1 files changed, 13 insertions, 5 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java
index 7c96c2194..83d0ced20 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java
@@ -52,6 +52,7 @@ import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
 import at.gv.egovernment.moa.id.auth.data.IdentityLink;

 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;

 import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

+import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

 import at.gv.egovernment.moa.id.auth.stork.STORKException;

 import at.gv.egovernment.moa.id.auth.stork.STORKResponseProcessor;

 import at.gv.egovernment.moa.id.auth.stork.VelocityProvider;

@@ -62,6 +63,7 @@ import at.gv.egovernment.moa.id.moduls.ModulUtils;
 import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;

 import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;

 import at.gv.egovernment.moa.id.util.HTTPUtils;

+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;

 import at.gv.egovernment.moa.logging.Logger;

 import at.gv.egovernment.moa.util.StringUtils;

 import at.gv.util.xsd.xmldsig.SignatureType;

@@ -123,9 +125,18 @@ public class PEPSConnectorServlet extends AuthServlet {
 				Logger.error("MOA-SessionID was not found, no previous AuthnRequest had been started");

 				throw new AuthenticationException("auth.02", new Object[] { moaSessionID });

 			}

-			

+

+	         if (!ParamValidatorUtils.isValidSessionID(moaSessionID))

+	             throw new WrongParametersException("VerifyAuthenticationBlock", PARAM_SESSIONID, "auth.12");

+

 			pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(moaSessionID);

 			

+			//load MOASession from database

+			AuthenticationSession moaSession = AuthenticationServer.getSession(moaSessionID);

+			

+			//change MOASessionID

+			moaSessionID = AuthenticationSessionStoreage.changeSessionID(moaSession);

+			

 			Logger.info("Found MOA sessionID: " + moaSessionID);

 			

 			Logger.debug("Beginning to extract SAMLResponse out of HTTP Request");

@@ -166,10 +177,7 @@ public class PEPSConnectorServlet extends AuthServlet {
 			}

 			

 			Logger.info("Got SAML response with authentication success message.");

-			

-			//check if authentication request was created before

-			AuthenticationSession moaSession = AuthenticationServer.getSession(moaSessionID);

-			

+						

 			Logger.debug("MOA session is still valid");

 			

 			STORKAuthnRequest storkAuthnRequest = moaSession.getStorkAuthnRequest();