1 files changed, 83 insertions, 0 deletions
diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/validation/MoaEidasConditionsValidator.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/validation/MoaEidasConditionsValidator.java
new file mode 100644
index 000000000..d9453322f
--- /dev/null
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/validation/MoaEidasConditionsValidator.java
@@ -0,0 +1,83 @@
+/*
+ * Copyright 2014 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+package at.gv.egovernment.moa.id.auth.modules.eidas.engine.validation;
+
+import org.joda.time.DateTime;
+import org.opensaml.saml2.core.Conditions;
+import org.opensaml.saml2.core.validator.ConditionsSpecValidator;
+import org.opensaml.xml.validation.ValidationException;
+
+import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * @author tlenz
+ *
+ * MOA-ID specific eIDAS Response Condition validator
+ * 
+ * This validator allows time jitter in 'notBefore' validation
+ *
+ */
+
+public class MoaEidasConditionsValidator extends ConditionsSpecValidator {
+
+	
+	
+    @Override
+    public void validate(Conditions conditions) throws ValidationException {
+        Logger.debug("conditions.getNotBefore() "+ conditions.getNotBefore());
+        Logger.debug("conditions.getNotOnOrAfter() "+ conditions.getNotOnOrAfter());
+        Logger.debug("dateTime.now() "+ DateTime.now());
+
+        super.validate(conditions);
+
+        if (conditions.getNotBefore() == null) {
+
+            throw new ValidationException("NotBefore is required.");
+        }
+
+        if (conditions.getNotBefore().minusMillis(Constants.CONFIG_PROPS_SKEWTIME).isAfterNow()) {
+            throw new ValidationException("Current time is before NotBefore condition");
+        }
+
+        if (conditions.getNotOnOrAfter() == null) {
+
+            throw new ValidationException("NotOnOrAfter is required.");
+        }
+        if (conditions.getNotOnOrAfter().isBeforeNow()) {
+
+            throw new ValidationException("Current time is after NotOnOrAfter condition");
+        }
+
+        if (conditions.getAudienceRestrictions() == null || conditions.getAudienceRestrictions().isEmpty()) {
+
+            throw new ValidationException("AudienceRestriction is required.");
+        }
+
+        if (conditions.getOneTimeUse() == null) {
+
+            throw new ValidationException("OneTimeUse is required.");
+        }
+
+    }
+}