27 files changed, 2058 insertions, 257 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
index 43384c58a..b9ce76d0c 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java
@@ -311,27 +311,28 @@ public class AuthenticationServer implements MOAIDAuthConstants {
 	}
 
 	/**
-	 * Processes an <code>&lt;InfoboxReadResponse&gt;</code> sent by the
-	 * security layer implementation.<br>
+	 * Processes an <code>&lt;InfoboxReadResponse&gt;</code> sent by the security layer implementation.<br>
 	 * <ul>
 	 * <li>Validates given <code>&lt;InfoboxReadResponse&gt;</code></li>
-	 * <li>Parses identity link enclosed in
-	 * <code>&lt;InfoboxReadResponse&gt;</code></li>
+	 * <li>Parses identity link enclosed in <code>&lt;InfoboxReadResponse&gt;</code></li>
 	 * <li>Verifies identity link by calling the MOA SP component</li>
 	 * <li>Checks certificate authority of identity link</li>
 	 * <li>Stores identity link in the session</li>
 	 * <li>Verifies all additional infoboxes returned from the BKU</li>
 	 * <li>Creates an authentication block to be signed by the user</li>
-	 * <li>Creates and returns a <code>&lt;CreateXMLSignatureRequest&gt;</code>
-	 * containg the authentication block, meant to be returned to the security
-	 * layer implementation</li>
+	 * <li>Creates and returns a <code>&lt;CreateXMLSignatureRequest&gt;</code> containg the authentication block, meant
+	 * to be returned to the security layer implementation</li>
 	 * </ul>
-	 *
-	 * @param sessionID                     ID of associated authentication session data
-	 * @param infoboxReadResponseParameters The parameters from the response returned from the BKU
-	 *                                      including the <code>&lt;InfoboxReadResponse&gt;</code>
-	 * @return String representation of the
-	 * <code>&lt;CreateXMLSignatureRequest&gt;</code>
+	 * 
+	 * @param sessionID
+	 *            ID of associated authentication session data
+	 * @param infoboxReadResponseParameters
+	 *            The parameters from the response returned from the BKU including the
+	 *            <code>&lt;InfoboxReadResponse&gt;</code>
+	 * @return String "found!" in case the identity link could be retrieved and successfully validated, {@code null} in
+	 *         case the identity link could not be retrieved (indicates that the card did not contain an identity link
+	 *         which might indicate a foreign identity). Note that failing to parse or failing to validate the identity
+	 *         link results in an Exception being thrown.
 	 * @throws BKUException
 	 */
 	public String verifyIdentityLink(AuthenticationSession session,
@@ -1095,14 +1096,14 @@ public class AuthenticationServer implements MOAIDAuthConstants {
 	 * <li>Stores authentication data in the authentication data store indexed
 	 * by the SAML artifact</li>
 	 * <li>Deletes authentication session</li>
-	 * <li>Returns the SAML artifact, encoded BASE64</li>
+	 * <li><strike>Returns the SAML artifact, encoded BASE64</strike><br/>New id of the authenticated MOA session or {@code null} in case of mandate mode (???)</li>
 	 * </ul>
 	 *
 	 * @param sessionID                         session ID of the running authentication session
 	 * @param xmlCreateXMLSignatureReadResponse String representation of the
 	 *                                          <code>&lt;CreateXMLSignatureResponse&gt;</code>
-	 * @return SAML artifact needed for retrieving authentication data, encoded
-	 * BASE64
+	 * @return <strike>SAML artifact needed for retrieving authentication data, encoded
+	 * BASE64</strike><br/>New id of the authenticated MOA session or {@code null} in case of mandate mode (???)
 	 * @throws BKUException
 	 */
 	public String verifyAuthenticationBlock(AuthenticationSession session,
@@ -1362,17 +1363,16 @@ public class AuthenticationServer implements MOAIDAuthConstants {
 	/**
 	 * Gets the foreign authentication data.<br>
 	 * <ul>
-	 * <li>Creates authentication data</li>
+	 * <li><strong>Creates authentication data</strong></li>
 	 * <li>Creates a corresponding SAML artifact</li>
 	 * <li>Stores authentication data in the authentication data store indexed
 	 * by the SAML artifact</li>
 	 * <li>Deletes authentication session</li>
-	 * <li>Returns the SAML artifact, encoded BASE64</li>
+	 * <li><strike>Returns the SAML artifact, encoded BASE64</strike></li>
 	 * </ul>
 	 *
 	 * @param sessionID session ID of the running authentication session
-	 * @return SAML artifact needed for retrieving authentication data, encoded
-	 * BASE64
+	 * @return String "new Session"
 	 */
 	public String getForeignAuthenticationData(AuthenticationSession session)
 			throws AuthenticationException, BuildException, ParseException,
@@ -1381,46 +1381,6 @@ public class AuthenticationServer implements MOAIDAuthConstants {
 		if (session == null)
 			throw new AuthenticationException("auth.10", new Object[]{
 					REQ_VERIFY_AUTH_BLOCK, PARAM_SESSIONID});
-
-		//        // post processing of the infoboxes
-		//        Iterator iter = session.getInfoboxValidatorIterator();
-		//        boolean formpending = false;
-		//        if (iter != null) {
-		//            while (!formpending && iter.hasNext()) {
-		//                Vector infoboxValidatorVector = (Vector) iter.next();
-		//                String identifier = (String) infoboxValidatorVector.get(0);
-		//                String friendlyName = (String) infoboxValidatorVector.get(1);
-		//                InfoboxValidator infoboxvalidator = (InfoboxValidator) infoboxValidatorVector
-		//                        .get(2);
-		//                InfoboxValidationResult infoboxValidationResult = null;
-		//                try {
-		//                    infoboxValidationResult = infoboxvalidator.validate(session
-		//                            .getIdentityLink().getSamlAssertion());
-		//                } catch (ValidateException e) {
-		//                    Logger.error("Error validating " + identifier + " infobox:"
-		//                            + e.getMessage());
-		//                    throw new ValidateException("validator.44",
-		//                            new Object[]{friendlyName});
-		//                }
-		//                if (!infoboxValidationResult.isValid()) {
-		//                    Logger.info("Validation of " + identifier
-		//                            + " infobox failed.");
-		//                    throw new ValidateException("validator.40", new Object[]{
-		//                            friendlyName,
-		//                            infoboxValidationResult.getErrorMessage()});
-		//                }
-		//                String form = infoboxvalidator.getForm();
-		//                if (ParepUtils.isEmpty(form)) {
-		//                    AddAdditionalSAMLAttributes(
-		//                            session,
-		//                            infoboxValidationResult.getExtendedSamlAttributes(),
-		//                            identifier, friendlyName);
-		//                } else {
-		//                    return "Redirect to Input Processor";
-		//                }
-		//            }
-		//        }
-
 		VerifyXMLSignatureResponse vsresp = new VerifyXMLSignatureResponse();
 		X509Certificate cert = session.getSignerCertificate();
 		vsresp.setX509certificate(cert);
@@ -1442,8 +1402,8 @@ public class AuthenticationServer implements MOAIDAuthConstants {
 	 * Retrieves a session from the session store.
 	 *
 	 * @param id session ID
-	 * @return <code>AuthenticationSession</code> stored with given session ID,
-	 * <code>null</code> if session ID unknown
+	 * @return <code>AuthenticationSession</code> stored with given session ID (never {@code null}).
+	 * @throws AuthenticationException in case the session id does not reflect a valic, active session.
 	 */
 	public static AuthenticationSession getSession(String id)
 			throws AuthenticationException {
@@ -1749,10 +1709,6 @@ public class AuthenticationServer implements MOAIDAuthConstants {
 		//        String acsURL = new DataURLBuilder().buildDataURL(issuerValue, 
 		//    			PEPSConnectorServlet.PEPSCONNECTOR_SERVLET_URL_PATTERN, moasession.getSessionID());
 
-		//solve Problem with sessionIDs 
-		String acsURL = issuerValue + PEPSConnectorServlet.PEPSCONNECTOR_SERVLET_URL_PATTERN;
-
-		Logger.debug("MOA Assertion Consumer URL (PEPSConnctor): " + acsURL);
 
 		String providerName = oaParam.getFriendlyName();
 		Logger.debug("Issuer value: " + issuerValue);
@@ -1787,12 +1743,18 @@ public class AuthenticationServer implements MOAIDAuthConstants {
 		List<String> value = new ArrayList<String>();
 
 		Logger.debug("PEPS supports XMLSignatures:"+cpeps.isXMLSignatureSupported());
+		String acsURL;
 		if(cpeps.isXMLSignatureSupported())//Send SignRequest to PEPS
 		{
+			//solve Problem with sessionIDs 
+			acsURL = issuerValue + PEPSConnectorServlet.PEPSCONNECTOR_SERVLET_URL_PATTERN;
+			
 			value.add(generateDssSignRequest(CreateXMLSignatureRequestBuilder.buildForeignIDTextToBeSigned("wie im  Signaturzertifikat (as in my signature certificate)", oaParam, moasession),
 					"application/xhtml+xml", moasession.getCcc()));
 			newAttribute.setValue(value);
 			attributeList.add(newAttribute);
+			
+			// TODO[branch]: STORK AuthReq CPEPS acsURL "/PEPSConnector"
 		}
 		else//Process SignRequest locally with MOCCA
 		{
@@ -1808,6 +1770,7 @@ public class AuthenticationServer implements MOAIDAuthConstants {
 			moasession.setSignedDoc(signedDoc);
 
 			acsURL = issuerValue + PEPSConnectorWithLocalSigningServlet.PEPSCONNECTOR_SERVLET_URL_PATTERN;
+			// TODO[branch]: STORK AuthReq acsURL "/PEPSConnectorWithLocalSigning"
 			try {
 				AuthenticationSessionStoreage.storeSession(moasession);
 			} catch (MOADatabaseException e) {
@@ -1816,6 +1779,7 @@ public class AuthenticationServer implements MOAIDAuthConstants {
 			}
 
 		}
+		Logger.debug("MOA Assertion Consumer URL (PEPSConnctor): " + acsURL);
 
 		if (Logger.isDebugEnabled()) {
 			Logger.debug("The following attributes are requested for this OA:");
@@ -1900,6 +1864,8 @@ public class AuthenticationServer implements MOAIDAuthConstants {
 			StringWriter writer = new StringWriter();
 			template.merge(context, writer);
 
+			// TODO[branch]: SAML2 Form Submit to CPEPS, response to acsURL Servlet
+			
 			resp.setContentType("text/html;charset=UTF-8");            
 			resp.getOutputStream().write(writer.toString().getBytes("UTF-8"));
 
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthInitializer.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthInitializer.java
index db36356c0..d4ce8670e 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthInitializer.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthInitializer.java
@@ -148,12 +148,15 @@ public class MOAIDAuthInitializer {
             }
         }
 
+        // FIXME[@tlenz]: iaik.prod:iaik_X509TrustManager requires iaik.IAIKRuntimeException which might have been moved to iaik.server.modules (iaik.prod:iaik_moa:1.51)) 
         // Initializes IAIKX509TrustManager logging
+        /*
         String log4jConfigURL = System.getProperty("log4j.configuration");
         Logger.info("Log4J Configuration: " + log4jConfigURL);
         if (log4jConfigURL != null) {
             IAIKX509TrustManager.initLog(new LoggerConfigImpl(log4jConfigURL));
         }
+         */
 
         // Initializes the Axis secure socket factory for use in calling the
         // MOA-SP web service
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/StartAuthenticationBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/StartAuthenticationBuilder.java
index 484fe1f9e..9a8372a2d 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/StartAuthenticationBuilder.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/StartAuthenticationBuilder.java
@@ -47,6 +47,15 @@ public class StartAuthenticationBuilder {
 	}
 	
 	
+	/**
+	 * Depending on the selected citizen's country ({@code moasession.ccc}):
+	 * <ul>
+	 * <li><strong>Either</strong> creates an "IdentityLinkForm" with embedded {@code InfoBoxReadRequest} to be submitted to a citizen card
+	 * environment for reading the subject's IdentityLink</li>
+	 * </ul>
+	 * 
+	 * @return The IdentityLinkForm.
+	 */
 	public String build(AuthenticationSession moasession, HttpServletRequest req,
 			HttpServletResponse resp) throws WrongParametersException, MOAIDException {
 		
@@ -54,25 +63,11 @@ public class StartAuthenticationBuilder {
 			throw new AuthenticationException("auth.18", new Object[] { });
 		}
 		  
-	    STORKConfig storkConfig = AuthConfigurationProvider.getInstance().getStorkConfig();
-	    
-	    Logger.info("Starting authentication for a citizen of country: " + (StringUtils.isEmpty(moasession.getCcc()) ? "AT" : moasession.getCcc()));
-	    // STORK or normal authentication
-	    if (storkConfig.isSTORKAuthentication(moasession.getCcc())) {
-	    	//STORK authentication
-	    	Logger.trace("Found C-PEPS configuration for citizen of country: " + moasession.getCcc());
-	    	Logger.debug("Starting STORK authentication");
-	    	
-	    	AuthenticationServer.startSTORKAuthentication(req, resp, moasession);
-	    	return "";
-	    	
-	    } else {
-	    	//normal MOA-ID authentication
-	    	Logger.debug("Starting normal MOA-ID authentication");
-		    			    	    	
-	    	String getIdentityLinkForm = AuthenticationServer.getInstance().startAuthentication(moasession, req);	   
+    	//normal MOA-ID authentication
+    	Logger.debug("Starting normal MOA-ID authentication");
+	    			    	    	
+    	String getIdentityLinkForm = AuthenticationServer.getInstance().startAuthentication(moasession, req);	   
 
-	    	return getIdentityLinkForm;
-	    }
+    	return getIdentityLinkForm;
 	}
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSession.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSession.java
index 26c22fb4a..76bf93249 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSession.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSession.java
@@ -304,6 +304,8 @@ public class AuthenticationSession implements Serializable {
 	private String authnContextClassRef;
 	// private String requestedProtocolURL = null;
 	
+	private String processInstanceId;
+	
 	public String getAuthnContextClassRef() {
 		return authnContextClassRef;
 	}
@@ -1110,6 +1112,22 @@ public class AuthenticationSession implements Serializable {
 	 */
 	public Date getSessionCreated() {
 		return sessionCreated;
-	}	
+	}
+
+	/**
+	 * Returns the identifier of the process instance associated with this moaid session.
+	 * @return The process instance id (may be {@code null} if no process has been created yet).
+	 */
+	public String getProcessInstanceId() {
+		return processInstanceId;
+	}
+
+	/**
+	 * Sets the process instance identifier in order to associate a certain process instance with this moaid session. 
+	 * @param processInstanceId The process instance id.
+	 */
+	public void setProcessInstanceId(String processInstanceId) {
+		this.processInstanceId = processInstanceId;
+	}
 	
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/AbstractAuthServletTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/AbstractAuthServletTask.java
new file mode 100644
index 000000000..67ddd170a
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/AbstractAuthServletTask.java
@@ -0,0 +1,378 @@
+package at.gv.egovernment.moa.id.auth.modules;

+

+import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.*;

+

+import java.io.ByteArrayOutputStream;

+import java.io.IOException;

+import java.io.InputStream;

+import java.util.Enumeration;

+import java.util.HashMap;

+import java.util.Iterator;

+import java.util.List;

+import java.util.Map;

+import java.util.Map.Entry;

+

+import javax.servlet.RequestDispatcher;

+import javax.servlet.ServletContext;

+import javax.servlet.ServletException;

+import javax.servlet.http.HttpServletRequest;

+import javax.servlet.http.HttpServletResponse;

+

+import org.apache.commons.fileupload.FileItem;

+import org.apache.commons.fileupload.FileItemFactory;

+import org.apache.commons.fileupload.FileUploadException;

+import org.apache.commons.fileupload.disk.DiskFileItemFactory;

+import org.apache.commons.fileupload.servlet.ServletFileUpload;

+import org.apache.commons.lang3.ArrayUtils;

+

+import at.gv.egovernment.moa.id.advancedlogging.StatisticLogger;

+import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;

+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

+import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

+import at.gv.egovernment.moa.id.auth.servlet.AuthServlet;

+import at.gv.egovernment.moa.id.config.ConfigurationException;

+import at.gv.egovernment.moa.id.entrypoints.DispatcherServlet;

+import at.gv.egovernment.moa.id.process.springweb.MoaIdTask;

+import at.gv.egovernment.moa.id.storage.DBExceptionStoreImpl;

+import at.gv.egovernment.moa.id.storage.IExceptionStore;

+import at.gv.egovernment.moa.id.util.ServletUtils;

+import at.gv.egovernment.moa.logging.Logger;

+import at.gv.egovernment.moa.util.MiscUtil;

+

+/**

+ * Task based counterpart to {@link AuthServlet}, providing the same utility methods (error handling, parameter parsing

+ * etc.).</p> The code has been taken from {@link AuthServlet}.

+ */

+public abstract class AbstractAuthServletTask extends MoaIdTask {

+

+	protected static final String ERROR_CODE_PARAM = "errorid";

+

+	protected void handleErrorNoRedirect(String errorMessage, Throwable exceptionThrown,

+			HttpServletRequest req, HttpServletResponse resp) {

+

+		if (null != errorMessage) {

+			Logger.error(errorMessage);

+			req.setAttribute("ErrorMessage", errorMessage);

+		}

+

+		if (null != exceptionThrown) {

+			if (null == errorMessage)

+				errorMessage = exceptionThrown.getMessage();

+			Logger.error(errorMessage, exceptionThrown);

+			req.setAttribute("ExceptionThrown", exceptionThrown);

+		}

+

+		if (Logger.isDebugEnabled()) {

+			req.setAttribute("LogLevel", "debug");

+		}

+		

+		

+		StatisticLogger logger = StatisticLogger.getInstance();

+		logger.logErrorOperation(exceptionThrown);

+		

+		

+		// forward this to errorpage-auth.jsp where the HTML error page is

+		// generated

+		ServletContext context = req.getServletContext();

+		RequestDispatcher dispatcher = context

+				.getRequestDispatcher("/errorpage-auth.jsp");

+		try {

+

+			resp.setHeader(HEADER_EXPIRES, HEADER_VALUE_EXPIRES);

+			resp.setHeader(HEADER_PRAGMA, HEADER_VALUE_PRAGMA);

+			resp.setHeader(HEADER_CACHE_CONTROL, HEADER_VALUE_CACHE_CONTROL);

+			resp.addHeader(HEADER_CACHE_CONTROL, HEADER_VALUE_CACHE_CONTROL_IE);

+

+			dispatcher.forward(req, resp);

+		} catch (ServletException e) {

+			Logger.error(e);

+		} catch (IOException e) {

+			Logger.error(e);

+		}

+	}

+	

+	/**

+	 * Handles an error. <br>>

+	 * <ul>

+	 * <li>Logs the error</li>

+	 * <li>Places error message and exception thrown into the request as request

+	 * attributes (to be used by <code>"/errorpage-auth.jsp"</code>)</li>

+	 * <li>Sets HTTP status 500 (internal server error)</li>

+	 * </ul>

+	 * 

+	 * @param errorMessage

+	 *            error message

+	 * @param exceptionThrown

+	 *            exception thrown

+	 * @param req

+	 *            servlet request

+	 * @param resp

+	 *            servlet response

+	 */

+	protected void handleError(String errorMessage, Throwable exceptionThrown,

+			HttpServletRequest req, HttpServletResponse resp, String pendingRequestID) {

+

+		if (null != errorMessage) {

+			Logger.error(errorMessage);

+			req.setAttribute("ErrorMessage", errorMessage);

+		}

+

+		if (null != exceptionThrown) {

+			if (null == errorMessage)

+				errorMessage = exceptionThrown.getMessage();

+			Logger.error(errorMessage, exceptionThrown);

+			req.setAttribute("ExceptionThrown", exceptionThrown);

+		}

+

+		if (Logger.isDebugEnabled()) {

+			req.setAttribute("LogLevel", "debug");

+		}

+

+		if (!(exceptionThrown instanceof MOAIDException)) {

+			Logger.error("Receive an internal error: Message=" + exceptionThrown.getMessage(), exceptionThrown);

+			

+		}

+		

+		IExceptionStore store = DBExceptionStoreImpl.getStore();

+		String id = store.storeException(exceptionThrown);

+

+		if (id != null && MiscUtil.isNotEmpty(pendingRequestID)) {

+		

+			String redirectURL = null;

+

+			redirectURL = ServletUtils.getBaseUrl(req);

+			redirectURL += "/dispatcher?" + ERROR_CODE_PARAM + "=" + id 

+					+ "&" + DispatcherServlet.PARAM_TARGET_PENDINGREQUESTID + "=" + pendingRequestID;

+		

+			resp.setContentType("text/html");

+			resp.setStatus(302);

+	

+			resp.addHeader("Location", redirectURL);		

+			Logger.debug("REDIRECT TO: " + redirectURL);	

+		

+			return;

+			

+		} else {

+			

+			//Exception can not be stored in database

+			handleErrorNoRedirect(errorMessage, exceptionThrown, req, resp);

+		}

+	}

+

+	/**

+	 * Handles a <code>WrongParametersException</code>.

+	 * 

+	 * @param req

+	 *            servlet request

+	 * @param resp

+	 *            servlet response

+	 */

+	protected void handleWrongParameters(WrongParametersException ex,

+			HttpServletRequest req, HttpServletResponse resp) {

+		Logger.error(ex.toString());

+		req.setAttribute("WrongParameters", ex.getMessage());

+

+		// forward this to errorpage-auth.jsp where the HTML error page is

+		// generated

+		ServletContext context = req.getServletContext();

+		RequestDispatcher dispatcher = context

+				.getRequestDispatcher("/errorpage-auth.jsp");

+		try {

+			setNoCachingHeaders(resp);

+			dispatcher.forward(req, resp);

+		} catch (ServletException e) {

+			Logger.error(e);

+		} catch (IOException e) {

+			Logger.error(e);

+		}

+	}

+

+	/**

+	 * Logs all servlet parameters for debugging purposes.

+	 */

+	protected void logParameters(HttpServletRequest req) {

+		for (Enumeration params = req.getParameterNames(); params

+				.hasMoreElements();) {

+			String parname = (String) params.nextElement();

+			Logger.debug("Parameter " + parname + req.getParameter(parname));

+		}

+	}

+

+	/**

+	 * Parses the request input stream for parameters, assuming parameters are

+	 * encoded UTF-8 (no standard exists how browsers should encode them).

+	 * 

+	 * @param req

+	 *            servlet request

+	 * 

+	 * @return mapping parameter name -> value

+	 * 

+	 * @throws IOException

+	 *             if parsing request parameters fails.

+	 * 

+	 * @throws FileUploadException

+	 *             if parsing request parameters fails.

+	 */

+	protected Map<String, String> getParameters(HttpServletRequest req) throws IOException,

+			FileUploadException {

+

+		Map<String, String> parameters = new HashMap<String, String>();

+

+		if (ServletFileUpload.isMultipartContent(req)) {

+			// request is encoded as mulitpart/form-data

+			FileItemFactory factory = new DiskFileItemFactory();

+			ServletFileUpload upload = null;

+			upload = new ServletFileUpload(factory);

+			List items = null;

+			items = upload.parseRequest(req);

+			for (int i = 0; i < items.size(); i++) {

+				FileItem item = (FileItem) items.get(i);

+				if (item.isFormField()) {

+					// Process only form fields - no file upload items

+					String logString = item.getString("UTF-8");

+

+					// TODO use RegExp

+					String startS = "<pr:Identification><pr:Value>";

+					String endS = "</pr:Value><pr:Type>urn:publicid:gv.at:baseid</pr:Type>";

+					String logWithMaskedBaseid = logString;

+					int start = logString.indexOf(startS);

+					if (start > -1) {

+						int end = logString.indexOf(endS);

+						if (end > -1) {

+							logWithMaskedBaseid = logString.substring(0, start);

+							logWithMaskedBaseid += startS;

+							logWithMaskedBaseid += "xxxxxxxxxxxxxxxxxxxxxxxx";

+							logWithMaskedBaseid += logString.substring(end,

+									logString.length());

+						}

+					}

+					parameters

+							.put(item.getFieldName(), item.getString("UTF-8"));

+					Logger.debug("Processed multipart/form-data request parameter: \nName: "

+							+ item.getFieldName()

+							+ "\nValue: "

+							+ logWithMaskedBaseid);

+				}

+			}

+		}

+

+		else {

+			// request is encoded as application/x-www-urlencoded

+			// [tknall]: we must not consume request body input stream once servlet-api request parameters have been accessed

+			

+			/*

+			InputStream in = req.getInputStream();

+

+			String paramName;

+			String paramValueURLEncoded;

+			do {

+				paramName = new String(readBytesUpTo(in, '='));

+				if (paramName.length() > 0) {

+					paramValueURLEncoded = readBytesUpTo(in, '&');

+					String paramValue = URLDecoder.decode(paramValueURLEncoded,

+							"UTF-8");

+					parameters.put(paramName, paramValue);

+				}

+			} while (paramName.length() > 0);

+			in.close();

+			*/

+			

+			Iterator<Entry<String, String[]>> requestParamIt = req.getParameterMap().entrySet().iterator();

+			while (requestParamIt.hasNext()) {

+				Entry<String, String[]> entry = requestParamIt.next();

+				String key = entry.getKey();

+				String[] values = entry.getValue();

+				// take the last value from the value array since the legacy code above also does it this way

+				parameters.put(key, ArrayUtils.isEmpty(values) ? null : values[values.length-1]); 

+			}

+			

+		}

+

+		return parameters;

+	}

+

+	/**

+	 * Reads bytes up to a delimiter, consuming the delimiter.

+	 * 

+	 * @param in

+	 *            input stream

+	 * @param delimiter

+	 *            delimiter character

+	 * @return String constructed from the read bytes

+	 * @throws IOException

+	 */

+	protected String readBytesUpTo(InputStream in, char delimiter)

+			throws IOException {

+		ByteArrayOutputStream bout = new ByteArrayOutputStream();

+		boolean done = false;

+		int b;

+		while (!done && (b = in.read()) >= 0) {

+			if (b == delimiter)

+				done = true;

+			else

+				bout.write(b);

+		}

+		return bout.toString();

+	}

+

+	/**

+	 * Sets response headers that prevent caching (code taken from {@link AuthServlet}).

+	 * 

+	 * @param resp

+	 *            The HttpServletResponse.

+	 */

+	public void setNoCachingHeaders(HttpServletResponse resp) {

+		resp.setHeader(HEADER_EXPIRES, HEADER_VALUE_EXPIRES);

+		resp.setHeader(HEADER_PRAGMA, HEADER_VALUE_PRAGMA);

+		resp.setHeader(HEADER_CACHE_CONTROL, HEADER_VALUE_CACHE_CONTROL);

+		resp.addHeader(HEADER_CACHE_CONTROL, HEADER_VALUE_CACHE_CONTROL_IE);

+	}

+

+	/**

+	 * Adds a parameter to a URL.

+	 * 

+	 * @param url

+	 *            the URL

+	 * @param paramname

+	 *            parameter name

+	 * @param paramvalue

+	 *            parameter value

+	 * @return the URL with parameter added

+	 */

+	protected static String addURLParameter(String url, String paramname,

+			String paramvalue) {

+		String param = paramname + "=" + paramvalue;

+		if (url.indexOf("?") < 0)

+			return url + "?" + param;

+		else

+			return url + "&" + param;

+	}

+

+	/**

+	 * Checks if HTTP requests are allowed

+	 * 

+	 * @param authURL

+	 *            requestURL

+	 * @throws AuthenticationException

+	 *             if HTTP requests are not allowed

+	 * @throws ConfigurationException

+	 */

+	protected void checkIfHTTPisAllowed(String authURL)

+			throws AuthenticationException, ConfigurationException {

+		// check if HTTP Connection may be allowed (through

+		// FRONTEND_SERVLETS_ENABLE_HTTP_CONNECTION_PROPERTY)

+		

+		//Removed from MOA-ID 2.0 config

+//		String boolStr = AuthConfigurationProvider

+//				.getInstance()

+//				.getGenericConfigurationParameter(

+//						AuthConfigurationProvider.FRONTEND_SERVLETS_ENABLE_HTTP_CONNECTION_PROPERTY);

+		if ((!authURL.startsWith("https:"))

+				//&& (false == BoolUtils.valueOf(boolStr))

+				)

+			throw new AuthenticationException("auth.07", new Object[] { authURL

+					+ "*" });

+

+	}

+

+}

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/AuthModule.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/AuthModule.java
new file mode 100644
index 000000000..a31f3ceb0
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/AuthModule.java
@@ -0,0 +1,41 @@
+package at.gv.egovernment.moa.id.auth.modules;
+
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+import at.gv.egovernment.moa.id.process.model.ProcessDefinition;
+
+/**
+ * Provides metadata of a certain module. Uses for module discovery and process selection.
+ */
+public interface AuthModule {
+
+	/**
+	 * Returns the priority of the module. The priority defines the order of the respective module within the chain of
+	 * discovered modules. Higher priorized modules are asked before lower priorized modules for a process that they can
+	 * handle.
+	 * <p/>
+	 * Internal default modules are priorized neutral ({@code 0}. Use a higher priority ({@code 1...Integer.MAX_VALUE})
+	 * in order to have your module(s) priorized or a lower priority ({@code Integer.MIN_VALUE...-1}) in order to put
+	 * your modules behind default modules.
+	 * 
+	 * @return the priority of the module.
+	 */
+	int getPriority();
+
+	/**
+	 * Checks if the module has a process, which is able to perform an authentication with the given
+	 * {@link ExecutionContext}.
+	 * 
+	 * @param context
+	 *            an ExecutionContext for a process.
+	 * @return the process-ID of a process which is able to work with the given ExecutionContext, or {@code null}.
+	 */
+	String selectProcess(ExecutionContext context);
+
+	/**
+	 * Returns the an Array of {@link ProcessDefinition}s of the processes included in this module.
+	 * 
+	 * @return an array of resource uris of the processes included in this module.
+	 */
+	String[] getProcessDefinitions();
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/DefaultAuthModuleImpl.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/DefaultAuthModuleImpl.java
new file mode 100644
index 000000000..8ae4a9999
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/DefaultAuthModuleImpl.java
@@ -0,0 +1,28 @@
+package at.gv.egovernment.moa.id.auth.modules.internal;
+
+import org.apache.commons.lang3.StringUtils;
+
+import at.gv.egovernment.moa.id.auth.modules.AuthModule;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+
+/**
+ * Module descriptor
+ */
+public class DefaultAuthModuleImpl implements AuthModule {
+
+	@Override
+	public int getPriority() {
+		return 0;
+	}
+
+	@Override
+	public String selectProcess(ExecutionContext context) {
+		return StringUtils.isBlank((String) context.get("ccc")) ? "DefaultAuthentication" : null;
+	}
+
+	@Override
+	public String[] getProcessDefinitions() {
+		return new String[] { "classpath:at/gv/egovernment/moa/id/auth/modules/internal/DefaultAuthentication.process.xml" };
+	}
+
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CertificateReadRequestTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CertificateReadRequestTask.java
new file mode 100644
index 000000000..bc73a9f2f
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CertificateReadRequestTask.java
@@ -0,0 +1,101 @@
+package at.gv.egovernment.moa.id.auth.modules.internal.tasks;

+

+import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.*;

+

+import javax.servlet.http.HttpServletRequest;

+import javax.servlet.http.HttpServletResponse;

+

+import org.apache.commons.lang.StringEscapeUtils;

+import org.apache.commons.lang3.BooleanUtils;

+

+import at.gv.egovernment.moa.id.auth.AuthenticationServer;

+import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;

+import at.gv.egovernment.moa.id.auth.builder.InfoboxReadRequestBuilderCertificate;

+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

+import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;

+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

+import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;

+import at.gv.egovernment.moa.id.commons.db.ConfigurationDBUtils;

+import at.gv.egovernment.moa.id.process.api.ExecutionContext;

+import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;

+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;

+import at.gv.egovernment.moa.id.util.ServletUtils;

+import at.gv.egovernment.moa.logging.Logger;

+

+/**

+ * Creates {@code InfoBoxReadRequest} in order to read the subject's certificates.<p/>

+ * In detail:

+ * <ul>

+ * <li>Renames the moa session id.</li>

+ * <li>Creates {@code InfoBoxReadRequest} in order to read the subject's certificates.</li>

+ * <li>Responds with {@code InfoBoxReadRequest} (for CCE), {@code DataURL} is {@code /VerifyCertificate}</li>

+ * </ul>

+ * Expects:

+ * <ul>

+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>

+ * </ul>

+ * Result:

+ * <ul>

+ * <li>Responds with {@code InfoBoxReadRequest} (for CCE), {@code DataURL} is {@code /VerifyCertificate}</li>

+ * </ul>

+ * Code taken from {@link at.gv.egovernment.moa.id.auth.servlet.VerifyIdentityLinkServlet}.

+ * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)

+ *

+ */

+public class CertificateReadRequestTask extends AbstractAuthServletTask {

+

+	@Override

+	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)

+			throws Exception {

+

+		// TODO[branch]: Foreign citizen or mandate mode; respond with IRR for certificates, dataURL = "/VerifyCertificate"

+		Logger.info("Send InfoboxReadRequest to BKU to get signer certificate.");

+

+		setNoCachingHeaders(resp);

+

+		String pendingRequestID = null;

+		

+		try {

+		

+			String sessionID = StringEscapeUtils.escapeHtml(req.getParameter(PARAM_SESSIONID));

+			

+			// check parameter

+			if (!ParamValidatorUtils.isValidSessionID(sessionID)) {

+				throw new WrongParametersException("CertificateReadRequestTask", PARAM_SESSIONID, "auth.12");

+			}

+

+			pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID);

+

+			AuthenticationSession session = AuthenticationServer.getSession(sessionID);

+

+			boolean useMandate = session.getUseMandate();

+			boolean identityLinkAvailable = BooleanUtils.isTrue((Boolean) executionContext.get("identityLinkAvailable"));

+			

+			if (!identityLinkAvailable && useMandate) {

+				Logger.error("Online-Mandate Mode for foreign citizencs not supported.");

+				throw new AuthenticationException("auth.13", null);

+			}

+

+			// change MOASessionID

+			AuthenticationSessionStoreage.changeSessionID(session);

+			

+			// create the InfoboxReadRequest to get the certificate

+			String infoboxReadRequest = new InfoboxReadRequestBuilderCertificate().build(true);

+

+			// build dataurl (to the VerifyCertificateSerlvet)

+			String dataurl = new DataURLBuilder().buildDataURL(session.getAuthURL(), REQ_VERIFY_CERTIFICATE,

+					session.getSessionID());

+

+			ServletUtils.writeCreateXMLSignatureRequest(resp, infoboxReadRequest,

+					AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "VerifyIdentityLink", dataurl);

+		

+		} catch (MOAIDException ex) {

+			handleError(null, ex, req, resp, pendingRequestID);

+		} finally {

+			ConfigurationDBUtils.closeSession();

+		}		

+

+	}

+

+}

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateIdentityLinkFormTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateIdentityLinkFormTask.java
new file mode 100644
index 000000000..4cd1ea94e
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/CreateIdentityLinkFormTask.java
@@ -0,0 +1,119 @@
+package at.gv.egovernment.moa.id.auth.modules.internal.tasks;

+

+import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.*;

+

+import java.io.PrintWriter;

+

+import javax.servlet.http.HttpServletRequest;

+import javax.servlet.http.HttpServletResponse;

+

+import org.apache.commons.lang.StringEscapeUtils;

+import org.apache.commons.lang3.ObjectUtils;

+

+import at.gv.egovernment.moa.id.auth.builder.StartAuthenticationBuilder;

+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

+import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;

+import at.gv.egovernment.moa.id.auth.servlet.GenerateIFrameTemplateServlet;

+import at.gv.egovernment.moa.id.commons.db.ConfigurationDBUtils;

+import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;

+import at.gv.egovernment.moa.id.process.api.ExecutionContext;

+import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;

+import at.gv.egovernment.moa.logging.Logger;

+import at.gv.egovernment.moa.util.MiscUtil;

+import at.gv.egovernment.moa.util.StringUtils;

+

+/**

+ * Creates a http form including an embedded {@code InfoBoxReadRequest} for reading the identity link.<p/>

+ * In detail:

+ * <ul>

+ * <li>Renames the moa session id.</li>

+ * <li>Removes ExecutionContext property {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}.</li>

+ * <li>Creates the http form mentioned above.</li>

+ * <li>Returns the http form via HttpServletResponse.</li>

+ * </ul>

+ * Expects:

+ * <ul>

+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID} <strong>or</strong></li>

+ * <li>ExecutionContext property {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID} (in case of legacy authentication without CCE selection, where the moa session is not provided by request parameter).</li>

+ * </ul>

+ * Result:

+ * <ul>

+ * <li>The identity link form via HttpServletResponse.</li>

+ * </ul>

+ * Possible branches:

+ * <ul>

+ * <li>In case of STORK authentication

+ * <ul>

+ * <li>Creates STORK auth SAML request.</li>

+ * <li>Creates and returns a form for submitting the SAML request to the CPEPS (post binding).</li>

+ * <li>Returns the form via HttpServletResponse.</li>

+ * </ul>

+ * </li>

+ * </ul>

+ * Code taken from {@link at.gv.egovernment.moa.id.auth.servlet.GenerateIFrameTemplateServlet}.

+ * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)

+ *

+ */

+public class CreateIdentityLinkFormTask extends AbstractAuthServletTask {

+

+	@Override

+	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)

+			throws Exception {

+

+		String pendingRequestID = null;

+		String moasessionid = StringEscapeUtils.escapeHtml(ObjectUtils.defaultIfNull(req.getParameter(PARAM_SESSIONID), (String) executionContext.get(PARAM_SESSIONID)));

+		AuthenticationSession moasession = null;

+		try {

+			

+			if (MiscUtil.isEmpty(moasessionid)) {

+				Logger.warn("MOASessionID is empty.");

+				throw new MOAIDException("auth.18", new Object[] {});

+			}

+			

+			try {

+			

+				pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(moasessionid);

+				moasession = AuthenticationSessionStoreage.getSession(moasessionid);

+				AuthenticationSessionStoreage.changeSessionID(moasession);

+				executionContext.remove(PARAM_SESSIONID);

+			

+			} catch (MOADatabaseException e) {

+				Logger.info("MOASession with SessionID=" + moasessionid + " is not found in Database");

+				throw new MOAIDException("init.04", new Object[] { moasessionid });

+

+			} catch (Throwable e) {

+				Logger.info("No HTTP Session found!");

+				throw new MOAIDException("auth.18", new Object[] {});

+			}

+

+			StartAuthenticationBuilder startauth = StartAuthenticationBuilder.getInstance();

+			String getIdentityLinkForm = startauth.build(moasession, req, resp);

+

+			if (!StringUtils.isEmpty(getIdentityLinkForm)) {

+				resp.setContentType("text/html;charset=UTF-8");

+				PrintWriter out = new PrintWriter(resp.getOutputStream());

+				out.print(getIdentityLinkForm);

+				out.flush();

+				Logger.debug("Finished GET " + GenerateIFrameTemplateServlet.class);

+			}

+			

+		} catch (WrongParametersException ex) {

+			handleWrongParameters(ex, req, resp);

+		}

+

+		catch (MOAIDException ex) {

+			handleError(null, ex, req, resp, pendingRequestID);

+

+		} catch (Exception e) {

+			Logger.error("CreateIdentityLinkFormTask has an interal Error.", e);

+

+		}

+

+		finally {

+			ConfigurationDBUtils.closeSession();

+		}

+	}

+

+}

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GetForeignIDTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GetForeignIDTask.java
new file mode 100644
index 000000000..4771628a3
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GetForeignIDTask.java
@@ -0,0 +1,182 @@
+package at.gv.egovernment.moa.id.auth.modules.internal.tasks;

+

+import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.*;

+

+import java.io.ByteArrayInputStream;

+import java.io.IOException;

+import java.security.cert.CertificateException;

+import java.util.Map;

+

+import javax.servlet.http.HttpServletRequest;

+import javax.servlet.http.HttpServletResponse;

+import javax.xml.transform.TransformerException;

+

+import org.apache.commons.fileupload.FileUploadException;

+import org.apache.commons.lang.StringEscapeUtils;

+import org.w3c.dom.Element;

+

+import at.gv.egovernment.moa.id.auth.AuthenticationServer;

+import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;

+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

+import at.gv.egovernment.moa.id.auth.data.CreateXMLSignatureResponse;

+import at.gv.egovernment.moa.id.auth.data.IdentityLink;

+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

+import at.gv.egovernment.moa.id.auth.exception.ParseException;

+import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;

+import at.gv.egovernment.moa.id.auth.parser.CreateXMLSignatureResponseParser;

+import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser;

+import at.gv.egovernment.moa.id.client.SZRGWClientException;

+import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;

+import at.gv.egovernment.moa.id.moduls.ModulUtils;

+import at.gv.egovernment.moa.id.process.api.ExecutionContext;

+import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;

+import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;

+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;

+import at.gv.egovernment.moa.logging.Logger;

+import at.gv.egovernment.moa.util.DOMUtils;

+import at.gv.util.xsd.srzgw.CreateIdentityLinkResponse;

+

+/**

+ * Evaluates the {@code CreateXMLSignatureResponse}, extracts signature and certificate and asks the SZR Gateway for an identity link.<p/>

+ * In detail:

+ * <ul>

+ * <li>Renames the moa session id.</li>

+ * <li>Parses the CreateXMLSignatureResponse retrieved from POST parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE}.</li>

+ * <li>Extracts signature and signer certificate.</li>

+ * <li>Send request to SZR Gateway in order to get an identity link.</li>

+ * <li>Updates moa session (sets identity link, QAA level 4, authentication data and foreigner flag).</li>

+ * <li>Redirects back to {@code /dispatcher} in order to finalize authentication.</li>

+ * </ul>

+ * Expects:

+ * <ul>

+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>

+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE} containing a {@code CreateXMLSignatureResponse}.</li>

+ * </ul>

+ * Result:

+ * <ul>

+ * <li>Identity link, QAA level 4 and foreigner flag put into moa session.</li>

+ * <li>Redirect to {@code /dispatcher}.</li>

+ * </ul>

+ * Code taken from {@link at.gv.egovernment.moa.id.auth.servlet.GetForeignIDServlet}.

+ * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)

+ *

+ */

+public class GetForeignIDTask extends AbstractAuthServletTask {

+

+	@Override

+	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)

+			throws Exception {

+

+		Logger.debug("POST GetForeignIDServlet");

+

+		setNoCachingHeaders(resp);

+

+		Map<String, String> parameters;

+

+		try {

+			parameters = getParameters(req);

+		} catch (FileUploadException e) {

+			Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());

+			throw new IOException(e.getMessage());

+		}

+		

+		String sessionID = StringEscapeUtils.escapeHtml(req.getParameter(PARAM_SESSIONID));

+		String pendingRequestID = null;

+		String redirectURL = null;

+		AuthenticationSession session = null;

+		try {

+			// check parameter

+			if (!ParamValidatorUtils.isValidSessionID(sessionID)) {

+				throw new WrongParametersException("GetForeignID", PARAM_SESSIONID, "auth.12");

+			}

+			String xmlCreateXMLSignatureResponse = (String) parameters.get(PARAM_XMLRESPONSE);

+			if (!ParamValidatorUtils.isValidXMLDocument(xmlCreateXMLSignatureResponse)) {

+				throw new WrongParametersException("GetForeignID", PARAM_XMLRESPONSE, "auth.12");

+			}

+			pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID);

+			session = AuthenticationServer.getSession(sessionID);

+

+			// change MOASessionID

+			sessionID = AuthenticationSessionStoreage.changeSessionID(session);

+

+			Logger.debug(xmlCreateXMLSignatureResponse);

+

+			CreateXMLSignatureResponse csresp = new CreateXMLSignatureResponseParser(xmlCreateXMLSignatureResponse)

+					.parseResponseDsig();

+

+			try {

+				String serializedAssertion = DOMUtils.serializeNode(csresp.getDsigSignature());

+				session.setAuthBlock(serializedAssertion);

+

+			} catch (TransformerException e) {

+				throw new ParseException("parser.04", new Object[] { REQ_VERIFY_AUTH_BLOCK, PARAM_XMLRESPONSE });

+

+			} catch (IOException e) {

+				throw new ParseException("parser.04", new Object[] { REQ_VERIFY_AUTH_BLOCK, PARAM_XMLRESPONSE });

+

+			}

+

+			Element signature = csresp.getDsigSignature();

+

+			try {

+				session.setSignerCertificate(AuthenticationServer.getCertificateFromXML(signature));

+			} catch (CertificateException e) {

+				Logger.error("Could not extract certificate from CreateXMLSignatureResponse");

+				throw new MOAIDException("auth.14", null);

+			}

+

+			// make SZR request to the identity link

+			CreateIdentityLinkResponse response = AuthenticationServer.getInstance().getIdentityLink(signature);

+

+			if (null != response.getErrorResponse()) {

+				// TODO fix exception parameter

+				throw new SZRGWClientException("service.08", (String) response.getErrorResponse().getErrorCode(),

+						(String) response.getErrorResponse().getInfo());

+			} else {

+				IdentityLinkAssertionParser ilParser = new IdentityLinkAssertionParser(new ByteArrayInputStream(

+						response.getIdentityLink()));

+				IdentityLink identitylink = ilParser.parseIdentityLink();

+				session.setIdentityLink(identitylink);

+

+				// set QAA Level four in case of card authentifcation

+				session.setQAALevel(PVPConstants.STORK_QAA_1_4);

+

+				AuthenticationServer.getInstance().getForeignAuthenticationData(session);

+

+				// session is implicit stored in changeSessionID!!!!

+				String newMOASessionID = AuthenticationSessionStoreage.changeSessionID(session);

+

+				Logger.info("Changed MOASession " + sessionID + " to Session " + newMOASessionID);

+				Logger.info("Daten angelegt zu MOASession " + newMOASessionID);

+

+				redirectURL = new DataURLBuilder().buildDataURL(session.getAuthURL(),

+						ModulUtils.buildAuthURL(session.getModul(), session.getAction(), pendingRequestID),

+						newMOASessionID);

+				redirectURL = resp.encodeRedirectURL(redirectURL);

+

+				// TODO[branch]: Final step back to /dispatcher

+

+				try {

+					AuthenticationSessionStoreage.storeSession(session);

+				} catch (MOADatabaseException e) {

+					throw new MOAIDException("Session store error", null);

+				}

+

+				resp.setContentType("text/html");

+				resp.setStatus(302);

+				resp.addHeader("Location", redirectURL);

+				Logger.debug("REDIRECT TO: " + redirectURL);

+			}

+

+		} catch (MOAIDException ex) {

+			handleError(null, ex, req, resp, pendingRequestID);

+

+		} catch (Exception e) {

+			Logger.error("GetForeignIDServlet has an interal Error.", e);

+

+		}

+

+	}

+

+}

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GetMISSessionIDTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GetMISSessionIDTask.java
new file mode 100644
index 000000000..f08f96782
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/GetMISSessionIDTask.java
@@ -0,0 +1,181 @@
+package at.gv.egovernment.moa.id.auth.modules.internal.tasks;

+

+import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.*;

+import iaik.pki.PKIException;

+

+import java.security.GeneralSecurityException;

+import java.util.List;

+

+import javax.net.ssl.SSLSocketFactory;

+import javax.servlet.http.HttpServletRequest;

+import javax.servlet.http.HttpServletResponse;

+import javax.xml.parsers.ParserConfigurationException;

+

+import org.apache.commons.lang.StringEscapeUtils;

+import org.xml.sax.SAXException;

+

+import at.gv.egovernment.moa.id.auth.AuthenticationServer;

+import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;

+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

+import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;

+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

+import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;

+import at.gv.egovernment.moa.id.commons.db.ConfigurationDBUtils;

+import at.gv.egovernment.moa.id.config.ConnectionParameter;

+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;

+import at.gv.egovernment.moa.id.moduls.ModulUtils;

+import at.gv.egovernment.moa.id.process.api.ExecutionContext;

+import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants;

+import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;

+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;

+import at.gv.egovernment.moa.id.util.SSLUtils;

+import at.gv.egovernment.moa.id.util.client.mis.simple.MISMandate;

+import at.gv.egovernment.moa.id.util.client.mis.simple.MISSimpleClient;

+import at.gv.egovernment.moa.logging.Logger;

+import at.gv.egovernment.moa.util.DOMUtils;

+

+/**

+ * Retrieves a mandate from the online mandate issuing service.<p/>

+ * In detail:

+ * <ul>

+ * <li>Renames the moa session id.</li>

+ * <li>Retrieves the mandate referenced within the moa session from the online (external) mandate issuing service.</li>

+ * <li>Verifies the mandate.</li>

+ * <li>Puts mandate into moa session.</li>

+ * <li>Redirects back to {@code /dispatcher} in order to finalize the authentication.</li>

+ * </ul>

+ * Expects:

+ * <ul>

+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>

+ * </ul>

+ * Result:

+ * <ul>

+ * <li>Mandate put into moa session.</li>

+ * <li>Redirect to {@code /dispatcher}.</li>

+ * </ul>

+ * Code taken from {@link at.gv.egovernment.moa.id.auth.servlet.GetMISSessionIDServlet}.

+ * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)

+ *

+ */

+public class GetMISSessionIDTask extends AbstractAuthServletTask {

+

+	@Override

+	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)

+			throws Exception {

+		

+		Logger.debug("POST GetMISSessionIDServlet");

+

+		String sessionID = req.getParameter(PARAM_SESSIONID);

+

+		// escape parameter strings

+		sessionID = StringEscapeUtils.escapeHtml(sessionID);

+

+		AuthenticationSession session = null;

+		String pendingRequestID = null;

+		try {

+			// check parameter

+			if (!ParamValidatorUtils.isValidSessionID(sessionID))

+				throw new WrongParametersException("VerifyCertificate",

+						PARAM_SESSIONID, "auth.12");

+

+			pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID);

+			

+			session = AuthenticationServer.getSession(sessionID);

+

+			//change MOASessionID

+		    sessionID = AuthenticationSessionStoreage.changeSessionID(session);

+			

+			String misSessionID = session.getMISSessionID();

+

+			AuthConfigurationProvider authConf = AuthConfigurationProvider

+					.getInstance();

+			ConnectionParameter connectionParameters = authConf

+					.getOnlineMandatesConnectionParameter();

+			SSLSocketFactory sslFactory = SSLUtils.getSSLSocketFactory(

+					AuthConfigurationProvider.getInstance(),

+					connectionParameters);

+

+			List<MISMandate> list = MISSimpleClient.sendGetMandatesRequest(

+					connectionParameters.getUrl(), misSessionID, sslFactory);

+

+			if (list == null || list.size() == 0) {

+				Logger.error("Keine Vollmacht gefunden.");

+				throw new AuthenticationException("auth.15", null);

+			}

+

+			// for now: list contains only one element

+			MISMandate mandate = (MISMandate) list.get(0);

+

+			// TODO[tlenz]: UTF-8 ?

+			String sMandate = new String(mandate.getMandate());

+			if (sMandate == null || sMandate.compareToIgnoreCase("") == 0) {

+				Logger.error("Mandate is empty.");

+				throw new AuthenticationException("auth.15",

+						new Object[] { GET_MIS_SESSIONID });

+			}

+						

+			//check if it is a parsable XML

+			byte[] byteMandate = mandate.getMandate();

+			// TODO[tlenz]: UTF-8 ?

+			String stringMandate = new String(byteMandate);

+			DOMUtils.parseDocument(stringMandate, false,

+					null, null).getDocumentElement();

+			

+			// extract RepresentationType

+			AuthenticationServer.getInstance().verifyMandate(session, mandate);

+			

+			session.setMISMandate(mandate);

+			session.setAuthenticatedUsed(false);

+			session.setAuthenticated(true);

+			

+	    	//set QAA Level four in case of card authentifcation

+	    	session.setQAALevel(PVPConstants.STORK_QAA_1_4);

+			

+			String oldsessionID = session.getSessionID();

+			

+			//Session is implicite stored in changeSessionID!!!

+			String newMOASessionID = AuthenticationSessionStoreage.changeSessionID(session);

+			

+			Logger.info("Changed MOASession " + oldsessionID + " to Session " + newMOASessionID);

+			Logger.info("Daten angelegt zu MOASession " + newMOASessionID);

+						

+			String redirectURL = new DataURLBuilder().buildDataURL(

+					session.getAuthURL(),

+					ModulUtils.buildAuthURL(session.getModul(),

+							session.getAction(), pendingRequestID), newMOASessionID);

+			redirectURL = resp.encodeRedirectURL(redirectURL);

+			

+			// TODO[branch]: Final step back to /dispatcher

+			

+			resp.setContentType("text/html");

+			resp.setStatus(302);

+			resp.addHeader("Location", redirectURL);

+			Logger.debug("REDIRECT TO: " + redirectURL);

+

+		} catch (MOAIDException ex) {

+			handleError(null, ex, req, resp, pendingRequestID);

+			

+		} catch (GeneralSecurityException ex) {

+			handleError(null, ex, req, resp, pendingRequestID);

+			

+		} catch (PKIException e) {

+			handleError(null, e, req, resp, pendingRequestID);

+			

+		} catch (SAXException e) {

+			handleError(null, e, req, resp, pendingRequestID);

+			

+		} catch (ParserConfigurationException e) {

+			handleError(null, e, req, resp, pendingRequestID);

+			

+	    } catch (Exception e) {

+	    	Logger.error("MISMandateValidation has an interal Error.", e);

+	       

+	    }

+	    finally {

+	    	ConfigurationDBUtils.closeSession();

+	    }

+		

+	}

+

+}

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/PrepareAuthBlockSignatureTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/PrepareAuthBlockSignatureTask.java
new file mode 100644
index 000000000..dcea3a1dd
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/PrepareAuthBlockSignatureTask.java
@@ -0,0 +1,102 @@
+package at.gv.egovernment.moa.id.auth.modules.internal.tasks;

+

+import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.*;

+

+import javax.servlet.http.HttpServletRequest;

+import javax.servlet.http.HttpServletResponse;

+

+import org.apache.commons.lang.StringEscapeUtils;

+

+import at.gv.egovernment.moa.id.auth.AuthenticationServer;

+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

+import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;

+import at.gv.egovernment.moa.id.commons.db.ConfigurationDBUtils;

+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;

+import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;

+import at.gv.egovernment.moa.id.process.api.ExecutionContext;

+import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;

+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;

+import at.gv.egovernment.moa.id.util.ServletUtils;

+import at.gv.egovernment.moa.logging.Logger;

+

+/**

+ * Creates {@code CreateXMLSignatureRequest} for auth block signature.<p/>

+ * In detail:

+ * <ul>

+ * <li>Renames the moa session id.</li>

+ * <li>Creates {@code CreateXMLSignatureRequest} for auth block signature.</li>

+ * <li>Responds with {@code CreateXMLSignatureRequest} (for CCE), {@code DataURL} is {@code /VerifyAuthBlock}</li>

+ * </ul>

+ * Expects:

+ * <ul>

+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>

+ * </ul>

+ * Result:

+ * <ul>

+ * <li>Responds with {@code CreateXMLSignatureRequest} (for CCE), {@code DataURL} is {@code /VerifyAuthBlock}</li>

+ * </ul>

+ * Code taken from {@link at.gv.egovernment.moa.id.auth.servlet.VerifyIdentityLinkServlet}.

+ * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)

+ *

+ */

+public class PrepareAuthBlockSignatureTask extends AbstractAuthServletTask {

+

+	@Override

+	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)

+			throws Exception {

+		// note: code taken from at.gv.egovernment.moa.id.auth.servlet.VerifyIdentityLinkServlet

+

+		Logger.debug("Process IdentityLink");

+

+		setNoCachingHeaders(resp);

+		

+		String pendingRequestID = null;

+

+		try {

+			

+			String sessionID = StringEscapeUtils.escapeHtml(req.getParameter(PARAM_SESSIONID));

+			

+			// check parameter

+			if (!ParamValidatorUtils.isValidSessionID(sessionID)) {

+				throw new WrongParametersException("VerifyIdentityLink", PARAM_SESSIONID, "auth.12");

+			}

+

+			pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID);

+

+			AuthenticationSession session = AuthenticationServer.getSession(sessionID);

+

+			// change MOASessionID

+			sessionID = AuthenticationSessionStoreage.changeSessionID(session);

+				

+			Logger.info("Normal");

+

+			// TODO[branch]: Default behaviour; respond with CXSR for authblock signature, dataURL "/VerifyAuthBlock"

+

+			OAAuthParameter oaParam = AuthConfigurationProvider.getInstance().getOnlineApplicationParameter(

+					session.getPublicOAURLPrefix());

+			AuthConfigurationProvider authConf = AuthConfigurationProvider.getInstance();

+

+			String createXMLSignatureRequest = AuthenticationServer.getInstance()

+					.getCreateXMLSignatureRequestAuthBlockOrRedirect(session, authConf, oaParam);

+

+			AuthenticationSessionStoreage.storeSession(session);

+			

+			ServletUtils.writeCreateXMLSignatureRequestOrRedirect(resp, session,

+					createXMLSignatureRequest, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT,

+					"VerifyIdentityLink");

+

+		} catch (MOAIDException ex) {

+			handleError(null, ex, req, resp, pendingRequestID);

+

+		} catch (Exception e) {

+			Logger.error("IdentityLinkValidation has an interal Error.", e);

+		}

+

+		finally {

+			ConfigurationDBUtils.closeSession();

+		}

+	}

+

+}

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyAuthenticationBlockTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyAuthenticationBlockTask.java
new file mode 100644
index 000000000..1e1a4df89
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyAuthenticationBlockTask.java
@@ -0,0 +1,246 @@
+package at.gv.egovernment.moa.id.auth.modules.internal.tasks;

+

+import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.*;

+import iaik.pki.PKIException;

+

+import java.io.IOException;

+import java.security.GeneralSecurityException;

+import java.util.List;

+import java.util.Map;

+

+import javax.net.ssl.SSLSocketFactory;

+import javax.servlet.http.HttpServletRequest;

+import javax.servlet.http.HttpServletResponse;

+import javax.xml.transform.TransformerException;

+

+import org.apache.commons.fileupload.FileUploadException;

+import org.apache.commons.lang.StringEscapeUtils;

+import org.w3c.dom.Element;

+

+import at.gv.egovernment.moa.id.auth.AuthenticationServer;

+import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;

+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

+import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;

+import at.gv.egovernment.moa.id.auth.exception.MISSimpleClientException;

+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

+import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;

+import at.gv.egovernment.moa.id.commons.db.ConfigurationDBUtils;

+import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;

+import at.gv.egovernment.moa.id.config.ConnectionParameter;

+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;

+import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;

+import at.gv.egovernment.moa.id.moduls.ModulUtils;

+import at.gv.egovernment.moa.id.process.api.ExecutionContext;

+import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;

+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;

+import at.gv.egovernment.moa.id.util.SSLUtils;

+import at.gv.egovernment.moa.id.util.client.mis.simple.MISSessionId;

+import at.gv.egovernment.moa.id.util.client.mis.simple.MISSimpleClient;

+import at.gv.egovernment.moa.logging.Logger;

+import at.gv.egovernment.moa.util.DOMUtils;

+

+/**

+ * Verifies the signed authentication block (provided as {@code CreateXMLSignatureResponse}).<p/>

+ * In detail:

+ * <ul>

+ * <li>Renames the moa session id.</li>

+ * <li>Takes the {@code CreateXMLSignatureResponse} from POST parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE}.</li>

+ * <li>Verifies the {@code CreateXMLSignatureResponse}.</li>

+ * <li>Updates moa session.</li>

+ * <li>Redirects back to {@code /dispatcher} in order to finalize the authentication.</li>

+ * </ul>

+ * Expects:

+ * <ul>

+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>

+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE} containing a {@code CreateXMLSignatureResponse}.</li>

+ * </ul>

+ * Result:

+ * <ul>

+ * <li>Authentication data put into moa session.</li>

+ * <li>Redirect to {@code /dispatcher}.</li>

+ * </ul>

+ * Possible branches:

+ * <ul>

+ * <li>In case of mandate mode

+ * <ul>

+ * <li>Creates a mandate session at the external mandate issuing service.</li>

+ * <li>Redirects the user's browser to the online mandate issuing service GUI.</li>

+ * </ul>

+ * </li>

+ * </ul>

+ * Code taken from {@link at.gv.egovernment.moa.id.auth.servlet.VerifyAuthenticationBlockServlet}.

+ * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)

+ *

+ */

+public class VerifyAuthenticationBlockTask extends AbstractAuthServletTask {

+

+	@Override

+	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)

+			throws Exception {

+

+		// note: code taken from at.gv.egovernment.moa.id.auth.servlet.VerifyAuthenticationBlockServlet

+		

+		Logger.debug("POST VerifyAuthenticationBlock");

+		

+		String pendingRequestID = null;		

+		

+	    Map<String, String> parameters;

+	    try 

+	    {

+	      parameters = getParameters(req);

+	    } catch (FileUploadException e) 

+	    {

+	      Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());

+	      throw new IOException(e.getMessage());

+	      

+	    }

+			String sessionID = req.getParameter(PARAM_SESSIONID);

+			String createXMLSignatureResponse = (String)parameters.get(PARAM_XMLRESPONSE);

+

+			// escape parameter strings

+			sessionID = StringEscapeUtils.escapeHtml(sessionID);

+			pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID);

+		   		

+			String redirectURL = null;

+			try {

+	         // check parameter

+	         if (!ParamValidatorUtils.isValidSessionID(sessionID))

+	            throw new WrongParametersException("VerifyAuthenticationBlock", PARAM_SESSIONID, "auth.12");

+	         if (!ParamValidatorUtils.isValidXMLDocument(createXMLSignatureResponse))

+	            throw new WrongParametersException("VerifyAuthenticationBlock", PARAM_XMLRESPONSE, "auth.12");

+

+				AuthenticationSession session = AuthenticationServer.getSession(sessionID);

+

+				//change MOASessionID

+			    sessionID = AuthenticationSessionStoreage.changeSessionID(session);

+				

+				String authenticatedMOASessionId = AuthenticationServer.getInstance().verifyAuthenticationBlock(session, createXMLSignatureResponse);

+				

+				if (authenticatedMOASessionId == null) { 

+					//mandate Mode

+				

+					  AuthConfigurationProvider authConf= AuthConfigurationProvider.getInstance();

+						ConnectionParameter connectionParameters = authConf.getOnlineMandatesConnectionParameter();	

+						SSLSocketFactory sslFactory = SSLUtils.getSSLSocketFactory(AuthConfigurationProvider.getInstance(), connectionParameters);

+						

+						// get identitity link as byte[]

+						Element elem = session.getIdentityLink().getSamlAssertion();

+						String s = DOMUtils.serializeNode(elem);

+						

+						//System.out.println("IDL: " + s);

+						

+						byte[] idl = s.getBytes("UTF-8");

+						

+						// redirect url

+						// build redirect(to the GetMISSessionIdSerlvet)

+						

+						//change MOASessionID before MIS request

+						String newMOASessionID = AuthenticationSessionStoreage.changeSessionID(session);

+						

+				        redirectURL =

+				              new DataURLBuilder().buildDataURL(

+				                session.getAuthURL(),

+				                GET_MIS_SESSIONID,

+				                newMOASessionID);

+						

+				        String oaURL = session.getOAURLRequested();

+				        OAAuthParameter oaParam = authConf.getOnlineApplicationParameter(oaURL);

+				        List<String> profiles = oaParam.getMandateProfiles();

+

+				        if (profiles == null) {

+				      	  Logger.error("No Mandate/Profile for OA configured.");

+				      	  throw new AuthenticationException("config.21", new Object[] { GET_MIS_SESSIONID});

+				        }

+				        

+				        String oaFriendlyName = oaParam.getFriendlyName();

+				        String mandateReferenceValue = session.getMandateReferenceValue();

+				        byte[] cert = session.getEncodedSignerCertificate();

+				        byte[] authBlock = session.getAuthBlock().getBytes("UTF-8");

+				        

+				        //TODO: check in case of SSO!!!

+				        String targetType = null;  

+				        if(oaParam.getBusinessService()) {

+				        	String id = oaParam.getIdentityLinkDomainIdentifier();

+				        	if (id.startsWith(AuthenticationSession.REGISTERANDORDNR_PREFIX_))

+				        		targetType = id;

+				        	else

+				        		targetType = AuthenticationSession.REGISTERANDORDNR_PREFIX_+session.getDomainIdentifier();

+				        	

+				        } else {

+				        	targetType = AuthenticationSession.TARGET_PREFIX_ + oaParam.getTarget();

+				        }

+				        

+				        MISSessionId misSessionID = MISSimpleClient.sendSessionIdRequest(

+				        		connectionParameters.getUrl(), 

+				        		idl, 

+				        		cert, 

+				        		oaFriendlyName, 

+				        		redirectURL, 

+				        		mandateReferenceValue, 

+				        		profiles, 

+				        		targetType,

+				        		authBlock,

+				        		sslFactory);

+				        

+				        if (misSessionID == null) {

+				      	  Logger.error("Fehler bei Anfrage an Vollmachten Service. MIS Session ID ist null.");

+				      	  throw new MISSimpleClientException("Fehler bei Anfrage an Vollmachten Service.");

+				        }

+				        

+				        String redirectMISGUI = misSessionID.getRedirectURL();

+				        session.setMISSessionID(misSessionID.getSessiondId());

+					

+						try {

+							AuthenticationSessionStoreage.storeSession(session);

+						} catch (MOADatabaseException e) {

+							throw new MOAIDException("Session store error", null);

+						}

+				        

+						// TODO[branch]: Mandate; redirect to MIS website; website redirects back to "/GetMISSessionID"

+						

+				        resp.setStatus(302);

+				    	  resp.addHeader("Location", redirectMISGUI);

+				    	  Logger.debug("REDIRECT TO: " + redirectURL);

+				}

+				else {

+					// TODO[branch]: Final step back to /dispatcher

+					redirectURL = new DataURLBuilder().buildDataURL(session.getAuthURL(), 

+							ModulUtils.buildAuthURL(session.getModul(), session.getAction(), pendingRequestID), authenticatedMOASessionId);

+							

+					resp.setContentType("text/html");

+					resp.setStatus(302);

+				

+					resp.addHeader("Location", redirectURL);		

+					Logger.debug("REDIRECT TO: " + redirectURL);				

+					

+				}

+				

+			}

+	    

+			catch (MOAIDException ex) {

+				handleError(null, ex, req, resp, pendingRequestID);

+				

+			} catch (GeneralSecurityException e) {

+				handleError(null, e, req, resp, pendingRequestID);

+				

+			} catch (PKIException e) {

+				handleError(null, e, req, resp, pendingRequestID);

+				

+			} catch (TransformerException e) {

+				handleError(null, e, req, resp, pendingRequestID);

+				

+		    } catch (Exception e) {

+		    	Logger.error("AuthBlockValidation has an interal Error.", e);

+		    }

+		       

+			

+		    finally {

+		    	ConfigurationDBUtils.closeSession();

+		    }		

+		

+		

+		

+	}

+

+}

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyCertificateTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyCertificateTask.java
new file mode 100644
index 000000000..32ea7fe3a
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyCertificateTask.java
@@ -0,0 +1,164 @@
+package at.gv.egovernment.moa.id.auth.modules.internal.tasks;

+

+import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.*;

+import iaik.x509.X509Certificate;

+

+import java.io.IOException;

+import java.util.Map;

+

+import javax.servlet.http.HttpServletRequest;

+import javax.servlet.http.HttpServletResponse;

+

+import org.apache.commons.fileupload.FileUploadException;

+import org.apache.commons.lang.StringEscapeUtils;

+

+import at.gv.egovernment.moa.id.auth.AuthenticationServer;

+import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder;

+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

+import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;

+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

+import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;

+import at.gv.egovernment.moa.id.commons.db.ConfigurationDBUtils;

+import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;

+import at.gv.egovernment.moa.id.process.api.ExecutionContext;

+import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;

+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;

+import at.gv.egovernment.moa.id.util.ServletUtils;

+import at.gv.egovernment.moa.logging.Logger;

+import at.gv.egovernment.moa.spss.util.CertificateUtils;

+

+/**

+ * Parses the certificate from {@code InfoBoxReadResponse} (via POST parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE}), creates the auth block to be signed and returns a {@code CreateXMLSignatureRequest} for auth block signature.<p/>

+ * In detail:

+ * <ul>

+ * <li>Renames the moa session id.</li>

+ * <li>Retrieves the certificate via {@code InfoBoxReadResponse} from POST parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE}.</li>

+ * <li>Verifies the certificate.</li>

+ * <li>Creates the auth block to be signed using information from the certificate (Organwalter, foreign citizen.</li>

+ * <li>Puts it in a {@code CreateXMLSignatureRequest}.</li>

+ * <li>Updates moa session.</li>

+ * <li>Responds with {@code CreateXMLSignatureRequest}.</li>

+ * </ul>

+ * Expects:

+ * <ul>

+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>

+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_SESSIONID} containing a {@code InfoBoxReadResponse}.</li>

+ * </ul>

+ * Result:

+ * <ul>

+ * <li>{@code CreateXMLSignatureRequest} send as HttpServletResponse (for CCE).</li>

+ * </ul>

+ * Code taken from {@link at.gv.egovernment.moa.id.auth.servlet.VerifyCertificateServlet}.

+ * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)

+ *

+ */

+public class VerifyCertificateTask extends AbstractAuthServletTask {

+

+	@Override

+	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)

+			throws Exception {

+

+		// note: code taken from at.gv.egovernment.moa.id.auth.servlet.VerifyCertificateServlet

+

+		Logger.debug("POST VerifyCertificateServlet");

+		

+		String pendingRequestID = null;

+		

+		Map<String, String> parameters;

+	    try 

+	    {

+	      parameters = getParameters(req);

+	    } catch (FileUploadException e) 

+	    {

+	      Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());

+	      throw new IOException(e.getMessage());

+	     	}

+	    String sessionID = req.getParameter(PARAM_SESSIONID);

+	    

+	    // escape parameter strings

+		sessionID = StringEscapeUtils.escapeHtml(sessionID);

+		

+		pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID);

+		

+	    AuthenticationSession session = null;

+	    try {

+	       // check parameter

+	       if (!ParamValidatorUtils.isValidSessionID(sessionID))

+	          throw new WrongParametersException("VerifyCertificate", PARAM_SESSIONID, "auth.12");

+	       

+	    	session = AuthenticationServer.getSession(sessionID);

+	    	

+	        //change MOASessionID

+	        sessionID = AuthenticationSessionStoreage.changeSessionID(session);

+	    	

+    		X509Certificate cert = AuthenticationServer.getInstance().getCertificate(sessionID, parameters);

+    		if (cert == null) {

+    			Logger.error("Certificate could not be read.");

+    			throw new AuthenticationException("auth.14", null);    		

+    		}

+    		

+	    	boolean useMandate = session.getUseMandate();

+	    	

+	    	if (useMandate) {

+

+	    		// verify certificate for OrganWalter

+	    		String createXMLSignatureRequestOrRedirect = AuthenticationServer.getInstance().verifyCertificate(session, cert);

+	    		

+		    	try {

+					AuthenticationSessionStoreage.storeSession(session);

+				} catch (MOADatabaseException e) {

+					throw new MOAIDException("session store error", null);

+				}

+	    		

+		    	// TODO[branch]: Mandate; respond with CXSR for authblock signature, dataURL "/VerifyAuthBlock"

+		    	ServletUtils.writeCreateXMLSignatureRequestOrRedirect(resp, session, createXMLSignatureRequestOrRedirect, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "VerifyCertificate");

+	    		

+	    	}

+	    	else {

+	    			

+		    	

+	    		String countrycode = CertificateUtils.getIssuerCountry(cert);

+	    		if (countrycode != null) {

+	    			if (countrycode.compareToIgnoreCase("AT") == 0) {

+	    				Logger.error("Certificate issuer country code is \"AT\". Login not support in foreign identities mode.");

+	    				throw new AuthenticationException("auth.22", null);

+	    			}

+	    		}

+	    		

+	    		// Foreign Identities Modus	

+		    	String createXMLSignatureRequest = AuthenticationServer.getInstance().createXMLSignatureRequestForeignID(session, cert);

+		      // build dataurl (to the GetForeignIDSerlvet)

+		    	String dataurl =

+	             new DataURLBuilder().buildDataURL(

+	               session.getAuthURL(),

+	               REQ_GET_FOREIGN_ID,

+	               session.getSessionID());

+	       

+		    	try {

+					AuthenticationSessionStoreage.storeSession(session);

+				} catch (MOADatabaseException e) {

+					throw new MOAIDException("session store error", null);

+				}

+		    	

+	    		// TODO[branch]: Foreign citizen; respond with CXSR for authblock signature, dataURL "/GetForeignID"

+		    	ServletUtils.writeCreateXMLSignatureRequest(resp, createXMLSignatureRequest, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "GetForeignID", dataurl);

+		    	

+		    	Logger.debug("Send CreateXMLSignatureRequest to BKU");

+	    	}	    		    	 

+	    }

+	    catch (MOAIDException ex) {

+	      handleError(null, ex, req, resp, pendingRequestID);

+	      

+	    } catch (Exception e) {

+	    	Logger.error("CertificateValidation has an interal Error.", e);

+	    }

+	       

+	    

+	    finally {

+	    	ConfigurationDBUtils.closeSession();

+	    }

+

+	}

+

+}

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyIdentityLinkTask.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyIdentityLinkTask.java
new file mode 100644
index 000000000..bf10b3681
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/internal/tasks/VerifyIdentityLinkTask.java
@@ -0,0 +1,102 @@
+package at.gv.egovernment.moa.id.auth.modules.internal.tasks;

+

+import static at.gv.egovernment.moa.id.auth.MOAIDAuthConstants.*;

+

+import java.io.IOException;

+import java.util.Map;

+

+import javax.servlet.http.HttpServletRequest;

+import javax.servlet.http.HttpServletResponse;

+

+import org.apache.commons.lang.StringEscapeUtils;

+

+import at.gv.egovernment.moa.id.auth.AuthenticationServer;

+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

+import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

+import at.gv.egovernment.moa.id.auth.exception.ParseException;

+import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

+import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask;

+import at.gv.egovernment.moa.id.commons.db.ConfigurationDBUtils;

+import at.gv.egovernment.moa.id.process.api.ExecutionContext;

+import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;

+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;

+import at.gv.egovernment.moa.logging.Logger;

+

+/**

+ * Verifies the identity link.<p/>

+ * In detail:

+ * <ul>

+ * <li>Renames the moa session id.</li>

+ * <li>Parses the identity link retrieved as {@code InfoBoxReadResponse} from POST parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE}.</li>

+ * <li>Verifies the identity link.</li>

+ * <li>Updates moa session.</li>

+ * <li>Puts boolean flag {@code identityLinkAvailable} into {@code ExecutionContext}.</li>

+ * </ul>

+ * Expects:

+ * <ul>

+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}</li>

+ * <li>HttpServletRequest parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_XMLRESPONSE PARAM_XMLRESPONSE} containing a {@code InfoBoxReadResponse}.</li>

+ * </ul>

+ * Result:

+ * <ul>

+ * <li>Identity link put into moa session.</li>

+ * <li>Boolean flag {@code identityLinkAvailable} into {@code ExecutionContext}.</li>

+ * </ul>

+ * Code taken from {@link at.gv.egovernment.moa.id.auth.servlet.VerifyIdentityLinkServlet}.

+ * @see #execute(ExecutionContext, HttpServletRequest, HttpServletResponse)

+ *

+ */

+public class VerifyIdentityLinkTask extends AbstractAuthServletTask {

+

+	@Override

+	public void execute(ExecutionContext executionContext, HttpServletRequest req, HttpServletResponse resp)

+			throws Exception {

+

+		// note: code taken from at.gv.egovernment.moa.id.auth.servlet.VerifyIdentityLinkServlet

+

+		Logger.debug("POST VerifyIdentityLink");

+

+		setNoCachingHeaders(resp);

+		

+		Map<String, String> parameters;

+		String pendingRequestID = null;

+

+		try {

+			parameters = getParameters(req);

+		} catch (Exception e) {

+			Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());

+			throw new IOException(e.getMessage());

+		}

+		

+		try {

+			

+			String sessionID = StringEscapeUtils.escapeHtml(req.getParameter(PARAM_SESSIONID));

+			// check parameter

+			if (!ParamValidatorUtils.isValidSessionID(sessionID)) {

+				throw new WrongParametersException("VerifyIdentityLink", PARAM_SESSIONID, "auth.12");

+			}

+			pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID);

+

+			AuthenticationSession session = AuthenticationServer.getSession(sessionID);

+

+			boolean identityLinkAvailable = AuthenticationServer.getInstance().verifyIdentityLink(session, parameters) != null;

+			AuthenticationSessionStoreage.storeSession(session);

+

+			executionContext.put("identityLinkAvailable", identityLinkAvailable);

+

+		} catch (ParseException ex) {

+			handleError(null, ex, req, resp, pendingRequestID);

+

+		} catch (MOAIDException ex) {

+			handleError(null, ex, req, resp, pendingRequestID);

+

+		} catch (Exception e) {

+			Logger.error("IdentityLinkValidation has an interal Error.", e);

+		}

+

+		finally {

+			ConfigurationDBUtils.closeSession();

+		}

+	}

+

+}

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/registration/ModuleRegistration.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/registration/ModuleRegistration.java
new file mode 100644
index 000000000..fa1878e74
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/registration/ModuleRegistration.java
@@ -0,0 +1,149 @@
+package at.gv.egovernment.moa.id.auth.modules.registration;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+import java.util.ServiceLoader;
+
+import javax.annotation.PostConstruct;
+
+import org.apache.commons.lang3.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationContext;
+import org.springframework.core.io.Resource;
+
+import at.gv.egovernment.moa.id.auth.modules.AuthModule;
+import at.gv.egovernment.moa.id.process.ProcessDefinitionParserException;
+import at.gv.egovernment.moa.id.process.ProcessEngine;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
+
+/**
+ * This class handles registering modules. The modules are detected either with
+ * the ServiceLoader mechanism or via Spring. All detected modules are ranked
+ * according to their priority.
+ */
+public class ModuleRegistration {
+
+	private static ModuleRegistration instance = new ModuleRegistration();
+
+	private List<AuthModule> priorizedModules = new ArrayList<>();
+
+	@Autowired
+	private ApplicationContext ctx;
+
+	@Autowired
+	private ProcessEngine processEngine;
+
+	private Logger log = LoggerFactory.getLogger(getClass());
+
+	public static ModuleRegistration getInstance() {
+		return instance;
+	}
+
+	private ModuleRegistration() {
+	}
+
+	@PostConstruct
+	private void init() {
+		// load modules via the ServiceLoader
+		initServiceLoaderModules();
+
+		// load modules via Spring
+		initSpringModules();
+
+		// order modules according to their priority
+		sortModules();
+	}
+	
+	/**
+	 * Discovers modules which use the ServiceLoader mechanism.
+	 */
+	private void initServiceLoaderModules() {
+		log.info("Looking for auth modules.");
+		ServiceLoader<AuthModule> loader = ServiceLoader.load(AuthModule.class);
+		Iterator<AuthModule> modules = loader.iterator();
+		while (modules.hasNext()) {
+			AuthModule module = modules.next();
+			log.info("Detected module {}", module.getClass().getName());
+			registerModuleProcessDefinitions(module);
+			priorizedModules.add(module);
+		}
+	}
+
+	/**
+	 * Discovers modules which use Spring.
+	 */
+	private void initSpringModules() {
+		log.debug("Discovering Spring modules.");
+		Map<String, AuthModule> modules = ctx.getBeansOfType(AuthModule.class);
+		for (AuthModule module : modules.values()) {
+			registerModuleProcessDefinitions(module);
+			priorizedModules.add(module);
+		}
+	}
+
+	/**
+	 * Registers the resource uris for the module.
+	 * 
+	 * @param module
+	 *            the module.
+	 */
+	private void registerModuleProcessDefinitions(AuthModule module) {
+		for (String uri : module.getProcessDefinitions()) {
+			Resource resource = ctx.getResource(uri);
+			if (resource.isReadable()) {
+				log.info("Registering process definition '{}'.", uri);
+				try (InputStream processDefinitionInputStream = resource.getInputStream()) {
+					processEngine.registerProcessDefinition(processDefinitionInputStream);
+				} catch (IOException e) {
+					log.error("Process definition '{}' could NOT be read.", uri, e);
+				} catch (ProcessDefinitionParserException e) {
+					log.error("Error while parsing process definition '{}'", uri, e);
+				}
+			} else {
+				log.error("Process definition '{}' cannot be read.", uri);
+			}
+		}
+	}
+
+	/**
+	 * Order the modules in descending order according to their priority.
+	 */
+	private void sortModules() {
+		Collections.sort(priorizedModules, new Comparator<AuthModule>() {
+			@Override
+			public int compare(AuthModule thisAuthModule, AuthModule otherAuthModule) {
+				int thisOrder = thisAuthModule.getPriority();
+				int otherOrder = otherAuthModule.getPriority();
+				return (thisOrder < otherOrder ? 1 : (thisOrder == otherOrder ? 0 : -1));
+			}
+		});
+	}
+
+	/**
+	 * Returns the process id of the first process, in the highest ranked
+	 * module, which is able to work with the given execution context.
+	 * 
+	 * @param context
+	 *            the {@link ExecutionContext}.
+	 * @return the process id or {@code null}
+	 */
+	public String selectProcess(ExecutionContext context) {
+		for (AuthModule module : priorizedModules) {
+			String id = module.selectProcess(context);
+			if (StringUtils.isNotEmpty(id)) {
+				log.debug("Process with id '{}' selected, for context '{}'.", id, context);
+				return id;
+			}
+		}
+		log.info("No process is able to handle context '{}'.", context);
+		return null;
+	}
+}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java
index e5b2c598c..331a7653a 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java
@@ -66,6 +66,11 @@ import org.apache.commons.fileupload.FileItemFactory;
 import org.apache.commons.fileupload.FileUploadException;
 import org.apache.commons.fileupload.disk.DiskFileItemFactory;
 import org.apache.commons.fileupload.servlet.ServletFileUpload;
+import org.springframework.beans.BeansException;
+import org.springframework.beans.factory.NoSuchBeanDefinitionException;
+import org.springframework.beans.factory.NoUniqueBeanDefinitionException;
+import org.springframework.web.context.WebApplicationContext;
+import org.springframework.web.context.support.WebApplicationContextUtils;
 
 import at.gv.egovernment.moa.id.advancedlogging.StatisticLogger;
 import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants;
@@ -74,6 +79,7 @@ import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
 import at.gv.egovernment.moa.id.config.ConfigurationException;
 import at.gv.egovernment.moa.id.entrypoints.DispatcherServlet;
+import at.gv.egovernment.moa.id.process.ProcessEngine;
 import at.gv.egovernment.moa.id.storage.DBExceptionStoreImpl;
 import at.gv.egovernment.moa.id.storage.IExceptionStore;
 import at.gv.egovernment.moa.id.util.ServletUtils;
@@ -97,6 +103,11 @@ public class AuthServlet extends HttpServlet implements MOAIDAuthConstants {
 
 	protected static final String ERROR_CODE_PARAM = "errorid";
 	
+	/**
+	 * The process engine.
+	 */
+	private ProcessEngine processEngine;
+	
 	@Override
 	protected void doGet(HttpServletRequest req, HttpServletResponse resp)
 			throws ServletException, IOException {
@@ -454,4 +465,31 @@ public class AuthServlet extends HttpServlet implements MOAIDAuthConstants {
 
 	}
 
+
+	/**
+	 * Returns the underlying process engine instance.
+	 * 
+	 * @return The process engine (never {@code null}).
+	 * @throws NoSuchBeanDefinitionException
+	 *             if no {@link ProcessEngine} bean was found.
+	 * @throws NoUniqueBeanDefinitionException
+	 *             if more than one {@link ProcessEngine} bean was found.
+	 * @throws BeansException
+	 *             if a problem getting the {@link ProcessEngine} bean occurred.
+	 * @throws IllegalStateException
+	 *             if the Spring WebApplicationContext was not found, which means that the servlet is used outside a
+	 *             Spring web environment.
+	 */
+	public synchronized ProcessEngine getProcessEngine() {
+		if (processEngine == null) {
+			WebApplicationContext ctx = WebApplicationContextUtils.getWebApplicationContext(getServletContext());
+			if (ctx == null) {
+				throw new IllegalStateException(
+						"Unable to find Spring WebApplicationContext. Servlet needs to be executed within a Spring web environment.");
+			}
+			processEngine = ctx.getBean(ProcessEngine.class);
+		}
+		return processEngine;
+	}
+	
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GenerateIFrameTemplateServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GenerateIFrameTemplateServlet.java
index 99a7dce89..ad4776a45 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GenerateIFrameTemplateServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GenerateIFrameTemplateServlet.java
@@ -23,55 +23,42 @@
 package at.gv.egovernment.moa.id.auth.servlet;
 
 import java.io.IOException;
-import java.io.PrintWriter;
 import java.util.List;
 
-import javax.servlet.ServletConfig;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.lang.StringEscapeUtils;
 
-import at.gv.egovernment.moa.id.auth.MOAIDAuthInitializer;
-import at.gv.egovernment.moa.id.auth.builder.StartAuthenticationBuilder;
 import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
 import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
+import at.gv.egovernment.moa.id.auth.modules.registration.ModuleRegistration;
 import at.gv.egovernment.moa.id.auth.parser.StartAuthentificationParameterParser;
 import at.gv.egovernment.moa.id.commons.db.ConfigurationDBUtils;
 import at.gv.egovernment.moa.id.commons.db.dao.config.TemplateType;
 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
 import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
+
 import at.gv.egovernment.moa.id.moduls.IRequest;
 import at.gv.egovernment.moa.id.moduls.RequestStorage;
 import at.gv.egovernment.moa.id.protocols.saml1.SAML1Protocol;
+
+import at.gv.egovernment.moa.id.process.ExecutionContextImpl;
+import at.gv.egovernment.moa.id.process.ProcessInstance;
+import at.gv.egovernment.moa.id.process.api.ExecutionContext;
 import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;
-import at.gv.egovernment.moa.id.util.MOAIDMessageProvider;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.FileUtils;
 import at.gv.egovernment.moa.util.MiscUtil;
-import at.gv.egovernment.moa.util.StringUtils;
 
 public class GenerateIFrameTemplateServlet extends AuthServlet {
 
 	private static final long serialVersionUID = 1L;
 
-	public void init(ServletConfig servletConfig) throws ServletException {
-//		    try {
-//		      super.init(servletConfig);
-//		      MOAIDAuthInitializer.initialize();
-//		      Logger.debug("default platform file.encoding: " + System.getProperty("file.encoding"));
-//		      Logger.info(MOAIDMessageProvider.getInstance().getMessage("init.00", null));
-//		    }
-//		    catch (Exception ex) {
-//		      Logger.fatal(MOAIDMessageProvider.getInstance().getMessage("init.02", null), ex);
-//		      throw new ServletException(ex);
-//		    }
-	}
-	  
 	protected void doGet(HttpServletRequest req, HttpServletResponse resp)
 			throws ServletException, IOException {
 		Logger.info("Receive " + GenerateIFrameTemplateServlet.class + " Request");
@@ -98,7 +85,7 @@ public class GenerateIFrameTemplateServlet extends AuthServlet {
 			
 	    	    moasession = AuthenticationSessionStoreage.getSession(moasessionid);
 	    	    
-	    	    AuthenticationSessionStoreage.changeSessionID(moasession);
+//	    	    AuthenticationSessionStoreage.changeSessionID(moasession);
 			
 			} catch (MOADatabaseException e) {
 				Logger.info("MOASession with SessionID="+ moasessionid + " is not found in Database");
@@ -168,28 +155,37 @@ public class GenerateIFrameTemplateServlet extends AuthServlet {
 		    											   moasession.getAction(),
 		    											   req);
 			}
-			
-		    StartAuthenticationBuilder startauth = StartAuthenticationBuilder.getInstance();			
-		    String getIdentityLinkForm = startauth.build(moasession, req, resp);
-			
-			//store MOASession
+
+			ExecutionContext ec = new ExecutionContextImpl();
+			// set execution context
+			ec.put("ccc", moasession.getCcc());
+			ec.put("useMandate", moasession.getUseMandate());
+			ec.put("bkuURL", moasession.getBkuURL());
+
+			// select and create process instance
+			String processDefinitionId = ModuleRegistration.getInstance().selectProcess(ec);
+			String processInstanceId = getProcessEngine().createProcessInstance(processDefinitionId, ec);
+
+			if (processDefinitionId == null) {
+				Logger.warn("No suitable process found for SessionID " + moasession.getSessionID());
+				throw new MOAIDException("process.02", new Object[] { moasession.getSessionID() });
+			}
+
+			// keep process instance id in moa session
+			moasession.setProcessInstanceId(processInstanceId);
+
+			// make sure moa session has been persisted before running the process
 			try {
 				AuthenticationSessionStoreage.storeSession(moasession);
-				
 			} catch (MOADatabaseException e) {
 				Logger.error("Database Error! MOASession is not stored!");
-				throw new MOAIDException("init.04", new Object[] {
-						moasession.getSessionID()});
+				throw new MOAIDException("init.04", new Object[] { moasession.getSessionID() });
 			}
-		    
-		    if (!StringUtils.isEmpty(getIdentityLinkForm)) {
-		    	resp.setContentType("text/html;charset=UTF-8");
-		    	PrintWriter out = new PrintWriter(resp.getOutputStream());
-		    	out.print(getIdentityLinkForm);
-		    	out.flush();
-		    	Logger.debug("Finished GET "+GenerateIFrameTemplateServlet.class);
-		    }
-	    } 
+
+			// start process
+			getProcessEngine().start(processInstanceId);
+
+		}
 	    catch (WrongParametersException ex) {
 	    	handleWrongParameters(ex, req, resp);
 	    }
@@ -206,4 +202,13 @@ public class GenerateIFrameTemplateServlet extends AuthServlet {
 	    	ConfigurationDBUtils.closeSession();
 	    }
 	}
+
+	
+	
+	
+	
+	
+	
+	
+
 }
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetForeignIDServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetForeignIDServlet.java
index bbc704f22..41c2a9c6a 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetForeignIDServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetForeignIDServlet.java
@@ -69,6 +69,7 @@ import at.gv.egovernment.moa.id.auth.data.IdentityLink;
 import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

 import at.gv.egovernment.moa.id.auth.exception.ParseException;

 import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

+import at.gv.egovernment.moa.id.auth.modules.internal.tasks.GetForeignIDTask;

 import at.gv.egovernment.moa.id.auth.parser.CreateXMLSignatureResponseParser;

 import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser;

 import at.gv.egovernment.moa.id.client.SZRGWClientException;
@@ -85,6 +86,7 @@ import at.gv.util.xsd.srzgw.CreateIdentityLinkResponse;
  * Servlet requested for getting the foreign eID

  * provided by the security layer implementation.

  * Utilizes the {@link AuthenticationServer}.

+ * @deprecated Use {@link GetForeignIDTask} instead.

  *

  */

 public class GetForeignIDServlet extends AuthServlet {

@@ -134,6 +136,8 @@ public class GetForeignIDServlet extends AuthServlet {
 

 		Logger.debug("POST GetForeignIDServlet");

 		

+		Logger.warn(getClass().getName() + " is deprecated and should not be used any more.");

+		

 		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);

 		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);

 		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java
index 9e2e845b5..043b660c1 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java
@@ -67,6 +67,7 @@ import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
 import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
+import at.gv.egovernment.moa.id.auth.modules.internal.tasks.GetMISSessionIDTask;
 import at.gv.egovernment.moa.id.commons.db.ConfigurationDBUtils;
 import at.gv.egovernment.moa.id.config.ConnectionParameter;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
@@ -83,7 +84,7 @@ import at.gv.egovernment.moa.util.DOMUtils;
 /**
  * Servlet requested for getting the foreign eID provided by the security layer
  * implementation. Utilizes the {@link AuthenticationServer}.
- * 
+ * @deprecated Use {@link GetMISSessionIDTask} instead.
  */
 public class GetMISSessionIDServlet extends AuthServlet {
 
@@ -136,6 +137,8 @@ public class GetMISSessionIDServlet extends AuthServlet {
 
 		Logger.debug("POST GetMISSessionIDServlet");
 
+		Logger.warn(getClass().getName() + " is deprecated and should not be used any more.");
+		
 		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,
 				MOAIDAuthConstants.HEADER_VALUE_EXPIRES);
 		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,
@@ -197,6 +200,7 @@ public class GetMISSessionIDServlet extends AuthServlet {
 			// for now: list contains only one element
 			MISMandate mandate = (MISMandate) list.get(0);
 
+			// TODO[tlenz]: UTF-8 ?
 			String sMandate = new String(mandate.getMandate());
 			if (sMandate == null || sMandate.compareToIgnoreCase("") == 0) {
 				Logger.error("Mandate is empty.");
@@ -206,6 +210,7 @@ public class GetMISSessionIDServlet extends AuthServlet {
 						
 			//check if it is a parsable XML
 			byte[] byteMandate = mandate.getMandate();
+			// TODO[tlenz]: UTF-8 ?
 			String stringMandate = new String(byteMandate);
 			DOMUtils.parseDocument(stringMandate, false,
 					null, null).getDocumentElement();
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/MonitoringServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/MonitoringServlet.java
deleted file mode 100644
index e04f97e6e..000000000
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/MonitoringServlet.java
+++ /dev/null
@@ -1,126 +0,0 @@
-/*******************************************************************************
- * Copyright 2014 Federal Chancellery Austria
- * MOA-ID has been developed in a cooperation between BRZ, the Federal
- * Chancellery Austria - ICT staff unit, and Graz University of Technology.
- * 
- * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
- * the European Commission - subsequent versions of the EUPL (the "Licence");
- * You may not use this work except in compliance with the Licence.
- * You may obtain a copy of the Licence at:
- * http://www.osor.eu/eupl/
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the Licence is distributed on an "AS IS" basis,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the Licence for the specific language governing permissions and
- * limitations under the Licence.
- * 
- * This product combines work with different licenses. See the "NOTICE" text
- * file for details on the various modules and licenses.
- * The "NOTICE" text file is part of the distribution. Any derivative works
- * that you distribute must include a readable copy of the "NOTICE" text file.
- ******************************************************************************/
-package at.gv.egovernment.moa.id.auth.servlet;
-
-import java.io.IOException;
-import java.io.PrintWriter;
-import java.util.Arrays;
-import java.util.List;
-
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import at.gv.egovernment.moa.id.config.ConfigurationException;
-import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
-import at.gv.egovernment.moa.id.monitoring.TestManager;
-import at.gv.egovernment.moa.logging.Logger;
-import at.gv.egovernment.moa.util.MiscUtil;
-
-public class MonitoringServlet extends AuthServlet {
-
-	private static final long serialVersionUID = 1L;
-	private static final String REQUEST_ATTR_MODULE = "module";
-	
-	
-	  protected void doGet(HttpServletRequest req, HttpServletResponse resp)
-			    throws ServletException, IOException {
-		  
-		  try {
-			AuthConfigurationProvider config = AuthConfigurationProvider.getInstance();
-			
-			if (config.isMonitoringActive()) {
-				Logger.debug("Monitoring Servlet received request");
-
-				TestManager tests = TestManager.getInstance();
-				
-				String modulename = req.getParameter(REQUEST_ATTR_MODULE);
-				if (MiscUtil.isEmpty(modulename)) {
-				
-					List<String> error = tests.executeTests();
-					if (error != null && error.size() > 0) {
-						createErrorMessage(req, resp, error);
-						
-					} else {
-						resp.setStatus(HttpServletResponse.SC_OK);
-						resp.setContentType("text/html;charset=UTF-8");
-						resp.getWriter().write(getHtml(config.getMonitoringMessageSuccess()));
-						Logger.info("Monitoring Servlet finished without errors");
-					}
-					
-				} else {
-					if (tests.existsModule(modulename)) {
-						List<String> errors = tests.executeTest(modulename);
-						if (errors != null && errors.size() > 0) {
-							createErrorMessage(req, resp, errors);
-							
-						} else {
-							resp.setStatus(HttpServletResponse.SC_OK);
-							resp.setContentType("text/html;charset=UTF-8");
-							resp.getWriter().write(getHtml(config.getMonitoringMessageSuccess()));
-							Logger.info("Monitoring Servlet finished without errors");
-						}
-						
-					} else {
-						Logger.warn("NO Testmodule exists with modulename " + modulename);
-						resp.setStatus(HttpServletResponse.SC_NOT_FOUND);
-						resp.setContentType("text/html;charset=UTF-8");
-						PrintWriter out;
-						try {
-							out = new PrintWriter(resp.getOutputStream());
-							out.write("NO Testmodule exists with modulename " + modulename);
-							out.flush();
-							    
-						} catch (IOException e) {
-							Logger.warn("Internal Monitoring Servlet Error. ", e);
-						} 
-					}
-					
-				}	
-			}
-			  
-		} catch (ConfigurationException e) {
-			createErrorMessage(req, resp, Arrays.asList(e.getMessage()));
-		}
-	  }
-	  
-	  private void createErrorMessage(HttpServletRequest req, HttpServletResponse resp, List<String> errorMessage) {
-		  Logger.warn("Monitoring Servlet found some Error: " + errorMessage);
-		  resp.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
-		  resp.setContentType("text/html;charset=UTF-8");
-		  PrintWriter out;
-		  try {
-			  out = new PrintWriter(resp.getOutputStream());
-			  for (String error : errorMessage)
-				  out.write(error + "<br>");
-			  out.flush();
-			  
-		  } catch (IOException e) {
-			  Logger.warn("Internal Monitoring Servlet Error. ", e);
-		  } 
-	  }
-	  
-	private String getHtml(String text) {
-		return "<html><head><title>Reponse</title></head><body>" + text +"</body></html>";
-	}
-}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java
index 8aef6af2d..7357818c8 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java
@@ -104,6 +104,7 @@ import javax.xml.ws.BindingProvider;
 

 /**

  * Endpoint for receiving STORK response messages

+ * @deprecated Use {@link at.gv.egovernment.moa.id.auth.modules.stork.tasks.PepsConnectorTask} instead.

  */

 public class PEPSConnectorServlet extends AuthServlet {

 

@@ -155,6 +156,8 @@ public class PEPSConnectorServlet extends AuthServlet {
 		

 		try {

 			

+			Logger.warn(getClass().getName() + " is deprecated and should not be used any more.");

+

 			Logger.info("PEPSConnector Servlet invoked, expecting C-PEPS message.");

 			Logger.debug("This ACS endpoint is: " + HTTPUtils.getBaseURL(request));

 						

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorWithLocalSigningServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorWithLocalSigningServlet.java
index 3bc79f8bd..337a9ed31 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorWithLocalSigningServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorWithLocalSigningServlet.java
@@ -109,6 +109,7 @@ import eu.stork.peps.exceptions.STORKSAMLEngineException;
 
 /**
  * Endpoint for receiving STORK response messages
+ * @deprecated Use {@link at.gv.egovernment.moa.id.auth.modules.stork.tasks.PepsConnectorHandleResponseWithoutSignatureTask} instead.
  */
 public class PEPSConnectorWithLocalSigningServlet extends AuthServlet {
 	private static final long serialVersionUID = 1L;
@@ -131,6 +132,8 @@ public class PEPSConnectorWithLocalSigningServlet extends AuthServlet {
 	 */
 	protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException 
 	{
+		Logger.warn(getClass().getName() + " is deprecated and should not be used any more.");
+
 		String moaSessionID1 = request.getParameter("moaSessionID");	
 		String signResponse = request.getParameter("signresponse");	
 		Logger.info("moaSessionID1:"+moaSessionID1);
@@ -473,6 +476,7 @@ public class PEPSConnectorWithLocalSigningServlet extends AuthServlet {
 						Logger.info("Found AttributeProviderPlugin attribute:"+ap.getAttributes());
 						if(ap.getAttributes().equalsIgnoreCase("signedDoc"))
 						{
+							// FIXME[tlenz]: A servlet's class field is not thread safe.
 							oasisDssWebFormURL = ap.getUrl();
 							found = true;
 							Logger.info("Loaded signedDoc attribute provider url from config:"+oasisDssWebFormURL);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ProcessEngineSignalServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ProcessEngineSignalServlet.java
new file mode 100644
index 000000000..a99b7aeef
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ProcessEngineSignalServlet.java
@@ -0,0 +1,83 @@
+package at.gv.egovernment.moa.id.auth.servlet;

+

+import java.io.IOException;

+

+import javax.servlet.ServletException;

+import javax.servlet.http.HttpServletRequest;

+import javax.servlet.http.HttpServletResponse;

+

+import org.apache.commons.lang.StringEscapeUtils;

+

+import at.gv.egovernment.moa.id.auth.AuthenticationServer;

+import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;

+import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

+import at.gv.egovernment.moa.id.commons.db.MOASessionDBUtils;

+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;

+

+/**

+ * Servlet that resumes a suspended process (in case of asynchronous tasks).

+ * 

+ * @author tknall

+ * 

+ */

+public class ProcessEngineSignalServlet extends AuthServlet {

+

+	private static final long serialVersionUID = 1L;

+

+	/**

+	 * Sets response headers that prevent caching (code taken from {@link AuthServlet}).

+	 * 

+	 * @param resp

+	 *            The HttpServletResponse.

+	 */

+	private void setNoCachingHeaders(HttpServletResponse resp) {

+		resp.setHeader(HEADER_EXPIRES, HEADER_VALUE_EXPIRES);

+		resp.setHeader(HEADER_PRAGMA, HEADER_VALUE_PRAGMA);

+		resp.setHeader(HEADER_CACHE_CONTROL, HEADER_VALUE_CACHE_CONTROL);

+		resp.addHeader(HEADER_CACHE_CONTROL, HEADER_VALUE_CACHE_CONTROL_IE);

+	}

+

+	/**

+	 * Processes a GET request, delegating the call to {@link #doPost(HttpServletRequest, HttpServletResponse)}.

+	 */

+	@Override

+	protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

+		this.doPost(req, resp);

+	}

+

+	/**

+	 * Resumes the current process instance that has been suspended due to an asynchronous task. The process instance is

+	 * retrieved from the MOA session referred to by the request parameter {@linkplain at.gv.egovernment.moa.id.auth.MOAIDAuthConstants#PARAM_SESSIONID PARAM_SESSIONID}.

+	 */

+	@Override

+	protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

+		String sessionID = StringEscapeUtils.escapeHtml(req.getParameter(PARAM_SESSIONID));

+

+		setNoCachingHeaders(resp);

+		try {

+

+			// check parameter

+			if (!ParamValidatorUtils.isValidSessionID(sessionID)) {

+				throw new WrongParametersException("ProcessEngineSignal", PARAM_SESSIONID, "auth.12");

+			}

+

+			// retrieve moa session

+			AuthenticationSession session = AuthenticationServer.getSession(sessionID);

+

+			// process instance is mandatory

+			if (session.getProcessInstanceId() == null) {

+				throw new IllegalStateException("MOA session does not provide process instance id.");

+			}

+

+			// wake up next task

+			getProcessEngine().signal(session.getProcessInstanceId());

+

+		} catch (Exception ex) {

+			handleError(null, ex, req, resp, null);

+		} finally {

+			MOASessionDBUtils.closeSession();

+		}

+

+	}

+

+}

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyAuthenticationBlockServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyAuthenticationBlockServlet.java
index e7fa9cbd7..a8fe71485 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyAuthenticationBlockServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyAuthenticationBlockServlet.java
@@ -71,6 +71,7 @@ import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
 import at.gv.egovernment.moa.id.auth.exception.MISSimpleClientException;
 import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
+import at.gv.egovernment.moa.id.auth.modules.internal.tasks.VerifyAuthenticationBlockTask;
 import at.gv.egovernment.moa.id.commons.db.ConfigurationDBUtils;
 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
 import at.gv.egovernment.moa.id.config.ConnectionParameter;
@@ -92,6 +93,7 @@ import at.gv.egovernment.moa.util.DOMUtils;
  * 
  * @author Paul Ivancsics
  * @version $Id$
+ * @deprecated Use {@link VerifyAuthenticationBlockTask} instead.
  */
 public class VerifyAuthenticationBlockServlet extends AuthServlet {
 	
@@ -153,6 +155,8 @@ public class VerifyAuthenticationBlockServlet extends AuthServlet {
 
 		Logger.debug("POST VerifyAuthenticationBlock");
 		
+		Logger.warn(getClass().getName() + " is deprecated and should not be used any more.");
+
 		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);
 		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);
 		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyCertificateServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyCertificateServlet.java
index a3397f561..2aa717a65 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyCertificateServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyCertificateServlet.java
@@ -65,6 +65,7 @@ import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
 import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;

 import at.gv.egovernment.moa.id.auth.exception.MOAIDException;

 import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;

+import at.gv.egovernment.moa.id.auth.modules.internal.tasks.VerifyCertificateTask;

 import at.gv.egovernment.moa.id.commons.db.ConfigurationDBUtils;

 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;

 import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;

@@ -77,6 +78,7 @@ import at.gv.egovernment.moa.spss.util.CertificateUtils;
  * Servlet requested for getting the foreign eID

  * provided by the security layer implementation.

  * Utilizes the {@link AuthenticationServer}.

+ * @deprecated Use {@link VerifyCertificateTask} instead.

  *

  */

 public class VerifyCertificateServlet extends AuthServlet {

@@ -126,6 +128,8 @@ public class VerifyCertificateServlet extends AuthServlet {
 

 		Logger.debug("POST VerifyCertificateServlet");

 		

+		Logger.warn(getClass().getName() + " is deprecated and should not be used any more.");

+

 		resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES);

 		resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);

 		resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);

@@ -180,7 +184,8 @@ public class VerifyCertificateServlet extends AuthServlet {
 					throw new MOAIDException("session store error", null);

 				}

 	    		

-	    		ServletUtils.writeCreateXMLSignatureRequestOrRedirect(resp, session, createXMLSignatureRequestOrRedirect, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "VerifyCertificate");

+		    	ServletUtils.writeCreateXMLSignatureRequestOrRedirect(resp, session, createXMLSignatureRequestOrRedirect, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "VerifyCertificate");

+	    		

 	    	}

 	    	else {

 	    			

@@ -208,8 +213,7 @@ public class VerifyCertificateServlet extends AuthServlet {
 					throw new MOAIDException("session store error", null);

 				}

 		    	

-		    	ServletUtils.writeCreateXMLSignatureRequest(resp, session, createXMLSignatureRequest, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "GetForeignID", dataurl);

-		    	

+		    	ServletUtils.writeCreateXMLSignatureRequest(resp, createXMLSignatureRequest, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "GetForeignID", dataurl);

 		    	

 		    	Logger.debug("Send CreateXMLSignatureRequest to BKU");

 	    	}	    		    	 

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyIdentityLinkServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyIdentityLinkServlet.java
index 3b503f07b..b8e57ed43 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyIdentityLinkServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyIdentityLinkServlet.java
@@ -53,7 +53,6 @@ import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.apache.commons.fileupload.FileUploadException;
 import org.apache.commons.lang.StringEscapeUtils;
 
 import at.gv.egovernment.moa.id.auth.AuthenticationServer;
@@ -65,8 +64,8 @@ import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
 import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.auth.exception.ParseException;
 import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
+import at.gv.egovernment.moa.id.auth.modules.internal.tasks.VerifyIdentityLinkTask;
 import at.gv.egovernment.moa.id.commons.db.ConfigurationDBUtils;
-import at.gv.egovernment.moa.id.commons.db.MOASessionDBUtils;
 import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException;
 import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
 import at.gv.egovernment.moa.id.config.auth.OAAuthParameter;
@@ -82,6 +81,7 @@ import at.gv.egovernment.moa.logging.Logger;
  *
  * @author Paul Ivancsics
  * @version $Id$
+ * @deprecated Use {@link VerifyIdentityLinkTask} instead.
  */
 public class VerifyIdentityLinkServlet extends AuthServlet {
 
@@ -135,6 +135,8 @@ public class VerifyIdentityLinkServlet extends AuthServlet {
     throws ServletException, IOException {
 
 		Logger.debug("POST VerifyIdentityLink");
+	
+	Logger.warn(getClass().getName() + " is deprecated and should not be used any more.");
 		  
     Map<String, String> parameters;
     String pendingRequestID = null;
@@ -201,7 +203,7 @@ public class VerifyIdentityLinkServlet extends AuthServlet {
                   session.getSessionID());
           
          
-          ServletUtils.writeCreateXMLSignatureRequest(resp, session, infoboxReadRequest, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "VerifyIdentityLink", dataurl);
+          ServletUtils.writeCreateXMLSignatureRequest(resp, infoboxReadRequest, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "VerifyIdentityLink", dataurl);
           
     	    	
     	    }
@@ -231,7 +233,7 @@ public class VerifyIdentityLinkServlet extends AuthServlet {
      		  //ServletUtils.writeCreateXMLSignatureRequestURLEncoded(resp, session, infoboxReadRequest, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "VerifyIdentityLink", dataurl);
      		   
      		  Logger.debug("ContentType set to: text/xml;charset=UTF-8 (ServletUtils)");
-     		  ServletUtils.writeCreateXMLSignatureRequest(resp, session, infoboxReadRequest, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "VerifyIdentityLink", dataurl);
+     		  ServletUtils.writeCreateXMLSignatureRequest(resp, infoboxReadRequest, AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, "VerifyIdentityLink", dataurl);
     			
     		}	
     		else {