1 files changed, 28 insertions, 7 deletions

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
index 31100bfac..5c8e181a7 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java
@@ -34,7 +34,7 @@ import java.util.Timer;
 
 import javax.xml.namespace.QName;
 
-import org.apache.commons.httpclient.HttpClient;
+import org.apache.commons.httpclient.MOAHttpClient;
 import org.opensaml.saml2.metadata.EntitiesDescriptor;
 import org.opensaml.saml2.metadata.EntityDescriptor;
 import org.opensaml.saml2.metadata.RoleDescriptor;
@@ -47,11 +47,14 @@ import org.opensaml.xml.XMLObject;
 import org.opensaml.xml.parse.BasicParserPool;
 
 import at.gv.egovernment.moa.id.commons.db.ConfigurationDBRead;
+import at.gv.egovernment.moa.id.commons.db.dao.config.ChainingModeType;
 import at.gv.egovernment.moa.id.commons.db.dao.config.OAPVP2;
 import at.gv.egovernment.moa.id.commons.db.dao.config.OnlineApplication;
+import at.gv.egovernment.moa.id.commons.ex.MOAHttpProtocolSocketFactoryException;
+import at.gv.egovernment.moa.id.commons.utils.MOAHttpProtocolSocketFactory;
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider;
 import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.InterfederatedIDPPublicServiceFilter;
 import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.MetadataFilterChain;
-import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.MetadataSignatureFilter;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.MiscUtil;
 
@@ -328,10 +331,30 @@ public class MOAMetadataProvider implements MetadataProvider {
 	private HTTPMetadataProvider createNewHTTPMetaDataProvider(String metadataURL, byte[] certificate, String oaName, MetadataFilterChain filter) {
 		HTTPMetadataProvider httpProvider = null;
 		Timer timer= null;
-		
-		try {
+		MOAHttpClient httpClient = null;
+		try {			
+			httpClient = new MOAHttpClient();
+			
+			if (metadataURL.startsWith("https:")) {
+				try {
+					MOAHttpProtocolSocketFactory protoSocketFactory = new MOAHttpProtocolSocketFactory(
+							"MOAMetaDataProvider", 
+							AuthConfigurationProvider.getInstance().getCertstoreDirectory(), 
+							AuthConfigurationProvider.getInstance().getTrustedCACertificates(),
+							null,
+							ChainingModeType.fromValue(AuthConfigurationProvider.getInstance().getDefaultChainingMode()), 
+							AuthConfigurationProvider.getInstance().isTrustmanagerrevoationchecking());
+					
+					httpClient.setCustomSSLTrustStore(metadataURL, protoSocketFactory);
+
+				} catch (MOAHttpProtocolSocketFactoryException e) {
+					Logger.warn("MOA SSL-TrustStore can not initialized. Use default Java TrustStore.");
+					
+				}
+			}
+			
 			timer = new Timer();
-			httpProvider = new HTTPMetadataProvider(timer, new HttpClient(), 
+			httpProvider = new HTTPMetadataProvider(timer, httpClient, 
 					metadataURL);
 			httpProvider.setParserPool(new BasicParserPool());
 			httpProvider.setRequireValidMetadata(true);
@@ -339,8 +362,6 @@ public class MOAMetadataProvider implements MetadataProvider {
 			httpProvider.setMaxRefreshDelay(1000*60*60*24); //24 hours
 			//httpProvider.setRefreshDelayFactor(0.1F);
 			
-			// TODO: use proper SSL checking
-			
 			if (filter == null) {			
 				filter = new MetadataFilterChain(metadataURL, certificate);
 			}