From 9ec3da77a6ed558e23fc5b476b672e66e8a3248b Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Tue, 28 Jan 2020 10:36:46 +0100 Subject: fix wrong default configuration parameter that skips BKU selection --- .../conf/moa-id/SLTemplates/template_handyBKU.html | 33 +++++ .../conf/moa-id/SLTemplates/template_localBKU.html | 25 ++++ .../conf/moa-id/SLTemplates/template_thirdBKU.html | 32 ++++ .../deploy/conf/moa-id/eIDAS/EncryptModule.xml | 40 +++++ .../deploy/conf/moa-id/eIDAS/SamlEngine_basics.xml | 98 +++++++++++++ .../data/deploy/conf/moa-id/eIDAS/SignModule.xml | 48 ++++++ .../deploy/conf/moa-id/eIDAS/encryptionConf.xml | 14 ++ .../data/deploy/conf/moa-id/moa-id.properties | 1 + .../transforms/TransformsInfoAuthBlockTable_DE.xml | 161 +++++++++++++++++++++ .../TransformsInfoAuthBlockTable_DE_2.0.xml | 7 + .../TransformsInfoAuthBlockTable_DE_3.0.xml | 7 + .../transforms/TransformsInfoAuthBlockTable_EN.xml | 161 +++++++++++++++++++++ .../id/auth/modules/BKUSelectionModuleImpl.java | 2 +- .../PropertyBasedAuthConfigurationProvider.java | 2 +- 14 files changed, 629 insertions(+), 2 deletions(-) create mode 100644 id/server/data/deploy/conf/moa-id/SLTemplates/template_handyBKU.html create mode 100644 id/server/data/deploy/conf/moa-id/SLTemplates/template_localBKU.html create mode 100644 id/server/data/deploy/conf/moa-id/SLTemplates/template_thirdBKU.html create mode 100644 id/server/data/deploy/conf/moa-id/eIDAS/EncryptModule.xml create mode 100644 id/server/data/deploy/conf/moa-id/eIDAS/SamlEngine_basics.xml create mode 100644 id/server/data/deploy/conf/moa-id/eIDAS/SignModule.xml create mode 100644 id/server/data/deploy/conf/moa-id/eIDAS/encryptionConf.xml create mode 100644 id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE.xml create mode 100644 id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE_2.0.xml create mode 100644 id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE_3.0.xml create mode 100644 id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_EN.xml diff --git a/id/server/data/deploy/conf/moa-id/SLTemplates/template_handyBKU.html b/id/server/data/deploy/conf/moa-id/SLTemplates/template_handyBKU.html new file mode 100644 index 000000000..e62921efa --- /dev/null +++ b/id/server/data/deploy/conf/moa-id/SLTemplates/template_handyBKU.html @@ -0,0 +1,33 @@ + + + + + + + + + + + + + + \ No newline at end of file diff --git a/id/server/data/deploy/conf/moa-id/SLTemplates/template_localBKU.html b/id/server/data/deploy/conf/moa-id/SLTemplates/template_localBKU.html new file mode 100644 index 000000000..80d33ff85 --- /dev/null +++ b/id/server/data/deploy/conf/moa-id/SLTemplates/template_localBKU.html @@ -0,0 +1,25 @@ + + + + + + + + + + + + + + + diff --git a/id/server/data/deploy/conf/moa-id/SLTemplates/template_thirdBKU.html b/id/server/data/deploy/conf/moa-id/SLTemplates/template_thirdBKU.html new file mode 100644 index 000000000..928c9f17b --- /dev/null +++ b/id/server/data/deploy/conf/moa-id/SLTemplates/template_thirdBKU.html @@ -0,0 +1,32 @@ + + + + + + + + + + + + + + diff --git a/id/server/data/deploy/conf/moa-id/eIDAS/EncryptModule.xml b/id/server/data/deploy/conf/moa-id/eIDAS/EncryptModule.xml new file mode 100644 index 000000000..46052053a --- /dev/null +++ b/id/server/data/deploy/conf/moa-id/eIDAS/EncryptModule.xml @@ -0,0 +1,40 @@ + + + + + SWModule encrypt with JKS. + + false + false + false + + + http://www.w3.org/2009/xmlenc11#aes256-gcm + + + + http://www.w3.org/2009/xmlenc11#aes128-gcm; + http://www.w3.org/2009/xmlenc11#aes256-gcm; + http://www.w3.org/2009/xmlenc11#aes192-gcm + + + + http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p + + keys/eidasKeyStore.jks + JKS + local-demo + local-demo + + + eIDAS/encryptionConf.xml + + CN=local-demo-cert, OU=DIGIT, O=European Comission, L=Brussels, ST=Belgium,C=BE + 54C8F779 + + + CN=local-demo-cert, OU=DIGIT, O=European Comission, L=Brussels, ST=Belgium, C=BE + 54C8F779 + + + \ No newline at end of file diff --git a/id/server/data/deploy/conf/moa-id/eIDAS/SamlEngine_basics.xml b/id/server/data/deploy/conf/moa-id/eIDAS/SamlEngine_basics.xml new file mode 100644 index 000000000..2327fb0d8 --- /dev/null +++ b/id/server/data/deploy/conf/moa-id/eIDAS/SamlEngine_basics.xml @@ -0,0 +1,98 @@ + + + + + SAML constants for AuthnRequests and Responses. + + + unspecified + + obtained + + + entity + + + + HTTP-POST + + false + false + false + + + true + + + false + + + http://S-PEPS.gov.xx + + + http://C-PEPS.gov.xx + + + 300 + + + false + + + true + + + http://www.stork.gov.eu/1.0/eIdentifier + http://www.stork.gov.eu/1.0/givenName + http://www.stork.gov.eu/1.0/surname + http://www.stork.gov.eu/1.0/inheritedFamilyName + http://www.stork.gov.eu/1.0/adoptedFamilyName + http://www.stork.gov.eu/1.0/gender + http://www.stork.gov.eu/1.0/dateOfBirth + http://www.stork.gov.eu/1.0/countryCodeOfBirth + http://www.stork.gov.eu/1.0/nationalityCode + http://www.stork.gov.eu/1.0/maritalStatus + http://www.stork.gov.eu/1.0/textResidenceAddress + http://www.stork.gov.eu/1.0/canonicalResidenceAddress + http://www.stork.gov.eu/1.0/eMail + http://www.stork.gov.eu/1.0/title + http://www.stork.gov.eu/1.0/residencePermit + http://www.stork.gov.eu/1.0/pseudonym + http://www.stork.gov.eu/1.0/age + http://www.stork.gov.eu/1.0/isAgeOver + http://www.stork.gov.eu/1.0/signedDoc + http://www.stork.gov.eu/1.0/citizenQAALevel + http://www.stork.gov.eu/1.0/fiscalNumber + http://www.stork.gov.eu/1.0/unknown + + + + http://eidas.europa.eu/attributes/naturalperson/CurrentFamilyName + http://eidas.europa.eu/attributes/naturalperson/CurrentGivenName + http://eidas.europa.eu/attributes/naturalperson/DateOfBirth + http://eidas.europa.eu/attributes/naturalperson/PersonIdentifier + http://eidas.europa.eu/attributes/naturalperson/BirthName + http://eidas.europa.eu/attributes/naturalperson/PlaceOfBirth + http://eidas.europa.eu/attributes/naturalperson/CurrentAddress + http://eidas.europa.eu/attributes/naturalperson/Gender + + http://eidas.europa.eu/attributes/legalperson/LegalPersonIdentifier + http://eidas.europa.eu/attributes/legalperson/LegalAddress + http://eidas.europa.eu/attributes/legalperson/LegalName + http://eidas.europa.eu/attributes/legalperson/VATRegistration + http://eidas.europa.eu/attributes/legalperson/TaxReference + http://eidas.europa.eu/attributes/legalperson/D-2012-17-EUIdentifier + http://eidas.europa.eu/attributes/legalperson/LEI + http://eidas.europa.eu/attributes/legalperson/EORI + http://eidas.europa.eu/attributes/legalperson/SEED + http://eidas.europa.eu/attributes/legalperson/SIC + + \ No newline at end of file diff --git a/id/server/data/deploy/conf/moa-id/eIDAS/SignModule.xml b/id/server/data/deploy/conf/moa-id/eIDAS/SignModule.xml new file mode 100644 index 000000000..bf7215cb5 --- /dev/null +++ b/id/server/data/deploy/conf/moa-id/eIDAS/SignModule.xml @@ -0,0 +1,48 @@ + + + + + SWModule sign with JKS. + false + false + + + + + + http://www.w3.org/2001/04/xmldsig-more#rsa-sha512 + + + + http://www.w3.org/2001/04/xmldsig-more#rsa-sha256; + http://www.w3.org/2001/04/xmldsig-more#rsa-sha384; + http://www.w3.org/2001/04/xmldsig-more#rsa-sha512; + http://www.w3.org/2001/04/xmldsig-more#rsa-ripemd160; + http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256; + http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384; + http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512; + http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1; + http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-mgf1 + + + + true + + + keys/eidasKeyStore_Service_CB.jks + JKS + local-demo + local-demo + CN=cpeps-cb-demo-certificate, OU=STORK, O=CPEPS, L=EU, ST=EU, C=CB + 54C8F839 + + + + keys/eidasKeyStore_METADATA.jks + JKS + local-demo + local-demo + CN=metadata, OU=DIGIT, O=EC, L=Brussels, ST=EU, C=BE + 561BC0C8 + + diff --git a/id/server/data/deploy/conf/moa-id/eIDAS/encryptionConf.xml b/id/server/data/deploy/conf/moa-id/eIDAS/encryptionConf.xml new file mode 100644 index 000000000..ff8307f10 --- /dev/null +++ b/id/server/data/deploy/conf/moa-id/eIDAS/encryptionConf.xml @@ -0,0 +1,14 @@ + + + + false + + false + + false + + false + + false + + \ No newline at end of file diff --git a/id/server/data/deploy/conf/moa-id/moa-id.properties b/id/server/data/deploy/conf/moa-id/moa-id.properties index 926f6153b..beeab5375 100644 --- a/id/server/data/deploy/conf/moa-id/moa-id.properties +++ b/id/server/data/deploy/conf/moa-id/moa-id.properties @@ -17,6 +17,7 @@ protocols.pvp2.schemavalidation=true configuration.moasession.key=SessionEncryptionKey configuration.moaconfig.key=ConfigurationEncryptionKey configuration.ssl.validation.revocation.method.order=ocsp,crl +general.moaidmode.active=true #configuration.ssl.validation.hostname=false #configuration.validate.authblock.targetfriendlyname=true< diff --git a/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE.xml b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE.xml new file mode 100644 index 000000000..1165d8b32 --- /dev/null +++ b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE.xml @@ -0,0 +1,161 @@ + + + + + + + + + Signatur der Anmeldedaten + + + +

Anmeldedaten:

Daten zur Person

+ + + + + + + + + + + + + + + + + + + + + + + + + +

Name:	+ +
Geburtsdatum:	+ + . + + . + +
Rolle:	+ +
Vollmacht:	+ Ich melde mich in Vertretung an. Im nächsten Schritt wird mir eine Liste der für mich verfügbaren Vertretungsverhältnisse angezeigt, aus denen ich eines auswählen werde. +

Daten zur Anwendung

+ + + + + + + + + +

Name:	+ +
Staat:	Österreich

Technische Parameter

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

URL:	+ +
Bereich:	+ +
+ Vollmachten-Referenz:	+ +
+ :	+ +
Identifikator:	+ + +
OID:	+ +
HPI:	+ +
Datum:	+ + . + + . + +
Uhrzeit:	+ + : + + : + +

+ + + + + + + + + application/xhtml+xml + + diff --git a/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE_2.0.xml b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE_2.0.xml new file mode 100644 index 000000000..e225ca6e0 --- /dev/null +++ b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE_2.0.xml @@ -0,0 +1,7 @@ +Signatur der Anmeldedaten

Anmeldedaten:

Daten zur Person

Name:
Geburtsdatum:	..
Rolle:
Vollmacht:	Ich melde mich in Vertretung an. Im nächsten Schritt wird mir eine Liste der für mich verfügbaren Vertretungsverhältnisse angezeigt, aus denen ich eines auswählen werde.

Daten zur Anwendung

Name:
Staat:	Österreich

Technische Parameter

URL:
Bereich:
+ Vollmachten-Referenz:
:
Identifikator:
OID:
HPI:
SessionTokken:
Datum:	..
Uhrzeit:	::

application/xhtml+xml \ No newline at end of file diff --git a/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE_3.0.xml b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE_3.0.xml new file mode 100644 index 000000000..6afe1f36b --- /dev/null +++ b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE_3.0.xml @@ -0,0 +1,7 @@ +Signatur der Anmeldedaten

Anmeldedaten:

Daten zur Person

Name:
Geburtsdatum:	..
Rolle:
Vollmacht:	Ich melde mich in Vertretung an. Im nächsten Schritt wird mir eine Liste der für mich verfügbaren Vertretungsverhältnisse angezeigt, aus denen ich eines auswählen werde.

Daten zur Anwendung

Name:
Staat:	Österreich (Test)Österreich (Test)BelgienSchweizTschechienEstlandSpanienFrankreichGriechenlandIslandItalienLitauenLuxemburgNiederlandePortugalSchwedenSlowenienSlowakeiTürkeiVereinigtes KönigreichAuslandÖsterreich

Technische Parameter

URL:
Bereich:
+ Vollmachten-Referenz:
:
Identifikator:
OID:
HPI:
SessionTokken:
Datum:	..
Uhrzeit:	::

application/xhtml+xml diff --git a/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_EN.xml b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_EN.xml new file mode 100644 index 000000000..e220b8f82 --- /dev/null +++ b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_EN.xml @@ -0,0 +1,161 @@ + + + + + + + + + Signing the authentication data + + + +

Authentication Data:

Personal Data

+ + + + + + + + + + + + + + + + + + + + + + + + + +

Name:	+ +
Date of Birth:	+ + . + + . + +
Role:	+ +
Mandate:	+ I log in as representative. In the next step a list of available mandates is shown. Here I select one mandate. +

Application Data

+ + + + + + + + + +

Name:	+ +
Country:	Austria

Technical Parameters

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

URL:	+ +
Sector:	+ +
+ Mandate Reference:	+ +
+ :	+ +
Identifier:	+ + +
OID:	+ +
HPI:	+ +
Date:	+ + . + + . + +
Time:	+ + : + + : + +

+ + + + + + + + + application/xhtml+xml + + diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/BKUSelectionModuleImpl.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/BKUSelectionModuleImpl.java index 6426e0e0c..8fba069cb 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/BKUSelectionModuleImpl.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/modules/BKUSelectionModuleImpl.java @@ -58,7 +58,7 @@ public class BKUSelectionModuleImpl implements AuthModule { performBKUSelection = (boolean) performBKUSelectionObj; if (performBKUSelection && configuration != null - && configuration.getBasicConfigurationBoolean(PropertyBasedAuthConfigurationProvider.PROP_MOAID_MODE, false)) + && configuration.getBasicConfigurationBoolean(PropertyBasedAuthConfigurationProvider.PROP_MOAID_MODE, true)) return "BKUSelectionProcess"; else diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java index eae7aae9d..f299e0e94 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java @@ -235,7 +235,7 @@ public class PropertyBasedAuthConfigurationProvider extends ConfigurationProvide allowedProtcols.setPVP21Active( configuration.getBooleanValue( MOAIDConfigurationConstants.GENERAL_PROTOCOLS_PVP2X_ENABLED, true) - && getBasicConfigurationBoolean(PROP_MOAID_MODE, false)); + && getBasicConfigurationBoolean(PROP_MOAID_MODE, true)); return allowedProtcols; -- cgit v1.2.3