1 files changed, 23 insertions, 6 deletions
diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/BuildMetadata.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/BuildMetadata.java
index fa02443dc..cdb28922c 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/BuildMetadata.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/auth/pvp2/BuildMetadata.java
@@ -142,21 +142,38 @@ public class BuildMetadata extends HttpServlet {
 			entitiesSignKeyDescriptor.setUse(UsageType.SIGNING);
 			entitiesSignKeyDescriptor.setKeyInfo(keyInfoGenerator.generate(signingcredential));
 			Signature entitiesSignature = getSignature(signingcredential);
-			
+			spEntitiesDescriptor.setSignature(entitiesSignature);
+
+			//Set AuthRequest Signing certificate
 			X509Credential authcredential = new KeyStoreX509CredentialAdapter(
 					keyStore, 
 					config.getPVP2KeystoreAuthRequestKeyAlias(), 
-					config.getPVP2KeystoreAuthRequestKeyPassword().toCharArray());
-			
-			
-			//Set AuthRequest Signing certificate
+					config.getPVP2KeystoreAuthRequestKeyPassword().toCharArray());			
 			KeyDescriptor signKeyDescriptor = SAML2Utils
 					.createSAMLObject(KeyDescriptor.class);
 			signKeyDescriptor.setUse(UsageType.SIGNING);
 			signKeyDescriptor.setKeyInfo(keyInfoGenerator.generate(authcredential));	
-			spEntitiesDescriptor.setSignature(entitiesSignature);
 			spSSODescriptor.getKeyDescriptors().add(signKeyDescriptor);
 			
+			
+			//set AuthRequest encryption certificate
+			if (MiscUtil.isNotEmpty(config.getPVP2KeystoreAuthRequestEncryptionKeyAlias())) {
+				X509Credential authEncCredential = new KeyStoreX509CredentialAdapter(
+						keyStore, 
+						config.getPVP2KeystoreAuthRequestEncryptionKeyAlias(), 
+						config.getPVP2KeystoreAuthRequestEncryptionKeyPassword().toCharArray());			
+				KeyDescriptor encryKeyDescriptor = SAML2Utils
+						.createSAMLObject(KeyDescriptor.class);
+				encryKeyDescriptor.setUse(UsageType.ENCRYPTION);
+				encryKeyDescriptor.setKeyInfo(keyInfoGenerator.generate(authEncCredential));	
+				spSSODescriptor.getKeyDescriptors().add(encryKeyDescriptor);
+				
+			} else {
+				log.warn("No Assertion Encryption-Key defined. This setting is not recommended!");
+				
+			}
+			
+			
 			NameIDFormat persistentnameIDFormat = SAML2Utils.createSAMLObject(NameIDFormat.class);
 			persistentnameIDFormat.setFormat(NameIDType.PERSISTENT);