1 files changed, 177 insertions, 153 deletions
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java
index 04fbc0588..e461197e2 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java
@@ -21,9 +21,8 @@
  * that you distribute must include a readable copy of the "NOTICE" text file.
  */
 
+package at.gv.egovernment.moa.id.auth.servlet;
 
-package at.gv.egovernment.moa.id.auth.servlet;
-
 import iaik.pki.PKIException;
 
 import java.io.IOException;
@@ -41,6 +40,7 @@ import org.apache.commons.lang.StringEscapeUtils;
 import org.w3c.dom.Element;
 import org.xml.sax.SAXException;
 
+import at.gv.egovernment.moa.id.AuthenticationException;
 import at.gv.egovernment.moa.id.MOAIDException;
 import at.gv.egovernment.moa.id.auth.AuthenticationServer;
 import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
@@ -48,8 +48,11 @@ import at.gv.egovernment.moa.id.auth.WrongParametersException;
 import at.gv.egovernment.moa.id.auth.builder.BPKBuilder;
 import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;
 import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.commons.db.ConfigurationDBUtils;
 import at.gv.egovernment.moa.id.config.ConnectionParameter;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
+import at.gv.egovernment.moa.id.moduls.ModulUtils;
+import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;
 import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
 import at.gv.egovernment.moa.id.util.SSLUtils;
 import at.gv.egovernment.moa.id.util.client.mis.simple.MISMandate;
@@ -58,160 +61,181 @@ import at.gv.egovernment.moa.id.util.client.mis.simple.MISSimpleClientException;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.DOMUtils;
 import at.gv.egovernment.moa.util.URLEncoder;
-
-/**
- * Servlet requested for getting the foreign eID
- * provided by the security layer implementation.
- * Utilizes the {@link AuthenticationServer}.
- *
- */
-public class GetMISSessionIDServlet extends AuthServlet {
-
-  /**
+
+/**
+ * Servlet requested for getting the foreign eID provided by the security layer
+ * implementation. Utilizes the {@link AuthenticationServer}.
+ * 
+ */
+public class GetMISSessionIDServlet extends AuthServlet {
+
+	/**
 	 * 
 	 */
 	private static final long serialVersionUID = 4666952867085392597L;
 
-/**
-   * Constructor for GetMISSessionIDServlet.
-   */
-  public GetMISSessionIDServlet() {
-    super();
-  }
-
-  /**
-   * GET requested by security layer implementation to verify
-   * that data URL resource is available.
-   * @see javax.servlet.http.HttpServlet#doGet(HttpServletRequest, HttpServletResponse)
-   */
-  protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-    throws ServletException, IOException { 
-    	
-	  doPost(req, resp);
-	  
-//		Logger.debug("GET GetMISSessionIDServlet");
-//		
-//		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);
-//		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);
-//		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
-//		resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);
-  }
-
-  /**
-   * Gets the signer certificate from the InfoboxReadRequest and 
-   * responds with a new 
-   * <code>CreateXMLSignatureRequest</code>.
-   * <br>
-   * Request parameters:
-   * <ul>
-   * <li>MOASessionID: ID of associated authentication session</li>
-   * <li>XMLResponse: <code>&lt;InfoboxReadResponse&gt;</code></li>
-   * </ul>
-   * @see javax.servlet.http.HttpServlet#doPost(HttpServletRequest, HttpServletResponse)
-   */
-  protected void doPost(HttpServletRequest req, HttpServletResponse resp)
-    throws ServletException, IOException {
-
-		Logger.debug("POST GetMISSessionIDServlet");
-		
-		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);
-		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);
-		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
-		resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);
-		
-//		Map parameters;
-//	    try 
-//	    {
-//	      parameters = getParameters(req);
-//	    } catch (FileUploadException e) 
-//	    {
-//	      Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());
-//	      throw new IOException(e.getMessage());
-//	     	}
-		
-	    String sessionID = req.getParameter(PARAM_SESSIONID);
-	    
-	    // escape parameter strings
-		sessionID = StringEscapeUtils.escapeHtml(sessionID);
-		
-	    AuthenticationSession session = null;
-	    try {
-	       // check parameter
-	       if (!ParamValidatorUtils.isValidSessionID(sessionID))
-	          throw new WrongParametersException("VerifyCertificate", PARAM_SESSIONID, "auth.12");
-	       
-	       session = AuthenticationServer.getSession(sessionID);
-	    	
-	    	String misSessionID = session.getMISSessionID();
-	    	
-	    	AuthConfigurationProvider authConf= AuthConfigurationProvider.getInstance();
-	    	ConnectionParameter connectionParameters = authConf.getOnlineMandatesConnectionParameter();	
-	    	SSLSocketFactory sslFactory = SSLUtils.getSSLSocketFactory(AuthConfigurationProvider.getInstance(), connectionParameters);
-
-	    	List list = MISSimpleClient.sendGetMandatesRequest(connectionParameters.getUrl(), misSessionID, sslFactory);
-	    	
-	    	if (list == null) {
-	    		Logger.error("Keine Vollmacht gefunden.");
-	    		throw new MISSimpleClientException("Keine Vollmacht gefunden");
-	    	}
-	    	if (list.size() == 0) {
-	    		Logger.error("Keine Vollmacht gefunden.");
-	    		throw new MISSimpleClientException("Keine Vollmacht gefunden");
-	    	}
-	    	
-	    	// for now: list contains only one element
-	    	MISMandate mandate = (MISMandate)list.get(0);	   
-	    	
-	    	
-	    	// verify mandate signature
-	    	AuthenticationServer.getInstance().verifyMandate(sessionID, mandate);
-
-	    	byte[] byteMandate = mandate.getMandate();
-	    	String stringMandate = new String(byteMandate);
-	    	Element mandateDoc = DOMUtils.parseDocument(stringMandate, false, null, null).getDocumentElement();
-
-	    	//TODO OW bPK (Offen: was bei saml:NameIdentifier NameQualifier="urn:publicid:gv.at:cdid+bpk"> und <saml:Attribute AttributeName="bPK" )
-	    	System.out.println("\n\n\n OW BPK: " + mandate.getOWbPK());
-	    	// TODO wenn OW bPK vorhanden - in SAML Assertion setzen!
-	    	
-	    	String redirectURL = null;
-	    	String samlArtifactBase64 = 
-				AuthenticationServer.getInstance().verifyAuthenticationBlockMandate(sessionID, mandateDoc);
-	    	
-	    	
-	    	if (!samlArtifactBase64.equals("Redirect to Input Processor")) {
-				  redirectURL = session.getOAURLRequested();
-	  			if (!session.getBusinessService()) {
-	          redirectURL = addURLParameter(redirectURL, PARAM_TARGET, URLEncoder.encode(session.getTarget(), "UTF-8"));
-	        }
-	  			redirectURL = addURLParameter(redirectURL, PARAM_SAMLARTIFACT, URLEncoder.encode(samlArtifactBase64, "UTF-8"));
-	  			redirectURL = resp.encodeRedirectURL(redirectURL);
-				} else {
-		      redirectURL = new DataURLBuilder().buildDataURL(session.getAuthURL(), AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, session.getSessionID());
-				}
-				resp.setContentType("text/html");
-				resp.setStatus(302);
-				
-				resp.addHeader("Location", redirectURL);			
-				Logger.debug("REDIRECT TO: " + redirectURL);
-	    		    	
-			    		      
-	    }
-	    catch (MOAIDException ex) {
-	      handleError(null, ex, req, resp);
-	    } catch (GeneralSecurityException ex) {
-	    	handleError(null, ex, req, resp);
-		} catch (PKIException e) {
-			handleError(null, e, req, resp);
-		} catch (MISSimpleClientException e) {
-			handleError(null, e, req, resp);
+	/**
+	 * Constructor for GetMISSessionIDServlet.
+	 */
+	public GetMISSessionIDServlet() {
+		super();
+	}
+
+	/**
+	 * GET requested by security layer implementation to verify that data URL
+	 * resource is available.
+	 * 
+	 * @see javax.servlet.http.HttpServlet#doGet(HttpServletRequest,
+	 *      HttpServletResponse)
+	 */
+	protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+			throws ServletException, IOException {
+
+		doPost(req, resp);
+
+		// Logger.debug("GET GetMISSessionIDServlet");
+		//
+		// resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);
+		// resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);
+		// resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
+		// resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);
+	}
+
+	/**
+	 * Gets the signer certificate from the InfoboxReadRequest and responds with
+	 * a new <code>CreateXMLSignatureRequest</code>. <br>
+	 * Request parameters:
+	 * <ul>
+	 * <li>MOASessionID: ID of associated authentication session</li>
+	 * <li>XMLResponse: <code>&lt;InfoboxReadResponse&gt;</code></li>
+	 * </ul>
+	 * 
+	 * @see javax.servlet.http.HttpServlet#doPost(HttpServletRequest,
+	 *      HttpServletResponse)
+	 */
+	protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+			throws ServletException, IOException {
+
+		Logger.debug("POST GetMISSessionIDServlet");
+
+		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,
+				MOAIDAuthConstants.HEADER_VALUE_EXPIRES);
+		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,
+				MOAIDAuthConstants.HEADER_VALUE_PRAGMA);
+		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,
+				MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
+		resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,
+				MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);
+
+		// Map parameters;
+		// try
+		// {
+		// parameters = getParameters(req);
+		// } catch (FileUploadException e)
+		// {
+		// Logger.error("Parsing mulitpart/form-data request parameters failed: "
+		// + e.getMessage());
+		// throw new IOException(e.getMessage());
+		// }
+
+		String sessionID = req.getParameter(PARAM_SESSIONID);
+
+		// escape parameter strings
+		sessionID = StringEscapeUtils.escapeHtml(sessionID);
+
+		AuthenticationSession session = null;
+		String pendingRequestID = null;
+		try {
+			// check parameter
+			if (!ParamValidatorUtils.isValidSessionID(sessionID))
+				throw new WrongParametersException("VerifyCertificate",
+						PARAM_SESSIONID, "auth.12");
+
+			pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID);
+			
+			session = AuthenticationServer.getSession(sessionID);
+
+			String misSessionID = session.getMISSessionID();
+
+			AuthConfigurationProvider authConf = AuthConfigurationProvider
+					.getInstance();
+			ConnectionParameter connectionParameters = authConf
+					.getOnlineMandatesConnectionParameter();
+			SSLSocketFactory sslFactory = SSLUtils.getSSLSocketFactory(
+					AuthConfigurationProvider.getInstance(),
+					connectionParameters);
+
+			List list = MISSimpleClient.sendGetMandatesRequest(
+					connectionParameters.getUrl(), misSessionID, sslFactory);
+
+			if (list == null) {
+				Logger.error("Keine Vollmacht gefunden.");
+				throw new MISSimpleClientException("Keine Vollmacht gefunden");
+			}
+			if (list.size() == 0) {
+				Logger.error("Keine Vollmacht gefunden.");
+				throw new MISSimpleClientException("Keine Vollmacht gefunden");
+			}
+
+			// for now: list contains only one element
+			MISMandate mandate = (MISMandate) list.get(0);
+
+			String sMandate = new String(mandate.getMandate());
+			if (sMandate == null | sMandate.compareToIgnoreCase("") == 0) {
+				Logger.error("Mandate is empty.");
+				throw new AuthenticationException("auth.16",
+						new Object[] { GET_MIS_SESSIONID });
+			}
+						
+			//check if it is a parsable XML
+			byte[] byteMandate = mandate.getMandate();
+			String stringMandate = new String(byteMandate);
+			Element mandateDoc = DOMUtils.parseDocument(stringMandate, false,
+					null, null).getDocumentElement();
+			
+			// extract RepresentationType
+			AuthenticationServer.getInstance().verifyMandate(session, mandate);
+			
+			session.setMISMandate(mandate);
+			session.setAuthenticatedUsed(false);
+			session.setAuthenticated(true);
+			
+			String oldsessionID = session.getSessionID();
+			
+			//Session is implicite stored in changeSessionID!!!
+			String newMOASessionID = AuthenticationSessionStoreage.changeSessionID(session);
+			
+			Logger.info("Changed MOASession " + oldsessionID + " to Session " + newMOASessionID);
+			Logger.info("Daten angelegt zu MOASession " + newMOASessionID);
+						
+			String redirectURL = new DataURLBuilder().buildDataURL(
+					session.getAuthURL(),
+					ModulUtils.buildAuthURL(session.getModul(),
+							session.getAction(), pendingRequestID), newMOASessionID);
+			redirectURL = resp.encodeRedirectURL(redirectURL);
+			
+			resp.setContentType("text/html");
+			resp.setStatus(302);
+			resp.addHeader("Location", redirectURL);
+			Logger.debug("REDIRECT TO: " + redirectURL);
+
+		} catch (MOAIDException ex) {
+			handleError(null, ex, req, resp, pendingRequestID);
+		} catch (GeneralSecurityException ex) {
+			handleError(null, ex, req, resp, pendingRequestID);
+		} catch (PKIException e) {
+			handleError(null, e, req, resp, pendingRequestID);
+		} catch (MISSimpleClientException e) {
+			handleError(null, e, req, resp, pendingRequestID);
 		} catch (SAXException e) {
-			handleError(null, e, req, resp);
+			handleError(null, e, req, resp, pendingRequestID);
 		} catch (ParserConfigurationException e) {
-			handleError(null, e, req, resp);
-		} 
-  }
-  
-   
- 
- }
+			handleError(null, e, req, resp, pendingRequestID);
+		}
+		
+	    finally {
+	    	ConfigurationDBUtils.closeSession();
+	    }
+	}
+
+}