Ein Fehler ist aufgetreten

Sie werden in kuürze zur Signatur der Anmeldedaten aufgefordert. Wenn sie diese +signieren, so werden sie zur Online-Anwendung weitergeleitet und angemeldet.

Spezifikationen

@@ -108,20 +107,24 @@ MOA ist eine Entwicklung des Bundesrechenzentrums BRZ in Zusammenarbeit mit A-Tr

E-Government
http://reference.e-government.gv.at

Security Layer Version 1.1
-http://www.buergerkarte.at/konzept/securitylayer/spezifikation/2002083

Bürgerkarte
+http://www.buergerkarte.at

Personenbindung Version 1.1
-http://www.buergerkarte.at/konzept/personenbindung/spezifikation/20020506

Security Layer Version 1.2
+http://www.buergerkarte.at/konzept/securitylayer/spezifikation/aktuell/

+ +

Personenbindung Version 1.2.2
+http://www.buergerkarte.at/konzept/personenbindung/spezifikation/aktuell/

Security Assertion Markup Language
http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=security

Auswahl von Bürgerkartenumgebungen Version 1.0.0
-bku-auswahl.20030408.pdf

- - + + + + + + @@ -131,7 +134,8 @@ MOA ist eine Entwicklung des Bundesrechenzentrums BRZ in Zusammenarbeit mit A-Tr

diff --git a/id/server/doc/moa_id/moa.htm b/id/server/doc/moa_id/moa.htm index 05a2d3007..d899dd94c 100644 --- a/id/server/doc/moa_id/moa.htm +++ b/id/server/doc/moa_id/moa.htm @@ -238,7 +238,7 @@ an den Benutzer weitergeleitet und die Anfragen des Benutzers an die OA weiterge

diff --git a/id/server/idserverlib/.classpath b/id/server/idserverlib/.classpath index 1c79cc393..f0e483a4a 100644 --- a/id/server/idserverlib/.classpath +++ b/id/server/idserverlib/.classpath @@ -1,9 +1,13 @@ - - - - - - - - - + + + + + + + + + + + + + diff --git a/id/server/idserverlib/.settings/org.eclipse.wst.common.component b/id/server/idserverlib/.settings/org.eclipse.wst.common.component index 554e24c0b..87b873d7b 100644 --- a/id/server/idserverlib/.settings/org.eclipse.wst.common.component +++ b/id/server/idserverlib/.settings/org.eclipse.wst.common.component @@ -1,8 +1,7 @@ - - - - - - - - + + + + + + + diff --git a/id/server/idserverlib/pom.xml b/id/server/idserverlib/pom.xml index c0f704522..45b46242e 100644 --- a/id/server/idserverlib/pom.xml +++ b/id/server/idserverlib/pom.xml @@ -2,14 +2,14 @@ MOA.id moa-id - 1.4.6 + 1.4.7 4.0.0 MOA.id.server moa-id-lib jar - 1.4.6 + 1.4.7 MOA ID API @@ -117,10 +117,10 @@ regexp regexp - + at.gv.egovernment.moa.id mandate-validate diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java index 971fbcef2..fcaa4f053 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java @@ -19,7 +19,6 @@ import iaik.pki.PKIException; import iaik.x509.X509Certificate; import java.io.File; -import java.io.FileOutputStream; import java.io.IOException; import java.security.GeneralSecurityException; import java.util.Calendar; @@ -34,7 +33,6 @@ import java.util.Vector; import javax.xml.transform.TransformerException; -import org.apache.axis.AxisFault; import org.w3c.dom.Element; import at.gv.egovernment.moa.id.AuthenticationException; @@ -90,7 +88,6 @@ import at.gv.egovernment.moa.id.util.Random; import at.gv.egovernment.moa.id.util.SSLUtils; import at.gv.egovernment.moa.logging.LogMsg; import at.gv.egovernment.moa.logging.Logger; -import at.gv.egovernment.moa.spss.MOASystemException; import at.gv.egovernment.moa.util.Base64Utils; import at.gv.egovernment.moa.util.BoolUtils; import at.gv.egovernment.moa.util.Constants; @@ -176,9 +173,9 @@ public class AuthenticationServer implements MOAIDAuthConstants { if ((!authURL.startsWith("https:")) && (false == BoolUtils.valueOf(boolStr))) throw new AuthenticationException("auth.07", new Object[] { authURL + "*" }); if (isEmpty(authURL)) - throw new WrongParametersException("StartAuthentication", "AuthURL"); + throw new WrongParametersException("StartAuthentication", "AuthURL", "auth.5"); if (isEmpty(oaURL)) - throw new WrongParametersException("StartAuthentication", PARAM_OA); + throw new WrongParametersException("StartAuthentication", PARAM_OA, "auth.5"); ConnectionParameter bkuConnParam = AuthConfigurationProvider.getInstance().getBKUConnectionParameter(); @@ -193,7 +190,7 @@ public class AuthenticationServer implements MOAIDAuthConstants { if (!oaParam.getBusinessService()) { if (isEmpty(target)) - throw new WrongParametersException("StartAuthentication", PARAM_TARGET); + throw new WrongParametersException("StartAuthentication", PARAM_TARGET, "auth.5"); } else { if (!isEmpty(target)) { Logger.info("Ignoring target parameter thus application type is \"businessService\""); @@ -220,7 +217,7 @@ public class AuthenticationServer implements MOAIDAuthConstants { // bkuSelectionType==HTMLSelect String bkuSelectTag; try { - bkuSelectTag = readBKUSelectTag(AuthConfigurationProvider.getInstance(), bkuConnParam); + bkuSelectTag = readBKUSelectTag(AuthConfigurationProvider.getInstance(), bkuConnParam); } catch (Throwable ex) { throw new AuthenticationException( "auth.11", @@ -273,9 +270,9 @@ public class AuthenticationServer implements MOAIDAuthConstants { *

Creates an HTML form for querying the identity link from the * security layer implementation. *
Form parameters include - *

the <InfoboxReadRequest>
the data URL where the security layer implementation sends it response to
the data URL where the security layer implementation sends it response to

* @param authURL URL of the servlet to be used as data URL @@ -302,7 +299,7 @@ public class AuthenticationServer implements MOAIDAuthConstants { if (isEmpty(sessionID)) { if (isEmpty(authURL)) - throw new WrongParametersException("StartAuthentication", "AuthURL"); + throw new WrongParametersException("StartAuthentication", "AuthURL", "auth.5"); //check if HTTP Connection may be allowed (through FRONTEND_SERVLETS_ENABLE_HTTP_CONNECTION_PROPERTY) String boolStr = @@ -311,7 +308,7 @@ public class AuthenticationServer implements MOAIDAuthConstants { if ((!authURL.startsWith("https:")) && (false == BoolUtils.valueOf(boolStr))) throw new AuthenticationException("auth.07", new Object[] { authURL + "*" }); if (isEmpty(oaURL)) - throw new WrongParametersException("StartAuthentication", PARAM_OA); + throw new WrongParametersException("StartAuthentication", PARAM_OA, "auth.5"); } AuthenticationSession session; OAAuthParameter oaParam; @@ -327,7 +324,7 @@ public class AuthenticationServer implements MOAIDAuthConstants { throw new AuthenticationException("auth.00", new Object[] { oaURL }); if (!oaParam.getBusinessService()) { if (isEmpty(target)) - throw new WrongParametersException("StartAuthentication", PARAM_TARGET); + throw new WrongParametersException("StartAuthentication", PARAM_TARGET, "auth.5"); } else { target = null; } @@ -411,8 +408,8 @@ public class AuthenticationServer implements MOAIDAuthConstants { *

Verifies all additional infoboxes returned from the BKU

Creates an authentication block to be signed by the user

Creates and returns a <CreateXMLSignatureRequest> - * containg the authentication block, meant to be returned to the - * security layer implementation

+ * containg the authentication block, meant to be returned to the + * security layer implementation * * * @param sessionID ID of associated authentication session data @@ -441,6 +438,23 @@ public class AuthenticationServer implements MOAIDAuthConstants { throw new AuthenticationException("auth.01", new Object[] { sessionID }); session.setTimestampIdentityLink(); AuthConfigurationProvider authConf = AuthConfigurationProvider.getInstance(); + + // check if an identity link was found + // Errorcode 2911 von Trustdesk BKU (nicht spezifikationskonform (SL1.2)) + CharSequence se = "ErrorCode>2911".substring(0); + boolean b = xmlInfoboxReadResponse.contains(se); + if (b) { // no identity link found + Logger.info("Es konnte keine Personenbindung auf der Karte gefunden werden. Versuche Anmeldung als ausl�ndische eID."); + return null; + } + // spezifikationsgem��er (SL1.2) Errorcode + se = "ErrorCode>4002"; + b = xmlInfoboxReadResponse.contains(se); + if (b) { // Unbekannter Infoboxbezeichner + Logger.info("Unbekannter Infoboxbezeichner. Versuche Anmeldung als ausl�ndische eID."); + return null; + } + // parses the IdentityLink identityLink = new InfoboxReadResponseParser(xmlInfoboxReadResponse).parseIdentityLink(); @@ -495,6 +509,18 @@ public class AuthenticationServer implements MOAIDAuthConstants { if (authConf==null) authConf = AuthConfigurationProvider.getInstance(); if (oaParam==null) oaParam = AuthConfigurationProvider.getInstance(). getOnlineApplicationParameter(session.getPublicOAURLPrefix()); + + //BZ.., calculate bPK for signing to be already present in AuthBlock + IdentityLink identityLink = session.getIdentityLink(); + if (identityLink.getIdentificationType().equals(Constants.URN_PREFIX_BASEID)) { + // only compute bPK if online application is a public service and we have the Stammzahl + String bpkBase64 = new BPKBuilder().buildBPK( + identityLink.getIdentificationValue(), + session.getTarget()); + identityLink.setIdentificationValue(bpkBase64); + } + //..BZ + // builds the AUTH-block String authBlock = buildAuthenticationBlock(session); @@ -513,6 +539,186 @@ public class AuthenticationServer implements MOAIDAuthConstants { return createXMLSignatureRequest; } + /** + * Returns a CreateXMLSignatureRequest for the foreign ID.
+ * + * @param sessionID ID of associated authentication session data + * @param infoboxReadResponseParameters The parameters from the response returned from + * the BKU + * @param cert The certificate of the foreign ID + * @return String representation of the <CreateXMLSignatureRequest> + */ + public String getCreateXMLSignatureRequestForeignID(String sessionID, Map infoboxReadResponseParameters, X509Certificate cert) + throws + AuthenticationException, + BuildException, + ParseException, + ConfigurationException, + ValidateException, + ServiceException { + + if (isEmpty(sessionID)) + throw new AuthenticationException("auth.10", new Object[] { REQ_VERIFY_IDENTITY_LINK, PARAM_SESSIONID}); + + + AuthenticationSession session = getSession(sessionID); + AuthConfigurationProvider authConf = AuthConfigurationProvider.getInstance(); + + OAAuthParameter oaParam = + AuthConfigurationProvider.getInstance().getOnlineApplicationParameter( + session.getPublicOAURLPrefix()); + + + return getCreateXMLSignatureRequestForeignID(session, authConf, oaParam); + } + + public String getCreateXMLSignatureRequestForeignID(AuthenticationSession session, AuthConfigurationProvider authConf, OAAuthParameter oaParam) + throws + ConfigurationException, + BuildException, + ValidateException { + + + if (authConf==null) authConf = AuthConfigurationProvider.getInstance(); + if (oaParam==null) oaParam = AuthConfigurationProvider.getInstance(). + getOnlineApplicationParameter(session.getPublicOAURLPrefix()); + + //BZ.., calculate bPK for signing to be already present in AuthBlock +// IdentityLink identityLink = session.getIdentityLink(); +// if (identityLink.getIdentificationType().equals(Constants.URN_PREFIX_BASEID)) { +// // only compute bPK if online application is a public service and we have the Stammzahl +// String bpkBase64 = new BPKBuilder().buildBPK( +// identityLink.getIdentificationValue(), +// session.getTarget()); +// identityLink.setIdentificationValue(bpkBase64); +// } + //..BZ + + + // builds the AUTH-block + String authBlock = buildAuthenticationBlock(session); +// session.setAuthBlock(authBlock); + // builds the + String[] transformsInfos = oaParam.getTransformsInfos(); + if ((transformsInfos == null) || (transformsInfos.length == 0)) { + // no OA specific transforms specified, use default ones + transformsInfos = authConf.getTransformsInfos(); + } + String createXMLSignatureRequest = + new CreateXMLSignatureRequestBuilder().build(authBlock, + oaParam.getKeyBoxIdentifier(), + transformsInfos, + oaParam.getSlVersion12()); + return createXMLSignatureRequest; +} + + /** + * Processes an <CreateXMLSignatureResponse> sent by the + * security layer implementation.
+ *

Validates given <CreateXMLSignatureResponse>
Parses response enclosed in <CreateXMLSignatureResponse>
Verifies signature by calling the MOA SP component
Returns the signer certificate

+ * + * @param sessionID ID of associated authentication session data + * @param createXMLSignatureResponseParameters The parameters from the response returned from + * the BKU including the <CreateXMLSignatureResponse> + */ + public X509Certificate verifyXMLSignature(String sessionID, Map createXMLSignatureResponseParameters) + throws + AuthenticationException, + BuildException, + ParseException, + ConfigurationException, + ValidateException, + ServiceException { + + + if (isEmpty(sessionID)) + throw new AuthenticationException("auth.10", new Object[] { REQ_GET_FOREIGN_ID, PARAM_SESSIONID}); + + + String xmlCreateXMLSignatureResponse = (String)createXMLSignatureResponseParameters.get(PARAM_XMLRESPONSE); + + System.out.println(xmlCreateXMLSignatureResponse); + + if (isEmpty(xmlCreateXMLSignatureResponse)) + throw new AuthenticationException("auth.10", new Object[] { REQ_GET_FOREIGN_ID, PARAM_XMLRESPONSE}); + + AuthenticationSession session = getSession(sessionID); + /*if (session.getTimestampIdentityLink() != null) + throw new AuthenticationException("auth.01", new Object[] { sessionID });*/ + //session.setTimestampIdentityLink(); + AuthConfigurationProvider authConf = AuthConfigurationProvider.getInstance(); + + + // parses the + CreateXMLSignatureResponseParser p = new CreateXMLSignatureResponseParser(xmlCreateXMLSignatureResponse); + CreateXMLSignatureResponse createXMLSignatureResponse = p.parseResponseDsig(); + + // builds a for a call of MOA-SP + Element domVerifyXMLSignatureRequest = + new VerifyXMLSignatureRequestBuilder().buildDsig( + createXMLSignatureResponse, authConf.getMoaSpAuthBlockTrustProfileID()); + + // invokes the call + Element domVerifyXMLSignatureResponse = + new SignatureVerificationInvoker().verifyXMLSignature(domVerifyXMLSignatureRequest); + + // parses the + VerifyXMLSignatureResponse verifyXMLSignatureResponse = + new VerifyXMLSignatureResponseParser(domVerifyXMLSignatureResponse).parseData(); + + + //int code = verifyXMLSignatureResponse.getSignatureCheckCode(); + + return verifyXMLSignatureResponse.getX509certificate(); + + } + + /** + * Processes an <CreateXMLSignatureResponse> sent by the + * security layer implementation.
+ *

Validates given <CreateXMLSignatureResponse>
Parses response enclosed in <CreateXMLSignatureResponse>
Verifies signature by calling the MOA SP component
Returns the signer certificate

+ * + * @param sessionID ID of associated authentication session data + * @param readInfoboxResponseParameters The parameters from the response returned from + * the BKU including the <ReadInfoboxResponse> + */ + public X509Certificate getCertificate(String sessionID, Map readInfoboxResponseParameters) + throws + AuthenticationException, + BuildException, + ParseException, + ConfigurationException, + ValidateException, + ServiceException { + + + if (isEmpty(sessionID)) + throw new AuthenticationException("auth.10", new Object[] { REQ_VERIFY_CERTIFICATE, PARAM_SESSIONID}); + + + String xmlReadInfoboxResponse = (String)readInfoboxResponseParameters.get(PARAM_XMLRESPONSE); + + if (isEmpty(xmlReadInfoboxResponse)) + throw new AuthenticationException("auth.10", new Object[] { REQ_VERIFY_CERTIFICATE, PARAM_XMLRESPONSE}); + + // parses the + InfoboxReadResponseParser p = new InfoboxReadResponseParser(xmlReadInfoboxResponse); + X509Certificate cert = p.parseCertificate(); + + return cert; + + } + /** * Builds an authentication block <saml:Assertion> from given session data. * @param session authentication session @@ -523,16 +729,19 @@ public class AuthenticationServer implements MOAIDAuthConstants { * to be appended to the AUTH-Block. */ private String buildAuthenticationBlock(AuthenticationSession session) throws BuildException { - IdentityLink identityLink = session.getIdentityLink(); - String issuer = identityLink.getName(); - String gebDat = identityLink.getDateOfBirth(); - String identificationValue = identityLink.getIdentificationValue(); - String identificationType = identityLink.getIdentificationType(); - String issueInstant = DateTimeUtils.buildDateTime(Calendar.getInstance()); + IdentityLink identityLink = session.getIdentityLink(); + String issuer = identityLink.getName(); + String gebDat = identityLink.getDateOfBirth(); + String identificationValue = identityLink.getIdentificationValue(); + String identificationType = identityLink.getIdentificationType(); + + String issueInstant = DateTimeUtils.buildDateTime(Calendar.getInstance()); session.setIssueInstant(issueInstant); String authURL = session.getAuthURL(); String target = session.getTarget(); - String oaURL = session.getPublicOAURLPrefix(); + //Bug #485 (https://egovlabs.gv.at/tracker/index.php?func=detail&aid=485&group_id=6&atid=105) + //String oaURL = session.getPublicOAURLPrefix(); + String oaURL = session.getPublicOAURLPrefix().replaceAll("&", "&"); List extendedSAMLAttributes = session.getExtendedSAMLAttributesAUTH(); String authBlock = new AuthenticationBlockAssertionBuilder().buildAuthBlock( issuer, @@ -824,19 +1033,19 @@ public class AuthenticationServer implements MOAIDAuthConstants { *

Validates given <CreateXMLSignatureResponse>

Parses <CreateXMLSignatureResponse> for error codes

Parses authentication block enclosed in - * <CreateXMLSignatureResponse>

+ * <CreateXMLSignatureResponse> *

Verifies authentication block by calling the MOA SP component

Creates authentication data

Creates a corresponding SAML artifact

Stores authentication data in the authentication data store - * indexed by the SAML artifact

+ * indexed by the SAML artifact *

Deletes authentication session

Returns the SAML artifact, encoded BASE64

* * * @param sessionID session ID of the running authentication session * @param xmlCreateXMLSignatureReadResponse String representation of the - * <CreateXMLSignatureResponse> + * <CreateXMLSignatureResponse> * @return SAML artifact needed for retrieving authentication data, encoded BASE64 */ public String verifyAuthenticationBlock( @@ -851,9 +1060,9 @@ public class AuthenticationServer implements MOAIDAuthConstants { ValidateException { if (isEmpty(sessionID)) - throw new AuthenticationException("auth.10", new Object[] { REQ_VERIFY_AUTH_BLOCK, PARAM_SESSIONID}); + throw new AuthenticationException("auth.10", new Object[] { REQ_VERIFY_AUTH_BLOCK, PARAM_SESSIONID}); if (isEmpty(xmlCreateXMLSignatureReadResponse)) - throw new AuthenticationException("auth.10", new Object[] { REQ_VERIFY_AUTH_BLOCK, PARAM_XMLRESPONSE}); + throw new AuthenticationException("auth.10", new Object[] { REQ_VERIFY_AUTH_BLOCK, PARAM_XMLRESPONSE}); AuthenticationSession session = getSession(sessionID); AuthConfigurationProvider authConf = AuthConfigurationProvider.getInstance(); // parses @@ -874,11 +1083,11 @@ public class AuthenticationServer implements MOAIDAuthConstants { String tpid = authConf.getMoaSpAuthBlockTrustProfileID(); Element domVsreq = new VerifyXMLSignatureRequestBuilder().build(csresp, vtids, tpid); // debug output - + // invokes the call Element domVsresp = new SignatureVerificationInvoker().verifyXMLSignature(domVsreq); // debug output - + // parses the VerifyXMLSignatureResponse vsresp = new VerifyXMLSignatureResponseParser(domVsresp).parseData(); @@ -1015,6 +1224,150 @@ public class AuthenticationServer implements MOAIDAuthConstants { "Anmeldedaten zu MOASession " + sessionID + " angelegt, SAML Artifakt " + samlArtifact); return samlArtifact; } + + /** + * Gets the foreign authentication data.
+ *

Creates authentication data
Creates a corresponding SAML artifact
Stores authentication data in the authentication data store + * indexed by the SAML artifact
Deletes authentication session
Returns the SAML artifact, encoded BASE64

+ * + * @param sessionID session ID of the running authentication session + * @return SAML artifact needed for retrieving authentication data, encoded BASE64 + */ + public String getForeignAuthenticationData( + String sessionID) + throws + AuthenticationException, + BuildException, + ParseException, + ConfigurationException, + ServiceException, + ValidateException { + + if (isEmpty(sessionID)) + throw new AuthenticationException("auth.10", new Object[] { REQ_VERIFY_AUTH_BLOCK, PARAM_SESSIONID}); + + AuthenticationSession session = getSession(sessionID); + //AuthConfigurationProvider authConf = AuthConfigurationProvider.getInstance(); + try { + String serializedAssertion = DOMUtils.serializeNode(session.getIdentityLink().getSamlAssertion()); + session.setAuthBlock(serializedAssertion); + } catch (TransformerException e) { + throw new ParseException("parser.04", new Object[] { REQ_VERIFY_AUTH_BLOCK, PARAM_XMLRESPONSE}); + } catch (IOException e) { + throw new ParseException("parser.04", new Object[] { REQ_VERIFY_AUTH_BLOCK, PARAM_XMLRESPONSE}); + } + // post processing of the infoboxes + Iterator iter = session.getInfoboxValidatorIterator(); + boolean formpending = false; + if (iter != null) { + while (!formpending && iter.hasNext()) { + Vector infoboxValidatorVector = (Vector) iter.next(); + String identifier = (String) infoboxValidatorVector.get(0); + String friendlyName = (String) infoboxValidatorVector.get(1); + InfoboxValidator infoboxvalidator = (InfoboxValidator) infoboxValidatorVector.get(2); + InfoboxValidationResult infoboxValidationResult = null; + try { + infoboxValidationResult = infoboxvalidator.validate(session.getIdentityLink().getSamlAssertion()); + } catch (ValidateException e) { + Logger.error("Error validating " + identifier + " infobox:" + e.getMessage()); + throw new ValidateException( + "validator.44", new Object[] {friendlyName}); + } + if (!infoboxValidationResult.isValid()) { + Logger.info("Validation of " + identifier + " infobox failed."); + throw new ValidateException( + "validator.40", new Object[] {friendlyName, infoboxValidationResult.getErrorMessage()}); + } + String form = infoboxvalidator.getForm(); + if (ParepUtils.isEmpty(form)) { + AddAdditionalSAMLAttributes(session, infoboxValidationResult.getExtendedSamlAttributes(), identifier, friendlyName); + } else { + return "Redirect to Input Processor"; + } + } + } + + // Exchange person data information by a mandate if needed + List oaAttributes = session.getExtendedSAMLAttributesOA(); + IdentityLink replacementIdentityLink = null; + if (session.isMandateCompatibilityMode() && oaAttributes != null && oaAttributes.size()>0) { + // look if we have a mandate + boolean foundMandate = false; + Iterator it = oaAttributes.iterator(); + while (!foundMandate && it.hasNext()) { + ExtendedSAMLAttribute samlAttribute = (ExtendedSAMLAttribute)it.next(); + if (ParepValidator.EXT_SAML_MANDATE_RAW.equals(samlAttribute.getName())) { + Object value = samlAttribute.getValue(); + if (value instanceof Element) { + Element mandate = (Element) value; + replacementIdentityLink = new IdentityLink(); + Element mandator = ParepUtils.extractMandator(mandate); + String dateOfBirth = ""; + Element prPerson = null; + String familyName = ""; + String givenName = ""; + String identificationType = ""; + String identificationValue = ""; + if (mandator != null) { + boolean physical = ParepUtils.isPhysicalPerson(mandator); + if (physical) { + familyName = ParepUtils.extractText(mandator, "descendant-or-self::pr:Name/pr:FamilyName/text()"); + givenName = ParepUtils.extractText(mandator, "descendant-or-self::pr:Name/pr:GivenName/text()"); + dateOfBirth = ParepUtils.extractMandatorDateOfBirth(mandator); + } else { + familyName = ParepUtils.extractMandatorFullName(mandator); + } + identificationType = ParepUtils.getIdentification(mandator, "Type"); + identificationValue = ParepUtils.extractMandatorWbpk(mandator); + prPerson = ParepUtils.extractPrPersonOfMandate(mandate); + if (physical && session.getBusinessService() && identificationType!=null && Constants.URN_PREFIX_BASEID.equals(identificationType)) { + // now we calculate the wbPK and do so if we got it from the BKU + identificationType = Constants.URN_PREFIX_WBPK + "+" + session.getDomainIdentifier(); + identificationValue = new BPKBuilder().buildWBPK(identificationValue, session.getDomainIdentifier()); + ParepUtils.HideStammZahlen(prPerson, true, null, null, true); + } + + } + replacementIdentityLink.setDateOfBirth(dateOfBirth); + replacementIdentityLink.setFamilyName(familyName); + replacementIdentityLink.setGivenName(givenName); + replacementIdentityLink.setIdentificationType(identificationType); + replacementIdentityLink.setIdentificationValue(identificationValue); + replacementIdentityLink.setPrPerson(prPerson); + try { + replacementIdentityLink.setSamlAssertion(session.getIdentityLink().getSamlAssertion()); + } catch (Exception e) { + throw new ValidateException("validator.64", null); + } + } else { + Logger.info("The type of Mandate SAML-Attribute is not \"org.w3c.dom.Element\""); + throw new ValidateException("validator.64", null); + } + } + } + } + + VerifyXMLSignatureResponse vsresp = new VerifyXMLSignatureResponse(); + X509Certificate cert = session.getForeignSignerCertificate(); + vsresp.setX509certificate(cert); + AuthenticationData authData = buildAuthenticationData(session, vsresp, replacementIdentityLink); + String samlArtifact = + new SAMLArtifactBuilder().build(session.getAuthURL(), session.getSessionID()); + storeAuthenticationData(samlArtifact, authData); + + // invalidates the authentication session + sessionStore.remove(sessionID); + Logger.info( + "Anmeldedaten zu MOASession " + sessionID + " angelegt, SAML Artifakt " + samlArtifact); + return samlArtifact; + } + /** * Builds the AuthenticationData object together with the * corresponding <saml:Assertion> @@ -1076,13 +1429,17 @@ public class AuthenticationServer implements MOAIDAuthConstants { authData.setWBPK(identityLink.getIdentificationValue()); } else { authData.setBPK(identityLink.getIdentificationValue()); + + //BZ.., calculation of bPK already before sending AUTHBlock + /* if (identityLink.getIdentificationType().equals(Constants.URN_PREFIX_BASEID)) { // only compute bPK if online application is a public service and we have the Stammzahl String bpkBase64 = new BPKBuilder().buildBPK( identityLink.getIdentificationValue(), session.getTarget()); authData.setBPK(bpkBase64); - } + }*/ + } String ilAssertion = oaParam.getProvideIdentityLink() @@ -1186,7 +1543,7 @@ public class AuthenticationServer implements MOAIDAuthConstants { * @param id Session ID * @return AuthenticationSession created * @exception AuthenticationException - * thrown when an AuthenticationSession is running + * thrown when an AuthenticationSession is running * already for the given session ID */ private static AuthenticationSession newSession() throws AuthenticationException { diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthConstants.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthConstants.java index 5aa1bf45e..88859dc3f 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthConstants.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthConstants.java @@ -54,6 +54,10 @@ public interface MOAIDAuthConstants { public static final String REQ_START_AUTHENTICATION = "StartAuthentication"; /** Request name {@link at.gv.egovernment.moa.id.auth.servlet.VerifyIdentityLinkServlet} is mapped to */ public static final String REQ_VERIFY_IDENTITY_LINK = "VerifyIdentityLink"; + /** Request name {@link at.gv.egovernment.moa.id.auth.servlet.GetForeignIDServlet} is mapped to */ + public static final String REQ_GET_FOREIGN_ID = "GetForeignID"; + /** Request name {@link at.gv.egovernment.moa.id.auth.servlet.VerifyCertificateServlet} is mapped to */ + public static final String REQ_VERIFY_CERTIFICATE = "VerifyCertificate"; /** Request name {@link at.gv.egovernment.moa.id.auth.servlet.ProcessValidatorInputServlet} is mapped to */ public static final String REQ_PROCESS_VALIDATOR_INPUT = "ProcessInput"; /** Request name {@link at.gv.egovernment.moa.id.auth.servlet.VerifyAuthenticationBlockServlet} is mapped to */ diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/WrongParametersException.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/WrongParametersException.java index 398a6731d..f4827c189 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/WrongParametersException.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/WrongParametersException.java @@ -29,8 +29,10 @@ public class WrongParametersException extends MOAIDException { /** * Constructor */ - public WrongParametersException(String call, String parameter) { - super("auth.05", new Object[] {call, parameter}); + public WrongParametersException(String call, String parameter, String errorID) { + super(errorID, new Object[] {call, parameter}); + //super("auth.5", new Object[] {call, parameter}); + //super("auth.12", new Object[] {call, parameter}); } - + } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationBlockAssertionBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationBlockAssertionBuilder.java index f9d8e7091..d684c16c9 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationBlockAssertionBuilder.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationBlockAssertionBuilder.java @@ -18,11 +18,21 @@ package at.gv.egovernment.moa.id.auth.builder; import java.text.MessageFormat; import java.util.List; +import org.w3c.dom.Element; + import at.gv.egovernment.moa.id.BuildException; import at.gv.egovernment.moa.id.ParseException; import at.gv.egovernment.moa.id.auth.data.AuthenticationSession; +import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttribute; +import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttributeImpl; +import at.gv.egovernment.moa.id.config.ConfigurationException; +import at.gv.egovernment.moa.id.config.TargetToSectorNameMapper; +import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider; +import at.gv.egovernment.moa.id.config.auth.OAAuthParameter; import at.gv.egovernment.moa.logging.Logger; import at.gv.egovernment.moa.util.Constants; +import at.gv.egovernment.moa.util.DOMUtils; +import at.gv.egovernment.moa.util.StringUtils; /** * Builder for the authentication block <saml:Assertion> @@ -66,6 +76,13 @@ public class AuthenticationBlockAssertionBuilder extends AuthenticationAssertion " " + NL + " " + NL; + + private static String PR_IDENTIFICATION_ATTRIBUTE = + " " + NL + + " {0}" + NL + + " {1}" + NL + + " " + NL; + /** * The number of SAML attributes included in this AUTH-Block (without the extended SAML attributes). */ @@ -123,20 +140,72 @@ public class AuthenticationBlockAssertionBuilder extends AuthenticationAssertion session.setSAMLAttributeGebeORwbpk(true); String gebeORwbpk = ""; String wbpkNSDeclaration = ""; + + //BZ.., reading OA parameters + OAAuthParameter oaParam; + try { + oaParam = AuthConfigurationProvider.getInstance().getOnlineApplicationParameter( + session.getPublicOAURLPrefix()); + } catch (ConfigurationException e) { + Logger.error("Error on building AUTH-Block: " + e.getMessage()); + throw new BuildException("builder.00", new Object[] { "AUTH-Block", e.toString()}); + } + //..BZ + + if (target == null) { // OA is a business application if (!Constants.URN_PREFIX_HPI.equals(identityLinkType)) { - // Only add wbPKs to AUTH-Block. HPIs can be added to the AUTH-Block by the corresponding Validator - gebeORwbpk = MessageFormat.format(WBPK_ATTRIBUTE, new Object[] { identityLinkValue, identityLinkType }); - wbpkNSDeclaration = " xmlns:pr=\"" + PD_NS_URI + "\""; + // Only add wbPKs to AUTH-Block. HPIs can be added to the AUTH-Block by the corresponding Validator + gebeORwbpk = MessageFormat.format(WBPK_ATTRIBUTE, new Object[] { identityLinkValue, identityLinkType }); + wbpkNSDeclaration = " xmlns:pr=\"" + PD_NS_URI + "\""; + + //BZ.., adding type of wbPK domain identifier + ExtendedSAMLAttribute idLinkDomainIdentifierTypeAttribute = + new ExtendedSAMLAttributeImpl("IdentityLinkDomainIdentifierType", oaParam.getIdentityLinkDomainIdentifierType(), Constants.MOA_NS_URI, ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY); + + extendedSAMLAttributes.add(idLinkDomainIdentifierTypeAttribute); + //..BZ + } else { - // We do not have a wbPK, therefore no SAML-Attribute is provided - session.setSAMLAttributeGebeORwbpk(false); + // We do not have a wbPK, therefore no SAML-Attribute is provided + session.setSAMLAttributeGebeORwbpk(false); } } else { - gebeORwbpk = MessageFormat.format(GESCHAEFTS_BEREICH_ATTRIBUTE, new Object[] { target }); + // OA is a govermental application + //BZ.. + String sectorName = TargetToSectorNameMapper.getSectorNameViaTarget(target); + //gebeORwbpk = MessageFormat.format(GESCHAEFTS_BEREICH_ATTRIBUTE, new Object[] { target }); + gebeORwbpk = MessageFormat.format(GESCHAEFTS_BEREICH_ATTRIBUTE, new Object[] { target + " (" + sectorName + ")" }); + //..BZ + + //BZ.., no business service, adding bPK + + Element bpkSamlValueElement; + try { + bpkSamlValueElement = DOMUtils.parseDocument(MessageFormat.format(PR_IDENTIFICATION_ATTRIBUTE, new Object[] { identityLinkValue, Constants.URN_PREFIX_BPK }), false, null, null).getDocumentElement(); + } catch (Exception e) { + Logger.error("Error on building AUTH-Block: " + e.getMessage()); + throw new BuildException("builder.00", new Object[] { "AUTH-Block", e.toString()}); + } + ExtendedSAMLAttribute bpkAttribute = + new ExtendedSAMLAttributeImpl("bPK", bpkSamlValueElement, Constants.MOA_NS_URI, ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY); + + extendedSAMLAttributes.add(bpkAttribute); + //gebeORwbpk = gebeORwbpk + MessageFormat.format(BPK_ATTRIBUTE, new Object[] { identityLinkValue, identityLinkType }); + wbpkNSDeclaration = " xmlns:pr=\"" + PD_NS_URI + "\""; + //..BZ } + //BZ.., adding friendly name of OA + String oaFriendlyName = StringUtils.isEmpty(oaParam.getFriendlyName()) ? "" : oaParam.getFriendlyName(); + + ExtendedSAMLAttribute oaFriendlyNameAttribute = + new ExtendedSAMLAttributeImpl("oaFriendlyName", oaFriendlyName, Constants.MOA_NS_URI, ExtendedSAMLAttribute.ADD_TO_AUTHBLOCK_ONLY); + + extendedSAMLAttributes.add(oaFriendlyNameAttribute); + //..BZ + String assertion; try { assertion = MessageFormat.format( diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilderForeign.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilderForeign.java new file mode 100644 index 000000000..9227d5303 --- /dev/null +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilderForeign.java @@ -0,0 +1,126 @@ +package at.gv.egovernment.moa.id.auth.builder; + +import java.io.IOException; +import java.io.StringReader; +import java.io.StringWriter; + +import at.gv.egovernment.moa.id.BuildException; + + +/** + * Builder for CreateXMLSignatureRequest to sign data from a foreign + * eID card. + * + */ + +public class CreateXMLSignatureRequestBuilderForeign extends Builder { + + /** special tag in the XML template to be substituted for the KeyboxIdentifier */ + private static final String KEYBOXID_TAG = ""; + /** special tag in the XML template to be substituted for the content */ + private static final String XMLCONTENT_TAG = ""; + /** private static int all contains the representation to replace all tags*/ + private static final int ALL = -1; + + /** default HTML template */ + private static final String DEFAULT_XML_TEMPLATE = + "" + + "" + + "" + KEYBOXID_TAG + "" + + "" + + "" + + "" + XMLCONTENT_TAG + "" + + "" + + "" + + "" + + "text/plain" + + "" + + "" + + "" + + ""; + + /** default HTML template */ + private static final String DEFAULT_XHTML_TEMPLATE = + "" + + "" + + "" + KEYBOXID_TAG + "" + + "" + + "" + + "" + XMLCONTENT_TAG + "" + + "" + + "" + + "" + + "application/xhtml+xml" + + "" + + "" + + "" + + ""; + + /** + * Constructor for CreateXMLSignatureRequestBuilderForeign. + */ + public CreateXMLSignatureRequestBuilderForeign() { + super(); + } + /** + * Builds the XML request. + * + * @param xmlRequest XML Request to be sent as a parameter in the form + * @param bkuURL URL of the "Bürgerkartenumgebung" the form will be submitted to; + * may be null, in this case the default URL will be used + * @param dataURL DataURL to be sent as a parameter in the form + */ + public String build( + String keyboxIdentifier, + String xmlContent) + throws BuildException + { + String xmlRequest = DEFAULT_XHTML_TEMPLATE; + xmlRequest = replaceTag(xmlRequest, KEYBOXID_TAG, keyboxIdentifier, true, ALL); + //htmlForm = replaceTag(htmlForm, XMLREQUEST_TAG, encodeParameter(xmlRequest), true, ALL); + xmlRequest = replaceTag(xmlRequest, XMLCONTENT_TAG, xmlContent, true, ALL); + return xmlRequest; + } + /** + * Encodes a string for inclusion as a parameter in the form. + * Double quotes are substituted by """. + * @param s the string to be encoded + * @return the string encoded + * @throws BuildException on any exception encountered + */ + public static String encodeParameter(String s) throws BuildException { + StringReader in = new StringReader(s); + StringWriter out = new StringWriter(); + try { + for (int ch = in.read(); ch >= 0; ch = in.read()) { + if (ch == '"') + out.write("""); + else if (ch == '<') + out.write("<"); + else if (ch == '>') + out.write(">"); + else if (ch == '�') + out.write("ä"); + else if (ch == '�') + out.write("ö"); + else if (ch == '�') + out.write("ü"); + else if (ch == '�') + out.write("Ä"); + else if (ch == '�') + out.write("Ö"); + else if (ch == '�') + out.write("Ü"); + else if (ch == '�') + out.write("ß"); + else + out.write(ch); + } + } + catch (IOException ex) { + throw new BuildException("builder.00", new Object[] {"GetIdentityLinkForm", ex.toString()}); + } + return out.toString(); + } + +} diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/InfoboxReadRequestBuilderCertificate.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/InfoboxReadRequestBuilderCertificate.java new file mode 100644 index 000000000..60feb7d2f --- /dev/null +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/InfoboxReadRequestBuilderCertificate.java @@ -0,0 +1,94 @@ +/* +* Copyright 2003 Federal Chancellery Austria +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ +package at.gv.egovernment.moa.id.auth.builder; + +import at.gv.egovernment.moa.util.Constants; + +/** + * Builder for the <InfoboxReadRequest> structure + * used for requesting the identity link from the security layer implementation. + * + * @author Paul Ivancsics + * @version $Id: InfoboxReadRequestBuilder.java 1087 2008-08-28 07:55:59Z mcentner $ + */ +public class InfoboxReadRequestBuilderCertificate implements Constants { + + + /** + * Constructor for InfoboxReadRequestBuilder. + */ + public InfoboxReadRequestBuilderCertificate() { + } + + + /** + * Builds an <InfoboxReadRequest>. + * + * @param slVersion12 specifies whether the Security Layer version is + * version 1.2 or not + * @param businessService specifies whether the online application is a + * business service or not + * @param identityLinkDomainIdentifier the identification number of the business + * company; maybe null if the OA + * is a public service; must not be null + * if the OA is a business service + * + * @return <InfoboxReadRequest> as String + */ + public String build(boolean slVersion12) { + + String slPrefix; + String slNsDeclaration; + + if (slVersion12) { + slPrefix = SL12_PREFIX; + slNsDeclaration = SL12_NS_URI; + } else { + slPrefix = SL10_PREFIX; + slNsDeclaration = SL10_NS_URI; + } + + StringBuffer sb = new StringBuffer(""); + sb.append("<"); + sb.append(slPrefix); + sb.append(":InfoboxReadRequest xmlns:"); + sb.append(slPrefix); + sb.append("=\""); + sb.append(slNsDeclaration); + sb.append("\">"); + sb.append("<"); + sb.append(slPrefix); + sb.append(":InfoboxIdentifier>Certificates"); + sb.append("<"); + sb.append(slPrefix); + sb.append(":AssocArrayParameters>"); + sb.append("<"); + sb.append(slPrefix); + sb.append(":ReadValue Key=\"SecureSignatureKeypair\"/>"); + sb.append(""); + sb.append(""); + + return sb.toString(); + + } + +} diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/VerifyXMLSignatureRequestBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/VerifyXMLSignatureRequestBuilder.java index ffe4ad9b6..a14d0325f 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/VerifyXMLSignatureRequestBuilder.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/VerifyXMLSignatureRequestBuilder.java @@ -217,5 +217,67 @@ public class VerifyXMLSignatureRequestBuilder { return requestElem_; } + + /** + * Builds a <VerifyXMLSignatureRequest> + * from the signed data with a known trustProfileID which + * has to exist in MOA-SP + * @param csr - signed AUTH-Block + * @param trustProfileID - a preconfigured TrustProfile at MOA-SP + * @return Element - The complete request as Dom-Element + * @throws ParseException + */ + public Element buildDsig( + CreateXMLSignatureResponse csr, + String trustProfileID) + throws BuildException { //samlAssertionObject + + try { + // build the request +// requestElem_.setAttributeNS(Constants.XMLNS_NS_URI, "xmlns:" +// + Constants.XML_PREFIX, Constants.XMLNS_NS_URI); + + Element verifiySignatureInfoElem = + requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureInfo"); + requestElem_.appendChild(verifiySignatureInfoElem); + Element verifySignatureEnvironmentElem = + requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureEnvironment"); + verifiySignatureInfoElem.appendChild(verifySignatureEnvironmentElem); + + Element xmlContentElem = requestDoc_.createElementNS(MOA_NS_URI, "XMLContent"); + verifySignatureEnvironmentElem.appendChild(xmlContentElem); + xmlContentElem.setAttribute(Constants.XML_PREFIX + ":space", "preserve"); + + // insert the dsig:Signature + xmlContentElem.appendChild(requestDoc_.importNode(csr.getDsigSignature(), true)); + // specify the signature location + Element verifySignatureLocationElem = + requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureLocation"); + verifiySignatureInfoElem.appendChild(verifySignatureLocationElem); + Node signatureLocation = requestDoc_.createTextNode("/"+ DSIG + "Signature"); + verifySignatureLocationElem.appendChild(signatureLocation); + // signature manifest params + Element signatureManifestCheckParamsElem = + requestDoc_.createElementNS(MOA_NS_URI, "SignatureManifestCheckParams"); + requestElem_.appendChild(signatureManifestCheckParamsElem); + signatureManifestCheckParamsElem.setAttribute("ReturnReferenceInputData", "true"); + // add the transform profile IDs + Element referenceInfoElem = requestDoc_.createElementNS(MOA_NS_URI, "ReferenceInfo"); + signatureManifestCheckParamsElem.appendChild(referenceInfoElem); + + Element returnHashInputDataElem = + requestDoc_.createElementNS(MOA_NS_URI, "ReturnHashInputData"); + requestElem_.appendChild(returnHashInputDataElem); + Element trustProfileIDElem = requestDoc_.createElementNS(MOA_NS_URI, "TrustProfileID"); + + trustProfileIDElem.appendChild(requestDoc_.createTextNode(trustProfileID)); + requestElem_.appendChild(trustProfileIDElem); + + } catch (Throwable t) { + throw new BuildException("builder.00", new Object[] { "VerifyXMLSignatureRequest" }, t); + } + + return requestElem_; + } } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSession.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSession.java index 969e628f4..eca02a77b 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSession.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSession.java @@ -15,6 +15,8 @@ */ package at.gv.egovernment.moa.id.auth.data; +import iaik.x509.X509Certificate; + import java.util.ArrayList; import java.util.Date; import java.util.Iterator; @@ -87,7 +89,11 @@ public class AuthenticationSession { * service or not */ private boolean businessService; - + + /** + * Signer certificate of the foreign citizen + */ + private X509Certificate signerCertificate; /** * SAML attributes from an extended infobox validation to be appended * to the SAML assertion delivered to the final online application. @@ -149,6 +155,14 @@ public class AuthenticationSession { infoboxValidators = new ArrayList(); } + public X509Certificate getForeignSignerCertificate() { + return signerCertificate; + } + + public void setForeignSignerCertificate(X509Certificate signerCertificate) { + this.signerCertificate = signerCertificate; + } + /** * Returns the identityLink. * @return IdentityLink diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/CreateXMLSignatureResponse.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/CreateXMLSignatureResponse.java index 81dc2f736..fc3831161 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/CreateXMLSignatureResponse.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/CreateXMLSignatureResponse.java @@ -1,18 +1,3 @@ -/* -* Copyright 2003 Federal Chancellery Austria -* -* Licensed under the Apache License, Version 2.0 (the "License"); -* you may not use this file except in compliance with the License. -* You may obtain a copy of the License at -* -* http://www.apache.org/licenses/LICENSE-2.0 -* -* Unless required by applicable law or agreed to in writing, software -* distributed under the License is distributed on an "AS IS" BASIS, -* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -* See the License for the specific language governing permissions and -* limitations under the License. -*/ package at.gv.egovernment.moa.id.auth.data; import org.w3c.dom.Element; @@ -35,6 +20,11 @@ private SAMLAttribute[] samlAttributes; * the original saml:Assertion-Element */ private Element samlAssertion; + + /** + * the original dsig:Signature-Element + */ + private Element dsigSignature; /** * Returns the samlAssertion. * @return Element @@ -43,6 +33,14 @@ public Element getSamlAssertion() { return samlAssertion; } +/** + * Returns the dsig:Signature + * @return Element + */ +public Element getDsigSignature() { + return dsigSignature; +} + /** * Returns the samlAttribute. * @return SAMLAttribute[] @@ -67,6 +65,10 @@ public void setSamlAssertion(Element samlAssertion) { this.samlAssertion = samlAssertion; } +public void setDsigSignature(Element dsigSignature) { + this.dsigSignature = dsigSignature; +} + /** * Sets the samlAttribute. * @param samlAttributes The samlAttributes to set diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/CreateXMLSignatureResponseParser.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/CreateXMLSignatureResponseParser.java index 74bad617c..d5b6f9aa9 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/CreateXMLSignatureResponseParser.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/CreateXMLSignatureResponseParser.java @@ -21,6 +21,7 @@ import java.util.ArrayList; import java.util.List; import org.w3c.dom.Element; +import org.w3c.dom.NodeList; import org.w3c.dom.traversal.NodeIterator; import at.gv.egovernment.moa.id.AuthenticationException; @@ -129,6 +130,31 @@ public class CreateXMLSignatureResponseParser { throw new ParseException("parser.01", new Object[] { t.toString()}, t); } } + + /** + * Unmarshalls the <@link sigResponse> to an + * <CreateXMLSignatureResponse> object. + * + * @return a <CreateXMLSignatureResponse> object + * @throws ParseException + */ + + public CreateXMLSignatureResponse parseResponseDsig() throws ParseException { + CreateXMLSignatureResponse cResp; + try { + cResp = new CreateXMLSignatureResponse(); + + NodeList list = sigResponse_.getElementsByTagNameNS(Constants.DSIG_NS_URI, "Signature"); + Element dsigSignatureNode = (Element) list.item(0); + + Element dsigSignatureElement = (Element) dsigSignatureNode; + cResp.setDsigSignature(dsigSignatureElement); + } + catch (Throwable t) { + throw new ParseException("parser.01", new Object[] { t.toString()}, t); + } + return cResp; + } /** * Unmarshalls the <@link sigResponse> to an diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/InfoboxReadResponseParser.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/InfoboxReadResponseParser.java index 954488173..b53a1a2dc 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/InfoboxReadResponseParser.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/InfoboxReadResponseParser.java @@ -15,17 +15,31 @@ */ package at.gv.egovernment.moa.id.auth.parser; +import iaik.x509.X509Certificate; + import java.io.ByteArrayInputStream; import java.io.InputStream; +import java.security.cert.CertificateException; + +import javax.xml.parsers.DocumentBuilder; +import javax.xml.parsers.DocumentBuilderFactory; +import javax.xml.parsers.ParserConfigurationException; +import javax.xml.transform.TransformerException; + +import org.apache.axis.encoding.Base64; +import org.w3c.dom.Document; import org.w3c.dom.Element; import at.gv.egovernment.moa.id.AuthenticationException; import at.gv.egovernment.moa.id.ParseException; import at.gv.egovernment.moa.id.auth.data.IdentityLink; +import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWConstants; import at.gv.egovernment.moa.util.Constants; import at.gv.egovernment.moa.util.DOMUtils; import at.gv.egovernment.moa.util.XPathUtils; +import com.sun.org.apache.xpath.internal.XPathAPI; + /** * Parses an <InfoboxReadResponse>. * @@ -175,6 +189,43 @@ public class InfoboxReadResponseParser { IdentityLinkAssertionParser ilParser = new IdentityLinkAssertionParser(samlAssertion); return ilParser.parseIdentityLink(); } + + /** + * Returns the certificate given in the InfoboxReadResponse + * @return + * @throws ParseException + */ + public X509Certificate parseCertificate() throws ParseException { + try { + DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder(); + Document doc = builder.newDocument(); + + Element nameSpaceNode = doc.createElement("NameSpaceNode"); + nameSpaceNode.setAttribute("xmlns:" + Constants.PD_PREFIX, Constants.PD_NS_URI); + nameSpaceNode.setAttribute("xmlns:" + Constants.DSIG_PREFIX, Constants.DSIG_NS_URI); + nameSpaceNode.setAttribute("xmlns:" + Constants.SL12_PREFIX, Constants.SL12_NS_URI); + + Element base64ContentElement = (Element)XPathAPI.selectSingleNode(infoBoxElem_.getParentNode(), "//sl:Base64Content[1]", nameSpaceNode); + + if (base64ContentElement == null) { + throw new ParseException("parser.01", new Object[] { "Could not find Base64Content for X509Certificate."}); + } + + String base64Content = DOMUtils.getText(base64ContentElement); + + // Decode Base64 value to X509Certificate + byte[] content = Base64.decode(base64Content); + return new X509Certificate(content); + + } catch (ParserConfigurationException e) { + throw new ParseException("parser.01", new Object[] { "Could not parse X509Certificate from InfoboxReadRequest."}, e); + } catch (TransformerException e) { + throw new ParseException("parser.01", new Object[] { "Could not parse X509Certificate from InfoboxReadRequest."}, e); + } catch (CertificateException e) { + throw new ParseException("parser.01", new Object[] { "Could not parse X509Certificate from InfoboxReadRequest."}, e); + } + + } } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java index 0656d37d3..bff0a3fca 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java @@ -123,6 +123,7 @@ public class AuthServlet extends HttpServlet implements MOAIDAuthConstants { * Logs all servlet parameters for debugging purposes. */ protected void logParameters(HttpServletRequest req) { + //@TODO Parameter? for (Enumeration params = req.getParameterNames(); params.hasMoreElements(); ) { String parname = (String)params.nextElement(); Logger.debug("Parameter " + parname + req.getParameter(parname)); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetForeignIDServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetForeignIDServlet.java new file mode 100644 index 000000000..0599c79bd --- /dev/null +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/GetForeignIDServlet.java @@ -0,0 +1,287 @@ +package at.gv.egovernment.moa.id.auth.servlet; + +import iaik.pki.PKIException; +import iaik.x509.X509Certificate; + +import java.io.IOException; +import java.security.GeneralSecurityException; +import java.security.cert.CertificateEncodingException; +import java.util.Map; + +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.xml.parsers.DocumentBuilder; +import javax.xml.parsers.DocumentBuilderFactory; +import javax.xml.parsers.ParserConfigurationException; + +import org.apache.axis.encoding.Base64; +import org.apache.commons.fileupload.FileUploadException; +import org.w3c.dom.Document; +import org.w3c.dom.Element; +import org.w3c.dom.Text; + +import at.gv.egovernment.moa.id.MOAIDException; +import at.gv.egovernment.moa.id.ParseException; +import at.gv.egovernment.moa.id.auth.AuthenticationServer; +import at.gv.egovernment.moa.id.auth.WrongParametersException; +import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder; +import at.gv.egovernment.moa.id.auth.data.AuthenticationSession; +import at.gv.egovernment.moa.id.auth.data.IdentityLink; +import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser; +import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.CreateIdentityLinkResponse; +import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWClient; +import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWClientException; +import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWConstants; +import at.gv.egovernment.moa.id.config.ConfigurationException; +import at.gv.egovernment.moa.id.config.ConnectionParameter; +import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider; +import at.gv.egovernment.moa.id.util.MOAIDMessageProvider; +import at.gv.egovernment.moa.id.util.ParamValidatorUtils; +import at.gv.egovernment.moa.id.util.SSLUtils; +import at.gv.egovernment.moa.logging.Logger; +import at.gv.egovernment.moa.util.URLEncoder; + +/** + * Servlet requested for getting the foreign eID + * provided by the security layer implementation. + * Utilizes the {@link AuthenticationServer}. + * + */ +public class GetForeignIDServlet extends AuthServlet { + + /** + * Constructor for GetForeignIDServlet. + */ + public GetForeignIDServlet() { + super(); + } + + /** + * GET requested by security layer implementation to verify + * that data URL resource is available. + * @see javax.servlet.http.HttpServlet#doGet(HttpServletRequest, HttpServletResponse) + */ + protected void doGet(HttpServletRequest req, HttpServletResponse resp) + throws ServletException, IOException { + + Logger.debug("GET GetForeignIDServlet"); + + + } + + /** + * Verifies the identity link and responds with a new + * CreateXMLSignatureRequest. + *
+ * Request parameters: + *

MOASessionID: ID of associated authentication session
XMLResponse: <InfoboxReadResponse>

+ * Response: + *

Content type: "text/xml"
Content: see return value of {@link AuthenticationServer#verifyIdentityLink}
Error status: 500 + *

+ * @see javax.servlet.http.HttpServlet#doPost(HttpServletRequest, HttpServletResponse) + */ + protected void doPost(HttpServletRequest req, HttpServletResponse resp) + throws ServletException, IOException { + + Logger.debug("POST GetForeignIDServlet"); + + Map parameters; + try + { + parameters = getParameters(req); + } catch (FileUploadException e) + { + Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage()); + throw new IOException(e.getMessage()); + } + String sessionID = req.getParameter(PARAM_SESSIONID); + String redirectURL = null; + X509Certificate cert = null; + AuthenticationSession session = null; + try { + // check parameter + if (!ParamValidatorUtils.isValidSessionID(sessionID)) + throw new WrongParametersException("GetForeignID", PARAM_SESSIONID, "auth.12"); + + session = AuthenticationServer.getSession(sessionID); + + cert = AuthenticationServer.getInstance().verifyXMLSignature(sessionID, parameters); + +// Element signature = AuthenticationServer.getInstance().getDsigElement +// (sessionID, parameters); + +// if (signature == null) { + if (cert == null) { + handleError("Error retrieving signature from foreign eID card.", null, req, resp); + } + else { + + // make SZR request + //Element samlAssertion = getIdentityLink(signature); + Element samlAssertion = getIdentityLink(cert); + + IdentityLinkAssertionParser ilParser = new IdentityLinkAssertionParser(samlAssertion); + IdentityLink identitylink = ilParser.parseIdentityLink(); + session.setIdentityLink(identitylink); + + String samlArtifactBase64 = + AuthenticationServer.getInstance().getForeignAuthenticationData(sessionID); + if (!samlArtifactBase64.equals("Redirect to Input Processor")) { + redirectURL = session.getOAURLRequested(); + if (!session.getBusinessService()) { + redirectURL = addURLParameter(redirectURL, PARAM_TARGET, URLEncoder.encode(session.getTarget(), "UTF-8")); + } + redirectURL = addURLParameter(redirectURL, PARAM_SAMLARTIFACT, URLEncoder.encode(samlArtifactBase64, "UTF-8")); + redirectURL = resp.encodeRedirectURL(redirectURL); + } else { + redirectURL = new DataURLBuilder().buildDataURL(session.getAuthURL(), AuthenticationServer.REQ_PROCESS_VALIDATOR_INPUT, session.getSessionID()); + } + resp.setContentType("text/html"); + resp.setStatus(302); + resp.addHeader("Location", redirectURL); + Logger.debug("REDIRECT TO: " + redirectURL); + } + + } + catch (ParseException ex) { + handleError(null, ex, req, resp); + } + catch (MOAIDException ex) { + handleError(null, ex, req, resp); + } + catch (SZRGWClientException ex) { + handleError(null, ex, req, resp); + } + } + + /** + * Adds a parameter to a URL. + * @param url the URL + * @param paramname parameter name + * @param paramvalue parameter value + * @return the URL with parameter added + */ + private static String addURLParameter(String url, String paramname, String paramvalue) { + String param = paramname + "=" + paramvalue; + if (url.indexOf("?") < 0) + return url + "?" + param; + else + return url + "&" + param; + } + + /** + * Does the request to the SZR-GW + * @param givenname + * @param familyname + * @param dateofbirth + * @return Identity link assertion + * @throws SZRGWClientException + */ + /*private Element getIdentityLink(Element signature) throws SZRGWClientException {*/ + private Element getIdentityLink(X509Certificate cert) throws SZRGWClientException { + + SZRGWClient client = new SZRGWClient(); + + try { + AuthConfigurationProvider authConf = AuthConfigurationProvider.getInstance(); + ConnectionParameter connectionParameters = authConf.getForeignIDConnectionParameter(); + //url = "http://localhost:8081/szr-gateway/services/IdentityLinkCreation"; + Logger.debug("Connection Parameters: " + connectionParameters); + client.setAddress(connectionParameters.getUrl()); + if (connectionParameters.getUrl().toLowerCase().startsWith("https:")) { + Logger.debug("Initialisiere SSL Verbindung"); + try { + client.setSSLSocketFactory(SSLUtils.getSSLSocketFactory(AuthConfigurationProvider.getInstance(), connectionParameters)); + } catch (IOException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } catch (GeneralSecurityException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } catch (PKIException e) { + // TODO Auto-generated catch block + e.printStackTrace(); + } + } + + Logger.info("Starte Kommunikation mit dem Stammzahlenregister Gateway(" + connectionParameters.getUrl() + ")..."); + + + } + catch (ConfigurationException e) { + Logger.warn(e); + Logger.warn(MOAIDMessageProvider.getInstance().getMessage("config.12", null )); + + } + // create request + Document doc = buildGetIdentityLinkRequest(cert); + Element request = doc.getDocumentElement(); + CreateIdentityLinkResponse response = null; + + //try { + response = client.createIdentityLinkResponse(request); + //} catch (SZRGWClientException e) { + // give him a second try - Nach dem Starten des Tomcat wird beim ersten Mal das Client-Zertifikat offenbar vom HTTPClient nicht mitgeschickt. + // client = new SZRGWClient(url); + // response = client.createIdentityLinkResponse(request); + // } + + + return response.getAssertion(); + + } + + /** + * Builds the szrgw:GetIdentityLinkRequest f�r the SZR-GW + * @param givenname + * @param familyname + * @param birthday + * @return + */ + private static Document buildGetIdentityLinkRequest(X509Certificate cert) { + + try { + byte[] certbyte = cert.getEncoded(); + String certstring = Base64.encode(certbyte); + + DocumentBuilderFactory factory =DocumentBuilderFactory.newInstance(); + factory.setNamespaceAware(true); + DocumentBuilder builder = factory.newDocumentBuilder(); + Document doc = builder.newDocument(); + + Element getIdentityLink = doc.createElementNS(SZRGWConstants.SZRGW_REQUEST_NS, "szrgw:GetIdentityLinkRequest"); + getIdentityLink.setAttributeNS("http://www.w3.org/2000/xmlns/", "xmlns:szrgw", SZRGWConstants.SZRGW_REQUEST_NS); + doc.appendChild(getIdentityLink); + + Element x509certificate = doc.createElementNS(SZRGWConstants.SZRGW_REQUEST_NS, "szrgw:X509Certificate"); + getIdentityLink.appendChild(x509certificate); + Text certbase64 = doc.createTextNode(certstring); + x509certificate.appendChild(certbase64); + + return doc; + } catch (ParserConfigurationException e) { + e.printStackTrace(); + } catch (CertificateEncodingException e) { + e.printStackTrace(); + } + return null; + + } + + /** + * Checks a parameter. + * @param param parameter + * @return true if the parameter is null or empty + */ + private boolean isEmpty(String param) { + return param == null || param.length() == 0; + } + +} diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ProcessValidatorInputServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ProcessValidatorInputServlet.java index 894b05428..317af3e06 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ProcessValidatorInputServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/ProcessValidatorInputServlet.java @@ -73,7 +73,7 @@ public class ProcessValidatorInputServlet extends AuthServlet { } catch (FileUploadException e) { Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage()); throw new IOException(e.getMessage()); - } + } String sessionID = req.getParameter(PARAM_SESSIONID); if (sessionID==null) sessionID = (String) req.getAttribute(PARAM_SESSIONID); if (sessionID==null) sessionID = (String) parameters.get(PARAM_SESSIONID); @@ -124,7 +124,8 @@ public class ProcessValidatorInputServlet extends AuthServlet { } catch (FileUploadException e) { Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage()); throw new IOException(e.getMessage()); - } + } + //@TODO Parameter String sessionID = req.getParameter(PARAM_SESSIONID); if (sessionID==null) sessionID = (String) req.getAttribute(PARAM_SESSIONID); if (sessionID==null) sessionID = (String) parameters.get(PARAM_SESSIONID); @@ -142,13 +143,15 @@ public class ProcessValidatorInputServlet extends AuthServlet { String htmlForm = null; boolean doInputProcessorSign = false; // If sign process should be within an extra form, provide a parameter. Otherwise transport through security layer is assumed + //@TODO Parameter String inputProcessorSignForm = req.getParameter("Sign_Form"); if (inputProcessorSignForm==null) inputProcessorSignForm = (String) req.getAttribute("Sign_Form"); if (inputProcessorSignForm==null) inputProcessorSignForm = (String) parameters.get("Sign_Form"); if (inputProcessorSignForm==null) inputProcessorSignForm = (String) parameters.get("Sign_Form_"); if (!ParepUtils.isEmpty(inputProcessorSignForm)) doInputProcessorSign = inputProcessorSignForm.equalsIgnoreCase("true"); if (doInputProcessorSign) { - // Test if we have a user input form sign template + // Test if we have a user input form sign template + //@TODO Parameter String inputProcessorSignTemplateURL = req.getParameter(PARAM_INPUT_PROCESSOR_SIGN_TEMPLATE); String inputProcessorSignTemplate = null; OAAuthParameter oaParam = diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/SelectBKUServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/SelectBKUServlet.java index 78c028767..09b3ae15f 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/SelectBKUServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/SelectBKUServlet.java @@ -29,6 +29,7 @@ import at.gv.egovernment.moa.id.auth.MOAIDAuthInitializer; import at.gv.egovernment.moa.id.auth.WrongParametersException; import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider; import at.gv.egovernment.moa.id.util.MOAIDMessageProvider; +import at.gv.egovernment.moa.id.util.ParamValidatorUtils; import at.gv.egovernment.moa.logging.Logger; /** @@ -74,6 +75,7 @@ public class SelectBKUServlet extends AuthServlet { authURL = authURL.concat(":" + req.getServerPort()); } authURL = authURL.concat(req.getContextPath() + "/"); + String target = req.getParameter(PARAM_TARGET); String oaURL = req.getParameter(PARAM_OA); String bkuSelectionTemplateURL = req.getParameter(PARAM_BKUTEMPLATE); @@ -84,6 +86,16 @@ public class SelectBKUServlet extends AuthServlet { resp.addHeader(HEADER_CACHE_CONTROL,HEADER_VALUE_CACHE_CONTROL_IE); try { + + // check parameter + if (!ParamValidatorUtils.isValidTarget(target)) + throw new WrongParametersException("StartAuthentication", PARAM_TARGET, "auth.12"); + if (!ParamValidatorUtils.isValidOA(oaURL)) + throw new WrongParametersException("StartAuthentication", PARAM_OA, "auth.12"); + if (!ParamValidatorUtils.isValidTemplate(templateURL)) + throw new WrongParametersException("StartAuthentication", PARAM_TEMPLATE, "auth.12"); + + String returnValue = AuthenticationServer.getInstance().selectBKU( authURL, target, oaURL, bkuSelectionTemplateURL, templateURL); String bkuSelectionType = AuthConfigurationProvider.getInstance().getBKUSelectionType(); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/StartAuthenticationServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/StartAuthenticationServlet.java index 961511ee7..8165f90f8 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/StartAuthenticationServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/StartAuthenticationServlet.java @@ -28,6 +28,7 @@ import at.gv.egovernment.moa.id.auth.AuthenticationServer; import at.gv.egovernment.moa.id.auth.MOAIDAuthInitializer; import at.gv.egovernment.moa.id.auth.WrongParametersException; import at.gv.egovernment.moa.id.util.MOAIDMessageProvider; +import at.gv.egovernment.moa.id.util.ParamValidatorUtils; import at.gv.egovernment.moa.logging.Logger; /** @@ -61,18 +62,36 @@ public class StartAuthenticationServlet extends AuthServlet { authURL = authURL.concat(":" + req.getServerPort()); } authURL = authURL.concat(req.getContextPath() + "/"); - String target = req.getParameter(PARAM_TARGET); - String oaURL = req.getParameter(PARAM_OA); + + String target = req.getParameter(PARAM_TARGET); + String oaURL = req.getParameter(PARAM_OA); String bkuURL = req.getParameter(PARAM_BKU); String templateURL = req.getParameter(PARAM_TEMPLATE); String sessionID = req.getParameter(PARAM_SESSIONID); + resp.setHeader(HEADER_EXPIRES,HEADER_VALUE_EXPIRES); resp.setHeader(HEADER_PRAGMA,HEADER_VALUE_PRAGMA); resp.setHeader(HEADER_CACHE_CONTROL,HEADER_VALUE_CACHE_CONTROL); resp.addHeader(HEADER_CACHE_CONTROL,HEADER_VALUE_CACHE_CONTROL_IE); - try { + + + try { + // check parameter + if (!ParamValidatorUtils.isValidTarget(target)) + throw new WrongParametersException("StartAuthentication", PARAM_TARGET, "auth.12"); + if (!ParamValidatorUtils.isValidOA(oaURL)) + throw new WrongParametersException("StartAuthentication", PARAM_OA, "auth.12"); + if (!ParamValidatorUtils.isValidBKUURI(bkuURL)) + throw new WrongParametersException("StartAuthentication", PARAM_BKU, "auth.12"); + if (!ParamValidatorUtils.isValidTemplate(templateURL)) + throw new WrongParametersException("StartAuthentication", PARAM_TEMPLATE, "auth.12"); + if (!ParamValidatorUtils.isValidSessionID(sessionID)) + throw new WrongParametersException("StartAuthentication", PARAM_SESSIONID, "auth.12"); + + String getIdentityLinkForm = AuthenticationServer.getInstance().startAuthentication(authURL, target, oaURL, templateURL, bkuURL, sessionID, req.getScheme()); + resp.setContentType("text/html;charset=UTF-8"); PrintWriter out = new PrintWriter(resp.getOutputStream()); out.print(getIdentityLinkForm); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyAuthenticationBlockServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyAuthenticationBlockServlet.java index 43947f6f0..824df9ca8 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyAuthenticationBlockServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyAuthenticationBlockServlet.java @@ -16,9 +16,7 @@ package at.gv.egovernment.moa.id.auth.servlet; import java.io.IOException; -import java.util.Iterator; import java.util.Map; -import java.util.Vector; import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; @@ -28,11 +26,10 @@ import org.apache.commons.fileupload.FileUploadException; import at.gv.egovernment.moa.id.MOAIDException; import at.gv.egovernment.moa.id.auth.AuthenticationServer; +import at.gv.egovernment.moa.id.auth.WrongParametersException; import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder; import at.gv.egovernment.moa.id.auth.data.AuthenticationSession; -import at.gv.egovernment.moa.id.auth.data.InfoboxValidationResult; -import at.gv.egovernment.moa.id.auth.validator.InfoboxValidator; -import at.gv.egovernment.moa.id.auth.validator.ValidateException; +import at.gv.egovernment.moa.id.util.ParamValidatorUtils; import at.gv.egovernment.moa.logging.Logger; import at.gv.egovernment.moa.util.URLEncoder; @@ -99,10 +96,16 @@ public class VerifyAuthenticationBlockServlet extends AuthServlet { Logger.error("Parsing mulitpart/form-data request parameters failed: " + e.getMessage()); throw new IOException(e.getMessage()); } + //@TODO Parameter String sessionID = req.getParameter(PARAM_SESSIONID); String createXMLSignatureResponse = (String)parameters.get(PARAM_XMLRESPONSE); String redirectURL = null; try { + // check parameter + if (!ParamValidatorUtils.isValidSessionID(sessionID)) + throw new WrongParametersException("VerifyAuthenticationBlock", PARAM_SESSIONID, "auth.12"); + + AuthenticationSession session = AuthenticationServer.getSession(sessionID); String samlArtifactBase64 = AuthenticationServer.getInstance().verifyAuthenticationBlock(sessionID, createXMLSignatureResponse); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyCertificateServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyCertificateServlet.java new file mode 100644 index 000000000..c9c1e794d --- /dev/null +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyCertificateServlet.java @@ -0,0 +1,286 @@ +package at.gv.egovernment.moa.id.auth.servlet; + +import iaik.pki.PKIException; +import iaik.x509.X509Certificate; + +import java.io.IOException; +import java.security.GeneralSecurityException; +import java.security.cert.CertificateEncodingException; +import java.util.Map; + +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.xml.parsers.DocumentBuilder; +import javax.xml.parsers.DocumentBuilderFactory; +import javax.xml.parsers.ParserConfigurationException; + +import org.apache.axis.encoding.Base64; +import org.apache.commons.fileupload.FileUploadException; +import org.w3c.dom.Document; +import org.w3c.dom.Element; +import org.w3c.dom.Text; + +import at.gv.egovernment.moa.id.MOAIDException; +import at.gv.egovernment.moa.id.auth.AuthenticationServer; +import at.gv.egovernment.moa.id.auth.WrongParametersException; +import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder; +import at.gv.egovernment.moa.id.auth.data.AuthenticationSession; +import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.CreateIdentityLinkResponse; +import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWClient; +import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWClientException; +import at.gv.egovernment.moa.id.auth.validator.parep.client.szrgw.SZRGWConstants; +import at.gv.egovernment.moa.id.config.ConfigurationException; +import at.gv.egovernment.moa.id.config.ConnectionParameter; +import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProvider; +import at.gv.egovernment.moa.id.util.MOAIDMessageProvider; +import at.gv.egovernment.moa.id.util.ParamValidatorUtils; +import at.gv.egovernment.moa.id.util.SSLUtils; +import at.gv.egovernment.moa.id.util.ServletUtils; +import at.gv.egovernment.moa.logging.Logger; + +/** + * Servlet requested for getting the foreign eID + * provided by the security layer implementation. + * Utilizes the {@link AuthenticationServer}. + * + */ +public class VerifyCertificateServlet extends AuthServlet { + + /** + * Constructor for VerifyCertificateServlet. + */ + public VerifyCertificateServlet() { + super(); + } + + /** + * GET requested by security layer implementation to verify + * that data URL resource is available. + * @see javax.servlet.http.HttpServlet#doGet(HttpServletRequest, HttpServletResponse) + */ + protected void doGet(HttpServletRequest req, HttpServletResponse resp) + throws ServletException, IOException { + + Logger.debug("GET VerifyCertificateServlet"); + + + } + + /** + * Gets the signer certificate from the InfoboxReadRequest and + * responds with a new + * CreateXMLSignatureRequest. + *
+ * Request parameters: + *

MOASessionID: ID of associated authentication session
XMLResponse: <InfoboxReadResponse>

Anmeldedaten:

- -

Daten zur Person

- - - - - - - - - - - - - - - - - - - -

Name:	- -
Geburtsdatum:	- - . - - . - -
Rolle:

- - -

- Ich bin weiters ermächtigt als - - von - - - , geboren am - - . - - . - - - - , - - - , in deren Auftrag zu handeln. -

- - -

Daten zur Anwendung

- - - - - - - - - -

Name:
Staat:	Österreich

- -

Technische Parameter

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

URL:
Bereich:
:
Identifikator:	- -
Identifikator des Vollmachtgebers:	-
OID:	- -
HPI:
Datum:	- - . - - . - -
Uhrzeit:	- - : - - : - -

- - - - - - - - - application/xhtml+xml - - diff --git a/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE.xml.old b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE.xml.old new file mode 100644 index 000000000..240126693 --- /dev/null +++ b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE.xml.old @@ -0,0 +1,161 @@ + + + + + + + + Signatur der Anmeldedaten + + + +

Anmeldedaten:

+ +

Daten zur Person

+ + + + + + + + + + + + + + + + + + + +

Name:	+ +
Geburtsdatum:	+ + . + + . + +
Rolle:

+ + +

+ Ich bin weiters ermächtigt als + + von + + + , geboren am + + . + + . + + + + , + + + , in deren Auftrag zu handeln. +

+ + +

Daten zur Anwendung

+ + + + + + + + + +

Name:
Staat:	Österreich

+ +

Technische Parameter

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

URL:
Bereich:
:
Identifikator:	+ +
Identifikator des Vollmachtgebers:	+
OID:	+ +
HPI:
Datum:	+ + . + + . + +
Uhrzeit:	+ + : + + : + +

+ + + + + + + + + application/xhtml+xml + + diff --git a/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_EN.xml b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_EN.xml deleted file mode 100644 index 1f8085aa3..000000000 --- a/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_EN.xml +++ /dev/null @@ -1,161 +0,0 @@ - - - - - - - - Signing the authentication data - - - -

Authentication Data:

- -

Personal Data

- - - - - - - - - - - - - - - - - - - -

Name:	- -
Date of Birth:	- - . - - . - -
Role:

- - -

- I am also authorized as - - of - - - , born on - - . - - . - - - - , - - - , to act on their behalf. -

- - -

Application Data

- - - - - - - - - -

Name:
Country:	Austria

- -

Technical Parameters

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

URL:
Sector:
:
Identifier:	- -
Identifier of the principal:	-
OID:	- -
HPI:
Date:	- - . - - . - -
Time:	- - : - - : - -

- - - - - - - - - application/xhtml+xml - - diff --git a/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_EN.xml.old b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_EN.xml.old new file mode 100644 index 000000000..1f8085aa3 --- /dev/null +++ b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_EN.xml.old @@ -0,0 +1,161 @@ + + + + + + + + Signing the authentication data + + + +

Authentication Data:

+ +

Personal Data

+ + + + + + + + + + + + + + + + + + + +

Name:	+ +
Date of Birth:	+ + . + + . + +
Role:

+ + +

+ I am also authorized as + + of + + + , born on + + . + + . + + + + , + + + , to act on their behalf. +

+ + +

Application Data

+ + + + + + + + + +

Name:
Country:	Austria

+ +

Technical Parameters

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

URL:
Sector:
:
Identifier:	+ +
Identifier of the principal:	+
OID:	+ +
HPI:
Date:	+ + . + + . + +
Time:	+ + : + + : + +

+ + + + + + + + + application/xhtml+xml + + diff --git a/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_DE.xml b/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_DE.xml deleted file mode 100644 index 5640412da..000000000 --- a/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_DE.xml +++ /dev/null @@ -1,159 +0,0 @@ - - - - - - - - - Signatur der Anmeldedaten - - - -

Anmeldedaten:

- -

Daten zur Person

- - - - - - - - - - - - - - - - - - - -

Name:	- -
Geburtsdatum:	- - . - - . - -
Rolle:

- - -

- Ich bin weiters ermächtigt als - - von - - - , geboren am - - . - - . - - - - , - - - , in deren Auftrag zu handeln. -

- - -

Daten zur Anwendung

- - - - - - - - - -

Name:
Staat:	Österreich

- -

Technische Parameter

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

URL:
Bereich:
:
Identifikator:	- -
Identifikator des Vollmachtgebers:	-
OID:	- -
HPI:
Datum:	- - . - - . - -
Uhrzeit:	- - : - - : - -

- - - - - - - - diff --git a/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_DE.xml.old b/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_DE.xml.old new file mode 100644 index 000000000..5640412da --- /dev/null +++ b/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_DE.xml.old @@ -0,0 +1,159 @@ + + + + + + + + + Signatur der Anmeldedaten + + + +

Anmeldedaten:

+ +

Daten zur Person

+ + + + + + + + + + + + + + + + + + + +

Name:	+ +
Geburtsdatum:	+ + . + + . + +
Rolle:

+ + +

+ Ich bin weiters ermächtigt als + + von + + + , geboren am + + . + + . + + + + , + + + , in deren Auftrag zu handeln. +

+ + +

Daten zur Anwendung

+ + + + + + + + + +

Name:
Staat:	Österreich

+ +

Technische Parameter

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

URL:
Bereich:
:
Identifikator:	+ +
Identifikator des Vollmachtgebers:	+
OID:	+ +
HPI:
Datum:	+ + . + + . + +
Uhrzeit:	+ + : + + : + +

+ + + + + + + + diff --git a/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_EN.xml b/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_EN.xml deleted file mode 100644 index 9a067b0ba..000000000 --- a/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_EN.xml +++ /dev/null @@ -1,159 +0,0 @@ - - - - - - - - - Signing the authentication data - - - -

Authentication Data:

- -

Personal Data

- - - - - - - - - - - - - - - - - - - -

Name:	- -
Date of Birth:	- - . - - . - -
Role:

- - -

- I am also authorized as - - of - - - , born on - - . - - . - - - - , - - - , to act on their behalf. -

- - -

Application Data

- - - - - - - - - -

Name:
Country:	Austria

- -

Technical Parameters

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

URL:
Sector:
:
Identifier:	- -
Identifier of the principal:	-
OID:	- -
HPI:
Date:	- - . - - . - -
Time:	- - : - - : - -

- - - - - - - - diff --git a/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_EN.xml.old b/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_EN.xml.old new file mode 100644 index 000000000..9a067b0ba --- /dev/null +++ b/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_EN.xml.old @@ -0,0 +1,159 @@ + + + + + + + + + Signing the authentication data + + + +

Authentication Data:

+ +

Personal Data

+ + + + + + + + + + + + + + + + + + + +

Name:	+ +
Date of Birth:	+ + . + + . + +
Role:

+ + +

+ I am also authorized as + + of + + + , born on + + . + + . + + + + , + + + , to act on their behalf. +

+ + +

Application Data

+ + + + + + + + + +

Name:
Country:	Austria

+ +

Technical Parameters

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

URL:
Sector:
:
Identifier:	+ +
Identifier of the principal:	+
OID:	+ +
HPI:
Date:	+ + . + + . + +
Time:	+ + : + + : + +

+ + + + + + + + diff --git a/id/server/data/deploy/conf/moa-spss/trustProfiles/MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer b/id/server/data/deploy/conf/moa-spss/trustProfiles/MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer new file mode 100644 index 000000000..ab9e0cd7d Binary files /dev/null and b/id/server/data/deploy/conf/moa-spss/trustProfiles/MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer differ diff --git "a/id/server/data/deploy/conf/moa-spss/trustProfiles/MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten/A-Trust-Qual-03.20080425-20180425.SerNo\303\224\303\207\303\20403e694(SecureSignatureKeypair).cer" "b/id/server/data/deploy/conf/moa-spss/trustProfiles/MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten/A-Trust-Qual-03.20080425-20180425.SerNo\303\224\303\207\303\20403e694(SecureSignatureKeypair).cer" deleted file mode 100644 index ab9e0cd7d..000000000 Binary files "a/id/server/data/deploy/conf/moa-spss/trustProfiles/MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten/A-Trust-Qual-03.20080425-20180425.SerNo\303\224\303\207\303\20403e694(SecureSignatureKeypair).cer" and /dev/null differ diff --git a/id/server/data/deploy/conf/moa-spss/trustProfiles/MOAIDBuergerkarteAuthentisierungsDatenOhneTestkarten/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer b/id/server/data/deploy/conf/moa-spss/trustProfiles/MOAIDBuergerkarteAuthentisierungsDatenOhneTestkarten/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer new file mode 100644 index 000000000..ab9e0cd7d Binary files /dev/null and b/id/server/data/deploy/conf/moa-spss/trustProfiles/MOAIDBuergerkarteAuthentisierungsDatenOhneTestkarten/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer differ diff --git "a/id/server/data/deploy/conf/moa-spss/trustProfiles/MOAIDBuergerkarteAuthentisierungsDatenOhneTestkarten/A-Trust-Qual-03.20080425-20180425.SerNo\303\224\303\207\303\20403e694(SecureSignatureKeypair).cer" "b/id/server/data/deploy/conf/moa-spss/trustProfiles/MOAIDBuergerkarteAuthentisierungsDatenOhneTestkarten/A-Trust-Qual-03.20080425-20180425.SerNo\303\224\303\207\303\20403e694(SecureSignatureKeypair).cer" deleted file mode 100644 index ab9e0cd7d..000000000 Binary files "a/id/server/data/deploy/conf/moa-spss/trustProfiles/MOAIDBuergerkarteAuthentisierungsDatenOhneTestkarten/A-Trust-Qual-03.20080425-20180425.SerNo\303\224\303\207\303\20403e694(SecureSignatureKeypair).cer" and /dev/null differ diff --git a/id/server/doc/MOA_ID_1.4_Anhang.pdf b/id/server/doc/MOA_ID_1.4_Anhang.pdf new file mode 100644 index 000000000..0c923666f Binary files /dev/null and b/id/server/doc/MOA_ID_1.4_Anhang.pdf differ diff --git a/id/server/doc/moa_id/id-admin_1.htm b/id/server/doc/moa_id/id-admin_1.htm index a695d73b0..bcb67e0fd 100644 --- a/id/server/doc/moa_id/id-admin_1.htm +++ b/id/server/doc/moa_id/id-admin_1.htm @@ -407,7 +407,7 @@ zur Verfügung. Der WebService ist unter http(s)://host:port/moa-id-auth/services/GetAuthenticationData

erreichbar. Die Verfügbarkeit der Anwendung kann überprüft werden, indem die URLs mit einem Web-Browser aufgerufen werden.

Musterseite
+

Musterseite (MOA-Template zur Bürgerkartenauswahl)
Nach dem erfolgreichen Starten von Tomcat steht eine Musterseite unter der URL

 http(s)://host:port/moa-id-auth/index.html

diff --git a/id/server/doc/moa_id/id-admin_2.htm b/id/server/doc/moa_id/id-admin_2.htm index 73569b39d..27d89b5dd 100644 --- a/id/server/doc/moa_id/id-admin_2.htm +++ b/id/server/doc/moa_id/id-admin_2.htm @@ -529,7 +529,8 @@ Projekt moa

AuthComponent/ForeignIdentities
-Ab Version 1.4.7 bietet MOA-ID die Möglichkeit der Nutzung von ausländischen Karten. Hierfür ist ein Stammzahlenregister-Gateway nötig, dass einen entsprechenden Zugang zum Stammzahlenregister bereitstellt. Es ist hierzu ein ensprechenden ConnectionParameter zu definieren, der die Zugangsdaten zum Gateway bereithält (siehe ConnectionParameter). In der Default-Konfiguration ist der Zugang zum Stammzahlenregister-Gateway bereits aktiviert. Es muss nur noch das Client-Zertifikat für die SSL-Verbinung zum Gateway angegeben werden. Voraussetzung dafür ist ein Zertifikat von A-Trust mit Verwaltungseigenschaft. Wenn ihr MOA-ID Zertifikat diese Voraussetzung erfüllt, können Sie dieses hier angeben.

+Ab Version 1.4.7 bietet MOA-ID die Möglichkeit der Nutzung von ausländischen Karten. Hierfür ist ein Stammzahlenregister-Gateway nötig, dass einen entsprechenden Zugang zum Stammzahlenregister bereitstellt. Es ist hierzu ein ensprechenden ConnectionParameter zu definieren, der die Zugangsdaten zum Gateway bereithält (siehe ConnectionParameter). In der Default-Konfiguration ist der Zugang zum Stammzahlenregister-Gateway bereits aktiviert. Es muss nur noch das Client-Zertifikat für die SSL-Verbinung zum Gateway angegeben werden. Voraussetzung dafür ist ein Zertifikat von A-Trust bzw. A-CERT mit Verwaltungseigenschaft. Wenn ihr MOA-ID Zertifikat diese Voraussetzung erfüllt, können Sie dieses hier angeben.
+

ProxyComponent
ProxyComponent enthält Parameter, die nur die MOA-ID Proxykomponente betreffen. Das Element diff --git a/id/server/doc/moa_id/moa.htm b/id/server/doc/moa_id/moa.htm index bf5d3611d..92e2dfd81 100644 --- a/id/server/doc/moa_id/moa.htm +++ b/id/server/doc/moa_id/moa.htm @@ -230,7 +230,7 @@ an den Benutzer weitergeleitet und die Anfragen des Benutzers an die OA weiterge

Ergänzung für ausländische Bürger

Ab der MOA Release 1.4.7 ist es möglich, dass sich auch ausländische Bürger mittels MOA-ID einloggen können. Hierzu wird eine Verbindung zu einem sogenannten Stammzahlenregister-Gateway aufgebaut, dass basierend auf den Zertifikatsdaten des ausländischen Bürgers eine Eintragung im Ergänzungsregister für natürliche Personen gemäß E-Government Gesetz §6(5) vornimmt. Somit ist es möglich, dass eine Personenbindung ausgestellt werden kann, die in weitere Folge an MOA-ID weitergeleitet wird.

Der Zugang zu diesem Stammzahlenregister-Gateways ist über eine Client-Server Authentifizierung abgesichert. Als Client-Zertifikate werden Zertifikate der Firma A-Trust, die mit der Verwaltungseigenschaft versehene sind, akzeptiert.

Der Zugang zu diesem Stammzahlenregister-Gateways ist über eine Client-Server Authentifizierung abgesichert. Als Client-Zertifikate werden Zertifikate der Firmen A-Trust bzw. A-CERT, die mit der Verwaltungseigenschaft versehen sind, akzeptiert.

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java index 4ef8dc359..c61e2dd84 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/CreateXMLSignatureRequestBuilder.java @@ -138,12 +138,18 @@ public class CreateXMLSignatureRequestBuilder implements Constants { request += ""; request += ""; request += "Signatur der Anmeldedaten"; - request += ""; + +// request += ""; request += ""; request += ""; request += "

Authentication Data:

"; @@ -151,7 +157,7 @@ public class CreateXMLSignatureRequestBuilder implements Constants { request += ""; request += ""; request += ""; - request += ""; request += ""; @@ -160,21 +166,21 @@ public class CreateXMLSignatureRequestBuilder implements Constants { request += "

Name:

"; + request += "

"; request += subject; request += "

"; request += ""; request += ""; - request += ""; request += ""; request += ""; request += ""; - request += ""; + request += ""; request += ""; request += "

Name:	"; + request += "	"; // friendlyname from OA request += StringUtils.isEmpty(oaParam.getFriendlyName()) ? "" : oaParam.getFriendlyName(); request += "
Country:	Austria	Austria

"; request += "

Technical Parameters

"; request += ""; request += ""; request += ""; - request += ""; @@ -188,7 +194,7 @@ public class CreateXMLSignatureRequestBuilder implements Constants { request += ""; - request += ""; request += ""; @@ -198,7 +204,7 @@ public class CreateXMLSignatureRequestBuilder implements Constants { request += ""; request += ""; - request += ""; request += ""; @@ -207,19 +213,19 @@ public class CreateXMLSignatureRequestBuilder implements Constants { request += ""; request += ""; - request += ""; request += ""; request += ""; request += ""; - request += ""; request += ""; request += "

URL:	"; + request += "	"; //public URL prefix from OA request += oaParam.getPublicURLPrefix(); request += "	"; request += identifierType + ":"; request += "	"; + request += "	"; request += identifier; request += "
"; request += "Sector:	"; + request += "	"; request += target + " (" + sectorName + ")"; request += "
Date:	"; + request += "	"; request += date; request += "
Time:	"; + request += "	"; request += time; request += "

"; - request += "

I hereby request to access this e-government application by using my " + + request += "

I hereby request to access this e-government application by using my " + "domestic electronic identity.
" + "I further affirm that I am not yet registered with the Austrian Central " + "Residents Registry and that I am not obliged to register with the Austrian " + diff --git a/spss/server/history.txt b/spss/server/history.txt index d6249e8cd..5e2df26d8 100644 --- a/spss/server/history.txt +++ b/spss/server/history.txt @@ -3,7 +3,7 @@ ############## - Update Konfiguration: - Im Element ServiceOrder unter dem Element RevocationChecking kann nur auch nur ein + Im Element ServiceOrder unter dem Element RevocationChecking kann nun auch nur ein Service eingetragen werden (bspw. nur CRL) - IAIK Libraries aktualisiert: iaik-moa: Version 1.27 -- cgit v1.2.3 From 66a1e0545eca48d90b29b2c35c82be8dccb28bfa Mon Sep 17 00:00:00 2001 From: kstranacher Date: Tue, 27 Jul 2010 09:51:55 +0000 Subject: git-svn-id: https://joinup.ec.europa.eu/svn/moa-idspss/trunk@1176 d688527b-c9ab-4aba-bd8d-4036d912da1d --- id/server/auth/src/main/webapp/index.html | 2 +- .../transforms/TransformsInfoAuthBlockTable_DE.xml | 158 +++++++++++++++++++++ .../transforms/TransformsInfoAuthBlockTable_EN.xml | 158 +++++++++++++++++++++ .../profiles/MOAIDTransformAuthBlockTable_DE.xml | 156 ++++++++++++++++++++ .../profiles/MOAIDTransformAuthBlockTable_EN.xml | 156 ++++++++++++++++++++ ...\207\303\20403e694(SecureSignatureKeypair).cer" | Bin 975 -> 0 bytes ...\207\303\20403e694(SecureSignatureKeypair).cer" | Bin 975 -> 0 bytes ...-20180425.SerNoe694(SecureSignatureKeypair).cer | Bin 0 -> 975 bytes ...-20180425.SerNoe694(SecureSignatureKeypair).cer | Bin 0 -> 975 bytes ...-20180425.SerNoe694(SecureSignatureKeypair).cer | Bin 0 -> 975 bytes 10 files changed, 629 insertions(+), 1 deletion(-) create mode 100644 id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE.xml create mode 100644 id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_EN.xml create mode 100644 id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_DE.xml create mode 100644 id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_EN.xml delete mode 100644 "spss/handbook/conf/moa-spss/trustProfiles/certifiedSignature+Test/A-Trust-Qual-03.20080425-20180425.SerNo\303\224\303\207\303\20403e694(SecureSignatureKeypair).cer" delete mode 100644 "spss/handbook/conf/moa-spss/trustProfiles/certifiedSignature/A-Trust-Qual-03.20080425-20180425.SerNo\303\224\303\207\303\20403e694(SecureSignatureKeypair).cer" create mode 100644 spss/handbook/conf/moa-spss/trustProfiles/secureSignature+Test/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer create mode 100644 spss/handbook/conf/moa-spss/trustProfiles/secureSignature-qual-only/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer create mode 100644 spss/handbook/conf/moa-spss/trustProfiles/secureSignature/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer (limited to 'id/server/auth/src/main/webapp') diff --git a/id/server/auth/src/main/webapp/index.html b/id/server/auth/src/main/webapp/index.html index 46ac4dd86..1cb5030a6 100644 --- a/id/server/auth/src/main/webapp/index.html +++ b/id/server/auth/src/main/webapp/index.html @@ -24,7 +24,7 @@ var iframe = document.createElement("iframe"); iframe.setAttribute("src", "iframeOnlineBKU.html"); iframe.setAttribute("width", "210"); - iframe.setAttribute("height", "150"); + iframe.setAttribute("height", "155"); iframe.setAttribute("frameborder", "0"); iframe.setAttribute("scrolling", "no"); iframe.setAttribute("title", "Login"); diff --git a/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE.xml b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE.xml new file mode 100644 index 000000000..fd6004811 --- /dev/null +++ b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_DE.xml @@ -0,0 +1,158 @@ + + + + + + + + Signatur der Anmeldedaten + + + +

Anmeldedaten:

+ +

Daten zur Person

+ + + + + + + + + + + + + + + + + + + +

Name:	+ +
Geburtsdatum:	+ + . + + . + +
Rolle:

+ + +

+ Ich bin weiters ermächtigt als + + von + + + , geboren am + + . + + . + + + + , + + + , in deren Auftrag zu handeln. +

+ + +

Daten zur Anwendung

+ + + + + + + + + +

Name:
Staat:	Österreich

+ +

Technische Parameter

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

URL:
Bereich:
:
Identifikator:	+ +
Identifikator des Vollmachtgebers:
OID:
HPI:
Datum:	+ + . + + . + +
Uhrzeit:	+ + : + + : + +

+ + + + + + + + + application/xhtml+xml + + diff --git a/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_EN.xml b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_EN.xml new file mode 100644 index 000000000..4e2b9444c --- /dev/null +++ b/id/server/data/deploy/conf/moa-id/transforms/TransformsInfoAuthBlockTable_EN.xml @@ -0,0 +1,158 @@ + + + + + + + + Signing the authentication data + + + +

Authentication Data:

+ +

Personal Data

+ + + + + + + + + + + + + + + + + + + +

Name:	+ +
Date of Birth:	+ + . + + . + +
Role:

+ + +

+ I am also authorized as + + of + + + , born on + + . + + . + + + + , + + + , to act on their behalf. +

+ + +

Application Data

+ + + + + + + + + +

Name:
Country:	Austria

+ +

Technical Parameters

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

URL:
Sector:
:
Identifier:	+ +
Identifier of the principal:
OID:
HPI:
Date:	+ + . + + . + +
Time:	+ + : + + : + +

+ + + + + + + + + application/xhtml+xml + + diff --git a/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_DE.xml b/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_DE.xml new file mode 100644 index 000000000..db638d545 --- /dev/null +++ b/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_DE.xml @@ -0,0 +1,156 @@ + + + + + + + + + Signatur der Anmeldedaten + + + +

Anmeldedaten:

+ +

Daten zur Person

+ + + + + + + + + + + + + + + + + + + +

Name:	+ +
Geburtsdatum:	+ + . + + . + +
Rolle:

+ + +

+ Ich bin weiters ermächtigt als + + von + + + , geboren am + + . + + . + + + + , + + + , in deren Auftrag zu handeln. +

+ + +

Daten zur Anwendung

+ + + + + + + + + +

Name:
Staat:	Österreich

+ +

Technische Parameter

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

URL:
Bereich:
:
Identifikator:	+ +
Identifikator des Vollmachtgebers:
OID:
HPI:
Datum:	+ + . + + . + +
Uhrzeit:	+ + : + + : + +

+ + + + + + + + diff --git a/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_EN.xml b/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_EN.xml new file mode 100644 index 000000000..6db367871 --- /dev/null +++ b/id/server/data/deploy/conf/moa-spss/profiles/MOAIDTransformAuthBlockTable_EN.xml @@ -0,0 +1,156 @@ + + + + + + + + + Signing the authentication data + + + +

Authentication Data:

+ +

Personal Data

+ + + + + + + + + + + + + + + + + + + +

Name:	+ +
Date of Birth:	+ + . + + . + +
Role:

+ + +

+ I am also authorized as + + of + + + , born on + + . + + . + + + + , + + + , to act on their behalf. +

+ + +

Application Data

+ + + + + + + + + +

Name:
Country:	Austria

+ +

Technical Parameters

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

URL:
Sector:
:
Identifier:	+ +
Identifier of the principal:
OID:
HPI:
Date:	+ + . + + . + +
Time:	+ + : + + : + +

+ + + + + + + + diff --git "a/spss/handbook/conf/moa-spss/trustProfiles/certifiedSignature+Test/A-Trust-Qual-03.20080425-20180425.SerNo\303\224\303\207\303\20403e694(SecureSignatureKeypair).cer" "b/spss/handbook/conf/moa-spss/trustProfiles/certifiedSignature+Test/A-Trust-Qual-03.20080425-20180425.SerNo\303\224\303\207\303\20403e694(SecureSignatureKeypair).cer" deleted file mode 100644 index ab9e0cd7d..000000000 Binary files "a/spss/handbook/conf/moa-spss/trustProfiles/certifiedSignature+Test/A-Trust-Qual-03.20080425-20180425.SerNo\303\224\303\207\303\20403e694(SecureSignatureKeypair).cer" and /dev/null differ diff --git "a/spss/handbook/conf/moa-spss/trustProfiles/certifiedSignature/A-Trust-Qual-03.20080425-20180425.SerNo\303\224\303\207\303\20403e694(SecureSignatureKeypair).cer" "b/spss/handbook/conf/moa-spss/trustProfiles/certifiedSignature/A-Trust-Qual-03.20080425-20180425.SerNo\303\224\303\207\303\20403e694(SecureSignatureKeypair).cer" deleted file mode 100644 index ab9e0cd7d..000000000 Binary files "a/spss/handbook/conf/moa-spss/trustProfiles/certifiedSignature/A-Trust-Qual-03.20080425-20180425.SerNo\303\224\303\207\303\20403e694(SecureSignatureKeypair).cer" and /dev/null differ diff --git a/spss/handbook/conf/moa-spss/trustProfiles/secureSignature+Test/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer b/spss/handbook/conf/moa-spss/trustProfiles/secureSignature+Test/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer new file mode 100644 index 000000000..ab9e0cd7d Binary files /dev/null and b/spss/handbook/conf/moa-spss/trustProfiles/secureSignature+Test/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer differ diff --git a/spss/handbook/conf/moa-spss/trustProfiles/secureSignature-qual-only/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer b/spss/handbook/conf/moa-spss/trustProfiles/secureSignature-qual-only/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer new file mode 100644 index 000000000..ab9e0cd7d Binary files /dev/null and b/spss/handbook/conf/moa-spss/trustProfiles/secureSignature-qual-only/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer differ diff --git a/spss/handbook/conf/moa-spss/trustProfiles/secureSignature/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer b/spss/handbook/conf/moa-spss/trustProfiles/secureSignature/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer new file mode 100644 index 000000000..ab9e0cd7d Binary files /dev/null and b/spss/handbook/conf/moa-spss/trustProfiles/secureSignature/A-Trust-Qual-03.20080425-20180425.SerNoe694(SecureSignatureKeypair).cer differ -- cgit v1.2.3 From 7848a953758fe645da5abc16eb8abff1fdc11da8 Mon Sep 17 00:00:00 2001 From: kstranacher Date: Tue, 27 Jul 2010 20:15:31 +0000 Subject: git-svn-id: https://joinup.ec.europa.eu/svn/moa-idspss/trunk@1177 d688527b-c9ab-4aba-bd8d-4036d912da1d --- .../java/at/gv/egovernment/moa/util/DOMUtils.java | 18 ++++++++ id/readme_1.4.7.txt | 46 ++++++++++++--------- id/server/auth/src/main/webapp/img/logo.jpg | Bin 18014 -> 18260 bytes .../conf/moa-id/SampleMOAIDConfiguration.xml | 6 ++- .../conf/moa-id/SampleMOAIDConfigurationProxy.xml | 6 ++- .../SampleMOAIDConfiguration_withTestBKs.xml | 6 ++- .../SampleMOAIDConfiguration_withTestBKsProxy.xml | 6 ++- .../conf/moa-id/SampleMOAWIDConfiguration.xml | 6 ++- .../conf/moa-id/SampleMOAWIDConfigurationProxy.xml | 6 ++- .../SampleMOAWIDConfiguration_withTestBKs.xml | 6 ++- .../SampleMOAWIDConfiguration_withTestBKsProxy.xml | 6 ++- .../moa/id/auth/AuthenticationServer.java | 34 ++++++++++++++- .../moa/id/auth/MOAIDAuthConstants.java | 5 ++- .../builder/VerifyXMLSignatureRequestBuilder.java | 1 + .../id/auth/servlet/VerifyIdentityLinkServlet.java | 2 + .../id/auth/validator/IdentityLinkValidator.java | 3 ++ .../VerifyXMLSignatureResponseValidator.java | 1 + 17 files changed, 120 insertions(+), 38 deletions(-) (limited to 'id/server/auth/src/main/webapp') diff --git a/common/src/main/java/at/gv/egovernment/moa/util/DOMUtils.java b/common/src/main/java/at/gv/egovernment/moa/util/DOMUtils.java index b403961d8..39cdf4e87 100644 --- a/common/src/main/java/at/gv/egovernment/moa/util/DOMUtils.java +++ b/common/src/main/java/at/gv/egovernment/moa/util/DOMUtils.java @@ -378,6 +378,24 @@ public class DOMUtils { .parseDocument(inputStream, true, Constants.ALL_SCHEMA_LOCATIONS, null) .getDocumentElement(); } + + /** + * A convenience method to parse an XML document non validating. + * + * @param inputStream The InputStream containing the XML + * document. + * @return The root element of the parsed XML document. + * @throws SAXException An error occurred parsing the document. + * @throws IOException An error occurred reading the document. + * @throws ParserConfigurationException An error occurred configuring the XML + * parser. + */ + public static Element parseXmlNonValidating(InputStream inputStream) + throws ParserConfigurationException, SAXException, IOException { + return DOMUtils + .parseDocument(inputStream, false, Constants.ALL_SCHEMA_LOCATIONS, null) + .getDocumentElement(); + } /** * Schema validate a given DOM element. diff --git a/id/readme_1.4.7.txt b/id/readme_1.4.7.txt index 3f04b9e3c..3fc743521 100644 --- a/id/readme_1.4.7.txt +++ b/id/readme_1.4.7.txt @@ -91,17 +91,21 @@ B.1 Durchf betreiben, sondern es von MOA ID �ber die API-Schnittstelle angesprochen wird, lautet dieses Stammverzeichnis f�r gew�hnlich CATALINA_HOME_ID/conf/moa-spss. - Weiters editieren Sie ihre MOA SPSS Konfiguration wie folgt: - * Im Element MOAConfiguration/SignatureVerification f�gen Sie folgende Zeilen - ein: - - MOAIDTransformAuthBlockTable_DE - profiles/MOAIDTransformAuthBlockTable_DE.xml - - - MOAIDTransformAuthBlockTable_EN - profiles/MOAIDTransformAuthBlockTable_EN.xml - + Weiters editieren Sie ihre MOA ID Konfiguration wie folgt: + * Im Element MOA-IDConfiguration/AuthComponent/SecurityLayer f�gen Sie eine + der folgende Zeilen ein: + + + je nachdem ob sie einen englischen oder deutschen Text zur Anzeige beim + B�rger w�nschen. + Alle weiteren TransformsInfo Elemente l�schen Sie bitte. + * Im Element AuthComponent/MOA-SP/VerifyAuthBlock f�gend Sie eine der folgende + Zeilen ein: + MOAIDTransformAuthBlockTable_DE + MOAIDTransformAuthBlockTable_EN + je nachdem ob sie einen englischen oder deutschen Text zur Anzeige beim + B�rger ausgew�hlt haben. + Alle weiteren VerifyTransformsInfoProfileID Elemente l�schen Sie bitte. 9. Kopieren Sie die drei Dateien aus dem Verzeichnis MOA_ID_AUTH_INST/conf/moa-id/certs/ca-certs in das Verzeichnis certs/ca-certs Ihres @@ -213,18 +217,20 @@ B.1 Durchf dieses Stammverzeichnis CATALINA_HOME_ID/conf/moa-id; in weiterer Folge wird davon ausgegangen). Weiters editieren Sie ihre MOA ID Konfiguration wie folgt: - * Im Element MOA-IDConfiguration/AuthComponent/SecurityLayer f�gen sie eine + * Im Element MOA-IDConfiguration/AuthComponent/SecurityLayer f�gen Sie eine der folgende Zeilen ein: je nachdem ob sie einen englischen oder deutschen Text zur Anzeige beim B�rger w�nschen. Alle weiteren TransformsInfo Elemente l�schen Sie bitte. - * Im Element AuthComponent/MOA-SP/VerifyAuthBlock f�gend Sie folgende Zeilen - ein: + * Im Element AuthComponent/MOA-SP/VerifyAuthBlock f�gend Sie eine der folgende + Zeilen ein: MOAIDTransformAuthBlockTable_DE MOAIDTransformAuthBlockTable_EN - + je nachdem ob sie einen englischen oder deutschen Text zur Anzeige beim + B�rger ausgew�hlt haben. + Alle weiteren VerifyTransformsInfoProfileID Elemente l�schen Sie bitte. 8. Kopieren Sie die zwei Dateien aus dem Verzeichnis MOA_ID_AUTH_INST/conf/moa-spss/profiles in das Verzeichnis profiles Ihres Stammverzeichnisses f�r die MOA SPSS Konfiguration (f�r gew�hnlich lautet @@ -295,17 +301,20 @@ B.2 Durchf dieses Stammverzeichnis CATALINA_HOME_ID/conf/moa-id; in weiterer Folge wird davon ausgegangen). Weiters editieren Sie ihre MOA ID Konfiguration wie folgt: - * Im Element MOA-IDConfiguration/AuthComponent/SecurityLayer f�gen sie eine + * Im Element MOA-IDConfiguration/AuthComponent/SecurityLayer f�gen Sie eine der folgende Zeilen ein: je nachdem ob sie einen englischen oder deutschen Text zur Anzeige beim B�rger w�nschen. Alle weiteren TransformsInfo Elemente l�schen Sie bitte. - * Im Element AuthComponent/MOA-SP/VerifyAuthBlock f�gend Sie folgende Zeilen - ein: + * Im Element AuthComponent/MOA-SP/VerifyAuthBlock f�gend Sie eine der folgende + Zeilen ein: MOAIDTransformAuthBlockTable_DE MOAIDTransformAuthBlockTable_EN + je nachdem ob sie einen englischen oder deutschen Text zur Anzeige beim + B�rger ausgew�hlt haben. + Alle weiteren VerifyTransformsInfoProfileID Elemente l�schen Sie bitte. 6. Kopieren Sie die zwei Dateien aus dem Verzeichnis MOA_ID_AUTH_INST/conf/moa-spss/profiles in das Verzeichnis profiles Ihres @@ -348,7 +357,6 @@ B.2 Durchf dieses hier angeben. - 8. Sichern Sie ihre MOA-ID Konfigurationsdatei. Kopieren Sie die Beispielkonfigurationsdateien aus dem Verzeichnis MOA_ID_AUTH_INST/conf/moa-id/SampleMOA*.xml nach diff --git a/id/server/auth/src/main/webapp/img/logo.jpg b/id/server/auth/src/main/webapp/img/logo.jpg index 6bfc6a1e9..bafbccc84 100644 Binary files a/id/server/auth/src/main/webapp/img/logo.jpg and b/id/server/auth/src/main/webapp/img/logo.jpg differ diff --git a/id/server/data/deploy/conf/moa-id/SampleMOAIDConfiguration.xml b/id/server/data/deploy/conf/moa-id/SampleMOAIDConfiguration.xml index 8c5cf90d3..e59925057 100644 --- a/id/server/data/deploy/conf/moa-id/SampleMOAIDConfiguration.xml +++ b/id/server/data/deploy/conf/moa-id/SampleMOAIDConfiguration.xml @@ -18,8 +18,9 @@ + - +

+ MOAIDTransformAuthBlockTable_DE - MOAIDTransformAuthBlockTable_EN +

diff --git a/id/server/data/deploy/conf/moa-id/SampleMOAIDConfigurationProxy.xml b/id/server/data/deploy/conf/moa-id/SampleMOAIDConfigurationProxy.xml index a04adaf51..a8a6e34e5 100644 --- a/id/server/data/deploy/conf/moa-id/SampleMOAIDConfigurationProxy.xml +++ b/id/server/data/deploy/conf/moa-id/SampleMOAIDConfigurationProxy.xml @@ -18,8 +18,9 @@ + - +

+ MOAIDTransformAuthBlockTable_DE - MOAIDTransformAuthBlockTable_EN +

diff --git a/id/server/data/deploy/conf/moa-id/SampleMOAIDConfiguration_withTestBKs.xml b/id/server/data/deploy/conf/moa-id/SampleMOAIDConfiguration_withTestBKs.xml index 1a7005eee..54a2d5ce6 100644 --- a/id/server/data/deploy/conf/moa-id/SampleMOAIDConfiguration_withTestBKs.xml +++ b/id/server/data/deploy/conf/moa-id/SampleMOAIDConfiguration_withTestBKs.xml @@ -18,8 +18,9 @@ + - +

MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten + MOAIDTransformAuthBlockTable_DE - MOAIDTransformAuthBlockTable_EN +

diff --git a/id/server/data/deploy/conf/moa-id/SampleMOAIDConfiguration_withTestBKsProxy.xml b/id/server/data/deploy/conf/moa-id/SampleMOAIDConfiguration_withTestBKsProxy.xml index 2070c52a6..9b4918475 100644 --- a/id/server/data/deploy/conf/moa-id/SampleMOAIDConfiguration_withTestBKsProxy.xml +++ b/id/server/data/deploy/conf/moa-id/SampleMOAIDConfiguration_withTestBKsProxy.xml @@ -18,8 +18,9 @@ + - +

MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten + MOAIDTransformAuthBlockTable_DE - MOAIDTransformAuthBlockTable_EN +

diff --git a/id/server/data/deploy/conf/moa-id/SampleMOAWIDConfiguration.xml b/id/server/data/deploy/conf/moa-id/SampleMOAWIDConfiguration.xml index 79fb7cba1..4f7711574 100644 --- a/id/server/data/deploy/conf/moa-id/SampleMOAWIDConfiguration.xml +++ b/id/server/data/deploy/conf/moa-id/SampleMOAWIDConfiguration.xml @@ -18,8 +18,9 @@ + - +

+ MOAIDTransformAuthBlockTable_DE - MOAIDTransformAuthBlockTable_EN +

diff --git a/id/server/data/deploy/conf/moa-id/SampleMOAWIDConfigurationProxy.xml b/id/server/data/deploy/conf/moa-id/SampleMOAWIDConfigurationProxy.xml index af92e8b67..c5350de66 100644 --- a/id/server/data/deploy/conf/moa-id/SampleMOAWIDConfigurationProxy.xml +++ b/id/server/data/deploy/conf/moa-id/SampleMOAWIDConfigurationProxy.xml @@ -18,8 +18,9 @@ + - +

+ MOAIDTransformAuthBlockTable_DE - MOAIDTransformAuthBlockTable_EN +

diff --git a/id/server/data/deploy/conf/moa-id/SampleMOAWIDConfiguration_withTestBKs.xml b/id/server/data/deploy/conf/moa-id/SampleMOAWIDConfiguration_withTestBKs.xml index ed2cdd07c..184ad442d 100644 --- a/id/server/data/deploy/conf/moa-id/SampleMOAWIDConfiguration_withTestBKs.xml +++ b/id/server/data/deploy/conf/moa-id/SampleMOAWIDConfiguration_withTestBKs.xml @@ -18,8 +18,9 @@ + - +

MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten + MOAIDTransformAuthBlockTable_DE - MOAIDTransformAuthBlockTable_EN +

diff --git a/id/server/data/deploy/conf/moa-id/SampleMOAWIDConfiguration_withTestBKsProxy.xml b/id/server/data/deploy/conf/moa-id/SampleMOAWIDConfiguration_withTestBKsProxy.xml index f7ed53249..41b03ad58 100644 --- a/id/server/data/deploy/conf/moa-id/SampleMOAWIDConfiguration_withTestBKsProxy.xml +++ b/id/server/data/deploy/conf/moa-id/SampleMOAWIDConfiguration_withTestBKsProxy.xml @@ -18,8 +18,9 @@ + - +

MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten + MOAIDTransformAuthBlockTable_DE - MOAIDTransformAuthBlockTable_EN +

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java index 01c6a512f..103274c29 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java @@ -15,10 +15,14 @@ */ package at.gv.egovernment.moa.id.auth; +import iaik.ixsil.exceptions.UtilsException; +import iaik.ixsil.util.Utils; import iaik.pki.PKIException; import iaik.x509.X509Certificate; import java.io.File; +import java.io.FileInputStream; +import java.io.FileNotFoundException; import java.io.IOException; import java.security.GeneralSecurityException; import java.security.Principal; @@ -32,10 +36,13 @@ import java.util.Map; import java.util.Set; import java.util.Vector; +import javax.xml.parsers.ParserConfigurationException; import javax.xml.transform.TransformerException; import org.w3c.dom.Element; +import org.xml.sax.SAXException; +import HTTPClient.Util; import at.gv.egovernment.moa.id.AuthenticationException; import at.gv.egovernment.moa.id.BuildException; import at.gv.egovernment.moa.id.ParseException; @@ -431,6 +438,7 @@ public class AuthenticationServer implements MOAIDAuthConstants { throw new AuthenticationException("auth.10", new Object[] { REQ_VERIFY_IDENTITY_LINK, PARAM_SESSIONID}); String xmlInfoboxReadResponse = (String)infoboxReadResponseParameters.get(PARAM_XMLRESPONSE); + if (isEmpty(xmlInfoboxReadResponse)) throw new AuthenticationException("auth.10", new Object[] { REQ_VERIFY_IDENTITY_LINK, PARAM_XMLRESPONSE}); @@ -455,8 +463,30 @@ public class AuthenticationServer implements MOAIDAuthConstants { Logger.info("Unbekannter Infoboxbezeichner. Versuche Anmeldung als ausl�ndische eID."); return null; } - - // parses the + + // for testing new identity link certificate +// xmlInfoboxReadResponse = null; +// try { +// File file = new File("c:/temp/xxxMuster-new-cert_infobox.xml"); +// FileInputStream fis; +// +// fis = new FileInputStream(file); +// byte[] array = Utils.readFromInputStream(fis); +// +// xmlInfoboxReadResponse = new String(array); +// System.out.println(xmlInfoboxReadResponse); +// +// } catch (FileNotFoundException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } catch (UtilsException e) { +// // TODO Auto-generated catch block +// e.printStackTrace(); +// } + + + + // parses the IdentityLink identityLink = new InfoboxReadResponseParser(xmlInfoboxReadResponse).parseIdentityLink(); // validates the identity link diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthConstants.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthConstants.java index 88859dc3f..84f8f6985 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthConstants.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthConstants.java @@ -86,7 +86,10 @@ public interface MOAIDAuthConstants { */ public static final String[] IDENTITY_LINK_SIGNERS_WITHOUT_OID = new String[] {"T=Dr.,CN=Nikolaus Schwab,O=BM f. Inneres i.A. des gf. Mitgieds der Datenschutzkommission", - "T=Dr.,CN=Nikolaus Schwab,O=BM f. Inneres i.A. des gf. Mitglieds der Datenschutzkommission"}; + "T=Dr.,CN=Nikolaus Schwab,O=BM f. Inneres i.A. des gf. Mitglieds der Datenschutzkommission", + "EMAIL=dsk@dsk.gv.at,serialNumber=325928323998,CN=Signaturservice Datenschutzkommission,OU=Stammzahlregisterbehoerde,O=Datenschutzkommission,C=AT"}; + //"E=dsk@dsk.gv.at,SERIALNUMBER=325928323998,CN=Signaturservice Datenschutzkommission,OU=Stammzahlregisterbehoerde,O=Datenschutzkommission,C=AT"}; + /** the number of the certifcate extension "Eigenschaft zur Ausstellung von Personenbindungen" */ public static final String IDENTITY_LINK_SIGNER_OID_NUMBER = "1.2.40.0.10.1.7.1"; /** diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/VerifyXMLSignatureRequestBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/VerifyXMLSignatureRequestBuilder.java index a14d0325f..2c97f01ae 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/VerifyXMLSignatureRequestBuilder.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/VerifyXMLSignatureRequestBuilder.java @@ -131,6 +131,7 @@ public class VerifyXMLSignatureRequestBuilder { Element referenceInfoElem = requestDoc_.createElementNS(MOA_NS_URI, "ReferenceInfo"); signatureManifestCheckParamsElem.appendChild(referenceInfoElem); Element[] dsigTransforms = identityLink.getDsigReferenceTransforms(); + for (int i = 0; i < dsigTransforms.length; i++) { Element verifyTransformsInfoProfileElem = requestDoc_.createElementNS(MOA_NS_URI, "VerifyTransformsInfoProfile"); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyIdentityLinkServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyIdentityLinkServlet.java index 1fc5013f3..ba3e2141b 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyIdentityLinkServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/VerifyIdentityLinkServlet.java @@ -106,6 +106,8 @@ public class VerifyIdentityLinkServlet extends AuthServlet { AuthenticationSession session = AuthenticationServer.getSession(sessionID); String createXMLSignatureRequestOrRedirect = AuthenticationServer.getInstance().verifyIdentityLink(sessionID, parameters); + + Logger.debug(createXMLSignatureRequestOrRedirect); if (createXMLSignatureRequestOrRedirect == null) { // no identity link found diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/validator/IdentityLinkValidator.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/validator/IdentityLinkValidator.java index 1c9b66124..baaa21db2 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/validator/IdentityLinkValidator.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/validator/IdentityLinkValidator.java @@ -155,6 +155,9 @@ public class IdentityLinkValidator implements Constants { if (attributeValue==null) attributeValue = (Element) XPathUtils.selectSingleNode((Element)nl.item(i), nSMap, SAML + "AttributeValue/" + ECDSA + "ECDSAKeyValue"); + if (attributeValue==null) + attributeValue = + (Element) XPathUtils.selectSingleNode((Element)nl.item(i), nSMap, SAML + "AttributeValue/" + DSIG + "DSAKeyValue"); if (attributeValue == null) throw new ValidateException("validator.02", null); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/validator/VerifyXMLSignatureResponseValidator.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/validator/VerifyXMLSignatureResponseValidator.java index bc7db72f4..affa95c2b 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/validator/VerifyXMLSignatureResponseValidator.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/validator/VerifyXMLSignatureResponseValidator.java @@ -124,6 +124,7 @@ public class VerifyXMLSignatureResponseValidator { catch (RFC2253NameParserException e) { throw new ValidateException("validator.17", null); } + System.out.println("subjectDN: " + subjectDN); // check the authorisation to sign the identity link if (!identityLinkSignersSubjectDNNames.contains(subjectDN)) { // subject DN check failed, try OID check: -- cgit v1.2.3 From 25e5ba1011151d2395facbee5f2afd22e3ea1929 Mon Sep 17 00:00:00 2001 From: kstranacher Date: Wed, 28 Jul 2010 07:01:59 +0000 Subject: git-svn-id: https://joinup.ec.europa.eu/svn/moa-idspss/trunk@1178 d688527b-c9ab-4aba-bd8d-4036d912da1d --- .../src/main/webapp/BKAuswahl-MOA-Template-Howto.pdf | Bin 0 -> 190907 bytes .../src/main/webapp/BKAuswahl-Musterseiten-Howto.pdf | Bin 178626 -> 0 bytes id/server/auth/src/main/webapp/index.html | 8 ++++---- 3 files changed, 4 insertions(+), 4 deletions(-) create mode 100644 id/server/auth/src/main/webapp/BKAuswahl-MOA-Template-Howto.pdf delete mode 100644 id/server/auth/src/main/webapp/BKAuswahl-Musterseiten-Howto.pdf (limited to 'id/server/auth/src/main/webapp') diff --git a/id/server/auth/src/main/webapp/BKAuswahl-MOA-Template-Howto.pdf b/id/server/auth/src/main/webapp/BKAuswahl-MOA-Template-Howto.pdf new file mode 100644 index 000000000..021e15b94 Binary files /dev/null and b/id/server/auth/src/main/webapp/BKAuswahl-MOA-Template-Howto.pdf differ diff --git a/id/server/auth/src/main/webapp/BKAuswahl-Musterseiten-Howto.pdf b/id/server/auth/src/main/webapp/BKAuswahl-Musterseiten-Howto.pdf deleted file mode 100644 index 1c0662f15..000000000 Binary files a/id/server/auth/src/main/webapp/BKAuswahl-Musterseiten-Howto.pdf and /dev/null differ diff --git a/id/server/auth/src/main/webapp/index.html b/id/server/auth/src/main/webapp/index.html index 1cb5030a6..a49d8c6bc 100644 --- a/id/server/auth/src/main/webapp/index.html +++ b/id/server/auth/src/main/webapp/index.html @@ -3,7 +3,7 @@ - Musterseite + MOA-Template zur Bürgerkartenauswahl (Musterseite) @@ -59,7 +59,7 @@ +

+ Information zur Anmeldung mittels elektronischer Vollmacht +

Aktivieren Sie das Kästchen "in Vertretung anmelden", + wenn Sie sich als Vertreter für eine andere Person anmelden möchten. Das Vollmachtenservice + der Stammzahlenregisterbehörde bietet Ihnen Ihre verfügbaren Vollmachten zur Auswahl an.

+ + +

Das Service zum Eintragen einer Vollmacht zwischen zwei natürlichen Personen können Sie + unter dem Hyperlink Bilaterale Vollmacht + eintragen.

+ +

Als Organwalter (gemäß § 5 Abs. 3 E-GovG) und berufsmäßige Parteinvertreter, + aktivieren Sie bitte ebenfalls das Kästchen "in Vertretung anmelden".

+ + +

Hinweis: Welche Vollmachten Ihnen bei der jeweiligen + Bürgerkartenapplikation zur Verfügung stehen, hängt vom Anwendungsbetreiber ab.

+ + @@ -197,11 +160,9 @@

- Bürgerkarte.at -

Bürgerkarte.at

- Digitales Österreich -

Digitales Österreich

A-SIT

- + +

- eine Chipkarte, die für die Verwendung als Bürgerkarte geeignet ist, wie zum Beispiel Ihre e-card, Bankomatkarte oder Signaturkarte von A-Trust -
einen Kartenleser mit den dazugehörigen Treibern
eine Bürgerkartensoftware (BKU) -

oder

- ein Mobiltelefon, das zur Nutzung als Handysignatur registriert ist.

Als Bürgerkartensoftware stehen Ihnen folgende drei Varianten zur Verfügung: -

+ Als Bürgerkartensoftware stehen folgende drei Varianten zur Verfügung: +

Lokale BKU: Diese Software wird lokal auf Ihrem Computer installiert. Die Software finden sie unter http://www.buergerkarte.at/download.de.php +
Lokale BKU: Diese Software wird lokal auf Ihrem Computer installiert. Die Software finden sie unter http://www.buergerkarte.at/de/voraussetzungen/software.html
Online BKU: Mit der Online BKU wird keine lokale Bürgerkartensoftware am PC benötigt. Über JAVA Technologien werden die benötigten Funktionen als Applet im Browser ausgeführt. Einzige Voraussetzung ist eine aktuelle JAVA Version (ab Java 6). -
Handysignatur: Mit der Handysignatur können Sie sich mittels ihres Mobiltelefons anmelden. Voraussetzung ist eine vorherige Registrierung. Mehr Informationen hierzu finden Sie auf: https://www.handy-signatur.at/
-
- Informationen zur Bürgerkarte finden Sie hier: +
Online-BKU: Mit der Online-BKU wird keine lokale Bürgerkartensoftware am PC benötigt. Über JAVA Technologien werden die benötigten Funktionen als Applet im Browser ausgeführt. Einzige Voraussetzung ist eine aktuelle JAVA Version (ab Java 6).
Mobile BKU: Mit der mobilen BKU können sie mittels ihres Mobiltelefons. Voraussetzung ist eine vorherige Registrierung. Mehr Informationen hierzu finden Sie auf http://www.a-trust.at/mobile/
+ Hinweis:
+ Wenn das JAVA-Applet nicht funktioniert (bei einer älteren JAVA Version als Java 6 oder bei einem nicht unterstützten Browser), müssen Sie die lokale BKU installieren und dann über die Button "Login mit Bürgerkarte" und "Lokale BKU" einsteigen. +

+
+ Informationen zur Bürgerkarte finden Sie hier: +

+
Digitales Österreich: Informationen rund um E-Government
- Bürgerkarte: Informationen zur Bürgerkarte + Bürgerkarte: Einfach verständliche Informationen zur Bürgerkarte

diff --git a/id/server/auth/src/main/webapp/template_handyBKU.html b/id/server/auth/src/main/webapp/template_handyBKU.html index 0ad73a6f3..6ccd295b2 100644 --- a/id/server/auth/src/main/webapp/template_handyBKU.html +++ b/id/server/auth/src/main/webapp/template_handyBKU.html @@ -10,10 +10,9 @@ } - -

- Falls Sie nicht automatisch weitergeleitet werden klicken Sie bitte hier: - + + + diff --git a/id/server/auth/src/main/webapp/template_localBKU.html b/id/server/auth/src/main/webapp/template_localBKU.html index f197d2c5c..e07ba5d52 100644 --- a/id/server/auth/src/main/webapp/template_localBKU.html +++ b/id/server/auth/src/main/webapp/template_localBKU.html @@ -10,10 +10,9 @@ } - + - Falls Sie nicht automatisch weitergeleitet werden klicken Sie bitte hier: - + diff --git a/id/server/auth/src/main/webapp/template_onlineBKU.html b/id/server/auth/src/main/webapp/template_onlineBKU.html index 565955538..1bb2ac236 100644 --- a/id/server/auth/src/main/webapp/template_onlineBKU.html +++ b/id/server/auth/src/main/webapp/template_onlineBKU.html @@ -10,10 +10,9 @@ } - + - Falls Sie nicht automatisch weitergeleitet werden klicken Sie bitte hier: - + diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java index a68dca65a..b8fa4f412 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java @@ -501,16 +501,19 @@ public class AuthenticationServer implements MOAIDAuthConstants { // check if an identity link was found // Errorcode 2911 von Trustdesk BKU (nicht spezifikationskonform (SL1.2)) - CharSequence se = "ErrorCode>2911".substring(0); - boolean b = xmlInfoboxReadResponse.contains(se); - if (b) { // no identity link found + //CharSequence se = "ErrorCode>2911".substring(0); + //boolean b = xmlInfoboxReadResponse.contains(se); + String se = "ErrorCode>2911"; + int b = xmlInfoboxReadResponse.indexOf(se); + if (b!=-1) { // no identity link found Logger.info("Es konnte keine Personenbindung auf der Karte gefunden werden. Versuche Anmeldung als ausl�ndische eID."); return null; } // spezifikationsgem��er (SL1.2) Errorcode se = "ErrorCode>4002"; - b = xmlInfoboxReadResponse.contains(se); - if (b) { // Unbekannter Infoboxbezeichner + //b = xmlInfoboxReadResponse.contains(se); + b = xmlInfoboxReadResponse.indexOf(se); + if (b!=-1) { // Unbekannter Infoboxbezeichner Logger.info("Unbekannter Infoboxbezeichner. Versuche Anmeldung als ausl�ndische eID."); return null; } @@ -1659,6 +1662,12 @@ public class AuthenticationServer implements MOAIDAuthConstants { Element mandatePerson = tempIdentityLink.getPrPerson(); + try { + System.out.println("MANDATE: " + DOMUtils.serializeNode(mandatePerson)); + } + catch(Exception e) { + e.printStackTrace(); + } String mandateData = null; try { OAAuthParameter oaParam = diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/IdentityLinkAssertionParser.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/IdentityLinkAssertionParser.java index 2e20f483c..cb3ed5ad9 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/IdentityLinkAssertionParser.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/IdentityLinkAssertionParser.java @@ -251,8 +251,8 @@ public class IdentityLinkAssertionParser { String familyname = XPathUtils.getElementValue(assertionElem, PERSON_FAMILY_NAME_XPATH, ""); // replace ' in name with ' - givenname = givenname.replace("'", "'"); - familyname = familyname.replace("'", "'"); + givenname = givenname.replaceAll("'", "'"); + familyname = familyname.replaceAll("'", "'"); identityLink.setGivenName(givenname); identityLink.setFamilyName(familyname); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/validator/CreateXMLSignatureResponseValidator.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/validator/CreateXMLSignatureResponseValidator.java index 49105b306..dfad29e50 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/validator/CreateXMLSignatureResponseValidator.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/validator/CreateXMLSignatureResponseValidator.java @@ -97,7 +97,7 @@ public class CreateXMLSignatureResponseValidator { throw new ValidateException("validator.32", null); } // replace ' in name with ' - issuer = issuer.replace("'", "'"); + issuer = issuer.replaceAll("'", "'"); String issueInstant = samlAssertion.getAttribute("IssueInstant"); if (!issueInstant.equals(session.getIssueInstant())) { diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/MOASecurityManagerExtended.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/MOASecurityManagerExtended.java new file mode 100644 index 000000000..ab9c01daa --- /dev/null +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/MOASecurityManagerExtended.java @@ -0,0 +1,111 @@ +package at.gv.egovernment.moa.spss; + +import java.net.InetAddress; +import java.net.UnknownHostException; +import java.util.Iterator; +import java.util.List; + +import at.gv.egovernment.moa.logging.Logger; + + +public class MOASecurityManagerExtended extends SecurityManager { + + private List blacklist; + private boolean allowExternalUris; + + public MOASecurityManagerExtended(boolean allowExternalUris, List blacklist) { + this.blacklist = blacklist; + this.allowExternalUris = allowExternalUris; + } + + + /** + * Overwrite checkConnect methods with blacklist check + */ + + public void checkConnect(String host, int port, Object context) { + Logger.debug("checkConnect: " + host + ":" + port); + if (!checkURI(host, port)) + throw new SecurityException("URI not allowed (blacklisted or external URIs generally not allowed"); + else { + Logger.debug("Perform checkConnect of given SecurityManager"); + super.checkConnect(host, port, context); + } + } + + public void checkConnect(String host, int port) { + Logger.debug("checkConnect: " + host + ":" + port); + if (!checkURI(host, port)) + throw new SecurityException("URI not allowed (blacklisted or external URIs generally not allowed"); + else { + Logger.debug("Perform checkConnect of given SecurityManager"); + super.checkConnect(host, port); + } + } + + private boolean checkURI(String host, int port) { + if (allowExternalUris) { + Iterator it = blacklist.iterator(); + while (it.hasNext()) { + String[] array = (String[])it.next(); + String bhost = array[0]; + String bport = array[1]; + if (bport == null) { + // check only host + if (bhost.equalsIgnoreCase(host)) { + Logger.debug("Security check: " + host + " blacklisted"); + return false; + } + } + else { + // check host and port + int iport = new Integer(bport).intValue(); + if (bhost.equalsIgnoreCase(host) && (iport == port)) { + Logger.debug("Security check: " + host + ":" + port + " blacklisted"); + return false; + } + + } + } + + Logger.debug("Security check: " + host + ":" + port + " allowed"); + return true; + } + else { + String localhost = getLocalhostName(); + if (host.equalsIgnoreCase(localhost) || host.equalsIgnoreCase("localhost") || host.equalsIgnoreCase("127.0.0.1") ) { + Logger.debug("Security check: localhost name allowed"); + return true; + } + + Logger.debug("Security check: " + host + ":" + port + " not allowed (external URIs not allowed)"); + return false; + } + } + private String getLocalhostName() { + try { + // save current SecurityManager + SecurityManager sm = System.getSecurityManager(); + // set System SecurityManager null (needed as java.net.InetAddress.getLocalHost call SecurityManager.checkConnect --> leads to endless loop) + System.setSecurityManager(null); + + InetAddress localhostaddress = InetAddress.getLocalHost(); + String localhost = localhostaddress.getHostName(); + + // set previously saved SecurityManager + System.setSecurityManager(sm); + + return localhost; + + } + catch (UnknownHostException e) { + Logger.debug("UnknownHostExeption: Returns \"localhost\" as name for localhost"); + return "localhost"; + } + } + + + /** + * Don't overwrite other methods + */ +} diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/MOASecurityManagerSimple.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/MOASecurityManagerSimple.java new file mode 100644 index 000000000..361a75e4c --- /dev/null +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/MOASecurityManagerSimple.java @@ -0,0 +1,165 @@ +package at.gv.egovernment.moa.spss; + +import java.io.FileDescriptor; +import java.net.InetAddress; +import java.net.UnknownHostException; +import java.security.Permission; +import java.util.Iterator; +import java.util.List; + +import at.gv.egovernment.moa.logging.Logger; + +public class MOASecurityManagerSimple extends SecurityManager { + + private List blacklist; + private boolean allowExternalUris; + + + public MOASecurityManagerSimple(boolean allowExternalUris, List blacklist) { + this.blacklist = blacklist; + this.allowExternalUris = allowExternalUris; + } + + /** + * Overwrite checkConnect methods with blacklist check + */ + + public void checkConnect(String host, int port, Object context) { + //Logger.debug("checkConnect: " + host + ":" + port); + if (!checkURI(host, port)) + throw new SecurityException("URI not allowed (blacklisted or external URIs generally not allowed"); + } + + public void checkConnect(String host, int port) { + //Logger.debug("checkConnect: " + host + ":" + port); + if (!checkURI(host, port)) + throw new SecurityException("URI not allowed (blacklisted or external URIs generally not allowed"); + } + + private boolean checkURI(String host, int port) { + if (allowExternalUris) { + Iterator it = blacklist.iterator(); + while (it.hasNext()) { + String[] array = (String[])it.next(); + String bhost = array[0]; + String bport = array[1]; + if (bport == null) { + // check only host + if (bhost.equalsIgnoreCase(host)) { + //Logger.debug("Security check: " + host + " blacklisted"); + return false; + } + } + else { + // check host and port + int iport = new Integer(bport).intValue(); + if (bhost.equalsIgnoreCase(host) && (iport == port)) { + //Logger.debug("Security check: " + host + ":" + port + " blacklisted"); + return false; + } + + } + } + + //Logger.debug("Security check: " + host + ":" + port + " allowed"); + return true; + } + else { + String localhost = getLocalhostName(); + if (host.equalsIgnoreCase(localhost) || host.equalsIgnoreCase("localhost") || host.equalsIgnoreCase("127.0.0.1") ) { + //Logger.debug("Security check: localhost name allowed"); + return true; + } + + //Logger.debug("Security check: " + host + ":" + port + " not allowed (external URIs not allowed)"); + return false; + } + } + + private String getLocalhostName() { + try { + // save current SecurityManager + SecurityManager sm = System.getSecurityManager(); + // set System SecurityManager null (needed as java.net.InetAddress.getLocalHost call SecurityManager.checkConnect --> leads to endless loop) + System.setSecurityManager(null); + + InetAddress localhostaddress = InetAddress.getLocalHost(); + String localhost = localhostaddress.getHostName(); + + // set previously saved SecurityManager + System.setSecurityManager(sm); + + return localhost; + + } + catch (UnknownHostException e) { + //Logger.debug("UnknownHostExeption: Returns \"localhost\" as name for localhost"); + return "localhost"; + } + } + + + /** + * Overwrite all other methods by doing nothing (as no SecurityManager is set initially) + */ + + public void checkAccept(String host, int port) { + } + public void checkAccess(Thread t) { + } + public void checkAccess(ThreadGroup g) { + } + public void checkAwtEventQueueAccess() { + } + public void checkCreateClassLoader() { + } + public void checkDelete(String file) { + } + public void checkExec(String cmd) { + } + public void checkExit(int status) { + } + public void checkLink(String lib) { + } + public void checkListen(int port) { + } + public void checkMemberAccess(Class arg0, int arg1) { + } + public void checkMulticast(InetAddress maddr, byte ttl) { + } + public void checkMulticast(InetAddress maddr) { + } + public void checkPackageAccess(String pkg) { + } + public void checkPackageDefinition(String pkg) { + } + public void checkPermission(Permission perm, Object context) { + } + public void checkPermission(Permission perm) { + } + public void checkPrintJobAccess() { + } + public void checkPropertiesAccess() { + } + public void checkPropertyAccess(String key) { + } + public void checkRead(FileDescriptor fd) { + } + public void checkRead(String file, Object context) { + } + public void checkRead(String file) { + } + public void checkSecurityAccess(String target) { + } + public void checkSetFactory() { + } + public void checkSystemClipboardAccess() { + } + public void checkWrite(FileDescriptor fd) { + } + public void checkWrite(String file) { + } + + + +} diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java index 9078ecbfa..abc781303 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java @@ -24,6 +24,14 @@ package at.gv.egovernment.moa.spss.server.config; +import iaik.asn1.structures.Name; +import iaik.ixsil.exceptions.URIException; +import iaik.ixsil.util.URI; +import iaik.pki.pathvalidation.ChainingModes; +import iaik.pki.revocation.RevocationSourceTypes; +import iaik.utils.RFC2253NameParser; +import iaik.utils.RFC2253NameParserException; + import java.io.File; import java.io.FileInputStream; import java.io.IOException; @@ -45,25 +53,15 @@ import javax.xml.parsers.ParserConfigurationException; import org.w3c.dom.Attr; import org.w3c.dom.Element; import org.w3c.dom.traversal.NodeIterator; - import org.xml.sax.SAXException; -import iaik.asn1.structures.Name; -import iaik.ixsil.exceptions.URIException; -import iaik.ixsil.util.URI; -import iaik.pki.pathvalidation.ChainingModes; -import iaik.pki.revocation.RevocationSourceTypes; -import iaik.utils.RFC2253NameParser; -import iaik.utils.RFC2253NameParserException; - import at.gv.egovernment.moa.logging.LogMsg; import at.gv.egovernment.moa.logging.Logger; +import at.gv.egovernment.moa.spss.util.MessageProvider; import at.gv.egovernment.moa.util.Constants; import at.gv.egovernment.moa.util.DOMUtils; import at.gv.egovernment.moa.util.XPathUtils; -import at.gv.egovernment.moa.spss.util.MessageProvider; - /** * A class that builds configuration data from a DOM based representation. * @@ -103,6 +101,14 @@ public class ConfigurationPartsBuilder { private static final String HARDWARE_CRYPTO_MODULE_XPATH = ROOT + CONF + "Common/" + CONF + "HardwareCryptoModule"; + private static final String PERMIT_EXTERNAL_URIS_XPATH = + ROOT + CONF + "Common/" + + CONF + "PermitExternalUris"; + private static final String BLACK_LIST_URIS_XPATH = + ROOT + CONF + "Common/" + + CONF + "PermitExternalUris/" + + CONF + "BlackListUri"; + private static final String HARDWARE_KEY_XPATH = ROOT + CONF + "SignatureCreation/" + CONF + "KeyModules/" @@ -370,6 +376,52 @@ public class ConfigurationPartsBuilder { return modules; } + + /** + * + * @return + */ + public boolean allowExternalUris() { + Element permitExtUris = (Element)XPathUtils.selectSingleNode(getConfigElem(), PERMIT_EXTERNAL_URIS_XPATH); + + // if PermitExternalUris element does not exist - don't allow external uris + if (permitExtUris == null) + return false; + else + return true; + + } + + /** + * + * @return + */ + public List buildPermitExternalUris() { + if (!allowExternalUris()) + return null; + + List blacklist = new ArrayList(); + + NodeIterator permitExtIter = XPathUtils.selectNodeIterator( + getConfigElem(), + BLACK_LIST_URIS_XPATH); + + Element permitExtElem = null; + while ((permitExtElem = (Element) permitExtIter.nextNode()) != null) { + String host = getElementValue(permitExtElem, CONF + "Host", null); + String port = getElementValue(permitExtElem, CONF + "Port", null); + + //System.out.println("Host:Port = " + host + ":" + port); + + String array[] = new String[2]; + array[0] = host; + array[1] = port; + blacklist.add(array); + + } + + return blacklist; + } /** * Build the configured hardware keys. diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java index 51ddf0811..9e0a7fd53 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java @@ -33,7 +33,9 @@ import java.io.File; import java.io.FileInputStream; import java.io.IOException; import java.math.BigInteger; +import java.net.InetAddress; import java.net.URL; +import java.net.UnknownHostException; import java.security.Principal; import java.security.cert.X509Certificate; import java.util.ArrayList; @@ -46,6 +48,8 @@ import org.w3c.dom.Element; import at.gv.egovernment.moa.logging.LogMsg; import at.gv.egovernment.moa.logging.Logger; +import at.gv.egovernment.moa.spss.MOASecurityManagerExtended; +import at.gv.egovernment.moa.spss.MOASecurityManagerSimple; import at.gv.egovernment.moa.spss.util.MessageProvider; import at.gv.egovernment.moa.util.DOMUtils; @@ -239,6 +243,16 @@ public class ConfigurationProvider */ private Map crlRetentionIntervals; + /** + * Indicates wether external URIs are allowed or not + */ + private boolean allowExternalUris_; + + /** + * A List of black listed URIs (host and port) + */ + private List blackListedUris_; + /** * Return the single instance of configuration data. * @@ -354,6 +368,13 @@ public class ConfigurationProvider warnings = new ArrayList(builder.getWarnings()); permitFileURIs = builder.getPermitFileURIs(); crlRetentionIntervals = builder.getCrlRetentionIntervals(); + + allowExternalUris_= builder.allowExternalUris(); + + if (allowExternalUris_) + blackListedUris_ = builder.buildPermitExternalUris(); + else + blackListedUris_ = null; // Set set = crlRetentionIntervals.entrySet(); // Iterator i = set.iterator(); @@ -361,8 +382,37 @@ public class ConfigurationProvider // Map.Entry me = (Map.Entry)i.next(); // System.out.println("Key: " + me.getKey() + " - Value: " + me.getValue() ); // } + + + // set SecurityManager for permitting/disallowing external URIs + SecurityManager sm = System.getSecurityManager(); + if (sm == null) { + // no security manager exists - create a new one + //Logger.debug(new LogMsg("Create new MOASecurityManagerSimple")); + sm = new MOASecurityManagerSimple(allowExternalUris_, blackListedUris_); + + + //Logger.debug(new LogMsg("Set the new MOASecurityManagerSimple")); + System.setSecurityManager(sm); + + } + else { + String classname = sm.getClass().getName(); + if (!classname.equalsIgnoreCase("at.gv.egovernment.moa.spss.MOASecurityManagerSimple") && + !classname.equalsIgnoreCase("at.gv.egovernment.moa.spss.MOASecurityManagerExtended")) { + // if SecurityManager is not already a MOASecurityManager + + // Logger.debug(new LogMsg("Create new MOASecurityManagerExtended (including existing SecurityManager)")); + sm = new MOASecurityManagerExtended(allowExternalUris_, blackListedUris_); + + //Logger.debug(new LogMsg("Set the new MOASecurityManagerSimple")); + System.setSecurityManager(sm); + } + //Logger.debug(new LogMsg("No new MOASecurityManager instantiated")); + } + } catch (Throwable t) { throw new ConfigurationException("config.11", null, t); } finally { @@ -637,8 +687,8 @@ public class ConfigurationProvider MessageProvider msg = MessageProvider.getInstance(); Logger.info(new LogMsg(msg.getMessage(messageId, parameters))); } - - /** + + /** * Log a warning. * * @param messageId The message ID. -- cgit v1.2.3 From fb449b592d265d880b5f44dd619748fdfe0e734f Mon Sep 17 00:00:00 2001 From: kstranacher Date: Mon, 20 Feb 2012 09:36:05 +0000 Subject: Minor updates for 1.5.1 release git-svn-id: https://joinup.ec.europa.eu/svn/moa-idspss/trunk@1265 d688527b-c9ab-4aba-bd8d-4036d912da1d --- .../at/gv/egovernment/moa/util/XPathException.java | 6 +- id/history.txt | 3 +- id/readme_1.5.1.txt | 3 +- id/server/auth/src/main/webapp/iframeHandyBKU.html | 18 +-- .../auth/src/main/webapp/iframeOnlineBKU.html | 18 +-- id/server/auth/src/main/webapp/index.html | 110 +++++++++++------- id/server/auth/src/main/webapp/info_bk.html | 38 ++++--- .../auth/src/main/webapp/template_handyBKU.html | 7 +- .../auth/src/main/webapp/template_localBKU.html | 5 +- .../auth/src/main/webapp/template_onlineBKU.html | 5 +- id/server/doc/moa_id/id-anwendung_1.htm | 4 +- .../moa/id/AuthenticationException.java | 4 + .../at/gv/egovernment/moa/id/BuildException.java | 5 + .../moa/id/ECDSAConverterException.java | 5 + .../at/gv/egovernment/moa/id/MOAIDException.java | 6 +- .../at/gv/egovernment/moa/id/ParseException.java | 5 + .../at/gv/egovernment/moa/id/ServiceException.java | 5 + .../moa/id/auth/AuthenticationServer.java | 6 - .../moa/id/auth/WrongParametersException.java | 5 + .../moa/id/auth/servlet/AuthServlet.java | 5 + .../moa/id/auth/servlet/ConfigurationServlet.java | 5 + .../moa/id/auth/servlet/GetForeignIDServlet.java | 8 +- .../id/auth/servlet/GetMISSessionIDServlet.java | 7 +- .../moa/id/auth/servlet/SelectBKUServlet.java | 5 + .../auth/servlet/StartAuthenticationServlet.java | 6 + .../servlet/VerifyAuthenticationBlockServlet.java | 5 + .../id/auth/servlet/VerifyCertificateServlet.java | 123 ++------------------- .../id/auth/servlet/VerifyIdentityLinkServlet.java | 5 + .../moa/id/auth/validator/ValidateException.java | 5 + .../moa/id/auth/validator/parep/ParepUtils.java | 1 - .../id/auth/validator/parep/ParepValidator.java | 1 - .../parep/client/szrgw/SZRGWClientException.java | 7 +- .../moa/id/config/ConfigurationException.java | 5 + .../id/proxy/DefaultLoginParameterResolver.java | 7 +- .../moa/id/proxy/ElakConnectionBuilder.java | 4 - .../id/proxy/LoginParameterResolverException.java | 5 + .../moa/id/proxy/NotAllowedException.java | 5 + .../moa/id/proxy/servlet/ConfigurationServlet.java | 5 + .../moa/id/proxy/servlet/ProxyException.java | 5 + .../moa/id/proxy/servlet/ProxyServlet.java | 6 +- .../moa/id/util/ParamValidatorUtils.java | 39 ++++--- .../id/util/client/mis/simple/MISSimpleClient.java | 2 - .../parser/IdentityLinkAssertionParserTest.java | 6 +- spss/server/history.txt | 2 +- .../moa/spss/MOAApplicationException.java | 5 + .../at/gv/egovernment/moa/spss/MOAException.java | 6 +- .../egovernment/moa/spss/MOARuntimeException.java | 6 +- .../egovernment/moa/spss/MOASystemException.java | 5 + .../spss/server/config/ConfigurationException.java | 5 + .../spss/server/invoke/IaikExceptionMapper.java | 8 +- .../moa/spss/server/service/AxisHandler.java | 7 +- .../spss/server/service/ConfigurationServlet.java | 6 +- .../moa/spss/server/service/ServiceUtils.java | 1 - 53 files changed, 313 insertions(+), 268 deletions(-) (limited to 'id/server/auth/src/main/webapp') diff --git a/common/src/main/java/at/gv/egovernment/moa/util/XPathException.java b/common/src/main/java/at/gv/egovernment/moa/util/XPathException.java index fae91d035..206245a68 100644 --- a/common/src/main/java/at/gv/egovernment/moa/util/XPathException.java +++ b/common/src/main/java/at/gv/egovernment/moa/util/XPathException.java @@ -34,7 +34,11 @@ import java.io.PrintWriter; * @version $Id$ */ public class XPathException extends RuntimeException { - /** The wrapped exception. */ + /** + * + */ + private static final long serialVersionUID = 1736311265333034392L; +/** The wrapped exception. */ private Throwable wrapped; /** diff --git a/id/history.txt b/id/history.txt index b8122f762..68b326ff6 100644 --- a/id/history.txt +++ b/id/history.txt @@ -14,10 +14,9 @@ Version MOA-ID 1.5.1: - f�r Online-Vollmachten - Fixer Target-Parameter f�r Online-Applikation konfigurierbar - Optionaler Parameter zur Angabe der IssueInstant im UTC Format in der SAML-Assertion -- Weiterer optionaler Parameter sourceID beim MOA-ID Aufruf - Update der Standard Trustprofile - Libraries aktualisiert: - iaik-moa: Version 1.31 + iaik-moa: Version 1.32 iaik-ixsil: Version 1.2.2.5 Axis: Version 1.0_IAIK ===== diff --git a/id/readme_1.5.1.txt b/id/readme_1.5.1.txt index dc7df1837..457391aec 100644 --- a/id/readme_1.5.1.txt +++ b/id/readme_1.5.1.txt @@ -18,10 +18,9 @@ gleichen Verzeichnis): - f�r Online-Vollmachten - Fixer Target-Parameter f�r Online-Applikation konfigurierbar - Optionaler Parameter zur Angabe der IssueInstant im UTC Format in der SAML-Assertion -- Weiterer optionaler Parameter sourceID beim MOA-ID Aufruf - Update der Standard Trustprofile - Libraries aktualisiert: - iaik-moa: Version 1.31 + iaik-moa: Version 1.32 iaik-ixsil: Version 1.2.2.5 Axis: Version 1.0_IAIK diff --git a/id/server/auth/src/main/webapp/iframeHandyBKU.html b/id/server/auth/src/main/webapp/iframeHandyBKU.html index a7e541b85..0f6e1e282 100644 --- a/id/server/auth/src/main/webapp/iframeHandyBKU.html +++ b/id/server/auth/src/main/webapp/iframeHandyBKU.html @@ -8,13 +8,11 @@ - - - Bitte warten... - - + + Bitte warten... + - - - +

\ No newline at end of file diff --git a/id/server/auth/src/main/webapp/iframeOnlineBKU.html b/id/server/auth/src/main/webapp/iframeOnlineBKU.html index bb69bb5d6..a039005e0 100644 --- a/id/server/auth/src/main/webapp/iframeOnlineBKU.html +++ b/id/server/auth/src/main/webapp/iframeOnlineBKU.html @@ -8,20 +8,16 @@ - Bitte warten... - + Bitte warten... - +

\ No newline at end of file diff --git a/id/server/auth/src/main/webapp/index.html b/id/server/auth/src/main/webapp/index.html index d78f01f2a..533f2830a 100644 --- a/id/server/auth/src/main/webapp/index.html +++ b/id/server/auth/src/main/webapp/index.html @@ -11,13 +11,11 @@

@@ -137,14 +178,10 @@

- - @@ -160,9 +197,11 @@

- Bürgerkarte.at

Bürgerkarte.at

- Digitales Österreich

Digitales Österreich

A-SIT

- -

- +

- eine Chipkarte, die für die Verwendung als Bürgerkarte geeignet ist, wie zum Beispiel Ihre e-card, Bankomatkarte oder Signaturkarte von a-trust oder ein Mobiltelefon, das zur Nutzung als Handy BKU (Bürgerkartenumgebung) registriert ist. -
einen Kartenleser mit den dazugehörigen Treibern
eine Bürgerkartensoftware (BKU) +

oder

+ ein Mobiltelefon, das zur Nutzung als Handysignatur registriert ist.

- Als Bürgerkartensoftware stehen folgende drei Varianten zur Verfügung: -

Als Bürgerkartensoftware stehen Ihnen folgende drei Varianten zur Verfügung: +

Lokale BKU: Diese Software wird lokal auf Ihrem Computer installiert. Die Software finden sie unter http://www.buergerkarte.at/de/voraussetzungen/software.html +
Lokale BKU: Diese Software wird lokal auf Ihrem Computer installiert. Die Software finden sie unter http://www.buergerkarte.at/download.de.php
Online-BKU: Mit der Online-BKU wird keine lokale Bürgerkartensoftware am PC benötigt. Über JAVA Technologien werden die benötigten Funktionen als Applet im Browser ausgeführt. Einzige Voraussetzung ist eine aktuelle JAVA Version (ab Java 6). +
Online BKU: Mit der Online BKU wird keine lokale Bürgerkartensoftware am PC benötigt. Über JAVA Technologien werden die benötigten Funktionen als Applet im Browser ausgeführt. Einzige Voraussetzung ist eine aktuelle JAVA Version (ab Java 6). +
Handysignatur: Mit der Handysignatur können Sie sich mittels ihres Mobiltelefons anmelden. Voraussetzung ist eine vorherige Registrierung. Mehr Informationen hierzu finden Sie auf: https://www.handy-signatur.at/
+
+ Informationen zur Bürgerkarte finden Sie hier:
Mobile BKU: Mit der mobilen BKU können sie mittels ihres Mobiltelefons. Voraussetzung ist eine vorherige Registrierung. Mehr Informationen hierzu finden Sie auf http://www.a-trust.at/mobile/
- Hinweis:
- Wenn das JAVA-Applet nicht funktioniert (bei einer älteren JAVA Version als Java 6 oder bei einem nicht unterstützten Browser), müssen Sie die lokale BKU installieren und dann über die Button "Login mit Bürgerkarte" und "Lokale BKU" einsteigen. -

-
- Informationen zur Bürgerkarte finden Sie hier: -

+
Digitales Österreich: Informationen rund um E-Government
- Bürgerkarte: Einfach verständliche Informationen zur Bürgerkarte + Bürgerkarte: Informationen zur Bürgerkarte

diff --git a/id/server/auth/src/main/webapp/template_handyBKU.html b/id/server/auth/src/main/webapp/template_handyBKU.html index 6ccd295b2..0ad73a6f3 100644 --- a/id/server/auth/src/main/webapp/template_handyBKU.html +++ b/id/server/auth/src/main/webapp/template_handyBKU.html @@ -10,9 +10,10 @@ } - -

- + + + Falls Sie nicht automatisch weitergeleitet werden klicken Sie bitte hier: + diff --git a/id/server/auth/src/main/webapp/template_localBKU.html b/id/server/auth/src/main/webapp/template_localBKU.html index e07ba5d52..f197d2c5c 100644 --- a/id/server/auth/src/main/webapp/template_localBKU.html +++ b/id/server/auth/src/main/webapp/template_localBKU.html @@ -10,9 +10,10 @@ } - + - + Falls Sie nicht automatisch weitergeleitet werden klicken Sie bitte hier: + diff --git a/id/server/auth/src/main/webapp/template_onlineBKU.html b/id/server/auth/src/main/webapp/template_onlineBKU.html index 1bb2ac236..565955538 100644 --- a/id/server/auth/src/main/webapp/template_onlineBKU.html +++ b/id/server/auth/src/main/webapp/template_onlineBKU.html @@ -10,9 +10,10 @@ } - + - + Falls Sie nicht automatisch weitergeleitet werden klicken Sie bitte hier: + diff --git a/id/server/doc/moa_id/id-anwendung_1.htm b/id/server/doc/moa_id/id-anwendung_1.htm index 561f3f556..dfc0ecd32 100644 --- a/id/server/doc/moa_id/id-anwendung_1.htm +++ b/id/server/doc/moa_id/id-anwendung_1.htm @@ -92,10 +92,10 @@ StartAuthentication?Target=<geschäftsbereich> useMandate=<true/false> optional; Gibt an ob eine Anmeldung im Online-Vollmachten-Modus durchgeführt werden soll (=true) oder nicht (=false); - +

diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/AuthenticationException.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/AuthenticationException.java index a8d30a22f..ae4c5fd1e 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/AuthenticationException.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/AuthenticationException.java @@ -34,6 +34,10 @@ package at.gv.egovernment.moa.id; public class AuthenticationException extends MOAIDException { /** + * + */ + private static final long serialVersionUID = 263160314137775182L; +/** * Constructor for AuthenticationException. * @param messageId */ diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/BuildException.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/BuildException.java index 298b9b9cc..c2ef9be6f 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/BuildException.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/BuildException.java @@ -34,6 +34,11 @@ package at.gv.egovernment.moa.id; public class BuildException extends MOAIDException { /** + * + */ + private static final long serialVersionUID = 5485716047459933845L; + +/** * Constructor for BuildException. * @param messageId * @param parameters diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/ECDSAConverterException.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/ECDSAConverterException.java index 13f5f9863..c7c9e3d07 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/ECDSAConverterException.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/ECDSAConverterException.java @@ -34,6 +34,11 @@ package at.gv.egovernment.moa.id; public class ECDSAConverterException extends MOAIDException { /** + * + */ + private static final long serialVersionUID = 4410043097831285005L; + +/** * Constructor for ECDSAConverterException. * @param messageId * @param parameters diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/MOAIDException.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/MOAIDException.java index f86e37972..54b5351de 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/MOAIDException.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/MOAIDException.java @@ -48,7 +48,11 @@ import at.gv.egovernment.moa.util.Constants; * @version $Id$ */ public class MOAIDException extends Exception { - /** message ID */ + /** + * + */ + private static final long serialVersionUID = -1507246171708083912L; +/** message ID */ private String messageId; /** wrapped exception */ private Throwable wrapped; diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/ParseException.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/ParseException.java index 999b64c10..eac65d14f 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/ParseException.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/ParseException.java @@ -34,6 +34,11 @@ package at.gv.egovernment.moa.id; public class ParseException extends MOAIDException { /** + * + */ + private static final long serialVersionUID = -1057863353991948754L; + +/** * Constructor for ParseException. * @param messageId * @param parameters diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/ServiceException.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/ServiceException.java index de56d63a9..8ba23705e 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/ServiceException.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/ServiceException.java @@ -34,6 +34,11 @@ package at.gv.egovernment.moa.id; public class ServiceException extends MOAIDException { /** + * + */ + private static final long serialVersionUID = 30082718911952186L; + +/** * Constructor for ServiceException. * @param messageId * @param parameters diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java index bf35b31f2..49d421f8e 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/AuthenticationServer.java @@ -24,15 +24,11 @@ package at.gv.egovernment.moa.id.auth; -import iaik.ixsil.exceptions.UtilsException; -import iaik.ixsil.util.Utils; import iaik.pki.PKIException; import iaik.x509.X509Certificate; import java.io.ByteArrayInputStream; import java.io.File; -import java.io.FileInputStream; -import java.io.FileNotFoundException; import java.io.IOException; import java.security.GeneralSecurityException; import java.security.Principal; @@ -530,10 +526,8 @@ public class AuthenticationServer implements MOAIDAuthConstants { // System.out.println(xmlInfoboxReadResponse); // // } catch (FileNotFoundException e) { -// // TODO Auto-generated catch block // e.printStackTrace(); // } catch (UtilsException e) { -// // TODO Auto-generated catch block // e.printStackTrace(); // } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/WrongParametersException.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/WrongParametersException.java index 8f1d7cbf8..d98c944de 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/WrongParametersException.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/WrongParametersException.java @@ -36,6 +36,11 @@ import at.gv.egovernment.moa.id.MOAIDException; public class WrongParametersException extends MOAIDException { /** + * + */ + private static final long serialVersionUID = -7501748998171109466L; + +/** * Constructor */ public WrongParametersException(String call, String parameter, String errorID) { diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java index bde0be4a1..a19618dc2 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/AuthServlet.java @@ -62,6 +62,11 @@ public class AuthServlet extends HttpServlet implements MOAIDAuthConstants { /** + * + */ + private static final long serialVersionUID = -6929905344382283738L; + +/** * Handles an error.
> *

Logs the error

MOAConfigurationException

MOAApplicationException

Throwable

MOASystemException

ConfigurationException

@@ -31,9 +31,22 @@ Geburtsdatum:	- .. + . + . +
+ Rolle im Gesundheitsbereich: +	+ + (OID***= ), +
Applikation: @@ -65,7 +78,9 @@ Datum:	- .. + . + . +
- :: + : + : +
+ HPI(**): +	+ +
@@ -87,10 +114,67 @@

@@ -30,6 +30,17 @@
+ Rolle im Gesundheitsbereich: +	+ + (OID***= ), +
Applikation: @@ -76,6 +87,16 @@
+ HPI():** +	+ +
@@ -87,12 +108,67 @@

+ Name: +	+ +
+ Geburtsdatum: +	+ . + . + +
+ +
+ *wbPK ():** +	+ +

@@ -32,9 +32,22 @@ Geburtsdatum:	- .. + . + . +
+ Rolle im Gesundheitsbereich: +	+ + (OID***= ), +
Applikation: @@ -66,7 +79,9 @@ Datum:	- .. + . + . +
- :: + : + : +
+ HPI(**): +	+ +
@@ -88,10 +115,67 @@

@@ -31,6 +31,17 @@
+ Rolle im Gesundheitsbereich: +	+ + (OID***= ), +
Applikation: @@ -77,6 +88,16 @@
+ HPI():** +	+ +
@@ -88,12 +109,67 @@

+ Vertreter:
Vorname	+
Name	+
Geburtsdatum	+ - + - +
+ Ich bin berufsmäßig berechtigt für die nachfolgend genannte Person in dessen Namen mit der Bürgerkarte einzuschreiten.
+ Vetretene Person:
natürliche Person:
Vorname	+
Name	+
Geburtsdatum	+ - + - +
otional:	+
Straße	+
Hausnmummer	+
Einh. Nr.	+
Postleitzahl	+
Gemeinde	+

juristische Person:
Name	+
	+

Name:	Dienst (Service):	"; // friendlyname from OA request += StringUtils.isEmpty(oaParam.getFriendlyName()) ? "" : oaParam.getFriendlyName(); request += "
Country:	Austria	Land (Country):	�sterreich (Austria)

URL:
"; - request += "Sector:	"; request += target + " (" + sectorName + ")"; request += "
Date:	Datum (Date):	"; request += date; request += "
Time:	Zeit (Time):	"; request += time; request += "

Fehler bei der Anmeldung

MOA-ID AUTH

Berufliche Parteienvertretung

Berufliche Parteienvertretung einer natürlichen/juristischen Person +

Sicherer Zugang zur Online-Anwendung mit Bürgerkarte

Signatur der Anmeldedaten

Mit meiner elektronischen Signatur beantrage ich, - - , -geboren am -.., den Zugang zur gesicherten Anwendung.

Mit meiner elektronischen Signatur beantrage ich, + , geboren am + . + . + , + + in der Rolle als + (OID***= ), + + den Zugang zur gesicherten Anwendung. +

Datum und Uhrzeit: + . + . + , + : + : +

HPI(**):

wbPK(*):

Ich bin weiters ermächtigt als + von + , geboren am + . + . + + + , + + , in dessen Auftrag zu handeln. + + wbPK(*) des Vollmachtgebers: +

wbPK(*) des Vollmachtgebers:

Signatur der Anmeldedaten

Mit meiner elektronischen Signatur beantrage ich, , - geboren am - . - . - , - den Zugang zur gesicherten Anwendung.

Mit meiner elektronischen Signatur beantrage ich, + , geboren am + . + . + , + + in der Rolle als + (OID***= ), + + den Zugang zur gesicherten Anwendung. +

Datum und Uhrzeit: . @@ -27,14 +32,48 @@ :

HPI(**):

wbPK(*):

Ich bin weiters ermächtigt als + von + , geboren am + . + . + + + , + + , in dessen Auftrag zu handeln. + + wbPK(*) des Vollmachtgebers: +

wbPK(*) des Vollmachtgebers:

(*) wbPK: Das wirtschaftsbereichsspezifische - Personenkennzeichen wird aus den jeweiligen Stammzahlen des Bürgers und des Wirtschaftsunternehmens - berechnet und ermöglicht eine eindeutige Zuordnung des Bürgers zum Wirtschaftsunternehmen.

(*) wbPK: Das wirtschaftsbereichsspezifische Personenkennzeichen wird aus den + jeweiligen Stammzahlen des Bürgers und des Wirtschaftsunternehmens berechnet und ermöglicht eine eindeutige Zuordnung des Bürgers zum + Wirtschaftsunternehmen.

(**) HPI: Der eHealth Professional Identifier wird aus den jeweiligen + Stammzahlen der Gesundheitsdiensteanbieterinnen / Gesundheitsdiensteanbieter berechnet und ermöglicht eine eindeutige Zuordnung der + Gesundheitsdiensteanbieterin / des Gesundheitsdiensteanbieters im Gesundheitsbereich.

(***) OID: Object Identifier sind standardisierte Objekt-Bezeichner und + beschreiben eindeutig die Rollen des GDA-Token Inhabers.

(*): Das wirtschaftsbereichsspezifische Personenkennzeichen (wbPK) wird aus den jeweiligen - Stammzahlen des Bürgers und des Wirtschaftsunternehmens berechnet und ermöglicht eine eindeutige - Zuordnung des Bürgers zum Wirtschaftsunternehmen.

(*): Das wirtschaftsbereichsspezifische Personenkennzeichen (wbPK) wird aus den + jeweiligen Stammzahlen des Bürgers und des Wirtschaftsunternehmens berechnet und ermöglicht eine eindeutige Zuordnung des Bürgers zum + Wirtschaftsunternehmen.

(**): Der eHealth Professional Identifier (HPI) wird aus den jeweiligen + Stammzahlen der Gesundheitsdiensteanbieterinnen / Gesundheitsdiensteanbieter berechnet und ermöglicht eine eindeutige Zuordnung der + Gesundheitsdiensteanbieterin / des Gesundheitsdiensteanbieters im Gesundheitsbereich.

(***): Object Identifier (OID) sind standardisierte Objekt-Bezeichner und + beschreiben eindeutig die Rollen des GDA-Token Inhabers.

Signatur der Anmeldedaten

Mit meiner elektronischen Signatur beantrage ich, - - , -geboren am -.., den Zugang zur gesicherten Anwendung.

Mit meiner elektronischen Signatur beantrage ich, + , geboren am + . + . + , + + in der Rolle als + (OID***= ), + + den Zugang zur gesicherten Anwendung. +

Datum und Uhrzeit: + . + . + , + : + : +

HPI(**):

wbPK(*):

Ich bin weiters ermächtigt als + von + , geboren am + . + . + + + , + + , in dessen Auftrag zu handeln. + + wbPK(*) des Vollmachtgebers: +

wbPK(*) des Vollmachtgebers:

Signatur der Anmeldedaten

Mit meiner elektronischen Signatur beantrage ich, , - geboren am - . - . - , - den Zugang zur gesicherten Anwendung.

Mit meiner elektronischen Signatur beantrage ich, + , geboren am + . + . + , + + in der Rolle als + (OID***= ), + + den Zugang zur gesicherten Anwendung. +

Datum und Uhrzeit: . @@ -28,14 +33,48 @@ :

HPI(**):

wbPK(*):

Ich bin weiters ermächtigt als + von + , geboren am + . + . + + + , + + , in dessen Auftrag zu handeln. + + wbPK(*) des Vollmachtgebers: +

wbPK(*) des Vollmachtgebers:

(*) wbPK: Das wirtschaftsbereichsspezifische - Personenkennzeichen wird aus den jeweiligen Stammzahlen des Bürgers und des Wirtschaftsunternehmens - berechnet und ermöglicht eine eindeutige Zuordnung des Bürgers zum Wirtschaftsunternehmen.

(*) wbPK: Das wirtschaftsbereichsspezifische Personenkennzeichen wird aus den + jeweiligen Stammzahlen des Bürgers und des Wirtschaftsunternehmens berechnet und ermöglicht eine eindeutige Zuordnung des Bürgers zum + Wirtschaftsunternehmen.

(**) HPI: Der eHealth Professional Identifier wird aus den jeweiligen + Stammzahlen der Gesundheitsdiensteanbieterinnen / Gesundheitsdiensteanbieter berechnet und ermöglicht eine eindeutige Zuordnung der + Gesundheitsdiensteanbieterin / des Gesundheitsdiensteanbieters im Gesundheitsbereich.

(***) OID: Object Identifier sind standardisierte Objekt-Bezeichner und + beschreiben eindeutig die Rollen des GDA-Token Inhabers.

(*): Das wirtschaftsbereichsspezifische Personenkennzeichen (wbPK) wird aus den jeweiligen - Stammzahlen des Bürgers und des Wirtschaftsunternehmens berechnet und ermöglicht eine eindeutige - Zuordnung des Bürgers zum Wirtschaftsunternehmen.

(*): Das wirtschaftsbereichsspezifische Personenkennzeichen (wbPK) wird aus den + jeweiligen Stammzahlen des Bürgers und des Wirtschaftsunternehmens berechnet und ermöglicht eine eindeutige Zuordnung des Bürgers zum + Wirtschaftsunternehmen.

(**): Der eHealth Professional Identifier (HPI) wird aus den jeweiligen + Stammzahlen der Gesundheitsdiensteanbieterinnen / Gesundheitsdiensteanbieter berechnet und ermöglicht eine eindeutige Zuordnung der + Gesundheitsdiensteanbieterin / des Gesundheitsdiensteanbieters im Gesundheitsbereich.

(***): Object Identifier (OID) sind standardisierte Objekt-Bezeichner und + beschreiben eindeutig die Rollen des GDA-Token Inhabers.

Berufliche Parteienvertretung

Berufliche Parteienvertretung einer natürlichen/juristischen Person +

Sicherer Zugang zur Online-Anwendung mit Bürgerkarte

Fehler bei der Anmeldung

Fehler bei der Anmeldung

Fehler bei der Anmeldung

Fehler bei der Anmeldung

Fehler bei der Anmeldung

Fehler bei der Anmeldung

Fehler bei der Anmeldung

Fehler bei der Anmeldung

Anmeldedaten:

Authentication Data:

Anmeldedaten:

Authentication Data:

Anmeldedaten:

Anmeldedaten:

Authentication Data:

Authentication Data:

Anmeldedaten:

Anmeldedaten:

Authentication Data:

Authentication Data:

Authentication Data:

Anmeldedaten:

Authentication Data:

Anmeldedaten:

Ich bin weiters ermächtigt als + von + , geboren am + . + . + + + , + + , in dessen Auftrag zu handeln. + +
wbPK(*) des Vollmachtgebers:
+

Ich bin weiters ermächtigt als + von + , geboren am + . + . + + + , + + , in dessen Auftrag zu handeln. + +
wbPK(*) des Vollmachtgebers:
+

() wbPK: Das wirtschaftsbereichsspezifische - Personenkennzeichen* wird aus den jeweiligen Stammzahlen des Bürgers und des Wirtschaftsunternehmens - berechnet und ermöglicht eine eindeutige Zuordnung des Bürgers zum Wirtschaftsunternehmen.

() wbPK: Das wirtschaftsbereichsspezifische Personenkennzeichen* wird aus den + jeweiligen Stammzahlen des Bürgers und des Wirtschaftsunternehmens berechnet und ermöglicht eine eindeutige Zuordnung des Bürgers zum + Wirtschaftsunternehmen.

(): Das wirtschaftsbereichsspezifische Personenkennzeichen (wbPK)* wird aus den jeweiligen - Stammzahlen des Bürgers und des Wirtschaftsunternehmens berechnet und ermöglicht eine eindeutige - Zuordnung des Bürgers zum Wirtschaftsunternehmen.

(): Das wirtschaftsbereichsspezifische Personenkennzeichen (wbPK)* wird aus den + jeweiligen Stammzahlen des Bürgers und des Wirtschaftsunternehmens berechnet und ermöglicht eine eindeutige Zuordnung des Bürgers zum + Wirtschaftsunternehmen.

Ich bin weiters ermächtigt als + von + , geboren am + . + . + + + , + + , in dessen Auftrag zu handeln. + +
wbPK(*) des Vollmachtgebers:
+

Ich bin weiters ermächtigt als + von + , geboren am + . + . + + + , + + , in dessen Auftrag zu handeln. + +
wbPK(*) des Vollmachtgebers:
+

() wbPK: Das wirtschaftsbereichsspezifische - Personenkennzeichen* wird aus den jeweiligen Stammzahlen des Bürgers und des Wirtschaftsunternehmens - berechnet und ermöglicht eine eindeutige Zuordnung des Bürgers zum Wirtschaftsunternehmen.

() wbPK: Das wirtschaftsbereichsspezifische Personenkennzeichen* wird aus den + jeweiligen Stammzahlen des Bürgers und des Wirtschaftsunternehmens berechnet und ermöglicht eine eindeutige Zuordnung des Bürgers zum + Wirtschaftsunternehmen.

(): Das wirtschaftsbereichsspezifische Personenkennzeichen (wbPK)* wird aus den jeweiligen - Stammzahlen des Bürgers und des Wirtschaftsunternehmens berechnet und ermöglicht eine eindeutige - Zuordnung des Bürgers zum Wirtschaftsunternehmen.

(): Das wirtschaftsbereichsspezifische Personenkennzeichen (wbPK)* wird aus den + jeweiligen Stammzahlen des Bürgers und des Wirtschaftsunternehmens berechnet und ermöglicht eine eindeutige Zuordnung des Bürgers zum + Wirtschaftsunternehmen.