1 files changed, 30 insertions, 4 deletions

diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/eIDASAuthenticationRequest.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/eIDASAuthenticationRequest.java
index f0e7e918b..26a171ba8 100644
--- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/eIDASAuthenticationRequest.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/eIDASAuthenticationRequest.java
@@ -43,12 +43,14 @@ import at.gv.egovernment.moa.id.auth.frontend.velocity.VelocityProvider;
 import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
 import at.gv.egovernment.moa.id.auth.modules.eidas.engine.MOAeIDASChainingMetadataProvider;
 import at.gv.egovernment.moa.id.auth.modules.eidas.utils.SimpleEidasAttributeGenerator;
+import at.gv.egovernment.moa.id.auth.modules.eidas.utils.eIDASAttributeProcessingUtils;
 import at.gv.egovernment.moa.id.commons.MOAIDConstants;
 import at.gv.egovernment.moa.id.commons.api.IRequest;
 import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.data.IAuthData;
 import at.gv.egovernment.moa.id.data.SLOInformationImpl;
 import at.gv.egovernment.moa.id.data.SLOInformationInterface;
+import at.gv.egovernment.moa.id.data.Trible;
 import at.gv.egovernment.moa.id.moduls.IAction;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.IAttributeGenerator;
 import at.gv.egovernment.moa.id.protocols.builder.attributes.MandateLegalPersonFullNameAttributeBuilder;
@@ -121,12 +123,28 @@ public class eIDASAuthenticationRequest implements IAction {
 						newValue = authData.getBPK();
 						isUniqueID = true;
 						
+						//generate eIDAS conform 'PersonalIdentifier' attribute
+						if (!eIDASAttributeProcessingUtils.validateEidasPersonalIdentifier(newValue)) {
+							Logger.debug("preCalculated PersonalIdentifier does not include eIDAS conform prefixes ... add prefix now");
+							if (MiscUtil.isEmpty(authData.getBPKType())
+									|| !authData.getBPKType().startsWith(at.gv.egovernment.moa.util.Constants.URN_PREFIX_EIDAS)) {
+								Logger.error("BPKType is empty or does not start with eIDAS bPKType prefix! bPKType:" + authData.getBPKType());
+								throw new MOAIDException("builder.08", new Object[]{"Suspect bPKType for eIDAS identifier generation"});
+								
+							} 
+							
+							String prefix = authData.getBPKType().substring(at.gv.egovernment.moa.util.Constants.URN_PREFIX_EIDAS.length() + 1);
+							newValue = prefix.replaceAll("\\+", "/") + "/" + newValue;
+														
+						}
+												
 						//generate a transient unique identifier if it is requested
 						String reqNameIDFormat = eidasRequest.getEidasRequest().getNameIdFormat();
 						if (MiscUtil.isNotEmpty(reqNameIDFormat) 
 								&& reqNameIDFormat.equals(SamlNameIdFormat.TRANSIENT.getNameIdFormat()))
 							newValue = generateTransientNameID(newValue);
-																			
+
+												
 						subjectNameID = newValue;
 						break;
 					case Constants.eIDAS_ATTR_LEGALPERSONIDENTIFIER:
@@ -301,12 +319,20 @@ public class eIDASAuthenticationRequest implements IAction {
 
 
 	private String generateTransientNameID(String nameID) {
-		String random = Random.nextLongRandom();
+		//extract source-country and destination country from persistent identifier 
+		Trible<String, String, String> split = eIDASAttributeProcessingUtils.parseEidasPersonalIdentifier(nameID);
+		if (split == null) {
+			Logger.error("eIDAS 'PersonalIdentifier' has a wrong format. There had to be a ERROR in implementation!!!!");
+			throw new IllegalStateException("eIDAS 'PersonalIdentifier' has a wrong format. There had to be a ERROR in implementation!!!!");
+			
+		} 
 		
+		//build correct formated transient identifier
+		String random = Random.nextLongRandom();		
 		try {
 			MessageDigest md = MessageDigest.getInstance("SHA-1");
-			byte[] hash = md.digest((nameID + random).getBytes("ISO-8859-1"));			
-			return Base64Utils.encode(hash);
+			byte[] hash = md.digest((split.getThird() + random).getBytes("ISO-8859-1"));			
+			return split.getFirst() + "/" + split.getSecond() + "/" + Base64Utils.encode(hash);
 			
 		} catch (Exception e) {
 			Logger.error("Can not generate transient personal identifier!", e);