diff options
Diffstat (limited to 'id/server/idserverlib/src/main/java/at/gv')
21 files changed, 442 insertions, 191 deletions
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/LoginFormBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/LoginFormBuilder.java index 9ba11bebd..a80fcfa25 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/LoginFormBuilder.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/LoginFormBuilder.java @@ -30,6 +30,7 @@ public class LoginFormBuilder { private static String BKU_HANDY = "#HANDY#"; private static String BKU_LOCAL = "#LOCAL#"; private static String CONTEXTPATH = "#CONTEXTPATH#"; + private static String MOASESSIONID = "#SESSIONID#"; private static String SERVLET = CONTEXTPATH+"/GenerateIframeTemplate"; @@ -84,7 +85,7 @@ public class LoginFormBuilder { return template; } - public static String buildLoginForm(String modul, String action, String oaname, String contextpath, boolean isIFrame) { + public static String buildLoginForm(String modul, String action, String oaname, String contextpath, boolean isIFrame, String moaSessionID) { String value = getTemplate(isIFrame); if(value != null) { @@ -98,6 +99,7 @@ public class LoginFormBuilder { value = value.replace(ACTION, action); value = value.replace(OANAME, oaname); value = value.replace(CONTEXTPATH, contextpath); + value = value.replace(MOASESSIONID, moaSessionID); } return value; } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SendAssertionFormBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SendAssertionFormBuilder.java index a72848832..956593237 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SendAssertionFormBuilder.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SendAssertionFormBuilder.java @@ -25,6 +25,7 @@ public class SendAssertionFormBuilder { private static String URL = "#URL#"; private static String MODUL = "#MODUL#"; private static String ACTION = "#ACTION#"; + private static String ID = "#ID#"; private static String OANAME = "#OAName#"; private static String CONTEXTPATH = "#CONTEXTPATH#"; @@ -75,7 +76,7 @@ public class SendAssertionFormBuilder { return template; } - public static String buildForm(String modul, String action, String oaname, String contextpath, boolean isIFrame) { + public static String buildForm(String modul, String action, String id, String oaname, String contextpath, boolean isIFrame) { String value = getTemplate(isIFrame); if(value != null) { @@ -87,6 +88,7 @@ public class SendAssertionFormBuilder { } value = value.replace(MODUL, modul); value = value.replace(ACTION, action); + value = value.replace(ID, id); value = value.replace(OANAME, oaname); value = value.replace(CONTEXTPATH, contextpath); } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java index c9a10b812..58cea2926 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/StartAuthentificationParameterParser.java @@ -221,11 +221,11 @@ public class StartAuthentificationParameterParser implements MOAIDAuthConstants{ } public static void parse(HttpServletRequest req, HttpServletResponse resp, - AuthenticationSession moasession) throws WrongParametersException, MOAIDException { + AuthenticationSession moasession, IRequest request) throws WrongParametersException, MOAIDException { - //check Module and Action - HttpSession httpSession = req.getSession(); - IRequest request = RequestStorage.getPendingRequest(httpSession); +// //check Module and Action +// HttpSession httpSession = req.getSession(); +// IRequest request = RequestStorage.getPendingRequest(httpSession); String modul = request.requestedModule();//req.getParameter(PARAM_MODUL); String action = request.requestedAction();//req.getParameter(PARAM_ACTION); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java index 4b15d80b4..022f21491 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java @@ -50,6 +50,7 @@ import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants; import at.gv.egovernment.moa.id.auth.WrongParametersException; import at.gv.egovernment.moa.id.config.ConfigurationException; import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider; +import at.gv.egovernment.moa.id.entrypoints.DispatcherServlet; import at.gv.egovernment.moa.id.storage.ExceptionStoreImpl; import at.gv.egovernment.moa.id.storage.IExceptionStore; import at.gv.egovernment.moa.id.util.ServletUtils; @@ -143,7 +144,7 @@ public class AuthServlet extends HttpServlet implements MOAIDAuthConstants { * servlet response */ protected void handleError(String errorMessage, Throwable exceptionThrown, - HttpServletRequest req, HttpServletResponse resp) { + HttpServletRequest req, HttpServletResponse resp, String pendingRequestID) { if (null != errorMessage) { Logger.error(errorMessage); @@ -167,7 +168,8 @@ public class AuthServlet extends HttpServlet implements MOAIDAuthConstants { String redirectURL = null; redirectURL = ServletUtils.getBaseUrl(req); - redirectURL += "/dispatcher?" + ERROR_CODE_PARAM + "=" + id; + redirectURL += "/dispatcher?" + ERROR_CODE_PARAM + "=" + id + + "&" + DispatcherServlet.PARAM_TARGET_PENDINGREQUESTID + "=" + pendingRequestID; resp.setContentType("text/html"); resp.setStatus(302); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GenerateIFrameTemplateServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GenerateIFrameTemplateServlet.java index 2ea34ee12..8d23f1a3b 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GenerateIFrameTemplateServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GenerateIFrameTemplateServlet.java @@ -52,19 +52,26 @@ public class GenerateIFrameTemplateServlet extends AuthServlet { protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { Logger.info("Receive " + GenerateIFrameTemplateServlet.class + " Request"); - + + String pendingRequestID = null; + try { String bkuid = req.getParameter(PARAM_BKU); String useMandate = req.getParameter(PARAM_USEMANDATE); String ccc = req.getParameter(PARAM_CCC); - - String moasessionid = null; + String moasessionid = req.getParameter(PARAM_SESSIONID); + AuthenticationSession moasession = null; - + try { - moasessionid = (String) req.getSession().getAttribute(AuthenticationManager.MOA_SESSION); - moasession = AuthenticationSessionStoreage.getSession(moasessionid); - + //moasessionid = (String) req.getSession().getAttribute(AuthenticationManager.MOA_SESSION); + + pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(moasessionid); + + moasession = AuthenticationSessionStoreage.getSession(moasessionid); + + String newmoasessionid = AuthenticationSessionStoreage.changeSessionID(moasession); + } catch (MOADatabaseException e) { Logger.info("MOASession with SessionID="+ moasessionid + " is not found in Database"); throw new MOAIDException("init.04", new Object[] { @@ -131,49 +138,9 @@ public class GenerateIFrameTemplateServlet extends AuthServlet { } catch (MOAIDException ex) { - handleError(null, ex, req, resp); + handleError(null, ex, req, resp, pendingRequestID); } } - -// private String getTemplateURIFromConfig(int bkuID, OAAuthParameter oaParam) throws WrongParametersException { -// //TODO: CHANGE to real OA config -// -// List<String> bkuURIs = Arrays.asList( -// "http://localhost:8080/moa-id-auth/template_onlineBKU.html", -// "http://localhost:8080/moa-id-auth/template_handyBKU.html", -// "http://127.0.0.1:8080/moa-id-auth/template_localBKU.html"); -// -//// List<String> bkuURIs = Arrays.asList( -//// "http://demo.egiz.gv.at/demoportal_moaid-2.0/template_onlineBKU.html", -//// "http://demo.egiz.gv.at/demoportal_moaid-2.0/template_handyBKU.html", -//// "http://demo.egiz.gv.at/demoportal_moaid-2.0/template_localBKU.html"); -// -// if (bkuID < bkuURIs.size()) -// return bkuURIs.get(bkuID); -// else -// throw new WrongParametersException("GenerateIFrameTemplate", PARAM_TEMPLATE, -// "auth.12"); -// } -// -// private String getBKUURIFromConfig(int bkuID, OAAuthParameter oaParam) throws WrongParametersException { -// //TODO: CHANGE to real OA config -// -// List<String> bkuURIs = Arrays.asList( -// "https://labda.iaik.tugraz.at:8843/bkuonline/https-security-layer-request", -// "https://www.handy-signatur.at/mobile/https-security-layer-request/default.aspx", -// "https://127.0.0.1:3496/https-security-layer-request"); -// -//// List<String> bkuURIs = Arrays.asList( -//// "https://demo.egiz.gv.at/demoportal_bkuonline/https-security-layer-request", -//// "https://www.handy-signatur.at/mobile/https-security-layer-request/default.aspx", -//// "https://127.0.0.1:3496/https-security-layer-request"); -// -// if (bkuID < bkuURIs.size()) -// return bkuURIs.get(bkuID); -// else -// throw new WrongParametersException("GenerateIFrameTemplate", PARAM_BKU, -// "auth.12"); -// } } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetForeignIDServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetForeignIDServlet.java index d49f4e215..02c751a0a 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetForeignIDServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetForeignIDServlet.java @@ -114,7 +114,10 @@ public class GetForeignIDServlet extends AuthServlet { resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);
- Map parameters;
+ Map parameters; + + String pendingRequestID = null; +
try
{
parameters = getParameters(req);
@@ -123,7 +126,8 @@ public class GetForeignIDServlet extends AuthServlet { Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage());
throw new IOException(e.getMessage());
}
- String sessionID = req.getParameter(PARAM_SESSIONID);
+ String sessionID = req.getParameter(PARAM_SESSIONID); + pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID);
// escape parameter strings
sessionID = StringEscapeUtils.escapeHtml(sessionID);
@@ -195,8 +199,9 @@ public class GetForeignIDServlet extends AuthServlet { } redirectURL = addURLParameter(redirectURL, PARAM_SAMLARTIFACT, URLEncoder.encode(samlArtifactBase64, "UTF-8")); redirectURL = resp.encodeRedirectURL(redirectURL);*/ + redirectURL = new DataURLBuilder().buildDataURL(session.getAuthURL(), - ModulUtils.buildAuthURL(session.getModul(), session.getAction()), newMOASessionID); + ModulUtils.buildAuthURL(session.getModul(), session.getAction(), pendingRequestID), newMOASessionID); redirectURL = resp.encodeRedirectURL(redirectURL); } else { @@ -219,10 +224,10 @@ public class GetForeignIDServlet extends AuthServlet { }
catch (MOAIDException ex) {
- handleError(null, ex, req, resp);
+ handleError(null, ex, req, resp, pendingRequestID);
}
catch (SZRGWClientException ex) {
- handleError(null, ex, req, resp);
+ handleError(null, ex, req, resp, pendingRequestID);
}
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java index 7d825da17..8e5fccfef 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetMISSessionIDServlet.java @@ -143,12 +143,15 @@ public class GetMISSessionIDServlet extends AuthServlet { sessionID = StringEscapeUtils.escapeHtml(sessionID); AuthenticationSession session = null; + String pendingRequestID = null; try { // check parameter if (!ParamValidatorUtils.isValidSessionID(sessionID)) throw new WrongParametersException("VerifyCertificate", PARAM_SESSIONID, "auth.12"); + pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID); + session = AuthenticationServer.getSession(sessionID); String misSessionID = session.getMISSessionID(); @@ -209,11 +212,11 @@ public class GetMISSessionIDServlet extends AuthServlet { Logger.info("Changed MOASession " + oldsessionID + " to Session " + newMOASessionID); Logger.info("Daten angelegt zu MOASession " + newMOASessionID); - + String redirectURL = new DataURLBuilder().buildDataURL( session.getAuthURL(), ModulUtils.buildAuthURL(session.getModul(), - session.getAction()), newMOASessionID); + session.getAction(), pendingRequestID), newMOASessionID); redirectURL = resp.encodeRedirectURL(redirectURL); @@ -252,17 +255,17 @@ public class GetMISSessionIDServlet extends AuthServlet { Logger.debug("REDIRECT TO: " + redirectURL); } catch (MOAIDException ex) { - handleError(null, ex, req, resp); + handleError(null, ex, req, resp, pendingRequestID); } catch (GeneralSecurityException ex) { - handleError(null, ex, req, resp); + handleError(null, ex, req, resp, pendingRequestID); } catch (PKIException e) { - handleError(null, e, req, resp); + handleError(null, e, req, resp, pendingRequestID); } catch (MISSimpleClientException e) { - handleError(null, e, req, resp); + handleError(null, e, req, resp, pendingRequestID); } catch (SAXException e) { - handleError(null, e, req, resp); + handleError(null, e, req, resp, pendingRequestID); } catch (ParserConfigurationException e) { - handleError(null, e, req, resp); + handleError(null, e, req, resp, pendingRequestID); } } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/LogOutServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/LogOutServlet.java index caf2e4490..8dc5d7469 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/LogOutServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/LogOutServlet.java @@ -83,29 +83,34 @@ public class LogOutServlet extends AuthServlet { SSOManager ssomanager = SSOManager.getInstance(); - //get SSO token from request - String ssoid = ssomanager.getSSOSessionID(req); - - if (ssomanager.isValidSSOSession(ssoid, req)) { - - //TODO: Single LogOut Implementation + try { + //get SSO token from request + String ssoid = ssomanager.getSSOSessionID(req); - //delete SSO session and MOA session - AuthenticationManager authmanager = AuthenticationManager.getInstance(); - String moasessionid = AuthenticationSessionStoreage.getMOASessionID(ssoid); - - authmanager.logout(req, resp, moasessionid); - Logger.info("User with SSO Id " + ssoid + " is logged out and get redirect to "+ redirectUrl); - } else { - Logger.info("No active SSO session found. User is maybe logout already and get redirect to "+ redirectUrl); - } + if (ssomanager.isValidSSOSession(ssoid, req)) { - //Remove SSO token - ssomanager.deleteSSOSessionID(req, resp); + //TODO: Single LogOut Implementation - //invalidate Session - req.getSession().invalidate(); + //delete SSO session and MOA session + AuthenticationManager authmanager = AuthenticationManager.getInstance(); + String moasessionid = AuthenticationSessionStoreage.getMOASessionID(ssoid); + RequestStorage.removePendingRequest(RequestStorage.getPendingRequest(req.getSession()), + AuthenticationSessionStoreage.getPendingRequestID(moasessionid)); + + authmanager.logout(req, resp, moasessionid); + Logger.info("User with SSO Id " + ssoid + " is logged out and get redirect to "+ redirectUrl); + } else { + Logger.info("No active SSO session found. User is maybe logout already and get redirect to "+ redirectUrl); + } + + //Remove SSO token + ssomanager.deleteSSOSessionID(req, resp); + + } catch (Exception e) { + Logger.warn(LogOutServlet.class.getName() + " has an LogOut Error. Redirect to Applikation " + redirectUrl, e); + } + //Redirect to Application resp.setStatus(301); resp.addHeader("Location", redirectUrl); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java index 63bc2a8cc..f6412f897 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/PEPSConnectorServlet.java @@ -56,6 +56,8 @@ public class PEPSConnectorServlet extends AuthServlet { */
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+ String pendingRequestID = null;
+
try {
Logger.info("PEPSConnector Servlet invoked, expecting C-PEPS message.");
@@ -80,6 +82,8 @@ public class PEPSConnectorServlet extends AuthServlet { httpSession.invalidate();
}
+ pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(moaSessionID);
+
Logger.info("Found MOA sessionID: " + moaSessionID);
Logger.debug("Beginning to extract SAMLResponse out of HTTP Request");
@@ -199,7 +203,7 @@ public class PEPSConnectorServlet extends AuthServlet { AuthenticationServer.getInstance().getForeignAuthenticationData(moaSession);
Logger.info("MOA assertion assembled and SAML Artifact generated.");
- //session is implicit stored in changeSessionID!!!!
+ //session is implicit stored in changeSessionID!!!!
String newMOASessionID = AuthenticationSessionStoreage.changeSessionID(moaSession);
Logger.info("Changed MOASession " + moaSessionID + " to Session " + newMOASessionID);
@@ -214,8 +218,9 @@ public class PEPSConnectorServlet extends AuthServlet { }
redirectURL = addURLParameter(redirectURL, PARAM_SAMLARTIFACT, URLEncoder.encode(samlArtifactBase64, "UTF-8"));
redirectURL = response.encodeRedirectURL(redirectURL);*/
+
redirectURL = new DataURLBuilder().buildDataURL(moaSession.getAuthURL(),
- ModulUtils.buildAuthURL(moaSession.getModul(), moaSession.getAction()), newMOASessionID);
+ ModulUtils.buildAuthURL(moaSession.getModul(), moaSession.getAction(), pendingRequestID), newMOASessionID);
redirectURL = response.encodeRedirectURL(redirectURL);
} else {
@@ -236,9 +241,9 @@ public class PEPSConnectorServlet extends AuthServlet { } catch (AuthenticationException e) {
- handleError(null, e, request, response);
+ handleError(null, e, request, response, pendingRequestID);
} catch (MOAIDException e) {
- handleError(null, e, request, response);
+ handleError(null, e, request, response, pendingRequestID);
}
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ProcessValidatorInputServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ProcessValidatorInputServlet.java index 200d25fbe..ba8698934 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ProcessValidatorInputServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ProcessValidatorInputServlet.java @@ -135,7 +135,7 @@ public class ProcessValidatorInputServlet extends AuthServlet { handleWrongParameters(ex, req, resp); }
catch (MOAIDException ex) {
- handleError(null, ex, req, resp);
+ handleError(null, ex, req, resp, null); //TODO: is this Class required?
}
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/SSOSendAssertionServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/SSOSendAssertionServlet.java index ecbd87498..9b559770f 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/SSOSendAssertionServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/SSOSendAssertionServlet.java @@ -36,18 +36,48 @@ public class SSOSendAssertionServlet extends AuthServlet{ private static final long serialVersionUID = 1L; private static final String PARAM = "value"; + private static final String MODULE = "mod"; + private static final String ACTION = "action"; + private static final String ID = "identifier"; protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { + + String id = null; Logger.info("Receive " + SSOSendAssertionServlet.class + " Request"); try { + Object idObject = req.getParameter(ID); + + if (idObject != null && (idObject instanceof String)) { + id = (String) idObject; + } + String value = req.getParameter(PARAM); value = StringEscapeUtils.escapeHtml(value); if (!ParamValidatorUtils.isValidUseMandate(value)) throw new WrongParametersException("SSOSendAssertionServlet", PARAM, null); - + //get module and action + Object moduleObject = req.getParameter(MODULE); + String module = null; + if (moduleObject != null && (moduleObject instanceof String)) { + module = (String) moduleObject; + } + + + Object actionObject = req.getParameter(ACTION); + String action = null; + if (actionObject != null && (actionObject instanceof String)) { + action = (String) actionObject; + } + + if (MiscUtil.isEmpty(module) || MiscUtil.isEmpty(action) || MiscUtil.isEmpty(id)) { + Logger.warn("No Moduel or Action parameter received!"); + throw new WrongParametersException("Module or Action is empty", "", "auth.10"); + } + + SSOManager ssomanager = SSOManager.getInstance(); //get SSO Cookie for Request String ssoId = ssomanager.getSSOSessionID(req); @@ -86,15 +116,9 @@ public class SSOSendAssertionServlet extends AuthServlet{ moaSessionID = AuthenticationSessionStoreage.getMOASessionID(ssoId); AuthenticationSession moasession = AuthenticationSessionStoreage.getSession(moaSessionID); AuthenticationSessionStoreage.setAuthenticated(moaSessionID, true); - - HttpSession httpSession = req.getSession(); - IRequest protocolRequest = RequestStorage.getPendingRequest(httpSession); - - if (protocolRequest == null) - throw new AuthenticationException("auth.21", new Object[] {}); - + String redirectURL = new DataURLBuilder().buildDataURL(moasession.getAuthURL(), - ModulUtils.buildAuthURL(protocolRequest.requestedModule(), protocolRequest.requestedAction()), ""); + ModulUtils.buildAuthURL(module, action, id), ""); resp.setContentType("text/html"); resp.setStatus(302); @@ -109,16 +133,16 @@ public class SSOSendAssertionServlet extends AuthServlet{ } } else { - handleError("SSO Session is not valid", null, req, resp); + handleError("SSO Session is not valid", null, req, resp, id); } } catch (MOADatabaseException e) { - handleError("SSO Session is not found", e, req, resp); + handleError("SSO Session is not found", e, req, resp, id); } catch (WrongParametersException e) { - handleError("Parameter is not valid", e, req, resp); + handleError("Parameter is not valid", e, req, resp, id); } catch (AuthenticationException e) { - handleError(e.getMessage(), e, req, resp); + handleError(e.getMessage(), e, req, resp, id); } } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyAuthenticationBlockServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyAuthenticationBlockServlet.java index adef74370..96914647e 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyAuthenticationBlockServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyAuthenticationBlockServlet.java @@ -136,6 +136,7 @@ public class VerifyAuthenticationBlockServlet extends AuthServlet { resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL); resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE); + String pendingRequestID = null; Map parameters; try @@ -152,6 +153,8 @@ public class VerifyAuthenticationBlockServlet extends AuthServlet { // escape parameter strings sessionID = StringEscapeUtils.escapeHtml(sessionID); + pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID); + String redirectURL = null; try { // check parameter @@ -161,7 +164,7 @@ public class VerifyAuthenticationBlockServlet extends AuthServlet { throw new WrongParametersException("VerifyAuthenticationBlock", PARAM_XMLRESPONSE, "auth.12"); AuthenticationSession session = AuthenticationServer.getSession(sessionID); - + String samlArtifactBase64 = AuthenticationServer.getInstance().verifyAuthenticationBlock(session, createXMLSignatureResponse); @@ -252,8 +255,9 @@ public class VerifyAuthenticationBlockServlet extends AuthServlet { redirectURL = addURLParameter(redirectURL, PARAM_SAMLARTIFACT, URLEncoder.encode(samlArtifactBase64, "UTF-8")); redirectURL = resp.encodeRedirectURL(redirectURL);*/ + redirectURL = new DataURLBuilder().buildDataURL(session.getAuthURL(), - ModulUtils.buildAuthURL(session.getModul(), session.getAction()), samlArtifactBase64); + ModulUtils.buildAuthURL(session.getModul(), session.getAction(), pendingRequestID), samlArtifactBase64); } else { redirectURL = new DataURLBuilder().buildDataURL(session.getAuthURL(), AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, session.getSessionID()); @@ -270,15 +274,15 @@ public class VerifyAuthenticationBlockServlet extends AuthServlet { } catch (MOAIDException ex) { - handleError(null, ex, req, resp); + handleError(null, ex, req, resp, pendingRequestID); } catch (GeneralSecurityException e) { - handleError(null, e, req, resp); + handleError(null, e, req, resp, pendingRequestID); } catch (PKIException e) { - handleError(null, e, req, resp); + handleError(null, e, req, resp, pendingRequestID); } catch (MISSimpleClientException e) { - handleError(null, e, req, resp); + handleError(null, e, req, resp, pendingRequestID); } catch (TransformerException e) { - handleError(null, e, req, resp); + handleError(null, e, req, resp, pendingRequestID); } } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyCertificateServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyCertificateServlet.java index e07be8420..896bd0864 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyCertificateServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyCertificateServlet.java @@ -106,6 +106,8 @@ public class VerifyCertificateServlet extends AuthServlet { resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA);
resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL);
resp.addHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL_IE);
+ + String pendingRequestID = null; Map parameters;
try
@@ -120,7 +122,9 @@ public class VerifyCertificateServlet extends AuthServlet { // escape parameter strings
sessionID = StringEscapeUtils.escapeHtml(sessionID);
-
+ + pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID); +
AuthenticationSession session = null;
try {
// check parameter
@@ -177,7 +181,7 @@ public class VerifyCertificateServlet extends AuthServlet { }
catch (MOAIDException ex) {
- handleError(null, ex, req, resp);
+ handleError(null, ex, req, resp, pendingRequestID);
}
}
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyIdentityLinkServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyIdentityLinkServlet.java index 2f12c7ae6..c6310d8c0 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyIdentityLinkServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyIdentityLinkServlet.java @@ -113,6 +113,8 @@ public class VerifyIdentityLinkServlet extends AuthServlet { Logger.debug("POST VerifyIdentityLink"); Map parameters; + String pendingRequestID = null; + try { parameters = getParameters(req); @@ -127,6 +129,8 @@ public class VerifyIdentityLinkServlet extends AuthServlet { // escape parameter strings sessionID = StringEscapeUtils.escapeHtml(sessionID); + pendingRequestID = AuthenticationSessionStoreage.getPendingRequestID(sessionID); + resp.setHeader(MOAIDAuthConstants.HEADER_EXPIRES,MOAIDAuthConstants.HEADER_VALUE_EXPIRES); resp.setHeader(MOAIDAuthConstants.HEADER_PRAGMA,MOAIDAuthConstants.HEADER_VALUE_PRAGMA); resp.setHeader(MOAIDAuthConstants.HEADER_CACHE_CONTROL,MOAIDAuthConstants.HEADER_VALUE_CACHE_CONTROL); @@ -175,7 +179,7 @@ public class VerifyIdentityLinkServlet extends AuthServlet { } catch(Exception e) { - handleError(null, e, req, resp); + handleError(null, e, req, resp, pendingRequestID); } } @@ -234,11 +238,11 @@ public class VerifyIdentityLinkServlet extends AuthServlet { } } catch (ParseException ex) { - handleError(null, ex, req, resp); + handleError(null, ex, req, resp, pendingRequestID); } catch (MOAIDException ex) { - handleError(null, ex, req, resp); + handleError(null, ex, req, resp, pendingRequestID); } } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/entrypoints/DispatcherServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/entrypoints/DispatcherServlet.java index e995a1c2e..e7b41e3c9 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/entrypoints/DispatcherServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/entrypoints/DispatcherServlet.java @@ -3,13 +3,20 @@ package at.gv.egovernment.moa.id.entrypoints; import iaik.util.logging.Log; import java.io.IOException; +import java.util.ConcurrentModificationException; +import java.util.HashMap; import java.util.Iterator; +import java.util.List; +import java.util.Map; +import java.util.Set; +import java.util.concurrent.ConcurrentHashMap; import javax.servlet.ServletConfig; import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession; +import javax.swing.ListModel; import at.gv.egovernment.moa.id.AuthenticationException; import at.gv.egovernment.moa.id.MOAIDException; @@ -32,6 +39,7 @@ import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage; import at.gv.egovernment.moa.id.storage.ExceptionStoreImpl; import at.gv.egovernment.moa.id.util.HTTPSessionUtils; import at.gv.egovernment.moa.id.util.MOAIDMessageProvider; +import at.gv.egovernment.moa.id.util.Random; import at.gv.egovernment.moa.id.util.legacy.LegacyHelper; import at.gv.egovernment.moa.logging.Logger; @@ -44,6 +52,7 @@ public class DispatcherServlet extends AuthServlet{ public static final String PARAM_TARGET_MODULE = "mod"; public static final String PARAM_TARGET_ACTION = "action"; + public static final String PARAM_TARGET_PENDINGREQUESTID = "pendingid"; @Override public void init(ServletConfig config) throws ServletException { @@ -66,6 +75,8 @@ public class DispatcherServlet extends AuthServlet{ boolean isValidSSOSession = false; boolean useSSOOA = false; + String protocolRequestID = null; + try { Logger.info("REQUEST: " + req.getRequestURI()); @@ -76,30 +87,65 @@ public class DispatcherServlet extends AuthServlet{ Throwable throwable = ExceptionStoreImpl.getStore() .fetchException(errorid); ExceptionStoreImpl.getStore().removeException(errorid); + + Object idObject = req.getParameter(PARAM_TARGET_PENDINGREQUESTID); - if (throwable != null) { + Map<String, IRequest> errorRequests = RequestStorage.getPendingRequest(req.getSession()); + + String pendingRequestID = null; + if (idObject != null && (idObject instanceof String)) { + if (errorRequests.containsKey((String)idObject)) + pendingRequestID = (String) idObject; + } + + if (throwable != null) { + if (errorRequests != null) { + + synchronized (errorRequests) { + + IRequest errorRequest = null; + if (pendingRequestID != null) { + errorRequest = errorRequests.get(pendingRequestID); + + //remove the + RequestStorage.removePendingRequest(errorRequests, pendingRequestID); + } + else { + if (errorRequests.size() > 1) { + handleErrorNoRedirect(throwable.getMessage(), throwable, + req, resp); + + } else { + Set<String> keys = errorRequests.keySet(); + errorRequest = errorRequests.get(keys.toArray()[0]); + RequestStorage.removeAllPendingRequests(req.getSession()); + } + + } + - IRequest errorRequest = RequestStorage - .getPendingRequest(req.getSession()); - - //remove the - RequestStorage.removePendingRequest(req.getSession()); - - if (errorRequest != null) { - try { - IModulInfo handlingModule = ModulStorage - .getModuleByPath(errorRequest - .requestedModule()); - if (handlingModule != null) { - if (handlingModule.generateErrorMessage( - throwable, req, resp, errorRequest)) { - return; + + if (errorRequest != null) { + + try { + IModulInfo handlingModule = ModulStorage + .getModuleByPath(errorRequest + .requestedModule()); + if (handlingModule != null) { + if (handlingModule.generateErrorMessage( + throwable, req, resp, errorRequest)) { + return; + } } + } catch (Throwable e) { + Logger.error(e); + handleErrorNoRedirect(throwable.getMessage(), + throwable, req, resp); } - } catch (Throwable e) { - Logger.error(e); - handleErrorNoRedirect(throwable.getMessage(), - throwable, req, resp); + } + else { + handleErrorNoRedirect(throwable.getMessage(), throwable, + req, resp); } } handleErrorNoRedirect(throwable.getMessage(), throwable, @@ -113,6 +159,7 @@ public class DispatcherServlet extends AuthServlet{ return; } + } Object moduleObject = req.getParameter(PARAM_TARGET_MODULE); String module = null; @@ -133,7 +180,7 @@ public class DispatcherServlet extends AuthServlet{ if (action == null) { action = req.getParameter(PARAM_TARGET_ACTION); } - + Logger.debug("dispatching to " + module + " protocol " + action); IModulInfo info = ModulStorage.getModuleByPath(module); @@ -174,46 +221,103 @@ public class DispatcherServlet extends AuthServlet{ } HttpSession httpSession = req.getSession(); + Map<String, IRequest> protocolRequests = null; IRequest protocolRequest = null; + try { - protocolRequest = RequestStorage.getPendingRequest(httpSession); - - if (protocolRequest != null) { - // check if pending request is same protocol and action - if (!protocolRequest.requestedModule().equals(module) - || !protocolRequest.requestedAction() - .equals(action) - || !info.validate(req, resp, protocolRequest)) { - resp.sendError(HttpServletResponse.SC_CONFLICT); - Logger.error("Different Request is pending in this session!"); + protocolRequests = RequestStorage.getPendingRequest(httpSession); + + Object idObject = req.getParameter(PARAM_TARGET_PENDINGREQUESTID); + + if (protocolRequests != null && + idObject != null && (idObject instanceof String)) { + +// synchronized (protocolRequests) { + + protocolRequestID = (String) idObject; + + //get IRequest if it exits + if (protocolRequests.containsKey(protocolRequestID)) { + protocolRequest = protocolRequests.get(protocolRequestID); + + //RequestStorage.setPendingRequest(httpSession, protocolRequests); + + } else { + resp.sendError(HttpServletResponse.SC_CONFLICT); + Logger.error("No PendingRequest with ID " + protocolRequestID + " found for this session!"); + return; + } +// } + } else { + try { + protocolRequest = info.preProcess(req, resp, action); + + if (protocolRequest != null) { + + if(protocolRequests != null) { + +// synchronized (protocolRequests) { +// synchronized (protocolRequest) { + Set<String> mapkeys = protocolRequests.keySet(); + for (String el : mapkeys) { + IRequest value = protocolRequests.get(el); + + if (value.getOAURL().equals(protocolRequest.getOAURL())) { + + if(!AuthenticationSessionStoreage.deleteSessionWithPendingRequestID(el)) { + Logger.warn("NO MOASession with PendingRequestID " + el + " found. Delete all user sessions!"); + RequestStorage.removeAllPendingRequests(req.getSession()); + + } else { + + + RequestStorage.removePendingRequest(protocolRequests, el); + } + } + } +// } +// } + + } else { + protocolRequests = new ConcurrentHashMap<String, IRequest>(); + } + + synchronized (protocolRequest) { + synchronized (protocolRequests) { + + //Start new Authentication + protocolRequest.setAction(action); + protocolRequest.setModule(module); + protocolRequestID = Random.nextRandom(); + protocolRequest.setRequestID(protocolRequestID); + protocolRequests.put(protocolRequestID, protocolRequest); + } + } + } + } catch (MOAIDException e) { + resp.sendError(HttpServletResponse.SC_BAD_REQUEST); + Logger.error("Failed to generate a valid protocol request!"); return; } - } - - if (protocolRequest == null) { - protocolRequest = info.preProcess(req, resp, action); - if (protocolRequest != null) { - protocolRequest.setAction(action); - protocolRequest.setModule(module); + + if (protocolRequest == null) { + resp.sendError(HttpServletResponse.SC_BAD_REQUEST); + Logger.error("Failed to generate a valid protocol request!"); + return; } } + + - if (protocolRequest == null) { - resp.sendError(HttpServletResponse.SC_BAD_REQUEST); - Logger.error("Failed to generate a valid protocol request!"); - return; - } - + //load Parameters from OnlineApplicationConfiguration OAAuthParameter oaParam = AuthConfigurationProvider.getInstance() .getOnlineApplicationParameter(protocolRequest.getOAURL()); if (oaParam == null) { - //TODO: Find a better place for this!! - //req.getSession().invalidate(); throw new AuthenticationException("auth.00", new Object[] { protocolRequest.getOAURL() }); } - - RequestStorage.setPendingRequest(httpSession, protocolRequest); + + RequestStorage.setPendingRequest(httpSession, protocolRequests); AuthenticationManager authmanager = AuthenticationManager.getInstance(); @@ -296,6 +400,8 @@ public class DispatcherServlet extends AuthServlet{ } } else { + + //TODO: maybe transmit moasessionID with http GET to handle more then one PendingRequest! moasessionID = HTTPSessionUtils.getHTTPSessionString(req.getSession(), AuthenticationManager.MOA_SESSION, null); moasession = AuthenticationSessionStoreage.getSession(moasessionID); @@ -319,7 +425,7 @@ public class DispatcherServlet extends AuthServlet{ moduleAction.processRequest(protocolRequest, req, resp, moasession); - RequestStorage.removePendingRequest(httpSession); + RequestStorage.removePendingRequest(protocolRequests, protocolRequestID); boolean isSSOSession = AuthenticationSessionStoreage.isSSOSession(moasessionID); @@ -331,7 +437,7 @@ public class DispatcherServlet extends AuthServlet{ authmanager.logout(req, resp, moasessionID); } - ConfigurationDBUtils.closeSession(); +// ConfigurationDBUtils.closeSession(); //authmanager.logout(req, resp); @@ -345,7 +451,7 @@ public class DispatcherServlet extends AuthServlet{ } catch (WrongParametersException ex) { handleWrongParameters(ex, req, resp); } catch (MOAIDException ex) { - handleError(null, ex, req, resp); + handleError(null, ex, req, resp, protocolRequestID); } catch (Throwable e) { e.printStackTrace(); resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java index b6742fb9e..b9f0b2144 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/AuthenticationManager.java @@ -177,7 +177,7 @@ public class AuthenticationManager extends AuthServlet { } authSession.setAuthenticated(false); - HTTPSessionUtils.setHTTPSessionString(session, MOA_SESSION, null); // remove moa session from HTTP Session + //HTTPSessionUtils.setHTTPSessionString(session, MOA_SESSION, null); // remove moa session from HTTP Session AuthenticationSessionStoreage.destroySession(moaSessionID); @@ -230,7 +230,7 @@ public class AuthenticationManager extends AuthServlet { //parse request parameter into MOASession - StartAuthentificationParameterParser.parse(request, response, moasession); + StartAuthentificationParameterParser.parse(request, response, moasession, target); Logger.info("Start Authentication Module: " + moasession.getModul() + " Action: " + moasession.getAction()); @@ -245,7 +245,7 @@ public class AuthenticationManager extends AuthServlet { //store MOASession try { - AuthenticationSessionStoreage.storeSession(moasession); + AuthenticationSessionStoreage.storeSession(moasession, target.getRequestID()); } catch (MOADatabaseException e) { Logger.error("Database Error! MOASession is not stored!"); throw new MOAIDException("init.04", new Object[] { @@ -284,11 +284,11 @@ public class AuthenticationManager extends AuthServlet { String loginForm = LoginFormBuilder.buildLoginForm(target.requestedModule(), - target.requestedAction(), oaParam.getFriendlyName(), request.getContextPath(), oaParam.useIFrame()); + target.requestedAction(), oaParam.getFriendlyName(), request.getContextPath(), oaParam.useIFrame(), moasession.getSessionID()); //store MOASession try { - AuthenticationSessionStoreage.storeSession(moasession); + AuthenticationSessionStoreage.storeSession(moasession, target.getRequestID()); } catch (MOADatabaseException e) { Logger.error("Database Error! MOASession is not stored!"); throw new MOAIDException("init.04", new Object[] { @@ -310,7 +310,7 @@ public class AuthenticationManager extends AuthServlet { throws ServletException, IOException, MOAIDException { String form = SendAssertionFormBuilder.buildForm(target.requestedModule(), - target.requestedAction(), oaParam.getFriendlyName(), request.getContextPath(), oaParam.useIFrame()); + target.requestedAction(), target.getRequestID(), oaParam.getFriendlyName(), request.getContextPath(), oaParam.useIFrame()); response.setContentType("text/html;charset=UTF-8"); PrintWriter out = new PrintWriter(response.getOutputStream()); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/IRequest.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/IRequest.java index f63b0049f..824b210cf 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/IRequest.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/IRequest.java @@ -10,6 +10,8 @@ public interface IRequest { public void setModule(String module); public void setAction(String action); public String getTarget(); + public void setRequestID(String id); + public String getRequestID(); //public void setTarget(); } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/ModulUtils.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/ModulUtils.java index 9ce835c7e..b07695938 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/ModulUtils.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/ModulUtils.java @@ -8,15 +8,17 @@ public class ModulUtils { public static final String UNAUTHDISPATCHER = "dispatcher"; public static final String AUTHDISPATCHER = "dispatcher"; - public static String buildUnauthURL(String modul, String action) { + public static String buildUnauthURL(String modul, String action, String pendingRequestID) { return UNAUTHDISPATCHER + "?" + DispatcherServlet.PARAM_TARGET_MODULE + "=" + modul + "&" + - DispatcherServlet.PARAM_TARGET_ACTION + "=" + action; + DispatcherServlet.PARAM_TARGET_ACTION + "=" + action + "&" + + DispatcherServlet.PARAM_TARGET_PENDINGREQUESTID + "=" + pendingRequestID; } - public static String buildAuthURL(String modul, String action) { + public static String buildAuthURL(String modul, String action, String pendingRequestID) { return AUTHDISPATCHER + "?" + DispatcherServlet.PARAM_TARGET_MODULE + "=" + modul + "&" + - DispatcherServlet.PARAM_TARGET_ACTION + "=" + action; + DispatcherServlet.PARAM_TARGET_ACTION + "=" + action + "&" + + DispatcherServlet.PARAM_TARGET_PENDINGREQUESTID + "=" + pendingRequestID; } } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestImpl.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestImpl.java index 29f9ff69b..420f11622 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestImpl.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestImpl.java @@ -9,6 +9,7 @@ public class RequestImpl implements IRequest { private String module = null; private String action = null; private String target = null; + private String requestID; public void setOAURL(String value) { @@ -66,4 +67,13 @@ public class RequestImpl implements IRequest { public void setTarget(String target) { this.target = target; } + + public void setRequestID(String id) { + this.requestID = id; + + } + + public String getRequestID() { + return requestID; + } } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestStorage.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestStorage.java index 4e7d8d2ed..35481a0a1 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestStorage.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/moduls/RequestStorage.java @@ -1,28 +1,65 @@ package at.gv.egovernment.moa.id.moduls; +import java.util.List; +import java.util.Map; + import javax.servlet.http.HttpSession; +import at.gv.egovernment.moa.logging.Logger; + public class RequestStorage { private static final String PENDING_REQUEST = "PENDING_REQUEST"; - public static IRequest getPendingRequest(HttpSession session) { - Object obj = session.getAttribute(PENDING_REQUEST); - if (obj != null) { - if (obj instanceof IRequest) { - return (IRequest) obj; - } else { + public static Map<String,IRequest> getPendingRequest(HttpSession session) { + + + Object obj = session.getAttribute(PENDING_REQUEST); + if (obj != null) { + synchronized (obj) { + if (obj instanceof Map<?,?>) { + if (((Map<?,?>) obj).size() > 0) { + if ( ((Map<?,?>) obj).keySet().toArray()[0] instanceof String) { + if (((Map<?,?>) obj).get(((Map<?,?>) obj).keySet().toArray()[0]) + instanceof IRequest) { + return (Map<String, IRequest>) obj; + + + + } + } + } + } + } session.setAttribute(PENDING_REQUEST, null); } - } - return null; + return null; } - public static void setPendingRequest(HttpSession session, IRequest request) { + public static void setPendingRequest(HttpSession session, Map<String, IRequest> request) { session.setAttribute(PENDING_REQUEST, request); } - public static void removePendingRequest(HttpSession session) { + public static void removeAllPendingRequests(HttpSession session) { session.setAttribute(PENDING_REQUEST, null); } + + public static void removePendingRequest(Map<String, IRequest> requestmap, String requestID) { + + if (requestmap != null && requestID != null) { + + synchronized (requestmap) { + + //Map<String, IRequest> requestmap = getPendingRequest(session); + + if (requestmap.containsKey(requestID)) { + requestmap.remove(requestID); + Logger.debug("Remove PendingRequest with ID " + requestID); + + } + + //setPendingRequest(session, requestmap); + } + } + } } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/storage/AuthenticationSessionStoreage.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/storage/AuthenticationSessionStoreage.java index da5556b30..1f71bf8bf 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/storage/AuthenticationSessionStoreage.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/storage/AuthenticationSessionStoreage.java @@ -107,11 +107,33 @@ public class AuthenticationSessionStoreage { } catch (MOADatabaseException e) { Logger.warn("MOASession could not be stored."); throw new MOADatabaseException(e); - } - + } + } + + public static void storeSession(AuthenticationSession session, String pendingRequestID) throws MOADatabaseException, BuildException { + try { + AuthenticatedSessionStore dbsession = searchInDatabase(session.getSessionID()); + dbsession.setPendingRequestID(pendingRequestID); + + dbsession.setAuthenticated(session.isAuthenticated()); + byte[] serialized = SerializationUtils.serialize(session); + + dbsession.setSession(SessionEncrytionUtil.encrypt(serialized)); + + //set Timestamp in this state, because automated timestamp generation is buggy in Hibernate 4.2.1 + dbsession.setUpdated(new Date()); + + MOASessionDBUtils.saveOrUpdate(dbsession); + Log.info("MOASession with sessionID=" + session.getSessionID() + " is stored in Database"); + + } catch (MOADatabaseException e) { + Logger.warn("MOASession could not be stored."); + throw new MOADatabaseException(e); + } } + public static void destroySession(String moaSessionID) throws MOADatabaseException { Session session = MOASessionDBUtils.getCurrentSession(); @@ -236,6 +258,7 @@ public class AuthenticationSessionStoreage { dbsession.setSSOSession(true); dbsession.setSSOsessionid(SSOSessionID); dbsession.setAuthenticated(false); + dbsession.setPendingRequestID(""); //Store MOASession session.saveOrUpdate(dbsession); @@ -365,7 +388,51 @@ public class AuthenticationSessionStoreage { } } + + public static boolean deleteSessionWithPendingRequestID(String id) { + MiscUtil.assertNotNull(id, "PendingRequestID"); + Logger.trace("Delete MOAsession with PendingRequestID " + id + " from database."); + Session session = MOASessionDBUtils.getCurrentSession(); + + List<AuthenticatedSessionStore> result; + + synchronized (session) { + session.beginTransaction(); + Query query = session.getNamedQuery("getSessionWithPendingRequestID"); + query.setString("sessionid", id); + result = query.list(); + + //send transaction + session.getTransaction().commit(); + } + + Logger.trace("Found entries: " + result.size()); + + //Assertion requires an unique artifact + if (result.size() != 1) { + Logger.trace("No entries found."); + return false; + + } else { + MOASessionDBUtils.delete(result.get(0)); + return true; + } + + } + + public static String getPendingRequestID(String sessionID) { + try { + AuthenticatedSessionStore dbsession = searchInDatabase(sessionID); + return dbsession.getPendingRequestID(); + + } catch (MOADatabaseException e) { + Logger.warn("MOASession with ID " + sessionID + " not found"); + return ""; + } + + } + public static void clean(long now, long authDataTimeOutCreated, long authDataTimeOutUpdated) { Date expioredatecreate = new Date(now - authDataTimeOutCreated); Date expioredateupdate = new Date(now - authDataTimeOutUpdated); |