aboutsummaryrefslogtreecommitdiff
path: root/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
diff options
context:
space:
mode:
Diffstat (limited to 'id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java')
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java398
1 files changed, 295 insertions, 103 deletions
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
index a8a7d0c51..52488c3cb 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
@@ -31,7 +31,6 @@ import java.security.PrivateKey;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Date;
-import java.util.Iterator;
import java.util.List;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@@ -66,6 +65,7 @@ import at.gv.egovernment.moa.id.auth.data.IdentityLink;
import at.gv.egovernment.moa.id.auth.data.VerifyXMLSignatureResponse;
import at.gv.egovernment.moa.id.auth.exception.BuildException;
import at.gv.egovernment.moa.id.auth.exception.DynamicOABuildException;
+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
import at.gv.egovernment.moa.id.auth.exception.ParseException;
import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser;
@@ -78,6 +78,7 @@ import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters;
import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
import at.gv.egovernment.moa.id.data.AuthenticationData;
+import at.gv.egovernment.moa.id.data.AuthenticationRoleFactory;
import at.gv.egovernment.moa.id.data.IAuthData;
import at.gv.egovernment.moa.id.moduls.IRequest;
import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;
@@ -95,6 +96,7 @@ import at.gv.egovernment.moa.id.protocols.saml1.SAML1AuthenticationData;
import at.gv.egovernment.moa.id.protocols.saml1.SAML1RequestImpl;
import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;
import at.gv.egovernment.moa.id.util.IdentityLinkReSigner;
+import at.gv.egovernment.moa.id.util.PVPtoSTORKMapper;
import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
import at.gv.egovernment.moa.id.util.client.mis.simple.MISMandate;
import at.gv.egovernment.moa.logging.Logger;
@@ -102,6 +104,11 @@ import at.gv.egovernment.moa.util.Base64Utils;
import at.gv.egovernment.moa.util.Constants;
import at.gv.egovernment.moa.util.MiscUtil;
import at.gv.egovernment.moa.util.XPathUtils;
+import at.gv.util.client.szr.SZRClient;
+import at.gv.util.config.EgovUtilPropertiesConfiguration;
+import at.gv.util.ex.EgovUtilException;
+import at.gv.util.wsdl.szr.SZRException;
+import at.gv.util.xsd.szr.PersonInfoType;
/**
* @author tlenz
@@ -170,7 +177,11 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
//get OnlineApplication from MOA-ID-Auth configuration
oaParam = AuthConfigurationProvider.getInstance()
.getOnlineApplicationParameter(oaID);
-
+
+ //build OA dynamically from STROK request if this OA is used as STORK<->PVP gateway
+ if (oaParam.isSTORKPVPGateway())
+ oaParam = DynamicOAAuthParameterBuilder.buildFromAuthnRequest(oaParam, protocolRequest);
+
} else {
//build OnlineApplication dynamic from requested attributes
oaParam = DynamicOAAuthParameterBuilder.buildFromAttributeQuery(reqAttributes, interfIDP);
@@ -342,23 +353,46 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
Logger.debug("Build AuthData from assertion starts ....");
- authData.setFamilyName(extractor.getAttribute(PVPConstants.PRINCIPAL_NAME_NAME));
- authData.setGivenName(extractor.getAttribute(PVPConstants.GIVEN_NAME_NAME));
- authData.setDateOfBirth(extractor.getAttribute(PVPConstants.BIRTHDATE_NAME));
- authData.setBPKType(extractor.getAttribute(PVPConstants.EID_SECTOR_FOR_IDENTIFIER_NAME));
- authData.setCcc(extractor.getAttribute(PVPConstants.EID_ISSUING_NATION_NAME));
- authData.setBkuURL(extractor.getAttribute(PVPConstants.EID_CCS_URL_NAME));
- authData.setIdentificationValue(extractor.getAttribute(PVPConstants.EID_SOURCE_PIN_NAME));
- authData.setIdentificationType(extractor.getAttribute(PVPConstants.EID_SOURCE_PIN_TYPE_NAME));
+ authData.setIsBusinessService(oaParam.getBusinessService());
+
+ authData.setFamilyName(extractor.getSingleAttributeValue(PVPConstants.PRINCIPAL_NAME_NAME));
+ authData.setGivenName(extractor.getSingleAttributeValue(PVPConstants.GIVEN_NAME_NAME));
+ authData.setDateOfBirth(extractor.getSingleAttributeValue(PVPConstants.BIRTHDATE_NAME));
+ authData.setBPKType(extractor.getSingleAttributeValue(PVPConstants.EID_SECTOR_FOR_IDENTIFIER_NAME));
+ authData.setCcc(extractor.getSingleAttributeValue(PVPConstants.EID_ISSUING_NATION_NAME));
+ authData.setBkuURL(extractor.getSingleAttributeValue(PVPConstants.EID_CCS_URL_NAME));
+ authData.setIdentificationValue(extractor.getSingleAttributeValue(PVPConstants.EID_SOURCE_PIN_NAME));
+ authData.setIdentificationType(extractor.getSingleAttributeValue(PVPConstants.EID_SOURCE_PIN_TYPE_NAME));
if (extractor.containsAttribute(PVPConstants.BPK_NAME)) {
- String pvpbPK = extractor.getAttribute(PVPConstants.BPK_NAME);
- authData.setBPK(pvpbPK.split(":")[1]);
+ String pvpbPK = extractor.getSingleAttributeValue(PVPConstants.BPK_NAME);
+ String[] spitted = pvpbPK.split(":");
+ authData.setBPK(spitted[1]);
+ if (MiscUtil.isEmpty(authData.getBPKType())) {
+ Logger.debug("PVP assertion contains NO bPK/wbPK target attribute. " +
+ "Starting target extraction from bPK/wbPK prefix ...");
+ //exract bPK/wbPK type from bpk attribute value prefix if type is
+ //not transmitted as single attribute
+ Pattern pattern = Pattern.compile("[a-zA-Z]{2}(-[a-zA-Z]+)?");
+ Matcher matcher = pattern.matcher(spitted[0]);
+ if (matcher.matches()) {
+ //find public service bPK
+ authData.setBPKType(Constants.URN_PREFIX_CDID + "+" + spitted[0]);
+ Logger.debug("Found bPK prefix. Set target to " + authData.getBPKType());
+
+ } else {
+ //find business service wbPK
+ authData.setBPKType(Constants.URN_PREFIX_WBPK+ "+" + spitted[0]);
+ Logger.debug("Found wbPK prefix. Set target to " + authData.getBPKType());
+
+ }
+ }
}
+ boolean foundEncryptedbPKForOA = false;
if (extractor.containsAttribute(PVPConstants.ENC_BPK_LIST_NAME)) {
List<String> encbPKList = Arrays.asList(
- extractor.getAttribute(PVPConstants.ENC_BPK_LIST_NAME).split(";"));
+ extractor.getSingleAttributeValue(PVPConstants.ENC_BPK_LIST_NAME).split(";"));
authData.setEncbPKList(encbPKList);
for (String fullEncbPK : encbPKList) {
int index = fullEncbPK.indexOf("|");
@@ -372,6 +406,7 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
+ oaParam.getPublicURLPrefix()
+ " Start decryption process ...");
PrivateKey privKey = oaParam.getBPKDecBpkDecryptionKey();
+ foundEncryptedbPKForOA = true;
if (privKey != null) {
try {
String bPK = BPKBuilder.decryptBPK(encbPK, oaParam.getTarget(), privKey);
@@ -406,20 +441,129 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
}
}
- if (MiscUtil.isEmpty(authData.getBPK()) && authData.getEncbPKList().size() == 0) {
- Logger.error("Federated assertion include no bPK or encrypted bPK");
+ if (MiscUtil.isEmpty(authData.getIdentificationValue()) &&
+ MiscUtil.isEmpty(authData.getBPK()) &&
+ !foundEncryptedbPKForOA) {
+ Logger.info("Federated assertion include no bPK, encrypted bPK or baseID");
throw new AssertionAttributeExtractorExeption("No " + PVPConstants.BPK_FRIENDLY_NAME
- + " or " + PVPConstants.ENC_BPK_LIST_FRIENDLY_NAME);
+ + " or " + PVPConstants.EID_SOURCE_PIN_NAME
+ + " or " + PVPConstants.ENC_BPK_LIST_NAME);
}
- if (extractor.containsAttribute(PVPConstants.EID_CITIZEN_QAA_LEVEL_NAME))
- authData.setQAALevel(PVPConstants.STORK_QAA_PREFIX +
- extractor.getAttribute(PVPConstants.EID_CITIZEN_QAA_LEVEL_NAME));
+ //check if received bPK matchs to online application configuration
+ //and no encrypted bPK is found for this oa
+ if (!matchsReceivedbPKToOnlineApplication(oaParam, authData)
+ && !foundEncryptedbPKForOA) {
+ Logger.info("Received bPK/wbPK does not match to online application");
+
+ if (MiscUtil.isEmpty(authData.getIdentificationValue())) {
+ Logger.info("No baseID found. Connect SZR to reveive baseID ...");
+ try {
+ EgovUtilPropertiesConfiguration eGovClientsConfig = AuthConfigurationProvider.getInstance().geteGovUtilsConfig();
+ if (eGovClientsConfig != null) {
+ SZRClient szrclient = new SZRClient(eGovClientsConfig);
+
+ Logger.debug("Create SZR request to get baseID ... ");
+ PersonInfoType personInfo = new PersonInfoType();
+ at.gv.util.xsd.szr.persondata.PhysicalPersonType person = new at.gv.util.xsd.szr.persondata.PhysicalPersonType();
+ personInfo.setPerson(person);
+ at.gv.util.xsd.szr.persondata.PersonNameType name = new at.gv.util.xsd.szr.persondata.PersonNameType();
+ person.setName(name);
+ at.gv.util.xsd.szr.persondata.IdentificationType idValue = new at.gv.util.xsd.szr.persondata.IdentificationType();
+ person.setIdentification(idValue);
+
+ //set bPK or wbPK
+ idValue.setValue(authData.getBPK());
+ idValue.setType(authData.getBPKType());
+
+ //set person information
+ name.setGivenName(authData.getGivenName());
+ name.setFamilyName(authData.getFamilyName());
+ if (authData.getDateOfBirth() != null)
+ person.setDateOfBirth(authData.getFormatedDateOfBirth());
+
+ //request szr and store baseID
+ authData.setIdentificationValue(szrclient.getStammzahl(personInfo));
+ authData.setIdentificationType(Constants.URN_PREFIX_BASEID);
+
+ } else {
+ Logger.warn("No SZR clieht configuration found. Interfederation SSO login not possible.");
+ throw new AssertionAttributeExtractorExeption("No " + PVPConstants.BPK_FRIENDLY_NAME
+ + " or " + PVPConstants.EID_SOURCE_PIN_NAME);
+
+ }
+
+ } catch (ConfigurationException e) {
+ Logger.warn("SZR connection FAILED. Interfederation SSO login not possible.", e);
+ throw new AssertionAttributeExtractorExeption("No " + PVPConstants.BPK_FRIENDLY_NAME
+ + " or " + PVPConstants.EID_SOURCE_PIN_NAME);
+
+ } catch (EgovUtilException e) {
+ Logger.warn("SZR connection FAILED. Interfederation SSO login not possible.", e);
+ throw new AssertionAttributeExtractorExeption("No " + PVPConstants.BPK_FRIENDLY_NAME
+ + " or " + PVPConstants.EID_SOURCE_PIN_NAME);
+
+ } catch (SZRException e) {
+ Logger.warn("SZR connection FAILED. Interfederation SSO login not possible.", e);
+ throw new AssertionAttributeExtractorExeption("No " + PVPConstants.BPK_FRIENDLY_NAME
+ + " or " + PVPConstants.EID_SOURCE_PIN_NAME);
+
+ }
+ }
+
+ //build OA specific bPK/wbPK information
+ buildOAspecificbPK(oaParam, authData,
+ authData.getIdentificationValue(),
+ authData.getIdentificationType());
+
+ }
+
+ if (MiscUtil.isEmpty(authData.getBPK())) {
+ Logger.debug("Calcutlate bPK from baseID");
+ buildOAspecificbPK(oaParam, authData,
+ authData.getIdentificationValue(),
+ authData.getIdentificationType());
+
+ }
+
+ try {
+ String qaaLevel = extractor.getQAALevel();
+ if (MiscUtil.isNotEmpty(qaaLevel) &&
+ qaaLevel.startsWith(PVPConstants.STORK_QAA_PREFIX)) {
+ authData.setQAALevel(qaaLevel);
+
+ } else {
+ Logger.debug("Found PVP QAA level. QAA mapping process starts ... ");
+ String mappedQAA = PVPtoSTORKMapper.getInstance().mapQAALevel(qaaLevel);
+ if (MiscUtil.isNotEmpty(mappedQAA))
+ authData.setQAALevel(mappedQAA);
+
+ else
+ throw new AssertionAttributeExtractorExeption("PVP SecClass not mappable");
+
+ }
+
+ } catch (AssertionAttributeExtractorExeption e) {
+ Logger.warn("No QAA level found in <RequestedAuthnContext> element of interfederated assertion. " +
+ "(ErrorHeader=" + e.getMessage() + ")");
+ if (extractor.containsAttribute(PVPConstants.EID_CITIZEN_QAA_LEVEL_NAME)) {
+ authData.setQAALevel(PVPConstants.STORK_QAA_PREFIX +
+ extractor.getSingleAttributeValue(PVPConstants.EID_CITIZEN_QAA_LEVEL_NAME));
+
+ } else {
+ Logger.info("No QAA level found. Set to default level " +
+ PVPConstants.STORK_QAA_PREFIX + "1");
+ authData.setQAALevel(PVPConstants.STORK_QAA_PREFIX + "1");
+
+ }
+
+ }
+
if (extractor.containsAttribute(PVPConstants.EID_AUTH_BLOCK_NAME)) {
try {
- byte[] authBlock = Base64Utils.decode(extractor.getAttribute(PVPConstants.EID_AUTH_BLOCK_NAME), false);
+ byte[] authBlock = Base64Utils.decode(extractor.getSingleAttributeValue(PVPConstants.EID_AUTH_BLOCK_NAME), false);
authData.setAuthBlock(new String(authBlock, "UTF-8"));
} catch (IOException e) {
@@ -431,7 +575,7 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
if (extractor.containsAttribute(PVPConstants.EID_SIGNER_CERTIFICATE_NAME)) {
try {
authData.setSignerCertificate(Base64Utils.decode(
- extractor.getAttribute(PVPConstants.EID_SIGNER_CERTIFICATE_NAME), false));
+ extractor.getSingleAttributeValue(PVPConstants.EID_SIGNER_CERTIFICATE_NAME), false));
} catch (IOException e) {
Logger.error("Received SignerCertificate is not valid", e);
@@ -441,10 +585,10 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
if (extractor.containsAttribute(PVPConstants.EID_IDENTITY_LINK_NAME)) {
try {
- InputStream idlStream = Base64Utils.decodeToStream(extractor.getAttribute(PVPConstants.EID_IDENTITY_LINK_NAME), false);
+ InputStream idlStream = Base64Utils.decodeToStream(extractor.getSingleAttributeValue(PVPConstants.EID_IDENTITY_LINK_NAME), false);
IdentityLink idl = new IdentityLinkAssertionParser(idlStream).parseIdentityLink();
- authData.setIdentityLink(idl);
-
+ buildOAspecificIdentityLink(oaParam, authData, idl);
+
} catch (ParseException e) {
Logger.error("Received IdentityLink is not valid", e);
@@ -456,12 +600,12 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
// set mandate attributes
- authData.setMandateReferenceValue(extractor.getAttribute(PVPConstants.MANDATE_REFERENCE_VALUE_NAME));
+ authData.setMandateReferenceValue(extractor.getSingleAttributeValue(PVPConstants.MANDATE_REFERENCE_VALUE_NAME));
if (extractor.containsAttribute(PVPConstants.MANDATE_FULL_MANDATE_NAME)) {
try {
byte[] mandate = Base64Utils.decode(
- (extractor.getAttribute(PVPConstants.MANDATE_FULL_MANDATE_NAME)), false);
+ (extractor.getSingleAttributeValue(PVPConstants.MANDATE_FULL_MANDATE_NAME)), false);
if (authData.getMISMandate() == null)
authData.setMISMandate(new MISMandate());
@@ -502,9 +646,9 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
legalperson.getIdentification().add(legalID );
mandator.setCorporateBody(legalperson );
- legalperson.setFullName(extractor.getAttribute(PVPConstants.MANDATE_LEG_PER_FULL_NAME_NAME));
- legalID.setType(extractor.getAttribute(PVPConstants.MANDATE_LEG_PER_SOURCE_PIN_TYPE_NAME));
- idvalue.setValue(extractor.getAttribute(PVPConstants.MANDATE_LEG_PER_SOURCE_PIN_NAME));
+ legalperson.setFullName(extractor.getSingleAttributeValue(PVPConstants.MANDATE_LEG_PER_FULL_NAME_NAME));
+ legalID.setType(extractor.getSingleAttributeValue(PVPConstants.MANDATE_LEG_PER_SOURCE_PIN_TYPE_NAME));
+ idvalue.setValue(extractor.getSingleAttributeValue(PVPConstants.MANDATE_LEG_PER_SOURCE_PIN_NAME));
//build natural person short mandate
} else if ( (extractor.containsAttribute(PVPConstants.MANDATE_NAT_PER_SOURCE_PIN_NAME) ||
@@ -524,18 +668,18 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
Value idValue = new Value();
persID.setValue(idValue );
- String[] pvp2GivenName = extractor.getAttribute(PVPConstants.MANDATE_NAT_PER_GIVEN_NAME_NAME).split(" ");
+ String[] pvp2GivenName = extractor.getSingleAttributeValue(PVPConstants.MANDATE_NAT_PER_GIVEN_NAME_NAME).split(" ");
for(int i=0; i<pvp2GivenName.length; i++)
persName.getGivenName().add(pvp2GivenName[i]);
- familyName.setValue(extractor.getAttribute(PVPConstants.MANDATE_NAT_PER_FAMILY_NAME_NAME));
- physPerson.setDateOfBirth(extractor.getAttribute(PVPConstants.MANDATE_NAT_PER_BIRTHDATE_NAME));
+ familyName.setValue(extractor.getSingleAttributeValue(PVPConstants.MANDATE_NAT_PER_FAMILY_NAME_NAME));
+ physPerson.setDateOfBirth(extractor.getSingleAttributeValue(PVPConstants.MANDATE_NAT_PER_BIRTHDATE_NAME));
if (extractor.containsAttribute(PVPConstants.MANDATE_NAT_PER_SOURCE_PIN_NAME)) {
persID.setType(Constants.URN_PREFIX_BASEID);
- idValue.setValue(extractor.getAttribute(PVPConstants.MANDATE_NAT_PER_SOURCE_PIN_NAME));
+ idValue.setValue(extractor.getSingleAttributeValue(PVPConstants.MANDATE_NAT_PER_SOURCE_PIN_NAME));
} else {
- String[] pvp2bPK = extractor.getAttribute(PVPConstants.MANDATE_NAT_PER_BPK_NAME).split(":");
+ String[] pvp2bPK = extractor.getSingleAttributeValue(PVPConstants.MANDATE_NAT_PER_BPK_NAME).split(":");
if (pvp2bPK.length == 2) {
idValue.setValue(pvp2bPK[1]);
@@ -547,7 +691,7 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
persID.setType(Constants.URN_PREFIX_WBPK + "+" + pvp2bPK[0]);
} else {
- Logger.warn("Receive mandator bPK from federation with an unsupported format. " + extractor.getAttribute(PVPConstants.MANDATE_NAT_PER_BPK_NAME));
+ Logger.warn("Receive mandator bPK from federation with an unsupported format. " + extractor.getSingleAttributeValue(PVPConstants.MANDATE_NAT_PER_BPK_NAME));
throw new AssertionAttributeExtractorExeption("Receive mandator bPK from federation with an unsupported format.");
}
@@ -585,14 +729,25 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
if (authData.getMISMandate() == null)
authData.setMISMandate(new MISMandate());
authData.getMISMandate().setProfRep(
- extractor.getAttribute(PVPConstants.MANDATE_PROF_REP_OID_NAME));
+ extractor.getSingleAttributeValue(PVPConstants.MANDATE_PROF_REP_OID_NAME));
}
-
+
+ //set PVP role attribute
+ if (extractor.containsAttribute(PVPConstants.ROLES_NAME)) {
+ String pvpRoles = extractor.getSingleAttributeValue(PVPConstants.ROLES_NAME);
+ if (MiscUtil.isNotEmpty(pvpRoles)) {
+ List<String> roles = Arrays.asList(pvpRoles.split(";"));
+ for (String role : roles) {
+ authData.addAuthenticationRole(AuthenticationRoleFactory.buildFormPVPole(role));
+ }
+ }
+ }
+
//set STORK attributes
if (extractor.containsAttribute(PVPConstants.EID_STORK_TOKEN_NAME)) {
- authData.setStorkAuthnResponse(extractor.getAttribute(PVPConstants.EID_STORK_TOKEN_NAME));
+ authData.setStorkAuthnResponse(extractor.getSingleAttributeValue(PVPConstants.EID_STORK_TOKEN_NAME));
authData.setForeigner(true);
}
@@ -604,6 +759,7 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
}
authData.setSsoSession(true);
+ authData.setInterfederatedSSOSession(true);
if (extractor.getFullAssertion().getConditions() != null && extractor.getFullAssertion().getConditions().getNotOnOrAfter() != null)
authData.setSsoSessionValidTo(extractor.getFullAssertion().getConditions().getNotOnOrAfter().toDate());
@@ -616,17 +772,45 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
authData.setPublicAuthority(false);
}
+ /**
+ * @param oaParam
+ * @param authData
+ * @return
+ */
+ private static boolean matchsReceivedbPKToOnlineApplication(
+ IOAAuthParameters oaParam, AuthenticationData authData) {
+
+ String oaTarget = null;
+ if (oaParam.getBusinessService()) {
+ if (oaParam.getIdentityLinkDomainIdentifier().startsWith(Constants.URN_PREFIX_WBPK) ||
+ oaParam.getIdentityLinkDomainIdentifier().startsWith(Constants.URN_PREFIX_STORK))
+ oaTarget = oaParam.getIdentityLinkDomainIdentifier();
+
+ else {
+ Logger.warn("BusinessIdentifier can not be clearly assigned, because it starts without a prefix.");
+ return false;
+
+ }
+
+ } else {
+ oaTarget = Constants.URN_PREFIX_CDID + "+" + oaParam.getTarget();
+
+ }
+
+
+ if (oaTarget.equals(authData.getBPKType()))
+ return true;
+ else
+ return false;
+ }
+
private static void buildAuthDataFormMOASession(AuthenticationData authData, AuthenticationSession session,
IOAAuthParameters oaParam) throws BuildException, ConfigurationException {
-
- String target = oaParam.getTarget();
IdentityLink identityLink = session.getIdentityLink();
VerifyXMLSignatureResponse verifyXMLSigResp = session.getXMLVerifySignatureResponse();
- boolean businessService = oaParam.getBusinessService();
-
authData.setIssuer(session.getAuthURL());
//baseID or wbpk in case of BusinessService without SSO or BusinessService SSO
@@ -661,6 +845,8 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
authData.setForeigner(session.isForeigner());
authData.setQAALevel(session.getQAALevel());
+ authData.setIsBusinessService(oaParam.getBusinessService());
+
if (session.isForeigner()) {
try {
//TODO: replace with TSL lookup when TSL is ready!
@@ -733,67 +919,12 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
Logger.trace("Authenticated User is OW: " + mandate.getOWbPK());
} else {
-
- if (businessService) {
- //since we have foreigner, wbPK is not calculated in BKU
- if (identityLink.getIdentificationType().equals(Constants.URN_PREFIX_BASEID)) {
-
- String registerAndOrdNr = oaParam.getIdentityLinkDomainIdentifier();
-
- if (registerAndOrdNr.startsWith(AuthenticationSession.REGISTERANDORDNR_PREFIX_)) {
- // If domainIdentifier starts with prefix
- // "urn:publicid:gv.at:wbpk+"; remove this prefix
- registerAndOrdNr = registerAndOrdNr
- .substring(AuthenticationSession.REGISTERANDORDNR_PREFIX_.length());
- Logger.debug("Register and ordernumber prefix stripped off; resulting register string: "
- + registerAndOrdNr);
- }
-
- String wbpkBase64 = new BPKBuilder().buildWBPK(identityLink.getIdentificationValue(), registerAndOrdNr);
- authData.setBPK(wbpkBase64);
- authData.setBPKType(Constants.URN_PREFIX_WBPK + "+" + registerAndOrdNr);
-
- } else {
- authData.setBPK(identityLink.getIdentificationValue());
- authData.setBPKType(identityLink.getIdentificationType());
-
- }
-
- Logger.trace("Authenticate user with wbPK " + authData.getBPK());
-
- Element idlassertion = session.getIdentityLink().getSamlAssertion();
- //set bpk/wpbk;
- Node prIdentification = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_IDENT_VALUE_XPATH);
- prIdentification.getFirstChild().setNodeValue(authData.getBPK());
- //set bkp/wpbk type
- Node prIdentificationType = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_IDENT_TYPE_XPATH);
- prIdentificationType.getFirstChild().setNodeValue(authData.getBPKType());
-
- IdentityLinkAssertionParser idlparser = new IdentityLinkAssertionParser(idlassertion);
- IdentityLink idl = idlparser.parseIdentityLink();
-
- //resign IDL
- IdentityLinkReSigner identitylinkresigner = IdentityLinkReSigner.getInstance();
- Element resignedilAssertion;
- resignedilAssertion = identitylinkresigner.resignIdentityLink(idl.getSamlAssertion());
- IdentityLinkAssertionParser resignedIDLParser = new IdentityLinkAssertionParser(resignedilAssertion);
- IdentityLink resignedIDL = resignedIDLParser.parseIdentityLink();
-
- authData.setIdentityLink(resignedIDL);
-
- } else {
-
- if (identityLink.getIdentificationType().equals(Constants.URN_PREFIX_BASEID)) {
- // only compute bPK if online application is a public service and we have the Stammzahl
- String bpkBase64 = new BPKBuilder().buildBPK(identityLink.getIdentificationValue(), target);
- authData.setBPK(bpkBase64);
- authData.setBPKType(Constants.URN_PREFIX_CDID + "+" + oaParam.getTarget());
- }
-
- Logger.trace("Authenticate user with bPK " + authData.getBPK());
-
- authData.setIdentityLink(identityLink);
- }
+ buildOAspecificbPK(oaParam, authData,
+ identityLink.getIdentificationValue(),
+ identityLink.getIdentificationType());
+
+ buildOAspecificIdentityLink(oaParam, authData, identityLink);
+
}
@@ -803,4 +934,65 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
}
}
+
+ private static void buildOAspecificIdentityLink(IOAAuthParameters oaParam, AuthenticationData authData, IdentityLink idl) throws MOAIDException {
+ if (oaParam.getBusinessService()) {
+ Element idlassertion = idl.getSamlAssertion();
+ //set bpk/wpbk;
+ Node prIdentification = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_IDENT_VALUE_XPATH);
+ prIdentification.getFirstChild().setNodeValue(authData.getBPK());
+ //set bkp/wpbk type
+ Node prIdentificationType = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_IDENT_TYPE_XPATH);
+ prIdentificationType.getFirstChild().setNodeValue(authData.getBPKType());
+
+ IdentityLinkAssertionParser idlparser = new IdentityLinkAssertionParser(idlassertion);
+ IdentityLink businessServiceIdl = idlparser.parseIdentityLink();
+
+ //resign IDL
+ IdentityLinkReSigner identitylinkresigner = IdentityLinkReSigner.getInstance();
+ Element resignedilAssertion;
+ resignedilAssertion = identitylinkresigner.resignIdentityLink(businessServiceIdl.getSamlAssertion());
+ IdentityLinkAssertionParser resignedIDLParser = new IdentityLinkAssertionParser(resignedilAssertion);
+ IdentityLink resignedIDL = resignedIDLParser.parseIdentityLink();
+
+ authData.setIdentityLink(resignedIDL);
+
+ } else
+ authData.setIdentityLink(idl);
+
+
+ }
+
+ private static void buildOAspecificbPK(IOAAuthParameters oaParam, AuthenticationData authData, String baseID, String baseIDType) throws BuildException {
+
+ if (oaParam.getBusinessService()) {
+ //since we have foreigner, wbPK is not calculated in BKU
+ if (baseIDType.equals(Constants.URN_PREFIX_BASEID)) {
+ String registerAndOrdNr = oaParam.getIdentityLinkDomainIdentifier();
+ authData.setBPK(new BPKBuilder().buildbPKorwbPK(baseID, registerAndOrdNr));
+ authData.setBPKType(registerAndOrdNr);
+
+ } else {
+ authData.setBPK(baseID);
+ authData.setBPKType(baseIDType);
+
+ }
+
+ Logger.trace("Authenticate user with wbPK " + authData.getBPK());
+
+ } else {
+
+ if (baseIDType.equals(Constants.URN_PREFIX_BASEID)) {
+ // only compute bPK if online application is a public service and we have the Stammzahl
+ String bpkBase64 = new BPKBuilder().buildBPK(baseID, oaParam.getTarget());
+ authData.setBPK(bpkBase64);
+ authData.setBPKType(Constants.URN_PREFIX_CDID + "+" + oaParam.getTarget());
+ }
+
+ Logger.trace("Authenticate user with bPK " + authData.getBPK());
+ }
+
+
+ }
+
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-01 14:42:08 +0000