aboutsummaryrefslogtreecommitdiff
path: root/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
diff options
context:
space:
mode:
Diffstat (limited to 'id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java')
-rw-r--r--id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java523
1 files changed, 340 insertions, 183 deletions
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
index 9af2f5ee5..a8a7d0c51 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java
@@ -24,20 +24,26 @@ package at.gv.egovernment.moa.id.auth.builder;
import iaik.x509.X509Certificate;
+import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
+import java.security.PrivateKey;
import java.util.ArrayList;
+import java.util.Arrays;
import java.util.Date;
-import java.util.GregorianCalendar;
+import java.util.Iterator;
import java.util.List;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
import javax.naming.ldap.LdapName;
import javax.naming.ldap.Rdn;
+import javax.xml.bind.JAXBContext;
+import javax.xml.bind.JAXBException;
+import javax.xml.bind.Marshaller;
-import org.opensaml.saml2.core.Assertion;
import org.opensaml.saml2.core.Attribute;
import org.opensaml.saml2.core.AttributeQuery;
-import org.opensaml.saml2.core.AttributeStatement;
import org.opensaml.saml2.core.Response;
import org.opensaml.ws.soap.common.SOAPException;
import org.opensaml.xml.XMLObject;
@@ -45,11 +51,17 @@ import org.opensaml.xml.security.SecurityException;
import org.w3c.dom.Element;
import org.w3c.dom.Node;
-import eu.stork.peps.auth.commons.PersonalAttribute;
-import eu.stork.peps.auth.commons.PersonalAttributeList;
-
+import at.gv.e_government.reference.namespace.mandates._20040701_.Mandate;
+import at.gv.e_government.reference.namespace.mandates._20040701_.Mandator;
+import at.gv.e_government.reference.namespace.persondata._20020228_.CorporateBodyType;
+import at.gv.e_government.reference.namespace.persondata._20020228_.IdentificationType;
+import at.gv.e_government.reference.namespace.persondata._20020228_.IdentificationType.Value;
+import at.gv.e_government.reference.namespace.persondata._20020228_.PersonNameType;
+import at.gv.e_government.reference.namespace.persondata._20020228_.PersonNameType.FamilyName;
+import at.gv.e_government.reference.namespace.persondata._20020228_.PhysicalPersonType;
import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttribute;
import at.gv.egovernment.moa.id.auth.data.IdentityLink;
import at.gv.egovernment.moa.id.auth.data.VerifyXMLSignatureResponse;
import at.gv.egovernment.moa.id.auth.exception.BuildException;
@@ -75,6 +87,7 @@ import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.AssertionAttributeExt
import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.AssertionValidationExeption;
import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.AttributQueryException;
import at.gv.egovernment.moa.id.protocols.pvp2x.messages.MOARequest;
+import at.gv.egovernment.moa.id.protocols.pvp2x.utils.AssertionAttributeExtractor;
import at.gv.egovernment.moa.id.protocols.pvp2x.utils.MOASAMLSOAPClient;
import at.gv.egovernment.moa.id.protocols.pvp2x.verification.SAMLVerificationEngine;
import at.gv.egovernment.moa.id.protocols.pvp2x.verification.TrustEngineFactory;
@@ -116,7 +129,10 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
if (protocolRequest instanceof SAML1RequestImpl) {
//request is SAML1
SAML1AuthenticationData saml1authdata = new SAML1AuthenticationData();
- saml1authdata.setExtendedSAMLAttributesOA(session.getExtendedSAMLAttributesOA());
+ if (session.getExtendedSAMLAttributesOA() == null)
+ saml1authdata.setExtendedSAMLAttributesOA(new ArrayList<ExtendedSAMLAttribute>());
+ else
+ saml1authdata.setExtendedSAMLAttributesOA(session.getExtendedSAMLAttributesOA());
authdata = saml1authdata;
@@ -145,7 +161,6 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
}
}
-
}
InterfederationSessionStore interfIDP = AuthenticationSessionStoreage.searchInterfederatedIDPFORAttributeQueryWithSessionID(session);
@@ -235,59 +250,68 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
attributs = reqQueryAttr;
//IDP is a service provider IDP and request interfederated IDP to collect attributes
- } else {
-
- //TODO: check if response include attributes and map this attributes to requested attributes
-
+ } else {
//get PVP 2.1 attributes from protocol specific requested attributes
attributs = req.getRequestedAttributes();
}
- //collect attributes by using BackChannel communication
- String endpoint = idp.getIDPAttributQueryServiceURL();
- if (MiscUtil.isEmpty(endpoint)) {
- Logger.error("No AttributeQueryURL for interfederationIDP " + oaParam.getPublicURLPrefix());
- throw new ConfigurationException("No AttributeQueryURL for interfederationIDP " + oaParam.getPublicURLPrefix(), null);
- }
+ Response intfResp = (Response) req.getInterfederationResponse().getResponse();
+ AssertionAttributeExtractor extractor =
+ new AssertionAttributeExtractor(intfResp);
- //build attributQuery request
- AttributeQuery query =
- AttributQueryBuilder.buildAttributQueryRequest(interfIDP.getUserNameID(), endpoint, attributs);
+ if (!extractor.containsAllRequiredAttributes()) {
+ //collect attributes by using BackChannel communication
+ String endpoint = idp.getIDPAttributQueryServiceURL();
+ if (MiscUtil.isEmpty(endpoint)) {
+ Logger.error("No AttributeQueryURL for interfederationIDP " + oaParam.getPublicURLPrefix());
+ throw new ConfigurationException("No AttributeQueryURL for interfederationIDP " + oaParam.getPublicURLPrefix(), null);
+ }
+
+ //build attributQuery request
+ AttributeQuery query =
+ AttributQueryBuilder.buildAttributQueryRequest(interfIDP.getUserNameID(), endpoint, attributs);
- //build SOAP request
- List<XMLObject> xmlObjects = MOASAMLSOAPClient.send(endpoint, query);
+ //build SOAP request
+ List<XMLObject> xmlObjects = MOASAMLSOAPClient.send(endpoint, query);
- if (xmlObjects.size() == 0) {
- Logger.error("Receive emptry AttributeQuery response-body.");
- throw new AttributQueryException("Receive emptry AttributeQuery response-body.", null);
+ if (xmlObjects.size() == 0) {
+ Logger.error("Receive emptry AttributeQuery response-body.");
+ throw new AttributQueryException("Receive emptry AttributeQuery response-body.", null);
- }
+ }
- if (xmlObjects.get(0) instanceof Response) {
- Response intfResp = (Response) xmlObjects.get(0);
+ if (xmlObjects.get(0) instanceof Response) {
+ intfResp = (Response) xmlObjects.get(0);
- //validate PVP 2.1 response
- try {
- SAMLVerificationEngine engine = new SAMLVerificationEngine();
- engine.verifyResponse(intfResp, TrustEngineFactory.getSignatureKnownKeysTrustEngine());
+ //validate PVP 2.1 response
+ try {
+ SAMLVerificationEngine engine = new SAMLVerificationEngine();
+ engine.verifyResponse(intfResp, TrustEngineFactory.getSignatureKnownKeysTrustEngine());
- SAMLVerificationEngine.validateAssertion(intfResp, false);
+ SAMLVerificationEngine.validateAssertion(intfResp, false);
- } catch (Exception e) {
- Logger.warn("PVP 2.1 assertion validation FAILED.", e);
- throw new AssertionValidationExeption("PVP 2.1 assertion validation FAILED.", null, e);
+ } catch (Exception e) {
+ Logger.warn("PVP 2.1 assertion validation FAILED.", e);
+ throw new AssertionValidationExeption("PVP 2.1 assertion validation FAILED.", null, e);
+ }
+
+ } else {
+ Logger.error("Receive AttributeQuery response-body include no PVP 2.1 response");
+ throw new AttributQueryException("Receive AttributeQuery response-body include no PVP 2.1 response.", null);
+
}
- //parse response information to authData
- buildAuthDataFormInterfederationResponse(authdata, session, intfResp);
-
+ //create assertion attribute extractor from AttributeQuery response
+ extractor = new AssertionAttributeExtractor(intfResp);
+
} else {
- Logger.error("Receive AttributeQuery response-body include no PVP 2.1 response");
- throw new AttributQueryException("Receive AttributeQuery response-body include no PVP 2.1 response.", null);
+ Logger.info("Interfedation response include all attributes with are required. Skip AttributQuery request step. ");
}
-
+ //parse response information to authData
+ buildAuthDataFormInterfederationResponse(authdata, session, extractor, oaParam);
+
} catch (SOAPException e) {
throw new BuildException("builder.06", null, e);
@@ -309,146 +333,280 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
}
}
- private static void buildAuthDataFormInterfederationResponse(AuthenticationData authData, AuthenticationSession session,
- Response intfResp) throws BuildException, AssertionAttributeExtractorExeption {
+ private static void buildAuthDataFormInterfederationResponse(
+ AuthenticationData authData,
+ AuthenticationSession session,
+ AssertionAttributeExtractor extractor,
+ IOAAuthParameters oaParam)
+ throws BuildException, AssertionAttributeExtractorExeption {
Logger.debug("Build AuthData from assertion starts ....");
- Assertion assertion = intfResp.getAssertions().get(0);
+ authData.setFamilyName(extractor.getAttribute(PVPConstants.PRINCIPAL_NAME_NAME));
+ authData.setGivenName(extractor.getAttribute(PVPConstants.GIVEN_NAME_NAME));
+ authData.setDateOfBirth(extractor.getAttribute(PVPConstants.BIRTHDATE_NAME));
+ authData.setBPKType(extractor.getAttribute(PVPConstants.EID_SECTOR_FOR_IDENTIFIER_NAME));
+ authData.setCcc(extractor.getAttribute(PVPConstants.EID_ISSUING_NATION_NAME));
+ authData.setBkuURL(extractor.getAttribute(PVPConstants.EID_CCS_URL_NAME));
+ authData.setIdentificationValue(extractor.getAttribute(PVPConstants.EID_SOURCE_PIN_NAME));
+ authData.setIdentificationType(extractor.getAttribute(PVPConstants.EID_SOURCE_PIN_TYPE_NAME));
- if (assertion.getAttributeStatements().size() == 0) {
- Logger.warn("Can not build AuthData from Assertion. NO Attributes included.");
- throw new AssertionAttributeExtractorExeption("Can not build AuthData from Assertion. NO Attributes included.", null);
-
+ if (extractor.containsAttribute(PVPConstants.BPK_NAME)) {
+ String pvpbPK = extractor.getAttribute(PVPConstants.BPK_NAME);
+ authData.setBPK(pvpbPK.split(":")[1]);
}
- AttributeStatement attrStat = assertion.getAttributeStatements().get(0);
- for (Attribute attr : attrStat.getAttributes()) {
-
- if (attr.getName().equals(PVPConstants.PRINCIPAL_NAME_NAME))
- authData.setFamilyName(attr.getAttributeValues().get(0).getDOM().getTextContent());
-
- if (attr.getName().equals(PVPConstants.GIVEN_NAME_NAME))
- authData.setGivenName(attr.getAttributeValues().get(0).getDOM().getTextContent());
-
- if (attr.getName().equals(PVPConstants.BIRTHDATE_NAME))
- authData.setDateOfBirth(attr.getAttributeValues().get(0).getDOM().getTextContent());
-
- if (attr.getName().equals(PVPConstants.BPK_NAME)) {
- String pvpbPK = attr.getAttributeValues().get(0).getDOM().getTextContent();
- authData.setBPK(pvpbPK.split(":")[1]);
- }
-
- if (attr.getName().equals(PVPConstants.EID_SECTOR_FOR_IDENTIFIER_NAME))
- authData.setBPKType(attr.getAttributeValues().get(0).getDOM().getTextContent());
-
- if (attr.getName().equals(PVPConstants.EID_CITIZEN_QAA_LEVEL_NAME))
- authData.setQAALevel(PVPConstants.STORK_QAA_PREFIX +
- attr.getAttributeValues().get(0).getDOM().getTextContent());
-
- if (attr.getName().equals(PVPConstants.EID_ISSUING_NATION_NAME))
- authData.setCcc(attr.getAttributeValues().get(0).getDOM().getTextContent());
+ if (extractor.containsAttribute(PVPConstants.ENC_BPK_LIST_NAME)) {
+ List<String> encbPKList = Arrays.asList(
+ extractor.getAttribute(PVPConstants.ENC_BPK_LIST_NAME).split(";"));
+ authData.setEncbPKList(encbPKList);
+ for (String fullEncbPK : encbPKList) {
+ int index = fullEncbPK.indexOf("|");
+ if (index >= 0) {
+ String encbPK = fullEncbPK.substring(index+1);
+ String second = fullEncbPK.substring(0, index);
+ int secIndex = second.indexOf("+");
+ if (secIndex >= 0) {
+ if (oaParam.getTarget().equals(second.substring(secIndex+1))) {
+ Logger.debug("Found encrypted bPK for online-application "
+ + oaParam.getPublicURLPrefix()
+ + " Start decryption process ...");
+ PrivateKey privKey = oaParam.getBPKDecBpkDecryptionKey();
+ if (privKey != null) {
+ try {
+ String bPK = BPKBuilder.decryptBPK(encbPK, oaParam.getTarget(), privKey);
+ if (MiscUtil.isNotEmpty(bPK)) {
+ if (MiscUtil.isEmpty(authData.getBPK())) {
+ authData.setBPK(bPK);
+ authData.setBPKType(Constants.URN_PREFIX_CDID + "+" + oaParam.getTarget());
+ Logger.info("bPK decryption process finished successfully.");
+ }
+
+ } else {
+ Logger.error("bPK decryption FAILED.");
+
+ }
+ } catch (BuildException e) {
+ Logger.error("bPK decryption FAILED.", e);
+
+ }
+
+ } else {
+ Logger.info("bPK decryption FAILED, because no valid decryption key is found.");
+
+ }
+
+ } else {
+ Logger.info("Found encrypted bPK but " +
+ "encrypted bPK target does not match to online-application target");
+
+ }
+ }
+ }
+ }
+ }
+
+ if (MiscUtil.isEmpty(authData.getBPK()) && authData.getEncbPKList().size() == 0) {
+ Logger.error("Federated assertion include no bPK or encrypted bPK");
+ throw new AssertionAttributeExtractorExeption("No " + PVPConstants.BPK_FRIENDLY_NAME
+ + " or " + PVPConstants.ENC_BPK_LIST_FRIENDLY_NAME);
- if (attr.getName().equals(PVPConstants.EID_CCS_URL_NAME))
- authData.setBkuURL(attr.getAttributeValues().get(0).getDOM().getTextContent());
+ }
+
+ if (extractor.containsAttribute(PVPConstants.EID_CITIZEN_QAA_LEVEL_NAME))
+ authData.setQAALevel(PVPConstants.STORK_QAA_PREFIX +
+ extractor.getAttribute(PVPConstants.EID_CITIZEN_QAA_LEVEL_NAME));
+
+ if (extractor.containsAttribute(PVPConstants.EID_AUTH_BLOCK_NAME)) {
+ try {
+ byte[] authBlock = Base64Utils.decode(extractor.getAttribute(PVPConstants.EID_AUTH_BLOCK_NAME), false);
+ authData.setAuthBlock(new String(authBlock, "UTF-8"));
- if (attr.getName().equals(PVPConstants.EID_AUTH_BLOCK_NAME)) {
- try {
- byte[] authBlock = Base64Utils.decode(attr.getAttributeValues().get(0).getDOM().getTextContent(), false);
- authData.setAuthBlock(new String(authBlock, "UTF-8"));
+ } catch (IOException e) {
+ Logger.error("Received AuthBlock is not valid", e);
- } catch (IOException e) {
- Logger.error("Received AuthBlock is not valid", e);
-
- }
- }
-
- if (attr.getName().equals(PVPConstants.EID_SIGNER_CERTIFICATE_NAME)) {
- try {
- authData.setSignerCertificate(Base64Utils.decode(
- attr.getAttributeValues().get(0).getDOM().getTextContent(), false));
-
- } catch (IOException e) {
- Logger.error("Received SignerCertificate is not valid", e);
-
- }
}
-
- if (attr.getName().equals(PVPConstants.EID_SOURCE_PIN_NAME))
- authData.setIdentificationValue(attr.getAttributeValues().get(0).getDOM().getTextContent());
-
- if (attr.getName().equals(PVPConstants.EID_SOURCE_PIN_TYPE_NAME))
- authData.setIdentificationType(attr.getAttributeValues().get(0).getDOM().getTextContent());
-
- if (attr.getName().equals(PVPConstants.EID_IDENTITY_LINK_NAME)) {
- try {
- InputStream idlStream = Base64Utils.decodeToStream(attr.getAttributeValues().get(0).getDOM().getTextContent(), false);
- IdentityLink idl = new IdentityLinkAssertionParser(idlStream).parseIdentityLink();
- authData.setIdentityLink(idl);
-
- } catch (ParseException e) {
- Logger.error("Received IdentityLink is not valid", e);
-
- } catch (Exception e) {
- Logger.error("Received IdentityLink is not valid", e);
-
- }
- }
-
- if (attr.getName().equals(PVPConstants.MANDATE_REFERENCE_VALUE_NAME))
- authData.setMandateReferenceValue(attr.getAttributeValues().get(0).getDOM().getTextContent());
-
-
- if (attr.getName().equals(PVPConstants.MANDATE_FULL_MANDATE_NAME)) {
- try {
- byte[] mandate = Base64Utils.decode(
- attr.getAttributeValues().get(0).getDOM().getTextContent(), false);
-
- if (authData.getMISMandate() == null)
- authData.setMISMandate(new MISMandate());
- authData.getMISMandate().setMandate(mandate);
+ }
+
+ if (extractor.containsAttribute(PVPConstants.EID_SIGNER_CERTIFICATE_NAME)) {
+ try {
+ authData.setSignerCertificate(Base64Utils.decode(
+ extractor.getAttribute(PVPConstants.EID_SIGNER_CERTIFICATE_NAME), false));
+
+ } catch (IOException e) {
+ Logger.error("Received SignerCertificate is not valid", e);
+
+ }
+ }
+
+ if (extractor.containsAttribute(PVPConstants.EID_IDENTITY_LINK_NAME)) {
+ try {
+ InputStream idlStream = Base64Utils.decodeToStream(extractor.getAttribute(PVPConstants.EID_IDENTITY_LINK_NAME), false);
+ IdentityLink idl = new IdentityLinkAssertionParser(idlStream).parseIdentityLink();
+ authData.setIdentityLink(idl);
+
+ } catch (ParseException e) {
+ Logger.error("Received IdentityLink is not valid", e);
+
+ } catch (Exception e) {
+ Logger.error("Received IdentityLink is not valid", e);
- authData.setUseMandate(true);
-
- } catch (Exception e) {
- Logger.error("Received Mandate is not valid", e);
- throw new AssertionAttributeExtractorExeption(PVPConstants.MANDATE_FULL_MANDATE_NAME);
-
- }
}
-
- if (attr.getName().equals(PVPConstants.MANDATE_PROF_REP_OID_NAME)) {
+ }
+
+
+ // set mandate attributes
+ authData.setMandateReferenceValue(extractor.getAttribute(PVPConstants.MANDATE_REFERENCE_VALUE_NAME));
+
+ if (extractor.containsAttribute(PVPConstants.MANDATE_FULL_MANDATE_NAME)) {
+ try {
+ byte[] mandate = Base64Utils.decode(
+ (extractor.getAttribute(PVPConstants.MANDATE_FULL_MANDATE_NAME)), false);
+
if (authData.getMISMandate() == null)
authData.setMISMandate(new MISMandate());
- authData.getMISMandate().setProfRep(
- attr.getAttributeValues().get(0).getDOM().getTextContent());
+ authData.getMISMandate().setMandate(mandate);
+ authData.getMISMandate().setFullMandateIncluded(true);
+ authData.setUseMandate(true);
+
+ } catch (Exception e) {
+ Logger.error("Received Mandate is not valid", e);
+ throw new AssertionAttributeExtractorExeption(PVPConstants.MANDATE_FULL_MANDATE_NAME);
- }
+ }
+ }
+
+ //TODO: build short mandate if full mandate is no included.
+ if (authData.getMISMandate() == null &&
+ (extractor.containsAttribute(PVPConstants.MANDATE_LEG_PER_SOURCE_PIN_NAME)
+ || extractor.containsAttribute(PVPConstants.MANDATE_NAT_PER_BPK_NAME)
+ || extractor.containsAttribute(PVPConstants.MANDATE_NAT_PER_SOURCE_PIN_NAME)) ) {
+ Logger.info("Federated assertion contains no full mandate. Start short mandate generation process ... ");
+
+ MISMandate misMandate = new MISMandate();
+ misMandate.setFullMandateIncluded(false);
+
+ Mandate mandateObject = new Mandate();
+ Mandator mandator = new Mandator();
+ mandateObject.setMandator(mandator);
+
+ //build legal person short mandate
+ if (extractor.containsAttribute(PVPConstants.MANDATE_LEG_PER_FULL_NAME_NAME) &&
+ extractor.containsAttribute(PVPConstants.MANDATE_LEG_PER_SOURCE_PIN_NAME) &&
+ extractor.containsAttribute(PVPConstants.MANDATE_LEG_PER_SOURCE_PIN_TYPE_NAME)) {
+ Logger.debug("Build short mandate for legal person ...");
+ CorporateBodyType legalperson = new CorporateBodyType();
+ IdentificationType legalID = new IdentificationType();
+ Value idvalue = new Value();
+ legalID.setValue(idvalue );
+ legalperson.getIdentification().add(legalID );
+ mandator.setCorporateBody(legalperson );
+
+ legalperson.setFullName(extractor.getAttribute(PVPConstants.MANDATE_LEG_PER_FULL_NAME_NAME));
+ legalID.setType(extractor.getAttribute(PVPConstants.MANDATE_LEG_PER_SOURCE_PIN_TYPE_NAME));
+ idvalue.setValue(extractor.getAttribute(PVPConstants.MANDATE_LEG_PER_SOURCE_PIN_NAME));
+
+ //build natural person short mandate
+ } else if ( (extractor.containsAttribute(PVPConstants.MANDATE_NAT_PER_SOURCE_PIN_NAME) ||
+ extractor.containsAttribute(PVPConstants.MANDATE_NAT_PER_BPK_NAME)) &&
+ extractor.containsAttribute(PVPConstants.MANDATE_NAT_PER_BIRTHDATE_NAME) &&
+ extractor.containsAttribute(PVPConstants.MANDATE_NAT_PER_FAMILY_NAME_NAME) &&
+ extractor.containsAttribute(PVPConstants.MANDATE_NAT_PER_GIVEN_NAME_NAME)) {
+ Logger.debug("Build short mandate for natural person ...");
+ PhysicalPersonType physPerson = new PhysicalPersonType();
+ PersonNameType persName = new PersonNameType();
+ mandator.setPhysicalPerson(physPerson );
+ physPerson.setName(persName );
+ FamilyName familyName = new FamilyName();
+ persName.getFamilyName().add(familyName );
+ IdentificationType persID = new IdentificationType();
+ physPerson.getIdentification().add(persID );
+ Value idValue = new Value();
+ persID.setValue(idValue );
+
+ String[] pvp2GivenName = extractor.getAttribute(PVPConstants.MANDATE_NAT_PER_GIVEN_NAME_NAME).split(" ");
+ for(int i=0; i<pvp2GivenName.length; i++)
+ persName.getGivenName().add(pvp2GivenName[i]);
+ familyName.setValue(extractor.getAttribute(PVPConstants.MANDATE_NAT_PER_FAMILY_NAME_NAME));
+ physPerson.setDateOfBirth(extractor.getAttribute(PVPConstants.MANDATE_NAT_PER_BIRTHDATE_NAME));
+
+ if (extractor.containsAttribute(PVPConstants.MANDATE_NAT_PER_SOURCE_PIN_NAME)) {
+ persID.setType(Constants.URN_PREFIX_BASEID);
+ idValue.setValue(extractor.getAttribute(PVPConstants.MANDATE_NAT_PER_SOURCE_PIN_NAME));
+
+ } else {
+ String[] pvp2bPK = extractor.getAttribute(PVPConstants.MANDATE_NAT_PER_BPK_NAME).split(":");
+ if (pvp2bPK.length == 2) {
+ idValue.setValue(pvp2bPK[1]);
- if (attr.getName().equals(PVPConstants.EID_STORK_TOKEN_NAME)) {
- authData.setStorkAuthnResponse(attr.getAttributeValues().get(0).getDOM().getTextContent());
- authData.setForeigner(true);
+ Pattern pattern = Pattern.compile(MOAIDAuthConstants.REGEX_PATTERN_TARGET);
+ Matcher matcher = pattern.matcher(pvp2bPK[0]);
+ if (matcher.matches())
+ persID.setType(Constants.URN_PREFIX_CDID + "+" + pvp2bPK[0]);
+ else
+ persID.setType(Constants.URN_PREFIX_WBPK + "+" + pvp2bPK[0]);
+
+ } else {
+ Logger.warn("Receive mandator bPK from federation with an unsupported format. " + extractor.getAttribute(PVPConstants.MANDATE_NAT_PER_BPK_NAME));
+ throw new AssertionAttributeExtractorExeption("Receive mandator bPK from federation with an unsupported format.");
+
+ }
+ }
+
+ } else {
+ Logger.error("Short mandate could not generated. Assertion contains not all attributes which are necessary.");
+ throw new AssertionAttributeExtractorExeption("Assertion contains not all attributes which are necessary for mandate generation", null);
+
}
- if (attr.getName().startsWith(PVPConstants.STORK_ATTRIBUTE_PREFIX)) {
+ try {
+ JAXBContext jc = JAXBContext.newInstance("at.gv.e_government.reference.namespace.mandates._20040701_");
+ Marshaller m = jc.createMarshaller();
+ ByteArrayOutputStream stream = new ByteArrayOutputStream();
+ m.marshal(mandateObject, stream);
+ misMandate.setMandate(Base64Utils.encode(stream.toByteArray()).getBytes());
+ stream.close();
- if (authData.getStorkAttributes() == null)
- authData.setStorkAttributes(new PersonalAttributeList());
+ } catch (JAXBException e) {
+ Logger.error("Failed to parse short mandate", e);
+ throw new AssertionAttributeExtractorExeption();
+
+ } catch (IOException e) {
+ Logger.error("Failed to parse short mandate", e);
+ throw new AssertionAttributeExtractorExeption();
- List<String> storkAttrValues = new ArrayList<String>();
- storkAttrValues.add(attr.getAttributeValues().get(0).getDOM().getTextContent());
- PersonalAttribute storkAttr = new PersonalAttribute(attr.getName(),
- false, storkAttrValues , "Available");
- authData.getStorkAttributes().put(attr.getName(), storkAttr );
- authData.setForeigner(true);
- }
-
+ }
+ authData.setUseMandate(true);
+
}
+
+ if (extractor.containsAttribute(PVPConstants.MANDATE_PROF_REP_OID_NAME)) {
+ if (authData.getMISMandate() == null)
+ authData.setMISMandate(new MISMandate());
+ authData.getMISMandate().setProfRep(
+ extractor.getAttribute(PVPConstants.MANDATE_PROF_REP_OID_NAME));
+
+ }
+
+
+ //set STORK attributes
+ if (extractor.containsAttribute(PVPConstants.EID_STORK_TOKEN_NAME)) {
+ authData.setStorkAuthnResponse(extractor.getAttribute(PVPConstants.EID_STORK_TOKEN_NAME));
+ authData.setForeigner(true);
+
+ }
+
+ if (!extractor.getSTORKAttributes().isEmpty()) {
+ authData.setStorkAttributes(extractor.getSTORKAttributes());
+ authData.setForeigner(true);
+
+ }
+
authData.setSsoSession(true);
- if (assertion.getConditions() != null && assertion.getConditions().getNotOnOrAfter() != null)
- authData.setSsoSessionValidTo(assertion.getConditions().getNotOnOrAfter().toDate());
+ if (extractor.getFullAssertion().getConditions() != null && extractor.getFullAssertion().getConditions().getNotOnOrAfter() != null)
+ authData.setSsoSessionValidTo(extractor.getFullAssertion().getConditions().getNotOnOrAfter().toDate());
//only for SAML1
if (PVPConstants.STORK_QAA_1_4.equals(authData.getQAALevel()))
@@ -504,33 +662,33 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
authData.setQAALevel(session.getQAALevel());
if (session.isForeigner()) {
- if (authData.getStorkAuthnRequest() != null) {
- authData.setCcc(authData.getStorkAuthnRequest()
- .getCitizenCountryCode());
-
- } else {
-
- try {
- //TODO: replace with TSL lookup when TSL is ready!
- X509Certificate certificate = new X509Certificate(authData.getSignerCertificate());
-
- if (certificate != null) {
-
- LdapName ln = new LdapName(certificate.getIssuerDN()
- .getName());
- for (Rdn rdn : ln.getRdns()) {
- if (rdn.getType().equalsIgnoreCase("C")) {
- Logger.info("C is: " + rdn.getValue());
- authData.setCcc(rdn.getValue().toString());
- break;
- }
+ try {
+ //TODO: replace with TSL lookup when TSL is ready!
+ X509Certificate certificate = new X509Certificate(authData.getSignerCertificate());
+ if (certificate != null) {
+ LdapName ln = new LdapName(certificate.getIssuerDN()
+ .getName());
+ for (Rdn rdn : ln.getRdns()) {
+ if (rdn.getType().equalsIgnoreCase("C")) {
+ Logger.info("C is: " + rdn.getValue());
+ authData.setCcc(rdn.getValue().toString());
+ break;
}
}
-
- } catch (Exception e) {
- Logger.error("Failed to extract country code from certificate", e);
+ }
+
+ } catch (Exception e) {
+ Logger.error("Failed to extract country code from certificate", e);
+
+ }
+
+ if (MiscUtil.isEmpty(authData.getCcc())) {
+ if (authData.getStorkAuthnRequest() != null) {
+ authData.setCcc(authData.getStorkAuthnRequest().getCitizenCountryCode());
+ Logger.info("Can not extract country from certificate -> Use country from STORK request.");
}
+
}
} else {
@@ -539,7 +697,6 @@ public class AuthenticationDataBuilder implements MOAIDAuthConstants {
}
try {
-
authData.setSsoSession(AuthenticationSessionStoreage.isSSOSession(session.getSessionID()));
//set max. SSO session time
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-18 21:49:08 +0000