1 files changed, 34 insertions, 10 deletions

diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASProtocol.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASProtocol.java
index aefae939b..589cd9654 100644
--- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASProtocol.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASProtocol.java
@@ -25,6 +25,8 @@ package at.gv.egovernment.moa.id.protocols.eidas;
 import java.io.IOException;
 import java.io.StringWriter;
 import java.util.List;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -213,6 +215,11 @@ public class EIDASProtocol extends AbstractAuthProtocolModulController {
 				
 			}
 			
+			//check eIDAS node configuration
+			IOAAuthParameters oaConfig = authConfig.getOnlineApplicationParameter(samlReq.getIssuer());
+			if (oaConfig == null)
+				throw new EIDASAuthnRequestProcessingException("eIDAS.08", new Object[]{samlReq.getIssuer()});
+			
 			//validate AssertionConsumerServiceURL against metadata 
 			EntityDescriptor eIDASNodeEntityDesc = new MOAeIDASMetadataProviderDecorator(eIDASMetadataProvider)
 						.getEntityDescriptor(eIDASSamlReq.getIssuer(), SAMLEngineUtils.getMetadataSigner());
@@ -258,8 +265,33 @@ public class EIDASProtocol extends AbstractAuthProtocolModulController {
 				
 			}		
 			
+			//validate request country-code against eIDAS node config
+			String reqCC = samlReq.getOriginCountryCode();
+			String eIDASTarget = oaConfig.getIdentityLinkDomainIdentifier();
+
+			//validate eIDAS target
+			Pattern pattern = Pattern.compile("^" + at.gv.egovernment.moa.util.Constants.URN_PREFIX_EIDAS 
+					+ "\\+[A-Z,a-z]{2}\\+[A-Z,a-z]{2}$");
+			Matcher matcher = pattern.matcher(eIDASTarget);						
+			if (MiscUtil.isEmpty(eIDASTarget) || !matcher.matches()) {
+				Logger.error("Configuration for eIDAS-node:" + samlReq.getIssuer() 
+					+ " contains wrong formated eIDAS target:" + eIDASTarget);
+				throw new MOAIDException("config.08", new Object[]{samlReq.getIssuer()});
+				
+			} else {
+				String[] splittedTarget = eIDASTarget.split("\\+");
+				if (!splittedTarget[2].equalsIgnoreCase(reqCC)) {
+					Logger.error("Configuration for eIDAS-node:" + samlReq.getIssuer() 
+						+ " Destination Country from request (" + reqCC 
+						+ ") does not match to configuration:" + eIDASTarget);
+					throw new MOAIDException("eIDAS.01", 
+							new Object[]{"Destination Country from request does not match to configuration"});
+					
+				}
+				Logger.debug("CountryCode from request matches eIDAS-node configuration target");
+			}
 			
-			
+						
 			//*************************************************
 			//*****  store eIDAS request information  *********
 			//*************************************************
@@ -269,10 +301,6 @@ public class EIDASProtocol extends AbstractAuthProtocolModulController {
 			// - memorize relaystate
 			String relayState = request.getParameter("RelayState");
 			pendingReq.setRemoteRelayState(relayState);
-
-			// - memorize country code of target country
-			pendingReq.setGenericDataToSession(
-					RequestImpl.eIDAS_GENERIC_REQ_DATA_COUNTRY, samlReq.getOriginCountryCode());
 			
 			//store level of assurance
 			pendingReq.setGenericDataToSession(RequestImpl.eIDAS_GENERIC_REQ_DATA_LEVELOFASSURENCE, 
@@ -288,10 +316,6 @@ public class EIDASProtocol extends AbstractAuthProtocolModulController {
 			pendingReq.setOAURL(samlReq.getIssuer());
 	
 			// - memorize OA config
-			IOAAuthParameters oaConfig = authConfig.getOnlineApplicationParameter(pendingReq.getOAURL());
-			if (oaConfig == null)
-				throw new EIDASAuthnRequestProcessingException("eIDAS.08", new Object[]{pendingReq.getOAURL()});
-			
 			pendingReq.setOnlineApplicationConfiguration(oaConfig);
 			
 			// - memorize service-provider type from eIDAS request
@@ -302,7 +326,7 @@ public class EIDASProtocol extends AbstractAuthProtocolModulController {
 			if (MiscUtil.isEmpty(spType))
 				spType = MetadataUtil.getSPTypeFromMetadata(eIDASNodeEntityDesc);
 							
-			if (MiscUtil.isEmpty(spType))
+			if (MiscUtil.isNotEmpty(spType))
 				Logger.debug("eIDAS request has SPType:" + spType);			
 			else
 				Logger.info("eIDAS request and eIDAS metadata contains NO 'SPType' element.");