1 files changed, 48 insertions, 10 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java
index 84c0138a5..2b9e72782 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVP2XProtocol.java
@@ -40,6 +40,7 @@ import org.opensaml.saml2.core.Response;
 import org.opensaml.saml2.core.Status;
 import org.opensaml.saml2.core.StatusCode;
 import org.opensaml.saml2.core.StatusMessage;
+import org.opensaml.saml2.core.impl.AuthnRequestImpl;
 import org.opensaml.saml2.metadata.AssertionConsumerService;
 import org.opensaml.saml2.metadata.AttributeConsumingService;
 import org.opensaml.saml2.metadata.EntityDescriptor;
@@ -58,11 +59,14 @@ import at.gv.egovernment.moa.id.protocols.pvp2x.binding.IEncoder;
 import at.gv.egovernment.moa.id.protocols.pvp2x.binding.MOARequest;
 import at.gv.egovernment.moa.id.protocols.pvp2x.binding.PostBinding;
 import at.gv.egovernment.moa.id.protocols.pvp2x.binding.RedirectBinding;
+import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.AuthnRequestValidatorException;
 import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.MandateAttributesNotHandleAbleException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.NameIDFormatNotSupportedException;
 import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.NoMetadataInformationException;
 import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.PVP2Exception;
 import at.gv.egovernment.moa.id.protocols.pvp2x.utils.CheckMandateAttributes;
 import at.gv.egovernment.moa.id.protocols.pvp2x.utils.SAML2Utils;
+import at.gv.egovernment.moa.id.protocols.pvp2x.validation.AuthnRequestValidator;
 import at.gv.egovernment.moa.id.protocols.pvp2x.verification.SAMLVerificationEngine;
 import at.gv.egovernment.moa.id.protocols.pvp2x.verification.TrustEngineFactory;
 import at.gv.egovernment.moa.id.util.VelocityLogAdapter;
@@ -90,6 +94,8 @@ public class PVP2XProtocol implements IModulInfo, MOAIDAuthConstants {
 		actions.put(POST, new AuthenticationAction());
 		actions.put(METADATA, new MetadataAction());
 		
+		//TODO: insert getArtifact action
+		
 		instance = new PVP2XProtocol();
 		
 		new VelocityLogAdapter();
@@ -167,7 +173,7 @@ public class PVP2XProtocol implements IModulInfo, MOAIDAuthConstants {
 			if(!(samlReq instanceof AuthnRequest)) {
 				throw new MOAIDException("Unsupported request", new Object[] {});
 			}
-			
+						
 			EntityDescriptor metadata = moaRequest.getEntityMetadata();
 			if(metadata == null) {
 				throw new NoMetadataInformationException();
@@ -201,7 +207,7 @@ public class PVP2XProtocol implements IModulInfo, MOAIDAuthConstants {
 					spSSODescriptor.getAttributeConsumingServices().size() > 0) {
 				attributeConsumer  = spSSODescriptor.getAttributeConsumingServices().get(attributeIdx);
 			} 
-			
+						
 			String oaURL = moaRequest.getEntityMetadata().getEntityID();
 			String binding = consumerService.getBinding();
 //			String entityID = moaRequest.getEntityMetadata().getEntityID();
@@ -223,11 +229,30 @@ public class PVP2XProtocol implements IModulInfo, MOAIDAuthConstants {
 					}
 				}
 			}
-			
-			request.getSession().setAttribute(PARAM_OA, oaURL);
 
+			//validate AuthnRequest
+			try {
+				AuthnRequestValidator.validate((AuthnRequestImpl) samlReq);
+				
+			} catch (AuthnRequestValidatorException e) {
+				if (generateErrorMessage(e, request, response, config)) {
+					throw new AuthnRequestValidatorException(e.getMessage(), 
+							new Object[] {}, config);
+					
+				} else {
+					throw new MOAIDException(e.getMessage(), new Object[] {});
+	
+				}			
+			}
+
+			//request.getSession().setAttribute(PARAM_OA, oaURL);
+			
 			return config;
-		} catch (Exception e) {
+
+		} catch (PVP2Exception e) {
+			throw e;
+			
+		} catch (Throwable e) {
 			e.printStackTrace();
 			throw new MOAIDException(e.getMessage(), new Object[] {});
 		}
@@ -253,17 +278,23 @@ public class PVP2XProtocol implements IModulInfo, MOAIDAuthConstants {
 		StatusMessage statusMessage = SAML2Utils.createSAMLObject(StatusMessage.class);
 		if(e instanceof NoPassivAuthenticationException) {
 			statusCode.setValue(StatusCode.NO_PASSIVE_URI);
-			statusMessage.setMessage(e.getLocalizedMessage());	
+			statusMessage.setMessage(StringEscapeUtils.escapeXml(e.getLocalizedMessage()));	
+			
+		} else if (e instanceof NameIDFormatNotSupportedException) {
+			statusCode.setValue(StatusCode.INVALID_NAMEID_POLICY_URI);
+			statusMessage.setMessage(StringEscapeUtils.escapeXml(e.getLocalizedMessage()));
+			
 		} else if(e instanceof PVP2Exception) {
 			PVP2Exception ex = (PVP2Exception) e;
 			statusCode.setValue(ex.getStatusCodeValue());
 			String statusMessageValue = ex.getStatusMessageValue();
 			if(statusMessageValue != null) {
-				statusMessage.setMessage(statusMessageValue);
+				statusMessage.setMessage(StringEscapeUtils.escapeXml(statusMessageValue));
 			}
+			
 		} else {
 			statusCode.setValue(StatusCode.RESPONDER_URI);
-			statusMessage.setMessage(e.getLocalizedMessage());
+			statusMessage.setMessage(StringEscapeUtils.escapeXml(e.getLocalizedMessage()));
 		}
 		
 		status.setStatusCode(statusCode);
@@ -271,7 +302,9 @@ public class PVP2XProtocol implements IModulInfo, MOAIDAuthConstants {
 			status.setStatusMessage(statusMessage);
 		}
 		samlResponse.setStatus(status);
-		
+		String remoteSessionID = SAML2Utils.getSecureIdentifier();
+		samlResponse.setID(remoteSessionID);
+				
 		IEncoder encoder = null;
 		
 		if(pvpRequest.getBinding().equals(SAMLConstants.SAML2_REDIRECT_BINDING_URI)) {
@@ -288,7 +321,12 @@ public class PVP2XProtocol implements IModulInfo, MOAIDAuthConstants {
 			encoder = new RedirectBinding();
 		}
 
-		encoder.encodeRespone(request, response, samlResponse, pvpRequest.getConsumerURL());
+		String relayState = null;
+		if (pvpRequest.getRequest() != null)
+			relayState = pvpRequest.getRequest().getRelayState();
+		
+		encoder.encodeRespone(request, response, samlResponse, pvpRequest.getConsumerURL(), 
+				relayState);
 		return true;
 	}