1 files changed, 33 insertions, 24 deletions
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/ProtocolFinalizationController.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/ProtocolFinalizationController.java
index 8c3f2c946..a9fc994ec 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/ProtocolFinalizationController.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/ProtocolFinalizationController.java
@@ -33,6 +33,7 @@ import org.springframework.web.bind.annotation.RequestMethod;
 
 import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants;
 import at.gv.egovernment.moa.id.auth.data.AuthenticationSession;
+import at.gv.egovernment.moa.id.auth.exception.AuthenticationException;
 import at.gv.egovernment.moa.id.auth.exception.MOAIDException;
 import at.gv.egovernment.moa.id.auth.exception.WrongParametersException;
 import at.gv.egovernment.moa.id.moduls.IRequest;
@@ -74,18 +75,9 @@ public class ProtocolFinalizationController extends AbstractAuthProtocolModulCon
 	
 						//build protocol-specific error message if possible
 						buildProtocolSpecificErrorResponse(throwable, req, resp, pendingReq);
-						
-						//log Error Message
-						statisticLogger.logErrorOperation(throwable, pendingReq);
-						
-						//get MOASession for this pendingRequest
-						AuthenticationSession moaSession = 
-								authenticatedSessionStorage.getSession(
-										pendingReq.getMOASessionIdentifier());
-						
-						//remove MOASession if someone is found
-						if (moaSession != null)
-							authmanager.performOnlyIDPLogOut(req, resp, moaSession.getSessionID());
+																
+						//remove active user-session
+						removeUserSession(pendingReq, req, resp);
 	
 						return;
 	
@@ -132,31 +124,48 @@ public class ProtocolFinalizationController extends AbstractAuthProtocolModulCon
 				if (moaSession == null) {
 					Logger.error("No MOASession with ID " + sessionID + " found.!");		
 					handleErrorNoRedirect(new MOAIDException("auth.02", new Object[]{sessionID}), req, resp, true);							
-					return;
 					
-				}
-								
-				//check if MOASession and pending-request are authenticated
-				if (moaSession.isAuthenticated() && pendingReq.isAuthenticated()) {				
-					finalizeAuthenticationProcess(req, resp, pendingReq, moaSession);
-									
 				} else {
-					Logger.error("MOASession oder Pending-Request are not authenticated --> Abort authentication process!");		
-					handleErrorNoRedirect(new MOAIDException("auth.20", null), req, resp, true);							
-					return;
-									
+					
+						//check if pending-request has 'abortedByUser' flag set
+					if (pendingReq.isAbortedByUser()) {
+						//send authentication aborted error to Service Provider
+						buildProtocolSpecificErrorResponse(
+								new AuthenticationException("auth.21", new Object[] {}), 
+								req, resp, pendingReq);
+						
+						//do not remove the full active SSO-Session 
+						// in case of only one Service-Provider authentication request is aborted   
+						if ( !(moaSession.isAuthenticated() 
+								&& pendingReq.needSingleSignOnFunctionality()) ) {
+							removeUserSession(pendingReq, req, resp);
+							
+						}							
+	
+						//check if MOASession and pending-request are authenticated					
+					} else if (moaSession.isAuthenticated() && pendingReq.isAuthenticated()) {				
+						finalizeAuthenticationProcess(req, resp, pendingReq, moaSession);
+	
+					} else {
+						//suspect state: pending-request is not aborted but also are not authenticated 
+						Logger.error("MOASession oder Pending-Request are not authenticated --> Abort authentication process!");		
+						handleErrorNoRedirect(new MOAIDException("auth.20", null), req, resp, true);							
+										
+					}
 				}
 							
 			} catch (Exception e) {
 				Logger.error("Finalize authentication protocol FAILED." , e);
 				buildProtocolSpecificErrorResponse(e, req, resp, pendingReq);
 				
+				removeUserSession(pendingReq, req, resp);
+				
 			}		
 		}
 		
 		//remove pending-request
 		if (pendingReq != null)
-		requestStorage.removePendingRequest(pendingReq.getRequestID());
+			requestStorage.removePendingRequest(pendingReq.getRequestID());
 		
 	}