen

+  - Bug-Fix - Problem mit Microsoft SQL Datenbanken behoben

+  - Bug-Fix - Single Log-Out für PVP2 S-Profil ohne aktive SSO Session

+  - Bug-Fix - Problem mit manchen SAML1 clients and GetAuthenticationData service

+

+

+------------------------------------------------------------------------------

+Version MOA-ID Release 3.1.1: Änderungen seit Version MOA-ID 3.1.0

+- Änderungen

+  - Security Update Struts2 2.3.28.1 (https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3081)

+  - Bug-Fix bei der Verarbeitung der BKU Auswahl

+  - Kleinere Bug-Fixes

+  - Update von Libraries

+    > org.apache.struts:struts2-core 2.3.28.1

+    > org.apache.struts:struts2-json-plugin 2.3.28.1

+    > org.slf4j:jcl-over-slf4j 1.7.21

+    > org.slf4j:jul-to-slf4j 1.7.21

+    > org.slf4j:slf4j-api 1.7.21

+    > org.slf4j:slf4j-log4j12 1.7.21

+    > org.springframework 4.2.6.RELEASE

+    > com.google.http-client:google-http-client-jackson2 1.22.0

+    > com.google.oauth-client:google-oauth-client-jetty 1.22.0

+

+------------------------------------------------------------------------------

 Version MOA-ID Release 3.1.0: Änderungen seit Version MOA-ID 3.0.2

 - Änderungen

   - Mehrere virtuelle IDP Instanzen je deployer MOA-ID Instanz möglich 

@@ -38,7 +63,6 @@ Version MOA-ID Release 3.0.2: Änderungen seit Version MOA-ID 3.0.1
   - Bug-Fix für Zugriff auf Oracle Datenbanken

   - 

 

-

   ------------------------------------------------------------------------------

 Version MOA-ID Release 3.0.1: Änderungen seit Version MOA-ID 3.0.0

 - Änderungen

diff --git a/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/MOAIDConfigurationValidator.java b/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/MOAIDConfigurationValidator.java
index 42ef0e1e6..2bb33a9d7 100644
--- a/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/MOAIDConfigurationValidator.java
+++ b/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/MOAIDConfigurationValidator.java
@@ -22,19 +22,19 @@
  */
 package at.gv.egovernment.moa.id.config.webgui.validation;
 
+import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
-import java.util.ServiceLoader;
 import java.util.Map.Entry;
+import java.util.ServiceLoader;
 import java.util.Set;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 
-import at.gv.egiz.components.configuration.api.Configuration;
 import at.gv.egovernment.moa.id.commons.config.MOAIDConfigurationConstants;
 import at.gv.egovernment.moa.id.commons.config.persistence.MOAIDConfiguration;
 import at.gv.egovernment.moa.id.commons.utils.KeyValueUtils;
@@ -243,10 +243,11 @@ public class MOAIDConfigurationValidator {
 				groupEl.getKey(), 
 				MOAIDConfigurationConstants.PREFIX_MOAID)); 
 		
-		//add or update key/value pairs from users with module or task specific information 
+		//add or update key/value pairs from users with module or task specific information
+		List<String> taskDelete = new ArrayList<String>();
 		Map<String, String> toBeAdded = module.postProcessing(
 				KeyValueUtils.removePrefixFromKeys(groupEl.getValue(), groupEl.getKey()), 
-				deleted, 
+				taskDelete, 
 				dbconfig);		
 		if (toBeAdded != null) {
 			toBeAdded = KeyValueUtils.makeKeysAbsolut(toBeAdded, groupEl.getKey(), MOAIDConfigurationConstants.PREFIX_MOAID);
@@ -261,6 +262,23 @@ public class MOAIDConfigurationValidator {
 			}
 		}
 		
+		//make delete elements absolute
+		if (!taskDelete.isEmpty()) {
+			Iterator<String> delInterator = taskDelete.iterator();
+			while (delInterator.hasNext()) {
+				String delKey = delInterator.next();
+				if (!delKey.startsWith(MOAIDConfigurationConstants.PREFIX_MOAID)) {
+					deleted.add(groupEl.getKey() + KeyValueUtils.KEY_DELIMITER + delKey );
+					
+				} else {
+					deleted.add(delKey);
+					
+				}
+				
+			}
+			
+		}
+		
 	}
 	
 	private void keyValueClassification(Iterator<Entry<String, String>> config, Map<String, Map<String,String>> result) {		
diff --git a/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/GeneralMOAIDConfigurationTask.java b/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/GeneralMOAIDConfigurationTask.java
index 1c3e0fe13..270d0866c 100644
--- a/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/GeneralMOAIDConfigurationTask.java
+++ b/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/GeneralMOAIDConfigurationTask.java
@@ -435,10 +435,10 @@ public class GeneralMOAIDConfigurationTask extends AbstractTaskValidator impleme
 		check = input.get(KeyValueUtils.removePrefixFromKey(MOAIDConfigurationConstants.GENERAL_AUTH_SSO_TARGET, getKeyPrefix()));
 		if (MiscUtil.isEmpty(check)) {
 			log.info("Empty SSO Target");
-			errors.add(new ValidationObjectIdentifier(
-					MOAIDConfigurationConstants.GENERAL_AUTH_SSO_TARGET, 
-					"SSO - Target",
-					LanguageHelper.getErrorString("validation.general.sso.target.empty")));
+//			errors.add(new ValidationObjectIdentifier(
+//					MOAIDConfigurationConstants.GENERAL_AUTH_SSO_TARGET, 
+//					"SSO - Target",
+//					LanguageHelper.getErrorString("validation.general.sso.target.empty")));
 			
 		} else {
 			
diff --git a/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/GeneralSTORKConfigurationTask.java b/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/GeneralSTORKConfigurationTask.java
index 1747e2207..8a1a2925b 100644
--- a/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/GeneralSTORKConfigurationTask.java
+++ b/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/GeneralSTORKConfigurationTask.java
@@ -133,38 +133,40 @@ public static final List<String> KEYWHITELIST;
 										LanguageHelper.getErrorString("validation.stork.cpeps.cc",
 										new Object[] {cc})));
 							}
-						} else {
-							log.warn("CPEPS config countrycode is empty : " + cc);
-							errors.add(new ValidationObjectIdentifier(
-								MOAIDConfigurationConstants.GENERAL_AUTH_STORK_CPEPS_LIST
-									+ "." + cpepsKey, 
-								"STORK - CPEPS Country",
-								LanguageHelper.getErrorString("validation.stork.cpeps.empty",
-								new Object[] {cc})));
-						}
-
-						// check url
-						if (MiscUtil.isNotEmpty(url)) {
-							if (!ValidationHelper.validateURL(url)) {
-								log.info("CPEPS config URL is invalid : " + url);
+							
+							// check url
+							if (MiscUtil.isNotEmpty(url)) {
+								if (!ValidationHelper.validateURL(url)) {
+									log.info("CPEPS config URL is invalid : " + url);
+									errors.add(new ValidationObjectIdentifier(
+										MOAIDConfigurationConstants.GENERAL_AUTH_STORK_CPEPS_LIST
+											+ "." + index + "." 
+											+ MOAIDConfigurationConstants.GENERAL_AUTH_STORK_CPEPS_LIST_URL, 
+										"STORK - CPEPS URL",
+										LanguageHelper.getErrorString("validation.stork.cpeps.url")));
+								}
+							} else {
+								log.warn("CPEPS config url is empty : " + url);
 								errors.add(new ValidationObjectIdentifier(
 									MOAIDConfigurationConstants.GENERAL_AUTH_STORK_CPEPS_LIST
 										+ "." + index + "." 
 										+ MOAIDConfigurationConstants.GENERAL_AUTH_STORK_CPEPS_LIST_URL, 
 									"STORK - CPEPS URL",
-									LanguageHelper.getErrorString("validation.stork.cpeps.url")));
-							}
+									LanguageHelper.getErrorString("validation.stork.cpeps.empty",
+									new Object[] {url})));
+								
+							}	
+														
 						} else {
-							log.warn("CPEPS config url is empty : " + url);
-							errors.add(new ValidationObjectIdentifier(
-								MOAIDConfigurationConstants.GENERAL_AUTH_STORK_CPEPS_LIST
-									+ "." + index + "." 
-									+ MOAIDConfigurationConstants.GENERAL_AUTH_STORK_CPEPS_LIST_URL, 
-								"STORK - CPEPS URL",
-								LanguageHelper.getErrorString("validation.stork.cpeps.empty",
-								new Object[] {url})));
-							
-						}					
+							log.warn("CPEPS config countrycode is empty : " + cc);
+//							errors.add(new ValidationObjectIdentifier(
+//								MOAIDConfigurationConstants.GENERAL_AUTH_STORK_CPEPS_LIST
+//									+ "." + cpepsKey, 
+//								"STORK - CPEPS Country",
+//								LanguageHelper.getErrorString("validation.stork.cpeps.empty",
+//								new Object[] {cc})));
+						}
+				
 						validatedCPeps.put(cc, url);
 						
 					} else {
diff --git a/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/ServicesAuthenticationInformationTask.java b/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/ServicesAuthenticationInformationTask.java
index 8e8feefe0..1819c5c2b 100644
--- a/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/ServicesAuthenticationInformationTask.java
+++ b/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/ServicesAuthenticationInformationTask.java
@@ -89,6 +89,25 @@ public class ServicesAuthenticationInformationTask extends AbstractTaskValidator
 			
 		}
 		
+		String isLegacyModeActive = input.get(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_TEMPLATE_LEGACY);
+		if (MiscUtil.isNotEmpty(isLegacyModeActive) && Boolean.parseBoolean(isLegacyModeActive)) {
+			if (!input.containsKey(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_TEMPLATE_FIRST_VALUE))
+				keysToDelete.add(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_TEMPLATE_FIRST_VALUE);
+			
+			if (!input.containsKey(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_TEMPLATE_SECOND_VALUE))
+				keysToDelete.add(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_TEMPLATE_SECOND_VALUE);
+			
+			if (!input.containsKey(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_TEMPLATE_THIRD_VALUE))
+				keysToDelete.add(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_TEMPLATE_THIRD_VALUE);
+						
+		} else {
+			keysToDelete.add(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_TEMPLATE_FIRST_VALUE);
+			keysToDelete.add(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_TEMPLATE_SECOND_VALUE);
+			keysToDelete.add(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_TEMPLATE_THIRD_VALUE);
+			
+		}
+		
+		
 		if (newConfigValues.isEmpty())
 			return null;
 		else
diff --git a/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/ServicesProtocolPVP2XTask.java b/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/ServicesProtocolPVP2XTask.java
index c55c35da0..d69157553 100644
--- a/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/ServicesProtocolPVP2XTask.java
+++ b/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/ServicesProtocolPVP2XTask.java
@@ -186,7 +186,7 @@ public class ServicesProtocolPVP2XTask extends AbstractTaskValidator implements
 						BasicX509Credential credential = new BasicX509Credential();
 						credential.setEntityCertificate(cert);
 						
-						timer = new Timer();
+						timer = new Timer(true);
 						httpClient = new MOAHttpClient();
 						
 						if (metadataURL.startsWith("https:"))
diff --git a/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/ServicesProtocolSTORKTask.java b/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/ServicesProtocolSTORKTask.java
index c7a74d1a1..eb881d465 100644
--- a/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/ServicesProtocolSTORKTask.java
+++ b/id/moa-id-webgui/src/main/java/at/gv/egovernment/moa/id/config/webgui/validation/task/impl/ServicesProtocolSTORKTask.java
@@ -190,7 +190,8 @@ public class ServicesProtocolSTORKTask extends AbstractTaskValidator implements
 //		if (MiscUtil.isEmpty(identificationType) || 
 //				!MOAIDConfigurationConstants.IDENIFICATIONTYPE_STORK.equals(identificationType)) {
 		if (MiscUtil.isNotEmpty(identificationType) && 
-				!MOAIDConfigurationConstants.IDENIFICATIONTYPE_STORK.equals(identificationType)) {
+				!(MOAIDConfigurationConstants.IDENIFICATIONTYPE_STORK.equals(identificationType) 
+						|| MOAIDConfigurationConstants.IDENIFICATIONTYPE_EIDAS.equals(identificationType))) {
 			log.info("STORK V-IDP only allowes identification numbers with STORK prefix.");
 			errors.add(new ValidationObjectIdentifier(
 					MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_TYPE, 
diff --git a/id/moa-spss-container/pom.xml b/id/moa-spss-container/pom.xml
index 49557d83e..bddc25f71 100644
--- a/id/moa-spss-container/pom.xml
+++ b/id/moa-spss-container/pom.xml
@@ -8,165 +8,155 @@
   <groupId>MOA.id</groupId>
   <artifactId>moa-spss-container</artifactId>
   <version>${moa-id-version}</version>
-  <packaging>pom</packaging>
   <name>MOA-SPSS-Container-for-MOA-ID</name>
   <description>This module holds MOA-SPSS and all required library</description>
   
   <properties>
-		<repositoryPath>${basedir}/../../repository</repositoryPath>
+		<repositoryPath>${basedir}/../../../repository</repositoryPath>
 	</properties>
   
-      <profiles>
-        <profile>
-            <id>default</id>
-            <activation>
-                <activeByDefault>true</activeByDefault>
-            </activation>
-            <repositories>
-                <repository>
-                    <id>local</id>
-                    <name>local</name>
-                    <url>file:${basedir}/../../repository</url>
-                </repository>
-                <repository>
-                    <id>egiz-commons</id>
-                    <url>https://demo.egiz.gv.at/int-repo/</url>
-                    <releases>
-                        <enabled>true</enabled>
-                    </releases>
-                </repository>
-            </repositories>
-        </profile>
-    </profiles>
+  <repositories>
+  	<repository>
+    	<id>MOA</id>
+      	<name>MOA Dependencies</name>
+      	<releases>
+      		<enabled>true</enabled>
+      		<checksumPolicy>ignore</checksumPolicy>
+      	</releases>
+        <layout>default</layout>
+        <url>file://${repositoryPath}</url>
+     </repository>
+  </repositories>
+  
+  <build>
+  	<plugins>
+  		<plugin>
+  			<groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <configuration>
+        	<includes>
+          	<include>${basedir}/../../../repository/MOA/spss/ext_libs/*.jar</include>
+           </includes>
+         </configuration>
+      </plugin>
+  	</plugins>
+  
+  </build>
   
   <dependencies>
-  	        <!-- we need Axis 1.1 here, 1.0 is included in SPSS -->
 		<dependency>
 			<groupId>MOA.spss.server</groupId>
-			<artifactId>moa-spss-lib</artifactId>
+			<artifactId>moa-sig-lib</artifactId>
 			<exclusions>
 				<exclusion>
-					<artifactId>iaik_pki_module</artifactId>
-					<groupId>iaik</groupId>
-				</exclusion>
-				<exclusion>
 					<groupId>commons-logging</groupId>
 					<artifactId>commons-logging</artifactId>
 				</exclusion>
 				<exclusion>
-					<artifactId>axis-wsdl4j</artifactId>
+					<artifactId>*</artifactId>
 					<groupId>axis</groupId>
 				</exclusion>
 			</exclusions>
 		</dependency>
-		
+	
+				
+<!-- 		MOA-SPSS 3.x --> 
 		<dependency>
-			<groupId>iaik.prod</groupId>
-			<artifactId>iaik_ixsil</artifactId>
-		</dependency>
+			<groupId>MOA.spss</groupId>
+			<artifactId>common</artifactId>
+		</dependency>	
 		<dependency>
 			<groupId>iaik.prod</groupId>
-			<artifactId>iaik_X509TrustManager</artifactId>
-		</dependency>
-		
-<!-- 		<dependency>
-			<groupId>axis</groupId>
-			<artifactId>axis</artifactId>
-		</dependency> -->
-
-<!-- 		<dependency>
-			<groupId>axis</groupId>
-			<artifactId>axis</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>org.apache.axis</groupId>
-			<artifactId>axis-jaxrpc</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>org.apache.axis</groupId>
-			<artifactId>axis-saaj</artifactId>
-		</dependency> -->
+			<artifactId>iaik_cms</artifactId>
+			<version>5.1</version>
+		</dependency>			
 		<dependency>
-			<groupId>commons-discovery</groupId>
-			<artifactId>commons-discovery</artifactId>
-		</dependency>
+			<groupId>iaik.prod</groupId>
+			<artifactId>iaik_cpades</artifactId>
+			<version>2.2b3_tmp</version>
+		</dependency>				
 		<dependency>
-			<groupId>commons-logging</groupId>
-			<artifactId>commons-logging</artifactId>
-		</dependency>
+			<groupId>iaik.prod</groupId>
+			<artifactId>iaik_eccelerate</artifactId>
+			<version>3.1_eval</version>
+		</dependency>		
 		<dependency>
-			<groupId>javax.activation</groupId>
-			<artifactId>activation</artifactId>
-		</dependency>
+			<groupId>iaik.prod</groupId>
+			<artifactId>iaik_eccelerate_addon</artifactId>
+			<version>3.01_eval</version>
+		</dependency>					
 		<dependency>
-			<groupId>javax.mail</groupId>
-			<artifactId>mail</artifactId>
+			<groupId>iaik.prod</groupId>
+			<artifactId>iaik_eccelerate_cms</artifactId>
+			<version>3.01</version>
 		</dependency>
 		<dependency>
-			<groupId>junit</groupId>
-			<artifactId>junit</artifactId>
-		</dependency>
-		
-<!-- 		<dependency>
-			<groupId>log4j</groupId>
-			<artifactId>log4j</artifactId>
-		</dependency> -->
-<!-- 		   <dependency>
-					<groupId>org.apache.logging.log4j</groupId>
-					<artifactId>log4j-core</artifactId>
-				</dependency> -->
-		
+    	<groupId>iaik.prod</groupId>
+      <artifactId>iaik_jce_full</artifactId>
+      <scope>provided</scope>
+    </dependency>
 		<dependency>
-			<groupId>org.postgresql</groupId>
-			<artifactId>postgresql</artifactId>
+			<groupId>iaik.prod</groupId>
+		  	<artifactId>iaik_jsse</artifactId>
+  			<version>4.4</version>
 		</dependency>
 		<dependency>
-			<groupId>javax.servlet</groupId>
-			<artifactId>javax.servlet-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
+    	<groupId>iaik.prod</groupId>
+      <artifactId>iaik_moa</artifactId>
+      <version>2.00</version>
+    </dependency>
 		<dependency>
-			<groupId>xalan-bin-dist</groupId>
-			<artifactId>xalan</artifactId>
-			<!-- <scope>provided</scope> -->
+			<groupId>iaik.prod</groupId>
+			<artifactId>iaik_pki_module</artifactId>
+			<version>1.1_moa</version>
 		</dependency>
 		<dependency>
-			<groupId>xerces</groupId>
-			<artifactId>xercesImpl</artifactId>
-			<!-- <scope>provided</scope> -->
+			<groupId>iaik.prod</groupId>
+			<artifactId>iaik_sva</artifactId>
+			<version>1.0_moa</version>
 		</dependency>
 		<dependency>
-			<groupId>xalan-bin-dist</groupId>
-			<artifactId>xml-apis</artifactId>
+			<groupId>iaik.prod</groupId>
+			<artifactId>iaik_tsl</artifactId>
+			<version>1.1_moa</version>
 		</dependency>
 		<dependency>
-			<groupId>xalan-bin-dist</groupId>
-			<artifactId>serializer</artifactId>
-			<!-- <scope>provided</scope> -->
+			<groupId>iaik.prod</groupId>
+			<artifactId>iaik_tsp</artifactId>
+			<version>2.31_eval</version>
 		</dependency>
 		<dependency>
 			<groupId>iaik.prod</groupId>
-			<artifactId>iaik_moa</artifactId>
-		</dependency>
+			<artifactId>iaik_util</artifactId>
+			<version>0.23</version>
+		</dependency>		
 		<dependency>
 			<groupId>iaik.prod</groupId>
-			<artifactId>iaik_ixsil</artifactId>
+			<artifactId>iaik_xades</artifactId>
+			<version>20160408_eval</version>
 		</dependency>
 		<dependency>
 			<groupId>iaik.prod</groupId>
-			<artifactId>iaik_jce_full</artifactId>
-			<scope>compile</scope>
+			<artifactId>iaik_xsect</artifactId>
+			<version>2.10_20160408_eval</version>
+		</dependency>		
+
+		
+				
+
+		<dependency>
+			<groupId>javax.mail</groupId>
+			<artifactId>mail</artifactId>
 		</dependency>
 		<dependency>
-			<groupId>iaik.prod</groupId>
-			<artifactId>iaik_ecc</artifactId>
-			<scope>compile</scope>
+			<groupId>junit</groupId>
+			<artifactId>junit</artifactId>
 		</dependency>
 		<dependency>
-			<groupId>iaik.prod</groupId>
-			<artifactId>iaik_cms</artifactId>
-			<scope>runtime</scope>
+			<groupId>org.postgresql</groupId>
+			<artifactId>postgresql</artifactId>
 		</dependency>
+
 		<dependency>
 			<groupId>iaik.prod</groupId>
 			<artifactId>iaik_Pkcs11Provider</artifactId>
@@ -228,38 +218,7 @@
             <!-- should be provided by the container or jre -->
             <scope>provided</scope>
         </dependency>
-        <dependency>
-            <groupId>iaik.prod</groupId>
-            <artifactId>iaik_jce_full</artifactId>
-            <!-- should be in the ext directory of the jre -->
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>iaik.prod</groupId>
-            <artifactId>iaik_ecc</artifactId>
-            <!-- should be in the ext directory of the jre -->
-            <scope>provided</scope>
-        </dependency>
-		
-		<dependency>
-			<groupId>iaik</groupId>
-			<artifactId>iaik_tsl</artifactId>
-			<exclusions>
-				<exclusion>
-					<artifactId>iaik_pki_module</artifactId>
-					<groupId>iaik</groupId>
-				</exclusion>
-				<exclusion>
-					<artifactId>iaik_ecc_signed</artifactId>
-					<groupId>iaik</groupId>
-				</exclusion>
-				<exclusion>
-					<artifactId>iaik_jce_eval_signed</artifactId>
-					<groupId>iaik</groupId>
-				</exclusion>
-			</exclusions>
-		</dependency>
-		
+	
   </dependencies>
   
 </project>
\ No newline at end of file
diff --git a/id/oa/src/main/java/at/gv/egovernment/moa/id/demoOA/Configuration.java b/id/oa/src/main/java/at/gv/egovernment/moa/id/demoOA/Configuration.java
index 85f16e11f..9be73b3f1 100644
--- a/id/oa/src/main/java/at/gv/egovernment/moa/id/demoOA/Configuration.java
+++ b/id/oa/src/main/java/at/gv/egovernment/moa/id/demoOA/Configuration.java
@@ -255,7 +255,9 @@ public class Configuration {
 			}
 		
 			//load IDP metadata into metadataprovider
-			idpMetadataProvider = new HTTPMetadataProvider(new Timer(), new HttpClient(), metadataurl);  
+			idpMetadataProvider = new HTTPMetadataProvider(
+					new Timer("demoOA", true), 
+					new HttpClient(), metadataurl);  
 			idpMetadataProvider.setRequireValidMetadata(true);  
 			idpMetadataProvider.setParserPool(new BasicParserPool());
 			idpMetadataProvider.setMetadataFilter(new MetaDataVerificationFilter(idpCredential));
diff --git a/id/readme_3.1.0.txt b/id/readme_3.1.0.txt
new file mode 100644
index 000000000..f06dd4f19
--- /dev/null
+++ b/id/readme_3.1.0.txt
@@ -0,0 +1,606 @@
+===============================================================================
+MOA ID Version Release 3.1.0 - Wichtige Informationen zur Installation
+===============================================================================
+
+-------------------------------------------------------------------------------
+A. Neuerungen/Änderungen
+-------------------------------------------------------------------------------
+
+Mit MOA ID Version 3.1.0 wurden folgende Neuerungen und Änderungen eingeführt, 
+die jetzt erstmals in der Veröffentlichung enthalten sind (siehe auch 
+history.txt im gleichen Verzeichnis).
+   
+- Änderungen
+  - Mehrere virtuelle IDP Instanzen je deployer MOA-ID Instanz möglich 
+    (unterschiedliche Entity-IDs je virtueller Instanz)
+  - Änderung der von MOA-ID verwendeten PVP 2.x EntityID
+  - Überarbeitung der Weboberfläche des Konfigurationstools
+  - Überarbeitung aller GUI Templates (BKU-Auswahl, Fehlermeldungen, ...)
+  - Inkludierung der neuen Logos für Karte und Handy-Signatur
+  - Optimierung der internen Prozesse
+  - Kleinere Bug-Fixes
+  - Update von Libraries
+
+
+-------------------------------------------------------------------------------
+B. Durchführung eines Updates
+-------------------------------------------------------------------------------
+
+Es wird generell eine Neuinstallation lt. Handbuch empfohlen! Dennoch ist auch
+eine Aktualisierung bestehender Installationen möglich. Je nachdem von welcher
+MOA-ID Version ausgegangen wird ergibt sich eine Kombination der nachfolgend 
+angebebenen Updateschritte.
+
+Hinweis: Wenn Sie die bestehende Konfiguration von MOA-ID 2.x.x in MOA-ID 3.1.x
+reimportieren möchten, so muss diese vor dem Update mit Hilfe der import/export
+Funktion der grafischen Konfigurationsoberfläche in eine Datei exportiert werden.
+Diese Datei dient dann als Basis für den Import in MOA-ID 3.1.x. 
+
+...............................................................................
+B.1 Durchführung eines Updates von Version 3.0.x auf Version 3.1.0
+...............................................................................
+1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-3.1.0.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war 
+   als auch das komplette Verzeichnis moa-id-auth. 
+
+4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.   
+
+5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+
+6. Update der TrustStores für WebService Zugriffe.
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\certs\ca-certs
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\certs\ca-certs.         
+     b.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\certs\certstore\toBeAdded
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\certs\certstore\toBeAdded.
+
+7. Hinzufügen der zusätzlichen Konfigurationsparameter in der 
+   MOA-ID-Configuration Konfigurationsdatei
+   CATALINA_HOME\conf\moa-id-configuration\moa-id-configtool.properties     
+     a.) dbcp.validationQuery=.....         (SQL Query zum Validieren der
+         Datenbankverbindung 
+           z.B: "SELECT 1" für mySQL
+                "select 1 from dual" für OracleDB)
+
+8. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth
+   Konfigurationsdatei CATALINA_HOME\conf\moa-id\moa-id.properties     
+     a.) configuration.dbcp.validationQuery=.....         (SQL Query zum 
+         Validieren der Datenbankverbindung 
+           z.B: "SELECT 1" für mySQL
+                "select 1 from dual" für OracleDB)
+
+9. Update der Default html-Templates für die Bürgerkartenauswahl.
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\htmlTemplates
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\htmlTemplates.         
+     b.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id-configuration\htmlTemplates
+         in das Verzeichnis CATALINA_HOME\conf\moa-id-configuration\htmlTemplates. 
+
+10.  Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+         
+...............................................................................
+B.2 Durchführung eines Updates von Version 2.2.1 auf Version 3.1.0 
+...............................................................................
+
+1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-3.1.0.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war und
+   moa-id-configuration.war als auch das komplette Verzeichnis moa-id-auth 
+   und das komplette Verzeichnis moa-id-configuration.
+
+4. Erstellen Sie eine Sicherungskopie aller "*.jar"-Dateien im Verzeichnis
+	 CATALINA_HOME_ID\endorsed und loeschen Sie diese Dateien danach.
+   	
+5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+6. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+                                 
+7. Update des Cert-Stores.
+   Kopieren Sie den Inhalt des Verzeichnisses
+   MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis
+   CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie 
+   vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann 
+   bejahen sie das.
+
+8. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen 
+   wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile 
+   beibehalten wollen, dann gehen Sie vor, wie in Punkt b).
+
+   a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen:
+
+    1)  Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles.
+    2)  Kopieren Sie das Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis 
+        CATALINA_HOME\conf\moa-spss.
+
+   b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie 
+      folgt vor, um die Profile auf den aktuellen Stand zu bringen:
+
+    1)  Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den 
+        entsprechenden Profilen im Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren 
+        Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt 
+        der einzelnen Profile aus der Distribution 
+        (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden 
+        Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) 
+        kopieren und dabei die vorhandenen gleichnamigen Zertifikate 
+        überschreiben), also z.B: Kopieren des Inhalts von 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach 
+        CATALINA_HOME\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. 
+
+9. Update der Default html-Templates für die Bürgerkartenauswahl.
+
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\htmlTemplates
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\htmlTemplates.         
+     b.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id-configuration\htmlTemplates
+         in das Verzeichnis CATALINA_HOME\conf\moa-id-configuration\htmlTemplates. 
+
+10. Update der STORK Konfiguration
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\stork
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\stork.
+     b.) Passen Sie die STORK Konfiguration laut Handbuch -> Konfiguration ->   
+         2.4 Konfiguration des SamlEngines an.
+         
+11. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth Konfigurationsdatei
+    CATALINA_HOME\conf\moa-id\moa-id.properties
+   
+12. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Configration Konfigurationsdatei
+    CATALINA_HOME\conf\moa-id-configuration\moa-id-configtool.properties
+
+13. Hinzufügen der zusätzlichen Konfigurationsdatei in der MOA-ID-Configuration
+    CATALINA_HOME\conf\moa-id-configuration\userdatabase.properties
+
+14. Update der Tomcat Start-Skripts:
+    - Die Konfigurationsdateien für MOA-ID-Auth und MOA-ID-Configuration müssen
+      nur als URI (file:/...) übergeben werden. 
+                 
+15.  Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+
+
+...............................................................................
+B.1 Durchführung eines Updates von Version 2.2.0 auf Version 2.2.1 
+...............................................................................
+1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.2.1.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war und
+   moa-id-configuration.war als auch das komplette Verzeichnis moa-id-auth 
+   und das komplette Verzeichnis moa-id-configuration.
+	
+4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+                                 
+6. Update des Cert-Stores.
+   Kopieren Sie den Inhalt des Verzeichnisses
+   MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis
+   CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie 
+   vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann 
+   bejahen sie das.
+
+7. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen 
+   wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile 
+   beibehalten wollen, dann gehen Sie vor, wie in Punkt b).
+
+   a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen:
+
+    1)  Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles.
+    2)  Kopieren Sie das Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis 
+        CATALINA_HOME\conf\moa-spss.
+
+   b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie 
+      folgt vor, um die Profile auf den aktuellen Stand zu bringen:
+
+    1)  Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den 
+        entsprechenden Profilen im Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren 
+        Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt 
+        der einzelnen Profile aus der Distribution 
+        (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden 
+        Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) 
+        kopieren und dabei die vorhandenen gleichnamigen Zertifikate 
+        überschreiben), also z.B: Kopieren des Inhalts von 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach 
+        CATALINA_HOME\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. 
+                 
+8.  Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+
+...............................................................................
+B.1 Durchführung eines Updates von Version 2.1.2 auf Version 2.2.0 
+...............................................................................
+ 1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.2.0.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war und
+   moa-id-configuration.war als auch das komplette Verzeichnis moa-id-auth 
+   und das komplette Verzeichnis moa-id-configuration.
+   
+4. Erstellen Sie eine Sicherungskopie aller "*.jar"-Dateien im Verzeichnis
+	 CATALINA_HOME_ID\endorsed und loeschen Sie diese Dateien danach.
+	
+6. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+7. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+   
+8. Kopieren der folgenden Dateien:
+      Sollte die Datei bereits vorhanden sein erstellen Sie ein Backup der 
+      Datei bevor Sie diese durch die neue Version ersetzen.  
+      a.) MOA_ID_AUTH_INST/conf/moa-id/stork/StorkSamlEngine_VIDP.xml ->
+          CATALINA_HOME/conf/moa-id/stork/StorkSamlEngine_VIDP.xml
+      b.) MOA_ID_AUTH_INST/conf/moa-id/stork/StorkSamlEngine_outgoing.xml ->
+          CATALINA_HOME/conf/moa-id/stork/StorkSamlEngine_outgoing.xml          
+                    
+9. Dem STORK KeyStores unter MOA_ID_AUTH_INST/conf/moa-id/keys/storkDemoKeys.jks 
+   (Passwort=local-demo) wurden neue vertrauenswürdige Zertifikate hinzugefügt.
+   Gleichen Sie bei Bedarf die Zertifikate dieses KeyStores mit Ihrem aktuell
+   verwendeten KeyStore ab. 
+
+10. Update des Cert-Stores.
+   Kopieren Sie den Inhalt des Verzeichnisses
+   MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis
+   CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie 
+   vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann 
+   bejahen sie das.
+
+11. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen 
+   wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile 
+   beibehalten wollen, dann gehen Sie vor, wie in Punkt b).
+
+   a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen:
+
+    1)  Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles.
+    2)  Kopieren Sie das Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis 
+        CATALINA_HOME\conf\moa-spss.
+
+   b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie 
+      folgt vor, um die Profile auf den aktuellen Stand zu bringen:
+
+    1)  Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den 
+        entsprechenden Profilen im Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren 
+        Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt 
+        der einzelnen Profile aus der Distribution 
+        (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden 
+        Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) 
+        kopieren und dabei die vorhandenen gleichnamigen Zertifikate 
+        überschreiben), also z.B: Kopieren des Inhalts von 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach 
+        CATALINA_HOME\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. 
+
+                 
+12. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+
+...............................................................................
+B.2 Durchführung eines Updates von Version 2.1.1 auf Version 2.1.2 
+...............................................................................
+ 1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.1.2.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war und
+   moa-id-configuration.war als auch das komplette Verzeichnis moa-id-auth 
+   und das komplette Verzeichnis moa-id-configuration.
+   
+4. Erstellen Sie eine Sicherungskopie aller "*.jar"-Dateien im Verzeichnis
+	 CATALINA_HOME_ID\endorsed und loeschen Sie diese Dateien danach.
+	
+5. Kopieren Sie alle Dateien aus dem Verzeichnis MOA_ID_AUTH_INST\endorsed in das 
+   Verzeichnis	CATALINA_HOME_ID\endorsed   
+
+6. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+7. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+   
+8. Kopieren der folgenden Dateien  
+      a.) MOA_ID_AUTH_INST/conf/moa-id/stork/StorkSamlEngine_VIDP.xml ->
+          CATALINA_HOME/conf/moa-id/stork/StorkSamlEngine_VIDP.xml
+          Sollte die Datei bereits vorhanden sein erstellen Sie ein Backup der 
+          Datei slo_template.html bevor Sie diese durch die neue Version ersetzen.
+          
+9. Dem STORK KeyStores unter MOA_ID_AUTH_INST/conf/moa-id/keys/storkDemoKeys.jks 
+   (Passwort=local-demo) wurden neue vertrauenswürdige Zertifikate hinzugefügt.
+   Gleichen Sie bei Bedarf die Zertifikate dieses KeyStores mit Ihrem aktuell
+   verwendeten KeyStore ab. 
+                 
+10. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+
+
+...............................................................................
+B.3 Durchführung eines Updates von Version 2.1.0 auf Version 2.1.1 
+...............................................................................
+ 1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.1.0.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Erstellen Sie eine Sicherungskopie aller "iaik*.jar"-Dateien im Verzeichnis
+	 JAVA_HOME\jre\lib\ext und loeschen Sie diese Dateien danach.
+	
+4. Kopieren Sie alle Dateien aus dem Verzeichnis MOA_ID_AUTH_INST\ext in das 
+   Verzeichnis	JAVA_HOME\jre\lib\ext (Achtung: Java 1.4.x wird nicht mehr 
+   unterstuetzt).
+
+5. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Datei moa-id-auth.war als 
+   auch das komplette Verzeichnis moa-id-auth.
+
+6. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+7. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+   
+8. Hinzufügen der zusätzlichen Konfigurationsparameter in der 
+   MOA-ID-Configuration Konfigurationsdatei
+   CATALINA_HOME\conf\moa-id-configuration\moa-id-configtool.properties     
+     a.) general.moaconfig.key=.....         (Passwort zum Ver- und 
+         Entschlüsseln von Konfigurationsparametern in der Datenbank)
+
+9. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth
+   Konfigurationsdatei CATALINA_HOME\conf\moa-id\moa-id.properties     
+     a.) configuration.moaconfig.key=.....   (Passwort zum Ver- und 
+         Entschlüsseln von Konfigurationsparametern in der Datenbank)
+
+10. Kopieren der folgenden Dateien  
+      a.) MOA_ID_AUTH_INST/conf/moa-id/htmlTemplates/slo_template.html ->
+          CATALINA_HOME/conf/moa-id/htmlTemplates/slo_template.html
+          Sollte die Datei bereits vorhanden sein erstellen Sie ein Backup der 
+          Datei slo_template.html bevor Sie diese durch die neue Version ersetzen.
+         
+11. Update des Cert-Stores.
+   Kopieren Sie den Inhalt des Verzeichnisses
+   MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis
+   CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie 
+   vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann 
+   bejahen sie das.
+
+12. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen 
+   wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile 
+   beibehalten wollen, dann gehen Sie vor, wie in Punkt b).
+
+   a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen:
+
+    1)  Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles.
+    2)  Kopieren Sie das Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis 
+        CATALINA_HOME\conf\moa-spss.
+
+   b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie 
+      folgt vor, um die Profile auf den aktuellen Stand zu bringen:
+
+    1)  Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den 
+        entsprechenden Profilen im Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren 
+        Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt 
+        der einzelnen Profile aus der Distribution 
+        (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden 
+        Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) 
+        kopieren und dabei die vorhandenen gleichnamigen Zertifikate 
+        überschreiben), also z.B: Kopieren des Inhalts von 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach 
+        CATALINA_HOME\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. 
+        
+13. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+    
+    
+...............................................................................
+B.4 Durchführung eines Updates von Version 2.0.1 auf Version 2.1.0 
+...............................................................................
+ 1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.1.0.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Datei moa-id-auth.war als 
+   auch das komplette Verzeichnis moa-id-auth.
+
+4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.   
+
+6. Update der STORK Konfiguration
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\stork
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\stork.
+     b.) Passen Sie die STORK Konfiguration laut Handbuch -> Konfiguration ->   
+         2.4 Konfiguration des SamlEngines an.
+         
+7. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Configuration Konfigurationsdatei
+   CATALINA_HOME\conf\moa-id-configuration\moa-id-configtool.properties     
+     a.) general.ssl.certstore=certs/certstore
+     b.) general.ssl.truststore=certs/truststore
+ 
+8. Kopieren des folgenden zusätzlichen Ordners  MOA_ID_AUTH_INST/conf/moa-id-configuration/certs
+   nach CATALINA_HOME\conf\moa-id-configuration\
+   
+9. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth Konfigurationsdatei
+   CATALINA_HOME\conf\moa-id\moa-id.properties und Anpassung an das zu verwendeten Schlüsselpaar.     
+     a.) protocols.pvp2.idp.ks.assertion.encryption.alias=pvp_assertion
+         protocols.pvp2.idp.ks.assertion.encryption.keypassword=password
+ 
+10. Kopieren der folgenden zusätzlichen Ordner aus MOA_ID_AUTH_INST/conf/moa-id/
+    nach CATALINA_HOME\conf\moa-id\
+      a.) MOA_ID_AUTH_INST/conf/moa-id/SLTemplates -> CATALINA_HOME\conf\moa-id\    
+      b.) MOA_ID_AUTH_INST/conf/moa-id/htmlTemplates/slo_template.html ->
+          CATALINA_HOME/conf/moa-id/htmlTemplates/slo_template.html
+      
+11. Neuinitialisieren des Datenbank Schema für die MOA-Session. Hierfür stehen 
+    zwei Varianten zur Verfügung.
+      a.) Ändern Sie in der Konfigurationsdatei für das Modul MOA-ID-Auth 
+          CATALINA_HOME\conf\moa-id\moa-id.properties die Zeile 
+               moasession.hibernate.hbm2ddl.auto=update
+          zu
+               moasession.hibernate.hbm2ddl.auto=create
+          Danach werden die Tabellen beim nächsten Startvorgang neu generiert.
+               
+      b.) Löschen Sie alle Tabellen aus dem Datenbank Schema für die MOA-Sessixson 
+          Informationen per Hand. Alle Tabellen werden beim nächsten Start autmatisch neu generiert.   
+       
+12 . Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+   Logging von MOA ID beim Einlesen der Konfiguration.
+
+
+...............................................................................
+B.5 Durchführung eines Updates von Version 2.0-RC1  auf Version 2.0.1
+...............................................................................
+
+1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.0.1.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+   Für MOA ID Proxy:
+   Entpacken Sie die Distribution von MOA-ID-Proxy (moa-id-proxy-2.0.1.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_PROXY_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Datei moa-id-auth.war als 
+   auch das komplette Verzeichnis moa-id-auth.
+
+4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+
+5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.  
+
+6. Update des Cert-Stores.
+   Kopieren Sie den Inhalt des Verzeichnisses
+   MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis
+   CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie 
+   vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann 
+   bejahen sie das.
+
+7. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen 
+   wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile 
+   beibehalten wollen, dann gehen Sie vor, wie in Punkt b).
+
+   a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen:
+
+    1)  Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles.
+    2)  Kopieren Sie das Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis 
+        CATALINA_HOME\conf\moa-spss.
+
+   b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie 
+      folgt vor, um die Profile auf den aktuellen Stand zu bringen:
+
+    1)  Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den 
+        entsprechenden Profilen im Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren 
+        Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt 
+        der einzelnen Profile aus der Distribution 
+        (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden 
+        Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) 
+        kopieren und dabei die vorhandenen gleichnamigen Zertifikate 
+        überschreiben), also z.B: Kopieren des Inhalts von 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach 
+        CATALINA_HOME\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw.
+           
+8. Update der Default html-Templates für die Bürgerkartenauswahl.
+
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\htmlTemplates
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\htmlTemplates.         
+     b.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id-configuration\htmlTemplates
+         in das Verzeichnis CATALINA_HOME\conf\moa-id-configuration\htmlTemplates. 
+
+9. Update der STORK Konfiguration
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\stork
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\stork.
+     b.) Passen Sie die STORK Konfiguration laut Handbuch -> Konfiguration ->   
+         2.4 Konfiguration des SamlEngines an.
+         
+10. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth Konfigurationsdatei
+   CATALINA_HOME\conf\moa-id\moa-id.properties
+     
+     a.) configuration.validation.certificate.QC.ignore=false
+     b.) protocols.pvp2.assertion.encryption.active=false          
+                                    
+11. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+   Logging von MOA ID beim Einlesen der Konfiguration.
+
+   
+...............................................................................
+B.6 Durchführung eines Updates von Version <= 1.5.1
+...............................................................................
+
+Bitte führen Sie eine Neuinstallation von MOA ID laut Handbuch durch und passen
+Sie die mitgelieferte Musterkonfiguration entsprechend Ihren Bedürfnissen unter 
+Zuhilfenahme Ihrer bisherigen Konfiguration an.
+
diff --git a/id/readme_3.1.1.txt b/id/readme_3.1.1.txt
new file mode 100644
index 000000000..50027725b
--- /dev/null
+++ b/id/readme_3.1.1.txt
@@ -0,0 +1,573 @@
+===============================================================================
+MOA ID Version Release 3.1.1 - Wichtige Informationen zur Installation
+===============================================================================
+
+-------------------------------------------------------------------------------
+A. Neuerungen/Änderungen
+-------------------------------------------------------------------------------
+
+Mit MOA ID Version 3.1.1 wurden folgende Neuerungen und Änderungen eingeführt, 
+die jetzt erstmals in der Veröffentlichung enthalten sind (siehe auch 
+history.txt im gleichen Verzeichnis).
+   
+- Änderungen
+  - Security Update für Struts 2
+  - Bug-Fix - BKU Auswahl beim Service Provider
+  - Update von Libraries
+
+
+-------------------------------------------------------------------------------
+B. Durchführung eines Updates
+-------------------------------------------------------------------------------
+
+Es wird generell eine Neuinstallation lt. Handbuch empfohlen! Dennoch ist auch
+eine Aktualisierung bestehender Installationen möglich. Je nachdem von welcher
+MOA-ID Version ausgegangen wird ergibt sich eine Kombination der nachfolgend 
+angebebenen Updateschritte.
+
+Hinweis: Wenn Sie die bestehende Konfiguration von MOA-ID 2.x.x in MOA-ID 3.1.x
+reimportieren möchten, so muss diese vor dem Update mit Hilfe der import/export
+Funktion der grafischen Konfigurationsoberfläche in eine Datei exportiert werden.
+Diese Datei dient dann als Basis für den Import in MOA-ID 3.1.x. 
+
+...............................................................................
+B.1 Durchführung eines Updates von Version 3.1.0 auf Version 3.1.1
+...............................................................................
+1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-3.1.1.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war 
+   als auch das komplette Verzeichnis moa-id-auth. 
+
+4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.   
+
+5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+
+6.  Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+         
+...............................................................................
+B.2 Durchführung eines Updates von Version 2.2.1 auf Version 3.1.1 
+...............................................................................
+
+1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-3.1.1.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war und
+   moa-id-configuration.war als auch das komplette Verzeichnis moa-id-auth 
+   und das komplette Verzeichnis moa-id-configuration.
+
+4. Erstellen Sie eine Sicherungskopie aller "*.jar"-Dateien im Verzeichnis
+	 CATALINA_HOME_ID\endorsed und loeschen Sie diese Dateien danach.
+   	
+5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+6. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+                                 
+7. Update des Cert-Stores.
+   Kopieren Sie den Inhalt des Verzeichnisses
+   MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis
+   CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie 
+   vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann 
+   bejahen sie das.
+
+8. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen 
+   wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile 
+   beibehalten wollen, dann gehen Sie vor, wie in Punkt b).
+
+   a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen:
+
+    1)  Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles.
+    2)  Kopieren Sie das Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis 
+        CATALINA_HOME\conf\moa-spss.
+
+   b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie 
+      folgt vor, um die Profile auf den aktuellen Stand zu bringen:
+
+    1)  Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den 
+        entsprechenden Profilen im Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren 
+        Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt 
+        der einzelnen Profile aus der Distribution 
+        (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden 
+        Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) 
+        kopieren und dabei die vorhandenen gleichnamigen Zertifikate 
+        überschreiben), also z.B: Kopieren des Inhalts von 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach 
+        CATALINA_HOME\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. 
+
+9. Update der Default html-Templates für die Bürgerkartenauswahl.
+
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\htmlTemplates
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\htmlTemplates.         
+     b.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id-configuration\htmlTemplates
+         in das Verzeichnis CATALINA_HOME\conf\moa-id-configuration\htmlTemplates. 
+
+10. Update der STORK Konfiguration
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\stork
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\stork.
+     b.) Passen Sie die STORK Konfiguration laut Handbuch -> Konfiguration ->   
+         2.4 Konfiguration des SamlEngines an.
+         
+11. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth Konfigurationsdatei
+    CATALINA_HOME\conf\moa-id\moa-id.properties
+   
+12. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Configration Konfigurationsdatei
+    CATALINA_HOME\conf\moa-id-configuration\moa-id-configtool.properties
+
+13. Hinzufügen der zusätzlichen Konfigurationsdatei in der MOA-ID-Configuration
+    CATALINA_HOME\conf\moa-id-configuration\userdatabase.properties
+
+14. Update der Tomcat Start-Skripts:
+    - Die Konfigurationsdateien für MOA-ID-Auth und MOA-ID-Configuration müssen
+      nur als URI (file:/...) übergeben werden. 
+                 
+15.  Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+
+
+...............................................................................
+B.1 Durchführung eines Updates von Version 2.2.0 auf Version 2.2.1 
+...............................................................................
+1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.2.1.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war und
+   moa-id-configuration.war als auch das komplette Verzeichnis moa-id-auth 
+   und das komplette Verzeichnis moa-id-configuration.
+	
+4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+                                 
+6. Update des Cert-Stores.
+   Kopieren Sie den Inhalt des Verzeichnisses
+   MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis
+   CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie 
+   vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann 
+   bejahen sie das.
+
+7. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen 
+   wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile 
+   beibehalten wollen, dann gehen Sie vor, wie in Punkt b).
+
+   a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen:
+
+    1)  Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles.
+    2)  Kopieren Sie das Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis 
+        CATALINA_HOME\conf\moa-spss.
+
+   b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie 
+      folgt vor, um die Profile auf den aktuellen Stand zu bringen:
+
+    1)  Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den 
+        entsprechenden Profilen im Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren 
+        Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt 
+        der einzelnen Profile aus der Distribution 
+        (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden 
+        Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) 
+        kopieren und dabei die vorhandenen gleichnamigen Zertifikate 
+        überschreiben), also z.B: Kopieren des Inhalts von 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach 
+        CATALINA_HOME\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. 
+                 
+8.  Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+
+...............................................................................
+B.1 Durchführung eines Updates von Version 2.1.2 auf Version 2.2.0 
+...............................................................................
+ 1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.2.0.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war und
+   moa-id-configuration.war als auch das komplette Verzeichnis moa-id-auth 
+   und das komplette Verzeichnis moa-id-configuration.
+   
+4. Erstellen Sie eine Sicherungskopie aller "*.jar"-Dateien im Verzeichnis
+	 CATALINA_HOME_ID\endorsed und loeschen Sie diese Dateien danach.
+	
+6. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+7. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+   
+8. Kopieren der folgenden Dateien:
+      Sollte die Datei bereits vorhanden sein erstellen Sie ein Backup der 
+      Datei bevor Sie diese durch die neue Version ersetzen.  
+      a.) MOA_ID_AUTH_INST/conf/moa-id/stork/StorkSamlEngine_VIDP.xml ->
+          CATALINA_HOME/conf/moa-id/stork/StorkSamlEngine_VIDP.xml
+      b.) MOA_ID_AUTH_INST/conf/moa-id/stork/StorkSamlEngine_outgoing.xml ->
+          CATALINA_HOME/conf/moa-id/stork/StorkSamlEngine_outgoing.xml          
+                    
+9. Dem STORK KeyStores unter MOA_ID_AUTH_INST/conf/moa-id/keys/storkDemoKeys.jks 
+   (Passwort=local-demo) wurden neue vertrauenswürdige Zertifikate hinzugefügt.
+   Gleichen Sie bei Bedarf die Zertifikate dieses KeyStores mit Ihrem aktuell
+   verwendeten KeyStore ab. 
+
+10. Update des Cert-Stores.
+   Kopieren Sie den Inhalt des Verzeichnisses
+   MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis
+   CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie 
+   vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann 
+   bejahen sie das.
+
+11. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen 
+   wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile 
+   beibehalten wollen, dann gehen Sie vor, wie in Punkt b).
+
+   a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen:
+
+    1)  Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles.
+    2)  Kopieren Sie das Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis 
+        CATALINA_HOME\conf\moa-spss.
+
+   b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie 
+      folgt vor, um die Profile auf den aktuellen Stand zu bringen:
+
+    1)  Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den 
+        entsprechenden Profilen im Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren 
+        Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt 
+        der einzelnen Profile aus der Distribution 
+        (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden 
+        Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) 
+        kopieren und dabei die vorhandenen gleichnamigen Zertifikate 
+        überschreiben), also z.B: Kopieren des Inhalts von 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach 
+        CATALINA_HOME\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. 
+
+                 
+12. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+
+...............................................................................
+B.2 Durchführung eines Updates von Version 2.1.1 auf Version 2.1.2 
+...............................................................................
+ 1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.1.2.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war und
+   moa-id-configuration.war als auch das komplette Verzeichnis moa-id-auth 
+   und das komplette Verzeichnis moa-id-configuration.
+   
+4. Erstellen Sie eine Sicherungskopie aller "*.jar"-Dateien im Verzeichnis
+	 CATALINA_HOME_ID\endorsed und loeschen Sie diese Dateien danach.
+	
+5. Kopieren Sie alle Dateien aus dem Verzeichnis MOA_ID_AUTH_INST\endorsed in das 
+   Verzeichnis	CATALINA_HOME_ID\endorsed   
+
+6. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+7. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+   
+8. Kopieren der folgenden Dateien  
+      a.) MOA_ID_AUTH_INST/conf/moa-id/stork/StorkSamlEngine_VIDP.xml ->
+          CATALINA_HOME/conf/moa-id/stork/StorkSamlEngine_VIDP.xml
+          Sollte die Datei bereits vorhanden sein erstellen Sie ein Backup der 
+          Datei slo_template.html bevor Sie diese durch die neue Version ersetzen.
+          
+9. Dem STORK KeyStores unter MOA_ID_AUTH_INST/conf/moa-id/keys/storkDemoKeys.jks 
+   (Passwort=local-demo) wurden neue vertrauenswürdige Zertifikate hinzugefügt.
+   Gleichen Sie bei Bedarf die Zertifikate dieses KeyStores mit Ihrem aktuell
+   verwendeten KeyStore ab. 
+                 
+10. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+
+
+...............................................................................
+B.3 Durchführung eines Updates von Version 2.1.0 auf Version 2.1.1 
+...............................................................................
+ 1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.1.0.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Erstellen Sie eine Sicherungskopie aller "iaik*.jar"-Dateien im Verzeichnis
+	 JAVA_HOME\jre\lib\ext und loeschen Sie diese Dateien danach.
+	
+4. Kopieren Sie alle Dateien aus dem Verzeichnis MOA_ID_AUTH_INST\ext in das 
+   Verzeichnis	JAVA_HOME\jre\lib\ext (Achtung: Java 1.4.x wird nicht mehr 
+   unterstuetzt).
+
+5. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Datei moa-id-auth.war als 
+   auch das komplette Verzeichnis moa-id-auth.
+
+6. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+7. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+   
+8. Hinzufügen der zusätzlichen Konfigurationsparameter in der 
+   MOA-ID-Configuration Konfigurationsdatei
+   CATALINA_HOME\conf\moa-id-configuration\moa-id-configtool.properties     
+     a.) general.moaconfig.key=.....         (Passwort zum Ver- und 
+         Entschlüsseln von Konfigurationsparametern in der Datenbank)
+
+9. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth
+   Konfigurationsdatei CATALINA_HOME\conf\moa-id\moa-id.properties     
+     a.) configuration.moaconfig.key=.....   (Passwort zum Ver- und 
+         Entschlüsseln von Konfigurationsparametern in der Datenbank)
+
+10. Kopieren der folgenden Dateien  
+      a.) MOA_ID_AUTH_INST/conf/moa-id/htmlTemplates/slo_template.html ->
+          CATALINA_HOME/conf/moa-id/htmlTemplates/slo_template.html
+          Sollte die Datei bereits vorhanden sein erstellen Sie ein Backup der 
+          Datei slo_template.html bevor Sie diese durch die neue Version ersetzen.
+         
+11. Update des Cert-Stores.
+   Kopieren Sie den Inhalt des Verzeichnisses
+   MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis
+   CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie 
+   vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann 
+   bejahen sie das.
+
+12. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen 
+   wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile 
+   beibehalten wollen, dann gehen Sie vor, wie in Punkt b).
+
+   a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen:
+
+    1)  Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles.
+    2)  Kopieren Sie das Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis 
+        CATALINA_HOME\conf\moa-spss.
+
+   b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie 
+      folgt vor, um die Profile auf den aktuellen Stand zu bringen:
+
+    1)  Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den 
+        entsprechenden Profilen im Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren 
+        Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt 
+        der einzelnen Profile aus der Distribution 
+        (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden 
+        Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) 
+        kopieren und dabei die vorhandenen gleichnamigen Zertifikate 
+        überschreiben), also z.B: Kopieren des Inhalts von 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach 
+        CATALINA_HOME\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. 
+        
+13. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+    
+    
+...............................................................................
+B.4 Durchführung eines Updates von Version 2.0.1 auf Version 2.1.0 
+...............................................................................
+ 1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.1.0.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Datei moa-id-auth.war als 
+   auch das komplette Verzeichnis moa-id-auth.
+
+4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.   
+
+6. Update der STORK Konfiguration
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\stork
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\stork.
+     b.) Passen Sie die STORK Konfiguration laut Handbuch -> Konfiguration ->   
+         2.4 Konfiguration des SamlEngines an.
+         
+7. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Configuration Konfigurationsdatei
+   CATALINA_HOME\conf\moa-id-configuration\moa-id-configtool.properties     
+     a.) general.ssl.certstore=certs/certstore
+     b.) general.ssl.truststore=certs/truststore
+ 
+8. Kopieren des folgenden zusätzlichen Ordners  MOA_ID_AUTH_INST/conf/moa-id-configuration/certs
+   nach CATALINA_HOME\conf\moa-id-configuration\
+   
+9. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth Konfigurationsdatei
+   CATALINA_HOME\conf\moa-id\moa-id.properties und Anpassung an das zu verwendeten Schlüsselpaar.     
+     a.) protocols.pvp2.idp.ks.assertion.encryption.alias=pvp_assertion
+         protocols.pvp2.idp.ks.assertion.encryption.keypassword=password
+ 
+10. Kopieren der folgenden zusätzlichen Ordner aus MOA_ID_AUTH_INST/conf/moa-id/
+    nach CATALINA_HOME\conf\moa-id\
+      a.) MOA_ID_AUTH_INST/conf/moa-id/SLTemplates -> CATALINA_HOME\conf\moa-id\    
+      b.) MOA_ID_AUTH_INST/conf/moa-id/htmlTemplates/slo_template.html ->
+          CATALINA_HOME/conf/moa-id/htmlTemplates/slo_template.html
+      
+11. Neuinitialisieren des Datenbank Schema für die MOA-Session. Hierfür stehen 
+    zwei Varianten zur Verfügung.
+      a.) Ändern Sie in der Konfigurationsdatei für das Modul MOA-ID-Auth 
+          CATALINA_HOME\conf\moa-id\moa-id.properties die Zeile 
+               moasession.hibernate.hbm2ddl.auto=update
+          zu
+               moasession.hibernate.hbm2ddl.auto=create
+          Danach werden die Tabellen beim nächsten Startvorgang neu generiert.
+               
+      b.) Löschen Sie alle Tabellen aus dem Datenbank Schema für die MOA-Sessixson 
+          Informationen per Hand. Alle Tabellen werden beim nächsten Start autmatisch neu generiert.   
+       
+12 . Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+   Logging von MOA ID beim Einlesen der Konfiguration.
+
+
+...............................................................................
+B.5 Durchführung eines Updates von Version 2.0-RC1  auf Version 2.0.1
+...............................................................................
+
+1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.0.1.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+   Für MOA ID Proxy:
+   Entpacken Sie die Distribution von MOA-ID-Proxy (moa-id-proxy-2.0.1.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_PROXY_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Datei moa-id-auth.war als 
+   auch das komplette Verzeichnis moa-id-auth.
+
+4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+
+5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.  
+
+6. Update des Cert-Stores.
+   Kopieren Sie den Inhalt des Verzeichnisses
+   MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis
+   CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie 
+   vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann 
+   bejahen sie das.
+
+7. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen 
+   wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile 
+   beibehalten wollen, dann gehen Sie vor, wie in Punkt b).
+
+   a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen:
+
+    1)  Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles.
+    2)  Kopieren Sie das Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis 
+        CATALINA_HOME\conf\moa-spss.
+
+   b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie 
+      folgt vor, um die Profile auf den aktuellen Stand zu bringen:
+
+    1)  Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den 
+        entsprechenden Profilen im Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren 
+        Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt 
+        der einzelnen Profile aus der Distribution 
+        (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden 
+        Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) 
+        kopieren und dabei die vorhandenen gleichnamigen Zertifikate 
+        überschreiben), also z.B: Kopieren des Inhalts von 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach 
+        CATALINA_HOME\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw.
+           
+8. Update der Default html-Templates für die Bürgerkartenauswahl.
+
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\htmlTemplates
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\htmlTemplates.         
+     b.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id-configuration\htmlTemplates
+         in das Verzeichnis CATALINA_HOME\conf\moa-id-configuration\htmlTemplates. 
+
+9. Update der STORK Konfiguration
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\stork
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\stork.
+     b.) Passen Sie die STORK Konfiguration laut Handbuch -> Konfiguration ->   
+         2.4 Konfiguration des SamlEngines an.
+         
+10. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth Konfigurationsdatei
+   CATALINA_HOME\conf\moa-id\moa-id.properties
+     
+     a.) configuration.validation.certificate.QC.ignore=false
+     b.) protocols.pvp2.assertion.encryption.active=false          
+                                    
+11. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+   Logging von MOA ID beim Einlesen der Konfiguration.
+
+   
+...............................................................................
+B.6 Durchführung eines Updates von Version <= 1.5.1
+...............................................................................
+
+Bitte führen Sie eine Neuinstallation von MOA ID laut Handbuch durch und passen
+Sie die mitgelieferte Musterkonfiguration entsprechend Ihren Bedürfnissen unter 
+Zuhilfenahme Ihrer bisherigen Konfiguration an.
+
diff --git a/id/readme_3.1.2.txt b/id/readme_3.1.2.txt
new file mode 100644
index 000000000..6fa7ddd4d
--- /dev/null
+++ b/id/readme_3.1.2.txt
@@ -0,0 +1,624 @@
+===============================================================================
+MOA ID Version Release 3.1.2 - Wichtige Informationen zur Installation
+===============================================================================
+
+-------------------------------------------------------------------------------
+A. Neuerungen/Änderungen
+-------------------------------------------------------------------------------
+
+Mit MOA ID Version 3.1.2 wurden folgende Neuerungen und Änderungen eingeführt, 
+die jetzt erstmals in der Veröffentlichung enthalten sind (siehe auch 
+history.txt im gleichen Verzeichnis).
+   
+- Änderungen
+  - Bug-Fix
+
+-------------------------------------------------------------------------------
+B. Durchführung eines Updates
+-------------------------------------------------------------------------------
+
+Es wird generell eine Neuinstallation lt. Handbuch empfohlen! Dennoch ist auch
+eine Aktualisierung bestehender Installationen möglich. Je nachdem von welcher
+MOA-ID Version ausgegangen wird ergibt sich eine Kombination der nachfolgend 
+angebebenen Updateschritte.
+
+Hinweis: Wenn Sie die bestehende Konfiguration von MOA-ID 2.x.x in MOA-ID 3.1.x
+reimportieren möchten, so muss diese vor dem Update mit Hilfe der import/export
+Funktion der grafischen Konfigurationsoberfläche in eine Datei exportiert werden.
+Diese Datei dient dann als Basis für den Import in MOA-ID 3.1.x. 
+
+...............................................................................
+B.1 Durchführung eines Updates von Version 3.1.x auf Version 3.1.2
+...............................................................................
+1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-3.1.2.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war 
+   als auch das komplette Verzeichnis moa-id-auth. 
+
+4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.   
+
+5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+
+6.  Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+
+
+...............................................................................
+B.1 Durchführung eines Updates von Version 3.0.x auf Version 3.1.2
+...............................................................................
+1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-3.1.2.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war 
+   als auch das komplette Verzeichnis moa-id-auth. 
+
+4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.   
+
+5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+
+6. Update der TrustStores für WebService Zugriffe.
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\certs\ca-certs
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\certs\ca-certs.         
+     b.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\certs\certstore\toBeAdded
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\certs\certstore\toBeAdded.
+
+7. Hinzufügen der zusätzlichen Konfigurationsparameter in der 
+   MOA-ID-Configuration Konfigurationsdatei
+   CATALINA_HOME\conf\moa-id-configuration\moa-id-configtool.properties     
+     a.) dbcp.validationQuery=.....         (SQL Query zum Validieren der
+         Datenbankverbindung 
+           z.B: "SELECT 1" für mySQL
+                "select 1 from dual" für OracleDB)
+
+8. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth
+   Konfigurationsdatei CATALINA_HOME\conf\moa-id\moa-id.properties     
+     a.) configuration.dbcp.validationQuery=.....         (SQL Query zum 
+         Validieren der Datenbankverbindung 
+           z.B: "SELECT 1" für mySQL
+                "select 1 from dual" für OracleDB)
+
+9. Update der Default html-Templates für die Bürgerkartenauswahl.
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\htmlTemplates
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\htmlTemplates.         
+     b.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id-configuration\htmlTemplates
+         in das Verzeichnis CATALINA_HOME\conf\moa-id-configuration\htmlTemplates. 
+
+10.  Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+
+         
+...............................................................................
+B.3 Durchführung eines Updates von Version 2.2.1 auf Version 3.1.2 
+...............................................................................
+
+1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-3.1.2.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war und
+   moa-id-configuration.war als auch das komplette Verzeichnis moa-id-auth 
+   und das komplette Verzeichnis moa-id-configuration.
+
+4. Erstellen Sie eine Sicherungskopie aller "*.jar"-Dateien im Verzeichnis
+	 CATALINA_HOME_ID\endorsed und loeschen Sie diese Dateien danach.
+   	
+5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+6. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+                                 
+7. Update des Cert-Stores.
+   Kopieren Sie den Inhalt des Verzeichnisses
+   MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis
+   CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie 
+   vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann 
+   bejahen sie das.
+
+8. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen 
+   wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile 
+   beibehalten wollen, dann gehen Sie vor, wie in Punkt b).
+
+   a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen:
+
+    1)  Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles.
+    2)  Kopieren Sie das Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis 
+        CATALINA_HOME\conf\moa-spss.
+
+   b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie 
+      folgt vor, um die Profile auf den aktuellen Stand zu bringen:
+
+    1)  Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den 
+        entsprechenden Profilen im Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren 
+        Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt 
+        der einzelnen Profile aus der Distribution 
+        (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden 
+        Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) 
+        kopieren und dabei die vorhandenen gleichnamigen Zertifikate 
+        überschreiben), also z.B: Kopieren des Inhalts von 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach 
+        CATALINA_HOME\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. 
+
+9. Update der Default html-Templates für die Bürgerkartenauswahl.
+
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\htmlTemplates
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\htmlTemplates.         
+     b.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id-configuration\htmlTemplates
+         in das Verzeichnis CATALINA_HOME\conf\moa-id-configuration\htmlTemplates. 
+
+10. Update der STORK Konfiguration
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\stork
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\stork.
+     b.) Passen Sie die STORK Konfiguration laut Handbuch -> Konfiguration ->   
+         2.4 Konfiguration des SamlEngines an.
+         
+11. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth Konfigurationsdatei
+    CATALINA_HOME\conf\moa-id\moa-id.properties
+   
+12. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Configration Konfigurationsdatei
+    CATALINA_HOME\conf\moa-id-configuration\moa-id-configtool.properties
+
+13. Hinzufügen der zusätzlichen Konfigurationsdatei in der MOA-ID-Configuration
+    CATALINA_HOME\conf\moa-id-configuration\userdatabase.properties
+
+14. Update der Tomcat Start-Skripts:
+    - Die Konfigurationsdateien für MOA-ID-Auth und MOA-ID-Configuration müssen
+      nur als URI (file:/...) übergeben werden. 
+                 
+15.  Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+
+
+...............................................................................
+B.4 Durchführung eines Updates von Version 2.2.0 auf Version 2.2.1 
+...............................................................................
+1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.2.1.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war und
+   moa-id-configuration.war als auch das komplette Verzeichnis moa-id-auth 
+   und das komplette Verzeichnis moa-id-configuration.
+	
+4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+                                 
+6. Update des Cert-Stores.
+   Kopieren Sie den Inhalt des Verzeichnisses
+   MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis
+   CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie 
+   vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann 
+   bejahen sie das.
+
+7. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen 
+   wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile 
+   beibehalten wollen, dann gehen Sie vor, wie in Punkt b).
+
+   a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen:
+
+    1)  Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles.
+    2)  Kopieren Sie das Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis 
+        CATALINA_HOME\conf\moa-spss.
+
+   b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie 
+      folgt vor, um die Profile auf den aktuellen Stand zu bringen:
+
+    1)  Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den 
+        entsprechenden Profilen im Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren 
+        Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt 
+        der einzelnen Profile aus der Distribution 
+        (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden 
+        Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) 
+        kopieren und dabei die vorhandenen gleichnamigen Zertifikate 
+        überschreiben), also z.B: Kopieren des Inhalts von 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach 
+        CATALINA_HOME\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. 
+                 
+8.  Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+
+...............................................................................
+B.1 Durchführung eines Updates von Version 2.1.2 auf Version 2.2.0 
+...............................................................................
+ 1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.2.0.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war und
+   moa-id-configuration.war als auch das komplette Verzeichnis moa-id-auth 
+   und das komplette Verzeichnis moa-id-configuration.
+   
+4. Erstellen Sie eine Sicherungskopie aller "*.jar"-Dateien im Verzeichnis
+	 CATALINA_HOME_ID\endorsed und loeschen Sie diese Dateien danach.
+	
+6. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+7. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+   
+8. Kopieren der folgenden Dateien:
+      Sollte die Datei bereits vorhanden sein erstellen Sie ein Backup der 
+      Datei bevor Sie diese durch die neue Version ersetzen.  
+      a.) MOA_ID_AUTH_INST/conf/moa-id/stork/StorkSamlEngine_VIDP.xml ->
+          CATALINA_HOME/conf/moa-id/stork/StorkSamlEngine_VIDP.xml
+      b.) MOA_ID_AUTH_INST/conf/moa-id/stork/StorkSamlEngine_outgoing.xml ->
+          CATALINA_HOME/conf/moa-id/stork/StorkSamlEngine_outgoing.xml          
+                    
+9. Dem STORK KeyStores unter MOA_ID_AUTH_INST/conf/moa-id/keys/storkDemoKeys.jks 
+   (Passwort=local-demo) wurden neue vertrauenswürdige Zertifikate hinzugefügt.
+   Gleichen Sie bei Bedarf die Zertifikate dieses KeyStores mit Ihrem aktuell
+   verwendeten KeyStore ab. 
+
+10. Update des Cert-Stores.
+   Kopieren Sie den Inhalt des Verzeichnisses
+   MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis
+   CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie 
+   vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann 
+   bejahen sie das.
+
+11. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen 
+   wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile 
+   beibehalten wollen, dann gehen Sie vor, wie in Punkt b).
+
+   a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen:
+
+    1)  Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles.
+    2)  Kopieren Sie das Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis 
+        CATALINA_HOME\conf\moa-spss.
+
+   b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie 
+      folgt vor, um die Profile auf den aktuellen Stand zu bringen:
+
+    1)  Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den 
+        entsprechenden Profilen im Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren 
+        Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt 
+        der einzelnen Profile aus der Distribution 
+        (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden 
+        Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) 
+        kopieren und dabei die vorhandenen gleichnamigen Zertifikate 
+        überschreiben), also z.B: Kopieren des Inhalts von 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach 
+        CATALINA_HOME\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. 
+
+                 
+12. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+
+...............................................................................
+B.2 Durchführung eines Updates von Version 2.1.1 auf Version 2.1.2 
+...............................................................................
+ 1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.1.2.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war und
+   moa-id-configuration.war als auch das komplette Verzeichnis moa-id-auth 
+   und das komplette Verzeichnis moa-id-configuration.
+   
+4. Erstellen Sie eine Sicherungskopie aller "*.jar"-Dateien im Verzeichnis
+	 CATALINA_HOME_ID\endorsed und loeschen Sie diese Dateien danach.
+	
+5. Kopieren Sie alle Dateien aus dem Verzeichnis MOA_ID_AUTH_INST\endorsed in das 
+   Verzeichnis	CATALINA_HOME_ID\endorsed   
+
+6. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+7. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+   
+8. Kopieren der folgenden Dateien  
+      a.) MOA_ID_AUTH_INST/conf/moa-id/stork/StorkSamlEngine_VIDP.xml ->
+          CATALINA_HOME/conf/moa-id/stork/StorkSamlEngine_VIDP.xml
+          Sollte die Datei bereits vorhanden sein erstellen Sie ein Backup der 
+          Datei slo_template.html bevor Sie diese durch die neue Version ersetzen.
+          
+9. Dem STORK KeyStores unter MOA_ID_AUTH_INST/conf/moa-id/keys/storkDemoKeys.jks 
+   (Passwort=local-demo) wurden neue vertrauenswürdige Zertifikate hinzugefügt.
+   Gleichen Sie bei Bedarf die Zertifikate dieses KeyStores mit Ihrem aktuell
+   verwendeten KeyStore ab. 
+                 
+10. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+
+
+...............................................................................
+B.3 Durchführung eines Updates von Version 2.1.0 auf Version 2.1.1 
+...............................................................................
+ 1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.1.0.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Erstellen Sie eine Sicherungskopie aller "iaik*.jar"-Dateien im Verzeichnis
+	 JAVA_HOME\jre\lib\ext und loeschen Sie diese Dateien danach.
+	
+4. Kopieren Sie alle Dateien aus dem Verzeichnis MOA_ID_AUTH_INST\ext in das 
+   Verzeichnis	JAVA_HOME\jre\lib\ext (Achtung: Java 1.4.x wird nicht mehr 
+   unterstuetzt).
+
+5. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Datei moa-id-auth.war als 
+   auch das komplette Verzeichnis moa-id-auth.
+
+6. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+7. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.
+   
+8. Hinzufügen der zusätzlichen Konfigurationsparameter in der 
+   MOA-ID-Configuration Konfigurationsdatei
+   CATALINA_HOME\conf\moa-id-configuration\moa-id-configtool.properties     
+     a.) general.moaconfig.key=.....         (Passwort zum Ver- und 
+         Entschlüsseln von Konfigurationsparametern in der Datenbank)
+
+9. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth
+   Konfigurationsdatei CATALINA_HOME\conf\moa-id\moa-id.properties     
+     a.) configuration.moaconfig.key=.....   (Passwort zum Ver- und 
+         Entschlüsseln von Konfigurationsparametern in der Datenbank)
+
+10. Kopieren der folgenden Dateien  
+      a.) MOA_ID_AUTH_INST/conf/moa-id/htmlTemplates/slo_template.html ->
+          CATALINA_HOME/conf/moa-id/htmlTemplates/slo_template.html
+          Sollte die Datei bereits vorhanden sein erstellen Sie ein Backup der 
+          Datei slo_template.html bevor Sie diese durch die neue Version ersetzen.
+         
+11. Update des Cert-Stores.
+   Kopieren Sie den Inhalt des Verzeichnisses
+   MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis
+   CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie 
+   vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann 
+   bejahen sie das.
+
+12. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen 
+   wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile 
+   beibehalten wollen, dann gehen Sie vor, wie in Punkt b).
+
+   a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen:
+
+    1)  Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles.
+    2)  Kopieren Sie das Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis 
+        CATALINA_HOME\conf\moa-spss.
+
+   b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie 
+      folgt vor, um die Profile auf den aktuellen Stand zu bringen:
+
+    1)  Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den 
+        entsprechenden Profilen im Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren 
+        Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt 
+        der einzelnen Profile aus der Distribution 
+        (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden 
+        Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) 
+        kopieren und dabei die vorhandenen gleichnamigen Zertifikate 
+        überschreiben), also z.B: Kopieren des Inhalts von 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach 
+        CATALINA_HOME\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. 
+        
+13. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+    Logging von MOA ID beim Einlesen der Konfiguration.
+    
+    
+...............................................................................
+B.4 Durchführung eines Updates von Version 2.0.1 auf Version 2.1.0 
+...............................................................................
+ 1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.1.0.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Datei moa-id-auth.war als 
+   auch das komplette Verzeichnis moa-id-auth.
+
+4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+   
+5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.   
+
+6. Update der STORK Konfiguration
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\stork
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\stork.
+     b.) Passen Sie die STORK Konfiguration laut Handbuch -> Konfiguration ->   
+         2.4 Konfiguration des SamlEngines an.
+         
+7. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Configuration Konfigurationsdatei
+   CATALINA_HOME\conf\moa-id-configuration\moa-id-configtool.properties     
+     a.) general.ssl.certstore=certs/certstore
+     b.) general.ssl.truststore=certs/truststore
+ 
+8. Kopieren des folgenden zusätzlichen Ordners  MOA_ID_AUTH_INST/conf/moa-id-configuration/certs
+   nach CATALINA_HOME\conf\moa-id-configuration\
+   
+9. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth Konfigurationsdatei
+   CATALINA_HOME\conf\moa-id\moa-id.properties und Anpassung an das zu verwendeten Schlüsselpaar.     
+     a.) protocols.pvp2.idp.ks.assertion.encryption.alias=pvp_assertion
+         protocols.pvp2.idp.ks.assertion.encryption.keypassword=password
+ 
+10. Kopieren der folgenden zusätzlichen Ordner aus MOA_ID_AUTH_INST/conf/moa-id/
+    nach CATALINA_HOME\conf\moa-id\
+      a.) MOA_ID_AUTH_INST/conf/moa-id/SLTemplates -> CATALINA_HOME\conf\moa-id\    
+      b.) MOA_ID_AUTH_INST/conf/moa-id/htmlTemplates/slo_template.html ->
+          CATALINA_HOME/conf/moa-id/htmlTemplates/slo_template.html
+      
+11. Neuinitialisieren des Datenbank Schema für die MOA-Session. Hierfür stehen 
+    zwei Varianten zur Verfügung.
+      a.) Ändern Sie in der Konfigurationsdatei für das Modul MOA-ID-Auth 
+          CATALINA_HOME\conf\moa-id\moa-id.properties die Zeile 
+               moasession.hibernate.hbm2ddl.auto=update
+          zu
+               moasession.hibernate.hbm2ddl.auto=create
+          Danach werden die Tabellen beim nächsten Startvorgang neu generiert.
+               
+      b.) Löschen Sie alle Tabellen aus dem Datenbank Schema für die MOA-Sessixson 
+          Informationen per Hand. Alle Tabellen werden beim nächsten Start autmatisch neu generiert.   
+       
+12 . Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+   Logging von MOA ID beim Einlesen der Konfiguration.
+
+
+...............................................................................
+B.5 Durchführung eines Updates von Version 2.0-RC1  auf Version 2.0.1
+...............................................................................
+
+1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird.
+   Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an.
+
+2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.0.1.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST 
+   bezeichnet.
+   Für MOA ID Proxy:
+   Entpacken Sie die Distribution von MOA-ID-Proxy (moa-id-proxy-2.0.1.zip) in
+   ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_PROXY_INST 
+   bezeichnet.
+
+3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth
+   beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps,
+   wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation 
+   für MOA ID steht). Löschen Sie darin sowohl die Datei moa-id-auth.war als 
+   auch das komplette Verzeichnis moa-id-auth.
+
+4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach
+   CATALINA_HOME_ID/webapps.
+
+5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach
+   CATALINA_HOME_ID/webapps.  
+
+6. Update des Cert-Stores.
+   Kopieren Sie den Inhalt des Verzeichnisses
+   MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis
+   CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie 
+   vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann 
+   bejahen sie das.
+
+7. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen 
+   wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile 
+   beibehalten wollen, dann gehen Sie vor, wie in Punkt b).
+
+   a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen:
+
+    1)  Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles.
+    2)  Kopieren Sie das Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis 
+        CATALINA_HOME\conf\moa-spss.
+
+   b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie 
+      folgt vor, um die Profile auf den aktuellen Stand zu bringen:
+
+    1)  Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den 
+        entsprechenden Profilen im Verzeichnis 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren 
+        Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt 
+        der einzelnen Profile aus der Distribution 
+        (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden 
+        Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) 
+        kopieren und dabei die vorhandenen gleichnamigen Zertifikate 
+        überschreiben), also z.B: Kopieren des Inhalts von 
+        MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach 
+        CATALINA_HOME\conf\moa-spss\trustProfiles\
+        MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw.
+           
+8. Update der Default html-Templates für die Bürgerkartenauswahl.
+
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\htmlTemplates
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\htmlTemplates.         
+     b.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id-configuration\htmlTemplates
+         in das Verzeichnis CATALINA_HOME\conf\moa-id-configuration\htmlTemplates. 
+
+9. Update der STORK Konfiguration
+     a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\stork
+         in das Verzeichnis CATALINA_HOME\conf\moa-id\stork.
+     b.) Passen Sie die STORK Konfiguration laut Handbuch -> Konfiguration ->   
+         2.4 Konfiguration des SamlEngines an.
+         
+10. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth Konfigurationsdatei
+   CATALINA_HOME\conf\moa-id\moa-id.properties
+     
+     a.) configuration.validation.certificate.QC.ignore=false
+     b.) protocols.pvp2.assertion.encryption.active=false          
+                                    
+11. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im
+   Logging von MOA ID beim Einlesen der Konfiguration.
+
+   
+...............................................................................
+B.6 Durchführung eines Updates von Version <= 1.5.1
+...............................................................................
+
+Bitte führen Sie eine Neuinstallation von MOA ID laut Handbuch durch und passen
+Sie die mitgelieferte Musterkonfiguration entsprechend Ihren Bedürfnissen unter 
+Zuhilfenahme Ihrer bisherigen Konfiguration an.
+
diff --git a/id/server/auth-edu/pom.xml b/id/server/auth-edu/pom.xml
index 090bb985b..b550249e9 100644
--- a/id/server/auth-edu/pom.xml
+++ b/id/server/auth-edu/pom.xml
@@ -93,12 +93,9 @@
 		<dependency>
 			<groupId>MOA.id</groupId>
   		<artifactId>moa-spss-container</artifactId>
+  		<type>pom</type>
   		<exclusions>
 					<exclusion>
-						<artifactId>iaik_pki_module</artifactId>
-						<groupId>iaik</groupId>
-					</exclusion>
-					<exclusion>
 						<groupId>commons-logging</groupId>
 						<artifactId>commons-logging</artifactId>
 					</exclusion>
@@ -218,12 +215,12 @@
 			<!-- should be in the ext directory of the jre -->
 			<scope>provided</scope>
 		</dependency>
-		<dependency>
+<!-- 		<dependency>
 			<groupId>iaik.prod</groupId>
 			<artifactId>iaik_ecc</artifactId>
-			<!-- should be in the ext directory of the jre -->
+			should be in the ext directory of the jre
 			<scope>provided</scope>
-		</dependency>
+		</dependency> -->
 		<dependency>
 			<groupId>iaik.prod</groupId>
 			<artifactId>iaik_Pkcs11Provider</artifactId>
diff --git a/id/server/auth-final/pom.xml b/id/server/auth-final/pom.xml
index 61eba7f22..b2f542880 100644
--- a/id/server/auth-final/pom.xml
+++ b/id/server/auth-final/pom.xml
@@ -77,12 +77,9 @@
 		<dependency>
 			<groupId>MOA.id</groupId>
   		<artifactId>moa-spss-container</artifactId>
+  		<type>pom</type>
   		<exclusions>
 					<exclusion>
-						<artifactId>iaik_pki_module</artifactId>
-						<groupId>iaik</groupId>
-					</exclusion>
-					<exclusion>
 						<groupId>commons-logging</groupId>
 						<artifactId>commons-logging</artifactId>
 					</exclusion>
@@ -158,16 +155,11 @@
 			<artifactId>moa-id-module-openID</artifactId>
 		</dependency>
 
-		<dependency>
+ 		<dependency>
 			<groupId>MOA.id.server.modules</groupId>
     	<artifactId>moa-id-module-elga_mandate_service</artifactId>
 		</dependency>
 
-<!-- 		<dependency>
-			<groupId>MOA.id.server.modules</groupId>
-			<artifactId>moa-id-module-eIDAS</artifactId>
-		</dependency> -->
-
  		<dependency>
 			<groupId>MOA.id.server.modules</groupId>
 			<artifactId>moa-id-modul-citizencard_authentication</artifactId>
@@ -191,12 +183,12 @@
 			<!-- should be in the ext directory of the jre -->
 			<scope>provided</scope>
 		</dependency>
-		<dependency>
+<!-- 		<dependency>
 			<groupId>iaik.prod</groupId>
 			<artifactId>iaik_ecc</artifactId>
-			<!-- should be in the ext directory of the jre -->
+			should be in the ext directory of the jre
 			<scope>provided</scope>
-		</dependency>
+		</dependency> -->
 		<dependency>
 			<groupId>iaik.prod</groupId>
 			<artifactId>iaik_Pkcs11Provider</artifactId>
diff --git a/id/server/data/deploy/conf/moa-id-configuration/htmlTemplates/loginFormFull.html b/id/server/data/deploy/conf/moa-id-configuration/htmlTemplates/loginFormFull.html
index 02b86472b..32f0a7d4d 100644
--- a/id/server/data/deploy/conf/moa-id-configuration/htmlTemplates/loginFormFull.html
+++ b/id/server/data/deploy/conf/moa-id-configuration/htmlTemplates/loginFormFull.html
@@ -22,7 +22,7 @@
 						<h2 id="tabheader" class="dunkel" role="heading">$HEADER_TEXT</h2>
 					</div>
 					<div id="bkulogin" class="hell" role="form">
-						<div id="mandateLogin" style="">
+						<div id="mandateLogin" style="$MANDATEVISIBLE">
 							<div>
 								<input tabindex="1" type="checkbox" name="Mandate"
 									id="mandateCheckBox" class="verticalcenter" role="checkbox"
@@ -37,13 +37,13 @@
 						</div>
 						<div id="bkuselectionarea">
 							<div id="bkukarte">
-								<img id="bkuimage" class="bkuimage" src="$contextPath/img/online-bku.png"
+								<img id="bkuimage" class="bkuimage" src="$contextPath/img/karte.png"
 									alt="OnlineBKU" /> <input name="bkuButtonOnline" type="button"
 									onClick="bkuOnlineClicked();" tabindex="2" role="button"
 									value="Karte" />
 							</div>
 							<div id="bkuhandy">
-								<img class="bkuimage" src="$contextPath/img/mobile-bku.png"
+								<img class="bkuimage" src="$contextPath/img/handysign.png"
 									alt="HandyBKU" /> <input name="bkuButtonHandy" type="button"
 									onClick="bkuHandyClicked();" tabindex="3" role="button"
 									value="HANDY" />
diff --git a/id/server/data/deploy/conf/moa-id-configuration/htmlTemplates/sendAssertionFormFull.html b/id/server/data/deploy/conf/moa-id-configuration/htmlTemplates/sendAssertionFormFull.html
index a9f0c4238..7ae4b3f92 100644
--- a/id/server/data/deploy/conf/moa-id-configuration/htmlTemplates/sendAssertionFormFull.html
+++ b/id/server/data/deploy/conf/moa-id-configuration/htmlTemplates/sendAssertionFormFull.html
@@ -3,7 +3,7 @@
 <head>
 	<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
     <!-- MOA-ID 2.x BKUSelection Layout CSS -->               
-    <link rel="stylesheet" href="$contextPath/css/buildCSS?pendingid=#ID#" />
+    <link rel="stylesheet" href="$contextPath/css/buildCSS?pendingid=$pendingReqID" />
     
     <title>Anmeldung an Online-Applikation</title>   
 </head>
diff --git a/id/server/data/deploy/conf/moa-id/htmlTemplates/javascript_tempalte.js b/id/server/data/deploy/conf/moa-id/htmlTemplates/javascript_tempalte.js
index eadb65b2b..a463bae65 100644
--- a/id/server/data/deploy/conf/moa-id/htmlTemplates/javascript_tempalte.js
+++ b/id/server/data/deploy/conf/moa-id/htmlTemplates/javascript_tempalte.js
@@ -142,7 +142,7 @@ function isIE() {
         var image = document.getElementById("bkuimage");
         var srcatt = image.getAttribute("src");
         var last = srcatt.substring(srcatt.lastIndexOf('/')+1);
-        srcatt = srcatt.replace(last,'online-bku-deactivated.png');    
+        srcatt = srcatt.replace(last,'karte_deactivated.png');    
         image.setAttribute("src",srcatt);
          
          
diff --git a/id/server/data/deploy/conf/moa-id/htmlTemplates/loginFormFull.html b/id/server/data/deploy/conf/moa-id/htmlTemplates/loginFormFull.html
index 02b86472b..32f0a7d4d 100644
--- a/id/server/data/deploy/conf/moa-id/htmlTemplates/loginFormFull.html
+++ b/id/server/data/deploy/conf/moa-id/htmlTemplates/loginFormFull.html
@@ -22,7 +22,7 @@
 						<h2 id="tabheader" class="dunkel" role="heading">$HEADER_TEXT</h2>
 					</div>
 					<div id="bkulogin" class="hell" role="form">
-						<div id="mandateLogin" style="">
+						<div id="mandateLogin" style="$MANDATEVISIBLE">
 							<div>
 								<input tabindex="1" type="checkbox" name="Mandate"
 									id="mandateCheckBox" class="verticalcenter" role="checkbox"
@@ -37,13 +37,13 @@
 						</div>
 						<div id="bkuselectionarea">
 							<div id="bkukarte">
-								<img id="bkuimage" class="bkuimage" src="$contextPath/img/online-bku.png"
+								<img id="bkuimage" class="bkuimage" src="$contextPath/img/karte.png"
 									alt="OnlineBKU" /> <input name="bkuButtonOnline" type="button"
 									onClick="bkuOnlineClicked();" tabindex="2" role="button"
 									value="Karte" />
 							</div>
 							<div id="bkuhandy">
-								<img class="bkuimage" src="$contextPath/img/mobile-bku.png"
+								<img class="bkuimage" src="$contextPath/img/handysign.png"
 									alt="HandyBKU" /> <input name="bkuButtonHandy" type="button"
 									onClick="bkuHandyClicked();" tabindex="3" role="button"
 									value="HANDY" />
diff --git a/id/server/data/deploy/conf/moa-id/moa-id.properties b/id/server/data/deploy/conf/moa-id/moa-id.properties
index 54cfaee18..5e8bfa567 100644
--- a/id/server/data/deploy/conf/moa-id/moa-id.properties
+++ b/id/server/data/deploy/conf/moa-id/moa-id.properties
@@ -5,24 +5,24 @@
 ******
 
 
-##General MOA-ID 3.0 Configuration
+##General MOA-ID 3.x Configuration
 
 ##For Testing
 configuration.validation.certificate.QC.ignore=false
 protocols.pvp2.assertion.encryption.active=false
 protocols.pvp2.schemavalidation=true
 
-##General MOA-ID 2.0 operations
-#MOA-ID 2.0 session information encryption key (PassPhrase)
+##General MOA-ID 3.x operations
+#MOA-ID 3.x session information encryption key (PassPhrase)
 configuration.moasession.key=SessionEncryptionKey
 configuration.moaconfig.key=ConfigurationEncryptionKey
 
-#MOA-ID 2.0 Monitoring Servlet
+#MOA-ID 3.x Monitoring Servlet
 configuration.monitoring.active=false
 configuration.monitoring.message.success=All Tests passed!
 configuration.monitoring.test.identitylink.url=$PATH_TO_CONFIG$/conf/moa-id/monitoring/monitoring_idl.xml
 
-#MOA-ID 2.0 Advanced Logging
+#MOA-ID 3.x Advanced Logging
 configuration.advancedlogging.active=false
 
 ##Webservice Client Configuration
@@ -47,13 +47,6 @@ stork.fakeIdL.countries=
 stork.fakeIdL.keygroup=
 stork.documentservice.url=
 
-
-## eIDAS protocol configuration
-moa.id.protocols.eIDAS.samlengine.config.file=eIDAS/SamlEngine_basics.xml
-moa.id.protocols.eIDAS.samlengine.sign.config.file=eIDAS/SignModule.xml
-moa.id.protocols.eIDAS.samlengine.enc.config.file=eIDAS/EncryptModule.xml
-moa.id.protocols.eIDAS.metadata.validation.truststore=eIDAS_metadata
-
 ##Protocol configuration##
 #PVP2
 protocols.pvp2.idp.ks.file=file:$PATH_TO_CONFIG$/conf/moa-id/keys/moa_idp[password].p12
@@ -72,7 +65,7 @@ protocols.oauth20.jwt.ks.key.name=oauth
 protocols.oauth20.jwt.ks.key.password=password
 
 ##Database configuration##
-#Hibnerate configuration for MOA-ID 2.0 session store 
+#Hibnerate configuration for MOA-ID 3.x session store 
 moasession.hibernate.dialect=org.hibernate.dialect.MySQLDialect
 moasession.hibernate.connection.url=jdbc:mysql://localhost/moa-id-session?charSet=utf-8
 moasession.hibernate.connection.charSet=utf-8
@@ -100,7 +93,7 @@ moasession.dbcp.validationQuery=select 1
 moasession.jpaVendorAdapter.generateDdl=true
 
 
-#Hibnerate configuration for MOA-ID 2.0 configuration
+#Hibnerate configuration for MOA-ID 3.x configuration
 configuration.hibernate.dialect=org.hibernate.dialect.MySQLDialect
 configuration.jpaVendorAdapter.generateDdl=true
 configuration.hibernate.show_sql=false
@@ -123,7 +116,7 @@ configuration.dbcp.testWhileIdle=false
 configuration.dbcp.validationQuery=SELECT 1
 
 #
-#Hibnerate configuration for MOA-ID 2.0 advanced statistic logging
+#Hibnerate configuration for MOA-ID 3.x advanced statistic logging
 advancedlogging.hibernate.dialect=org.hibernate.dialect.MySQLDialect
 advancedlogging.hibernate.connection.url=jdbc:mysql://localhost/moa-id-statistic?charSet=utf-8&autoReconnect=true
 advancedlogging.hibernate.connection.charSet=utf-8
@@ -142,6 +135,12 @@ advancedlogging.hibernate.format_sql=true
 ##  This additional eID moduls add special functionality to MOA-ID-Auth.
 ##  The configuration of this modules is only needed if this modules are in use.
 ########
+### eIDAS protocol configuration ###
+moa.id.protocols.eIDAS.samlengine.config.file=eIDAS/SamlEngine_basics.xml
+moa.id.protocols.eIDAS.samlengine.sign.config.file=eIDAS/SignModule.xml
+moa.id.protocols.eIDAS.samlengine.enc.config.file=eIDAS/EncryptModule.xml
+moa.id.protocols.eIDAS.metadata.validation.truststore=eIDAS_metadata
+
 ### HBV Mandate-Service client module ###
 modules.elga_mandate.nameID.target=urn:publicid:gv.at:cdid+GH
 modules.elga_mandate.service.entityID=
diff --git a/id/server/doc/handbook/application/application.html b/id/server/doc/handbook/application/application.html
index 5fadafd9a..60732acaf 100644
--- a/id/server/doc/handbook/application/application.html
+++ b/id/server/doc/handbook/application/application.html
@@ -129,7 +129,7 @@ https://&lt;host&gt;:&lt;port&gt;/moa-id-oa/
   </tr>
   <tr>
     <td>general.login.pvp2.idp.metadata.entityID</td>
-    <td>https://demo.egiz.gv.at/moa-id-auth/</td>
+    <td>https://demo.egiz.gv.at/moa-id-auth/pvp2/metadata</td>
     <td>EntityID des IDP in den Metadaten (Details siehe PVP2.1 Spezifikation)</td>
   </tr>
   <tr>
diff --git a/id/server/doc/handbook/protocol/Assertion.xml b/id/server/doc/handbook/protocol/Assertion.xml
index b6db5f088..2654f2e80 100644
--- a/id/server/doc/handbook/protocol/Assertion.xml
+++ b/id/server/doc/handbook/protocol/Assertion.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://demo.egiz.gv.at/demoportal_demologin/securearea.action" InResponseTo="_aeebfae3ce681fe3ddcaf213a42f01d3" IssueInstant="2014-03-05T06:39:51.017Z" Version="2.0" xmlns:xs="http://www.w3.org/2001/XMLSchema">
-	<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://demo.egiz.gv.at/demoportal_moaid-2.0</saml2:Issuer>
+	<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://demo.egiz.gv.at/demoportal_moaid-2.0/pvp/metadata</saml2:Issuer>
 	<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
 		<ds:SignedInfo>
 			<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
@@ -34,7 +34,7 @@ nibdIyU5+AmfFzDaMwNocJEANoXrjLTpduCHvT0Qt/wH+7rVdgjX1djMrBhyMWs7GQyIBRfuf58m
 		<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
 	</saml2p:Status>
 	<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_602c3236bffaf71ac3ac88674e76ff9f" IssueInstant="2014-03-05T06:39:51.017Z" Version="2.0">
-		<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://demo.egiz.gv.at/demoportal_moaid-2.0</saml2:Issuer>
+		<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://demo.egiz.gv.at/demoportal_moaid-2.0/pvp/metadata</saml2:Issuer>
 		<saml2:Subject>
 			<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="urn:publicid:gv.at:cdid+BF">QVGm48cqcM4UcyhDTNGYmVdrIoY=</saml2:NameID>
 			<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
diff --git a/id/server/doc/handbook/protocol/idp_metadata.xml b/id/server/doc/handbook/protocol/idp_metadata.xml
index e8915332e..ffc15d461 100644
--- a/id/server/doc/handbook/protocol/idp_metadata.xml
+++ b/id/server/doc/handbook/protocol/idp_metadata.xml
@@ -1,4 +1,4 @@
-<md:EntitiesDescriptor ID="_c0303e3081ac29bb8329cade76279069" Name="MOA-ID 2.0 Demo IDP (Version: 2.1.0)" validUntil="2014-07-04T11:23:29.736Z">
+<md:EntitiesDescriptor ID="_c0303e3081ac29bb8329cade76279069" Name="MOA-ID 3.1 Demo IDP (Version: 3.1.0)" validUntil="2016-04-05T11:23:29.736Z">
 	<ds:Signature>
 		<ds:SignedInfo>
 			<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
@@ -37,7 +37,7 @@ cfmNJhb06H+6mmHz929Bk4HuHoQj8X8=</ds:X509Certificate>
 			</ds:X509Data>
 		</ds:KeyInfo>
 	</ds:Signature>
-	<md:EntityDescriptor entityID="https://demo.egiz.gv.at/demoportal_moaid-2.0" validUntil="2014-07-27T11:23:29.736Z">
+	<md:EntityDescriptor entityID="https://demo.egiz.gv.at/demoportal_moaid-2.0/pvp/metadata" validUntil="2014-07-27T11:23:29.736Z">
 		<md:IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
 			<md:KeyDescriptor use="signing">
 				<ds:KeyInfo>
diff --git a/id/server/doc/handbook/protocol/protocol.html b/id/server/doc/handbook/protocol/protocol.html
index 6713bd7a3..58474b635 100644
--- a/id/server/doc/handbook/protocol/protocol.html
+++ b/id/server/doc/handbook/protocol/protocol.html
@@ -1079,6 +1079,7 @@ https://&lt;host&gt;:&lt;port&gt;/moa-id-auth/LogOut
 <pre>
 https://&lt;host&gt;:&lt;port&gt;/moa-id-auth/pvp2/metadata
 </pre>
+<p><strong>Hinweis:</strong> Ist die deployed MOA-ID Instanz f&uuml;r mehrere virtuelle IDPs konfiguriert, so k&ouml;nnen die Metadaten f&uuml;r die jeweiligen virutellen Entities &uuml;ber den PublicURLPrefix der jeweiligen virtuellen Instanz abgerufen werden. Z.B. https://aaa.com/moa-id-auth/pvp2/metadata f&uuml;r virtuellen IDP aaa.com oder https://bbb.com/moa-id-auth/pvp2/metadata f&uuml;r virtuellen IDP bbb.com</p>
 <p>Wollen Sie f&uuml;r Ihre Online-Applikation PVP 2.1 als Authentifizierungsprotokoll nutzen m&uuml;ssen f&uuml;r jede Online-Applikation Metadaten erstellt und durch den Service Provider signiert werden. Zus&auml;tzlich muss die URL auf die Metadaten und das entsprechende Signaturzertifikat zur Pr&uuml;fung der Signatur in der online-applikationsspezifischen <a href="../config/config.html#konfigurationsparameter_oa_protocol_pvp21">PVP 2.1 Konfiguration</a> von MOA-ID-Auth hinterlegt sein. Ein Beispiel f&uuml;r online-applikationsspezifische Metadaten finden Sie <a href="serviceprovider_metadata.xml">hier</a>.</p>
 <p>Die nachfolgenden Anforderungen an die online-applikationsspezifischen Metadaten .</p>
 <ul>
diff --git a/id/server/doc/htmlTemplates/BKU-selection.html b/id/server/doc/htmlTemplates/BKU-selection.html
index 2b0115d4a..32f0a7d4d 100644
--- a/id/server/doc/htmlTemplates/BKU-selection.html
+++ b/id/server/doc/htmlTemplates/BKU-selection.html
@@ -4,847 +4,29 @@
 <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
 
    <!-- MOA-ID 2.x BKUSelection Layout CSS -->               
-    <style type="text/css">
-			@media screen and (min-width: 650px) {
-			
-				body {
-					margin:0;
-					padding:0;
-					color : #000;
-					background-color : #fff;
-			  	text-align: center;
-			  	background-color: #6B7B8B;
-				}
-                
-                .browserInfoButton{
-         color: rgb(128, 128, 128); 
-        }
-				
-        #localBKU p {
-          font-size: 0.7em;
-        } 
-        
-        #localBKU input{
-          font-size: 0.85em;
-          /*border-radius: 5px;*/
-        }
-        
-         #bkuselectionarea input[type=button] {
-          font-size: 0.85em;
-          /*border-radius: 7px;*/
-          margin-bottom: 25px;
-          min-width: 80px;
-         }
-        
-        #mandateLogin {
-          font-size: 0.85em;
-        }
-        
-        #bku_header h2 {
-          font-size: 0.8em;
-        } 
-        
-        
-			  #page {
-			    display: block;
-			    border: 2px solid rgb(0,0,0);
-			    width: 650px;
-			    height: 460px;
-			    margin: 0 auto;
-			    margin-top: 5%;
-			    position: relative;
-			    border-radius: 25px;
-			    background: rgb(255,255,255);
-			  }
-			  
-			  #page1 {
-			    text-align: center;
-			  }
-			  
-			  #main {
-			    /*	clear:both; */
-				  position:relative;
-			    margin: 0 auto;
-			    width: 250px;
-			    text-align: center;
-			  }
-			  
-			  .OA_header {
-			/*	  background-color: white;*/
-			    font-size: 20pt;
-			    margin-bottom: 25px;
-			    margin-top: 25px;
-			  }
-			
-			  #leftcontent {
-			    /*float:left; */
-				  width:250px;
-				  margin-bottom: 25px;
-			    text-align: left;
-			    border: 1px solid rgb(0,0,0);
-			  }
-			  			  
-			  #selectArea {
-				 font-size: 15px;
-				 padding-bottom: 65px;
-			  }
-			
-			  #leftcontent {
-				 width: 300px;
-				 margin-top: 30px;
-			  }
-			
-        #bku_header {
-          height: 5%;
-          padding-bottom: 3px;
-          padding-top: 3px;
-        }
-      
-        #bkulogin {
-				  overflow:hidden;	
-          min-width: 190px;
-          min-height: 180px;
-          /*height: 260px;*/	
-			  }
-      
-        h2#tabheader{
-				  font-size: 1.1em; 
-          padding-left: 2%;
-          padding-right: 2%;
-          position: relative;
-			  }
-      	
-        #stork h2 {
-          font-size: 1.0em;
-          margin-bottom: 2%;
-        }
-        		  
-			  .setAssertionButton_full {
-			  	background: #efefef;
-				  cursor: pointer;
-				  margin-top: 15px;
-			    width: 100px;
-			    height: 30px
-			  }
-			
-			  #leftbutton  {
-				 width: 30%; 
-				 float:left; 
-				 margin-left: 40px;
-			  }
-			
-			  #rightbutton {
-				 width: 30%; 
-				 float:right; 
-				 margin-right: 45px; 
-				 text-align: right;
-			  }
-        
-        button {
-          height: 25px;
-          width: 75px;
-          margin-bottom: 10px;
-        }
-        
-        
-        
-       #validation {
-        position: absolute;
-        bottom: 0px;
-        margin-left: 270px;
-        padding-bottom: 10px;
-      }
-			
-			}
-
-      @media screen and (max-width: 205px) {
-        #localBKU p {
-          font-size: 0.6em;
-        }
-       .browserInfoButton{
-         color: rgb(128, 128, 128); 
-        }
-        
-        #localBKU input {
-          font-size: 0.6em;
-          min-width: 60px;
-         /* max-width: 65px; */
-          min-height: 1.0em;
-         /* border-radius: 5px; */
-        }
-        
-        #bkuselectionarea input[type=button] {
-          font-size: 0.7em;
-          min-width: 55px;
-          /*min-height: 1.1em;
-          border-radius: 5px;*/
-          margin-bottom: 2%
-        }
-        
-        #mandateLogin {
-          font-size: 0.65em;
-        }
-        
-        #bku_header h2 {
-          font-size: 0.8em;
-          margin-top: -0.4em;
-          padding-top: 0.4em;
-        }
-        
-        #bkulogin {
-        min-height: 150px;
-        } 
-      }
-
-      @media screen and (max-width: 249px) and (min-width: 206px) {
-        #localBKU p {
-          font-size: 0.7em;
-        } 
-        .browserInfoButton{
-         color: rgb(128, 128, 128); 
-        }
-        
-        #localBKU input {
-          font-size: 0.7em;
-          min-width: 70px;
-       /*    max-width: 75px;    */
-          min-height: 0.95em;
-        /*  border-radius: 6px;    */
-        }
-        
-        #bkuselectionarea input[type=button] {
-          font-size: 0.75em;
-          min-width: 60px;
-      /*    min-height: 0.95em;
-          border-radius: 6px;    */
-          margin-bottom: 5%
-        }
-        
-        #mandateLogin {
-          font-size: 0.75em;
-        }
-        
-        #bku_header h2 {
-          font-size: 0.9em;
-          margin-top: -0.45em;
-          padding-top: 0.45em;
-        }
-        
-        #bkulogin {
-          min-height: 180px;
-        }  
-      }
-
-      @media screen and (max-width: 299px) and (min-width: 250px) {
-        #localBKU p {
-          font-size: 0.9em;
-        } 
-        .browserInfoButton{
-         color: rgb(128, 128, 128); 
-        }
-        
-        #localBKU input {
-          font-size: 0.8em;
-          min-width: 70px;
-       /*    max-width: 75px;      */
-      /*    border-radius: 6px;  */
-        }
-        
-        #bkuselectionarea input[type=button] {
-          font-size: 0.85em;
-     /*     min-height: 1.05em;
-          border-radius: 7px;        */
-          margin-bottom: 10%;
-        }
-        
-        #mandateLogin {
-          font-size: 1em;
-        }
-        
-        #bku_header h2 {
-          font-size: 1.0em;
-          margin-top: -0.50em;
-          padding-top: 0.50em;
-        } 
-      }
-
-      @media screen and (max-width: 399px) and (min-width: 300px) {
-        #localBKU p {
-          font-size: 0.9em;
-        } 
-        .browserInfoButton{
-         color: rgb(128, 128, 128); 
-        }
-        #localBKU input {
-          font-size: 0.8em;
-          min-width: 70px;
-      /*     max-width: 75px;     */
-      /*    border-radius: 6px;       */
-        }
-        
-        #bkuselectionarea input[type=button] {
-          font-size: 0.9em;
-   /*       min-height: 1.2em;
-          border-radius: 8px;          */
-          margin-bottom: 10%;
-          max-width: 80px;
-        }
-        
-        #mandateLogin {
-          font-size: 1em;
-        }
-        
-        #bku_header h2 {
-          font-size: 1.1em;
-          margin-top: -0.55em;
-          padding-top: 0.55em;
-        } 
-      }
-      
-      @media screen and (max-width: 649px) and (min-width: 400px) {
-        #localBKU p {
-          font-size: 0.9em;
-        } 
-       .browserInfoButton{
-         color: rgb(128, 128, 128); 
-        } 
-        #localBKU input {
-          font-size: 0.8em;
-          min-width: 70px;
-      /*     max-width: 80px;       */
-     /*     border-radius: 6px;          */
-        }
-        
-        #bkuselectionarea input[type=button] {
-          font-size: 1.0em;
-     /*      min-height: 1.3em;
-         border-radius: 10px;         */
-          margin-bottom: 10%;
-          max-width: 85px;
-        }
-        
-        #mandateLogin {
-          font-size: 1.2em;
-        }
-        
-        #bku_header h2 {
-          font-size: 1.3em;
-          margin-top: -0.65em;
-          padding-top: 0.65em;
-        } 
-      }
-
-
-			
-			@media screen and (max-width: 649px) {
-				
-        body {
-					margin:0;
-					padding:0;
-					color : #000;
-			  	text-align: center;
-          font-size: 100%;
-			  	background-color: #MAIN_BACKGOUNDCOLOR#;
-				}
-        		.browserInfoButton{
-                    color: rgb(128, 128, 128); 
-                }		
-			  #page {
-			     visibility: hidden;
-			     margin-top: 0%;
-			  }
-			  
-			  #page1 {
-			    visibility: hidden;
-			  }
-			  
-			  #main {
-			    visibility: hidden;
-			  }
-        
-        #validation {
-          visibility: hidden;
-          display: none;
-        }
-			  
-			  .OA_header {
-			    margin-bottom: 0px;
-			    margin-top: 0px;
-			    font-size: 0pt;
-			    visibility: hidden;
-			  }
-			
-			  #leftcontent {
-			    visibility: visible;
-			    margin-bottom: 0px;
-			    text-align: left;
-			    border:none;
-          vertical-align: middle;
-          min-height: 173px;
-          min-width: 204px;
-          
-			  }
-			  
-        #bku_header {
-          height: 10%;
-          min-height: 1.2em;
-          margin-top: 1%;
-        }
-        
-        h2#tabheader{
-          padding-left: 2%;
-          padding-right: 2%;
-          position: relative;
-          top: 50%;
-			  }
-        
-        #stork h2 {
-          font-size: 0.9em;
-          margin-bottom: 2%;
-        }
-        
-       	#bkulogin {	
-          min-width: 190px;
-          min-height: 170px;	
-			 }
-        
-			 .setAssertionButton_full {
-			     	background: #efefef;
-				    cursor: pointer;
-				    margin-top: 15px;
-			      width: 70px;
-			      height: 25px;
-			 }
-       
-        input[type=button] {
-/*          height: 11%;  */
-          width: 70%;
-        }
-			}
-			      
-			* {
-				margin: 0;
-				padding: 0;
-        font-family: #FONTTYPE#;
-			}
-							      			
-			#selectArea {
-				padding-top: 10px;
-				padding-bottom: 55px;
-				padding-left: 10px;
-			}
-			
-			.setAssertionButton {
-				background: #efefef;
-				cursor: pointer;
-				margin-top: 15px;
-			  width: 70px;
-			  height: 25px;
-			}
-			
-			#leftbutton  {
-				width: 35%; 
-				float:left; 
-				margin-left: 15px;
-			}
-			
-			#rightbutton {
-				width: 35%; 
-				float:right; 
-				margin-right: 25px; 
-				text-align: right;
-			}
-			
-			#stork {
-			    /*margin-bottom: 10px;*/
-			   /* margin-top: 5px; */
-			}
-      			
-      #mandateLogin {
-        padding-bottom: 4%;
-        padding-top: 4%;
-        height: 10%;
-        position: relative;
-        text-align: center;
-			}
-      
-      .verticalcenter {
-        vertical-align: middle;
-      }
-      
-      #mandateLogin div {
-        clear: both;
-        margin-top: -1%;
-        position: relative;
-        top: 50%;
-      }
-      
-      #bkuselectionarea {
-          position: relative;
-          display: block;
-      }
-      
-      #localBKU {
-        padding-bottom: 4%;
-        /*padding-top: 4%;*/
-        position: relative;
-        clear: both;     
-        text-align: center;
-			}
-          			
-			#bkukarte {
-				float:left;
-				text-align:center;
-				width:40%;
-        min-height: 70px;
-        padding-left: 5%;
-        padding-top: 2%;
-			}
-			
-			#bkuhandy {
-				float:right;
-				text-align:center;
-				width:40%;
-        min-height: 90px;
-        padding-right: 5%;
-        padding-top: 2%;
-			}
-			
-      .bkuimage {
-        width: 90%;
-        height: auto;
-      }
-      
-			#mandate{
-				text-align:center;
-				padding : 5px 5px 5px 5px;
-			}
-      
-/*		input[type=button], .sendButton {
-				background: #BUTTON_BACKGROUNDCOLOR#;
-        color: #BUTTON_COLOR#;
-/*				border:1px solid #000;  */
-/*				cursor: pointer;
-/*        box-shadow: 3px 3px 3px #222222;  */
-/*			}
-			
-/*      button:hover, button:focus, button:active, 
-      .sendButton:hover , .sendButton:focus, .sendButton:active,
-      #mandateCheckBox:hover, #mandateCheckBox:focus, #mandateCheckBox:active {
-				background: #BUTTON_BACKGROUNDCOLOR_FOCUS#;
-        color: #BUTTON_COLOR#;
-/*				border:1px solid #000;                */
-/*				cursor: pointer;
-/*        box-shadow: -1px -1px 3px #222222;  */
-/*			}
-      
-*/      
-			input {
-				/*border:1px solid #000;*/
-				cursor: pointer;
-			}
-      
-      #localBKU input {
-/*        color: #BUTTON_COLOR#;  */
-        /*border: 0px;*/
-        display: inline-block;
-        
-      }
-			
-      #localBKU input:hover, #localBKU input:focus, #localBKU input:active {
-        /*text-decoration: underline;*/
-      }
-      
-			#installJava, #BrowserNOK {
-				clear:both;
-				font-size:0.8em;
-				padding:4px;
-			}
-						
-			.selectText{
-			
-			}
-			
-			.selectTextHeader{
-			
-			}
-			
-			.sendButton {
-        width: 30%;
-        margin-bottom: 1%;	
-			}
-			
-			#leftcontent a {
-				text-decoration:none; 
-				color: #000;
-			/*	display:block;*/
-				padding:4px;	
-			}
-			
-			#leftcontent a:hover, #leftcontent a:focus, #leftcontent a:active {
-				text-decoration:underline;
-				color: #000;	
-			}
-						
-			.infobutton {
-				background-color: #005a00;
-				color: white;
-				font-family: serif;
-				text-decoration: none;
-				padding-top: 2px;
-				padding-right: 4px;
-				padding-bottom: 2px;
-				padding-left: 4px;
-				font-weight: bold;
-			}
-			
-			.hell {
-				background-color : #MAIN_BACKGOUNDCOLOR#;
-        color: #MAIN_COLOR#;	
-			}
-			
-			.dunkel {
-				background-color: #HEADER_BACKGROUNDCOLOR#;
-        color: #HEADER_COLOR#;
-			}
-			      
-			.main_header {
-			   color: black;
-			    font-size: 32pt;
-			    position: absolute;
-			    right: 10%;
-			    top: 40px;
-				
-			}
-      
-      #ssoSessionTransferBlock {
-        font-size: 0.8em;
-        margin-left: 5px;
-        margin-bottom: 5px;
-      }
-      			                        
-    </style>       
-<!-- MOA-ID 2.x BKUSelection JavaScript fucnctions-->
-<script type="text/javascript">
-		function isIE() {
-			return (/MSIE (\d+\.\d+);/.test(navigator.userAgent));
-		}
-		function isFullscreen() {
-			try {
-				return ((top.innerWidth == screen.width) && (top.innerHeight == screen.height));
-			} catch (e) {
-				return false;
-			}
-		}
-		function isActivexEnabled() {
-			var supported = null;
-			try {
-				supported = !!new ActiveXObject("htmlfile");
-			} catch (e) {
-				supported = false;
-			}
-			return supported;
-		}
-		function isMetro() {
-			if (!isIE())
-				return false;
-			return !isActivexEnabled() && isFullscreen();
-		}
-		window.onload=function() {
-			document.getElementById("localBKU").style.display="block";
-			return;
-		}
-    function bkuLocalClicked() {
-       setMandateSelection();
-    }
-    
-		function bkuOnlineClicked() {
-			if (isMetro())
-				document.getElementById("metroDetected").style.display="block";
-			document.getElementById("localBKU").style.display="block";
-/* 			if (checkMandateSSO())
-				return; */
-			
-			setMandateSelection();
-/* 			setSSOSelection(); */
-						
-			var iFrameURL = "#AUTH_URL#" + "?";
-			iFrameURL += "bkuURI=" + "#ONLINE#";
-			iFrameURL += "&useMandate=" + document.getElementById("useMandate").value;
-/* 			iFrameURL += "&SSO=" + document.getElementById("useSSO").value; */
-			iFrameURL += "&MODUL=" + "#MODUL#";
-			iFrameURL += "&ACTION=" + "#ACTION#";
-			iFrameURL += "&MOASessionID=" + "#SESSIONID#";
-			generateIFrame(iFrameURL);
-		}
-		function bkuHandyClicked() {
-			document.getElementById("localBKU").style.display="none";
-/* 			if (checkMandateSSO())
-				return; */
-			
-			setMandateSelection();
-/* 			setSSOSelection(); */
-			
-			var iFrameURL = "#AUTH_URL#" + "?";
-			iFrameURL += "bkuURI=" + "#HANDY#";
-			iFrameURL += "&useMandate=" + document.getElementById("useMandate").value;
-/* 			iFrameURL += "&SSO=" + document.getElementById("useSSO").value; */
-			iFrameURL += "&MODUL=" + "#MODUL#";
-			iFrameURL += "&ACTION=" + "#ACTION#";
-			iFrameURL += "&MOASessionID=" + "#SESSIONID#";
-			generateIFrame(iFrameURL);
-		}
-		function storkClicked() {
-			document.getElementById("localBKU").style.display="none"; 
-/* 			if (checkMandateSSO())
-				return; */
-			
-			setMandateSelection();
-/* 			setSSOSelection(); */
-			
-			var ccc = "AT";
-			var countrySelection = document.getElementById("cccSelection");
-			if (countrySelection !=  null) {
-				ccc = document.getElementById("cccSelection").value;
-			}
-			var iFrameURL = "#AUTH_URL#" + "?";
-			iFrameURL += "bkuURI=" + "#ONLINE#";
-			iFrameURL += "&useMandate=" + document.getElementById("useMandate").value;
-			iFrameURL += "&CCC=" + ccc;
-/* 			iFrameURL += "&SSO=" + document.getElementById("useSSO").value; */
-			iFrameURL += "&MODUL=" + "#MODUL#";
-			iFrameURL += "&ACTION=" + "#ACTION#";
-			iFrameURL += "&MOASessionID=" + "#SESSIONID#";
-			generateIFrame(iFrameURL);
-		}
-		function generateIFrame(iFrameURL) {
-			var el = document.getElementById("bkulogin");
-      var width = el.clientWidth;
-      var heigth = el.clientHeight - 20;
-			var parent = el.parentNode;
-            
-      iFrameURL += "&heigth=" + heigth;
-      iFrameURL += "&width=" + width;
-      
-			var iframe = document.createElement("iframe");
-			iframe.setAttribute("src", iFrameURL);
-			iframe.setAttribute("width", el.clientWidth - 1);
-			iframe.setAttribute("height", el.clientHeight - 1);
-			iframe.setAttribute("frameborder", "0");
-			iframe.setAttribute("scrolling", "no");
-			iframe.setAttribute("title", "Login");
-			parent.replaceChild(iframe, el);
-		}
-		function setMandateSelection() {
-			document.getElementById("moaidform").action = "#AUTH_URL#";
-			document.getElementById("useMandate").value = "false";
-			var checkbox = document.getElementById("mandateCheckBox");
-			if (checkbox !=  null) {
-				if (document.getElementById("mandateCheckBox").checked) {
-					document.getElementById("useMandate").value = "true";
-				}
-			}
-		}
-		function onChangeChecks() {
-      if (self.innerWidth < 650) {
-         document.getElementById("moaidform").setAttribute("target","_parent");
-      } else {
-         document.getElementById("moaidform").removeAttribute("target");
-      }
-      
-    }
-    
-     function checkIfBrowserSupportsJava(){
-        console.log("Browser is Chrome: "+checkIfBrowserIsChrome());
-        console.log("Browser is Safari: "+checkIfBrowserIsSafari());
-        console.log("Browser is Edge: "+checkIfBrowserIsEdge());
-        
-        var cnt = 0;
-        
-        if(checkIfBrowserIsChrome())cnt++;
-        if(checkIfBrowserIsEdge())cnt++;
-        if(checkIfBrowserIsSafari())cnt++;
-           
-        if(cnt==0 || cnt>1)//cnt>1 means perhaps wrong detection
-            return true;
-        
-        var image = document.getElementById("bkuimage");
-        var srcatt = image.getAttribute("src");
-        var last = srcatt.substring(srcatt.lastIndexOf('/')+1);
-        srcatt = srcatt.replace(last,'online-bku-deactivated.png');    
-        image.setAttribute("src",srcatt);
-         
-         
-        var button = document.getElementsByName("bkuButtonOnline")[0];               
-        button.setAttribute("class","browserInfoButton");
-        button.setAttribute("title","Java wird nicht unterstützt, klicken für mehr Informationen.");
-        button.setAttribute("onClick","alert('Java wird von Ihrem Browser nicht unterstützt, ist jedoch für den Betrieb der Online Bürgerkartenumgebung notwendig.\\nWollen Sie dennoch die Online Bürgerkartenumgebung verwenden, wird zur Zeit Java noch von Firefox und MS Internet Explorer unterstützt. \\nAlternativ koennen Sie auch eine lokale Bürgerkartenumgebung verwenden, verfügbar unter www.buergerkarte.at.');");
-         
-        return false;
+   <link rel="stylesheet" href="$contextPath/css/buildCSS?pendingid=$pendingReqID" />
    
-    }
-    function checkIfBrowserIsChrome(){
-        var chrome_defined = !!window.chrome;//chrome object defined
-        var webstore_defined = false;
-        if(window.chrome){
-            webstore_defined = !!window.chrome.webstore;
-           }
-        return chrome_defined && webstore_defined;
-    }
-    function checkIfBrowserIsEdge(){//edge also defines the chrome object, but not the webapp
-        var chrome_defined = !!window.chrome;//chrome object defined
-        var webstore_defined = true;
-        if(window.chrome){
-            webstore_defined = !!window.chrome.webstore;
-           }
-        return chrome_defined && !webstore_defined;
-    }
-    function checkIfBrowserIsSafari(){
-        var cond1 = Object.prototype.toString.call(window.HTMLElement).indexOf('Constructor') > 0;
-        return cond1;
-    }
-/* 		function setSSOSelection() {
-			document.getElementById("useSSO").value = "false";
-			var checkbox = document.getElementById("SSOCheckBox");
-			if (checkbox !=  null) {
-				if (document.getElementById("SSOCheckBox").checked) {
-					document.getElementById("useSSO").value = "true";
-				}
-			}
-		} */
-		
-/* 		function checkMandateSSO() {
-			var sso = document.getElementById("SSOCheckBox");
-			var mandate = document.getElementById("mandateCheckBox");
-			
-			
-			if (sso.checked && mandate.checked) {
-				alert("Anmeldung in Vertretung in kombination mit Single Sign-On wird aktuell noch nicht unterstützt!")
-				mandate.checked = false;
-				sso.checked = false;
-				return true;
-			} else {
-				return false;
-			}
-		} */
-	</script>
+   <!-- MOA-ID 2.x BKUSelection JavaScript fucnctions-->
+   <script src="$contextPath/js/buildJS?pendingid=$pendingReqID"></script>
+   
+
 <title>Anmeldung mittels Bürgerkarte oder Handy-Signatur</title>
 </head>
 <body onload="onChangeChecks();checkIfBrowserSupportsJava();" onresize="onChangeChecks();">
 	<div id="page">
 		<div id="page1" class="case selected-case" role="main">
-			<h2 class="OA_header" role="heading">Anmeldung an: #OAName#</h2>
+			<h2 class="OA_header" role="heading">Anmeldung an: $OAName</h2>
 			<div id="main">
 				<div id="leftcontent" class="hell" role="application">
 					<div id="bku_header" class="dunkel">
-						<h2 id="tabheader" class="dunkel" role="heading">#HEADER_TEXT#</h2>
+						<h2 id="tabheader" class="dunkel" role="heading">$HEADER_TEXT</h2>
 					</div>
 					<div id="bkulogin" class="hell" role="form">
-						<div id="mandateLogin" style="#MANDATEVISIBLE#">
+						<div id="mandateLogin" style="$MANDATEVISIBLE">
 							<div>
 								<input tabindex="1" type="checkbox" name="Mandate"
 									id="mandateCheckBox" class="verticalcenter" role="checkbox"
-									onClick='document.getElementById("mandateCheckBox").setAttribute("aria-checked", document.getElementById("mandateCheckBox").checked);'#MANDATECHECKED#>
+									onClick='document.getElementById("mandateCheckBox").setAttribute("aria-checked", document.getElementById("mandateCheckBox").checked);'$MANDATECHECKED>
 								<label for="mandateCheckBox" class="verticalcenter">in
 									Vertretung anmelden</label>
 								<!--a      href="info_mandates.html" 
@@ -855,43 +37,41 @@
 						</div>
 						<div id="bkuselectionarea">
 							<div id="bkukarte">
-								<img id="bkuimage" class="bkuimage" src="#CONTEXTPATH#/img/online-bku.png"
+								<img id="bkuimage" class="bkuimage" src="$contextPath/img/karte.png"
 									alt="OnlineBKU" /> <input name="bkuButtonOnline" type="button"
 									onClick="bkuOnlineClicked();" tabindex="2" role="button"
 									value="Karte" />
 							</div>
 							<div id="bkuhandy">
-								<img class="bkuimage" src="#CONTEXTPATH#/img/mobile-bku.png"
+								<img class="bkuimage" src="$contextPath/img/handysign.png"
 									alt="HandyBKU" /> <input name="bkuButtonHandy" type="button"
 									onClick="bkuHandyClicked();" tabindex="3" role="button"
 									value="HANDY" />
 							</div>
 						</div>
 						<div id="localBKU">
-							<form method="get" id="moaidform" action="#AUTH_URL#"
+							<form method="get" id="moaidform" action="$contextPath$submitEndpoint"
 								class="verticalcenter" target="_parent">
-								<input type="hidden" name="bkuURI" value="#LOCAL#"> <input
-									type="hidden" name="useMandate" id="useMandate"> <input
-									type="hidden" name="SSO" id="useSSO"> <input
-									type="hidden" name="ccc" id="ccc"> <input type="hidden"
-									name="MODUL" value="#MODUL#"> <input type="hidden"
-									name="ACTION" value="#ACTION#"> <input type="hidden"
-									name="MOASessionID" value="#SESSIONID#"> 
-                  <input type="submit" value=" Lokale Bürgerkartenumgebung " tabindex="4"
-									role="button" onclick="setMandateSelection();">
+								<input type="hidden" name="bkuURI" value="$bkuLocal" />
+								<input type="hidden" name="useMandate" id="useMandate" /> 
+								<input type="hidden" name="SSO" id="useSSO" /> 
+								<input type="hidden" name="ccc" id="ccc" /> 
+								<input type="hidden" name="pendingid" value="$pendingReqID" /> 
+                <input type="submit" value=" Lokale Bürgerkartenumgebung " tabindex="4"
+									     role="button" onclick="setMandateSelection();">
                 </form>
               </div>
               
               <!-- Single Sign-On Session transfer functionality -->
               <!--div id="ssoSessionTransferBlock">
-                <a href="#AUTH_URL#?MOASessionID=#SESSIONID#&restoreSSOSession=true">>Restore SSO Session from Smartphone</a>
+                <a href="$contextPath$submitEndpoint?pendingid=$pendingReqID&restoreSSOSession=true">>Restore SSO Session from Smartphone</a>
               </div-->
               
-              <div id="stork" align="center" style="#STORKVISIBLE#">
+              <div id="stork" align="center" style="$STORKVISIBLE">
                 <h2 id="tabheader" class="dunkel">Home Country Selection</h2>
                 <p>
                   <select name="cccSelection" id="cccSelection" size="1" style="width: 120px; margin-right: 5px;" >
-                    #PEPSLIST#
+                    $countryList
                   </select>
                   <button name="bkuButton" type="button" onClick="storkClicked();">Proceed</button>
                   <a href="info_stork.html" target="_blank" class="infobutton" style="color:#FFF">i</a>
@@ -907,16 +87,6 @@
 				</div>
 			</div>
 		</div>
-		<!--div id="validation">
-			<a href="http://validator.w3.org/check?uri="> <img
-				style="border: 0; width: 88px; height: 31px"
-				src="#CONTEXTPATH#/img/valid-html5-blue.png" alt="HTML5 ist valide!" />
-			</a> <a href="http://jigsaw.w3.org/css-validator/"> <img
-				style="border: 0; width: 88px; height: 31px"
-				src="http://jigsaw.w3.org/css-validator/images/vcss-blue"
-				alt="CSS ist valide!" />
-			</a>
-		</div-->
 	</div>
 </body>
 </html>
diff --git a/id/server/doc/htmlTemplates/sendAssertion.html b/id/server/doc/htmlTemplates/sendAssertion.html
index 07d018a94..7ae4b3f92 100644
--- a/id/server/doc/htmlTemplates/sendAssertion.html
+++ b/id/server/doc/htmlTemplates/sendAssertion.html
@@ -3,556 +3,7 @@
 <head>
 	<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
     <!-- MOA-ID 2.x BKUSelection Layout CSS -->               
-    <style type="text/css">
-			@media screen and (min-width: 650px) {
-			
-				body {
-					margin:0;
-					padding:0;
-					color : #000;
-					background-color : #fff;
-			  	text-align: center;
-			  	background-color: #6B7B8B;
-				}
-				
-        #localBKU p {
-          font-size: 0.7em;
-        } 
-        
-        #localBKU input{
-          font-size: 0.7em;
-          border-radius: 5px;
-        }
-        
-         #bkuselectionarea button {
-          font-size: 0.85em;
-          border-radius: 7px;
-          margin-bottom: 25px;
-         }
-        
-        #mandateLogin {
-          font-size: 0.85em;
-        }
-        
-        #bku_header h2 {
-          font-size: 0.8em;
-        } 
-        
-        
-			  #page {
-			    display: block;
-			    border: 2px solid rgb(0,0,0);
-			    width: 650px;
-			    height: 440px;
-			    margin: 0 auto;
-			    margin-top: 5%;
-			    position: relative;
-			    border-radius: 25px;
-			    background: rgb(255,255,255);
-			  }
-			  
-			  #page1 {
-			    text-align: center;
-			  }
-			  
-			  #main {
-			    /*	clear:both; */
-				  position:relative;
-			    margin: 0 auto;
-			    width: 250px;
-			    text-align: center;
-			  }
-			  
-			  .OA_header {
-			/*	  background-color: white;*/
-			    font-size: 20pt;
-			    margin-bottom: 25px;
-			    margin-top: 25px;
-			  }
-			
-			  #leftcontent {
-        	width: 300px;
-				  margin-top: 30px;
-          padding-bottom: 15px;
-				  margin-bottom: 25px;
-			    text-align: left;
-			    border: 1px solid rgb(0,0,0);
-			  }
-			  			  
-			  #selectArea {
-				 font-size: 15px;
-				 padding-bottom: 65px;
-			  }
-			 
-        #selectArea h3 {
-          margin-bottom: 25px;
-        }
-      
-        #bku_header {
-          height: 5%;
-          padding-bottom: 3px;
-          padding-top: 3px;
-        }
-      
-        #bkulogin {
-				  overflow:hidden;	
-          min-width: 190px;
-          min-height: 180px;
-          /*height: 260px;*/	
-			  }
-      
-        h2#tabheader{
-				  font-size: 1.1em; 
-          padding-left: 2%;
-          padding-right: 2%;
-          position: relative;
-			  }
-      			  
-			  .setAssertionButton_full {
-				  margin-top: 15px;
-			    width: 100px;
-			    height: 30px;
-          font-size: 1.3em;
-          min-height: 1.3em;
-/*          border-radius: 10px;*/
-			  }
-			
-			  #leftbutton  {
-				 width: 30%; 
-				 float:left; 
-				 margin-left: 40px;
-			  }
-			
-			  #rightbutton {
-				 width: 30%; 
-				 float:right; 
-				 margin-right: 45px; 
-				 text-align: right;
-			  }
-        
-        button {
-          height: 25px;
-          width: 90px;
-          margin-bottom: 10px;
-        }
-        
-       #validation {
-        position: absolute;
-        bottom: 0px;
-        margin-left: 270px;
-        padding-bottom: 10px;
-      }
-			
-			}
-
-      @media screen and (max-width: 205px) {
-        #localBKU p {
-          font-size: 0.6em;
-        } 
-        
-        #localBKU input {
-          font-size: 0.7em;
-          min-width: 70px;
-          min-height: 1.2em;
-          border-radius: 5px;
-        }
-        
-        #bkuselectionarea button, .setAssertionButton_full {
-          font-size: 0.8em;
-          min-width: 65px;
-          min-height: 1.3em;
-  /*        border-radius: 5px;         */
-          margin-bottom: 2%
-        }
-        
-        #mandateLogin {
-          font-size: 0.65em;
-        }
-        
-        #bku_header h2, #selectArea h3 {
-          font-size: 0.8em;
-          margin-top: -0.4em;
-        } 
-      }
-
-      @media screen and (max-width: 249px) and (min-width: 206px) {
-        #localBKU p {
-          font-size: 0.7em;
-        } 
-        
-        #localBKU input {
-          font-size: 0.85em;
-          min-width: 80px;
-          min-height: 0.95em;
-          border-radius: 6px;
-        }
-        
-        #bkuselectionarea button, .setAssertionButton_full {
-          font-size: 0.85em;
-          min-width: 70px;
-          min-height: 0.95em;
-  /*        border-radius: 6px;        */
-          margin-bottom: 2%
-        }
-        
-        #mandateLogin {
-          font-size: 0.75em;
-        }
-        
-        #bku_header h2, #selectArea h3 {
-          font-size: 0.9em;
-          margin-top: -0.45em;
-        } 
-      }
-
-      @media screen and (max-width: 299px) and (min-width: 250px) {
-        #localBKU p {
-          font-size: 0.9em;
-        } 
-        
-        #localBKU input {
-          font-size: 0.9em;
-          min-width: 100px;
-          border-radius: 6px;
-        }
-        
-        #bkuselectionarea button, .setAssertionButton_full {
-          font-size: 1.0em;
-          min-height: 1.05em;
- /*         border-radius: 7px;          */
-          margin-bottom: 5%;
-        }
-        
-        #mandateLogin {
-          font-size: 1em;
-        }
-        
-        #bku_header h2, #selectArea h3 {
-          font-size: 1.0em;
-          margin-top: -0.50em;
-        } 
-      }
-
-      @media screen and (max-width: 399px) and (min-width: 300px) {
-        #localBKU p {
-          font-size: 0.9em;
-        } 
-        
-        #localBKU input {
-          font-size: 0.9em;
-          min-width: 100px;
-          border-radius: 6px;
-        }
-        
-        #bkuselectionarea button, .setAssertionButton_full {
-          font-size: 1.1em;
-          min-height: 1.2em;
-  /*        border-radius: 8px;     */
-          margin-bottom: 5%;
-        }
-        
-        #mandateLogin {
-          font-size: 1em;
-        }
-        
-        #bku_header h2, #selectArea h3 {
-          font-size: 1.1em;
-          margin-top: -0.55em;
-        } 
-      }
-      
-      @media screen and (max-width: 649px) and (min-width: 400px) {
-        #localBKU p {
-          font-size: 0.9em;
-        } 
-        
-        #localBKU input {
-          font-size: 0.9em;
-          min-width: 100px;
-          border-radius: 6px;
-        }
-        
-        #bkuselectionarea button, .setAssertionButton_full {
-          font-size: 1.3em;
-          min-height: 1.3em;
-/*          border-radius: 10px;  */
-          margin-bottom: 5%;
-        }
-        
-        #mandateLogin {
-          font-size: 1.2em;
-        }
-        
-        #bku_header h2, #selectArea h3 {
-          font-size: 1.3em;
-          margin-top: -0.65em;
-        } 
-      }
-
-
-			
-			@media screen and (max-width: 649px) {
-				
-        body {
-					margin:0;
-					padding:0;
-					color : #000;
-			  	text-align: center;
-          font-size: 100%;
-			  	background-color: #MAIN_BACKGOUNDCOLOR#;
-				}
-        				
-			  #page {
-			     visibility: hidden;
-			     margin-top: 0%;
-			  }
-			  
-			  #page1 {
-			    visibility: hidden;
-			  }
-			  
-			  #main {
-			    visibility: hidden;
-			  }
-        
-        #validation {
-          visibility: hidden;
-          display: none;
-        }
-			  
-			  .OA_header {
-			    margin-bottom: 0px;
-			    margin-top: 0px;
-			    font-size: 0pt;
-			    visibility: hidden;
-			  }
-			
-			  #leftcontent {
-			    visibility: visible;
-			    margin-bottom: 0px;
-			    text-align: left;
-			    border:none;
-          min-width: 190px;
-/*          min-height: 190px;  */
-          vertical-align: middle;
-          
-			  }
-			  
-        #bku_header {
-          height: 10%;
-          min-height: 1.2em;
-          margin-top: 1%;
-        }
-        
-        h2#tabheader{
-          padding-left: 2%;
-          padding-right: 2%;
-          padding-top: 1%;
-          position: relative;
-          top: 50%;
-			  }
-        
-       	#bkulogin {	
-          min-width: 190px;
-          min-height: 150px;	
-			 }
-        
-			 .setAssertionButton_full {
-				    margin-top: 15px;
-			      width: 70%;
-			      height: 11%;
-            min-width: 60px;
-            min-height: 25px;
-			 }
-       
-       #selectArea h3 {
-          margin-top: 2%;
-       }
-       
-        button {
-          height: 11%;
-          width: 70%;
-        }
-			}
-			      
-			* {
-				margin: 0;
-				padding: 0;
-/*				border: 0;  */
-        font-family: #FONTTYPE#;
-			}
-							      			
-			#selectArea {
-				padding-top: 10px;
-				padding-bottom: 55px;
-				padding-left: 10px;
-			}
-			
-			.setAssertionButton {
-				background: #efefef;
-				cursor: pointer;
-				margin-top: 15px;
-			  width: 70px;
-			  height: 25px;
-			}
-			
-			#leftbutton  {
-				width: 35%; 
-				float:left; 
-				margin-left: 15px;
-			}
-			
-			#rightbutton {
-				width: 35%; 
-				float:right; 
-				margin-right: 25px; 
-				text-align: right;
-			}
-			
-			#stork {
-			    margin-bottom: 10px;
-			    margin-top: 5px;
-			}
-			
-      #mandateLogin {
-        padding-bottom: 2%;
-        padding-top: 2%;
-        height: 10%;
-        position: relative;
-        text-align: center;
-			}
-      
-      .verticalcenter {
-        vertical-align: middle;
-      }
-      
-      #mandateLogin > div {
-        clear: both;
-        margin-top: -1%;
-        position: relative;
-        top: 50%;
-      }
-      
-      #bkuselectionarea {
-          position: relative;
-          display: block;
-      }
-      
-      #localBKU {
-        padding-left: 5%;
-        padding-right: 2%;
-        padding-bottom: 2%;
-        position: relative;
-        clear: both;        
-			}
-          			
-			#bkukarte {
-				float:left;
-				text-align:center;
-				width:40%;
-        min-height: 70px;
-        padding-left: 5%;
-        padding-top: 2%;
-			}
-			
-			#bkuhandy {
-				float:right;
-				text-align:center;
-				width:40%;
-        min-height: 90px;
-        padding-right: 5%;
-        padding-top: 2%;
-			}
-			
-      .bkuimage {
-        width: 90%;
-        height: auto;
-      }
-      
-			#mandate{
-				text-align:center;
-				padding : 5px 5px 5px 5px;
-			}
-			
-			button, .sendButton {
-/*				background: #BUTTON_BACKGROUNDCOLOR#;
-        color: #BUTTON_COLOR#;  */
-        cursor: pointer;
-        
-/*				border:1px solid #000;
-        box-shadow: 3px 3px 3px #222222; */
-			}
-			
-      button:hover, button:focus, button:active, 
-      .sendButton:hover , .sendButton:focus, .sendButton:active,
-      #mandateCheckBox:hover, #mandateCheckBox:focus, #mandateCheckBox:active {
-/*				background: #BUTTON_BACKGROUNDCOLOR_FOCUS#;
-        color: #BUTTON_COLOR#;  */        
-        cursor: pointer;
-        
-/*				border:1px solid #000;
-        box-shadow: -1px -1px 3px #222222;  */
-			}
-      			
-			#installJava, #BrowserNOK {
-				clear:both;
-				font-size:0.8em;
-				padding:4px;
-			}
-						
-			.selectText{
-			
-			}
-			
-			.selectTextHeader{
-			
-			}
-						
-			#leftcontent a {
-				text-decoration:none; 
-				color: #000;
-			/*	display:block;*/
-				padding:4px;	
-			}
-			
-			#leftcontent a:hover, #leftcontent a:focus, #leftcontent a:active {
-				text-decoration:underline;
-				color: #000;	
-			}
-						
-			.infobutton {
-				background-color: #005a00;
-				color: white;
-				font-family: serif;
-				text-decoration: none;
-				padding-top: 2px;
-				padding-right: 4px;
-				padding-bottom: 2px;
-				padding-left: 4px;
-				font-weight: bold;
-			}
-			
-			.hell {
-				background-color : #MAIN_BACKGOUNDCOLOR#;
-        color: #MAIN_COLOR#;	
-			}
-			
-			.dunkel {
-				background-color: #HEADER_BACKGROUNDCOLOR#;
-        color: #HEADER_COLOR#;
-			}
-			      
-			.main_header {
-			   color: black;
-			    font-size: 32pt;
-			    position: absolute;
-			    right: 10%;
-			    top: 40px;
-				
-			}
-      			                        
-    </style>
-    
+    <link rel="stylesheet" href="$contextPath/css/buildCSS?pendingid=$pendingReqID" />
     
     <title>Anmeldung an Online-Applikation</title>   
 </head>
@@ -574,25 +25,21 @@
             </div>
 					
 						<div id="selectArea" class="hell" role="application">
-							<h3>Anmeldung an: #OAName#</h3>
+							<h3>Anmeldung an: $OAName</h3>
 					
 <!-- 						<div class="hell"> -->
 							<div id="leftbutton">
-									<form method="post" id="moaidform_yes" action="#URL#">
+									<form method="post" id="moaidform_yes" action="$contextPath$submitEndpoint">
 										<input type="hidden" name="value" value="true">
-										<input type="hidden" name="mod" value="#MODUL#">
-								    <input type="hidden" name="action" value="#ACTION#">
-                    <input type="hidden" name="identifier" value="#ID#">
-										<input type="submit" value="Ja" class="setAssertionButton_full sendButton" role="button">
+                    <input type="hidden" name="pendingid" value="$pendingReqID">
+										<input type="submit" value="Ja" class="setAssertionButton_full" role="button">
 									</form>
 							</div>
 							<div id="rightbutton">
-										<form method="post" id="moaidform_no" action="#URL#">
+										<form method="post" id="moaidform_no" action="$contextPath$submitEndpoint">
 										<input type="hidden" name="value" value="false">
-										<input type="hidden" name="mod" value="#MODUL#">
-								    <input type="hidden" name="action" value="#ACTION#">
-                    <input type="hidden" name="identifier" value="#ID#">
-										<input type="submit" value="Nein" class="setAssertionButton_full sendButton" role="button">
+                    <input type="hidden" name="pendingid" value="$pendingReqID">
+										<input type="submit" value="Nein" class="setAssertionButton_full" role="button">
 									</form>
 							</div>
 						
@@ -600,18 +47,6 @@
 					</div>
 				</div>
 		</div>
-    <!--div id="validation">
-        <a href="http://validator.w3.org/check?uri=">
-          <img   style="border:0;width:88px;height:31px"
-                 src="#CONTEXTPATH#/img/valid-html5-blue.png"
-                 alt="HTML5 ist valide!" />
-        </a>
-        <a href="http://jigsaw.w3.org/css-validator/">
-          <img   style="border:0;width:88px;height:31px"
-                 src="http://jigsaw.w3.org/css-validator/images/vcss-blue"
-                 alt="CSS ist valide!" />
-        </a>
-    </div-->
 	</div>
 </body>
 </html>
diff --git a/id/server/idserverlib/pom.xml b/id/server/idserverlib/pom.xml
index dabce982c..20457a0d4 100644
--- a/id/server/idserverlib/pom.xml
+++ b/id/server/idserverlib/pom.xml
@@ -113,6 +113,7 @@
 						<groupId>axis</groupId>

 					</exclusion>

 				</exclusions>

+  			<type>pom</type>

 			</dependency>

   

   		<dependency>

@@ -314,6 +315,13 @@
 			<scope>test</scope>

 		</dependency>

 

+ 		<dependency>

+			<groupId>iaik.prod</groupId>

+			<artifactId>iaik_ixsil</artifactId>

+			<version>1.2.2.5</version>

+			<scope>test</scope>

+		</dependency> 

+

 		<dependency>

 			<groupId>com.h2database</groupId>

 			<artifactId>h2</artifactId>

diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/logging/LoggingContext.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/IDestroyableObject.java
index db4b93a0b..6f98357e2 100644
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/logging/LoggingContext.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/IDestroyableObject.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2003 Federal Chancellery Austria
+ * Copyright 2014 Federal Chancellery Austria
  * MOA-ID has been developed in a cooperation between BRZ, the Federal
  * Chancellery Austria - ICT staff unit, and Graz University of Technology.
  *
@@ -20,51 +20,17 @@
  * The "NOTICE" text file is part of the distribution. Any derivative works
  * that you distribute must include a readable copy of the "NOTICE" text file.
  */
-
-
-package at.gv.egovernment.moa.logging;
+package at.gv.egovernment.moa.id.auth;
 
 /**
- * Encapsulates contextual information (i.e. per request information) for
- * logging purposes.
- * 
- * @author Patrick Peck
- * @version $Id$
+ * @author tlenz
+ *
  */
-public class LoggingContext {
-  /** The name of the node ID system property. */
-  public static final String NODE_ID_PROPERTY = "moa.node-id";
-  
-  /** The current transaction ID. */
-  private String transactionID;
-  /** The node ID. */
-  private String nodeID;
-  
-  /**
-   * Create a new <code>LoggingContext</code>.
-   * 
-   * @param transactionID The transaction ID. May be <code>null</code>.
-   */
-  public LoggingContext(String transactionID) {
-    this.transactionID = transactionID;
-    this.nodeID = System.getProperty(NODE_ID_PROPERTY);
-  }
-  
-  /**
-   * Return the transaction ID.
-   * 
-   * @return The transaction ID.
-   */
-  public String getTransactionID() {
-    return transactionID;
-  }
-  
-  /**
-   * Return the node ID.
-   * 
-   * @return The node ID.
-   */
-  public String getNodeID() {
-    return nodeID;
-  }
+public interface IDestroyableObject {
+	/**
+	 * Manually deep destroy a Java object with all child objects like timers and threads 
+	 * 
+	 */
+	public void fullyDestroy();
+	
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/IGarbageCollectorProcessing.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/IGarbageCollectorProcessing.java
index a1008e883..27d142f2c 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/IGarbageCollectorProcessing.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/IGarbageCollectorProcessing.java
@@ -20,7 +20,7 @@
  * The "NOTICE" text file is part of the distribution. Any derivative works
  * that you distribute must include a readable copy of the "NOTICE" text file.
  */
-package at.gv.egovernment.moa.id.config.auth;
+package at.gv.egovernment.moa.id.auth;
 
 /**
  * @author tlenz
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAGarbageCollector.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAGarbageCollector.java
new file mode 100644
index 000000000..52e30a2f0
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAGarbageCollector.java
@@ -0,0 +1,93 @@
+/*******************************************************************************
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ *******************************************************************************/
+package at.gv.egovernment.moa.id.auth;
+
+
+import java.util.Iterator;
+import java.util.Map;
+import java.util.Map.Entry;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationContext;
+import org.springframework.scheduling.annotation.EnableScheduling;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Service;
+
+import at.gv.egovernment.moa.logging.Logger;
+
+@Service("MOAGarbageCollector")
+@EnableScheduling
+public class MOAGarbageCollector implements Runnable {
+
+	@Autowired ApplicationContext context;
+	
+	private static final long INTERVAL = 24 * 60 * 60 * 1000; // 24 hours
+	//private static final long INITAL_DELAY = 12 * 60 * 60 * 1000;  // 12 hours
+	
+	private static final long INITAL_DELAY = 2 * 60 * 1000;  // 12 hours
+	
+//	private static final List<IGarbageCollectorProcessing> processModules = 
+//			new ArrayList<IGarbageCollectorProcessing>(); 
+	
+	
+	@Scheduled(fixedRate = INTERVAL, initialDelay = INITAL_DELAY)
+	public void run() {
+		
+		Map<String, IGarbageCollectorProcessing> processModules = 
+				context.getBeansOfType(IGarbageCollectorProcessing.class);
+
+		if (processModules != null) {
+			Iterator<Entry<String, IGarbageCollectorProcessing>> interator = processModules.entrySet().iterator();
+			while (interator.hasNext()) {
+				try {
+					interator.next().getValue().runGarbageCollector();
+					
+				} catch (Throwable e1) {
+					Logger.warn("Garbage collection FAILED in some module.", e1);
+					
+				}
+								
+			}			
+		}	
+	}
+	
+//	/**
+//	 * Add a module to MOA internal garbage collector. Every module is executed once a day 
+//	 * 
+//	 * @param modul Module which should be executed by the garbage collector.
+//	 */
+//	public static void addModulForGarbageCollection(IGarbageCollectorProcessing modul) {
+//		processModules.add(modul);
+//		
+//	}
+	
+//	public static void start() {				
+//		// start the session cleanup thread
+//		Thread configLoader = new Thread(new MOAGarbageCollector(), "MOAGarbageCollector");
+//		configLoader.setName("MOAGarbageCollectorr");
+//		configLoader.setDaemon(true);
+//		configLoader.setPriority(Thread.MIN_PRIORITY);
+//		configLoader.start();		
+//	}
+	
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthInitializer.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthInitializer.java
index 926131b59..11f47052e 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthInitializer.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthInitializer.java
@@ -36,18 +36,16 @@ import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
 import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 import at.gv.egovernment.moa.id.commons.utils.MOAIDMessageProvider;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.MOAGarbageCollector;
 import at.gv.egovernment.moa.id.util.Random;
 import at.gv.egovernment.moa.id.util.SSLUtils;
 import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.logging.LoggingContext;
-import at.gv.egovernment.moa.logging.LoggingContextManager;
 import at.gv.egovernment.moa.spss.server.config.ConfigurationProvider;
 import at.gv.egovernment.moa.spss.server.iaik.config.IaikConfigurator;
-import at.gv.egovernment.moa.util.Constants;
 import at.gv.egovernment.moa.util.MiscUtil;
+import at.gv.egovernment.moaspss.logging.LoggingContext;
+import at.gv.egovernment.moaspss.logging.LoggingContextManager;
 import iaik.pki.PKIException;
-import iaik.security.ecc.provider.ECCProvider;
+import iaik.security.ec.provider.ECCelerate;
 import iaik.security.provider.IAIK;
 
 /**
@@ -104,7 +102,7 @@ public class MOAIDAuthInitializer {
 
         Logger.info("Loading Java security providers.");
         IAIK.addAsProvider();                
-        ECCProvider.addAsProvider();
+        ECCelerate.addAsProvider();
         
         // Initializes SSLSocketFactory store
         SSLUtils.initialize();
@@ -141,7 +139,12 @@ public class MOAIDAuthInitializer {
         //ECCProvider.addAsProvider();
         
         Security.insertProviderAt(IAIK.getInstance(), 0);
-        Security.addProvider(new ECCProvider());
+        
+        ECCelerate eccProvider = ECCelerate.getInstance();
+        if (Security.getProvider(eccProvider.getName()) != null)
+        	Security.removeProvider(eccProvider.getName());	
+        	
+        Security.addProvider(new ECCelerate());
         
         if (Logger.isDebugEnabled()) {
         	Logger.debug("Loaded Security Provider:");
@@ -150,7 +153,5 @@ public class MOAIDAuthInitializer {
         		Logger.debug(i + ": " + providerList[i].getName() + " Version " + providerList[i].getVersion());        		
         	
         }
-        
-        MOAGarbageCollector.start();
     }
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
index 908c7e7b6..f980f299c 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
@@ -106,6 +106,7 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants {
 	@Autowired protected AuthConfiguration authConfig;
 	@Autowired private AttributQueryBuilder attributQueryBuilder;
 	@Autowired private SAMLVerificationEngineSP samlVerificationEngine;
+	@Autowired(required=true) private MOAMetadataProvider metadataProvider;
 	
 	
 	public IAuthData buildAuthenticationData(IRequest pendingReq, 
@@ -222,7 +223,7 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants {
 				try {
 					samlVerificationEngine.verifyIDPResponse(intfResp, 
 							TrustEngineFactory.getSignatureKnownKeysTrustEngine(
-									MOAMetadataProvider.getInstance()));
+									metadataProvider));
 			
 					//create assertion attribute extractor from AttributeQuery response
 					return new AssertionAttributeExtractor(intfResp);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java
index 69c155c1e..140c7aebc 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java
@@ -206,7 +206,7 @@ public class StartAuthentificationParameterParser extends MOAIDAuthConstants{
 	    
 	    
 	    //validate SSO functionality
-	    String domainIdentifier = authConfig.getSSOTagetIdentifier().trim();
+	    String domainIdentifier = authConfig.getSSOTagetIdentifier();
 		if (MiscUtil.isEmpty(domainIdentifier) && protocolReq.needSingleSignOnFunctionality()) {			
 			//do not use SSO if no Target is set
 			Logger.warn("NO SSO-Target found in configuration. Single Sign-On is deaktivated!");
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractController.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractController.java
index 0d99bcd68..1431911a3 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractController.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AbstractController.java
@@ -32,6 +32,7 @@ import javax.servlet.http.HttpServletResponse;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 
+import com.google.common.net.MediaType;
 import at.gv.egovernment.moa.id.advancedlogging.IStatisticLogger;
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
 import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
@@ -86,7 +87,7 @@ public abstract class AbstractController extends MOAIDAuthConstants {
 	@ExceptionHandler({Exception.class})
 	public void GenericExceptionHandler(HttpServletResponse resp, Exception exception) throws IOException {
 		Logger.error("Internel Server Error." , exception);
-		resp.setContentType("text/html;charset=UTF-8");
+		resp.setContentType(MediaType.HTML_UTF_8.toString());
 		resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Internal Server Error!" +
 				"(Errorcode=9199"
 				+" | Description="+ exception.getMessage() + ")");
@@ -97,7 +98,7 @@ public abstract class AbstractController extends MOAIDAuthConstants {
 	@ExceptionHandler({IOException.class})
 	public void IOExceptionHandler(HttpServletResponse resp, Throwable exception) {
 		Logger.error("Internel Server Error." , exception);
-		resp.setContentType("text/html;charset=UTF-8");
+		resp.setContentType(MediaType.HTML_UTF_8.toString());
 		resp.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
 		return;
 		
@@ -221,7 +222,7 @@ public abstract class AbstractController extends MOAIDAuthConstants {
 				Logger.warn(loggedException.getMessage(), loggedException);
 	
 			} else {
-				Logger.info(loggedException.getMessage());
+				Logger.warn(loggedException.getMessage());
 	
 			}			
 		}		
@@ -232,7 +233,7 @@ public abstract class AbstractController extends MOAIDAuthConstants {
 		String code = utils.mapInternalErrorToExternalError(
 				((InvalidProtocolRequestException)e).getMessageId());
 		String descr = e.getMessage();
-		resp.setContentType("text/html;charset=UTF-8");
+		resp.setContentType(MediaType.HTML_UTF_8.toString());
 		resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Protocol validation FAILED!" +
 				"(Errorcode=" + code +
 				" | Description=" + descr + ")");
@@ -315,7 +316,7 @@ public abstract class AbstractController extends MOAIDAuthConstants {
 	private void internalMOAIDExceptionHandler(HttpServletRequest req, HttpServletResponse resp, Exception e, boolean writeExceptionToStatisicLog) throws IOException {				
 		if (e instanceof ProtocolNotActiveException) {
 			resp.getWriter().write(e.getMessage());
-			resp.setContentType("text/html;charset=UTF-8");
+			resp.setContentType(MediaType.HTML_UTF_8.toString());
 			resp.sendError(HttpServletResponse.SC_FORBIDDEN, e.getMessage());
 		
 		} else if (e instanceof AuthnRequestValidatorException) {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GUILayoutBuilderServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GUILayoutBuilderServlet.java
index babc87866..9b658d81b 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GUILayoutBuilderServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GUILayoutBuilderServlet.java
@@ -85,7 +85,7 @@ public class GUILayoutBuilderServlet extends AbstractController {
 						null);
 		
 			//build GUI component
-			formBuilder.build(resp, config, "text/css;charset=UTF-8", "CSS-Form");
+			formBuilder.build(resp, config, "text/css; charset=UTF-8", "CSS-Form");
 			
 		} catch (Exception e) {
 			Logger.warn("GUI ressource:'CSS' generation FAILED.");
@@ -114,7 +114,7 @@ public class GUILayoutBuilderServlet extends AbstractController {
 						GeneralProcessEngineSignalController.ENDPOINT_BKUSELECTION_EVALUATION);
 		
 			//build GUI component
-			formBuilder.build(resp, config, "text/javascript;charset=UTF-8", "JavaScript");
+			formBuilder.build(resp, config, "text/javascript; charset=UTF-8", "JavaScript");
 			
 		} catch (Exception e) {
 			Logger.warn("GUI ressource:'JavaScript' generation FAILED.");
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/RedirectServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/RedirectServlet.java
index d9386d404..3eaede028 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/RedirectServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/RedirectServlet.java
@@ -131,7 +131,7 @@ public class RedirectServlet {
 							DefaultGUIFormBuilderConfiguration.VIEW_REDIRECT, 
 							null);
 					config.putCustomParameter(URL, url);
-					guiBuilder.build(resp, config, "RedirectForm");
+					guiBuilder.build(resp, config, "RedirectForm.html");
 						
 				}
 				
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/interceptor/VHostUrlRewriteServletFilter.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/interceptor/VHostUrlRewriteServletFilter.java
new file mode 100644
index 000000000..93d74d7ef
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/interceptor/VHostUrlRewriteServletFilter.java
@@ -0,0 +1,185 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.servlet.interceptor;
+
+import java.io.IOException;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.List;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+
+import org.springframework.context.ApplicationContext;
+
+import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
+import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
+import at.gv.egovernment.moa.id.util.HTTPUtils;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+public class VHostUrlRewriteServletFilter implements Filter {
+
+	private static final String VHOST_PATH = "/vhost/";
+	private static final String AUTHURL = "authURL";
+	
+	
+	private ApplicationContext context = null;
+	
+	public VHostUrlRewriteServletFilter(ApplicationContext context) {
+		Logger.info("Register vHost Servelt Filter");
+		this.context = context;
+		
+	}
+	
+	/* (non-Javadoc)
+	 * @see javax.servlet.Filter#init(javax.servlet.FilterConfig)
+	 */
+	@Override
+	public void init(FilterConfig filterConfig) throws ServletException {
+
+	}
+
+	/* (non-Javadoc)
+	 * @see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest, javax.servlet.ServletResponse, javax.servlet.FilterChain)
+	 */
+	@Override
+	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+			throws IOException, ServletException {
+		 HttpServletRequest httpReq = (HttpServletRequest) request;		 
+		 try {
+			 AuthConfiguration authConfig = context.getBean(AuthConfiguration.class); 
+			 List<String> configuredPublicURLPrefix = authConfig.getPublicURLPrefix();
+		
+			 //check if End-Point is valid		
+			 String publicURLString = HTTPUtils.extractAuthURLFromRequest(httpReq);
+			 URL publicURL;
+			 try {
+				 publicURL = new URL(publicURLString);
+					
+			 } catch (MalformedURLException e) {
+				 Logger.error("IDP AuthenticationServiceURL Prefix is not a valid URL." + publicURLString, e);
+				 throw new ConfigurationException("1299", null, e);
+					
+			 }
+			 
+			 //check if virtual IDPs are enabled
+			 if (!authConfig.isVirtualIDPsEnabled()) {
+				 Logger.trace("Virtual IDPs are disabled. Use default IDP PublicURLPrefix from configuration: " + configuredPublicURLPrefix.get(0));
+				 httpReq.setAttribute(AUTHURL, configuredPublicURLPrefix.get(0));
+				 chain.doFilter(request, response);
+				
+			 } else {				 
+				String authURLString = HTTPUtils.extractAuthServletPathFromRequest(httpReq);
+				 URL authURL;
+				 try {
+					 authURL = new URL(authURLString);
+						
+				 } catch (MalformedURLException e) {
+					 Logger.error("IDP AuthenticationServiceURL Prefix is not a valid URL." + authURLString, e);
+					 throw new ConfigurationException("1299", null, e);
+						
+				 } 
+								
+				Logger.debug("Extract AuthenticationServiceURL: " + authURLString);
+				URL resultURL = null;
+					
+				for (String el : configuredPublicURLPrefix) {
+					try {
+						URL configuredURL = new URL(el);
+
+						//get Ports from URL
+						int configPort = configuredURL.getPort();					
+						if (configPort == -1)
+							configPort = configuredURL.getDefaultPort();
+							
+						int authURLPort = authURL.getPort();
+						if (authURLPort == -1)
+							authURLPort = authURL.getDefaultPort();
+							
+						//check AuthURL against ConfigurationURL
+						if (configuredURL.getHost().equals(authURL.getHost()) &&
+								configPort == authURLPort &&
+								authURL.getPath().startsWith(configuredURL.getPath())) {
+							Logger.debug("Select configurated PublicURLPrefix: " + configuredURL 
+									+ " for authURL: " + authURLString);
+							resultURL = configuredURL;
+						}
+							
+					} catch (MalformedURLException e) {
+							Logger.error("Configurated IDP PublicURLPrefix is not a valid URL." + el);
+							
+					}				
+				}
+								
+				if (resultURL == null) {
+					Logger.warn("Extract AuthenticationServiceURL: " + authURL + " is NOT found in configuration.");
+					throw new ConfigurationException("config.25", new Object[]{authURLString});
+						
+				} else {
+					httpReq.setAttribute(AUTHURL, resultURL.toExternalForm());
+						
+				}
+				 				 				 
+				String servletPath = httpReq.getServletPath();				 								 
+				if (servletPath.startsWith(VHOST_PATH)) {
+					Logger.trace("Found V-IDP selection via REST URL ... ");
+					String vHostDescriptor = resultURL.toExternalForm().substring(0, publicURLString.length());
+					String requestedServlet = authURLString.substring(0, vHostDescriptor.length());
+					String newURL = publicURL.toExternalForm().concat(requestedServlet);
+					httpReq.setAttribute(AUTHURL, newURL);
+					httpReq.getRequestDispatcher(newURL).forward(httpReq, response);
+										 
+				} else {
+					Logger.trace("Found V-IDP selection via Domain ...");
+					chain.doFilter(request, response);
+					
+				}
+				 				
+			 }
+		 
+		 } catch (ConfigurationException e) {
+			 
+			 
+		 }
+		 		 			     
+	}
+
+	/* (non-Javadoc)
+	 * @see javax.servlet.Filter#destroy()
+	 */
+	@Override
+	public void destroy() {
+		// TODO Auto-generated method stub
+
+	}
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/interceptor/WebFrontEndSecurityInterceptor.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/interceptor/WebFrontEndSecurityInterceptor.java
index 87804ea6c..9fdec9fbb 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/interceptor/WebFrontEndSecurityInterceptor.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/interceptor/WebFrontEndSecurityInterceptor.java
@@ -53,7 +53,8 @@ public class WebFrontEndSecurityInterceptor implements HandlerInterceptor {
 				
 		//only for SAML1 GetAuthenticationData webService functionality
 		String requestedServlet = request.getServletPath();		
-		if (MiscUtil.isNotEmpty(requestedServlet) && requestedServlet.startsWith("/services/GetAuthenticationData")) {
+		if (MiscUtil.isNotEmpty(requestedServlet) && 
+				requestedServlet.startsWith("/services")) {
 			Logger.debug("SAML1 GetAuthenticationServices allow access without SSL");
 			return true;
 			
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/MOAGarbageCollector.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/MOAGarbageCollector.java
deleted file mode 100644
index 1072bec5c..000000000
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/MOAGarbageCollector.java
+++ /dev/null
@@ -1,77 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- *******************************************************************************/
-package at.gv.egovernment.moa.id.config.auth;
-
-
-import java.util.ArrayList;
-import java.util.List;
-
-import at.gv.egovernment.moa.logging.Logger;
-
-public class MOAGarbageCollector implements Runnable {
-
-	private static final long INTERVAL = 24 * 60 * 60; // 24 hours	
-	private static final List<IGarbageCollectorProcessing> processModules = 
-			new ArrayList<IGarbageCollectorProcessing>(); 
-	
-	public void run() {
-		while (true) {
-			try {
-				Thread.sleep(INTERVAL * 1000);
-				
-				try {
-					for (IGarbageCollectorProcessing element : processModules)
-						element.runGarbageCollector();
-					
-				} catch (Throwable e1) {
-					Logger.warn("Garbage collection FAILED in some module.", e1);
-				}
-								
-			} catch (Throwable e) {
-				Logger.warn("MOA-ID garbage collection is not possible, actually.", e);
-				
-			} finally {
-								
-			}
-		}	
-	}
-	
-	/**
-	 * Add a module to MOA internal garbage collector. Every module is executed once a day 
-	 * 
-	 * @param modul Module which should be executed by the garbage collector.
-	 */
-	public static void addModulForGarbageCollection(IGarbageCollectorProcessing modul) {
-		processModules.add(modul);
-		
-	}
-	
-	public static void start() {				
-		// start the session cleanup thread
-		Thread configLoader = new Thread(new MOAGarbageCollector(), "MOAGarbageCollector");
-		configLoader.setName("MOAGarbageCollectorr");
-		configLoader.setDaemon(true);
-		configLoader.setPriority(Thread.MIN_PRIORITY);
-		configLoader.start();
-	}
-}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java
index b1bba6c17..9f39e32cc 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/OAAuthParameter.java
@@ -122,7 +122,10 @@ public String getIdentityLinkDomainIdentifier() {
 	if (MiscUtil.isNotEmpty(type) && MiscUtil.isNotEmpty(value)) {
 		if (MOAIDConstants.IDENIFICATIONTYPE_STORK.equals(type)) {
 			return MOAIDConstants.PREFIX_STORK + "AT" + "+" + value;
-			
+		
+		} else if (MOAIDConstants.IDENIFICATIONTYPE_EIDAS.equals(type)) {
+			return MOAIDConstants.PREFIX_EIDAS + value;
+						
 		} else {
 			return MOAIDConstants.PREFIX_WPBK + type + "+" + value;
 			
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java
index 210bda3e6..348b1c45a 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java
@@ -738,13 +738,17 @@ public class PropertyBasedAuthConfigurationProvider extends ConfigurationProvide
 	 */
 	public String getSSOTagetIdentifier() throws ConfigurationException {
 		try {
-			return configuration.getStringValue(
+			String value = configuration.getStringValue(
 					MOAIDConfigurationConstants.GENERAL_AUTH_SSO_TARGET);
-			
+			if (MiscUtil.isNotEmpty(value))
+				return value.trim();
+						
 		} catch (at.gv.egiz.components.configuration.api.ConfigurationException e) {
 			Logger.warn("Single Sign-On Target can not be read from configuration.", e);
-			return null;
+			
 		}
+		
+		return null;
 	}
 
 	/**
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java
index 3c6042b51..34b250bf0 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java
@@ -104,7 +104,8 @@ public class AuthenticationManager extends MOAIDAuthConstants {
 	@Autowired private SingleLogOutBuilder sloBuilder;
 	@Autowired private SAMLVerificationEngineSP samlVerificationEngine;
 	@Autowired private IGUIFormBuilder guiBuilder;
-			
+	@Autowired(required=true) private MOAMetadataProvider metadataProvider;
+	
 	public void performSingleLogOut(HttpServletRequest httpReq,
 	HttpServletResponse httpResp, AuthenticationSession session, PVPTargetConfiguration pvpReq) throws MOAIDException {
 		performSingleLogOut(httpReq, httpResp, session, pvpReq, null);
@@ -527,7 +528,7 @@ public class AuthenticationManager extends MOAIDAuthConstants {
 					
 				} else {
 					samlVerificationEngine.verifySLOResponse(sloResp, 
-							TrustEngineFactory.getSignatureKnownKeysTrustEngine(MOAMetadataProvider.getInstance()));
+							TrustEngineFactory.getSignatureKnownKeysTrustEngine(metadataProvider));
 					
 				}
 								
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestImpl.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestImpl.java
index 85e4dc99b..1e0dfca8a 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestImpl.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestImpl.java
@@ -32,6 +32,8 @@ import java.util.Map;
 
 import javax.servlet.http.HttpServletRequest;
 
+import org.opensaml.saml2.metadata.provider.MetadataProvider;
+
 import at.gv.egovernment.moa.id.advancedlogging.TransactionIDUtils;
 import at.gv.egovernment.moa.id.commons.MOAIDConstants;
 import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
@@ -52,8 +54,12 @@ public abstract class RequestImpl implements IRequest, Serializable{
 	public static final String DATAID_REQUESTED_ATTRIBUTES = "requestedAttributes";
 	public static final String DATAID_INTERFEDERATIOIDP_ENTITYID = "interIDPEntityID";
 	
+	public static final String DATAID_REQUESTER_IP_ADDRESS = "requesterIP";
+	
 	public static final String eIDAS_GENERIC_REQ_DATA_COUNTRY = "country";
 	
+	
+	
 	private static final long serialVersionUID = 1L;
 
 	private String module = null;
@@ -91,10 +97,10 @@ public abstract class RequestImpl implements IRequest, Serializable{
 	 */
 	public final void initialize(HttpServletRequest req) throws ConfigurationException {				
 		//set requestID
-		requestID = Random.nextRandom();
+		requestID = Random.nextLongRandom();
 		
 		//set unique transaction identifier for logging
-		uniqueTransactionIdentifer = Random.nextRandom();		
+		uniqueTransactionIdentifer = Random.nextLongRandom();		
 		TransactionIDUtils.setTransactionId(uniqueTransactionIdentifer);
 		
 		
@@ -167,6 +173,15 @@ public abstract class RequestImpl implements IRequest, Serializable{
 		else
 			Logger.warn("No unique session-identifier FOUND, but it should be allready set into request!?!");
 		
+		//set requester's IP address
+		try {
+			setGenericDataToSession(DATAID_REQUESTER_IP_ADDRESS, req.getRemoteAddr());
+			
+		} catch (SessionDataStorageException e) {
+			Logger.warn("Can not store remote IP address to 'pendingRequest' during an exception." , e);
+			
+		}
+		
 	}
 	
 	/**
@@ -174,7 +189,7 @@ public abstract class RequestImpl implements IRequest, Serializable{
 	 * 
 	 * @return List of PVP 2.1 attribute names with maps all protocol specific attributes
 	 */
-	public abstract Collection<String> getRequestedAttributes();
+	public abstract Collection<String> getRequestedAttributes(MetadataProvider metadataProvider);
 	
 	public void setOAURL(String value) {
 		oaURL = value;
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/ProcessEngineImpl.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/ProcessEngineImpl.java
index f9986dccb..76e6605c1 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/ProcessEngineImpl.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/process/ProcessEngineImpl.java
@@ -129,6 +129,11 @@ public class ProcessEngineImpl implements ProcessEngine {
 			
 			ProcessInstance pi = loadProcessInstance(pendingReq.getProcessInstanceId());
 
+			if (pi == null ) {
+				throw new ProcessExecutionException("Process instance '" + pendingReq.getProcessInstanceId() + "' does not exist.");
+				
+			}
+			
 			MDC.put(MDC_CTX_PI_NAME, pi.getId());
 
 			if (!ProcessInstanceState.NOT_STARTED.equals(pi.getState())) {
@@ -164,6 +169,11 @@ public class ProcessEngineImpl implements ProcessEngine {
 			
 			ProcessInstance pi = loadProcessInstance(pendingReq.getProcessInstanceId());
 
+			if (pi == null ) {
+				throw new ProcessExecutionException("Process instance '" + pendingReq.getProcessInstanceId() + "' does not exist.");
+				
+			}
+			
 			MDC.put(MDC_CTX_PI_NAME, pi.getId());
 
 			if (!ProcessInstanceState.SUSPENDED.equals(pi.getState())) {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateProfRepDescAttributeBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateProfRepDescAttributeBuilder.java
index b4eed85d0..a611c72b9 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateProfRepDescAttributeBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/MandateProfRepDescAttributeBuilder.java
@@ -53,7 +53,10 @@ public class MandateProfRepDescAttributeBuilder implements IPVPAttributeBuilder
 			
 				profRepName = misMandate.getTextualDescriptionOfOID();
 				
-				if (MiscUtil.isEmpty(profRepName)) {			
+				//only read textual prof. rep. OID describtion from mandate annotation
+				// if also OID exists
+				if (MiscUtil.isEmpty(profRepName) 
+						&& MiscUtil.isNotEmpty(misMandate.getProfRep())) {			
 					Element mandate = authData.getMandate();
 					if (mandate == null) {
 						throw new NoMandateDataAttributeException();
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java
index 98c6632f1..6375f26a3 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AttributQueryAction.java
@@ -81,6 +81,7 @@ public class AttributQueryAction implements IAction {
 	@Autowired private IDPCredentialProvider pvpCredentials;
 	@Autowired private AuthConfiguration authConfig;
 	@Autowired private MOASessionDBUtils moaSessionDBUtils;
+	@Autowired(required=true) private MOAMetadataProvider metadataProvider;
 	
 	private final static List<String> DEFAULTSTORKATTRIBUTES = Arrays.asList(
 			new String[]{PVPConstants.EID_STORK_TOKEN_NAME});	
@@ -140,7 +141,7 @@ public class AttributQueryAction implements IAction {
 				
 				//build PVP 2.1 response
 				Response authResponse = AuthResponseBuilder.buildResponse(
-						MOAMetadataProvider.getInstance(), issuerEntityID, attrQuery, date, 
+						metadataProvider, issuerEntityID, attrQuery, date, 
 						assertion, authConfig.isPVP2AssertionEncryptionActive());
 									
 				SoapBinding decoder = new SoapBinding();				
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AuthenticationAction.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AuthenticationAction.java
index 8de44a2e8..aac49844e 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AuthenticationAction.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/AuthenticationAction.java
@@ -61,6 +61,7 @@ import at.gv.egovernment.moa.logging.Logger;
 public class AuthenticationAction implements IAction {
 	@Autowired IDPCredentialProvider pvpCredentials;
 	@Autowired AuthConfiguration authConfig;
+	@Autowired(required=true) private MOAMetadataProvider metadataProvider;
 	
 	public SLOInformationInterface processRequest(IRequest req, HttpServletRequest httpReq,
 			HttpServletResponse httpResp, IAuthData authData) throws MOAIDException {
@@ -70,7 +71,7 @@ public class AuthenticationAction implements IAction {
 		//get basic information
 		MOARequest moaRequest = (MOARequest) pvpRequest.getRequest();
 		AuthnRequest authnRequest = (AuthnRequest) moaRequest.getSamlRequest();
-		EntityDescriptor peerEntity = moaRequest.getEntityMetadata();		
+		EntityDescriptor peerEntity = moaRequest.getEntityMetadata(metadataProvider);		
 		
 		AssertionConsumerService consumerService = 
 				SAML2Utils.createSAMLObject(AssertionConsumerService.class);
@@ -94,7 +95,7 @@ public class AuthenticationAction implements IAction {
 				peerEntity, date, consumerService, sloInformation);
 		
 		Response authResponse = AuthResponseBuilder.buildResponse(
-				MOAMetadataProvider.getInstance(), issuerEntityID, authnRequest, 
+				metadataProvider, issuerEntityID, authnRequest, 
 				date, assertion, authConfig.isPVP2AssertionEncryptionActive());
 							
 		IEncoder binding = null;
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/MetadataAction.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/MetadataAction.java
index 2a688da68..b282e3a4b 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/MetadataAction.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/MetadataAction.java
@@ -28,6 +28,8 @@ import javax.servlet.http.HttpServletResponse;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
+import com.google.common.net.MediaType;
+
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
 import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger;
 import at.gv.egovernment.moa.id.commons.api.IRequest;
@@ -62,7 +64,7 @@ public class MetadataAction implements IAction {
 			String metadataXML = metadatabuilder.buildPVPMetadata(metadataConfig);			
 			Logger.debug("METADATA: " + metadataXML);
 						
-			httpResp.setContentType("text/xml");
+			httpResp.setContentType(MediaType.XML_UTF_8.toString());
 			httpResp.getOutputStream().write(metadataXML.getBytes("UTF-8"));
 
 			httpResp.getOutputStream().close();
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java
index 82e46b6ce..127284ae0 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java
@@ -104,6 +104,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController  {
 
 	@Autowired IDPCredentialProvider pvpCredentials;
 	@Autowired SAMLVerificationEngineSP samlVerificationEngine;
+	@Autowired(required=true) private MOAMetadataProvider metadataProvider;
 	
 	public static final String NAME = PVP2XProtocol.class.getName();
 	public static final String PATH = "id_pvp2x";
@@ -187,7 +188,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController  {
 			
 			//get POST-Binding decoder implementation
 			InboundMessage msg = (InboundMessage) new PostBinding().decode(
-					req, resp, MOAMetadataProvider.getInstance(), false,
+					req, resp, metadataProvider, false,
 					new MOAURICompare(PVPConfiguration.getInstance().getIDPSSOPostService(pendingReq.getAuthURL())));
 			pendingReq.setRequest(msg);
 						
@@ -240,7 +241,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController  {
 			
 			//get POST-Binding decoder implementation
 			InboundMessage msg = (InboundMessage) new RedirectBinding().decode(
-					req, resp, MOAMetadataProvider.getInstance(), false,
+					req, resp, metadataProvider, false,
 					new MOAURICompare(PVPConfiguration.getInstance().getIDPSSORedirectService(pendingReq.getAuthURL())));
 			pendingReq.setRequest(msg);
 			
@@ -294,7 +295,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController  {
 			
 			//get POST-Binding decoder implementation
 			InboundMessage msg = (InboundMessage) new SoapBinding().decode(
-					req, resp, MOAMetadataProvider.getInstance(), false,
+					req, resp, metadataProvider, false,
 					new MOAURICompare(PVPConfiguration.getInstance().getIDPSSOPostService(pendingReq.getAuthURL())));
 			pendingReq.setRequest(msg);
 			
@@ -336,7 +337,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController  {
 			
 			if(!msg.isVerified()) {
 				samlVerificationEngine.verify(msg, 
-						TrustEngineFactory.getSignatureKnownKeysTrustEngine(MOAMetadataProvider.getInstance()));
+						TrustEngineFactory.getSignatureKnownKeysTrustEngine(metadataProvider));
 				msg.setVerified(true);
 								
 			}
@@ -493,7 +494,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController  {
 			
 			msg = (MOARequest) inMsg;
 			
-			EntityDescriptor metadata = msg.getEntityMetadata();
+			EntityDescriptor metadata = msg.getEntityMetadata(metadataProvider);
 			if(metadata == null) {
 				throw new NoMetadataInformationException();
 			}
@@ -643,7 +644,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController  {
 			throw new MOAIDException("Unsupported request", new Object[] {});
 		}
 				
-		EntityDescriptor metadata = moaRequest.getEntityMetadata();
+		EntityDescriptor metadata = moaRequest.getEntityMetadata(metadataProvider);
 		if(metadata == null) {
 			throw new NoMetadataInformationException();
 		}
@@ -735,7 +736,7 @@ public class PVP2XProtocol extends AbstractAuthProtocolModulController  {
 			}
 		}
 						
-		String oaURL = moaRequest.getEntityMetadata().getEntityID();
+		String oaURL = moaRequest.getEntityMetadata(metadataProvider).getEntityID();
 		oaURL = StringEscapeUtils.escapeHtml(oaURL);
 		IOAAuthParameters oa = authConfig.getOnlineApplicationParameter(oaURL);
 		
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVPTargetConfiguration.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVPTargetConfiguration.java
index e7f2a7d4b..caf66942e 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVPTargetConfiguration.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVPTargetConfiguration.java
@@ -32,6 +32,7 @@ import org.opensaml.saml2.core.impl.AuthnRequestImpl;
 import org.opensaml.saml2.metadata.AttributeConsumingService;
 import org.opensaml.saml2.metadata.RequestedAttribute;
 import org.opensaml.saml2.metadata.SPSSODescriptor;
+import org.opensaml.saml2.metadata.provider.MetadataProvider;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Scope;
 import org.springframework.stereotype.Component;
@@ -54,7 +55,6 @@ public class PVPTargetConfiguration extends RequestImpl {
 	
 	private static final long serialVersionUID = 4889919265919638188L;
 	
-	
 	InboundMessage request;
 	String binding;
 	String consumerURL;
@@ -88,14 +88,14 @@ public class PVPTargetConfiguration extends RequestImpl {
 	 * @see at.gv.egovernment.moa.id.moduls.RequestImpl#getRequestedAttributes()
 	 */
 	@Override
-	public Collection<String> getRequestedAttributes() {
+	public Collection<String> getRequestedAttributes(MetadataProvider metadataProvider) {
 
 		Map<String, String> reqAttr = new HashMap<String, String>();
 		for (String el : PVP2XProtocol.DEFAULTREQUESTEDATTRFORINTERFEDERATION)
 			reqAttr.put(el, "");
 						
 		try {			
-			SPSSODescriptor spSSODescriptor = getRequest().getEntityMetadata().getSPSSODescriptor(SAMLConstants.SAML20P_NS);
+			SPSSODescriptor spSSODescriptor = getRequest().getEntityMetadata(metadataProvider).getSPSSODescriptor(SAMLConstants.SAML20P_NS);
 			if (spSSODescriptor.getAttributeConsumingServices() != null && 
 					spSSODescriptor.getAttributeConsumingServices().size() > 0) {
 							
@@ -139,5 +139,6 @@ public class PVPTargetConfiguration extends RequestImpl {
 					
 		}
 		
-	}	
+	}
+
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/SingleLogOutAction.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/SingleLogOutAction.java
index 57540138e..c762e2505 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/SingleLogOutAction.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/SingleLogOutAction.java
@@ -24,17 +24,11 @@ package at.gv.egovernment.moa.id.protocols.pvp2x;
 
 import java.io.Serializable;
 import java.io.UnsupportedEncodingException;
-import java.util.List;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.lang.SerializationUtils;
-import org.hibernate.HibernateException;
-import org.hibernate.Query;
-import org.hibernate.Session;
-import org.hibernate.Transaction;
-import org.hibernate.resource.transaction.spi.TransactionStatus;
 import org.opensaml.saml2.core.LogoutRequest;
 import org.opensaml.saml2.core.LogoutResponse;
 import org.opensaml.saml2.metadata.SingleLogoutService;
@@ -49,7 +43,6 @@ import at.gv.egovernment.moa.id.auth.servlet.RedirectServlet;
 import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
 import at.gv.egovernment.moa.id.commons.api.IRequest;
 import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
-import at.gv.egovernment.moa.id.commons.db.MOASessionDBUtils;
 import at.gv.egovernment.moa.id.commons.db.dao.session.AssertionStore;
 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
 import at.gv.egovernment.moa.id.data.IAuthData;
@@ -126,6 +119,9 @@ public class SingleLogOutAction implements IAction {
 					try {
 						session = authenticationSessionStorage.getSession(moasession);
 
+						if (session == null)
+							throw new MOADatabaseException();
+						
 					} catch (MOADatabaseException e) {
 						Logger.info("Can not find active Session. Single LogOut not possible!");
 						SingleLogoutService sloService = sloBuilder.getResponseSLODescriptor(pvpReq);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java
index 25b22f0ad..94d91694a 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java
@@ -62,6 +62,7 @@ import at.gv.egovernment.moa.util.MiscUtil;
 
 public class SoapBinding implements IDecoder, IEncoder {
 
+	@Autowired(required=true) private MOAMetadataProvider metadataProvider;
 	@Autowired private IDPCredentialProvider credentialProvider;
 	
 	public InboundMessageInterface decode(HttpServletRequest req,
@@ -109,7 +110,7 @@ public class SoapBinding implements IDecoder, IEncoder {
 					RequestAbstractType attributeRequest = (RequestAbstractType) attrReq;
 					try {						
 						if (MiscUtil.isNotEmpty(attributeRequest.getIssuer().getValue()) && 
-								MOAMetadataProvider.getInstance().getRole(
+								metadataProvider.getRole(
 										attributeRequest.getIssuer().getValue(), 
 										SPSSODescriptor.DEFAULT_ELEMENT_NAME) != null)
 							request.setEntityID(attributeRequest.getIssuer().getValue());
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/PVPMetadataBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/PVPMetadataBuilder.java
index 855925272..e2f8664d8 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/PVPMetadataBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/PVPMetadataBuilder.java
@@ -24,8 +24,6 @@ package at.gv.egovernment.moa.id.protocols.pvp2x.builder;
 
 import java.io.IOException;
 import java.io.StringWriter;
-import java.security.PrivateKey;
-import java.security.interfaces.RSAPrivateKey;
 import java.util.List;
 
 import javax.xml.parsers.DocumentBuilder;
@@ -66,7 +64,6 @@ import org.opensaml.xml.security.credential.UsageType;
 import org.opensaml.xml.security.keyinfo.KeyInfoGenerator;
 import org.opensaml.xml.security.x509.X509KeyInfoGeneratorFactory;
 import org.opensaml.xml.signature.Signature;
-import org.opensaml.xml.signature.SignatureConstants;
 import org.opensaml.xml.signature.SignatureException;
 import org.opensaml.xml.signature.Signer;
 import org.springframework.stereotype.Service;
@@ -74,6 +71,7 @@ import org.w3c.dom.Document;
 
 import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 import at.gv.egovernment.moa.id.protocols.pvp2x.config.IPVPMetadataBuilderConfiguration;
+import at.gv.egovernment.moa.id.protocols.pvp2x.signer.AbstractCredentialProvider;
 import at.gv.egovernment.moa.id.protocols.pvp2x.signer.CredentialsNotAvailableException;
 import at.gv.egovernment.moa.id.protocols.pvp2x.utils.SAML2Utils;
 import at.gv.egovernment.moa.logging.Logger;
@@ -153,7 +151,7 @@ public class PVPMetadataBuilder {
 
 		//set metadata signature parameters
 		Credential metadataSignCred = config.getMetadataSigningCredentials();		
-		Signature signature = getIDPSignature(metadataSignCred);
+		Signature signature = AbstractCredentialProvider.getIDPSignature(metadataSignCred);
 		SecurityHelper.prepareSignatureParams(signature, metadataSignCred, null, null);
 		
 		
@@ -437,27 +435,5 @@ public class PVPMetadataBuilder {
 		return idpSSODescriptor;
 		
 	}
-	
-	private Signature getIDPSignature(Credential credentials) {		
-		PrivateKey privatekey = credentials.getPrivateKey();		
-		Signature signer = SAML2Utils.createSAMLObject(Signature.class);
 		
-		if (privatekey instanceof RSAPrivateKey) {
-			signer.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
-			
-		} else if (privatekey instanceof iaik.security.ecc.ecdsa.ECPrivateKey) {
-			signer.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA1);
-
-		} else {
-			Logger.warn("Could NOT evaluate the Private-Key type from " + credentials.getEntityId() + " credential.");
-			
-			
-		}
-
-		signer.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);		
-		signer.setSigningCredential(credentials);
-		return signer;
-		
-	}
-	
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/SingleLogOutBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/SingleLogOutBuilder.java
index e5c897aa6..de59e6055 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/SingleLogOutBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/SingleLogOutBuilder.java
@@ -94,8 +94,9 @@ import at.gv.egovernment.moa.logging.Logger;
 @Service("PVP_SingleLogOutBuilder")
 public class SingleLogOutBuilder {
 
+	@Autowired(required=true) private MOAMetadataProvider metadataProvider;
 	@Autowired private IDPCredentialProvider credentialProvider;
-	
+		
 	public void checkStatusCode(ISLOInformationContainer sloContainer, LogoutResponse logOutResp) {
 		Status status = logOutResp.getStatus();				
 		if (!status.getStatusCode().getValue().equals(StatusCode.SUCCESS_URI)) {
@@ -353,7 +354,7 @@ public class SingleLogOutBuilder {
 	
 	public SingleLogoutService getRequestSLODescriptor(String entityID) throws NOSLOServiceDescriptorException {
 		try {
-			EntityDescriptor entity = MOAMetadataProvider.getInstance().getEntityDescriptor(entityID);
+			EntityDescriptor entity = metadataProvider.getEntityDescriptor(entityID);
 			SSODescriptor spsso = entity.getSPSSODescriptor(SAMLConstants.SAML20P_NS);
 			
 			SingleLogoutService sloService = null;			
@@ -394,7 +395,7 @@ public class SingleLogOutBuilder {
 	
 	public SingleLogoutService getResponseSLODescriptor(PVPTargetConfiguration spRequest) throws NoMetadataInformationException, NOSLOServiceDescriptorException {
 		MOARequest moaReq = (MOARequest) spRequest.getRequest();
-		EntityDescriptor metadata = moaReq.getEntityMetadata();
+		EntityDescriptor metadata = moaReq.getEntityMetadata(metadataProvider);
 		SSODescriptor ssodesc = metadata.getSPSSODescriptor(SAMLConstants.SAML20P_NS);
 		
 		if (ssodesc == null) {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java
index 68301d000..55d8fa1ff 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/builder/assertion/PVP2AssertionBuilder.java
@@ -208,8 +208,7 @@ public class PVP2AssertionBuilder implements PVPConstants {
 			Integer aIdx = authnRequest.getAttributeConsumingServiceIndex();
 			int idx = 0;
 
-			AttributeConsumingService attributeConsumingService = null;
-			
+			AttributeConsumingService attributeConsumingService = null;						
 			if (aIdx != null) {
 				idx = aIdx.intValue();
 				attributeConsumingService = spSSODescriptor
@@ -223,6 +222,19 @@ public class PVP2AssertionBuilder implements PVPConstants {
 				}				
 			}
 			
+			/* 
+			 * TODO: maybe use first AttributeConsumingService if no is selected 
+			 * in request or on service is marked as default
+			 * 
+			 */
+			if (attributeConsumingService == null ) {
+				List<AttributeConsumingService> attrConsumingServiceList = spSSODescriptor.getAttributeConsumingServices();
+				if (attrConsumingServiceList != null && !attrConsumingServiceList.isEmpty())
+					attributeConsumingService = attrConsumingServiceList.get(0);
+								
+			}
+			
+			
 			if (attributeConsumingService != null) {						
 				Iterator<RequestedAttribute> it = attributeConsumingService
 						.getRequestAttributes().iterator();
@@ -316,6 +328,15 @@ public class PVP2AssertionBuilder implements PVPConstants {
 					//no sourcePin is included --> search for bPK
 					bpk = authData.getGenericData(PVPConstants.MANDATE_NAT_PER_BPK_NAME, String.class);
 					
+					try {
+						if (bpk.contains(":"))
+							bpk = bpk.split(":")[1];
+						
+					} catch (Exception e) {
+						Logger.warn("Can not split bPK from mandator attribute!", e);
+						
+					}
+					
 					//set bPK-Type from configuration, because it MUST be equal to service-provider type
 					if (oaParam.getBusinessService()) {
 						if (oaParam.getIdentityLinkDomainIdentifier().startsWith(AuthenticationSession.REGISTERANDORDNR_PREFIX_))
@@ -436,10 +457,17 @@ public class PVP2AssertionBuilder implements PVPConstants {
 				.createSAMLObject(SubjectConfirmationData.class);
 		subjectConfirmationData.setInResponseTo(authnRequest.getID());
 		subjectConfirmationData.setNotOnOrAfter(new DateTime(authData.getSsoSessionValidTo().getTime()));
-		subjectConfirmationData.setNotBefore(date);
+//		subjectConfirmationData.setNotBefore(date);
 		
+		//set 'recipient' attribute in subjectConformationData 
 		subjectConfirmationData.setRecipient(assertionConsumerService.getLocation());
 		
+		//set IP address of the user machine as 'Address' attribute in subjectConformationData 
+		String usersIPAddress = pendingReq.getGenericData(
+				PVPTargetConfiguration.DATAID_REQUESTER_IP_ADDRESS, String.class);
+		if (MiscUtil.isNotEmpty(usersIPAddress))
+			subjectConfirmationData.setAddress(usersIPAddress);
+		
 		//set SLO information
 		sloInformation.setUserNameIdentifier(subjectNameID.getValue());
 		sloInformation.setNameIDFormat(subjectNameID.getFormat());
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/messages/InboundMessage.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/messages/InboundMessage.java
index 332caf967..8c8345bbf 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/messages/InboundMessage.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/messages/InboundMessage.java
@@ -25,11 +25,11 @@ package at.gv.egovernment.moa.id.protocols.pvp2x.messages;
 import java.io.Serializable;
 
 import org.opensaml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml2.metadata.provider.MetadataProvider;
 import org.opensaml.saml2.metadata.provider.MetadataProviderException;
 import org.w3c.dom.Element;
 
 import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.NoMetadataInformationException;
-import at.gv.egovernment.moa.id.protocols.pvp2x.metadata.MOAMetadataProvider;
 import at.gv.egovernment.moa.logging.Logger;
 
 /**
@@ -46,10 +46,12 @@ public class InboundMessage implements InboundMessageInterface, Serializable{
 	private String relayState = null;
 	
 	
-	public EntityDescriptor getEntityMetadata() throws NoMetadataInformationException {
-		
+	public EntityDescriptor getEntityMetadata(MetadataProvider metadataProvider) throws NoMetadataInformationException {
 		try {
-			return MOAMetadataProvider.getInstance().getEntityDescriptor(this.entityID);
+			if (metadataProvider == null)
+				throw new NullPointerException("No PVP MetadataProvider found.");
+			
+			return metadataProvider.getEntityDescriptor(this.entityID);
 			
 		} catch (MetadataProviderException e) {
 			Logger.warn("No Metadata for EntitiyID " + entityID);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
index 3002ca179..19adfe4c4 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
@@ -44,13 +44,14 @@ import org.opensaml.saml2.metadata.provider.MetadataProvider;
 import org.opensaml.saml2.metadata.provider.MetadataProviderException;
 import org.opensaml.saml2.metadata.provider.ObservableMetadataProvider;
 import org.opensaml.xml.XMLObject;
+import org.springframework.stereotype.Service;
 
+import at.gv.egovernment.moa.id.auth.IDestroyableObject;
+import at.gv.egovernment.moa.id.auth.IGarbageCollectorProcessing;
 import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
 import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 import at.gv.egovernment.moa.id.commons.config.MOAIDConfigurationConstants;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.IGarbageCollectorProcessing;
-import at.gv.egovernment.moa.id.config.auth.MOAGarbageCollector;
 import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.InterfederatedIDPPublicServiceFilter;
 import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.PVPMetadataFilterChain;
 import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.SchemaValidationFilter;
@@ -58,65 +59,85 @@ import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.Base64Utils;
 import at.gv.egovernment.moa.util.MiscUtil;
 
+@Service("PVPMetadataProvider")
 public class MOAMetadataProvider extends SimpleMOAMetadataProvider
-	implements ObservableMetadataProvider, IGarbageCollectorProcessing, IMOARefreshableMetadataProvider {
+	implements ObservableMetadataProvider, IGarbageCollectorProcessing, 
+	IMOARefreshableMetadataProvider, IDestroyableObject {
 
-	private static MOAMetadataProvider instance = null;
+	//private static final int METADATA_GARBAGE_TIMEOUT_SEC = 604800;  //7 days   
+	
+//	private static MOAMetadataProvider instance = null;
+	MetadataProvider internalProvider = null;
 	private static Object mutex = new Object();
+	//private Map<String, Date> lastAccess = null;
 	
 	
-	public static MOAMetadataProvider getInstance() {
-		if (instance == null) {
-			synchronized (mutex) {
-				if (instance == null) {
-					instance = new MOAMetadataProvider();
-					
-					//add this to MOA garbage collector
-					MOAGarbageCollector.addModulForGarbageCollection(instance);
-										
-				}
-			}
-		}
-		return instance;
+	public MOAMetadataProvider() {
+		internalProvider = new ChainingMetadataProvider();	
+		//lastAccess = new HashMap<String, Date>();
+		
 	}
 	
+//	public static MOAMetadataProvider getInstance() {
+//		if (instance == null) {
+//			synchronized (mutex) {
+//				if (instance == null) {
+//					instance = new MOAMetadataProvider();
+//					
+//					//add this to MOA garbage collector
+//					MOAGarbageCollector.addModulForGarbageCollection(instance);
+//										
+//				}
+//			}
+//		}
+//		return instance;
+//	}
+	
 	/* (non-Javadoc)
 	 * @see at.gv.egovernment.moa.id.config.auth.IGarbageCollectorProcessing#runGarbageCollector()
 	 */
 	@Override
 	public void runGarbageCollector() {
-		reInitialize();
-		
-	}
-	
-	private static void reInitialize() {
 		synchronized (mutex) {
 			
 			/**add new Metadataprovider or remove Metadataprovider which are not in use any more.**/
-			if (instance != null)
-				try {
-					Logger.trace("Check consistence of PVP2X metadata");	
-					instance.addAndRemoveMetadataProvider();
+			try {
+				Logger.trace("Check consistence of PVP2X metadata");	
+				addAndRemoveMetadataProvider();
 					
-				} catch (ConfigurationException e) {
-					Logger.error("Access to MOA-ID configuration FAILED.", e);
+			} catch (ConfigurationException e) {
+				Logger.error("Access to MOA-ID configuration FAILED.", e);
 					
-				}
-			else
-				Logger.info("MOAMetadataProvider is not loaded.");
+			}
 		}
+		
 	}
 	
-	public static void destroy() {
-		if (instance != null) {
-			instance.internalDestroy();
+	
+//	private static void reInitialize() {
+//		synchronized (mutex) {
+//			
+//			/**add new Metadataprovider or remove Metadataprovider which are not in use any more.**/
+//			if (instance != null)
+//				try {
+//					Logger.trace("Check consistence of PVP2X metadata");	
+//					instance.addAndRemoveMetadataProvider();
+//					
+//				} catch (ConfigurationException e) {
+//					Logger.error("Access to MOA-ID configuration FAILED.", e);
+//					
+//				}
+//			else
+//				Logger.info("MOAMetadataProvider is not loaded.");
+//		}
+//	}
+	
+	public void fullyDestroy() {
+		internalDestroy();
 			
-		} else {
-			Logger.info("MOAMetadataProvider is not loaded. Accordingly it can not be destroyed");
-		}
 	}
 	
-	MetadataProvider internalProvider;
+
 
 	@Override
 	public boolean refreshMetadataProvider(String entityID) {
@@ -208,7 +229,7 @@ public class MOAMetadataProvider extends SimpleMOAMetadataProvider
 	
 	private void addAndRemoveMetadataProvider() throws ConfigurationException {
 		if (internalProvider != null && internalProvider instanceof ChainingMetadataProvider) {
-			Logger.info("Relaod MOAMetaDataProvider.");
+			Logger.info("Reload MOAMetaDataProvider.");
 			
 			/*OpenSAML ChainingMetadataProvider can not remove a MetadataProvider (UnsupportedOperationException)
 			 *The ChainingMetadataProvider use internal a unmodifiableList to hold all registrated MetadataProviders.*/ 
@@ -217,7 +238,19 @@ public class MOAMetadataProvider extends SimpleMOAMetadataProvider
 			
 			//get all actually loaded metadata providers
 			Map<String, HTTPMetadataProvider> loadedproviders = getAllActuallyLoadedProviders();
-			
+						
+			/* TODO: maybe add metadata provider destroy after timeout.
+			 *       But could be a problem if one Metadataprovider load an EntitiesDescriptor 
+			 *       with more the multiple EntityDescriptors. If one of this EntityDesciptors 
+			 *       are expired the full EntitiesDescriptor is removed. 
+			 *       
+			 *       Timeout requires a better solution in this case! 
+			 */
+//			Date now = new Date();
+//			Date expioredate = new Date(now.getTime() - (METADATA_GARBAGE_TIMEOUT_SEC * 1000));
+//			Logger.debug("Starting PVP Metadata garbag collection (Expioredate:" 
+//					+ expioredate + ")");
+									
 			//load all PVP2 OAs form ConfigurationDatabase and 
 			//compare actually loaded Providers with configured PVP2 OAs
 			Map<String, String> allOAs = AuthConfigurationProviderFactory.getInstance().getConfigurationWithWildCard(
@@ -238,30 +271,31 @@ public class MOAMetadataProvider extends SimpleMOAMetadataProvider
 						HTTPMetadataProvider httpProvider = null;				
 						try {
 							if (MiscUtil.isNotEmpty(metadataurl)) {						
-								if (loadedproviders.containsKey(metadataurl)) {
+								if (loadedproviders.containsKey(metadataurl)) {									
 									//	PVP2 OA is actually loaded, to nothing
 									providersinuse.put(metadataurl, loadedproviders.get(metadataurl));
 									loadedproviders.remove(metadataurl);
 							
 							
-								} else if ( MiscUtil.isNotEmpty(metadataurl) &&
-										!providersinuse.containsKey(metadataurl) ) {
-									//PVP2 OA is new, add it to MOAMetadataProvider
-									String certBase64 = oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_PROTOCOLS_PVP2X_CERTIFICATE);
-									if (MiscUtil.isNotEmpty(certBase64)) {
-										byte[] cert = Base64Utils.decode(certBase64, false);
-										String oaFriendlyName = oaParam.getFriendlyName();
-									
-									
-										Logger.info("Loading metadata for: " + oaFriendlyName);
-										httpProvider = createNewHTTPMetaDataProvider(
-												metadataurl, 												
-												buildMetadataFilterChain(oaParam, metadataurl, cert),
-												oaFriendlyName);
-							
-										if (httpProvider != null)
-											providersinuse.put(metadataurl, httpProvider);
-									}
+									//INFO: load metadata dynamically if they are requested 
+//								} else if ( MiscUtil.isNotEmpty(metadataurl) &&
+//										!providersinuse.containsKey(metadataurl) ) {
+//									//PVP2 OA is new, add it to MOAMetadataProvider
+//									String certBase64 = oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_PROTOCOLS_PVP2X_CERTIFICATE);
+//									if (MiscUtil.isNotEmpty(certBase64)) {
+//										byte[] cert = Base64Utils.decode(certBase64, false);
+//										String oaFriendlyName = oaParam.getFriendlyName();
+//									
+//									
+//										Logger.info("Loading metadata for: " + oaFriendlyName);
+//										httpProvider = createNewHTTPMetaDataProvider(
+//												metadataurl, 												
+//												buildMetadataFilterChain(oaParam, metadataurl, cert),
+//												oaFriendlyName);
+//							
+//										if (httpProvider != null)
+//											providersinuse.put(metadataurl, httpProvider);
+//									}
 						
 								}
 							}
@@ -339,15 +373,21 @@ public class MOAMetadataProvider extends SimpleMOAMetadataProvider
 				}
 			}
 				
-			instance = null;
+			internalProvider = new ChainingMetadataProvider();
 		} else {
 			Logger.warn("ReInitalize MOAMetaDataProvider is not possible! MOA-ID Instance has to be restarted manualy");
 		}
 	}
 	
-	private MOAMetadataProvider() {
+	@Deprecated
+	/**
+	 * Load all PVP metadata from OA configuration
+	 * 
+	 * This method is deprecated because OA metadata should be loaded dynamically 
+	 * if the corresponding OA is requested.
+	 */
+	private void loadAllPVPMetadataFromKonfiguration() {
 		ChainingMetadataProvider chainProvider = new ChainingMetadataProvider();
-		
 		Logger.info("Loading metadata");		
 		Map<String, MetadataProvider> providersinuse = new HashMap<String, MetadataProvider>();
 		try {
@@ -417,14 +457,15 @@ public class MOAMetadataProvider extends SimpleMOAMetadataProvider
 								+ e.getMessage(), e);
 			}
 			
+			internalProvider = chainProvider;
+			
 		} catch (ConfigurationException e) {
 			Logger.error("Access MOA-ID configuration FAILED.", e);
 			
 		}
-		
-		internalProvider = chainProvider;
+				
 	}
-	
+		
 	private PVPMetadataFilterChain buildMetadataFilterChain(IOAAuthParameters oaParam, String metadataURL, byte[] certificate) throws CertificateException {
 		PVPMetadataFilterChain filterChain = new PVPMetadataFilterChain(metadataURL, certificate);
 		filterChain.getFilters().add(new SchemaValidationFilter());
@@ -505,17 +546,30 @@ public class MOAMetadataProvider extends SimpleMOAMetadataProvider
 			
 		}
 		
+//		if (entityDesc != null)
+//			lastAccess.put(entityID, new Date());
+		
 		return entityDesc;
 	}
 
 	public List<RoleDescriptor> getRole(String entityID, QName roleName)
-			throws MetadataProviderException {
-		return internalProvider.getRole(entityID, roleName);
+			throws MetadataProviderException {		
+		List<RoleDescriptor> result = internalProvider.getRole(entityID, roleName);
+		
+//		if (result != null)
+//			lastAccess.put(entityID, new Date());
+		
+		return result; 
 	}
 
 	public RoleDescriptor getRole(String entityID, QName roleName,
 			String supportedProtocol) throws MetadataProviderException {
-		return internalProvider.getRole(entityID, roleName, supportedProtocol);
+		RoleDescriptor result = internalProvider.getRole(entityID, roleName, supportedProtocol);
+		
+//		if (result != null)
+//			lastAccess.put(entityID, new Date());
+		
+		return result; 
 	}
 
 	/* (non-Javadoc)
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/SimpleMOAMetadataProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/SimpleMOAMetadataProvider.java
index 442455d4b..8261a86c1 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/SimpleMOAMetadataProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/SimpleMOAMetadataProvider.java
@@ -81,7 +81,7 @@ public abstract class SimpleMOAMetadataProvider implements MetadataProvider{
 				}
 			}
 			
-			timer = new Timer();
+			timer = new Timer(true);
 			httpProvider = new HTTPMetadataProvider(timer, httpClient, 
 					metadataURL);
 			httpProvider.setParserPool(new BasicParserPool());
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/signer/AbstractCredentialProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/signer/AbstractCredentialProvider.java
index bf4cfd480..77cc7228b 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/signer/AbstractCredentialProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/signer/AbstractCredentialProvider.java
@@ -24,6 +24,7 @@ package at.gv.egovernment.moa.id.protocols.pvp2x.signer;
 
 import java.security.KeyStore;
 import java.security.PrivateKey;
+import java.security.interfaces.ECPrivateKey;
 import java.security.interfaces.RSAPrivateKey;
 
 import org.opensaml.xml.security.credential.Credential;
@@ -198,7 +199,7 @@ public abstract class AbstractCredentialProvider {
 		if (privatekey instanceof RSAPrivateKey) {
 			signer.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
 			
-		} else if (privatekey instanceof iaik.security.ecc.ecdsa.ECPrivateKey) {
+		} else if (privatekey instanceof ECPrivateKey) {
 			signer.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA1);
 
 		} else {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/SAMLVerificationEngine.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/SAMLVerificationEngine.java
index f384dd511..f6104bdeb 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/SAMLVerificationEngine.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/SAMLVerificationEngine.java
@@ -41,6 +41,7 @@ import org.opensaml.xml.security.criteria.EntityIDCriteria;
 import org.opensaml.xml.security.criteria.UsageCriteria;
 import org.opensaml.xml.signature.SignatureTrustEngine;
 import org.opensaml.xml.validation.ValidationException;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 import org.w3c.dom.Element;
 import org.xml.sax.SAXException;
@@ -56,6 +57,8 @@ import at.gv.egovernment.moa.util.MiscUtil;
 
 @Service("SAMLVerificationEngine")
 public class SAMLVerificationEngine {
+		
+	@Autowired(required=true) MOAMetadataProvider metadataProvider;
 	
 	public void verify(InboundMessage msg, SignatureTrustEngine sigTrustEngine ) throws org.opensaml.xml.security.SecurityException, Exception {
 		try {		
@@ -72,7 +75,8 @@ public class SAMLVerificationEngine {
 			
 			}			
 			Logger.debug("PVP2X message validation FAILED. Relead metadata for entityID: " + msg.getEntityID());
-			if (!MOAMetadataProvider.getInstance().refreshMetadataProvider(msg.getEntityID()))
+						
+			if (metadataProvider == null || !metadataProvider.refreshMetadataProvider(msg.getEntityID()))
 				throw e;
 			
 			else {
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ECDSAKeyValueConverter.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ECDSAKeyValueConverter.java
index 2c0a82708..f37ae0b0b 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ECDSAKeyValueConverter.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ECDSAKeyValueConverter.java
@@ -20,48 +20,15 @@
  * The "NOTICE" text file is part of the distribution. Any derivative works
  * that you distribute must include a readable copy of the "NOTICE" text file.
  ******************************************************************************/
-/*
- * Copyright 2003 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- */
-
 
 package at.gv.egovernment.moa.id.util;
 
-import iaik.security.ecc.ecdsa.ECDSAParameter;
-import iaik.security.ecc.ecdsa.ECPublicKey;
-import iaik.security.ecc.math.ecgroup.AffineCoordinate;
-import iaik.security.ecc.math.ecgroup.Coordinate;
-import iaik.security.ecc.math.ecgroup.CoordinateTypes;
-import iaik.security.ecc.math.ecgroup.ECGroupFactory;
-import iaik.security.ecc.math.ecgroup.ECPoint;
-import iaik.security.ecc.math.ecgroup.EllipticCurve;
-import iaik.security.ecc.math.field.Field;
-import iaik.security.ecc.math.field.FieldElement;
-import iaik.security.ecc.math.field.PrimeField;
-import iaik.security.ecc.parameter.ECCParameterFactory;
-import iaik.security.ecc.spec.ECCParameterSpec;
-
 import java.math.BigInteger;
 import java.security.PublicKey;
+import java.security.spec.ECField;
+import java.security.spec.ECFieldF2m;
+import java.security.spec.ECFieldFp;
+import java.security.spec.ECPoint;
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.Vector;
@@ -72,6 +39,15 @@ import org.w3c.dom.NamedNodeMap;
 import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
 
+import at.gv.egovernment.moa.logging.Logger;
+import iaik.security.ec.common.ECParameterSpec;
+import iaik.security.ec.common.ECPublicKey;
+import iaik.security.ec.common.ECStandardizedParameterFactory;
+import iaik.security.ec.common.EllipticCurve;
+import iaik.security.ec.math.field.Field;
+import iaik.security.ec.math.field.FieldElement;
+import iaik.security.ec.math.field.PrimeField;
+
 public class ECDSAKeyValueConverter
 { 
     
@@ -94,15 +70,13 @@ public class ECDSAKeyValueConverter
     if (domainParams == null) throw new Exception("Domain parameters must not be implicit.");
 
     Element namedCurve = getChildElement(domainParams, ecdsaNS, "NamedCurve", 1);
-    ECCParameterSpec eccParameterSpec;
+    ECParameterSpec eccParameterSpec;
 
     if (namedCurve != null)
     {
       // URL curveNameURN = new URL(namedCurve.getAttributeNS(null, "URN"));
       String curveNameOID = namedCurve.getAttributeNS(null, "URN").substring(8);
-      ECCParameterFactory eccParamFactory = ECCParameterFactory.getInstance();
-      // eccParameterSpec = eccParamFactory.getParameterByOID(curveNameURN.getPath().substring(4));
-      eccParameterSpec = eccParamFactory.getParameterByOID(curveNameOID);
+      eccParameterSpec = ECStandardizedParameterFactory.getParametersByOID(curveNameOID);
     }
     else
     {
@@ -167,14 +141,21 @@ public class ECDSAKeyValueConverter
       String cofactorStr = getChildElementText(basePointParams, ecdsaNS, "Cofactor", 1);
       BigInteger cofactor = (cofactorStr != null) ? new BigInteger(cofactorStr, 10) : null;
 
+      BigInteger a = new BigInteger(aStr, 10);
+      BigInteger b = new BigInteger(bStr, 10);
+      BigInteger basePointX = new BigInteger(basePointXStr, 10);
+      BigInteger basePointY = new BigInteger(basePointYStr, 10);
+      
       if (fieldParamsType == FIELD_TYPE_PRIME)
-      {
-        BigInteger a = new BigInteger(aStr, 10);
-        BigInteger b = new BigInteger(bStr, 10);
-        BigInteger basePointX = new BigInteger(basePointXStr, 10);
-        BigInteger basePointY = new BigInteger(basePointYStr, 10);
-        eccParameterSpec = new ECCParameterSpec(p, cofactor, order, seed, null, a, b, basePointX,
-          basePointY, null);
+      {        
+        ECField javaECField = new ECFieldFp(p);
+		java.security.spec.EllipticCurve curve = 
+        		new java.security.spec.EllipticCurve(javaECField, a, b, seed.toByteArray());
+		java.security.spec.ECPoint javaECbasePoint = 
+				new java.security.spec.ECPoint(basePointX, basePointY);		
+		java.security.spec.ECParameterSpec javaECSpec = 
+        		new java.security.spec.ECParameterSpec(curve, javaECbasePoint, order, cofactor.intValue());        
+        eccParameterSpec = ECParameterSpec.getParameterSpec(javaECSpec);
       }
       else
       {
@@ -193,9 +174,19 @@ public class ECDSAKeyValueConverter
           irreducible[k1/32] += 1 << k1 % 32;
           irreducible[0] += 1;
         }
-        eccParameterSpec = new ECCParameterSpec(irreducible, cofactor, order, octetString2IntArray(aStr),
-          octetString2IntArray(bStr), octetString2IntArray(basePointXStr),
-          octetString2IntArray(basePointYStr), null);
+        
+        ECField javaECField = new ECFieldF2m(m, irreducible);
+		java.security.spec.EllipticCurve curve = 
+        		new java.security.spec.EllipticCurve(javaECField, a, b, seed.toByteArray());
+		java.security.spec.ECPoint javaECbasePoint = 
+				new java.security.spec.ECPoint(basePointX, basePointY);		
+		java.security.spec.ECParameterSpec javaECSpec = 
+        		new java.security.spec.ECParameterSpec(curve, javaECbasePoint, order, cofactor.intValue());        
+        eccParameterSpec = ECParameterSpec.getParameterSpec(javaECSpec);
+                
+//        eccParameterSpec = new ECCParameterSpec(irreducible, cofactor, order, octetString2IntArray(aStr),
+//          octetString2IntArray(bStr), octetString2IntArray(basePointXStr),
+//          octetString2IntArray(basePointYStr), null);
       }
     }
 
@@ -206,10 +197,14 @@ public class ECDSAKeyValueConverter
     Element publicKeyYElem = getChildElement(publicKeyElem, ecdsaNS, "Y", 1);
     String publicKeyYStr = publicKeyYElem.getAttributeNS(null, "Value");
 
-    ECDSAParameter ecdsaParams = new ECDSAParameter(eccParameterSpec, CoordinateTypes.PROJECTIVE_COORDINATES);
-    ECGroupFactory ecGroupFactory = ECGroupFactory.getInstance();
-    EllipticCurve eCurve = ecGroupFactory.getCurve(eccParameterSpec.getA(),
-        eccParameterSpec.getB(), eccParameterSpec.getR(), CoordinateTypes.PROJECTIVE_COORDINATES);
+    //ECParameterSpec ecdsaParams = new ECParameterSpec(eccParameterSpec, CoordinateTypes.PROJECTIVE_COORDINATES);
+    //ECGroupFactory ecGroupFactory = ECGroupFactory.getInstance();
+        
+    EllipticCurve eCurve = eccParameterSpec.getCurve();
+    
+//    EllipticCurve eCurve = ecGroupFactory.getCurve(eccParameterSpec.getA(),
+//        eccParameterSpec.getB(), eccParameterSpec.getR(), CoordinateTypes.PROJECTIVE_COORDINATES);    
+    
     Field field = eCurve.getField();
 
     // Detect type of public key field elements
@@ -239,10 +234,19 @@ public class ECDSAKeyValueConverter
     }
 //    ProjectiveCoordinate publicKeyPointCoordinate = new ProjectiveCoordinate(publicKeyPointX,
 //      publicKeyPointY, field.getONEelement());
-    Coordinate publicKeyPointCoordinate = new AffineCoordinate(publicKeyPointX,
-        publicKeyPointY).toProjective();
-    ECPoint publicKeyPoint = eCurve.newPoint(publicKeyPointCoordinate);
-    ECPublicKey publicKey = new ECPublicKey(ecdsaParams, publicKeyPoint);
+//    Coordinate publicKeyPointCoordinate = new AffineCoordinate(publicKeyPointX,
+//        publicKeyPointY).toProjective();
+    
+    ECPoint publicKeyPointECPoint =  new ECPoint(publicKeyPointX.toBigInteger(),
+    		publicKeyPointY.toBigInteger());
+    
+    if (!eCurve.containsPoint(publicKeyPointECPoint)) {
+    	Logger.error("IDL ECC parameter extraction FAILED! Public-Key ECPoint is not on the curve!");
+    	throw new Exception("IDL ECC parameter extraction FAILED! Public-Key ECPoint is not on the curve!");
+    	
+    }
+    	
+    ECPublicKey publicKey = new ECPublicKey(eccParameterSpec, publicKeyPointECPoint);
 
     return publicKey;
   }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/HTTPUtils.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/HTTPUtils.java
index d2499af9d..4cb6af127 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/HTTPUtils.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/HTTPUtils.java
@@ -173,6 +173,17 @@ public class HTTPUtils {
 		
 	}
 	
+	/**
+	 * Extract the IDP requested URL from authrequest
+	 * 
+	 * @param req HttpServletRequest
+	 * @return RequestURL <String> which ends always without /
+	 */ 
+	public static String extractAuthServletPathFromRequest(HttpServletRequest req) {
+	    return extractAuthURLFromRequest(req).concat(req.getServletPath());
+	 	
+	}
+	
 	public static String addURLParameter(String url, String paramname,
 			String paramvalue) {
 		String param = paramname + "=" + paramvalue;
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java
index 47ea91753..885d03fd8 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/ParamValidatorUtils.java
@@ -539,9 +539,7 @@ public class ParamValidatorUtils extends MOAIDAuthConstants{
 			return false;

 		}

 

-	    if (StringUtils.isEmpty(oaURL) 

-	    		//|| StringUtils.isEmpty(templateURL) 

-	    		|| StringUtils.isEmpty(bkuURL) )

+	    if (StringUtils.isEmpty(bkuURL))

 	    	return false;

 	    else

 	    	return true;

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/Random.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/Random.java
index 47f784c33..ba45a3679 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/Random.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/Random.java
@@ -99,8 +99,12 @@ public class Random {
 		char preFix = allowedPreFix[Math.abs(random.nextInt() % allowedPreFix.length)];
 	 
 		//generate ID
-		return preFix + new String(Hex.encodeHex(Bytes.concat(now.getBytes(), randValue))); // 20 bytes = 160 bits
-		
+		String returnValue = preFix + new String(Hex.encodeHex(Bytes.concat(now.getBytes(), randValue))); // 20 bytes = 160 bits
+		if (returnValue.length() > 40)
+			return returnValue.substring(0, 40);
+		else
+			return returnValue;
+				
 	}
 	
 	
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/SSLUtils.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/SSLUtils.java
index f0cec1d61..891d01e09 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/SSLUtils.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/SSLUtils.java
@@ -46,9 +46,6 @@
 
 package at.gv.egovernment.moa.id.util;
 
-import iaik.pki.PKIException;
-import iaik.security.provider.IAIK;
-
 import java.io.BufferedInputStream;
 import java.io.BufferedReader;
 import java.io.IOException;
@@ -71,6 +68,8 @@ import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 import at.gv.egovernment.moa.id.commons.utils.ssl.SSLConfigurationException;
 import at.gv.egovernment.moa.id.config.ConnectionParameter;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
+import iaik.pki.PKIException;
+import iaik.security.provider.IAIK;
 
 
 /**
@@ -126,8 +125,7 @@ public class SSLUtils {
    	   //INFO: MOA-ID 2.x always use defaultChainingMode 
 	    
 	    try {	    
-	    	SSLSocketFactory ssf =  
-	    			at.gv.egovernment.moa.id.commons.utils.ssl.SSLUtils.getSSLSocketFactory(
+	    	SSLSocketFactory ssf = at.gv.egovernment.moa.id.commons.utils.ssl.SSLUtils.getSSLSocketFactory(
 	    					connParam.getUrl(), 
 	    					conf.getCertstoreDirectory(), 
 	    					trustStoreURL, 
diff --git a/id/server/idserverlib/src/main/resources/moaid.authentication.beans.xml b/id/server/idserverlib/src/main/resources/moaid.authentication.beans.xml
index ad2a8a063..ba8c47304 100644
--- a/id/server/idserverlib/src/main/resources/moaid.authentication.beans.xml
+++ b/id/server/idserverlib/src/main/resources/moaid.authentication.beans.xml
@@ -5,10 +5,16 @@
 	xmlns:tx="http://www.springframework.org/schema/tx"
 	xmlns:aop="http://www.springframework.org/schema/aop"
 	xmlns:p="http://www.springframework.org/schema/p"
+	xmlns:task="http://www.springframework.org/schema/task"
 	xsi:schemaLocation="http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.1.xsd
 		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
 		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd
-		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd">
+		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
+		http://www.springframework.org/schema/task http://www.springframework.org/schema/task/spring-task-3.0.xsd">
+ 
+ 	<task:annotation-driven executor="MOA-ID-Auth_TaskExecutor" scheduler="MOA-ID-Auth_Scheduler"/>
+	<task:executor id="MOA-ID-Auth_TaskExecutor" pool-size="5"/>
+	<task:scheduler id="MOA-ID-Auth_Scheduler" pool-size="10"/>
  
  	<bean id="processEngine" class="at.gv.egovernment.moa.id.process.ProcessEngineImpl">
 		<property name="transitionConditionExpressionEvaluator">
@@ -51,7 +57,16 @@
 				class="at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger"/>
 				
 	<bean id="AuthenticationSessionCleaner" 
-				class="at.gv.egovernment.moa.id.auth.AuthenticationSessionCleaner"/>								
+				class="at.gv.egovernment.moa.id.auth.AuthenticationSessionCleaner"/>
+				
+	<bean id="MOAGarbageCollector" 
+				class="at.gv.egovernment.moa.id.auth.MOAGarbageCollector"/>
+
+<!-- 	<bean id="taskExecutor" class="org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor">
+    <property name="corePoolSize" value="5" />
+    <property name="maxPoolSize" value="10" />
+    <property name="queueCapacity" value="25" />
+	</bean>	 -->										
 				
 <!-- Authentication Process Tasks -->
 	<bean id="GenerateBKUSelectionFrameTask" 
diff --git a/id/server/idserverlib/src/test/java/at/gv/egovernment/moa/id/module/test/TestRequestImpl.java b/id/server/idserverlib/src/test/java/at/gv/egovernment/moa/id/module/test/TestRequestImpl.java
index 66dffe311..0b5128c8b 100644
--- a/id/server/idserverlib/src/test/java/at/gv/egovernment/moa/id/module/test/TestRequestImpl.java
+++ b/id/server/idserverlib/src/test/java/at/gv/egovernment/moa/id/module/test/TestRequestImpl.java
@@ -24,6 +24,8 @@ package at.gv.egovernment.moa.id.module.test;
 
 import java.util.Collection;
 
+import org.opensaml.saml2.metadata.provider.MetadataProvider;
+
 import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
 import at.gv.egovernment.moa.id.commons.api.IRequest;
 import at.gv.egovernment.moa.id.commons.api.exceptions.SessionDataStorageException;
@@ -254,7 +256,7 @@ public class TestRequestImpl implements IRequest {
 	 * @see at.gv.egovernment.moa.id.moduls.IRequest#getRequestedAttributes()
 	 */
 	@Override
-	public Collection<String> getRequestedAttributes() {
+	public Collection<String> getRequestedAttributes(MetadataProvider metadataProvider) {
 		// TODO Auto-generated method stub
 		return null;
 	}
diff --git a/id/server/idserverlib/src/test/java/test/tlenz/simpletest.java b/id/server/idserverlib/src/test/java/test/tlenz/simpletest.java
index 2c80b7ffd..05cd74ed2 100644
--- a/id/server/idserverlib/src/test/java/test/tlenz/simpletest.java
+++ b/id/server/idserverlib/src/test/java/test/tlenz/simpletest.java
@@ -1,23 +1,23 @@
 package test.tlenz;
 
-import java.io.File;
 import java.io.FileInputStream;
-import java.io.InputStream;
-import java.io.ObjectInputStream;
-import java.net.URI;
-import java.net.URISyntaxException;
+import java.util.HashMap;
+import java.util.List;
 
-import org.w3c.dom.Element;
+import org.apache.commons.io.IOUtils;
+import org.w3c.dom.NodeList;
 
-import iaik.asn1.structures.Name;
-import iaik.utils.RFC2253NameParser;
-import iaik.utils.RFC2253NameParserException;
-import at.gv.egovernment.moa.id.auth.data.IdentityLink;
-import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser;
-import at.gv.egovernment.moa.id.data.AuthenticationRole;
-import at.gv.egovernment.moa.id.data.AuthenticationRoleFactory;
-import at.gv.egovernment.moa.id.util.IdentityLinkReSigner;
-import at.gv.egovernment.moa.util.DOMUtils;
+import at.gv.egovernment.moa.spss.api.SPSSFactory;
+import at.gv.egovernment.moa.spss.api.SignatureVerificationService;
+import at.gv.egovernment.moa.spss.api.common.Content;
+import at.gv.egovernment.moa.spss.api.common.ContentBinary;
+import at.gv.egovernment.moa.spss.api.common.ContentXML;
+import at.gv.egovernment.moa.spss.api.common.InputData;
+import at.gv.egovernment.moa.spss.api.common.SignerInfo;
+import at.gv.egovernment.moa.spss.api.xmlverify.VerifySignatureInfo;
+import at.gv.egovernment.moa.spss.api.xmlverify.VerifySignatureLocation;
+import at.gv.egovernment.moa.spss.api.xmlverify.VerifyXMLSignatureRequest;
+import at.gv.egovernment.moa.spss.api.xmlverify.VerifyXMLSignatureResponse;
 
 /*******************************************************************************
  * Copyright 2014 Federal Chancellery Austria
@@ -62,71 +62,130 @@ import at.gv.egovernment.moa.util.DOMUtils;
 public class simpletest {
 //
 	public static void main(String[] args) {
-				
 		
-		URI fileURI = null;
-		try {
-			fileURI = new URI("file:c:/moa3/tomcat8/conf/moa-id/moa-id.properties");
-			File propertiesFile = new File(fileURI);
+		try  {
+			FileInputStream sigDocFIS = null;
+			sigDocFIS = new FileInputStream("D:/idl_test/identity_link.xml");
 			
-			InputStream in = new FileInputStream(propertiesFile);
-			ObjectInputStream testOIS = new ObjectInputStream(in);
+			SPSSFactory spssFac = SPSSFactory.getInstance();
+	        SignatureVerificationService sigVerifyService = SignatureVerificationService.getInstance();
+	        Content sigDocContent = spssFac.createContent(sigDocFIS, null);
+	        
+	        
+	     // Position der zu pruefenden Signatur
+	        HashMap nSMap = new HashMap();
+	        nSMap.put("dsig", "http://www.w3.org/2000/09/xmldsig#");
+	        VerifySignatureLocation sigLocation = spssFac.createVerifySignatureLocation("//dsig:Signature", nSMap);
+
+	        // Pruefrequest zusammenstellen
+	        VerifySignatureInfo sigInfo = spssFac.createVerifySignatureInfo(sigDocContent, sigLocation);
+	        VerifyXMLSignatureRequest verifyRequest = spssFac.createVerifyXMLSignatureRequest(
+	                null,    // Verwende aktuelle Zeit als Pruefzeit
+	                sigInfo,
+	                null,    // Keine Ergaenzungsobjekte
+	                null,    // Signaturmanifest-Pruefung soll nicht durchgefuehrt werden
+	                true,   // Hash-Inputdaten, d.h. tatsaechlich signierte Daten werden nicht zurueckgeliefert
+	                "MOAIDBuergerkarteAuthentisierungsDaten");
+	        
+	        
+	        VerifyXMLSignatureResponse verifyResponse = null;
+	        verifyResponse = sigVerifyService.verifyXMLSignature(verifyRequest);
+	        
+	        SignerInfo signerInfo = verifyResponse.getSignerInfo();
+	        String signerCertificateEncoded = null;
+
+	        List hashInputDatas = verifyResponse.getHashInputDatas();
+	        if (hashInputDatas != null && !hashInputDatas.isEmpty()) {
+	        	for (Object el : hashInputDatas) {
+	        		InputData inputData = (InputData) el;
+	        		switch (inputData.getContentType()) {
+	        	      case Content.XML_CONTENT :
+	        	        ContentXML contentXml = (ContentXML) inputData;
+	        	        NodeList input_XML = contentXml.getXMLContent();
+	        	     
+	        	        break;
+	        	      case Content.BINARY_CONTENT :
+	        	          ContentBinary contentBinary = (ContentBinary) inputData;	        	       
+	        	          String input_Binary = IOUtils.toString(contentBinary.getBinaryContent());
+	        	          	        	        
+	        		}	        		
+	        	}	        	
+	        }
+	        
+	        
 			
-			Object test = testOIS.readObject();
+		} catch (Exception e) {
 			
 			
-		} catch (Exception e1) {
-			e1.printStackTrace();
-		}
-		
-		try {
-			fileURI = new URI("file:/c:/moa3/tomcat8/conf/moa-id/moa-id.properties");
-			File propertiesFile = new File(fileURI);
-		} catch (Exception e1) {
-			e1.printStackTrace();
-		}
-		
-		try {
-			fileURI = new URI("file://c:/moa3/tomcat8/conf/moa-id/moa-id.properties");
-			File propertiesFile = new File(fileURI);
-		} catch (Exception e1) {
-			e1.printStackTrace();
-		}
-		
-		try {
-			fileURI = new URI("file:///c:/moa3/tomcat8/conf/moa-id/moa-id.properties");
-			File propertiesFile = new File(fileURI);
-		} catch (Exception e1) {
-			e1.printStackTrace();
 		}
 		
 		
 		
-		try {
-		InputStream s = new FileInputStream("D:/idl_test/identity_link.xml");
-		Element idlTemplate = DOMUtils.parseXmlValidating(s);
-		
-        //resign IDL
-		IdentityLinkReSigner identitylinkresigner = IdentityLinkReSigner.getInstance();
-		Element resignedilAssertion = identitylinkresigner.resignIdentityLink(idlTemplate, "IDLSigning");
-		IdentityLink identityLink = new IdentityLinkAssertionParser(resignedilAssertion).parseIdentityLink();
-		
-		} catch (Exception e) {
-			System.out.println(e.getMessage());
-			
-		}
 		
-		String subjectName = "serialNumber=896929130327, givenName=OCSP, SN=Responder 03-1, CN=OCSP Responder 03-1, C=AT";
 		
-		try {
-			Name test = new RFC2253NameParser(subjectName).parse();
-			
-			System.out.println(test.getRFC2253String());
-			
-		} catch (RFC2253NameParserException e) {
-			// TODO Auto-generated catch block
-			e.printStackTrace();
-		}
+//		URI fileURI = null;
+//		try {
+//			fileURI = new URI("file:c:/moa3/tomcat8/conf/moa-id/moa-id.properties");
+//			File propertiesFile = new File(fileURI);
+//			
+//			InputStream in = new FileInputStream(propertiesFile);
+//			ObjectInputStream testOIS = new ObjectInputStream(in);
+//			
+//			Object test = testOIS.readObject();
+//			
+//			
+//		} catch (Exception e1) {
+//			e1.printStackTrace();
+//		}
+//		
+//		try {
+//			fileURI = new URI("file:/c:/moa3/tomcat8/conf/moa-id/moa-id.properties");
+//			File propertiesFile = new File(fileURI);
+//		} catch (Exception e1) {
+//			e1.printStackTrace();
+//		}
+//		
+//		try {
+//			fileURI = new URI("file://c:/moa3/tomcat8/conf/moa-id/moa-id.properties");
+//			File propertiesFile = new File(fileURI);
+//		} catch (Exception e1) {
+//			e1.printStackTrace();
+//		}
+//		
+//		try {
+//			fileURI = new URI("file:///c:/moa3/tomcat8/conf/moa-id/moa-id.properties");
+//			File propertiesFile = new File(fileURI);
+//		} catch (Exception e1) {
+//			e1.printStackTrace();
+//		}
+//		
+//		
+//		
+//		try {
+//		InputStream s = new FileInputStream("D:/idl_test/identity_link.xml");
+//		Element idlTemplate = DOMUtils.parseXmlValidating(s);
+//		
+//        //resign IDL
+//		IdentityLinkReSigner identitylinkresigner = IdentityLinkReSigner.getInstance();
+//		Element resignedilAssertion = identitylinkresigner.resignIdentityLink(idlTemplate, "IDLSigning");
+//		IdentityLink identityLink = new IdentityLinkAssertionParser(resignedilAssertion).parseIdentityLink();
+//		
+//		} catch (Exception e) {
+//			System.out.println(e.getMessage());
+//			
+//		}
+//		
+//		String subjectName = "serialNumber=896929130327, givenName=OCSP, SN=Responder 03-1, CN=OCSP Responder 03-1, C=AT";
+//		
+//		try {
+//			Name test = new RFC2253NameParser(subjectName).parse();
+//			
+//			System.out.println(test.getRFC2253String());
+//			
+//		} catch (RFC2253NameParserException e) {
+//			// TODO Auto-generated catch block
+//			e.printStackTrace();
+//		}
 		
 		
 //		AuthenticationRole test = AuthenticationRoleFactory.buildFormPVPole("ecas-demo-EUROPEAN_COMMISSION(key=A\\,B)");
diff --git a/id/server/moa-id-commons/pom.xml b/id/server/moa-id-commons/pom.xml
index 613698fc6..4e8d77a4f 100644
--- a/id/server/moa-id-commons/pom.xml
+++ b/id/server/moa-id-commons/pom.xml
@@ -97,16 +97,18 @@
             <groupId>iaik.prod</groupId>
             <artifactId>iaik_jce_full</artifactId>
         </dependency>
-        <dependency>
-            <groupId>iaik.prod</groupId>
-            <artifactId>iaik_moa</artifactId>
-        </dependency>
     
+    		<dependency>
+    			<groupId>MOA.id</groupId>
+					<artifactId>moa-spss-container</artifactId>
+					<version>${moa-id-version}</version>
+    		</dependency>
+        
         <dependency>
 					<groupId>iaik.prod</groupId>
 					<artifactId>iaik_X509TrustManager</artifactId>
 				</dependency>
-    
+				        
         <dependency>
             <groupId>joda-time</groupId>
             <artifactId>joda-time</artifactId>
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/MOAIDConstants.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/MOAIDConstants.java
index 6726aacb5..27744273f 100644
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/MOAIDConstants.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/MOAIDConstants.java
@@ -40,11 +40,13 @@ public class MOAIDConstants {
 	
 	public static final String PREFIX_WPBK = "urn:publicid:gv.at:wbpk+";
     public static final String PREFIX_STORK = "urn:publicid:gv.at:storkid+";
+    public static final String PREFIX_EIDAS = "urn:publicid:gv.at:eidasid+";
 	
 	public static final String IDENIFICATIONTYPE_FN = "FN";
 	public static final String IDENIFICATIONTYPE_ERSB = "ERSB";
 	public static final String IDENIFICATIONTYPE_ZVR = "ZVR";
     public static final String IDENIFICATIONTYPE_STORK = "STORK";
+    public static final String IDENIFICATIONTYPE_EIDAS = "eIDAS";
 	
     public static final String KEYBOXIDENTIFIER_SECURE = "SecureSignatureKeypair";
     public static final String KEYBOXIDENTIFIER_CERTIFIED = "CertifiedKeypair";
@@ -71,6 +73,7 @@ public class MOAIDConstants {
 		tmp.put(IDENIFICATIONTYPE_ZVR, "Vereinsnummer");
 		tmp.put(IDENIFICATIONTYPE_ERSB, "ERsB Kennzahl");
         tmp.put(IDENIFICATIONTYPE_STORK, "STORK");
+        tmp.put(IDENIFICATIONTYPE_EIDAS, "eIDAS");
         BUSINESSSERVICENAMES = Collections.unmodifiableMap(tmp);
         
         List<String> awbpk = new ArrayList<String>();
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/api/IRequest.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/api/IRequest.java
index b23b4474b..25919a937 100644
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/api/IRequest.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/api/IRequest.java
@@ -24,6 +24,8 @@ package at.gv.egovernment.moa.id.commons.api;
 
 import java.util.Collection;
 
+import org.opensaml.saml2.metadata.provider.MetadataProvider;
+
 import at.gv.egovernment.moa.id.commons.api.exceptions.SessionDataStorageException;
 
 public interface IRequest {
@@ -193,9 +195,10 @@ public interface IRequest {
 	
 	/**
 	 * This method get a Set of PVP 2.1 attribute, which are request by this pending-request.
+	 * @param metadataProvider SAML2 Metadata Provider, or null if no metadata provider is required
 	 * 
 	 * @return A set of PVP attribute names or null if no attributes are requested 
 	 * 			or the Service Provider, which sends this request needs no attributes
 	 */
-	public Collection<String> getRequestedAttributes();
+	public Collection<String> getRequestedAttributes(MetadataProvider metadataProvider);
 }
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/config/ConfigurationMigrationUtils.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/config/ConfigurationMigrationUtils.java
index 63d8f463c..e865c4ed6 100644
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/config/ConfigurationMigrationUtils.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/config/ConfigurationMigrationUtils.java
@@ -22,8 +22,6 @@ moaidconfigmoaidconfigmoaidconfig * Copyright 2014 Federal Chancellery Austria
  */
 package at.gv.egovernment.moa.id.commons.config;
 
-import iaik.x509.X509Certificate;
-
 import java.io.IOException;
 import java.math.BigInteger;
 import java.security.cert.CertificateException;
@@ -88,6 +86,7 @@ import at.gv.egovernment.moa.id.commons.validation.TargetValidator;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.Base64Utils;
 import at.gv.egovernment.moa.util.MiscUtil;
+import iaik.x509.X509Certificate;
 
 /**
  * @author tlenz
@@ -185,6 +184,10 @@ public class ConfigurationMigrationUtils {
 						if (MOAIDConfigurationConstants.PREFIX_WPBK.startsWith(split[0]) && split.length >= 2) {							
 							result.put(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_TYPE, split[1]);
 							result.put(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_VALUE, split[2]);
+						
+						} else if (MOAIDConfigurationConstants.PREFIX_EIDAS.startsWith(split[0]) && split.length >= 2) {							
+							result.put(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_TYPE, MOAIDConfigurationConstants.IDENIFICATIONTYPE_EIDAS);
+							result.put(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_VALUE, split[1] + "+" + split[2]);
 							
 						} else if (MOAIDConfigurationConstants.PREFIX_STORK.startsWith(split[0]) && split.length >= 2) {							
 							result.put(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_TYPE, MOAIDConfigurationConstants.IDENIFICATIONTYPE_STORK);
@@ -240,17 +243,20 @@ public class ConfigurationMigrationUtils {
 				if (templates != null) {
 					List<TemplateType> templatetype = templates.getTemplate();					
 					if (templatetype != null) {
-						if (templatetype.size() > 0) {
+						if (templatetype.size() > 0 &&
+								MiscUtil.isNotEmpty(templatetype.get(0).getURL())) {
 							result.put(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_TEMPLATE_FIRST_VALUE, templatetype.get(0).getURL());
 							result.put(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_TEMPLATE_LEGACY, Boolean.TRUE.toString());
 							
 						} else
 							result.put(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_TEMPLATE_LEGACY, Boolean.FALSE.toString());
 				
-						if (templatetype.size() > 1)
+						if (templatetype.size() > 1 &&
+								MiscUtil.isNotEmpty(templatetype.get(1).getURL()))
 							result.put(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_TEMPLATE_SECOND_VALUE, templatetype.get(1).getURL());
 
-						if (templatetype.size() > 2)
+						if (templatetype.size() > 2 &&
+								MiscUtil.isNotEmpty(templatetype.get(2).getURL()))
 							result.put(MOAIDConfigurationConstants.SERVICE_AUTH_BKU_TEMPLATE_THIRD_VALUE, templatetype.get(2).getURL());
 				
 					}
@@ -757,9 +763,15 @@ public class ConfigurationMigrationUtils {
 
 				if (oa.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_TYPE) != null &&
 						oa.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_VALUE) != null) {
-					if (oa.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_TYPE).equals(MOAIDConfigurationConstants.IDENIFICATIONTYPE_STORK)) {
+					
+					if (oa.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_TYPE).equals(MOAIDConfigurationConstants.IDENIFICATIONTYPE_EIDAS)) {
+						idnumber.setValue(MOAIDConfigurationConstants.PREFIX_EIDAS + oa.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_VALUE));
+						idnumber.setType(MOAIDConfigurationConstants.BUSINESSSERVICENAMES.get(oa.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_TYPE)));
+					
+					} else if (oa.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_TYPE).equals(MOAIDConfigurationConstants.IDENIFICATIONTYPE_STORK)) {
 						idnumber.setValue(MOAIDConfigurationConstants.PREFIX_STORK + "AT" + "+" + oa.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_VALUE));
 						idnumber.setType(MOAIDConfigurationConstants.BUSINESSSERVICENAMES.get(oa.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_TYPE)));
+						
 					} else {
 						idnumber.setValue(MOAIDConfigurationConstants.PREFIX_WPBK + oa.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_TYPE) + "+" + oa.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_VALUE));
 						idnumber.setType(MOAIDConfigurationConstants.BUSINESSSERVICENAMES.get(oa.get(MOAIDConfigurationConstants.SERVICE_AUTH_TARGET_BUSINESS_TYPE)));
@@ -1259,10 +1271,16 @@ public class ConfigurationMigrationUtils {
 						if (list.contains(MOA_CONFIG_PROTOCOL_SAML1))
 							result.put(MOAIDConfigurationConstants.GENERAL_PROTOCOLS_SAML1_LEGACY, 
 									Boolean.TRUE.toString());
+						else
+							result.put(MOAIDConfigurationConstants.GENERAL_PROTOCOLS_SAML1_LEGACY, 
+									Boolean.FALSE.toString());
 						
 						if (list.contains(MOA_CONFIG_PROTOCOL_PVP2))
 							result.put(MOAIDConfigurationConstants.GENERAL_PROTOCOLS_PVP2X_LEGACY, 
 									Boolean.TRUE.toString());
+						else
+							result.put(MOAIDConfigurationConstants.GENERAL_PROTOCOLS_PVP2X_LEGACY, 
+									Boolean.FALSE.toString());
 					}
 					
 					SAML1 saml1 = protocols.getSAML1();
@@ -1277,14 +1295,18 @@ public class ConfigurationMigrationUtils {
 							result.put(MOAIDConfigurationConstants.GENERAL_PROTOCOLS_SAML1_SOURCEID, 
 									saml1.getSourceID());
 									
-					}
+					} else
+						result.put(MOAIDConfigurationConstants.GENERAL_PROTOCOLS_SAML1_ENABLED, 
+								Boolean.FALSE.toString());
 					
 					OAuth oauth = protocols.getOAuth();
 					if (oauth != null) {
 						result.put(MOAIDConfigurationConstants.GENERAL_PROTOCOLS_OPENID_ENABLED, 
 								String.valueOf(oauth.isIsActive()));
 					
-					}
+					} else
+						result.put(MOAIDConfigurationConstants.GENERAL_PROTOCOLS_OPENID_ENABLED, 
+								Boolean.FALSE.toString());
 					
 					PVP2 pvp2 = protocols.getPVP2();
 					if (pvp2 != null) {
@@ -1323,7 +1345,10 @@ public class ConfigurationMigrationUtils {
 							result.put(MOAIDConfigurationConstants.GENERAL_PROTOCOLS_PVP2X_METADATA_ORG_URL, 
 									org.getURL());
 						}
-					}	
+						
+					} else
+						result.put(MOAIDConfigurationConstants.GENERAL_PROTOCOLS_PVP2X_ENABLED, 
+								Boolean.FALSE.toString());
 				}
 				
 				SecurityLayer seclayer = auth.getSecurityLayer();
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/dao/session/AssertionStore.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/dao/session/AssertionStore.java
index 7c542da09..4c6cd16c0 100644
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/dao/session/AssertionStore.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/dao/session/AssertionStore.java
@@ -68,7 +68,7 @@ public class AssertionStore implements Serializable{
 	@GeneratedValue(strategy = GenerationType.AUTO)
 	@Column(name = "id", unique=true, nullable=false)
 	private long id;
-	
+		
 	@Column(name = "artifact", unique=true, nullable=false)
 	private String artifact;
 	
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/dao/session/AuthenticatedSessionStore.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/dao/session/AuthenticatedSessionStore.java
index 96c6f3658..eeaf03544 100644
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/dao/session/AuthenticatedSessionStore.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/dao/session/AuthenticatedSessionStore.java
@@ -67,12 +67,13 @@ import org.hibernate.annotations.DynamicUpdate;
 public class AuthenticatedSessionStore implements Serializable{
 
 	private static final long serialVersionUID = 1L;
-
+	
 	@Id
 	@GeneratedValue(strategy = GenerationType.AUTO)
 	@Column(name = "id", unique=true, nullable=false)
 	private long id;
 	
+	
 	@Column(name = "sessionid", unique=true, nullable=false)
 	private String sessionid;
 	
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/MOAHttpProtocolSocketFactory.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/MOAHttpProtocolSocketFactory.java
index 2ade63c1c..142e9a23a 100644
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/MOAHttpProtocolSocketFactory.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/MOAHttpProtocolSocketFactory.java
@@ -22,15 +22,12 @@
  */
 package at.gv.egovernment.moa.id.commons.utils;
 
-import iaik.pki.PKIException;
-
 import java.io.IOException;
 import java.net.InetAddress;
 import java.net.Socket;
 import java.net.UnknownHostException;
 import java.security.GeneralSecurityException;
 
-import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLSocketFactory;
 
 import org.apache.commons.httpclient.ConnectTimeoutException;
@@ -39,7 +36,7 @@ import org.apache.commons.httpclient.protocol.SecureProtocolSocketFactory;
 
 import at.gv.egovernment.moa.id.commons.ex.MOAHttpProtocolSocketFactoryException;
 import at.gv.egovernment.moa.id.commons.utils.ssl.SSLConfigurationException;
-import at.gv.egovernment.moa.id.commons.utils.ssl.SSLUtils;
+import iaik.pki.PKIException;
 
 /**
  * @author tlenz
@@ -62,7 +59,7 @@ public class MOAHttpProtocolSocketFactory implements SecureProtocolSocketFactory
 		super();
 		
 		try {
-			this.sslfactory = SSLUtils.getSSLSocketFactory(
+			this.sslfactory = at.gv.egovernment.moa.id.commons.utils.ssl.SSLUtils.getSSLSocketFactory(
 					url, 
 					certStoreRootDirParam, 
 					trustStoreURL, 
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/CertStoreConfigurationImpl.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/CertStoreConfigurationImpl.java
index 00e750f58..dcbec6bf6 100644
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/CertStoreConfigurationImpl.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/CertStoreConfigurationImpl.java
@@ -46,13 +46,17 @@
 
 package at.gv.egovernment.moa.id.commons.utils.ssl;
 
+import java.io.File;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+
 import at.gv.egovernment.moa.logging.Logger;
 import iaik.pki.store.certstore.CertStoreConfiguration;
 import iaik.pki.store.certstore.CertStoreParameters;
 import iaik.pki.store.certstore.CertStoreTypes;
 import iaik.pki.store.certstore.directory.DirectoryCertStoreParameters;
-
-import java.io.File;
+import iaik.pki.store.certstore.directory.VirtualCertStore;
 
 /**
  * Implementation of interface needed to initialize an IAIK JSSE <code>TrustManager</code>
@@ -153,4 +157,16 @@ public class CertStoreConfigurationImpl extends ObservableImpl
         return CertStoreTypes.DIRECTORY;
     }
 
+	/* (non-Javadoc)
+	 * @see iaik.pki.store.certstore.directory.DirectoryCertStoreParameters#getVirtualStores()
+	 */
+	@Override
+	public Set getVirtualStores() {
+		//TODO: only for Testing and not complete !!!Ask Harald !!!!
+		
+		Map<String, VirtualCertStore> vCertStore = new HashMap<String, VirtualCertStore>();		
+		return vCertStore.keySet();
+		
+	}
+
 }
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/MOAIDTrustManager.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/MOAIDTrustManager.java
index eaef3f1d4..bcd38c638 100644
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/MOAIDTrustManager.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/MOAIDTrustManager.java
@@ -57,9 +57,8 @@ import java.util.ArrayList;
 import java.util.List;
 
 import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.logging.LoggingContext;
-import at.gv.egovernment.moa.logging.LoggingContextManager;
-
+import at.gv.egovernment.moaspss.logging.LoggingContext;
+import at.gv.egovernment.moaspss.logging.LoggingContextManager;
 import iaik.pki.jsse.IAIKX509TrustManager;
 
 /**
@@ -95,14 +94,14 @@ public class MOAIDTrustManager extends IAIKX509TrustManager {
    * Fixes a bug occuring in the case MOA-SP is called by API.
    * In this case, IAIKX509TrustManager uses the LogginConfig of MOA-SP.
    * This method must be called before a MOAIDTrustManager is constructed,
-   * from every thread.
-   */
+   * from every thread. 
+   */ 
   public static void initializeLoggingContext() {  
     if (LoggingContextManager.getInstance().getLoggingContext() == null)
     LoggingContextManager.getInstance().setLoggingContext(
       new LoggingContext(Thread.currentThread().getName()));
   }
-
+ 
   
   /**
    * Builds an Array of accepted server certificates from an URL,
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/PKIConfigurationImpl.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/PKIConfigurationImpl.java
index 5d8c7a54e..3eb4707c8 100644
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/PKIConfigurationImpl.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/PKIConfigurationImpl.java
@@ -60,6 +60,10 @@ import iaik.pki.store.revocation.archive.ArchiveConfiguration;
  * @version $Id$
  */
 public class PKIConfigurationImpl implements PKIConfiguration {
+	
+	private static final int TIMEOUT_READ = 60; //[sec]
+	private static final int TIMEOUT_CONNECTION = 60; //[sec]
+	
   /** The configuration for the CertStore */
   private CertStoreConfiguration certStoreConfiguration;
   /** The configuration for the RevocationChecks */
@@ -108,11 +112,19 @@ public class PKIConfigurationImpl implements PKIConfiguration {
   }
 
 /* (non-Javadoc)
- * @see iaik.pki.PKIConfiguration#getTimeout()
+ * @see iaik.pki.PKIConfiguration#getConnectTimeout()
  */
-  public int getTimeout() {
-	// TODO Auto-generated method stub
-	return 0;
+@Override
+public int getConnectTimeout() {
+	return TIMEOUT_CONNECTION * 1000;
+}
+
+/* (non-Javadoc)
+ * @see iaik.pki.PKIConfiguration#getReadTimeout()
+ */
+@Override
+public int getReadTimeout() {
+	return TIMEOUT_READ * 1000;
 }
 
 }
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/PKIProfileImpl.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/PKIProfileImpl.java
index 59994a257..a34fa9b8b 100644
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/PKIProfileImpl.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/PKIProfileImpl.java
@@ -96,13 +96,6 @@ public class PKIProfileImpl extends ObservableImpl
   }
 
   /**
-   * @see iaik.pki.PKIProfile#autoAddCertificates()
-   */
-  public boolean autoAddCertificates() {
-    return true;
-  }
-
-  /**
    * @see iaik.pki.PKIProfile#getRevocationProfile()
    */
   public RevocationProfile getRevocationProfile() {
@@ -227,4 +220,22 @@ public class PKIProfileImpl extends ObservableImpl
   public void setId(String id) {
     this.id = id;
   }
+
+/* (non-Javadoc)
+ * @see iaik.pki.PKIProfile#autoAddCertificates()
+ */
+@Override
+public int autoAddCertificates() {
+	//TODO: ask harald!!!!!
+	return 1;
+}
+
+/* (non-Javadoc)
+ * @see iaik.pki.PKIProfile#getIndirectRevocationTrustStoreProfile()
+ */
+@Override
+public TrustStoreProfile getIndirectRevocationTrustStoreProfile() {
+	//TODO: ask harald!!!!!
+	return null;
+}
 }
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/RevocationConfigurationImpl.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/RevocationConfigurationImpl.java
index b5e0543db..40d081ea4 100644
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/RevocationConfigurationImpl.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/RevocationConfigurationImpl.java
@@ -46,13 +46,16 @@
 
 package at.gv.egovernment.moa.id.commons.utils.ssl;
 
-import iaik.pki.revocation.RevocationConfiguration;
-
 import java.security.cert.X509Certificate;
 import java.util.Collections;
 import java.util.Date;
+import java.util.HashMap;
+import java.util.Map;
 import java.util.Set;
 
+import iaik.pki.revocation.RevocationConfiguration;
+import iaik.pki.revocation.dbcrl.config.DBCrlConfig;
+
 /**
  * Implementation of interface needed to initialize an IAIK JSSE <code>TrustManager</code>
  * @author Paul Ivancsics
@@ -81,4 +84,41 @@ public class RevocationConfigurationImpl extends ObservableImpl implements Revoc
      return null;
   }
 
+/* (non-Javadoc)
+ * @see iaik.pki.revocation.RevocationConfiguration#getKeepRevocationInfo()
+ */
+@Override
+public boolean getKeepRevocationInfo() {
+	return false;
+}
+
+/* (non-Javadoc)
+ * @see iaik.pki.revocation.RevocationConfiguration#getPositiveOCSPResponders()
+ */
+@Override
+public Set getPositiveOCSPResponders() {
+	
+	//TODO: !!!!! ASK Harald !!!!!
+	Map<String, String> test = new HashMap<String, String>();
+	test.put("ALL", "ALL");
+	return test.keySet();
+}
+
+/* (non-Javadoc)
+ * @see iaik.pki.revocation.RevocationConfiguration#skipIndirectCRLCheckForAlternativeDistributionPoints()
+ */
+@Override
+public boolean skipIndirectCRLCheckForAlternativeDistributionPoints() {
+	//TODO: !!!!! ASK Harald !!!!!
+	return false;
+}
+
+/* (non-Javadoc)
+ * @see iaik.pki.revocation.RevocationConfiguration#getDataBaseCRLConfig()
+ */
+@Override
+public DBCrlConfig getDataBaseCRLConfig() {
+	return null;
+}
+
 }
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/SSLUtils.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/SSLUtils.java
index 68437a04d..503e0bfc4 100644
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/SSLUtils.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/utils/ssl/SSLUtils.java
@@ -46,25 +46,28 @@
 
 package at.gv.egovernment.moa.id.commons.utils.ssl;
 
-import iaik.pki.PKIConfiguration;
-import iaik.pki.PKIException;
-import iaik.pki.PKIFactory;
-import iaik.pki.PKIProfile;
-import iaik.pki.jsse.IAIKX509TrustManager;
-import iaik.security.provider.IAIK;
-
 import java.io.IOException;
 import java.security.GeneralSecurityException;
+import java.security.KeyStore;
 import java.security.Security;
 import java.util.HashMap;
 import java.util.Map;
 
 import javax.net.ssl.KeyManager;
+import javax.net.ssl.KeyManagerFactory;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLSocketFactory;
 import javax.net.ssl.TrustManager;
 
 import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.KeyStoreUtils;
+import iaik.pki.PKIConfiguration;
+import iaik.pki.PKIException;
+import iaik.pki.PKIFactory;
+import iaik.pki.PKIProfile;
+import iaik.pki.jsse.IAIKX509TrustManager;
+//import iaik.pki.jsse.IAIKX509TrustManager;
+import iaik.security.provider.IAIK;
 
 
 /**
@@ -136,7 +139,7 @@ public class SSLUtils {
     		 acceptedServerCertURL,
     		 checkRevocation);
     
-    KeyManager[] kms = at.gv.egovernment.moa.util.SSLUtils.getKeyManagers(
+    KeyManager[] kms = getKeyManagers(
       clientKeyStoreType, clientKeyStoreURL, clientKeyStorePassword);
     SSLContext ctx = SSLContext.getInstance("TLS");
     ctx.init(kms, tms, null);    
@@ -154,6 +157,68 @@ public class SSLUtils {
   }
   
   /**
+   * Loads the client key store from file and gets the 
+   * <code>KeyManager</code>s from a default <code>KeyManagerFactory</code>,
+	 * initialized from the given client key store.
+   * @param clientKeyStoreType key store type of <code>clientKeyStore</code>
+   * @param clientKeyStoreURL URL of key store containing keys to be used for
+   * 				 client authentication; if <code>null</code>, the default key store will be utilized
+   * @param clientKeyStorePassword password used to check the integrity of the client key store; 
+   * 				 if <code>null</code>, it will not be checked
+	 * @return <code>KeyManager</code>s to be used for creating an 
+	 * 				  <code>SSLSocketFactory</code> utilizing the given client key store
+   * @throws IOException thrown while reading from the key store file
+   * @throws GeneralSecurityException thrown while initializing the 
+   * 					default <code>KeyManagerFactory</code>
+   */
+  public static KeyManager[] getKeyManagers (
+		String clientKeyStoreType,
+		String clientKeyStoreURL,
+  	String clientKeyStorePassword)
+	  throws IOException, GeneralSecurityException {
+  
+  	if (clientKeyStoreURL == null)
+  		return null;
+  		
+	  // Set up the KeyStore to use. We need to load the file into
+	  // a KeyStore instance.
+	  KeyStore clientKeyStore = KeyStoreUtils.loadKeyStore(
+	  	clientKeyStoreType, clientKeyStoreURL, clientKeyStorePassword);
+		return getKeyManagers(clientKeyStore, clientKeyStorePassword);
+	}  
+  /**
+   * Gets the <code>KeyManager</code>s from a default <code>KeyManagerFactory</code>,
+	 * initialized from the given client key store.
+   * @param clientKeyStore client key store
+   * @param clientKeyStorePassword if provided, it will be used to check 
+   * 				 the integrity of the client key store; if omitted, it will not be checked
+	 * @return <code>KeyManager</code>s to be used for creating an 
+	 * 				  <code>SSLSocketFactory</code> utilizing the given client key store
+   * @throws GeneralSecurityException thrown while initializing the 
+   * 					default <code>KeyManagerFactory</code>
+   */
+	public static KeyManager[] getKeyManagers (
+		KeyStore clientKeyStore,
+  	String clientKeyStorePassword)
+	  throws GeneralSecurityException {
+  
+  	if (clientKeyStore == null)
+  		return null;
+  		
+	  // Now we initialize the default KeyManagerFactory with this KeyStore
+	  String alg=KeyManagerFactory.getDefaultAlgorithm();
+	  KeyManagerFactory kmFact=KeyManagerFactory.getInstance(alg);
+  	char[] password = null;
+  	if (clientKeyStorePassword != null)
+  		password = clientKeyStorePassword.toCharArray();
+	  kmFact.init(clientKeyStore, password);
+	
+	  // And now get the KeyManagers
+	  KeyManager[] kms=kmFact.getKeyManagers();
+	  return kms;
+	}  
+  
+  /**
    * Initializes an <code>IAIKX509TrustManager</code> for a given trust store,
    * using configuration data.
    * 
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/logging/LogMsg.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/logging/LogMsg.java
deleted file mode 100644
index 51667f010..000000000
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/logging/LogMsg.java
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright 2003 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- */
-
-
-package at.gv.egovernment.moa.logging;
-
-/**
- * A unified message type to log messages from inside the MOA subsystem.
- * 
- * @author Patrick Peck
- * @version $Id$
- */
-public class LogMsg {
-  /** The message to log. */
-  private Object message;
-
-  /**
-   * Create a <code>LogMsg</code> object.
-   * 
-   * @param message The actual message to log. May be <code>null</code>. 
-   */
-  public LogMsg(Object message) {
-    this.message = message;
-  }
-
-  /**
-   * Convert this log message to a <code>String</code>.
-   * 
-   * @return The <code>String</code> representation of this log message. 
-   */
-  public String toString() {
-    StringBuffer msg = new StringBuffer();
-    LoggingContext ctx =
-      LoggingContextManager.getInstance().getLoggingContext();
-    String tid = ctx != null ? ctx.getTransactionID() : null;
-    String nodeId = ctx != null ? ctx.getNodeID() : null;
-    
-    msg.append("TID=");
-    msg.append(tid != null ? tid : "<null>");
-    msg.append(" NID=");
-    msg.append(nodeId != null ? nodeId : "<null>");
-    msg.append(" MSG=");
-    msg.append(message != null ? message.toString() : "<null>");
-
-    return msg.toString();
-  }
-}
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/logging/LoggingContextManager.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/logging/LoggingContextManager.java
deleted file mode 100644
index f0d7b4c07..000000000
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/logging/LoggingContextManager.java
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Copyright 2003 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- */
-
-
-package at.gv.egovernment.moa.logging;
-
-/**
- * Provides each thread with a single instance of <code>LoggingContext</code>.
- * 
- * @author Patrick Peck
- * @version $Id$
- */
-public class LoggingContextManager {
-  /** The single instance of this class. */
-  private static LoggingContextManager instance = null;
-  
-  /** The <code>LoggingContext</code> for each thread. */
-  private ThreadLocal context;
-  
-  /**
-   * Get the single instance of the <code>LoggingContextManager</code> class.
-   * 
-   * @return LoggingContextManager The single instance.
-   */
-  public static synchronized LoggingContextManager getInstance() {
-    if (instance == null) {
-      instance = new LoggingContextManager();
-    }
-    return instance;
-  }
-  
-  /**
-   * Creates a new <code>LoggingContextManager</code>.
-   * 
-   * Protected to disallow direct instantiation.
-   */
-  protected LoggingContextManager() {
-    context = new ThreadLocal();
-  }
-  
-  /**
-   * Set the <code>LoggingContext</code> context for the current thread.
-   * 
-   * @param ctx The <code>LoggingContext</code> for the current thread.
-   */
-  public void setLoggingContext(LoggingContext ctx) {
-    context.set(ctx);
-  }
-  
-  /**
-   * Return the <code>LoggingContext</code> for the current thread.
-   * 
-   * @return LoggingContext The <code>LoggingContext</code> for the current
-   * thread, or <code>null</code> if none has been set.
-   */
-  public LoggingContext getLoggingContext() {
-    return (LoggingContext) context.get();
-  }
-
-}
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/util/DOMUtils.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/util/DOMUtils.java
index 95cd63643..fed968443 100644
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/util/DOMUtils.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/util/DOMUtils.java
@@ -49,6 +49,7 @@ import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamResult;
 
+import org.apache.commons.io.IOUtils;
 import org.apache.xerces.parsers.DOMParser;
 import org.apache.xerces.parsers.SAXParser;
 import org.apache.xerces.parsers.XMLGrammarPreparser;
@@ -225,12 +226,13 @@ public class DOMUtils {
 		byte buffer [] = null;
 		ByteArrayInputStream baStream = null;
 		if(true == Logger.isDebugEnabled()) {
-			int len = inputStream.available();
-			buffer = new byte[len];
-			inputStream.read(buffer);
+			buffer = IOUtils.toByteArray(inputStream);
 			baStream = new ByteArrayInputStream(buffer);
-		}	
 			
+		}	
+		
+		
+		
     // create the DOM parser
     if (symbolTable != null) {
       parser = new DOMParser(symbolTable, grammarPool);
@@ -298,7 +300,7 @@ public class DOMUtils {
 	    else 
 			parser.parse(new InputSource(inputStream));
     } catch(SAXException e) {
-			if(true == Logger.isDebugEnabled() && null != buffer) {
+			if(true == Logger.isDebugEnabled() && null != buffer) {				
 				String xmlContent = new String(buffer);
 				Logger.debug("SAXException in:\n" + xmlContent);				 
 			} 
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/util/MOAEntityResolver.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/util/MOAEntityResolver.java
index 8f3ffd4c6..b1a3f8446 100644
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/util/MOAEntityResolver.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/util/MOAEntityResolver.java
@@ -31,7 +31,6 @@ import org.apache.xerces.util.URI.MalformedURIException;
 import org.xml.sax.EntityResolver;
 import org.xml.sax.InputSource;
 
-import at.gv.egovernment.moa.logging.LogMsg;
 import at.gv.egovernment.moa.logging.Logger;
 
 /**
@@ -72,7 +71,7 @@ public class MOAEntityResolver implements EntityResolver {
 
     if (Logger.isDebugEnabled()) {
       Logger.debug(
-        new LogMsg("resolveEntity: p=" + publicId + " s=" + systemId));
+        new at.gv.egovernment.moaspss.logging.LogMsg("resolveEntity: p=" + publicId + " s=" + systemId));
     }
 
     if (publicId != null) {
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/util/MOAErrorHandler.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/util/MOAErrorHandler.java
index 3769b264d..ea71a677f 100644
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/util/MOAErrorHandler.java
+++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/util/MOAErrorHandler.java
@@ -28,8 +28,8 @@ import org.apache.xml.utils.DefaultErrorHandler;
 import org.xml.sax.SAXException;
 import org.xml.sax.SAXParseException;
 
-import at.gv.egovernment.moa.logging.LogMsg;
 import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moaspss.logging.LogMsg;
 
 /**
  * An <code>ErrorHandler</code> that logs a message and throws a
diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/util/SSLUtils.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/util/SSLUtils.java
deleted file mode 100644
index c2c67ec58..000000000
--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/util/SSLUtils.java
+++ /dev/null
@@ -1,244 +0,0 @@
-/*
- * Copyright 2003 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- */
-
-
-package at.gv.egovernment.moa.util;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.security.GeneralSecurityException;
-import java.security.KeyStore;
-
-import javax.net.ssl.KeyManager;
-import javax.net.ssl.KeyManagerFactory;
-import javax.net.ssl.SSLContext;
-import javax.net.ssl.SSLSocketFactory;
-import javax.net.ssl.TrustManager;
-import javax.net.ssl.TrustManagerFactory;
-
-/**
- * Utility for connecting to server applications via SSL.
- * 
- * @author Paul Ivancsics
- * @version $Id$
- */
-public class SSLUtils {
-	
-	/**
-	 * Creates an <code>SSLSocketFactory</code> which utilizes the given trust store.
-	 * 
-   * @param trustStoreType key store type of trust store
-   * @param trustStoreInputStream input stream for reading JKS trust store containing
-   * 				 trusted server certificates; if <code>null</code>, the default
-   * 				 trust store will be utilized
-   * @param trustStorePassword if provided, it will be used to check 
-   * 				 the integrity of the trust store; if omitted, it will not be checked
-   * @return <code>SSLSocketFactory</code> to be used by an <code>HttpsURLConnection</code>
-   * @throws IOException thrown while reading from the input stream
-   * @throws GeneralSecurityException thrown while creating the socket factory
-	 */
-  public static SSLSocketFactory getSSLSocketFactory(
-  	String trustStoreType,
-  	InputStream trustStoreInputStream,
-  	String trustStorePassword)
- 	  throws IOException, GeneralSecurityException {
-  		
-	  TrustManager[] tms = getTrustManagers(trustStoreType, trustStoreInputStream, trustStorePassword);
-		SSLContext ctx = SSLContext.getInstance("TLS");
-		ctx.init(null, tms, null);
-
-    SSLSocketFactory sf = ctx.getSocketFactory();
-  	return sf;
-  }
-	/**
-	 * Creates an <code>SSLSocketFactory</code> which utilizes the
-	 * given trust store and keystore.
-	 * 
-   * @param trustStore trust store containing trusted server certificates; 
-   * 				 if <code>null</code>, the default trust store will be utilized
-   * @param clientKeyStoreType key store type of <code>clientKeyStore</code>
-   * @param clientKeyStoreURL URL of key store containing keys to be used for
-   * 				 client authentication; if <code>null</code>, the default key store will be utilized
-   * @param clientKeyStorePassword if provided, it will be used to check 
-   * 				 the integrity of the client key store; if omitted, it will not be checked
-   * @return <code>SSLSocketFactory</code> to be used by an <code>HttpsURLConnection</code>
-   * @throws IOException thrown while reading key store file
-   * @throws GeneralSecurityException thrown while creating the socket factory
-	 */
-  public static SSLSocketFactory getSSLSocketFactory(
-  	KeyStore trustStore,
-  	String clientKeyStoreType,
-  	String clientKeyStoreURL,
-  	String clientKeyStorePassword)
- 	  throws IOException, GeneralSecurityException {
-  		
-		SSLContext ctx = getSSLContext(
-			trustStore, clientKeyStoreType, clientKeyStoreURL, clientKeyStorePassword);
-    SSLSocketFactory sf = ctx.getSocketFactory();
-  	return sf;
-  }
-	/**
-	 * Creates an <code>SSLContext</code> initialized for the
-	 * given trust store and keystore.
-	 * 
-   * @param trustStore trust store containing trusted server certificates; 
-   * 				 if <code>null</code>, the default trust store will be utilized
-   * @param clientKeyStoreType key store type of <code>clientKeyStore</code>
-   * @param clientKeyStoreURL URL of key store containing keys to be used for
-   * 				 client authentication; if <code>null</code>, the default key store will be utilized
-   * @param clientKeyStorePassword if provided, it will be used to check 
-   * 				 the integrity of the client key store; if omitted, it will not be checked
-   * @return <code>SSLContext</code> to be used for creating an <code>SSLSocketFactory</code>
-   * @throws IOException thrown while reading key store file
-   * @throws GeneralSecurityException thrown while creating the SSL context
-	 */
-  public static SSLContext getSSLContext(
-  	KeyStore trustStore,
-  	String clientKeyStoreType,
-  	String clientKeyStoreURL,
-  	String clientKeyStorePassword)
- 	  throws IOException, GeneralSecurityException {
-  		
- 	  TrustManager[] tms = getTrustManagers(trustStore);
-		KeyManager[] kms = getKeyManagers(clientKeyStoreType, clientKeyStoreURL, clientKeyStorePassword);
-		SSLContext ctx = SSLContext.getInstance("TLS");
-		ctx.init(kms, tms, null);
-		return ctx;
-  }
-  /**
-   * Loads the trust store from an input stream and gets the 
-   * <code>TrustManager</code>s from a default <code>TrustManagerFactory</code>,
-	 * initialized from the given trust store.
-   * @param trustStoreType key store type of trust store
-   * @param trustStoreInputStream input stream for reading JKS trust store containing
-   * 				 trusted server certificates; if <code>null</code>, the default
-   * 				 trust store will be utilized
-   * @param trustStorePassword if provided, it will be used to check 
-   * 				 the integrity of the trust store; if omitted, it will not be checked
-	 * @return <code>TrustManager</code>s to be used for creating an 
-	 * 				  <code>SSLSocketFactory</code> utilizing the given trust store
-   * @throws IOException thrown while reading from the input stream
-   * @throws GeneralSecurityException thrown while initializing the 
-   * 					default <code>TrustManagerFactory</code>
-   */
-	protected static TrustManager[] getTrustManagers(
-		String trustStoreType,
-		InputStream trustStoreInputStream,
-  	String trustStorePassword)
-	  throws IOException, GeneralSecurityException {
-	  	
-	  if (trustStoreInputStream == null)
-	  	return null;
-
-	  // Set up the TrustStore to use. We need to load the file into
-	  // a KeyStore instance.
-		KeyStore trustStore = KeyStoreUtils.loadKeyStore(trustStoreType, trustStoreInputStream, trustStorePassword);
-		return getTrustManagers(trustStore);
-	}
-	/**
-	 * Gets the <code>TrustManager</code>s from a default <code>TrustManagerFactory</code>,
-	 * initialized from the given trust store.
-	 * 
-	 * @param trustStore the trust store to use
-	 * @return <code>TrustManager</code>s to be used for creating an 
-	 * 				  <code>SSLSocketFactory</code> utilizing the given trust store
-   * @throws GeneralSecurityException thrown while initializing the 
-   * 					default <code>TrustManagerFactory</code>
-	 */
-	protected static TrustManager[] getTrustManagers(KeyStore trustStore)
-	  throws GeneralSecurityException {
-	  	
-	  if (trustStore == null)
-	  	return null;
-
-	  // Initialize the default TrustManagerFactory with this KeyStore
-	  String alg=TrustManagerFactory.getDefaultAlgorithm();
-	  TrustManagerFactory tmFact=TrustManagerFactory.getInstance(alg);
-	  tmFact.init(trustStore);
-	
-	  // And now get the TrustManagers
-	  TrustManager[] tms=tmFact.getTrustManagers();
-	  return tms;
-	}
-  /**
-   * Loads the client key store from file and gets the 
-   * <code>KeyManager</code>s from a default <code>KeyManagerFactory</code>,
-	 * initialized from the given client key store.
-   * @param clientKeyStoreType key store type of <code>clientKeyStore</code>
-   * @param clientKeyStoreURL URL of key store containing keys to be used for
-   * 				 client authentication; if <code>null</code>, the default key store will be utilized
-   * @param clientKeyStorePassword password used to check the integrity of the client key store; 
-   * 				 if <code>null</code>, it will not be checked
-	 * @return <code>KeyManager</code>s to be used for creating an 
-	 * 				  <code>SSLSocketFactory</code> utilizing the given client key store
-   * @throws IOException thrown while reading from the key store file
-   * @throws GeneralSecurityException thrown while initializing the 
-   * 					default <code>KeyManagerFactory</code>
-   */
-  public static KeyManager[] getKeyManagers (
-		String clientKeyStoreType,
-		String clientKeyStoreURL,
-  	String clientKeyStorePassword)
-	  throws IOException, GeneralSecurityException {
-  
-  	if (clientKeyStoreURL == null)
-  		return null;
-  		
-	  // Set up the KeyStore to use. We need to load the file into
-	  // a KeyStore instance.
-	  KeyStore clientKeyStore = KeyStoreUtils.loadKeyStore(
-	  	clientKeyStoreType, clientKeyStoreURL, clientKeyStorePassword);
-		return getKeyManagers(clientKeyStore, clientKeyStorePassword);
-	}  
-  /**
-   * Gets the <code>KeyManager</code>s from a default <code>KeyManagerFactory</code>,
-	 * initialized from the given client key store.
-   * @param clientKeyStore client key store
-   * @param clientKeyStorePassword if provided, it will be used to check 
-   * 				 the integrity of the client key store; if omitted, it will not be checked
-	 * @return <code>KeyManager</code>s to be used for creating an 
-	 * 				  <code>SSLSocketFactory</code> utilizing the given client key store
-   * @throws GeneralSecurityException thrown while initializing the 
-   * 					default <code>KeyManagerFactory</code>
-   */
-	public static KeyManager[] getKeyManagers (
-		KeyStore clientKeyStore,
-  	String clientKeyStorePassword)
-	  throws GeneralSecurityException {
-  
-  	if (clientKeyStore == null)
-  		return null;
-  		
-	  // Now we initialize the default KeyManagerFactory with this KeyStore
-	  String alg=KeyManagerFactory.getDefaultAlgorithm();
-	  KeyManagerFactory kmFact=KeyManagerFactory.getInstance(alg);
-  	char[] password = null;
-  	if (clientKeyStorePassword != null)
-  		password = clientKeyStorePassword.toCharArray();
-	  kmFact.init(clientKeyStore, password);
-	
-	  // And now get the KeyManagers
-	  KeyManager[] kms=kmFact.getKeyManagers();
-	  return kms;
-	}  
-}
diff --git a/id/server/moa-id-commons/src/test/java/test/at/gv/egovernment/moa/AllTests.java b/id/server/moa-id-commons/src/test/java/test/at/gv/egovernment/moa/AllTests.java
index c0a93bf03..df4fe807f 100644
--- a/id/server/moa-id-commons/src/test/java/test/at/gv/egovernment/moa/AllTests.java
+++ b/id/server/moa-id-commons/src/test/java/test/at/gv/egovernment/moa/AllTests.java
@@ -34,7 +34,7 @@ import junit.framework.TestSuite;
  */
 public class AllTests {
 
-  public static Test suite() {
+  public static Test suite() { 
     TestSuite suite = new TestSuite();
     
 //    suite.addTestSuite(DOMUtilsTest.class);
diff --git a/id/server/moa-id-commons/src/test/java/test/at/gv/egovernment/moa/util/SSLUtilsTest.java b/id/server/moa-id-commons/src/test/java/test/at/gv/egovernment/moa/util/SSLUtilsTest.java
deleted file mode 100644
index 2b5094fb8..000000000
--- a/id/server/moa-id-commons/src/test/java/test/at/gv/egovernment/moa/util/SSLUtilsTest.java
+++ /dev/null
@@ -1,181 +0,0 @@
-/*
- * Copyright 2003 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- *
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- *
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- */
-
-
-package test.at.gv.egovernment.moa.util;
-
-import java.net.URL;
-import java.security.KeyStore;
-import java.security.Security;
-
-import javax.net.ssl.SSLException;
-import javax.net.ssl.SSLSocketFactory;
-
-import junit.framework.TestCase;
-import at.gv.egovernment.moa.util.KeyStoreUtils;
-import at.gv.egovernment.moa.util.SSLUtils;
-
-import com.sun.net.ssl.HostnameVerifier;
-import com.sun.net.ssl.HttpsURLConnection;
-
-/**
- * @author Paul Ivancsics
- * @version $Id$
- */
-public class SSLUtilsTest extends TestCase {
-
-  public SSLUtilsTest(String arg0) {
-    super(arg0);
-  }
-
-	
-  protected void setUp() throws Exception {
-    //System.setProperty("javax.net.debug", "all");
-    Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
-    System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");
-    System.setProperty("https.cipherSuites", "SSL_DHE_DSS_WITH_DES_CBC_SHA,SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA,SSL_RSA_WITH_DES_CBC_SHA,SSL_RSA_WITH_3DES_EDE_CBC_SHA,SSL_RSA_EXPORT_WITH_RC4_40_MD5");
-  }
-
-	public void testGetSSLSocketFactoryBaltimoreOK() throws Exception {
-		doTestGetSSLSocketFactory(
-			"GET",
-			"https://www.baltimore.com/",
-			false,
-			"file:data/test/security/cacerts+gt_cybertrust_root",
-			"changeit",
-			true);
-	}
-	public void testGetSSLSocketFactoryBaltimoreNOK() throws Exception {
-		doTestGetSSLSocketFactory(
-			"GET",
-			"https://www.baltimore.com/",
-			false,
-			"file:data/test/security/cacerts",
-			"changeit", 
-			false);
-	}
-	public void testGetSSLSocketFactoryVerisignOK() throws Exception {
-		doTestGetSSLSocketFactory(
-			"GET",
-			"https://www.verisign.com/",
-			false,
-			"file:data/test/security/cacerts",
-			"changeit",
-			true);
-	}
-	public void testGetSSLSocketFactoryVerisignNoTruststoreOK() throws Exception {
-		doTestGetSSLSocketFactory(
-			"GET",
-			"https://www.verisign.com/",
-			false,
-			null,
-			null,
-			true);
-	}
-	public void testGetSSLSocketFactoryLocalhostOK() throws Exception {
-		String urlString = "https://localhost:8443/moa-id-auth/index.jsp";
-		doTestGetSSLSocketFactory(
-			"GET",
-			urlString,
-			true,
-			"file:data/test/security/server.keystore.tomcat",
-			"changeit",
-			true);
-	}
-	public void testGetSSLSocketFactoryLocalhostNOK() throws Exception {
-		String urlString = "https://localhost:8443/moa-id-auth/index.jsp";
-		doTestGetSSLSocketFactory(
-			"GET",
-			urlString,
-			true,
-			null,
-			null,
-			false);
-	}
-		
-	public void doTestGetSSLSocketFactory(
-		String requestMethod,
-		String urlString, 
-		boolean useHostnameVerifierHack,
-		String truststoreurl,
-		String trustpassword,
-		boolean shouldOk
-		) throws Exception {
-
-		doTestGetSSLSocketFactory(
-			requestMethod, urlString, useHostnameVerifierHack, truststoreurl, trustpassword, null, null, null, shouldOk);
-		}
-	public void doTestGetSSLSocketFactory(
-		String requestMethod,
-		String urlString, 
-		boolean useHostnameVerifierHack,
-		String truststoreurl,
-		String trustpassword,
-		String keystoretype,
-		String keystoreurl,
-		String keypassword,
-		boolean shouldOk
-		) throws Exception {
-
-		KeyStore truststore = null;
-		if (truststoreurl != null)
-			truststore = KeyStoreUtils.loadKeyStore("jks", truststoreurl, trustpassword);
-		SSLSocketFactory sf = SSLUtils.getSSLSocketFactory(
-			truststore, keystoretype, keystoreurl, keypassword);
-		System.out.println(requestMethod + " " + urlString);
-
-		URL url = new URL(urlString);
-		HttpsURLConnection conn = (HttpsURLConnection)url.openConnection();
-		conn.setRequestMethod(requestMethod);
-		conn.setDoInput(true);
-		conn.setDoOutput(true);
-		conn.setUseCaches(false);
-		conn.setAllowUserInteraction(false);		
-  	conn.setSSLSocketFactory(sf);
-  	if (useHostnameVerifierHack)
-  		conn.setHostnameVerifier(new HostnameVerifierHack());
-  	try {
-			conn.connect();
-			assertTrue(shouldOk);
-			assertEquals(200, conn.getResponseCode());
-			conn.disconnect();
-  	}
-  	catch (SSLException ex) {
-  		assertFalse(shouldOk);
-  	}
-	}
-//	private byte[] readTruststore(String filename) throws IOException {
-//		if (filename == null)
-//			return null;
-//		FileInputStream in = new FileInputStream(filename);
-//		byte[] buffer = new byte[in.available()];
-//		in.read(buffer);
-//		in.close();
-//		return buffer;
-//	}
-  private class HostnameVerifierHack implements HostnameVerifier {
-    public boolean verify(String arg0, String arg1) {
-      return true;
-    }
-	}
-}
diff --git a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/GUIFormBuilderImpl.java b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/GUIFormBuilderImpl.java
index 94fa4d977..26b37226d 100644
--- a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/GUIFormBuilderImpl.java
+++ b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/GUIFormBuilderImpl.java
@@ -54,7 +54,7 @@ import at.gv.egovernment.moa.util.MiscUtil;
 @Service("guiFormBuilder")
 public class GUIFormBuilderImpl implements IGUIFormBuilder {
 	
-	private static final String DEFAULT_CONTENT_TYPE = "text/html;charset=UTF-8";
+	private static final String DEFAULT_CONTENT_TYPE = "text/html; charset=UTF-8";
 	private static final String CONFIG_HTMLTEMPLATES_DIR = "htmlTemplates/";
 	private static final String CLASSPATH_HTMLTEMPLATES_DIR = "templates/";
 			
diff --git a/id/server/moa-id-frontend-resources/src/main/resources/templates/loginFormFull.html b/id/server/moa-id-frontend-resources/src/main/resources/templates/loginFormFull.html
index 6c70b57b3..32f0a7d4d 100644
--- a/id/server/moa-id-frontend-resources/src/main/resources/templates/loginFormFull.html
+++ b/id/server/moa-id-frontend-resources/src/main/resources/templates/loginFormFull.html
@@ -22,7 +22,7 @@
 						<h2 id="tabheader" class="dunkel" role="heading">$HEADER_TEXT</h2>
 					</div>
 					<div id="bkulogin" class="hell" role="form">
-						<div id="mandateLogin" style="">
+						<div id="mandateLogin" style="$MANDATEVISIBLE">
 							<div>
 								<input tabindex="1" type="checkbox" name="Mandate"
 									id="mandateCheckBox" class="verticalcenter" role="checkbox"
diff --git a/id/server/moa-id-frontend-resources/src/main/resources/templates/sendAssertionFormFull.html b/id/server/moa-id-frontend-resources/src/main/resources/templates/sendAssertionFormFull.html
index a9f0c4238..7ae4b3f92 100644
--- a/id/server/moa-id-frontend-resources/src/main/resources/templates/sendAssertionFormFull.html
+++ b/id/server/moa-id-frontend-resources/src/main/resources/templates/sendAssertionFormFull.html
@@ -3,7 +3,7 @@
 <head>
 	<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
     <!-- MOA-ID 2.x BKUSelection Layout CSS -->               
-    <link rel="stylesheet" href="$contextPath/css/buildCSS?pendingid=#ID#" />
+    <link rel="stylesheet" href="$contextPath/css/buildCSS?pendingid=$pendingReqID" />
     
     <title>Anmeldung an Online-Applikation</title>   
 </head>
diff --git a/id/server/moa-id-spring-initializer/src/main/java/at/gv/egovernment/moa/id/auth/MOAContextCloseHandler.java b/id/server/moa-id-spring-initializer/src/main/java/at/gv/egovernment/moa/id/auth/MOAContextCloseHandler.java
new file mode 100644
index 000000000..f99013082
--- /dev/null
+++ b/id/server/moa-id-spring-initializer/src/main/java/at/gv/egovernment/moa/id/auth/MOAContextCloseHandler.java
@@ -0,0 +1,166 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth;
+
+import java.util.Iterator;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.concurrent.TimeUnit;
+
+import org.springframework.beans.BeansException;
+import org.springframework.beans.factory.config.BeanPostProcessor;
+import org.springframework.context.ApplicationContext;
+import org.springframework.context.ApplicationContextAware;
+import org.springframework.context.ApplicationListener;
+import org.springframework.context.event.ContextClosedEvent;
+import org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor;
+import org.springframework.scheduling.concurrent.ThreadPoolTaskScheduler;
+import org.springframework.stereotype.Component;
+
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ */
+@Component
+public class MOAContextCloseHandler implements ApplicationListener<ContextClosedEvent>, ApplicationContextAware, BeanPostProcessor {
+
+	private ApplicationContext context;
+	
+	/* (non-Javadoc)
+	 * @see org.springframework.context.ApplicationListener#onApplicationEvent(org.springframework.context.ApplicationEvent)
+	 */
+	@Override
+	public void onApplicationEvent(ContextClosedEvent arg0) {
+		Logger.info("MOA-ID-Auth shutdown process started ...");		
+		
+		try {			
+			Logger.debug("CleanUp objects with implements the IDestroyable interface ... ");
+			Map<String, IDestroyableObject> objectsToDestroy = context.getBeansOfType(IDestroyableObject.class);
+			if (objectsToDestroy != null) {
+				Iterator<Entry<String, IDestroyableObject>> interator = 
+						objectsToDestroy.entrySet().iterator();				
+				while (interator.hasNext()) {
+					Entry<String, IDestroyableObject> object = interator.next();
+					try {
+						object.getValue().fullyDestroy();
+						Logger.debug("Object with ID:" + object.getKey() + " is destroyed");
+						
+					} catch (Exception e) {
+						Logger.warn("Destroing object with ID:" + object.getKey() + " FAILED!", e);
+						
+					}										
+				}				
+			}						
+			Logger.info("Object cleanUp complete");
+					
+			Logger.debug("Stopping Spring Thread-Pools ... ");		
+			//shut-down task schedulers
+			Map<String, ThreadPoolTaskScheduler> schedulers = context.getBeansOfType(ThreadPoolTaskScheduler.class);
+		    for (ThreadPoolTaskScheduler scheduler : schedulers.values()) {         
+		        scheduler.getScheduledExecutor().shutdown();
+		        try {
+		            scheduler.getScheduledExecutor().awaitTermination(20000, TimeUnit.MILLISECONDS);
+		            if(scheduler.getScheduledExecutor().isTerminated() || scheduler.getScheduledExecutor().isShutdown())
+		                Logger.debug("Scheduler "+scheduler.getThreadNamePrefix() + " has stoped");
+		            else{
+		            	Logger.debug("Scheduler "+scheduler.getThreadNamePrefix() + " has not stoped normally and will be shut down immediately");
+		                scheduler.getScheduledExecutor().shutdownNow();
+		                Logger.info("Scheduler "+scheduler.getThreadNamePrefix() + " has shut down immediately");
+		            }
+		        } catch (IllegalStateException e) {
+		            e.printStackTrace();
+		        } catch (InterruptedException e) {
+		            e.printStackTrace();
+		            
+		        } finally {
+					scheduler.shutdown();
+		        	
+				}
+		    }
+			
+		  //shut-down task executors
+		    Map<String, ThreadPoolTaskExecutor> executers = context.getBeansOfType(ThreadPoolTaskExecutor.class);
+		    for (ThreadPoolTaskExecutor executor: executers.values()) {
+		        int retryCount = 0;
+		        while(executor.getActiveCount()>0 && ++retryCount<51){
+		            try {
+		            	Logger.debug("Executer "+executor.getThreadNamePrefix()+" is still working with active " + executor.getActiveCount()+" work. Retry count is "+retryCount);
+		                Thread.sleep(1000);
+		            } catch (InterruptedException e) {
+		                e.printStackTrace();
+		            }
+		        }
+		        if(!(retryCount<51))
+		        	Logger.debug("Executer "+executor.getThreadNamePrefix()+" is still working.Since Retry count exceeded max value "+retryCount+", will be killed immediately");
+		        executor.shutdown();
+		        Logger.debug("Executer "+executor.getThreadNamePrefix()+" with active " + executor.getActiveCount()+" work has killed");
+		    }
+			
+			Logger.debug("Spring Thread-Pools stopped");
+			
+			Logger.info("MOA-ID-Auth shutdown process finished");
+			
+		} catch (Exception e) {
+			Logger.warn("MOA-ID-Auth shutdown process has an error.", e);
+			
+		}
+		
+		//System.exit(0);
+		//Thread.currentThread().interrupt();		
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see org.springframework.beans.factory.config.BeanPostProcessor#postProcessAfterInitialization(java.lang.Object, java.lang.String)
+	 */
+	@Override
+	public Object postProcessAfterInitialization(Object arg0, String arg1) throws BeansException {
+		if(arg0 instanceof ThreadPoolTaskScheduler)
+	        ((ThreadPoolTaskScheduler)arg0).setWaitForTasksToCompleteOnShutdown(true);
+	    if(arg0 instanceof ThreadPoolTaskExecutor)
+	        ((ThreadPoolTaskExecutor)arg0).setWaitForTasksToCompleteOnShutdown(true);
+	    return arg0;
+	    
+	}
+
+	/* (non-Javadoc)
+	 * @see org.springframework.beans.factory.config.BeanPostProcessor#postProcessBeforeInitialization(java.lang.Object, java.lang.String)
+	 */
+	@Override
+	public Object postProcessBeforeInitialization(Object arg0, String arg1) throws BeansException {
+		return arg0;
+		
+	}
+
+	/* (non-Javadoc)
+	 * @see org.springframework.context.ApplicationContextAware#setApplicationContext(org.springframework.context.ApplicationContext)
+	 */
+	@Override
+	public void setApplicationContext(ApplicationContext arg0) throws BeansException {
+		this.context = arg0;
+		
+	}
+
+}
diff --git a/id/server/moa-id-spring-initializer/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthSpringInitializer.java b/id/server/moa-id-spring-initializer/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthSpringInitializer.java
index 51670281d..3a53d081d 100644
--- a/id/server/moa-id-spring-initializer/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthSpringInitializer.java
+++ b/id/server/moa-id-spring-initializer/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthSpringInitializer.java
@@ -119,9 +119,7 @@ public class MOAIDAuthSpringInitializer implements WebApplicationInitializer {
 							MOAIDAuthSpringInitializer.class));
 				}
 			}
-			
-			
-			
+						
 			Logger.debug("Refreshing context "+ rootContext);
 			rootContext.refresh();
 
@@ -129,8 +127,7 @@ public class MOAIDAuthSpringInitializer implements WebApplicationInitializer {
 
 			Logger.trace("Final Beans in "+ rootContext);
 			dumpBeanDefinitions(rootContext);
-			
-			
+											
 			Logger.info("Registering dispatcher configuration");
 			ServletRegistration.Dynamic dispatcher = servletContext.addServlet(
 					"dispatcher", new DispatcherServlet(rootContext));
@@ -144,7 +141,11 @@ public class MOAIDAuthSpringInitializer implements WebApplicationInitializer {
 			
 			Logger.info("=============== Register RequestContextListener! ===============");
 			servletContext.addListener(new RequestContextListener());
-
+			
+//			Logger.info("=============== Register RequestFilter! ===============");
+//			servletContext.addFilter("vHost RequestFilter", new VHostUrlRewriteServletFilter(rootContext))
+//				.addMappingForUrlPatterns(null, false, "/*");
+						
 			Logger.info("Basic Context initalisation finished --> Start MOA-ID-Auth initialisation process ...");
 			MOAIDAuthInitializer.initialize(rootContext);
 			Logger.info(MOAIDMessageProvider.getInstance().getMessage(
diff --git a/id/server/moa-id-spring-initializer/src/main/resources/applicationContext.xml b/id/server/moa-id-spring-initializer/src/main/resources/applicationContext.xml
index ae38c836e..2c53d55b9 100644
--- a/id/server/moa-id-spring-initializer/src/main/resources/applicationContext.xml
+++ b/id/server/moa-id-spring-initializer/src/main/resources/applicationContext.xml
@@ -27,5 +27,8 @@
   	<bean class="at.gv.egovernment.moa.id.auth.servlet.interceptor.UniqueSessionIdentifierInterceptor" />
   </mvc:interceptors> 
 
+	<bean id="MOAIDContextCloseHandler" 
+	      class="at.gv.egovernment.moa.id.auth.MOAContextCloseHandler"/>
+	
 	
 </beans>
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/pom.xml b/id/server/modules/moa-id-modul-citizencard_authentication/pom.xml
index f2403a62e..e5b38f9b6 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/pom.xml
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/pom.xml
@@ -23,6 +23,13 @@
   	</dependency>
   	
   	<dependency>
+			<groupId>iaik.prod</groupId>
+			<artifactId>iaik_ixsil</artifactId>
+			<version>1.2.2.5</version>
+			<scope>test</scope>
+		</dependency> 
+  	
+  	<dependency>
 			<groupId>MOA.id.server</groupId>
 			<artifactId>moa-id-commons</artifactId>
 			<type>test-jar</type>
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
index 7122c6577..90ed1c886 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
@@ -65,7 +65,6 @@ import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.data.MISMandate;
 import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
 import at.gv.egovernment.moa.id.util.XMLUtil;
-import at.gv.egovernment.moa.logging.LogMsg;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.Constants;
 import at.gv.egovernment.moa.util.DOMUtils;
@@ -73,6 +72,7 @@ import at.gv.egovernment.moa.util.DateTimeUtils;
 import at.gv.egovernment.moa.util.FileUtils;
 import at.gv.egovernment.moa.util.MiscUtil;
 import at.gv.egovernment.moa.util.StringUtils;
+import at.gv.egovernment.moaspss.logging.LogMsg;
 import iaik.asn1.ObjectID;
 import iaik.x509.X509Certificate;
 import iaik.x509.X509ExtensionInitException;
@@ -167,12 +167,14 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 		}
 
 		String infoboxReadRequest = "";
-		if (pendingReq.needSingleSignOnFunctionality()) {
-			Logger.info("SSO Login requested");
+		String ssoDomainIdentifier = authConfig.getSSOTagetIdentifier();
+		if (MiscUtil.isNotEmpty(ssoDomainIdentifier) && 
+				pendingReq.needSingleSignOnFunctionality()) {
+			Logger.debug("SSO Login requested");
 			//load identityLink with SSO Target
 			boolean isbuisness = false;
-			String domainIdentifier = authConfig.getSSOTagetIdentifier().trim();
-			if (domainIdentifier.startsWith(PREFIX_WPBK)) {
+			
+			if (ssoDomainIdentifier.startsWith(PREFIX_WPBK)) {
 				isbuisness = true;
 
 			} else {
@@ -182,10 +184,10 @@ public class AuthenticationServer extends BaseAuthenticationServer {
 
 			//build ReadInfobox request
 			infoboxReadRequest = new InfoboxReadRequestBuilder().build(
-					isbuisness, domainIdentifier);
+					isbuisness, ssoDomainIdentifier);
 
 		} else {
-			Logger.info("Non-SSO Login requested");
+			Logger.debug("Non-SSO Login requested or SSO not allowed/possible");
 			//build ReadInfobox request
 			infoboxReadRequest = new InfoboxReadRequestBuilder().build(
 					oaParam.getBusinessService(), oaParam
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetIdentityLinkFormBuilder.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetIdentityLinkFormBuilder.java
index 18495381e..ef81af94b 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetIdentityLinkFormBuilder.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/builder/GetIdentityLinkFormBuilder.java
@@ -174,7 +174,7 @@ public class GetIdentityLinkFormBuilder extends Builder {
 		htmlForm = replaceTag(htmlForm, COLOR_TAG, FormBuildUtils.getDefaultMap().get(FormBuildUtils.PARAM_MAIN_BACKGROUNDCOLOR), false, ALL);
     	
    	//set redirect target
-   	if (oaParam != null && MiscUtil.isNotEmpty(oaParam.getConfigurationValue(oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_AUTH_TEMPLATES_CUSTOMIZATION_APPLETREDIRECTTARGET))))
+   	if (oaParam != null && MiscUtil.isNotEmpty(oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_AUTH_TEMPLATES_CUSTOMIZATION_APPLETREDIRECTTARGET)))
    		htmlForm = replaceTag(htmlForm, REDIRECTTARGETTAG, 
    				oaParam.getConfigurationValue(MOAIDConfigurationConstants.SERVICE_AUTH_TEMPLATES_CUSTOMIZATION_APPLETREDIRECTTARGET), false, ALL);
    	else
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateIdentityLinkFormTask.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateIdentityLinkFormTask.java
index e82aa8fbb..e47aff83b 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateIdentityLinkFormTask.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateIdentityLinkFormTask.java
@@ -10,6 +10,8 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.stereotype.Component;
 
+import com.google.common.net.MediaType;
+
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
 import at.gv.egovernment.moa.id.advancedlogging.TransactionIDUtils;
 import at.gv.egovernment.moa.id.auth.AuthenticationServer;
@@ -75,9 +77,9 @@ public class CreateIdentityLinkFormTask extends AbstractAuthServletTask {
 						pendingReq, MOAIDEventConstants.AUTHPROCESS_MANDATES_REQUESTED);			
 				revisionsLogger.logEvent(pendingReq.getOnlineApplicationConfiguration(), 
 					pendingReq, MOAIDEventConstants.AUTHPROCESS_BKU_URL, moasession.getBkuURL());
-			
+				     				
 			if (!StringUtils.isEmpty(getIdentityLinkForm)) {
-				resp.setContentType("text/html;charset=UTF-8");
+				resp.setContentType(MediaType.HTML_UTF_8.toString());
 				PrintWriter out = new PrintWriter(resp.getOutputStream());
 				out.print(getIdentityLinkForm);
 				out.flush();
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/validator/VerifyXMLSignatureResponseValidator.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/validator/VerifyXMLSignatureResponseValidator.java
index df101f5b7..4e591ada2 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/validator/VerifyXMLSignatureResponseValidator.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/validator/VerifyXMLSignatureResponseValidator.java
@@ -46,13 +46,6 @@
 
 package at.gv.egovernment.moa.id.auth.validator;
 
-import iaik.asn1.ObjectID;
-import iaik.asn1.structures.Name;
-import iaik.security.ecc.ecdsa.ECPublicKey;
-import iaik.utils.RFC2253NameParserException;
-import iaik.x509.X509Certificate;
-import iaik.x509.X509ExtensionInitException;
-
 import java.security.InvalidKeyException;
 import java.security.PublicKey;
 import java.security.interfaces.RSAPublicKey;
@@ -70,6 +63,11 @@ import at.gv.egovernment.moa.id.commons.api.exceptions.ConfigurationException;
 import at.gv.egovernment.moa.id.commons.utils.MOAIDMessageProvider;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
 import at.gv.egovernment.moa.logging.Logger;
+import iaik.asn1.structures.Name;
+import iaik.security.ec.common.ECPublicKey;
+import iaik.utils.RFC2253NameParserException;
+import iaik.x509.X509Certificate;
+import iaik.x509.X509ExtensionInitException;
 
 /**
  * This class is used to validate an {@link VerifyXMLSignatureResponse} 
@@ -268,9 +266,9 @@ public class VerifyXMLSignatureResponseValidator {
       
       //compare ECDSAPublicKeys
       if( ( (idl.getPublicKey()[i] instanceof java.security.interfaces.ECPublicKey) || 
-    		  (idl.getPublicKey()[i] instanceof iaik.security.ecc.ecdsa.ECPublicKey)) && 
+    		  (idl.getPublicKey()[i] instanceof ECPublicKey)) && 
          ( (pubKeySignature instanceof java.security.interfaces.ECPublicKey) || 
-        		(pubKeySignature instanceof iaik.security.ecc.ecdsa.ECPublicKey) ) ) {
+        		(pubKeySignature instanceof ECPublicKey) ) ) {
 
 		try {
 			ECPublicKey ecdsaPubKeySignature = new ECPublicKey(pubKeySignature.getEncoded());
diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/util/CitizenCardServletUtils.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/util/CitizenCardServletUtils.java
index 2a8d26566..9fbdf5cd7 100644
--- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/util/CitizenCardServletUtils.java
+++ b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/util/CitizenCardServletUtils.java
@@ -55,6 +55,8 @@ import java.net.URLEncoder;
 
 import javax.servlet.http.HttpServletResponse;
 
+import com.google.common.net.MediaType;
+
 import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;
 import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
 import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
@@ -91,7 +93,7 @@ public class CitizenCardServletUtils extends ServletUtils{
       resp.addHeader("Location", dataURL);
       
       //TODO test impact of explicit setting charset with older versions of BKUs (HotSign)
-      resp.setContentType("text/xml;charset=UTF-8");
+      resp.setContentType(MediaType.XML_UTF_8.toString());
       
       OutputStream out = resp.getOutputStream();
       out.write(createXMLSignatureRequestOrRedirect.getBytes("UTF-8"));
@@ -127,7 +129,7 @@ public class CitizenCardServletUtils extends ServletUtils{
       resp.addHeader("Location", dataURL);
       
       //TODO test impact of explicit setting charset with older versions of BKUs (HotSign)
-      resp.setContentType("text/xml;charset=UTF-8");
+      resp.setContentType(MediaType.XML_UTF_8.toString());
             
       OutputStream out = resp.getOutputStream();
       out.write(createXMLSignatureRequestOrRedirect.getBytes("UTF-8"));
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASChainingMetadataProvider.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASChainingMetadataProvider.java
index 80a2734f2..f062ad3c2 100644
--- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASChainingMetadataProvider.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASChainingMetadataProvider.java
@@ -25,14 +25,15 @@ import org.opensaml.saml2.metadata.provider.MetadataProvider;
 import org.opensaml.saml2.metadata.provider.MetadataProviderException;
 import org.opensaml.saml2.metadata.provider.ObservableMetadataProvider;
 import org.opensaml.xml.XMLObject;
+import org.springframework.stereotype.Service;
 
+import at.gv.egovernment.moa.id.auth.IDestroyableObject;
+import at.gv.egovernment.moa.id.auth.IGarbageCollectorProcessing;
 import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
 import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
 import at.gv.egovernment.moa.id.commons.ex.MOAHttpProtocolSocketFactoryException;
 import at.gv.egovernment.moa.id.commons.utils.MOAHttpProtocolSocketFactory;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
-import at.gv.egovernment.moa.id.config.auth.IGarbageCollectorProcessing;
-import at.gv.egovernment.moa.id.config.auth.MOAGarbageCollector;
 import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.filter.SchemaValidationException;
 import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.filter.SignatureValidationException;
 import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.MOASPMetadataSignatureFilter;
@@ -41,35 +42,57 @@ import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.MiscUtil;
 import eu.eidas.auth.engine.AbstractSAMLEngine;
 
-public class MOAeIDASChainingMetadataProvider implements ObservableMetadataProvider, IGarbageCollectorProcessing {
+@Service("eIDASMetadataProvider")
+public class MOAeIDASChainingMetadataProvider implements ObservableMetadataProvider, 
+	IGarbageCollectorProcessing, IDestroyableObject {
 
-	private static MOAeIDASChainingMetadataProvider instance = null;
+//	private static MOAeIDASChainingMetadataProvider instance = null;
 	private static Object mutex = new Object();
 	
 	private MetadataProvider internalProvider;
 	private Map<String, Date> lastAccess = null;
 	
 	
-	public static MOAeIDASChainingMetadataProvider getInstance() {
-		if (instance == null) {
-			synchronized (mutex) {
-				if (instance == null) {
-					instance = new MOAeIDASChainingMetadataProvider();
-					MOAGarbageCollector.addModulForGarbageCollection(instance);
-				}
-			}
-		}
-		return instance;
-	}
+//	public static MOAeIDASChainingMetadataProvider getInstance() {
+//		if (instance == null) {
+//			synchronized (mutex) {
+//				if (instance == null) {
+//					instance = new MOAeIDASChainingMetadataProvider();
+//					MOAGarbageCollector.addModulForGarbageCollection(instance);
+//				}
+//			}
+//		}
+//		return instance;
+//	}
 	
 	
-	private MOAeIDASChainingMetadataProvider() {
+	public MOAeIDASChainingMetadataProvider() {
 		internalProvider = new ChainingMetadataProvider();
 		lastAccess = new HashMap<String, Date>();
 				
 	}
 	
 	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.IDestroyableObject#fullyDestroy()
+	 */
+	@Override
+	public void fullyDestroy() {
+		Map<String, HTTPMetadataProvider> loadedproviders = getAllActuallyLoadedProviders();
+		if (loadedproviders != null) {
+			for (Entry<String, HTTPMetadataProvider> el : loadedproviders.entrySet()) {
+				try {
+					el.getValue().destroy();
+					Logger.debug("Destroy eIDAS Matadataprovider: " + el.getKey() + " finished");
+					
+				} catch (Exception e) {
+					Logger.warn("Destroy eIDAS Matadataprovider: " + el.getKey() + " FAILED");
+					
+				}
+			}
+		}		
+	}
+	
+	/* (non-Javadoc)
 	 * @see at.gv.egovernment.moa.id.config.auth.IGarbageCollectorProcessing#runGarbageCollector()
 	 */
 	@Override
@@ -196,7 +219,7 @@ public class MOAeIDASChainingMetadataProvider implements ObservableMetadataProvi
 				}
 			}
 			
-			timer = new Timer();
+			timer = new Timer(true);
 			httpProvider = new HTTPMetadataProvider(timer, httpClient, 
 					metadataURL);
 			httpProvider.setParserPool(AbstractSAMLEngine.getNewBasicSecuredParserPool());
@@ -405,5 +428,4 @@ public class MOAeIDASChainingMetadataProvider implements ObservableMetadataProvi
 			if (observer != null)
 				observer.onEvent(this);
 	}
-
 }
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/CreateIdentityLinkTask.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/CreateIdentityLinkTask.java
index 5d7430dd7..a56e6c3cd 100644
--- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/CreateIdentityLinkTask.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/CreateIdentityLinkTask.java
@@ -87,12 +87,17 @@ public class CreateIdentityLinkTask extends AbstractAuthServletTask {
 			    // replace data
 	            Element idlassertion = identityLink.getSamlAssertion();
 	            
-	            // - set bpk/wpbk;
+	            // - set fake baseID;
 		        Node prIdentification = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_IDENT_VALUE_XPATH);		        		        
 		        if(!eIDASAttributes.containsKey(Constants.eIDAS_ATTR_PERSONALIDENTIFIER))
 		        	throw new eIDASAttributeException(Constants.eIDAS_ATTR_PERSONALIDENTIFIER);
-		        String eIdentifier = eIDASAttributes.get(Constants.eIDAS_ATTR_PERSONALIDENTIFIER).getValue().get(0);
+		        String eIdentifier = eIDASAttributes.get(Constants.eIDAS_ATTR_PERSONALIDENTIFIER).getValue().get(0);		        		        		        
 		        prIdentification.getFirstChild().setNodeValue(eIdentifier);
+		        
+		        //build personal identifier which looks like a baseID		        
+//		        String fakeBaseID = new BPKBuilder().buildBPK(eIdentifier, "baseID");
+//		        Logger.info("Map eIDAS eIdentifier:" + eIdentifier + " to fake baseID:" + fakeBaseID);
+//		        prIdentification.getFirstChild().setNodeValue(fakeBaseID);
 
 		        // - set last name
 		        Node prFamilyName = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_FAMILY_NAME_XPATH);
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/GenerateAuthnRequestTask.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/GenerateAuthnRequestTask.java
index c82636a8f..2f10df540 100644
--- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/GenerateAuthnRequestTask.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/GenerateAuthnRequestTask.java
@@ -33,14 +33,18 @@ import org.apache.commons.lang3.StringUtils;
 import org.apache.velocity.Template;
 import org.apache.velocity.VelocityContext;
 import org.apache.velocity.app.VelocityEngine;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 
+import com.google.common.net.MediaType;
+
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
 import at.gv.egovernment.moa.id.auth.frontend.velocity.VelocityProvider;
 import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
 import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
+import at.gv.egovernment.moa.id.auth.modules.eidas.engine.MOAeIDASChainingMetadataProvider;
 import at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.EIDASEngineException;
 import at.gv.egovernment.moa.id.auth.modules.eidas.utils.SAMLEngineUtils;
 import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
@@ -68,6 +72,8 @@ import eu.eidas.engine.exceptions.EIDASSAMLEngineException;
 @Component("GenerateAuthnRequestTask")
 public class GenerateAuthnRequestTask extends AbstractAuthServletTask {
 
+	@Autowired(required=true) MOAeIDASChainingMetadataProvider eIDASMetadataProvider;
+	
 	/* (non-Javadoc)
 	 * @see at.gv.egovernment.moa.id.process.springweb.MoaIdTask#execute(at.gv.egovernment.moa.id.process.api.ExecutionContext, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
 	 */
@@ -125,7 +131,7 @@ public class GenerateAuthnRequestTask extends AbstractAuthServletTask {
 				pAttList.add(newAttribute);
 			}
 
-			EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine();
+			EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine(eIDASMetadataProvider);
 
 			//build eIDAS AuthnRequest
 			EIDASAuthnRequest authnRequest = new EIDASAuthnRequest();
@@ -176,8 +182,8 @@ public class GenerateAuthnRequestTask extends AbstractAuthServletTask {
 	            Logger.debug("Template merge done");
 
 	            Logger.debug("Sending html content: " + writer.getBuffer().toString());
-
-	            response.setContentType("text/html;charset=UTF-8");
+	            
+	            response.setContentType(MediaType.HTML_UTF_8.toString());
 	            response.getOutputStream().write(writer.getBuffer().toString().getBytes("UTF-8"));
 
 	            revisionsLogger.logEvent(oaConfig, pendingReq, 
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/ReceiveAuthnResponseTask.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/ReceiveAuthnResponseTask.java
index fae06031a..daa4d8b02 100644
--- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/ReceiveAuthnResponseTask.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/ReceiveAuthnResponseTask.java
@@ -4,6 +4,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import org.opensaml.saml2.core.StatusCode;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
@@ -11,6 +12,7 @@ import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants;
 import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;
 import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException;
 import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
+import at.gv.egovernment.moa.id.auth.modules.eidas.engine.MOAeIDASChainingMetadataProvider;
 import at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.EIDASEngineException;
 import at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.eIDASResponseNotSuccessException;
 import at.gv.egovernment.moa.id.auth.modules.eidas.utils.MOAPersonalAttributeList;
@@ -29,6 +31,8 @@ import eu.eidas.engine.exceptions.EIDASSAMLEngineException;
 @Component("ReceiveAuthnResponseTask")
 public class ReceiveAuthnResponseTask extends AbstractAuthServletTask {
 
+	@Autowired(required=true) MOAeIDASChainingMetadataProvider eIDASMetadataProvider;
+	
 	@Override
 	public void execute(ExecutionContext executionContext, HttpServletRequest request, HttpServletResponse response) throws TaskExecutionException {
 
@@ -48,7 +52,7 @@ public class ReceiveAuthnResponseTask extends AbstractAuthServletTask {
 			byte[] decSamlToken = EIDASUtil.decodeSAMLToken(base64SamlToken);		
 			
 			//get eIDAS SAML-engine
-			EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine();
+			EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine(eIDASMetadataProvider);
 			
 			//validate SAML token
 			EIDASAuthnResponse samlResp = engine.validateEIDASAuthnResponse(decSamlToken, 
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/SAMLEngineUtils.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/SAMLEngineUtils.java
index eeb8305cf..68640caf7 100644
--- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/SAMLEngineUtils.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/SAMLEngineUtils.java
@@ -42,7 +42,7 @@ public class SAMLEngineUtils {
 
 	private static EIDASSAMLEngine eIDASEngine = null;
 	
-	public static synchronized EIDASSAMLEngine createSAMLEngine() throws EIDASEngineException{
+	public static synchronized EIDASSAMLEngine createSAMLEngine(MOAeIDASChainingMetadataProvider moaeIDASMetadataProvider) throws EIDASEngineException{
 		
 		if (eIDASEngine == null) {
 			try {
@@ -56,7 +56,7 @@ public class SAMLEngineUtils {
 				//set metadata management to eIDAS SAMLengine
 				engine.setMetadataProcessor(
 						new MOAeIDASMetadataProviderDecorator(
-								MOAeIDASChainingMetadataProvider.getInstance()));
+								moaeIDASMetadataProvider));
 	
 				//set MOA specific extension processor 
 				ExtensionProcessorI extensionProcessor = new MOAeIDAsExtensionProcessor();
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASData.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASData.java
index 563c3a18c..4dffba575 100644
--- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASData.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASData.java
@@ -2,6 +2,7 @@ package at.gv.egovernment.moa.id.protocols.eidas;
 
 import java.util.Collection;
 
+import org.opensaml.saml2.metadata.provider.MetadataProvider;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Scope;
 import org.springframework.stereotype.Component;
@@ -29,7 +30,7 @@ public class EIDASData extends RequestImpl {
 	private String remoteRelayState;
 
 	@Override
-	public Collection<String> getRequestedAttributes() {
+	public Collection<String> getRequestedAttributes(MetadataProvider metadataProvider) {
 		// TODO Auto-generated method stub
 		return null;
 	}
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASProtocol.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASProtocol.java
index 24134f1d9..fc935e2ef 100644
--- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASProtocol.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASProtocol.java
@@ -34,6 +34,7 @@ import org.apache.velocity.VelocityContext;
 import org.apache.velocity.app.VelocityEngine;
 import org.opensaml.saml2.core.StatusCode;
 import org.opensaml.saml2.metadata.AssertionConsumerService;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -74,6 +75,8 @@ public class EIDASProtocol extends AbstractAuthProtocolModulController {
     public static final String NAME = EIDASProtocol.class.getName();
     public static final String PATH = "eidas";
 
+    @Autowired(required=true) MOAeIDASChainingMetadataProvider eIDASMetadataProvider;
+    
 	public EIDASProtocol() {
 		super();
 		Logger.debug("Registering servlet " + getClass().getName() + 
@@ -166,11 +169,13 @@ public class EIDASProtocol extends AbstractAuthProtocolModulController {
 			Logger.warn("No eIDAS SAMLRequest found in http request.");
 			throw new MOAIDException("HTTP request includes no eIDAS SAML-Request element.", null);
 		}						
-		byte[] decSamlToken = EIDASUtil.decodeSAMLToken(base64SamlToken);	
-
+			
 		try {
+			//decode SAML2 token
+			byte[] decSamlToken = EIDASUtil.decodeSAMLToken(base64SamlToken);
+			
 			//get eIDAS SAML-engine
-			EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine();
+			EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine(eIDASMetadataProvider);
 
 			//validate SAML token
 			EIDASAuthnRequest samlReq = engine.validateEIDASAuthnRequest(decSamlToken);
@@ -193,23 +198,33 @@ public class EIDASProtocol extends AbstractAuthProtocolModulController {
 			samlReq.setPersonalAttributeList(pendingReq.getEidasRequestedAttributes()); // circumvent non-serializable eidas personal attribute list
 			pendingReq.setEidasRequest(samlReq);
 			
-			//validate destination against metadata 
+			//validate Destination against MOA-ID-Auth configuration
 			String reqDestination = samlReq.getDestination();
-			if (MiscUtil.isNotEmpty(reqDestination)) {
+			if (MiscUtil.isEmpty(reqDestination) || 
+					!reqDestination.startsWith(pendingReq.getAuthURL())) {
+				Logger.info("eIDAS AuthnRequest contains a not valid 'Destination' attribute");
+				throw new eIDASAuthnRequestValidationException("stork.01", 
+						new Object[]{"eIDAS AuthnRequest contains a not valid 'Destination' attribute"});
+				
+			}
+							
+			//validate AssertionConsumerServiceURL against metadata 
+			String reqAssertionConsumerServiceURL = samlReq.getAssertionConsumerServiceURL();			
+			if (MiscUtil.isNotEmpty(reqAssertionConsumerServiceURL)) {
 				boolean isValid = false;
-				List<AssertionConsumerService> allowedAssertionConsumerUrl = new MOAeIDASMetadataProviderDecorator(MOAeIDASChainingMetadataProvider.getInstance())
+				List<AssertionConsumerService> allowedAssertionConsumerUrl = new MOAeIDASMetadataProviderDecorator(eIDASMetadataProvider)
 						.getSPSSODescriptor(samlReq.getIssuer()).getAssertionConsumerServices();
 				
 				for (AssertionConsumerService el : allowedAssertionConsumerUrl) {
-					if (reqDestination.equals(el.getLocation()))
+					if (reqAssertionConsumerServiceURL.equals(el.getLocation()))
 						isValid = true;
 					
 				}
 				
 				if (!isValid) {
-					Logger.info("eIDAS AuthnRequest contains a not valid 'Destination' attribute");
+					Logger.info("eIDAS AuthnRequest contains a not valid 'AssertionConsumerServiceURL' attribute");
 					throw new eIDASAuthnRequestValidationException("stork.01", 
-							new Object[]{"eIDAS AuthnRequest contains a not valid 'Destination' attribute"});
+							new Object[]{"eIDAS AuthnRequest contains a not valid 'AssertionConsumerServiceURL' attribute"});
 				}
 				
 			}
@@ -279,11 +294,11 @@ public class EIDASProtocol extends AbstractAuthProtocolModulController {
         		}
      		
         		
-        		EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine();
+        		EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine(eIDASMetadataProvider);
         		
         		if(null == eidasReq.getEidasRequest().getAssertionConsumerServiceURL()) {
     				String assertionConsumerUrl = MetadataUtil.getAssertionUrlFromMetadata(
-    						new MOAeIDASMetadataProviderDecorator(MOAeIDASChainingMetadataProvider.getInstance()), 
+    						new MOAeIDASMetadataProviderDecorator(eIDASMetadataProvider), 
     						engine, 
     						eidasReq.getEidasRequest());
     				eidasReq.getEidasRequest().setAssertionConsumerServiceURL(assertionConsumerUrl);
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EidasMetaDataRequest.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EidasMetaDataRequest.java
index b4db5c83d..3fc13406c 100644
--- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EidasMetaDataRequest.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EidasMetaDataRequest.java
@@ -23,10 +23,12 @@ import javax.servlet.http.HttpServletResponse;
 
 import org.opensaml.saml2.metadata.ContactPerson;
 import org.opensaml.saml2.metadata.Organization;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
 import org.springframework.stereotype.Service;
 
 import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
+import at.gv.egovernment.moa.id.auth.modules.eidas.engine.MOAeIDASChainingMetadataProvider;
 import at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.EIDASEngineException;
 import at.gv.egovernment.moa.id.auth.modules.eidas.utils.SAMLEngineUtils;
 import at.gv.egovernment.moa.id.commons.api.IRequest;
@@ -50,6 +52,8 @@ import eu.eidas.engine.exceptions.SAMLEngineException;
 @Service("EidasMetaDataRequest")
 public class EidasMetaDataRequest implements IAction {
     
+	@Autowired(required=true) MOAeIDASChainingMetadataProvider eIDASMetadataProvider;
+	
 	/* (non-Javadoc)
 	 * @see at.gv.egovernment.moa.id.moduls.IAction#processRequest(at.gv.egovernment.moa.id.moduls.IRequest, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, at.gv.egovernment.moa.id.data.IAuthData)
 	 */
@@ -103,7 +107,7 @@ public class EidasMetaDataRequest implements IAction {
     public String generateMetadata(String metadata_url, String sp_return_url) throws SAMLEngineException, EIDASEngineException{
         String metadata="invalid metadata";
 
-		EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine();
+		EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine(eIDASMetadataProvider);
         
         MetadataGenerator generator = new MetadataGenerator();
         MetadataConfigParams mcp=new MetadataConfigParams();
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/eIDASAuthenticationRequest.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/eIDASAuthenticationRequest.java
index 9943cc5fb..2beb419fb 100644
--- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/eIDASAuthenticationRequest.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/eIDASAuthenticationRequest.java
@@ -49,6 +49,7 @@ import at.gv.egovernment.moa.id.data.IAuthData;
 import at.gv.egovernment.moa.id.data.SLOInformationInterface;
 import at.gv.egovernment.moa.id.moduls.IAction;
 import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.MiscUtil;
 import eu.eidas.auth.commons.EIDASAuthnResponse;
 import eu.eidas.auth.commons.EIDASStatusCode;
 import eu.eidas.auth.commons.EIDASUtil;
@@ -68,6 +69,7 @@ import eu.eidas.auth.engine.metadata.MetadataUtil;
 public class eIDASAuthenticationRequest implements IAction {
 
 	@Autowired protected MOAReversionLogger revisionsLogger;
+	@Autowired(required=true) MOAeIDASChainingMetadataProvider eIDASMetadataProvider;
 	
 	@Override
 	public SLOInformationInterface processRequest(IRequest req, HttpServletRequest httpReq, HttpServletResponse httpResp, IAuthData authData) throws MOAIDException {
@@ -86,20 +88,21 @@ public class eIDASAuthenticationRequest implements IAction {
 			
 			// TODO make use of proper builder
 			switch(current.getKey()) {
-			case Constants.eIDAS_ATTR_DATEOFBIRTH: newValue = new SimpleDateFormat("YYYY-MM-dd").format(authData.getDateOfBirth()); break;
-			case Constants.eIDAS_ATTR_CURRENTFAMILYNAME: newValue = authData.getFamilyName();break;
-			case Constants.eIDAS_ATTR_CURRENTGIVENNAME: newValue = authData.getGivenName();break;
-			
-			//TODO: change bPK builder !!!!!!
-			case Constants.eIDAS_ATTR_PERSONALIDENTIFIER: newValue = authData.getBPK(); break;
+				case Constants.eIDAS_ATTR_DATEOFBIRTH: newValue = new SimpleDateFormat("YYYY-MM-dd").format(authData.getDateOfBirth()); break;
+				case Constants.eIDAS_ATTR_CURRENTFAMILYNAME: newValue = authData.getFamilyName();break;
+				case Constants.eIDAS_ATTR_CURRENTGIVENNAME: newValue = authData.getGivenName();break;			
+				case Constants.eIDAS_ATTR_PERSONALIDENTIFIER: newValue = authData.getBPK(); break;
+				
 			}
 			
-			if("".equals(newValue))
+			if(MiscUtil.isEmpty(newValue))
 				current.getValue().setStatus(EIDASStatusCode.STATUS_NOT_AVAILABLE.toString());
+			
 			else {
 				current.getValue().getValue().clear();
 				current.getValue().getValue().add(newValue);
 				current.getValue().setStatus(EIDASStatusCode.STATUS_AVAILABLE.toString());
+				
 			}
 		}
 		
@@ -116,7 +119,7 @@ public class eIDASAuthenticationRequest implements IAction {
 		
 		String token = null;
 		try {
-			EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine();
+			EIDASSAMLEngine engine = SAMLEngineUtils.createSAMLEngine(eIDASMetadataProvider);
 			
 			// encryption is done by the SamlEngine, i.e. by the module we provide in the config
 			// but we need to set the appropriate request issuer
@@ -125,7 +128,7 @@ public class eIDASAuthenticationRequest implements IAction {
 
 			if(null == eidasRequest.getEidasRequest().getAssertionConsumerServiceURL()) {
 				String assertionConsumerUrl = MetadataUtil.getAssertionUrlFromMetadata(
-						new MOAeIDASMetadataProviderDecorator(MOAeIDASChainingMetadataProvider.getInstance()), 
+						new MOAeIDASMetadataProviderDecorator(eIDASMetadataProvider), 
 						engine, 
 						eidasRequest.getEidasRequest());
 				eidasRequest.getEidasRequest().setAssertionConsumerServiceURL(assertionConsumerUrl);
@@ -137,8 +140,9 @@ public class eIDASAuthenticationRequest implements IAction {
 			
 			token = EIDASUtil.encodeSAMLToken(response.getTokenSaml());
 			
-		} catch(Exception e) {
+		} catch(Exception e) {			
 			e.printStackTrace();
+			
 		}
 		
 		revisionsLogger.logEvent(req, Constants.eIDAS_REVERSIONSLOG_IDP_AUTHREQUEST);
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/resources/moaid_eidas_auth.beans.xml b/id/server/modules/moa-id-module-eIDAS/src/main/resources/moaid_eidas_auth.beans.xml
index 5d79d082a..20395f210 100644
--- a/id/server/modules/moa-id-module-eIDAS/src/main/resources/moaid_eidas_auth.beans.xml
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/resources/moaid_eidas_auth.beans.xml
@@ -14,6 +14,9 @@
 
 	<bean id="EIDASProtocol"
 				class="at.gv.egovernment.moa.id.protocols.eidas.EIDASProtocol"/>
+				
+	<bean id="eIDASMetadataProvider"
+				class="at.gv.egovernment.moa.id.auth.modules.eidas.engine.MOAeIDASChainingMetadataProvider"/>
 							
 <!-- Authentication Process Tasks -->
 	<bean id="GenerateAuthnRequestTask" 
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/controller/ELGAMandateMetadataController.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/controller/ELGAMandateMetadataController.java
index 29bc5ee12..5720e4827 100644
--- a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/controller/ELGAMandateMetadataController.java
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/controller/ELGAMandateMetadataController.java
@@ -32,6 +32,8 @@ import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 
+import com.google.common.net.MediaType;
+
 import at.gv.egovernment.moa.id.auth.modules.elgamandates.ELGAMandatesAuthConstants;
 import at.gv.egovernment.moa.id.auth.modules.elgamandates.config.ELGAMandatesMetadataConfiguration;
 import at.gv.egovernment.moa.id.auth.modules.elgamandates.utils.ELGAMandatesCredentialProvider;
@@ -80,7 +82,7 @@ public class ELGAMandateMetadataController extends AbstractController {
 				String xmlMetadata = metadatabuilder.buildPVPMetadata(metadataConfig);
 				
 				//write response
-				resp.setContentType("text/xml");
+				resp.setContentType(MediaType.XML_UTF_8.toString());
 				resp.getOutputStream().write(xmlMetadata.getBytes("UTF-8"));
 				resp.getOutputStream().close();
 
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/ReceiveElgaMandateResponseTask.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/ReceiveElgaMandateResponseTask.java
index 5604b7640..07bde7762 100644
--- a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/ReceiveElgaMandateResponseTask.java
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/ReceiveElgaMandateResponseTask.java
@@ -149,16 +149,21 @@ public class ReceiveElgaMandateResponseTask extends AbstractAuthServletTask {
 			//load MOASession object
 			defaultTaskInitialization(request, executionContext);
 			
+
+			/**
+			 * Mandate Reference-Value is generated from ELGA MandateServie  -->
+			 * MOA-ID generated reference value is not equal to reference-value from ELGA MandateService
+			 * But MOA-ID refernece-value is also validated in 'inResponseTo' attribute from ELGA MandateService response
+			 */
 			//validate receive mandate reference-value
-			//TODO: update if ReferenceValue Discussion is finished
-			String responseRefValue = extractor.getSingleAttributeValue(PVPConstants.MANDATE_REFERENCE_VALUE_NAME); 
-			if (!moasession.getMandateReferenceValue().equals(responseRefValue)) {
-				Logger.warn("PVP Response from ELGA mandate-service contains a not valid MandateReferenceValue.");
-				throw new AssertionValidationExeption("sp.pvp2.07", 
-						new Object[]{ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING,
-								PVPConstants.MANDATE_REFERENCE_VALUE_FRIENDLY_NAME});
-				
-			}
+//			String responseRefValue = extractor.getSingleAttributeValue(PVPConstants.MANDATE_REFERENCE_VALUE_NAME); 
+//			if (!moasession.getMandateReferenceValue().equals(responseRefValue)) {
+//				Logger.warn("PVP Response from ELGA mandate-service contains a not valid MandateReferenceValue.");
+//				throw new AssertionValidationExeption("sp.pvp2.07", 
+//						new Object[]{ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING,
+//								PVPConstants.MANDATE_REFERENCE_VALUE_FRIENDLY_NAME});
+//				
+//			}
 			
 			Logger.debug("Validation of PVP Response from ELGA mandate-service is complete.");
 			
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/RequestELGAMandateTask.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/RequestELGAMandateTask.java
index 6a7858575..fd918c7f4 100644
--- a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/RequestELGAMandateTask.java
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/tasks/RequestELGAMandateTask.java
@@ -150,9 +150,25 @@ public class RequestELGAMandateTask extends AbstractAuthServletTask {
 				}								
 			}
 			
+			//build subjectNameID with bPK-Type Prefix
+			String bPKPrefix = null;
+			if (configTarget.startsWith(Constants.URN_PREFIX_WBPK))
+				bPKPrefix = configTarget.substring((Constants.URN_PREFIX_WBPK + "+").length());
+			
+			else if (configTarget.startsWith(Constants.URN_PREFIX_CDID)) 
+				bPKPrefix = configTarget.substring((Constants.URN_PREFIX_CDID + "+").length());
+			
+			if (bPKPrefix == null) {
+				throw new MOAIDException("service.10", 
+						new Object[]{ELGAMandatesAuthConstants.MODULE_NAME_FOR_LOGGING, "Configurated bPK-Type is wrong."});
+				
+			}
+			
 			//set bPK of representative as SAML2 subjectNameID
-			authnReqConfig.setSubjectNameID(representativeBPK );
-			authnReqConfig.setSubjectNameIDQualifier(configTarget);
+			authnReqConfig.setSubjectNameID(bPKPrefix + ":" + representativeBPK );
+
+			//is not recommended from ELGA
+			//authnReqConfig.setSubjectNameIDQualifier(configTarget);
 			
 			//set MandateReferenceValue as RequestID
 			authnReqConfig.setRequestID(moasession.getMandateReferenceValue());
diff --git a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/utils/ELGAMandateServiceMetadataProvider.java b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/utils/ELGAMandateServiceMetadataProvider.java
index c9485104b..36cd2c7e7 100644
--- a/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/utils/ELGAMandateServiceMetadataProvider.java
+++ b/id/server/modules/moa-id-module-elga_mandate_service/src/main/java/at/gv/egovernment/moa/id/auth/modules/elgamandates/utils/ELGAMandateServiceMetadataProvider.java
@@ -36,6 +36,7 @@ import org.opensaml.xml.XMLObject;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
+import at.gv.egovernment.moa.id.auth.IDestroyableObject;
 import at.gv.egovernment.moa.id.auth.modules.elgamandates.ELGAMandatesAuthConstants;
 import at.gv.egovernment.moa.id.commons.api.AuthConfiguration;
 import at.gv.egovernment.moa.id.protocols.pvp2x.metadata.SimpleMOAMetadataProvider;
@@ -51,7 +52,8 @@ import at.gv.egovernment.moa.util.MiscUtil;
  */
 
 @Service("ELGAMandate_MetadataProvider")
-public class ELGAMandateServiceMetadataProvider extends SimpleMOAMetadataProvider {
+public class ELGAMandateServiceMetadataProvider extends SimpleMOAMetadataProvider
+	implements IDestroyableObject {
 
 	@Autowired AuthConfiguration authConfig;
 	
@@ -69,6 +71,13 @@ public class ELGAMandateServiceMetadataProvider extends SimpleMOAMetadataProvide
 		
 	}
 	
+	public void destroy() {
+		if (metadataProvider != null)
+			metadataProvider.destroy();
+		
+	}
+	
+	
 		
 	/* (non-Javadoc)
 	 * @see org.opensaml.saml2.metadata.provider.MetadataProvider#requireValidMetadata()
@@ -220,4 +229,16 @@ public class ELGAMandateServiceMetadataProvider extends SimpleMOAMetadataProvide
 			metadataProvider.setRequireValidMetadata(true);
 		}
 	}
+
+	/* (non-Javadoc)
+	 * @see at.gv.egovernment.moa.id.auth.IDestroyableObject#fullyDestroy()
+	 */
+	@Override
+	public void fullyDestroy() {
+		if (metadataProvider != null) {
+			metadataProvider.destroy();
+			
+		}
+		
+	}
 }
diff --git a/id/server/modules/moa-id-module-openID/pom.xml b/id/server/modules/moa-id-module-openID/pom.xml
index 4684c8032..2bd3b6b4f 100644
--- a/id/server/modules/moa-id-module-openID/pom.xml
+++ b/id/server/modules/moa-id-module-openID/pom.xml
@@ -41,13 +41,13 @@
 		<dependency>
 			<groupId>com.google.http-client</groupId>
 			<artifactId>google-http-client-jackson2</artifactId>
-			<version>1.21.0</version>
+			<version>1.22.0</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
 			<groupId>com.google.oauth-client</groupId>
 			<artifactId>google-oauth-client-jetty</artifactId>
-			<version>1.21.0</version>
+			<version>1.22.0</version>
 			<scope>test</scope>
 			<exclusions>
 				<exclusion>
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20AuthRequest.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20AuthRequest.java
index 98fcdc8dc..258b77b98 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20AuthRequest.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20AuthRequest.java
@@ -28,6 +28,7 @@ import java.util.Map;
 
 import javax.servlet.http.HttpServletRequest;
 
+import org.opensaml.saml2.metadata.provider.MetadataProvider;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Scope;
 import org.springframework.stereotype.Component;
@@ -209,7 +210,7 @@ public class OAuth20AuthRequest extends OAuth20BaseRequest {
 	 * @see at.gv.egovernment.moa.id.moduls.RequestImpl#getRequestedAttributes()
 	 */
 	@Override
-	public Collection<String> getRequestedAttributes() {
+	public Collection<String> getRequestedAttributes(MetadataProvider metadataProvider) {
 		Map<String, String> reqAttr = new HashMap<String, String>();
 		for (String el : PVP2XProtocol.DEFAULTREQUESTEDATTRFORINTERFEDERATION)
 			reqAttr.put(el, "");
diff --git a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20TokenRequest.java b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20TokenRequest.java
index f35de9c58..50638ebf8 100644
--- a/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20TokenRequest.java
+++ b/id/server/modules/moa-id-module-openID/src/main/java/at/gv/egovernment/moa/id/protocols/oauth20/protocol/OAuth20TokenRequest.java
@@ -26,6 +26,7 @@ import java.util.Collection;
 
 import javax.servlet.http.HttpServletRequest;
 
+import org.opensaml.saml2.metadata.provider.MetadataProvider;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Scope;
 import org.springframework.stereotype.Component;
@@ -168,7 +169,7 @@ class OAuth20TokenRequest extends OAuth20BaseRequest {
 	 * @see at.gv.egovernment.moa.id.moduls.RequestImpl#getRequestedAttributes()
 	 */
 	@Override
-	public Collection<String> getRequestedAttributes() {
+	public Collection<String> getRequestedAttributes(MetadataProvider metadataProvider) {
 		return null;
 	}
 }
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/data/SSOTransferAuthenticationData.java b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/data/SSOTransferAuthenticationData.java
index f9cb4c636..78cbd788d 100644
--- a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/data/SSOTransferAuthenticationData.java
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/data/SSOTransferAuthenticationData.java
@@ -49,8 +49,9 @@ public class SSOTransferAuthenticationData implements IAuthData {
 	
 	public SSOTransferAuthenticationData(AuthConfiguration authConfig, AuthenticationSession authSession) throws ConfigurationException {
 		this.authSession = authSession;
-		String domainIdentifier = authConfig.getSSOTagetIdentifier().trim();
-		isIDPPrivateService = domainIdentifier.startsWith(MOAIDAuthConstants.PREFIX_WPBK);
+		String domainIdentifier = authConfig.getSSOTagetIdentifier();
+		if (domainIdentifier != null)
+			isIDPPrivateService = domainIdentifier.startsWith(MOAIDAuthConstants.PREFIX_WPBK);
 		
 	}
 	
diff --git a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/task/RestoreSSOSessionTask.java b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/task/RestoreSSOSessionTask.java
index dd133e4fb..003ce8c21 100644
--- a/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/task/RestoreSSOSessionTask.java
+++ b/id/server/modules/moa-id-module-ssoTransfer/src/main/java/at/gv/egovernment/moa/id/auth/modules/ssotransfer/task/RestoreSSOSessionTask.java
@@ -39,6 +39,7 @@ import org.opensaml.saml2.core.Response;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 
+import com.google.common.net.MediaType;
 import com.google.gson.JsonObject;
 import com.google.gson.JsonParser;
 
@@ -216,7 +217,7 @@ public class RestoreSSOSessionTask extends AbstractAuthServletTask {
 		    			SSOTransferConstants.SSOCONTAINER_KEY_STATUS, 
 		    			"OK");
 		    	response.setStatus(HttpServletResponse.SC_OK);
-		    	response.setContentType("text/html;charset=UTF-8");
+		    	response.setContentType(MediaType.HTML_UTF_8.toString());
 				PrintWriter out = new PrintWriter(response.getOutputStream()); 
 				out.print(responseMsg.toString());
 				out.flush();
diff --git a/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/controller/FederatedAuthMetadataController.java b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/controller/FederatedAuthMetadataController.java
index 98240a636..02356d74a 100644
--- a/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/controller/FederatedAuthMetadataController.java
+++ b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/controller/FederatedAuthMetadataController.java
@@ -32,6 +32,8 @@ import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 
+import com.google.common.net.MediaType;
+
 import at.gv.egovernment.moa.id.auth.modules.federatedauth.FederatedAuthConstants;
 import at.gv.egovernment.moa.id.auth.modules.federatedauth.config.FederatedAuthMetadataConfiguration;
 import at.gv.egovernment.moa.id.auth.modules.federatedauth.utils.FederatedAuthCredentialProvider;
@@ -80,7 +82,7 @@ public class FederatedAuthMetadataController extends AbstractController {
 				String xmlMetadata = metadatabuilder.buildPVPMetadata(metadataConfig);
 				
 				//write response
-				resp.setContentType("text/xml");
+				resp.setContentType(MediaType.XML_UTF_8.toString());
 				resp.getOutputStream().write(xmlMetadata.getBytes("UTF-8"));
 				resp.getOutputStream().close();
 
diff --git a/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/tasks/CreateAuthnRequestTask.java b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/tasks/CreateAuthnRequestTask.java
index d581e7e75..f5896bc25 100644
--- a/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/tasks/CreateAuthnRequestTask.java
+++ b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/tasks/CreateAuthnRequestTask.java
@@ -62,7 +62,7 @@ public class CreateAuthnRequestTask extends AbstractAuthServletTask {
 
 	@Autowired PVPAuthnRequestBuilder authnReqBuilder;
 	@Autowired FederatedAuthCredentialProvider credential;
-	
+	@Autowired(required=true) MOAMetadataProvider metadataProvider;
 	
 	/* (non-Javadoc)
 	 * @see at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask#execute(at.gv.egovernment.moa.id.process.api.ExecutionContext, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
@@ -95,7 +95,7 @@ public class CreateAuthnRequestTask extends AbstractAuthServletTask {
 			}
 			
 			//load IDP SAML2 entitydescriptor
-			EntityDescriptor idpEntity = MOAMetadataProvider.getInstance().
+			EntityDescriptor idpEntity = metadataProvider.
 					getEntityDescriptor(idpEntityID);			
 			if (idpEntity == null) {
 				Logger.warn("Requested IDP " + idpEntityID 
diff --git a/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/tasks/ReceiveAuthnResponseTask.java b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/tasks/ReceiveAuthnResponseTask.java
index 1c3134b77..f739940c8 100644
--- a/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/tasks/ReceiveAuthnResponseTask.java
+++ b/id/server/modules/moa-id-modules-federated_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/federatedauth/tasks/ReceiveAuthnResponseTask.java
@@ -90,7 +90,7 @@ public class ReceiveAuthnResponseTask extends AbstractAuthServletTask {
 	@Autowired private SSOManager ssoManager;
 	@Autowired private AttributQueryBuilder attributQueryBuilder;
 	@Autowired private AuthenticationDataBuilder authDataBuilder;
-	
+	@Autowired(required=true) MOAMetadataProvider metadataProvider;
 	
 	
 	/* (non-Javadoc)
@@ -125,7 +125,7 @@ public class ReceiveAuthnResponseTask extends AbstractAuthServletTask {
 			
 			//decode PVP response object
 			msg = (InboundMessage) decoder.decode(
-					request, response, MOAMetadataProvider.getInstance(), true,
+					request, response, metadataProvider, true,
 					comperator);
 			 
 			if (MiscUtil.isEmpty(msg.getEntityID())) {
@@ -135,7 +135,7 @@ public class ReceiveAuthnResponseTask extends AbstractAuthServletTask {
 
 			//validate response signature
 			if(!msg.isVerified()) {
-				samlVerificationEngine.verify(msg, TrustEngineFactory.getSignatureKnownKeysTrustEngine(MOAMetadataProvider.getInstance()));
+				samlVerificationEngine.verify(msg, TrustEngineFactory.getSignatureKnownKeysTrustEngine(metadataProvider));
 				msg.setVerified(true);
 								
 			}
@@ -247,7 +247,7 @@ public class ReceiveAuthnResponseTask extends AbstractAuthServletTask {
 		
 		try {
 			Logger.debug("Service Provider is no federated IDP --> start Attribute validation or requesting ... ");
-			Collection<String> requestedAttr = pendingReq.getRequestedAttributes();
+			Collection<String> requestedAttr = pendingReq.getRequestedAttributes(metadataProvider);
 						
 			//check if SAML2 Assertion contains a minimal set of attributes
 			if (!extractor.containsAllRequiredAttributes()) {
@@ -267,7 +267,7 @@ public class ReceiveAuthnResponseTask extends AbstractAuthServletTask {
 			
 			//check if all attributes are include
 			if (!extractor.containsAllRequiredAttributes(
-					pendingReq.getRequestedAttributes())) {
+					pendingReq.getRequestedAttributes(metadataProvider))) {
 				Logger.warn("PVP Response from federated IDP contains not all requested attributes.");
 				throw new AssertionValidationExeption("sp.pvp2.06", new Object[]{FederatedAuthConstants.MODULE_NAME_FOR_LOGGING});
 				
diff --git a/id/server/modules/moa-id-modules-saml1/pom.xml b/id/server/modules/moa-id-modules-saml1/pom.xml
index 323edee8d..0463bf8d9 100644
--- a/id/server/modules/moa-id-modules-saml1/pom.xml
+++ b/id/server/modules/moa-id-modules-saml1/pom.xml
@@ -26,6 +26,13 @@
   	</dependency>
 
   	<dependency>
+			<groupId>MOA.id.server</groupId>
+			<artifactId>moa-id-commons</artifactId>
+			<type>test-jar</type>
+			<scope>test</scope>
+		</dependency>
+
+  	<dependency>
   		<groupId>MOA.id.server</groupId>
   		<artifactId>moa-id-lib</artifactId>
   	</dependency>
diff --git a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/GetAuthenticationDataService.java b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/GetAuthenticationDataService.java
index b01ea666d..893799b5d 100644
--- a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/GetAuthenticationDataService.java
+++ b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/GetAuthenticationDataService.java
@@ -66,9 +66,12 @@ import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.w3c.dom.Element;
+import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
 import org.xml.sax.SAXException;
 
+import com.google.common.net.MediaType;
+
 import at.gv.egovernment.moa.id.auth.builder.SAMLResponseBuilder;
 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
 import at.gv.egovernment.moa.id.auth.frontend.velocity.VelocityProvider;
@@ -122,7 +125,8 @@ public class GetAuthenticationDataService extends AbstractController implements
 	private static final String CONTEXT_SOAP_STATUSCODE = "statusCode";
 	private static final String CONTEXT_SOAP_ASSERTION = "assertion";
 	
-	@RequestMapping(value = "/services/GetAuthenticationData", method = {RequestMethod.POST})
+	@RequestMapping(value = {"/services/GetAuthenticationData", "/services"}, 
+			        method = {RequestMethod.POST})
 	public void getAuthenticationData(HttpServletRequest req, HttpServletResponse resp)
 		    throws IOException {
 		InputStream is = null;
@@ -136,13 +140,13 @@ public class GetAuthenticationDataService extends AbstractController implements
 		    
 			String respString = DOMUtils.serializeNode(soapResp, true);
 			
-			resp.setContentType("text/xml;charset=UTF-8");
+			resp.setContentType(MediaType.XML_UTF_8.toString());
 			context.put(CONTEXT_SOAP_ASSERTION, respString);
 			evaluateTemplate(context, resp, TEMPLATE_SOAP_SUCCESS);
 						
 		} catch (ParserConfigurationException | SAXException | IOException | TransformerException e) {
 			Logger.error("SAML1 GetAuthenticationData receive a non-valid request.", e);
-			resp.setContentType("text/xml;charset=UTF-8");
+			resp.setContentType(MediaType.XML_UTF_8.toString());
 					
 			context.put(CONTEXT_SOAP_ISSUEINSTANT, DateTimeUtils.buildDateTimeUTC(Calendar.getInstance()));
 			context.put(CONTEXT_SOAP_RESPONSEID, Random.nextRandom());
@@ -153,7 +157,7 @@ public class GetAuthenticationDataService extends AbstractController implements
 			
 		} catch (SAML1AssertionResponseBuildException e) {
 			Logger.error("SAML1 GetAuthenticationData response build failed..", e);
-			resp.setContentType("text/xml;charset=UTF-8");
+			resp.setContentType(MediaType.XML_UTF_8.toString());
 			
 			context.put(CONTEXT_SOAP_ISSUEINSTANT, e.getIssueInstant());
 			context.put(CONTEXT_SOAP_REQUESTEID, e.getRequestID());
@@ -187,17 +191,17 @@ public class GetAuthenticationDataService extends AbstractController implements
 		
 		if (wsdl_param != null) {
 			//print wsdl
-			resp.setContentType("text/xml;charset=UTF-8");
+			resp.setContentType(MediaType.XML_UTF_8.toString());
 			evaluateTemplate(context, resp, TEMPLATE_WSDL);
 			
 		} else if (xsd_param != null){
 			//print xsd
-			resp.setContentType("text/xml;charset=UTF-8");
+			resp.setContentType(MediaType.XML_UTF_8.toString());
 			evaluateTemplate(context, resp, TEMPLATE_XSD);
 						
 		} else {
 			//print plain info
-			resp.setContentType("text/html;charset=UTF-8");
+			resp.setContentType(MediaType.XML_UTF_8.toString());
 			evaluateTemplate(context, resp, TEMPLATE_PLAIN_INFO);
 			
 		}
@@ -223,13 +227,23 @@ public class GetAuthenticationDataService extends AbstractController implements
 			}	
 		} 
 		
-		//get first child from body --> should be the SAML1 Request element 
-		Element saml1Req;
-		if (saml1ReqList.item(0).getFirstChild() instanceof Element)
-			saml1Req = (Element) saml1ReqList.item(0).getFirstChild();
-			
-		else {
-			throw new SAXException("First child of 'soap-env:Body' element has a wrong type.");
+		//get the first child from body which is of type Element (SAML1 Request element) 
+		Element saml1Req = null;
+		
+		Node reqObj = saml1ReqList.item(0).getFirstChild();
+		while (reqObj != null) {
+			if (reqObj instanceof Element) {
+				saml1Req = (Element) reqObj;
+				break;
+				
+			} else {
+				reqObj = reqObj.getNextSibling();
+				
+			}			
+		}
+		
+		if (saml1Req == null) {
+			throw new SAXException("Every child of 'soap-env:Body' element has a wrong type.");
 				
 		}
 
diff --git a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1RequestImpl.java b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1RequestImpl.java
index 42fafc01e..1d3525626 100644
--- a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1RequestImpl.java
+++ b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/SAML1RequestImpl.java
@@ -26,6 +26,7 @@ import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 
+import org.opensaml.saml2.metadata.provider.MetadataProvider;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Scope;
 import org.springframework.stereotype.Component;
@@ -81,7 +82,7 @@ public class SAML1RequestImpl extends RequestImpl {
 	 * @see at.gv.egovernment.moa.id.moduls.RequestImpl#getRequestedAttributes()
 	 */
 	@Override
-	public Collection<String> getRequestedAttributes() {
+	public Collection<String> getRequestedAttributes(MetadataProvider metadataProvider) {
 		
 		List<String> reqAttr = new ArrayList<String>();
 		reqAttr.addAll(SAML1Protocol.DEFAULTREQUESTEDATTRFORINTERFEDERATION);
diff --git a/id/server/modules/moa-id-modules-saml1/src/main/resources/plain_info.vm b/id/server/modules/moa-id-modules-saml1/src/main/resources/plain_info.vm
index dfc11820f..858479904 100644
--- a/id/server/modules/moa-id-modules-saml1/src/main/resources/plain_info.vm
+++ b/id/server/modules/moa-id-modules-saml1/src/main/resources/plain_info.vm
@@ -1,6 +1,6 @@
 <html>
 <head>
-<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
+<meta content="text/html; charset=utf-8" http-equiv="Content-Type"/>
 </head>
 <body>
 <h1>GetAuthenticationData</h1>