1 files changed, 41 insertions, 2 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/RedirectServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/RedirectServlet.java
index 7c51e7d6b..671151bbe 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/RedirectServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/RedirectServlet.java
@@ -30,6 +30,9 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import at.gv.egovernment.moa.id.auth.builder.RedirectFormBuilder;
+import at.gv.egovernment.moa.id.commons.db.ConfigurationDBRead;
+import at.gv.egovernment.moa.id.commons.db.ConfigurationDBUtils;
+import at.gv.egovernment.moa.id.commons.db.dao.config.OnlineApplication;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.MiscUtil;
 import at.gv.egovernment.moa.util.URLEncoder;
@@ -45,12 +48,45 @@ public class RedirectServlet extends AuthServlet{
 	
 	protected void doGet(HttpServletRequest req, HttpServletResponse resp)
 			throws ServletException, IOException {
-		Logger.info("Receive " + RedirectServlet.class + " Request");
+		Logger.debug("Receive " + RedirectServlet.class + " Request");
 		
 		String url = req.getParameter(REDIRCT_PARAM_URL);
 		String target = req.getParameter(PARAM_TARGET);
 		String artifact = req.getParameter(PARAM_SAMLARTIFACT);
 		
+		if (MiscUtil.isEmpty(artifact)) {
+			resp.sendError(HttpServletResponse.SC_FORBIDDEN, "Parameters not valid");
+			return;
+		}
+		
+		Logger.debug("Check URL against online-applications");
+		OnlineApplication oa = null;
+		String redirectTarget = "_parent";
+		try {
+			oa = ConfigurationDBRead.getActiveOnlineApplication(url);			
+			if (oa == null) {		
+				resp.sendError(HttpServletResponse.SC_FORBIDDEN, "Parameters not valid");
+				return;
+				
+			} else {
+				try {
+					redirectTarget = oa.getAuthComponentOA().getTemplates().getBKUSelectionCustomization().getAppletRedirectTarget();
+					
+				} catch (Exception e) {
+					Logger.debug("Use default redirectTarget.");
+				}
+				
+			}
+			
+		} catch (Throwable e) {
+			resp.sendError(HttpServletResponse.SC_FORBIDDEN, "Request not allowed.");
+			return;
+						
+		} finally {
+			ConfigurationDBUtils.closeSession();
+			
+		}
+					
 		Logger.info("Redirect to " + url);
 		
 		if (MiscUtil.isNotEmpty(target)) {
@@ -65,12 +101,15 @@ public class RedirectServlet extends AuthServlet{
 				URLEncoder.encode(artifact, "UTF-8"));
 		url = resp.encodeRedirectURL(url);
 		
-		String redirect_form = RedirectFormBuilder.buildLoginForm(url);
+		String redirect_form = RedirectFormBuilder.buildLoginForm(url, redirectTarget);
 		
 		resp.setContentType("text/html;charset=UTF-8");
 		PrintWriter out = new PrintWriter(resp.getOutputStream()); 
 		out.write(redirect_form);
 		out.flush();
+		
+
 	}
+	
 
 }