1 files changed, 362 insertions, 0 deletions
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationBlockAssertionBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationBlockAssertionBuilder.java
new file mode 100644
index 000000000..bab387b4a
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationBlockAssertionBuilder.java
@@ -0,0 +1,362 @@
+/*
+* Copyright 2003 Federal Chancellery Austria
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+package at.gv.egovernment.moa.id.auth.builder;
+
+import java.text.MessageFormat;
+import java.util.List;
+
+import org.w3c.dom.Element;
+
+import at.gv.egovernment.moa.id.BuildException;
+import at.gv.egovernment.moa.id.ParseException;
+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttribute;
+import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttributeImpl;
+import at.gv.egovernment.moa.id.config.ConfigurationException;
+import at.gv.egovernment.moa.id.config.TargetToSectorNameMapper;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
+import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.util.Constants;
+import at.gv.egovernment.moa.util.DOMUtils;
+import at.gv.egovernment.moa.util.StringUtils;
+
+/**
+ * Builder for the authentication block <code>&lt;saml:Assertion&gt;</code>
+ * to be included in a <code>&lt;CreateXMLSignatureResponse&gt;</code>.
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class AuthenticationBlockAssertionBuilder extends AuthenticationAssertionBuilder implements Constants {
+
+  /** template for the Auth-Block */
+  private static String AUTH_BLOCK = 
+    "<saml:Assertion xmlns:saml=''" + SAML_NS_URI + "''{0} MajorVersion=''1'' MinorVersion=''0'' AssertionID=''any'' Issuer=''{1}'' IssueInstant=''{2}''>" + NL +
+    " <saml:AttributeStatement>" + NL +
+    "   <saml:Subject>" + NL +
+    "     <saml:NameIdentifier>{3}</saml:NameIdentifier>" + NL +
+    "   </saml:Subject>" + NL +
+    "{4}" + 
+    "   <saml:Attribute AttributeName=''OA'' AttributeNamespace=''" + MOA_NS_URI + "''>" + NL +
+    "     <saml:AttributeValue>{5}</saml:AttributeValue>" + NL +
+    "   </saml:Attribute>" + NL +
+    "   <saml:Attribute AttributeName=''Geburtsdatum'' AttributeNamespace=''" + MOA_NS_URI + "''>" + NL +
+    "     <saml:AttributeValue>{6}</saml:AttributeValue>" + NL +
+    "   </saml:Attribute>" + NL +
+    "{7}" +
+    " </saml:AttributeStatement>" + NL +
+    "</saml:Assertion>";
+  
+  private static String GESCHAEFTS_BEREICH_ATTRIBUTE =
+    "   <saml:Attribute AttributeName=''Geschaeftsbereich'' AttributeNamespace=''" + MOA_NS_URI + "''>" + NL +
+    "     <saml:AttributeValue>{0}</saml:AttributeValue>" + NL +
+    "   </saml:Attribute>" + NL;
+  
+  private static String WBPK_ATTRIBUTE =
+    "   <saml:Attribute AttributeName=''wbPK'' AttributeNamespace=''" + MOA_NS_URI + "''>" + NL +
+    "     <saml:AttributeValue>" + NL +
+    "       <pr:Identification>" + NL +
+    "         <pr:Value>{0}</pr:Value>" + NL +
+    "         <pr:Type>{1}</pr:Type>" + NL +
+    "       </pr:Identification>" + NL +
+    "     </saml:AttributeValue>" + NL +
+    "   </saml:Attribute>" + NL;
+  
+  
+  private static String PR_IDENTIFICATION_ATTRIBUTE =     
+       "       <pr:Identification xmlns:pr=\"" + PD_NS_URI + "\">" + NL +
+       "         <pr:Value>{0}</pr:Value>" + NL +
+       "         <pr:Type>{1}</pr:Type>" + NL +
+       "       </pr:Identification>" + NL;
+  
+  /**
+   * The number of SAML attributes included in this AUTH-Block (without the extended SAML attributes).
+   */
+  public static final int NUM_OF_SAML_ATTRIBUTES = 3;
+  
+  /**
+   * Constructor for AuthenticationBlockAssertionBuilder.
+   */
+  public AuthenticationBlockAssertionBuilder() {
+    super();
+  }
+  
+  /**
+   * Builds the authentication block <code>&lt;saml:Assertion&gt;</code> 
+   * 
+   * @param issuer authentication block issuer; <code>"GivenName FamilyName"</code>
+   * @param issueInstant current timestamp
+   * @param authURL URL of MOA-ID authentication component
+   * @param target "Gesch&auml;ftsbereich"; maybe <code>null</code> if the application
+   *               is a business application
+   * @param identityLinkValue the content of the <code>&lt;pr:Value&gt;</code>
+   *                          child element of the <code>&lt;pr:Identification&gt;</code>
+   *                          element derived from the Identitylink; this is the
+   *                          value of the <code>wbPK</code>;
+   *                          maybe <code>null</code> if the application is a public service
+   * @param identityLinkType  the content of the <code>&lt;pr:Type&gt;</code>
+   *                          child element of the <code>&lt;pr:Identification&gt;</code>
+   *                          element derived from the Identitylink; this includes the
+   *                          URN prefix and the identification number of the business
+   *                          application used as input for wbPK computation;
+   *                          maybe <code>null</code> if the application is a public service
+   * @param oaURL public URL of online application requested
+   * @param gebDat The date of birth from the identity link.
+   * @param extendedSAMLAttributes The SAML attributes to be appended to the AUTHBlock.
+   * 
+   * @return String representation of authentication block 
+   *          <code>&lt;saml:Assertion&gt;</code> built
+   *          
+   * @throws BuildException If an error occurs on serializing an extended SAML attribute 
+   *                        to be appended to the AUTH-Block.
+   */
+  public String buildAuthBlock(
+    String issuer, 
+    String issueInstant, 
+    String authURL, 
+    String target,
+    String identityLinkValue, 
+    String identityLinkType,
+    String oaURL, 
+    String gebDat,
+    List extendedSAMLAttributes,
+    AuthenticationSession session)
+  throws BuildException
+  {
+    session.setSAMLAttributeGebeORwbpk(true);
+    String gebeORwbpk = "";
+    String wbpkNSDeclaration = "";
+    
+    //BZ.., reading OA parameters
+    OAAuthParameter oaParam;
+   try {
+      oaParam = AuthConfigurationProvider.getInstance().getOnlineApplicationParameter(
+           session.getPublicOAURLPrefix());
+   } catch (ConfigurationException e) {
+      Logger.error("Error on building AUTH-Block: " + e.getMessage());
+         throw new BuildException("builder.00", new Object[] { "AUTH-Block", e.toString()});
+   }
+   //..BZ
+    
+    
+    if (target == null) {
+      // OA is a business application
+      if (!Constants.URN_PREFIX_HPI.equals(identityLinkType)) {
+        // Only add wbPKs to AUTH-Block. HPIs can be added to the AUTH-Block by the corresponding Validator
+         gebeORwbpk = MessageFormat.format(WBPK_ATTRIBUTE, new Object[] { identityLinkValue, identityLinkType });
+         wbpkNSDeclaration = " xmlns:pr=\"" + PD_NS_URI + "\"";
+         
+         //BZ.., adding type of wbPK domain identifier        
+        ExtendedSAMLAttribute idLinkDomainIdentifierTypeAttribute = 
+             new ExtendedSAMLAttributeImpl("IdentityLinkDomainIdentifierType", oaParam.getIdentityLinkDomainIdentifierType(), Constants.MOA_NS_URI, ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY);
+            
+        extendedSAMLAttributes.add(idLinkDomainIdentifierTypeAttribute);
+        //..BZ
+         
+      } else {
+        // We do not have a wbPK, therefore no SAML-Attribute is provided
+        session.setSAMLAttributeGebeORwbpk(false);
+      }
+    } else {
+      // OA is a govermental application
+      //BZ..
+      String sectorName = TargetToSectorNameMapper.getSectorNameViaTarget(target);      
+      //gebeORwbpk = MessageFormat.format(GESCHAEFTS_BEREICH_ATTRIBUTE, new Object[] { target });
+      gebeORwbpk = MessageFormat.format(GESCHAEFTS_BEREICH_ATTRIBUTE, new Object[] { target + " (" + sectorName + ")" });
+      //..BZ
+      
+      //BZ.., no business service, adding bPK
+      
+      Element bpkSamlValueElement;
+      try {
+         bpkSamlValueElement = DOMUtils.parseDocument(MessageFormat.format(PR_IDENTIFICATION_ATTRIBUTE, new Object[] { identityLinkValue, Constants.URN_PREFIX_BPK }), false, null, null).getDocumentElement();
+      } catch (Exception e) {
+         Logger.error("Error on building AUTH-Block: " + e.getMessage());
+          throw new BuildException("builder.00", new Object[] { "AUTH-Block", e.toString()});
+      } 
+      ExtendedSAMLAttribute bpkAttribute = 
+          new ExtendedSAMLAttributeImpl("bPK", bpkSamlValueElement, Constants.MOA_NS_URI, ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY);
+         
+     extendedSAMLAttributes.add(bpkAttribute);
+      //gebeORwbpk = gebeORwbpk  + MessageFormat.format(BPK_ATTRIBUTE, new Object[] { identityLinkValue, identityLinkType });
+     wbpkNSDeclaration = " xmlns:pr=\"" + PD_NS_URI + "\"";
+     //..BZ     
+    }
+    
+    //BZ.., adding friendly name of OA    
+    String oaFriendlyName = StringUtils.isEmpty(oaParam.getFriendlyName()) ? "" : oaParam.getFriendlyName(); 
+    
+    ExtendedSAMLAttribute oaFriendlyNameAttribute = 
+         new ExtendedSAMLAttributeImpl("oaFriendlyName", oaFriendlyName, Constants.MOA_NS_URI, ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY);
+    
+    extendedSAMLAttributes.add(oaFriendlyNameAttribute);
+    //..BZ
+    
+    String assertion;
+    try {
+      assertion = MessageFormat.format(
+        AUTH_BLOCK, new Object[] { 
+          wbpkNSDeclaration, 
+          issuer, 
+          issueInstant, 
+          authURL, 
+          gebeORwbpk, 
+          oaURL, 
+          gebDat,
+          buildExtendedSAMLAttributes(extendedSAMLAttributes)});
+    } catch (ParseException e) {
+      Logger.error("Error on building AUTH-Block: " + e.getMessage());
+      throw new BuildException("builder.00", new Object[] { "AUTH-Block", e.toString()});
+    }
+    
+    return assertion;
+    
+  }
+  
+  /**
+   * Builds the authentication block <code>&lt;saml:Assertion&gt;</code> 
+   * 
+   * @param issuer authentication block issuer; <code>"GivenName FamilyName"</code>
+   * @param issueInstant current timestamp
+   * @param authURL URL of MOA-ID authentication component
+   * @param target "Gesch&auml;ftsbereich"; maybe <code>null</code> if the application
+   *               is a business application
+   * @param identityLinkValue the content of the <code>&lt;pr:Value&gt;</code>
+   *                          child element of the <code>&lt;pr:Identification&gt;</code>
+   *                          element derived from the Identitylink; this is the
+   *                          value of the <code>wbPK</code>;
+   *                          maybe <code>null</code> if the application is a public service
+   * @param identityLinkType  the content of the <code>&lt;pr:Type&gt;</code>
+   *                          child element of the <code>&lt;pr:Identification&gt;</code>
+   *                          element derived from the Identitylink; this includes the
+   *                          URN prefix and the identification number of the business
+   *                          application used as input for wbPK computation;
+   *                          maybe <code>null</code> if the application is a public service
+   * @param oaURL public URL of online application requested
+   * @param gebDat The date of birth from the identity link.
+   * @param extendedSAMLAttributes The SAML attributes to be appended to the AUTHBlock.
+   * 
+   * @return String representation of authentication block 
+   *          <code>&lt;saml:Assertion&gt;</code> built
+   *          
+   * @throws BuildException If an error occurs on serializing an extended SAML attribute 
+   *                        to be appended to the AUTH-Block.
+   */
+  public String buildAuthBlockForeignID(
+    String issuer, 
+    String issueInstant, 
+    String authURL, 
+    String target,
+    String identityLinkValue, 
+    String identityLinkType,
+    String oaURL, 
+    String gebDat,
+    List extendedSAMLAttributes,
+    AuthenticationSession session)
+  throws BuildException
+  {
+    session.setSAMLAttributeGebeORwbpk(true);
+    String gebeORwbpk = "";
+    String wbpkNSDeclaration = "";
+    
+    //BZ.., reading OA parameters
+    OAAuthParameter oaParam;
+   try {
+      oaParam = AuthConfigurationProvider.getInstance().getOnlineApplicationParameter(
+           session.getPublicOAURLPrefix());
+   } catch (ConfigurationException e) {
+      Logger.error("Error on building AUTH-Block: " + e.getMessage());
+         throw new BuildException("builder.00", new Object[] { "AUTH-Block", e.toString()});
+   }
+   //..BZ
+    
+    
+    if (target == null) {
+      // OA is a business application
+      if (!Constants.URN_PREFIX_HPI.equals(identityLinkType)) {
+        // Only add wbPKs to AUTH-Block. HPIs can be added to the AUTH-Block by the corresponding Validator
+         gebeORwbpk = MessageFormat.format(WBPK_ATTRIBUTE, new Object[] { identityLinkValue, identityLinkType });
+         wbpkNSDeclaration = " xmlns:pr=\"" + PD_NS_URI + "\"";
+         
+         //BZ.., adding type of wbPK domain identifier        
+        ExtendedSAMLAttribute idLinkDomainIdentifierTypeAttribute = 
+             new ExtendedSAMLAttributeImpl("IdentityLinkDomainIdentifierType", oaParam.getIdentityLinkDomainIdentifierType(), Constants.MOA_NS_URI, ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY);
+            
+        extendedSAMLAttributes.add(idLinkDomainIdentifierTypeAttribute);
+        //..BZ
+         
+      } else {
+        // We do not have a wbPK, therefore no SAML-Attribute is provided
+        session.setSAMLAttributeGebeORwbpk(false);
+      }
+    } else {
+      // OA is a govermental application
+      //BZ..
+      String sectorName = TargetToSectorNameMapper.getSectorNameViaTarget(target);      
+      //gebeORwbpk = MessageFormat.format(GESCHAEFTS_BEREICH_ATTRIBUTE, new Object[] { target });
+      gebeORwbpk = MessageFormat.format(GESCHAEFTS_BEREICH_ATTRIBUTE, new Object[] { target + " (" + sectorName + ")" });
+      //..BZ
+      
+      //BZ.., no business service, adding bPK
+      
+      Element bpkSamlValueElement;
+      try {
+         bpkSamlValueElement = DOMUtils.parseDocument(MessageFormat.format(PR_IDENTIFICATION_ATTRIBUTE, new Object[] { identityLinkValue, Constants.URN_PREFIX_BPK }), false, null, null).getDocumentElement();
+      } catch (Exception e) {
+         Logger.error("Error on building AUTH-Block: " + e.getMessage());
+          throw new BuildException("builder.00", new Object[] { "AUTH-Block", e.toString()});
+      } 
+      ExtendedSAMLAttribute bpkAttribute = 
+          new ExtendedSAMLAttributeImpl("bPK", bpkSamlValueElement, Constants.MOA_NS_URI, ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY);
+         
+     extendedSAMLAttributes.add(bpkAttribute);
+      //gebeORwbpk = gebeORwbpk  + MessageFormat.format(BPK_ATTRIBUTE, new Object[] { identityLinkValue, identityLinkType });
+     wbpkNSDeclaration = " xmlns:pr=\"" + PD_NS_URI + "\"";
+     //..BZ     
+    }
+    
+    //BZ.., adding friendly name of OA    
+    String oaFriendlyName = StringUtils.isEmpty(oaParam.getFriendlyName()) ? "" : oaParam.getFriendlyName(); 
+    
+    ExtendedSAMLAttribute oaFriendlyNameAttribute = 
+         new ExtendedSAMLAttributeImpl("oaFriendlyName", oaFriendlyName, Constants.MOA_NS_URI, ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY);
+    
+    extendedSAMLAttributes.add(oaFriendlyNameAttribute);
+    //..BZ
+    
+    String assertion;
+    try {
+      assertion = MessageFormat.format(
+        AUTH_BLOCK, new Object[] { 
+          wbpkNSDeclaration, 
+          issuer, 
+          issueInstant, 
+          authURL, 
+          gebeORwbpk, 
+          oaURL, 
+          gebDat,
+          buildExtendedSAMLAttributes(extendedSAMLAttributes)});
+    } catch (ParseException e) {
+      Logger.error("Error on building AUTH-Block: " + e.getMessage());
+      throw new BuildException("builder.00", new Object[] { "AUTH-Block", e.toString()});
+    }
+    
+    return assertion;
+    
+  }
+
+}