1 files changed, 70 insertions, 6 deletions

diff --git a/id/server/modules/moa-id-module-sl20_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/sl20_auth/sl20/verifier/QualifiedeIDVerifier.java b/id/server/modules/moa-id-module-sl20_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/sl20_auth/sl20/verifier/QualifiedeIDVerifier.java
index d07d7a78a..a7253c2c6 100644
--- a/id/server/modules/moa-id-module-sl20_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/sl20_auth/sl20/verifier/QualifiedeIDVerifier.java
+++ b/id/server/modules/moa-id-module-sl20_authentication/src/main/java/at/gv/egovernment/moa/id/auth/modules/sl20_auth/sl20/verifier/QualifiedeIDVerifier.java
@@ -1,14 +1,22 @@
 package at.gv.egovernment.moa.id.auth.modules.sl20_auth.sl20.verifier;
 
+import java.io.ByteArrayInputStream;
 import java.io.IOException;
+import java.util.Arrays;
 import java.util.Date;
 import java.util.List;
 
 import org.jaxen.SimpleNamespaceContext;
+import org.opensaml.Configuration;
+import org.opensaml.DefaultBootstrap;
+import org.opensaml.saml2.core.Assertion;
+import org.opensaml.xml.XMLObject;
+import org.opensaml.xml.io.Unmarshaller;
+import org.opensaml.xml.io.UnmarshallerFactory;
 import org.w3c.dom.Element;
+import org.xml.sax.SAXException;
 
 import at.gv.egovernment.moa.id.auth.builder.SignatureVerificationUtils;
-import at.gv.egovernment.moa.id.auth.exception.ValidateException;
 import at.gv.egovernment.moa.id.auth.invoke.SignatureVerificationInvoker;
 import at.gv.egovernment.moa.id.auth.modules.sl20_auth.exceptions.SL20eIDDataValidationException;
 import at.gv.egovernment.moa.id.auth.modules.sl20_auth.sl20.SL20Constants;
@@ -22,10 +30,12 @@ import at.gv.egovernment.moa.id.commons.api.data.IIdentityLink;
 import at.gv.egovernment.moa.id.commons.api.data.IVerifiyXMLSignatureResponse;
 import at.gv.egovernment.moa.id.commons.api.exceptions.MOAIDException;
 import at.gv.egovernment.moa.id.protocols.pvp2x.utils.AssertionAttributeExtractor;
+import at.gv.egovernment.moa.id.protocols.pvp2x.utils.SAML2Utils;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.sig.tsl.utils.MiscUtil;
 import at.gv.egovernment.moa.util.Base64Utils;
 import at.gv.egovernment.moa.util.Constants;
+import at.gv.egovernment.moa.util.DOMUtils;
 
 
 public class QualifiedeIDVerifier {
@@ -69,21 +79,22 @@ public class QualifiedeIDVerifier {
 			verifyXMLSignatureResponse,
 			authConfig.getIdentityLinkX509SubjectNames(),
 			VerifyXMLSignatureResponseValidator.CHECK_IDENTITY_LINK,
-			oaParam);
+			oaParam,
+			authConfig);
 
 				
 	}
 	
 	public static IVerifiyXMLSignatureResponse verifyAuthBlock(String authBlockB64, IOAAuthParameters oaParam, AuthConfiguration authConfig) throws MOAIDException, IOException {
 		String trustProfileId = authConfig.getMoaSpAuthBlockTrustProfileID(oaParam.isUseAuthBlockTestTestStore());
-		List<String> verifyTransformsInfoProfileID = null;
+		List<String> verifyTransformsInfoProfileID = Arrays.asList("SL20Authblock_v1.0");
 		
 		SignatureVerificationUtils sigVerify = new SignatureVerificationUtils();
 		IVerifiyXMLSignatureResponse sigVerifyResult = sigVerify.verify(Base64Utils.decode(authBlockB64, false), trustProfileId , verifyTransformsInfoProfileID);
 						
 		// validates the <VerifyXMLSignatureResponse>
 		VerifyXMLSignatureResponseValidator.getInstance().validate(sigVerifyResult,
-					null, VerifyXMLSignatureResponseValidator.CHECK_AUTH_BLOCK, oaParam);
+					null, VerifyXMLSignatureResponseValidator.CHECK_AUTH_BLOCK, oaParam, authConfig);
 
 		return sigVerifyResult;
 				
@@ -120,7 +131,7 @@ public class QualifiedeIDVerifier {
 			// date and time
 			validateSigningDateTime(sigVerifyResult, authBlockExtractor);
 			
-		} catch ( ValidateException e) {
+		} catch ( Exception e) {
 			Logger.warn("Validation of eID information FAILED. ", e);
 			throw new SL20eIDDataValidationException(new Object[] {
 					SL20Constants.SL20_COMMAND_PARAM_EID_RESULT_IDL,
@@ -134,6 +145,59 @@ public class QualifiedeIDVerifier {
 		
 	}
 	
+	public static Assertion parseAuthBlockToSaml2Assertion(String authblockB64) throws SL20eIDDataValidationException {
+		try {
+			//parse authBlock into SAML2 Assertion
+			byte[] authBlockBytes = Base64Utils.decode(authblockB64, false);			
+			Element authBlockDOM = DOMUtils.parseXmlValidating(new ByteArrayInputStream(authBlockBytes));			
+				
+			//A-Trust workarounda
+//			Element authBlockDOM = DOMUtils.parseXmlValidating(new ByteArrayInputStream(authblockB64.getBytes()));
+//			Element authBlockDOM = DOMUtils.parseXmlNonValidating(new ByteArrayInputStream(authblockB64.getBytes()));
+			
+			DefaultBootstrap.bootstrap();
+			UnmarshallerFactory unmarshallerFactory = Configuration.getUnmarshallerFactory();
+			Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(authBlockDOM);			 
+			XMLObject samlAssertion = unmarshaller.unmarshall(authBlockDOM);
+			
+			//validate SAML2 Assertion
+			SAML2Utils.schemeValidation(samlAssertion);
+			
+			if (samlAssertion instanceof Assertion)			
+				return (Assertion) samlAssertion;			
+			else 
+				throw new SL20eIDDataValidationException(
+						new Object[] {
+							SL20Constants.SL20_COMMAND_PARAM_EID_RESULT_AUTHBLOCK,
+							"AuthBlock is NOT of type SAML2 Assertion"
+						});
+				
+		} catch (SL20eIDDataValidationException e) {
+			throw e;
+				
+		} catch (SAXException e) {
+			Logger.info("Scheme validation of SAML2 AuthBlock FAILED. Reason: " + e.getMessage());
+			throw new SL20eIDDataValidationException(
+					new Object[] {
+						SL20Constants.SL20_COMMAND_PARAM_EID_RESULT_AUTHBLOCK,
+						e.getMessage()
+					}, 
+					e);
+			
+		} catch (Exception e) {
+			Logger.info("Can not parse AuthBlock. Reason: " + e.getMessage());
+			Logger.trace("FullAuthBlock: " + authblockB64);
+			throw new SL20eIDDataValidationException(
+					new Object[] {
+						SL20Constants.SL20_COMMAND_PARAM_EID_RESULT_AUTHBLOCK,
+						e.getMessage()
+					}, 
+					e);
+		
+		}
+						
+	}
+	
 	private static void validateSigningDateTime( IVerifiyXMLSignatureResponse sigVerifyResult, AssertionAttributeExtractor authBlockExtractor) throws SL20eIDDataValidationException {
 		Date signingDate = sigVerifyResult.getSigningDateTime();
 		Date notBefore = authBlockExtractor.getAssertionNotBefore();
@@ -163,7 +227,7 @@ public class QualifiedeIDVerifier {
 				+ " NotBefore:" + notBefore.toString() 
 				+ " NotOrNotAfter:" + notOrNotAfter.toString());
 		
-		if (signingDate.after(notBefore) || signingDate.before(notOrNotAfter))
+		if (signingDate.after(notBefore) && signingDate.before(notOrNotAfter))
 			Logger.debug("Signing date validation successfull");
 		
 		else {