1 files changed, 42 insertions, 26 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java
index b1ae12084..977784a6b 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java
@@ -27,7 +27,6 @@ package at.gv.egovernment.moa.id.auth.servlet;
 import iaik.pki.PKIException;
 
 import java.io.IOException;
-import java.io.PrintWriter;
 import java.security.GeneralSecurityException;
 import java.util.List;
 
@@ -38,16 +37,14 @@ import javax.servlet.http.HttpServletResponse;
 import javax.xml.parsers.ParserConfigurationException;
 
 import org.apache.commons.lang.StringEscapeUtils;
-import org.w3c.dom.Document;
+import org.w3c.dom.Element;
 import org.xml.sax.SAXException;
 
-import at.gv.egovernment.moa.id.BuildException;
 import at.gv.egovernment.moa.id.MOAIDException;
 import at.gv.egovernment.moa.id.auth.AuthenticationServer;
 import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
 import at.gv.egovernment.moa.id.auth.WrongParametersException;
 import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;
-import at.gv.egovernment.moa.id.auth.builder.GetIdentityLinkFormBuilder;
 import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
 import at.gv.egovernment.moa.id.config.ConnectionParameter;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
@@ -58,6 +55,7 @@ import at.gv.egovernment.moa.id.util.client.mis.simple.MISSimpleClient;
 import at.gv.egovernment.moa.id.util.client.mis.simple.MISSimpleClientException;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.DOMUtils;
+import at.gv.egovernment.moa.util.URLEncoder;
 

 /**

  * Servlet requested for getting the foreign eID

@@ -139,8 +137,6 @@ public class GetMISSessionIDServlet extends AuthServlet {
 	    	

 	    	String misSessionID = session.getMISSessionID();

 	    	

-	    	//System.out.println("MIS Session ID (GetMISServlet): " + misSessionID);

-	    	

 	    	AuthConfigurationProvider authConf= AuthConfigurationProvider.getInstance();

 	    	ConnectionParameter connectionParameters = authConf.getOnlineMandatesConnectionParameter();	

 	    	SSLSocketFactory sslFactory = SSLUtils.getSSLSocketFactory(AuthConfigurationProvider.getInstance(), connectionParameters);

@@ -158,31 +154,36 @@ public class GetMISSessionIDServlet extends AuthServlet {
 	    	

 	    	// for now: list contains only one element

 	    	MISMandate mandate = (MISMandate)list.get(0);	    	

-   	

+	    	

 	    	// verify mandate signature

-	    	String createXMLSignatureRequestOrRedirect = AuthenticationServer.getInstance().verifyMandate(sessionID, mandate);

+	    	AuthenticationServer.getInstance().verifyMandate(sessionID, mandate);

 
 	    	byte[] byteMandate = mandate.getMandate();
 	    	String stringMandate = new String(byteMandate);
-	    	Document mandateDoc = DOMUtils.parseDocument(stringMandate, false, null, null);
-	    	session.setMandateElem(mandateDoc.getDocumentElement());
-	    	//System.out.println("stringMandate: " + stringMandate);
+	    	Element mandateDoc = DOMUtils.parseDocument(stringMandate, false, null, null).getDocumentElement();
+	    	//session.setMandateElem(mandateDoc.getDocumentElement());
 	    	
-	    	String dataurl =

-	             new DataURLBuilder().buildDataURL(

-	               session.getAuthURL(),

-	               REQ_VERIFY_AUTH_BLOCK,

-	               session.getSessionID());

-	    	

-	    	Logger.debug(createXMLSignatureRequestOrRedirect);

- 

-	    	//String request = getHTMLForm(createXMLSignatureRequestOrRedirect, session.getBkuURL(), dataurl, session.getPublicOAURLPrefix());

-	    	String request = null;

-	    	resp.setContentType("text/html;charset=UTF-8");

-			PrintWriter out = new PrintWriter(resp.getOutputStream());

-			out.print(request);

-			out.flush();

-	    	

+	    	String redirectURL = null;
+	    	String samlArtifactBase64 = 
+				AuthenticationServer.getInstance().verifyAuthenticationBlockMandate(sessionID, mandateDoc);
+	    	
+	    	
+	    	if (!samlArtifactBase64.equals("Redirect to Input Processor")) {
+				  redirectURL = session.getOAURLRequested();
+	  			if (!session.getBusinessService()) {
+	          redirectURL = addURLParameter(redirectURL, PARAM_TARGET, URLEncoder.encode(session.getTarget(), "UTF-8"));
+	        }
+	  			redirectURL = addURLParameter(redirectURL, PARAM_SAMLARTIFACT, URLEncoder.encode(samlArtifactBase64, "UTF-8"));
+	  			redirectURL = resp.encodeRedirectURL(redirectURL);
+				} else {
+		      redirectURL = new DataURLBuilder().buildDataURL(session.getAuthURL(), AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, session.getSessionID());
+				}
+				resp.setContentType("text/html");
+				resp.setStatus(302);
+				
+				resp.addHeader("Location", redirectURL);			
+				Logger.debug("REDIRECT TO: " + redirectURL);
+	    		    	

 			    		      

 	    }

 	    catch (MOAIDException ex) {

@@ -198,6 +199,21 @@ public class GetMISSessionIDServlet extends AuthServlet {
 		} catch (ParserConfigurationException e) {
 			handleError(null, e, req, resp);
 		} 

+  }
+  
+  /**
+   * Adds a parameter to a URL.
+   * @param url the URL
+   * @param paramname parameter name
+   * @param paramvalue parameter value
+   * @return the URL with parameter added
+   */
+  private static String addURLParameter(String url, String paramname, String paramvalue) {
+		String param = paramname + "=" + paramvalue;
+  	if (url.indexOf("?") < 0)
+	  	return url + "?" + param;
+  	else
+  		return url + "&" + param;
   }