From 3314af0442eba4bce469b21585a75c1a327f53b5 Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Fri, 18 Dec 2015 13:00:30 +0100 Subject: add first untested parts for eIDAS SAML-engine configuration --- .../at/gv/egovernment/moa/id/config/auth/AuthConfiguration.java | 8 ++++++++ .../id/config/auth/PropertyBasedAuthConfigurationProvider.java | 5 +++++ 2 files changed, 13 insertions(+) (limited to 'id/server/idserverlib/src') diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfiguration.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfiguration.java index c98a7d537..ad3268b90 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfiguration.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfiguration.java @@ -25,6 +25,14 @@ public interface AuthConfiguration extends ConfigurationProvider{ public String getConfigurationWithKey(final String key); + /** + * Get a configuration value from basic file based MOA-ID configuration + * + * @param key configuration key + * @return configuration value + */ + public String getBasicMOAIDConfiguration(final String key); + public int getTransactionTimeOut(); public int getSSOCreatedTimeOut(); public int getSSOUpdatedTimeOut(); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java index 645831479..dce7de526 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java @@ -173,6 +173,11 @@ public class PropertyBasedAuthConfigurationProvider extends ConfigurationProvide } } + public String getBasicMOAIDConfiguration(final String key) { + return properties.getProperty(key); + + } + /* (non-Javadoc) * @see at.gv.egovernment.moa.id.config.auth.AuthConfiguration#getPropertyWithKey(java.lang.String) */ -- cgit v1.2.3 From 74e36f95b4fb49b37b05d5e93c9404f795c964df Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Tue, 12 Jan 2016 10:43:11 +0100 Subject: refactor MOASession data-object to store generice information from authentication modules --- .../moa/id/auth/data/AuthenticationSession.java | 374 ++++++--------------- .../AuthenticationSessionStorageConstants.java | 38 +++ .../exception/SessionDataStorageException.java | 45 +++ .../moa/id/data/AuthenticationData.java | 122 ++++--- .../at/gv/egovernment/moa/id/data/IAuthData.java | 8 +- 5 files changed, 256 insertions(+), 331 deletions(-) create mode 100644 id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSessionStorageConstants.java create mode 100644 id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/exception/SessionDataStorageException.java (limited to 'id/server/idserverlib/src') diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSession.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSession.java index 59482c4a8..ae3ec9a9b 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSession.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSession.java @@ -44,13 +44,15 @@ import java.security.cert.CertificateException; import java.util.ArrayList; import java.util.Date; import java.util.List; +import java.util.Map; +import org.apache.commons.collections4.map.HashedMap; -import eu.stork.peps.auth.commons.IPersonalAttributeList; -import eu.stork.peps.auth.commons.STORKAuthnRequest; +import at.gv.egovernment.moa.id.auth.exception.SessionDataStorageException; import at.gv.egovernment.moa.id.data.MISMandate; import at.gv.egovernment.moa.logging.Logger; import at.gv.egovernment.moa.util.Constants; +import at.gv.egovernment.moa.util.MiscUtil; /** * Session data to be stored between AuthenticationServer API calls. @@ -215,129 +217,28 @@ public class AuthenticationSession implements Serializable { * accept. The infobox identifiers are comma separated. */ private String pushInfobox; - - /** - * The STORK AuthRequest to be sent to the C-PEPS - */ - private STORKAuthnRequest storkAuthnRequest; - - private String storkAuthnResponse; - + // private AuthenticationData authData; // protocol selection private String action; private String modul; + private String processInstanceId; + private boolean authenticated; private boolean authenticatedUsed = false; private boolean ssoRequested = false; - + private String QAALevel = null; - -// private OAuth20SessionObject oAuth20SessionObject; - - // /** - // * Indicates if target from configuration is used or not - // */ - // private boolean useTargetFromConfig; - - // /** - // * Authentication data for the assertion - // */ - // private AuthenticationData assertionAuthData; - // - // /** - // * Persondata for the assertion - // */ - // private String assertionPrPerson; - // - // /** - // * Authblock for the assertion - // */ - // private String assertionAuthBlock; - // - // /** - // * Identitylink assertion for the (MOA) assertion - // */ - // private String assertionIlAssertion; - // - // /** - // * Signer certificate (base64 encoded) for the assertion - // */ - // private String assertionSignerCertificateBase64; - // - // /** - // * bussiness service for the assertion - // */ - // boolean assertionBusinessService; - // - // /** - // * timestamp logging when authentication session has been created - // */ - // private Date timestampStart; - // private CreateXMLSignatureResponse XMLCreateSignatureResponse; - + private VerifyXMLSignatureResponse XMLVerifySignatureResponse; private boolean isForeigner; - - private IPersonalAttributeList storkAttributes; + private Map genericSessionDataStorate = new HashedMap(); - //Temporary store SignRequest for local processing - private String signedDoc; - //Temporary store SAMLResponse for processing after user signed signedDoc locally - private String SAMLResponse; - // - private StringBuffer returnURL; - private IPersonalAttributeList authnResponseGetPersonalAttributeList; - private String authnContextClassRef; - // private String requestedProtocolURL = null; - - private String processInstanceId; - - public String getAuthnContextClassRef() { - return authnContextClassRef; - } - - public void setAuthnContextClassRef(String authnContextClassRef) { - this.authnContextClassRef = authnContextClassRef; - } - - public IPersonalAttributeList getAuthnResponseGetPersonalAttributeList() { - return authnResponseGetPersonalAttributeList; - } - - public void setAuthnResponseGetPersonalAttributeList(IPersonalAttributeList authnResponseGetPersonalAttributeList) { - this.authnResponseGetPersonalAttributeList = authnResponseGetPersonalAttributeList; - } - - public String getSAMLResponse() { - return SAMLResponse; - } - - public void setSAMLResponse(String samlResponse) { - SAMLResponse = samlResponse; - } - - public StringBuffer getReturnURL() { - return returnURL; - } - - public void setReturnURL(StringBuffer returnURL) { - this.returnURL = returnURL; - } - - public String getSignedDoc() { - return signedDoc; - } - - public void setSignedDoc(String signedDoc) { - this.signedDoc = signedDoc; - } - public String getModul() { return modul; } @@ -353,15 +254,7 @@ public class AuthenticationSession implements Serializable { public void setAction(String action) { this.action = action; } - - // public AuthenticationData getAuthData() { - // return authData; - // } - // - // public void setAuthData(AuthenticationData authData) { - // this.authData = authData; - // } - + public boolean isAuthenticatedUsed() { return authenticatedUsed; } @@ -378,14 +271,6 @@ public class AuthenticationSession implements Serializable { this.authenticated = authenticated; } - // public String getRequestedProtocolURL() { - // return requestedProtocolURL; - // } - // - // public void setRequestedProtocolURL(String requestedProtocolURL) { - // this.requestedProtocolURL = requestedProtocolURL; - // } - /** * Constructor for AuthenticationSession. * @@ -395,8 +280,7 @@ public class AuthenticationSession implements Serializable { public AuthenticationSession(String id, Date created) { sessionID = id; sessionCreated = created; - // setTimestampStart(); -// infoboxValidators = new ArrayList(); + } public X509Certificate getSignerCertificate() { @@ -760,98 +644,7 @@ public class AuthenticationSession implements Serializable { public void setIssueInstant(String issueInstant) { this.issueInstant = issueInstant; } - -// /** -// * Returns the iterator to the stored infobox validators. -// * -// * @return Iterator -// */ -// public Iterator getInfoboxValidatorIterator() { -// if (infoboxValidators == null) return null; -// return infoboxValidators.iterator(); -// } - - // /** - // * Adds an infobox validator class to the stored infobox validators. - // * - // * @param infoboxIdentifier - // * the identifier of the infobox the validator belongs to - // * @param infoboxFriendlyName - // * the friendly name of the infobox - // * @param infoboxValidator - // * the infobox validator to add - // */ - // public Iterator addInfoboxValidator(String infoboxIdentifier, - // String infoboxFriendlyName, InfoboxValidator infoboxValidator) { - // if (infoboxValidators == null) - // infoboxValidators = new ArrayList(); - // Vector v = new Vector(3); - // v.add(infoboxIdentifier); - // v.add(infoboxFriendlyName); - // v.add(infoboxValidator); - // infoboxValidators.add(v); - // return infoboxValidators.iterator(); - // } - -// /** -// * Tests for pending input events of the infobox validators. -// * -// * @return true if a validator has a form to show -// */ -// public boolean isValidatorInputPending() { -// boolean result = false; -// Iterator iter = getInfoboxValidatorIterator(); -// if (iter != null) { -// while (!result && iter.hasNext()) { -// Vector infoboxValidatorVector = (Vector) iter.next(); -// InfoboxValidator infoboxvalidator = (InfoboxValidator) infoboxValidatorVector.get(2); -// if (!ParepUtils.isEmpty(infoboxvalidator.getForm())) result = true; -// } -// } -// return result; -// } - - // /** - // * Returns the first pending infobox validator. - // * - // * @return the infobox validator class - // */ - // public InfoboxValidator getFirstPendingValidator() { - // Iterator iter = getInfoboxValidatorIterator(); - // if (iter != null) { - // while (iter.hasNext()) { - // Vector infoboxValidatorVector = (Vector) iter.next(); - // InfoboxValidator infoboxvalidator = (InfoboxValidator) infoboxValidatorVector - // .get(2); - // String form = infoboxvalidator.getForm(); - // if (!ParepUtils.isEmpty(form)) - // return infoboxvalidator; - // } - // } - // return null; - // } - - // /** - // * Returns the input form of the first pending infobox validator input - // * processor. - // * - // * @return the form to show - // */ - // public String getFirstValidatorInputForm() { - // Iterator iter = getInfoboxValidatorIterator(); - // if (iter != null) { - // while (iter.hasNext()) { - // Vector infoboxValidatorVector = (Vector) iter.next(); - // InfoboxValidator infoboxvalidator = (InfoboxValidator) infoboxValidatorVector - // .get(2); - // String form = infoboxvalidator.getForm(); - // if (!ParepUtils.isEmpty(form)) - // return form; - // } - // } - // return null; - // } - + /** * Returns domain identifier (the register and number in the register parameter). * null in the case of not a business service. @@ -954,26 +747,7 @@ public class AuthenticationSession implements Serializable { public void setMandateReferenceValue(String mandateReferenceValue) { this.mandateReferenceValue = mandateReferenceValue; } - - /** - * Gets the STORK SAML AuthnRequest - * - * @return STORK SAML AuthnRequest - */ - public STORKAuthnRequest getStorkAuthnRequest() { - return storkAuthnRequest; - } - - /** - * Sets the STORK SAML AuthnRequest - * - * @param storkAuthnRequest - * STORK SAML AuthnRequest - */ - public void setStorkAuthnRequest(STORKAuthnRequest storkAuthnRequest) { - this.storkAuthnRequest = storkAuthnRequest; - } - + public String getCcc() { return ccc; } @@ -1054,24 +828,8 @@ public class AuthenticationSession implements Serializable { } /** - * Memorizes the stork attribute list. - * - * @param personalAttributeList the new stork attributes - */ - public void setStorkAttributes(IPersonalAttributeList personalAttributeList) { - this.storkAttributes = personalAttributeList; - } - - /** - * Recalls the stork attribute list. - * - * @return the stork attributes - */ - public IPersonalAttributeList getStorkAttributes() { - return this.storkAttributes; - } - - /** + * eIDAS QAA level + * * @return the qAALevel */ public String getQAALevel() { @@ -1079,26 +837,14 @@ public class AuthenticationSession implements Serializable { } /** + * set QAA level in eIDAS form + * * @param qAALevel the qAALevel to set */ public void setQAALevel(String qAALevel) { QAALevel = qAALevel; } - /** - * @return the storkAuthnResponse - */ - public String getStorkAuthnResponse() { - return storkAuthnResponse; - } - - /** - * @param storkAuthnResponse the storkAuthnResponse to set - */ - public void setStorkAuthnResponse(String storkAuthnResponse) { - this.storkAuthnResponse = storkAuthnResponse; - } - /** * @return the sessionCreated */ @@ -1121,5 +867,89 @@ public class AuthenticationSession implements Serializable { public void setProcessInstanceId(String processInstanceId) { this.processInstanceId = processInstanceId; } + + public Map getGenericSessionDataStorage() { + return genericSessionDataStorate; + } + + /** + * Returns a generic session-data object with is stored with a specific identifier + * + * @param key The specific identifier of the session-data object + * @return The session-data object or null if no data is found with this key + */ + public Object getGenericDataFromSession(String key) { + if (MiscUtil.isNotEmpty(key)) { + return genericSessionDataStorate.get(key); + + } + + Logger.warn("Can not load generic session-data with key='null'"); + return null; + + } + + /** + * Returns a generic session-data object with is stored with a specific identifier + * + * @param key The specific identifier of the session-data object + * @param clazz The class type which is stored with this key + * @return The session-data object or null if no data is found with this key + */ + public T getGenericDataFromSession(String key, final Class clazz) { + if (MiscUtil.isNotEmpty(key)) { + Object data = genericSessionDataStorate.get(key); + + if (data == null) + return null; + + try { + @SuppressWarnings("unchecked") + T test = (T) data; + return test; + + } catch (Exception e) { + Logger.warn("Generic authentication-data object can not be casted to requsted type", e); + return null; + + } + + } + + Logger.warn("Can not load generic session-data with key='null'"); + return null; + + } + + /** + * Store a generic data-object to session with a specific identifier + * + * @param key Identifier for this data-object + * @param object Generic data-object which should be stored. This data-object had to be implement the 'java.io.Serializable' interface + * @throws SessionDataStorageException Error message if the data-object can not stored to generic session-data storage + */ + public void setGenericDataToSession(String key, Object object) throws SessionDataStorageException { + if (MiscUtil.isEmpty(key)) { + Logger.warn("Generic session-data can not be stored with a 'null' key"); + throw new SessionDataStorageException("Generic session-data can not be stored with a 'null' key", null); + + } + + if (object != null) { + if (!Serializable.class.isInstance(object)) { + Logger.warn("Generic session-data can only store objects which implements the 'Seralizable' interface"); + throw new SessionDataStorageException("Generic session-data can only store objects which implements the 'Seralizable' interface", null); + + } + } + + if (genericSessionDataStorate.containsKey(key)) + Logger.debug("Overwrite generic session-data with key:" + key); + else + Logger.trace("Add generic session-data with key:" + key + " to session."); + + genericSessionDataStorate.put(key, object); + } + } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSessionStorageConstants.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSessionStorageConstants.java new file mode 100644 index 000000000..f67f41dd3 --- /dev/null +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSessionStorageConstants.java @@ -0,0 +1,38 @@ +/* + * Copyright 2014 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + */ +package at.gv.egovernment.moa.id.auth.data; + +/** + * @author tlenz + * + */ +public class AuthenticationSessionStorageConstants { + + public static final String PREFIX_STORK = "stork_"; + public static final String PREFIX_eIDAS = "eIDAS_"; + + public static final String STORK_ATTRIBUTELIST = PREFIX_STORK + "attributelist"; + public static final String STORK_REQUEST = PREFIX_STORK + "request"; + public static final String STORK_RESPONSE = PREFIX_STORK + "response"; + public static final String STORK_CCC = PREFIX_STORK + "ccc"; +} diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/exception/SessionDataStorageException.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/exception/SessionDataStorageException.java new file mode 100644 index 000000000..203be784e --- /dev/null +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/exception/SessionDataStorageException.java @@ -0,0 +1,45 @@ +/* + * Copyright 2014 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + */ +package at.gv.egovernment.moa.id.auth.exception; + +/** + * @author tlenz + * + */ +public class SessionDataStorageException extends MOAIDException { + + /** + * + */ + private static final long serialVersionUID = 5743057708136365929L; + + /** + * @param messageId + * @param parameters + */ + public SessionDataStorageException(String messageId, Object[] parameters) { + super(messageId, parameters); + + } + +} diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java index e2892e70a..a5dfe7524 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java @@ -29,13 +29,13 @@ import java.text.SimpleDateFormat; import java.util.ArrayList; import java.util.Date; import java.util.List; +import java.util.Map; +import org.apache.commons.collections4.map.HashedMap; import org.w3c.dom.Element; -import eu.stork.peps.auth.commons.IPersonalAttributeList; -import eu.stork.peps.auth.commons.STORKAuthnRequest; - import at.gv.egovernment.moa.id.auth.data.IdentityLink; +import at.gv.egovernment.moa.id.auth.exception.SessionDataStorageException; import at.gv.egovernment.moa.logging.Logger; import at.gv.egovernment.moa.util.DOMUtils; import at.gv.egovernment.moa.util.DateTimeUtils; @@ -122,9 +122,8 @@ public class AuthenticationData implements IAuthData, Serializable { * STORK attributes from response */ private String ccc = null; - private IPersonalAttributeList storkAttributes = null; - private String storkAuthnResponse; - private STORKAuthnRequest storkRequest = null; + + private Map genericDataStorate = new HashedMap(); private byte[] signerCertificate = null; @@ -397,23 +396,6 @@ public class AuthenticationData implements IAuthData, Serializable { this.identityLink = identityLink; } - - /** - * @return the storkAttributes - */ - public IPersonalAttributeList getStorkAttributes() { - return storkAttributes; - } - - - /** - * @param storkAttributes the storkAttributes to set - */ - public void setStorkAttributes(IPersonalAttributeList storkAttributes) { - this.storkAttributes = storkAttributes; - } - - /** * @return the signerCertificate */ @@ -538,35 +520,6 @@ public class AuthenticationData implements IAuthData, Serializable { this.ssoSession = ssoSession; } - /** - * @param storkRequest the storkRequest to set - */ - public void setStorkRequest(STORKAuthnRequest storkRequest) { - this.storkRequest = storkRequest; - } - - /* (non-Javadoc) - * @see at.gv.egovernment.moa.id.data.IAuthData#getStorkAuthnRequest() - */ - @Override - public STORKAuthnRequest getStorkAuthnRequest() { - return this.storkRequest; - } - - /** - * @return the storkAuthnResponse - */ - public String getStorkAuthnResponse() { - return storkAuthnResponse; - } - - /** - * @param storkAuthnResponse the storkAuthnResponse to set - */ - public void setStorkAuthnResponse(String storkAuthnResponse) { - this.storkAuthnResponse = storkAuthnResponse; - } - /** * @return the mandateReferenceValue */ @@ -743,5 +696,68 @@ public class AuthenticationData implements IAuthData, Serializable { public void setIsBusinessService(boolean flag) { this.businessService = flag; - } + } + + /** + * Returns a generic data-object with is stored with a specific identifier + * + * @param key The specific identifier of the data object + * @param clazz The class type which is stored with this key + * @return The data object or null if no data is found with this key + */ + public T getGenericData(String key, final Class clazz) { + if (MiscUtil.isNotEmpty(key)) { + Object data = genericDataStorate.get(key); + + if (data == null) + return null; + + try { + @SuppressWarnings("unchecked") + T test = (T) data; + return test; + + } catch (Exception e) { + Logger.warn("Generic authentication-data object can not be casted to requsted type", e); + return null; + + } + + } + + Logger.warn("Can not load generic session-data with key='null'"); + return null; + + } + + /** + * Store a generic data-object to session with a specific identifier + * + * @param key Identifier for this data-object + * @param object Generic data-object which should be stored. This data-object had to be implement the 'java.io.Serializable' interface + * @throws SessionDataStorageException Error message if the data-object can not stored to generic session-data storage + */ + public void setGenericData(String key, Object object) throws SessionDataStorageException { + if (MiscUtil.isEmpty(key)) { + Logger.warn("Generic session-data can not be stored with a 'null' key"); + throw new SessionDataStorageException("Generic data can not be stored with a 'null' key", null); + + } + + if (object != null) { + if (!Serializable.class.isInstance(object)) { + Logger.warn("Generic data can only store objects which implements the 'Seralizable' interface"); + throw new SessionDataStorageException("Generic data can only store objects which implements the 'Seralizable' interface", null); + + } + } + + if (genericDataStorate.containsKey(key)) + Logger.debug("Overwrite generic data with key:" + key); + else + Logger.trace("Add generic data with key:" + key + " to session."); + + genericDataStorate.put(key, object); + } + } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java index 09b0d7971..915242787 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java @@ -27,9 +27,6 @@ import java.util.List; import org.w3c.dom.Element; -import eu.stork.peps.auth.commons.IPersonalAttributeList; -import eu.stork.peps.auth.commons.STORKAuthnRequest; - import at.gv.egovernment.moa.id.auth.data.IdentityLink; /** @@ -89,8 +86,7 @@ public interface IAuthData { boolean isForeigner(); String getCcc(); - STORKAuthnRequest getStorkAuthnRequest(); - String getStorkAuthnResponse(); - IPersonalAttributeList getStorkAttributes(); + + public T getGenericData(String key, final Class clazz); } -- cgit v1.2.3 From 68017565392861db4958716971d5be38faf5fff6 Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Tue, 12 Jan 2016 10:44:13 +0100 Subject: refactore STORK authentication module to use generic MOASession data-storage --- .../id/auth/builder/AuthenticationDataBuilder.java | 55 ++++++++++++++++------ .../builder/attributes/EIDSTORKTOKEN.java | 4 +- .../pvp2x/utils/AssertionAttributeExtractor.java | 17 +++---- .../moa/id/protocols/saml1/GetArtifactAction.java | 10 +++- .../AbstractPepsConnectorWithLocalSigningTask.java | 5 +- .../tasks/CreateStorkAuthRequestFormTask.java | 7 ++- .../PepsConnectorHandleLocalSignResponseTask.java | 14 ++++-- ...onnectorHandleResponseWithoutSignatureTask.java | 33 ++++++++----- .../modules/stork/tasks/PepsConnectorTask.java | 19 +++++--- .../builder/attributes/STORKAttributHelper.java | 8 ++-- .../id/protocols/stork2/MOAAttributeProvider.java | 13 +++-- 11 files changed, 126 insertions(+), 59 deletions(-) (limited to 'id/server/idserverlib/src') diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java index 998fa495f..b79b99a65 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/AuthenticationDataBuilder.java @@ -32,7 +32,9 @@ import java.security.PrivateKey; import java.util.ArrayList; import java.util.Arrays; import java.util.Date; +import java.util.Iterator; import java.util.List; +import java.util.Map.Entry; import java.util.regex.Matcher; import java.util.regex.Pattern; @@ -62,6 +64,7 @@ import at.gv.e_government.reference.namespace.persondata._20020228_.PersonNameTy import at.gv.e_government.reference.namespace.persondata._20020228_.PhysicalPersonType; import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants; import at.gv.egovernment.moa.id.auth.data.AuthenticationSession; +import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants; import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttribute; import at.gv.egovernment.moa.id.auth.data.IdentityLink; import at.gv.egovernment.moa.id.auth.data.VerifyXMLSignatureResponse; @@ -69,6 +72,7 @@ import at.gv.egovernment.moa.id.auth.exception.BuildException; import at.gv.egovernment.moa.id.auth.exception.DynamicOABuildException; import at.gv.egovernment.moa.id.auth.exception.MOAIDException; import at.gv.egovernment.moa.id.auth.exception.ParseException; +import at.gv.egovernment.moa.id.auth.exception.SessionDataStorageException; import at.gv.egovernment.moa.id.auth.exception.WrongParametersException; import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser; import at.gv.egovernment.moa.id.commons.db.MOASessionDBUtils; @@ -788,16 +792,24 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants { //set STORK attributes if (extractor.containsAttribute(PVPConstants.EID_STORK_TOKEN_NAME)) { - authData.setStorkAuthnResponse(extractor.getSingleAttributeValue(PVPConstants.EID_STORK_TOKEN_NAME)); - authData.setForeigner(true); + try { + authData.setGenericData(AuthenticationSessionStorageConstants.STORK_RESPONSE, + extractor.getSingleAttributeValue(PVPConstants.EID_STORK_TOKEN_NAME)); + authData.setForeigner(true); + + } catch (SessionDataStorageException e) { + Logger.warn("STORK Response can not stored into generic authData.", e); + + } - } - - if (!extractor.getSTORKAttributes().isEmpty()) { - authData.setStorkAttributes(extractor.getSTORKAttributes()); - authData.setForeigner(true); } + +// if (!extractor.getSTORKAttributes().isEmpty()) { +// authData.setStorkAttributes(extractor.getSTORKAttributes()); +// authData.setForeigner(true); +// +// } authData.setSsoSession(true); authData.setInterfederatedSSOSession(true); @@ -887,10 +899,22 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants { authData.setBkuURL(session.getBkuURL()); - authData.setStorkAttributes(session.getStorkAttributes()); - authData.setStorkAuthnResponse(session.getStorkAuthnResponse()); - authData.setStorkRequest(session.getStorkAuthnRequest()); - + //copy all generic authentication information to authData + if (session.getGenericSessionDataStorage() != null && + !session.getGenericSessionDataStorage().isEmpty()) { + Iterator> copyInterator = session.getGenericSessionDataStorage().entrySet().iterator(); + while (copyInterator.hasNext()) { + Entry element = copyInterator.next(); + try { + authData.setGenericData(element.getKey(), element.getValue()); + + } catch (SessionDataStorageException e) { + Logger.warn("Can not add generic authData with key:" + element.getKey(), e); + + } + } + } + authData.setSignerCertificate(session.getEncodedSignerCertificate()); authData.setAuthBlock(session.getAuthBlock()); @@ -921,9 +945,12 @@ public class AuthenticationDataBuilder extends MOAIDAuthConstants { } if (MiscUtil.isEmpty(authData.getCcc())) { - if (authData.getStorkAuthnRequest() != null) { - authData.setCcc(authData.getStorkAuthnRequest().getCitizenCountryCode()); - Logger.info("Can not extract country from certificate -> Use country from STORK request."); + String storkCCC = authData.getGenericData( + AuthenticationSessionStorageConstants.STORK_CCC, String.class); + + if (MiscUtil.isNotEmpty(storkCCC)) { + authData.setCcc(storkCCC); + Logger.info("Can not extract country from certificate -> Use country:" + storkCCC + " from STORK request."); } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSTORKTOKEN.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSTORKTOKEN.java index 84b791708..43a0458cb 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSTORKTOKEN.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/EIDSTORKTOKEN.java @@ -24,6 +24,7 @@ package at.gv.egovernment.moa.id.protocols.builder.attributes; import java.io.IOException; +import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants; import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters; import at.gv.egovernment.moa.id.config.auth.OAAuthParameter; import at.gv.egovernment.moa.id.data.IAuthData; @@ -47,7 +48,8 @@ public class EIDSTORKTOKEN implements IPVPAttributeBuilder { throw new UnavailableAttributeException(EID_STORK_TOKEN_NAME); } else { - String storkResponse = authData.getStorkAuthnResponse(); + String storkResponse = authData.getGenericData( + AuthenticationSessionStorageConstants.STORK_RESPONSE, String.class); if ( MiscUtil.isEmpty(storkResponse) ) { throw new UnavailableAttributeException(EID_STORK_TOKEN_NAME); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/utils/AssertionAttributeExtractor.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/utils/AssertionAttributeExtractor.java index 26b3bfbd1..9c294245f 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/utils/AssertionAttributeExtractor.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/utils/AssertionAttributeExtractor.java @@ -38,9 +38,6 @@ import org.opensaml.saml2.core.StatusResponseType; import org.opensaml.saml2.core.Subject; import org.opensaml.xml.XMLObject; -import eu.stork.peps.auth.commons.PersonalAttribute; -import eu.stork.peps.auth.commons.PersonalAttributeList; - import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants; import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.AssertionAttributeExtractorExeption; import at.gv.egovernment.moa.logging.Logger; @@ -50,7 +47,7 @@ public class AssertionAttributeExtractor { private Assertion assertion = null; private Map> attributs = new HashMap>(); - private PersonalAttributeList storkAttributes = new PersonalAttributeList(); + //private PersonalAttributeList storkAttributes = new PersonalAttributeList(); private final List minimalAttributeNameList = Arrays.asList( PVPConstants.PRINCIPAL_NAME_NAME, @@ -77,9 +74,9 @@ public class AssertionAttributeExtractor { for (XMLObject el : attr.getAttributeValues()) storkAttrValues.add(el.getDOM().getTextContent()); - PersonalAttribute storkAttr = new PersonalAttribute(attr.getName(), - false, storkAttrValues , "Available"); - storkAttributes.put(attr.getName(), storkAttr ); +// PersonalAttribute storkAttr = new PersonalAttribute(attr.getName(), +// false, storkAttrValues , "Available"); +// storkAttributes.put(attr.getName(), storkAttr ); } else { List attrList = new ArrayList(); @@ -155,9 +152,9 @@ public class AssertionAttributeExtractor { } - public PersonalAttributeList getSTORKAttributes() { - return storkAttributes; - } +// public PersonalAttributeList getSTORKAttributes() { +// return storkAttributes; +// } public String getNameID() throws AssertionAttributeExtractorExeption { diff --git a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/GetArtifactAction.java b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/GetArtifactAction.java index b94348856..5bdf51e7d 100644 --- a/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/GetArtifactAction.java +++ b/id/server/modules/moa-id-modules-saml1/src/main/java/at/gv/egovernment/moa/id/protocols/saml1/GetArtifactAction.java @@ -27,7 +27,10 @@ import java.util.List; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; +import eu.stork.peps.auth.commons.IPersonalAttributeList; + import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants; +import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants; import at.gv.egovernment.moa.id.auth.data.ExtendedSAMLAttribute; import at.gv.egovernment.moa.id.auth.exception.AuthenticationException; import at.gv.egovernment.moa.id.auth.servlet.RedirectServlet; @@ -71,8 +74,11 @@ public class GetArtifactAction implements IAction { SAML1AuthenticationServer saml1server = SAML1AuthenticationServer.getInstace(); // add other stork attributes to MOA assertion if available - if(null != authData.getStorkAttributes()) { - List moaExtendedSAMLAttibutes = SAML1AuthenticationServer.addAdditionalSTORKAttributes(authData.getStorkAttributes()); + IPersonalAttributeList storkAttributes = authData.getGenericData( + AuthenticationSessionStorageConstants.STORK_ATTRIBUTELIST, + IPersonalAttributeList.class); + if(null != storkAttributes) { + List moaExtendedSAMLAttibutes = SAML1AuthenticationServer.addAdditionalSTORKAttributes(storkAttributes); authData.getExtendedSAMLAttributesOA().addAll(moaExtendedSAMLAttibutes); Logger.info("MOA assertion assembled and SAML Artifact generated."); } diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/AbstractPepsConnectorWithLocalSigningTask.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/AbstractPepsConnectorWithLocalSigningTask.java index 939390847..ee4961d5e 100644 --- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/AbstractPepsConnectorWithLocalSigningTask.java +++ b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/AbstractPepsConnectorWithLocalSigningTask.java @@ -21,6 +21,7 @@ import org.apache.commons.io.IOUtils; import org.xml.sax.SAXException; import at.gv.egovernment.moa.id.auth.data.AuthenticationSession; +import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants; import at.gv.egovernment.moa.id.auth.data.IdentityLink; import at.gv.egovernment.moa.id.auth.exception.AuthenticationException; import at.gv.egovernment.moa.id.auth.exception.BKUException; @@ -113,7 +114,9 @@ public abstract class AbstractPepsConnectorWithLocalSigningTask extends Abstract moaSession.setIdentityLink(identityLink); Logger.debug("Adding addtional STORK attributes to MOA session"); - moaSession.setStorkAttributes(personalAttributeList); + moaSession.setGenericDataToSession( + AuthenticationSessionStorageConstants.STORK_ATTRIBUTELIST, + personalAttributeList); // We don't have BKUURL, setting from null to "Not applicable" moaSession.setBkuURL("Not applicable (STORK Authentication)"); diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/CreateStorkAuthRequestFormTask.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/CreateStorkAuthRequestFormTask.java index ef61739f8..901762f17 100644 --- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/CreateStorkAuthRequestFormTask.java +++ b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/CreateStorkAuthRequestFormTask.java @@ -46,6 +46,7 @@ import eu.stork.peps.exceptions.STORKSAMLEngineException; import at.gv.egovernment.moa.id.auth.BaseAuthenticationServer; import at.gv.egovernment.moa.id.auth.builder.CreateXMLSignatureRequestBuilder; import at.gv.egovernment.moa.id.auth.data.AuthenticationSession; +import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants; import at.gv.egovernment.moa.id.auth.exception.AuthenticationException; import at.gv.egovernment.moa.id.auth.exception.MOAIDException; import at.gv.egovernment.moa.id.auth.exception.WrongParametersException; @@ -264,7 +265,7 @@ public class CreateStorkAuthRequestFormTask extends AbstractAuthServletTask { //attributeList.add(newAttribute); //store SignRequest for later... - moasession.setSignedDoc(signedDoc); + moasession.setGenericDataToSession("STORK_signDoc", signedDoc); acsURL = issuerValue + AbstractPepsConnectorWithLocalSigningTask.PEPSCONNECTOR_SERVLET_URL_PATTERN; // TODO[branch]: STORK AuthReq acsURL "/PEPSConnectorWithLocalSigning" @@ -339,7 +340,9 @@ public class CreateStorkAuthRequestFormTask extends AbstractAuthServletTask { Logger.debug("STORK AuthnRequest successfully internally validated."); //send - moasession.setStorkAuthnRequest(authnRequest); + moasession.setGenericDataToSession( + AuthenticationSessionStorageConstants.STORK_REQUEST, + authnRequest); // do PEPS-conform logging for easier evaluation try { diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorHandleLocalSignResponseTask.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorHandleLocalSignResponseTask.java index 7b9fa3f12..f872241ae 100644 --- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorHandleLocalSignResponseTask.java +++ b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorHandleLocalSignResponseTask.java @@ -22,6 +22,7 @@ import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger; import at.gv.egovernment.moa.id.auth.BaseAuthenticationServer; import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder; import at.gv.egovernment.moa.id.auth.data.AuthenticationSession; +import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants; import at.gv.egovernment.moa.id.auth.exception.AuthenticationException; import at.gv.egovernment.moa.id.auth.exception.MOAIDException; import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException; @@ -142,7 +143,10 @@ public class PepsConnectorHandleLocalSignResponseTask extends AbstractPepsConnec moaSession.setXMLVerifySignatureResponse(tmp); executionContext.put("identityLinkAvailable", false); try { - IPersonalAttributeList personalAttributeList = moaSession.getAuthnResponseGetPersonalAttributeList(); + IPersonalAttributeList personalAttributeList = + moaSession.getGenericDataFromSession( + AuthenticationSessionStorageConstants.STORK_ATTRIBUTELIST, + IPersonalAttributeList.class); // Add SignResponse TODO Add signature (extracted from signResponse)? List values = new ArrayList(); values.add(signResponseString); @@ -151,7 +155,8 @@ public class PepsConnectorHandleLocalSignResponseTask extends AbstractPepsConnec PersonalAttribute signedDocAttribute = new PersonalAttribute("signedDoc", false, values, "Available"); personalAttributeList.add(signedDocAttribute); - String authnContextClassRef = moaSession.getAuthnContextClassRef(); + String authnContextClassRef = moaSession.getGenericDataFromSession( + "STORK_authContextClass", String.class); SZRGInsertion(moaSession, personalAttributeList, authnContextClassRef, citizenSignature); executionContext.put("identityLinkAvailable", true); } catch (STORKException e) { @@ -187,8 +192,9 @@ public class PepsConnectorHandleLocalSignResponseTask extends AbstractPepsConnec } Logger.debug("Add full STORK AuthnResponse to MOA session"); - moaSession.setStorkAuthnResponse(request.getParameter("SAMLResponse"));// TODO ask Florian/Thomas - // authnResponse? + moaSession.setGenericDataToSession( + AuthenticationSessionStorageConstants.STORK_RESPONSE, + request.getParameter("SAMLResponse")); MOAReversionLogger.getInstance().logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_PEPS_RECEIVED); diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorHandleResponseWithoutSignatureTask.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorHandleResponseWithoutSignatureTask.java index 304e5f495..8240f6d00 100644 --- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorHandleResponseWithoutSignatureTask.java +++ b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorHandleResponseWithoutSignatureTask.java @@ -2,18 +2,15 @@ package at.gv.egovernment.moa.id.auth.modules.stork.tasks; import iaik.x509.X509Certificate; -import java.io.IOException; import java.io.StringWriter; import java.util.ArrayList; import java.util.Collection; -import java.util.List; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.xml.transform.Source; import javax.xml.transform.stream.StreamSource; -import org.apache.commons.codec.binary.Base64; import org.apache.commons.io.IOUtils; import org.apache.commons.lang.StringEscapeUtils; import org.apache.velocity.Template; @@ -24,6 +21,7 @@ import org.opensaml.saml2.core.StatusCode; import at.gv.egovernment.moa.id.auth.BaseAuthenticationServer; import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder; import at.gv.egovernment.moa.id.auth.data.AuthenticationSession; +import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants; import at.gv.egovernment.moa.id.auth.exception.AuthenticationException; import at.gv.egovernment.moa.id.auth.exception.MOAIDException; import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException; @@ -204,7 +202,10 @@ public class PepsConnectorHandleResponseWithoutSignatureTask extends AbstractPep Logger.debug("MOA session is still valid"); - STORKAuthnRequest storkAuthnRequest = moaSession.getStorkAuthnRequest(); + STORKAuthnRequest storkAuthnRequest = + moaSession.getGenericDataFromSession( + AuthenticationSessionStorageConstants.STORK_REQUEST, + STORKAuthnRequest.class); if (storkAuthnRequest == null) { Logger.error("Could not find any preceeding STORK AuthnRequest to this MOA session: " + moaSessionID); @@ -263,11 +264,15 @@ public class PepsConnectorHandleResponseWithoutSignatureTask extends AbstractPep } else { // store SAMLResponse - moaSession.setSAMLResponse(request.getParameter("SAMLResponse")); + moaSession.setGenericDataToSession( + AuthenticationSessionStorageConstants.STORK_RESPONSE, + request.getParameter("SAMLResponse")); // store authnResponse // moaSession.setAuthnResponse(authnResponse);//not serializable - moaSession.setAuthnResponseGetPersonalAttributeList(attributeList); + moaSession.setGenericDataToSession( + AuthenticationSessionStorageConstants.STORK_ATTRIBUTELIST, + attributeList); String authnContextClassRef = null; try { @@ -277,12 +282,12 @@ public class PepsConnectorHandleResponseWithoutSignatureTask extends AbstractPep Logger.warn("STORK QAA-Level is not found in AuthnResponse. Set QAA Level to requested level"); } - moaSession.setAuthnContextClassRef(authnContextClassRef); - moaSession.setReturnURL(request.getRequestURL()); + moaSession.setGenericDataToSession("STORK_authContextClass", authnContextClassRef); + moaSession.setGenericDataToSession("STORK_returnURL", request.getRequestURL()); // load signedDoc - String signRequest = moaSession.getSignedDoc(); - + String signRequest = moaSession.getGenericDataFromSession("STORK_signDoc", String.class); + // session is implicit stored in changeSessionID!!!! String newMOASessionID = AuthenticationSessionStoreage.changeSessionID(moaSession); @@ -380,9 +385,11 @@ public class PepsConnectorHandleResponseWithoutSignatureTask extends AbstractPep } Logger.debug("Add full STORK AuthnResponse to MOA session"); - moaSession.setStorkAuthnResponse(request.getParameter("SAMLResponse"));// TODO ask Florian/Thomas - // authnResponse? - + moaSession.setGenericDataToSession( + AuthenticationSessionStorageConstants.STORK_RESPONSE, + request.getParameter("SAMLResponse")); + + // session is implicit stored in changeSessionID!!!! String newMOASessionID = AuthenticationSessionStoreage.changeSessionID(moaSession); diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorTask.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorTask.java index b505605ab..8322d1a02 100644 --- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorTask.java +++ b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/auth/modules/stork/tasks/PepsConnectorTask.java @@ -2,7 +2,6 @@ package at.gv.egovernment.moa.id.auth.modules.stork.tasks; import iaik.x509.X509Certificate; -import java.io.IOException; import java.io.InputStream; import java.io.StringWriter; import java.net.URL; @@ -11,7 +10,6 @@ import java.util.ArrayList; import java.util.Arrays; import java.util.Date; import java.util.List; -import java.util.Properties; import javax.activation.DataSource; import javax.servlet.http.HttpServletRequest; @@ -39,6 +37,7 @@ import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger; import at.gv.egovernment.moa.id.auth.BaseAuthenticationServer; import at.gv.egovernment.moa.id.auth.builder.DataURLBuilder; import at.gv.egovernment.moa.id.auth.data.AuthenticationSession; +import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants; import at.gv.egovernment.moa.id.auth.data.IdentityLink; import at.gv.egovernment.moa.id.auth.exception.AuthenticationException; import at.gv.egovernment.moa.id.auth.exception.MOAIDException; @@ -243,7 +242,10 @@ public class PepsConnectorTask extends AbstractAuthServletTask { Logger.debug("MOA session is still valid"); - STORKAuthnRequest storkAuthnRequest = moaSession.getStorkAuthnRequest(); + STORKAuthnRequest storkAuthnRequest = + moaSession.getGenericDataFromSession( + AuthenticationSessionStorageConstants.STORK_REQUEST, + STORKAuthnRequest.class); if (storkAuthnRequest == null) { Logger.error("Could not find any preceeding STORK AuthnRequest to this MOA session: " + moaSessionID); @@ -575,10 +577,15 @@ public class PepsConnectorTask extends AbstractAuthServletTask { moaSession.setIdentityLink(identityLink); Logger.debug("Adding addtional STORK attributes to MOA session"); - moaSession.setStorkAttributes(attributeList); - + moaSession.setGenericDataToSession( + AuthenticationSessionStorageConstants.STORK_ATTRIBUTELIST, + attributeList); + Logger.debug("Add full STORK AuthnResponse to MOA session"); - moaSession.setStorkAuthnResponse(request.getParameter("SAMLResponse")); + moaSession.setGenericDataToSession( + AuthenticationSessionStorageConstants.STORK_RESPONSE, + request.getParameter("SAMLResponse")); + // We don't have BKUURL, setting from null to "Not applicable" moaSession.setBkuURL("Not applicable (STORK Authentication)"); diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKAttributHelper.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKAttributHelper.java index 9a0598cf6..fb9172f6e 100644 --- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKAttributHelper.java +++ b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/builder/attributes/STORKAttributHelper.java @@ -24,8 +24,7 @@ package at.gv.egovernment.moa.id.protocols.builder.attributes; import eu.stork.peps.auth.commons.IPersonalAttributeList; import eu.stork.peps.auth.commons.PersonalAttribute; -import at.gv.egovernment.moa.id.auth.data.AuthenticationSession; -import at.gv.egovernment.moa.id.auth.stork.STORKConstants; +import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants; import at.gv.egovernment.moa.id.data.IAuthData; import at.gv.egovernment.moa.id.protocols.pvp2x.builder.attributes.exceptions.UnavailableAttributeException; import at.gv.egovernment.moa.logging.Logger; @@ -43,7 +42,10 @@ public class STORKAttributHelper { throw new UnavailableAttributeException(attributName); } else { - IPersonalAttributeList storkAttributes = authSession.getStorkAttributes(); + IPersonalAttributeList storkAttributes = + authSession.getGenericData( + AuthenticationSessionStorageConstants.STORK_ATTRIBUTELIST, + IPersonalAttributeList.class); if ( storkAttributes == null ) { throw new UnavailableAttributeException(attributName); diff --git a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOAAttributeProvider.java b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOAAttributeProvider.java index 2c7e5b539..f9f38e2d5 100644 --- a/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOAAttributeProvider.java +++ b/id/server/modules/module-stork/src/main/java/at/gv/egovernment/moa/id/protocols/stork2/MOAAttributeProvider.java @@ -23,6 +23,7 @@ package at.gv.egovernment.moa.id.protocols.stork2; import at.gv.egovernment.moa.id.auth.builder.BPKBuilder; +import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants; import at.gv.egovernment.moa.id.auth.exception.BuildException; import at.gv.egovernment.moa.id.data.AuthenticationRole; import at.gv.egovernment.moa.id.data.IAuthData; @@ -30,6 +31,7 @@ import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants; import at.gv.egovernment.moa.id.util.PVPtoSTORKMapper; import at.gv.egovernment.moa.logging.Logger; import at.gv.egovernment.moa.util.MiscUtil; +import eu.stork.peps.auth.commons.IPersonalAttributeList; import eu.stork.peps.auth.commons.PersonalAttribute; import eu.stork.peps.auth.commons.PersonalAttributeList; import eu.stork.peps.complex.attributes.eu.stork.names.tc.stork._1_0.assertion.AttributeStatusType; @@ -83,12 +85,17 @@ public class MOAAttributeProvider { public void populateAttribute(PersonalAttributeList attributeList, PersonalAttribute requestedAttribute ) { String storkAttribute = requestedAttribute.getName(); - + + IPersonalAttributeList storkAttributes = + authData.getGenericData( + AuthenticationSessionStorageConstants.STORK_ATTRIBUTELIST, + IPersonalAttributeList.class); + // TODO: check if authData gets populated with stork attributtes during previous steps; it seems it is not - if (null != authData && null != authData.getStorkAttributes() && authData.getStorkAttributes().containsKey(requestedAttribute.getName())) { + if (null != authData && null != storkAttributes && storkAttributes.containsKey(requestedAttribute.getName())) { Logger.debug("Trying to get value for attribute directly from STORK2 response [" + storkAttribute + "]"); try { - PersonalAttribute tmp = authData.getStorkAttributes().get(requestedAttribute.getName()); + PersonalAttribute tmp = storkAttributes.get(requestedAttribute.getName()); attributeList.add((PersonalAttribute) tmp.clone()); } catch(Exception e) { Logger.error("Could not retrieve attribute from STORK2 response: " + storkAttribute); -- cgit v1.2.3 From 2683e6eee3b6f820fe5fa4ef1b76a94cdfcd846d Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Wed, 13 Jan 2016 08:48:15 +0100 Subject: add STORK-QAA <--> eIdAS-QAA level mapper --- .../moa/id/data/AuthenticationData.java | 50 ++++++++++++++++++++-- .../at/gv/egovernment/moa/id/data/IAuthData.java | 1 + .../moa/id/protocols/pvp2x/PVPConstants.java | 5 +++ .../egovernment/moa/id/util/PVPtoSTORKMapper.java | 48 ++++++++++++++++++++- .../properties/pvp-stork_mapping.properties | 20 +++++++-- 5 files changed, 116 insertions(+), 8 deletions(-) (limited to 'id/server/idserverlib/src') diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java index a5dfe7524..53be0881b 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationData.java @@ -36,6 +36,9 @@ import org.w3c.dom.Element; import at.gv.egovernment.moa.id.auth.data.IdentityLink; import at.gv.egovernment.moa.id.auth.exception.SessionDataStorageException; +import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants; +import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.AssertionAttributeExtractorExeption; +import at.gv.egovernment.moa.id.util.PVPtoSTORKMapper; import at.gv.egovernment.moa.logging.Logger; import at.gv.egovernment.moa.util.DOMUtils; import at.gv.egovernment.moa.util.DateTimeUtils; @@ -477,9 +480,47 @@ public class AuthenticationData implements IAuthData, Serializable { * @return */ public String getQAALevel() { - return this.QAALevel; + if (this.QAALevel != null && + this.QAALevel.startsWith(PVPConstants.EIDAS_QAA_PREFIX)) { + String mappedQAA = PVPtoSTORKMapper.getInstance().mapeIDASQAAToSTORKQAA(this.QAALevel); + if (MiscUtil.isNotEmpty(mappedQAA)) + return mappedQAA; + + else { + Logger.error("eIDAS QAA-level:" + this.QAALevel + + " can not be mapped to STORK QAA-level! Use " + + PVPConstants.STORK_QAA_1_1 + " as default value."); + return PVPConstants.STORK_QAA_1_1; + + } + + + } else + return this.QAALevel; } + + public String getEIDASQAALevel() { + if (this.QAALevel != null && + this.QAALevel.startsWith(PVPConstants.STORK_QAA_PREFIX)) { + String mappedQAA = PVPtoSTORKMapper.getInstance().mapSTORKQAAToeIDASQAA(this.QAALevel); + if (MiscUtil.isNotEmpty(mappedQAA)) + return mappedQAA; + + else { + Logger.error("STORK QAA-level:" + this.QAALevel + + " can not be mapped to eIDAS QAA-level! Use " + + PVPConstants.EIDAS_QAA_LOW + " as default value."); + return PVPConstants.EIDAS_QAA_LOW; + + } + + + } else + return this.QAALevel; + + } + /** * @return @@ -498,13 +539,16 @@ public class AuthenticationData implements IAuthData, Serializable { /** + * Store QAA level in eIDAS format to authentication Data + * * @param qAALevel the qAALevel to set + * @throws AssertionAttributeExtractorExeption */ public void setQAALevel(String qAALevel) { - QAALevel = qAALevel; + QAALevel = qAALevel; + } - /** * @return the ssoSession */ diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java index 915242787..91d40fcc3 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/IAuthData.java @@ -79,6 +79,7 @@ public interface IAuthData { String getMandateReferenceValue(); String getQAALevel(); + public String getEIDASQAALevel(); String getSessionIndex(); String getNameID(); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVPConstants.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVPConstants.java index 168f2362a..dc0cab8c3 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVPConstants.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/PVPConstants.java @@ -41,6 +41,11 @@ public interface PVPConstants { public static final String STORK_QAA_1_3 = "http://www.stork.gov.eu/1.0/citizenQAALevel/3"; public static final String STORK_QAA_1_4 = "http://www.stork.gov.eu/1.0/citizenQAALevel/4"; + public static final String EIDAS_QAA_PREFIX = "http://eidas.europa.eu/LoA/"; + public static final String EIDAS_QAA_LOW = EIDAS_QAA_PREFIX + "low"; + public static final String EIDAS_QAA_SUBSTANTIAL = EIDAS_QAA_PREFIX + "substantial"; + public static final String EIDAS_QAA_HIGH = EIDAS_QAA_PREFIX + "high"; + public static final String STORK_ATTRIBUTE_PREFIX = "http://www.stork.gov.eu/"; public static final String URN_OID_PREFIX = "urn:oid:"; diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/PVPtoSTORKMapper.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/PVPtoSTORKMapper.java index 5ef9494f4..d0da0003f 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/PVPtoSTORKMapper.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/PVPtoSTORKMapper.java @@ -37,10 +37,14 @@ public class PVPtoSTORKMapper { private static final String PVP_SECCLASS_PREFIX = "http://www.ref.gv.at/ns/names/agiz/pvp/"; private static final String STORK_QAA_PREFIX = "http://www.stork.gov.eu/1.0/"; + private static final String eIDAS_QAA_PREFIX = "http://eidas.europa.eu/"; private static final String MAPPING_RESOURCE = "resources/properties/pvp-stork_mapping.properties"; + private static final String MAPPING_SECCLASS_PREFIX = "secclass_"; + private static final String MAPPING_EIDAS_PREFIX = "eidas_"; + private Properties mapping = null; private static PVPtoSTORKMapper instance = null; @@ -68,6 +72,47 @@ public class PVPtoSTORKMapper { } + /** + * Map STORK QAA level to eIDAS QAA level + * + * @param storkQAA STORK QAA level + * @return + */ + public String mapSTORKQAAToeIDASQAA(String storkQAA) { + if (mapping != null) { + String input = storkQAA.substring(STORK_QAA_PREFIX.length()); + String mappedQAA = mapping.getProperty(MAPPING_EIDAS_PREFIX + input); + if (MiscUtil.isNotEmpty(mappedQAA)) { + Logger.info("Map STORK-QAA " + storkQAA + " to eIDAS-QAA " + mappedQAA); + return mappedQAA; + + } + } + Logger.warn("No eIDAS-QAA mapping for STORK-QAA " + storkQAA +" !"); + return null; + + } + + /** + * Map eIDAS QAA-level to STORK QAA-level + * + * @param qaaLevel eIDAS QAA-level + * @return STORK QAA-level + */ + public String mapeIDASQAAToSTORKQAA(String qaaLevel) { + if (mapping != null) { + String input = qaaLevel.substring(eIDAS_QAA_PREFIX.length()); + String mappedQAA = mapping.getProperty(MAPPING_EIDAS_PREFIX + input); + if (MiscUtil.isNotEmpty(mappedQAA)) { + Logger.info("Map eIDAS-QAA " + qaaLevel + " to STORK-QAA " + mappedQAA); + return mappedQAA; + + } + } + Logger.warn("No eIDAS-QAA mapping for eIDAS-QAA " + qaaLevel +" !"); + return null; + } + /**Map a STORK QAA level to PVP SecClass * * @param STORK-QAA level @@ -76,7 +121,7 @@ public class PVPtoSTORKMapper { public String mapToSecClass(String storkQAALevel) { if (mapping != null) { String input = storkQAALevel.substring(STORK_QAA_PREFIX.length()); - String mappedQAA = mapping.getProperty(input); + String mappedQAA = mapping.getProperty(MAPPING_SECCLASS_PREFIX + input); if (MiscUtil.isNotEmpty(mappedQAA)) { Logger.info("Map STORK-QAA " + storkQAALevel + " to PVP SecClass " + mappedQAA); return mappedQAA; @@ -125,4 +170,5 @@ public class PVPtoSTORKMapper { Logger.warn("NO mapping for PVPRole "+ el.getRoleName() + " !"); return null; } + } diff --git a/id/server/idserverlib/src/main/resources/resources/properties/pvp-stork_mapping.properties b/id/server/idserverlib/src/main/resources/resources/properties/pvp-stork_mapping.properties index ca12fada4..63a679db5 100644 --- a/id/server/idserverlib/src/main/resources/resources/properties/pvp-stork_mapping.properties +++ b/id/server/idserverlib/src/main/resources/resources/properties/pvp-stork_mapping.properties @@ -25,7 +25,19 @@ secclass/0-2=http://www.stork.gov.eu/1.0/citizenQAALevel/4 secclass/0-3=http://www.stork.gov.eu/1.0/citizenQAALevel/4 ##STORK-QAA to PVP SecClass mapping -citizenQAALevel/1=http://www.ref.gv.at/ns/names/agiz/pvp/secclass/0 -citizenQAALevel/2=http://www.ref.gv.at/ns/names/agiz/pvp/secclass/0-1 -citizenQAALevel/3=http://www.ref.gv.at/ns/names/agiz/pvp/secclass/0-2 -citizenQAALevel/4=http://www.ref.gv.at/ns/names/agiz/pvp/secclass/0-2 \ No newline at end of file +secclass_citizenQAALevel/1=http://www.ref.gv.at/ns/names/agiz/pvp/secclass/0 +secclass_citizenQAALevel/2=http://www.ref.gv.at/ns/names/agiz/pvp/secclass/0-1 +secclass_citizenQAALevel/3=http://www.ref.gv.at/ns/names/agiz/pvp/secclass/0-2 +secclass_citizenQAALevel/4=http://www.ref.gv.at/ns/names/agiz/pvp/secclass/0-2 + + +##STORK-QAA to eIDAS-QAA mapping +eidas_citizenQAALevel/1=http://eidas.europa.eu/LoA/low +eidas_citizenQAALevel/2=http://eidas.europa.eu/LoA/low +eidas_citizenQAALevel/3=http://eidas.europa.eu/LoA/substantial +eidas_citizenQAALevel/4=http://eidas.europa.eu/LoA/high + +##eIDAS-QAA to STORK-QAA mapping +LoA/low=http://www.stork.gov.eu/1.0/citizenQAALevel/1 +LoA/substantial=http://www.stork.gov.eu/1.0/citizenQAALevel/2 +LoA/high=http://www.stork.gov.eu/1.0/citizenQAALevel/4 \ No newline at end of file -- cgit v1.2.3 From 22820de6b6fa074be1d9990766fa631a6f7f5818 Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Wed, 13 Jan 2016 08:57:23 +0100 Subject: add test IDL generation --- .../AuthenticationSessionStorageConstants.java | 4 + .../moa/id/auth/modules/eidas/Constants.java | 6 + .../eidas/exceptions/eIDASAttributeException.java | 38 +++ .../eidas/tasks/CreateIdentityLinkTask.java | 185 +++++++++++ .../eidas/tasks/ReceiveAuthnResponseTask.java | 33 +- .../eidas/utils/MOAOrderedAttributeIterator.java | 66 ++++ .../eidas/utils/MOAPersonalAttributeList.java | 343 +++++++++++++++++++++ .../modules/eidas/eIDAS.Authentication.process.xml | 15 +- .../resources/xmldata/fakeIdL_IdL_template.xml | 51 +++ 9 files changed, 725 insertions(+), 16 deletions(-) create mode 100644 id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASAttributeException.java create mode 100644 id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/CreateIdentityLinkTask.java create mode 100644 id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/MOAOrderedAttributeIterator.java create mode 100644 id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/MOAPersonalAttributeList.java create mode 100644 id/server/modules/moa-id-module-eIDAS/src/main/resources/resources/xmldata/fakeIdL_IdL_template.xml (limited to 'id/server/idserverlib/src') diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSessionStorageConstants.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSessionStorageConstants.java index f67f41dd3..648dcf6f1 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSessionStorageConstants.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/data/AuthenticationSessionStorageConstants.java @@ -35,4 +35,8 @@ public class AuthenticationSessionStorageConstants { public static final String STORK_REQUEST = PREFIX_STORK + "request"; public static final String STORK_RESPONSE = PREFIX_STORK + "response"; public static final String STORK_CCC = PREFIX_STORK + "ccc"; + + public static final String eIDAS_ATTRIBUTELIST = PREFIX_eIDAS + "attributeList"; + public static final String eIDAS_RESPONSE = PREFIX_eIDAS + "response"; } + diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/Constants.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/Constants.java index 8e38facbf..9f347b4ee 100644 --- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/Constants.java +++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/Constants.java @@ -55,4 +55,10 @@ public class Constants { + CONIG_PROPS_EIDAS_SAMLENGINE_ENCRYPT + ".config.file"; public static final long CONFIG_PROPS_SKEWTIME = 2 * 60 * 1000; //2 minutes skew time for response validation + + public static final String eIDAS_ATTR_PERSONALIDENTIFIER = "PersonIdentifier"; + public static final String eIDAS_ATTR_DATEOFBIRTH = "DateOfBirth"; + public static final String eIDAS_ATTR_CURRENTGIVENNAME = "CurrentGivenName"; + public static final String eIDAS_ATTR_CURRENTFAMILYNAME = "CurrentFamilyName"; + } diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASAttributeException.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASAttributeException.java new file mode 100644 index 000000000..7840ae2e6 --- /dev/null +++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/exceptions/eIDASAttributeException.java @@ -0,0 +1,38 @@ +/* + * Copyright 2014 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + */ +package at.gv.egovernment.moa.id.auth.modules.eidas.exceptions; + +/** + * @author tlenz + * + */ +public class eIDASAttributeException extends Exception { + + private static final long serialVersionUID = 1L; + + public eIDASAttributeException(String message) { + super(message); + + } + +} diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/CreateIdentityLinkTask.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/CreateIdentityLinkTask.java new file mode 100644 index 000000000..f4d6c4ad4 --- /dev/null +++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/CreateIdentityLinkTask.java @@ -0,0 +1,185 @@ +/* + * Copyright 2014 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + */ +package at.gv.egovernment.moa.id.auth.modules.eidas.tasks; + +import java.io.IOException; +import java.io.InputStream; +import java.text.ParseException; +import java.text.SimpleDateFormat; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.xml.parsers.ParserConfigurationException; + +import org.w3c.dom.Element; +import org.w3c.dom.Node; +import org.xml.sax.SAXException; + +import eu.eidas.auth.commons.IPersonalAttributeList; + +import at.gv.egovernment.moa.id.advancedlogging.MOAIDEventConstants; +import at.gv.egovernment.moa.id.advancedlogging.MOAReversionLogger; +import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants; +import at.gv.egovernment.moa.id.auth.data.AuthenticationSession; +import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants; +import at.gv.egovernment.moa.id.auth.data.IdentityLink; +import at.gv.egovernment.moa.id.auth.exception.MOAIDException; +import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask; +import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException; +import at.gv.egovernment.moa.id.auth.modules.eidas.Constants; +import at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.eIDASAttributeException; +import at.gv.egovernment.moa.id.auth.parser.IdentityLinkAssertionParser; +import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException; +import at.gv.egovernment.moa.id.config.auth.AuthConfiguration; +import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory; +import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters; +import at.gv.egovernment.moa.id.moduls.IRequest; +import at.gv.egovernment.moa.id.moduls.RequestStorage; +import at.gv.egovernment.moa.id.process.api.ExecutionContext; +import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage; +import at.gv.egovernment.moa.id.util.IdentityLinkReSigner; +import at.gv.egovernment.moa.logging.Logger; +import at.gv.egovernment.moa.util.DOMUtils; +import at.gv.egovernment.moa.util.XPathUtils; + +/** + * @author tlenz + * + */ +public class CreateIdentityLinkTask extends AbstractAuthServletTask { + + /* (non-Javadoc) + * @see at.gv.egovernment.moa.id.process.springweb.MoaIdTask#execute(at.gv.egovernment.moa.id.process.api.ExecutionContext, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse) + */ + @Override + public void execute(ExecutionContext executionContext, + HttpServletRequest request, HttpServletResponse response) + throws TaskExecutionException { + try{ + String moasessionid = (String) executionContext.get(MOAIDAuthConstants.PARAM_SESSIONID); + String pendingRequestID = (String) executionContext.get("pendingRequestID"); + + //load pending request + IRequest pendingReq = RequestStorage.getPendingRequest(pendingRequestID); + if (pendingReq == null) { + Logger.info("No PendingRequest with Id: " + pendingRequestID + " Maybe, a transaction timeout occure."); + throw new MOAIDException("auth.28", new Object[]{pendingRequestID}); + + } + + //load MOASession object and OA-configuration + AuthenticationSession moasession = AuthenticationSessionStoreage.getSession(moasessionid); + IOAAuthParameters oaConfig = pendingReq.getOnlineApplicationConfiguration(); + + //get eIDAS attributes from MOA-Session + IPersonalAttributeList eIDASAttributes = moasession.getGenericDataFromSession( + AuthenticationSessionStorageConstants.eIDAS_ATTRIBUTELIST, + IPersonalAttributeList.class); + + AuthConfiguration config = AuthConfigurationProviderFactory.getInstance(); + IdentityLink identityLink = null; + + //connect SZR-Gateway + //TODO: implement SZR-Gateway communication!!!! + if(true) { + + // create fake IdL + // - fetch IdL template from resources + InputStream s = CreateIdentityLinkTask.class.getResourceAsStream("/resources/xmldata/fakeIdL_IdL_template.xml"); + Element idlTemplate = DOMUtils.parseXmlValidating(s); + + identityLink = new IdentityLinkAssertionParser(idlTemplate).parseIdentityLink(); + + // replace data + Element idlassertion = identityLink.getSamlAssertion(); + + // - set bpk/wpbk; + Node prIdentification = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_IDENT_VALUE_XPATH); + if(!eIDASAttributes.containsKey(Constants.eIDAS_ATTR_PERSONALIDENTIFIER)) + throw new eIDASAttributeException("PersonalIdentifier is missing"); + String eIdentifier = eIDASAttributes.get(Constants.eIDAS_ATTR_PERSONALIDENTIFIER).getValue().get(0); + prIdentification.getFirstChild().setNodeValue(eIdentifier); + + // - set last name + Node prFamilyName = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_FAMILY_NAME_XPATH); + if(!eIDASAttributes.containsKey(Constants.eIDAS_ATTR_CURRENTFAMILYNAME)) + throw new eIDASAttributeException("currentFamilyName is missing"); + String familyName = eIDASAttributes.get(Constants.eIDAS_ATTR_CURRENTFAMILYNAME).getValue().get(0); + prFamilyName.getFirstChild().setNodeValue(familyName); + + // - set first name + Node prGivenName = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_GIVEN_NAME_XPATH); + if(!eIDASAttributes.containsKey(Constants.eIDAS_ATTR_CURRENTGIVENNAME)) + throw new eIDASAttributeException("currentGivenName is missing"); + String givenName = eIDASAttributes.get(Constants.eIDAS_ATTR_CURRENTGIVENNAME).getValue().get(0); + prGivenName.getFirstChild().setNodeValue(givenName); + + // - set date of birth + Node prDateOfBirth = XPathUtils.selectSingleNode(idlassertion, IdentityLinkAssertionParser.PERSON_DATE_OF_BIRTH_XPATH); + if(!eIDASAttributes.containsKey(Constants.eIDAS_ATTR_DATEOFBIRTH)) + throw new eIDASAttributeException("dateOfBirth is missing"); + String dateOfBirth = eIDASAttributes.get(Constants.eIDAS_ATTR_DATEOFBIRTH).getValue().get(0); + dateOfBirth = new SimpleDateFormat("yyyy-MM-dd").format(new SimpleDateFormat("yyyyMMdd").parse(dateOfBirth)); + prDateOfBirth.getFirstChild().setNodeValue(dateOfBirth); + + identityLink = new IdentityLinkAssertionParser(idlassertion).parseIdentityLink(); + + //resign IDL + IdentityLinkReSigner identitylinkresigner = IdentityLinkReSigner.getInstance(); + Element resignedilAssertion = identitylinkresigner.resignIdentityLink(identityLink.getSamlAssertion(), config.getStorkFakeIdLResigningKey()); + identityLink = new IdentityLinkAssertionParser(resignedilAssertion).parseIdentityLink(); + + } else { + //contact SZR Gateway + Logger.debug("Starting connecting SZR Gateway"); + + //TODO:!!!!!! + + } + + Logger.debug("SZR communication was successfull"); + + if (identityLink == null) { + Logger.error("SZR Gateway did not return an identity link."); + throw new MOAIDException("stork.10", null); + } + + MOAReversionLogger.getInstance().logEvent(pendingReq, MOAIDEventConstants.AUTHPROCESS_PEPS_IDL_RECEIVED); + moasession.setForeigner(true); + moasession.setIdentityLink(identityLink); + moasession.setBkuURL("Not applicable (eIDASAuthentication)"); + + //store MOA-session to database + AuthenticationSessionStoreage.storeSession(moasession); + + } catch (ParseException | MOAIDException | MOADatabaseException | ParserConfigurationException | SAXException | IOException e) { + throw new TaskExecutionException("IdentityLink generation for foreign person FAILED.", e); + + } catch (eIDASAttributeException e) { + throw new TaskExecutionException("Minimum required eIDAS attributeset not found.", e); + + } + + } + +} diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/ReceiveAuthnResponseTask.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/ReceiveAuthnResponseTask.java index e80d62535..693807d63 100644 --- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/ReceiveAuthnResponseTask.java +++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/tasks/ReceiveAuthnResponseTask.java @@ -10,13 +10,16 @@ import eu.eidas.engine.exceptions.EIDASSAMLEngineException; import at.gv.egovernment.moa.id.auth.MOAIDAuthConstants; import at.gv.egovernment.moa.id.auth.data.AuthenticationSession; +import at.gv.egovernment.moa.id.auth.data.AuthenticationSessionStorageConstants; import at.gv.egovernment.moa.id.auth.exception.MOAIDException; import at.gv.egovernment.moa.id.auth.modules.AbstractAuthServletTask; import at.gv.egovernment.moa.id.auth.modules.TaskExecutionException; import at.gv.egovernment.moa.id.auth.modules.eidas.Constants; import at.gv.egovernment.moa.id.auth.modules.eidas.exceptions.EIDASEngineException; +import at.gv.egovernment.moa.id.auth.modules.eidas.utils.MOAPersonalAttributeList; import at.gv.egovernment.moa.id.auth.modules.eidas.utils.SAMLEngineUtils; import at.gv.egovernment.moa.id.commons.db.ex.MOADatabaseException; +import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory; import at.gv.egovernment.moa.id.config.auth.IOAAuthParameters; import at.gv.egovernment.moa.id.moduls.IRequest; import at.gv.egovernment.moa.id.moduls.RequestStorage; @@ -68,20 +71,36 @@ public class ReceiveAuthnResponseTask extends AbstractAuthServletTask { //TODO: check if additional decryption operation is required } + + //MOA-ID specific response validation + //TODO: implement MOA-ID specific response validation + //update MOA-Session data with received information + Logger.debug("Store eIDAS response information into MOA-session."); + moasession.setQAALevel(samlResp.getAssuranceLevel()); + moasession.setCcc(samlResp.getCountry()); + + moasession.setGenericDataToSession( + AuthenticationSessionStorageConstants.eIDAS_ATTRIBUTELIST, + new MOAPersonalAttributeList(samlResp.getPersonalAttributeList())); + + moasession.setGenericDataToSession( + AuthenticationSessionStorageConstants.eIDAS_RESPONSE, + decSamlToken); + + //set general information to MOA-Session + moasession.setAuthURL(AuthConfigurationProviderFactory.getInstance().getPublicURLPrefix() + "/"); - - - System.out.println(new String(decSamlToken)); - + //store MOA-session to database + AuthenticationSessionStoreage.storeSession(moasession); }catch (EIDASSAMLEngineException e) { Logger.error("eIDAS AuthnRequest generation FAILED.", e); - throw new TaskExecutionException("eIDAS AuthnRequest generation FAILED.", - new EIDASEngineException("Could not generate token for Saml Request", e)); + throw new TaskExecutionException("eIDAS Response processing FAILED.", + new EIDASEngineException("Could not validate eIDAS response", e)); } catch (EIDASEngineException | MOAIDException | MOADatabaseException e) { - throw new TaskExecutionException("eIDAS AuthnRequest generation FAILED.", e); + throw new TaskExecutionException("eIDAS Response processing FAILED.", e); } diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/MOAOrderedAttributeIterator.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/MOAOrderedAttributeIterator.java new file mode 100644 index 000000000..573163af0 --- /dev/null +++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/MOAOrderedAttributeIterator.java @@ -0,0 +1,66 @@ +/* + * Copyright 2014 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + */ +package at.gv.egovernment.moa.id.auth.modules.eidas.utils; + +import java.util.Iterator; +import java.util.NoSuchElementException; + +import at.gv.egovernment.moa.logging.Logger; + +import eu.eidas.auth.commons.PersonalAttribute; +import eu.eidas.auth.commons.PersonalAttributeList; + + +/** + * @author tlenz + * + */ +public class MOAOrderedAttributeIterator implements Iterator { + + private MOAPersonalAttributeList pal; + private Iterator keyIterator; + + public MOAOrderedAttributeIterator(MOAPersonalAttributeList palArg) { + this.pal = palArg; + keyIterator = palArg.getInsertOrder().iterator(); + } + + @Override + public boolean hasNext() { + return keyIterator.hasNext(); + } + + @Override + public PersonalAttribute next() { + if (!hasNext()) { + throw new NoSuchElementException(); + } + return pal.get(keyIterator.next()); + } + + @Override + public void remove() { + Logger.error("Not implemented"); + } + +} diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/MOAPersonalAttributeList.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/MOAPersonalAttributeList.java new file mode 100644 index 000000000..5cc100b70 --- /dev/null +++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/utils/MOAPersonalAttributeList.java @@ -0,0 +1,343 @@ +/* + * Copyright 2014 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + */ +package at.gv.egovernment.moa.id.auth.modules.eidas.utils; + +import java.io.IOException; +import java.io.ObjectInputStream; +import java.util.ArrayList; +import java.util.Collections; +import java.util.HashMap; +import java.util.Iterator; +import java.util.List; +import java.util.Map; +import java.util.StringTokenizer; +import java.util.concurrent.ConcurrentHashMap; + +import org.apache.commons.lang.StringUtils; + +import at.gv.egovernment.moa.logging.Logger; + +import eu.eidas.auth.commons.AttributeConstants; +import eu.eidas.auth.commons.AttributeUtil; +import eu.eidas.auth.commons.EIDASErrors; +import eu.eidas.auth.commons.EIDASParameters; +import eu.eidas.auth.commons.EIDASUtil; +import eu.eidas.auth.commons.EIDASValues; +import eu.eidas.auth.commons.IPersonalAttributeList; +import eu.eidas.auth.commons.PersonalAttribute; +import eu.eidas.auth.commons.exceptions.InternalErrorEIDASException; + +/** + * @author tlenz + * + */ +public final class MOAPersonalAttributeList extends + ConcurrentHashMap implements IPersonalAttributeList { + + /** + * + */ + private static final long serialVersionUID = -4488124133022713089L; + + public MOAPersonalAttributeList(IPersonalAttributeList eIDASAttributeList) { + super(); + Iterator element = eIDASAttributeList.iterator(); + while(element.hasNext()) + add(element.next()); + + } + + /** + * Hash with the latest fetched attribute name alias. + */ + private Map latestAttrAlias = + new HashMap(); + + /** + * Hash with mapping number of alias or the attribute name. + */ + private Map attrAliasNumber = + new HashMap(); + private List insertOrder = new ArrayList(); + + /** + * Obtain the insertOrder Collection + * + * @return defensive copy of the collection + */ + List getInsertOrder() { + return Collections.unmodifiableList(this.insertOrder); + } + + /** + * Default constructor. + */ + public MOAPersonalAttributeList() { + super(); + + } + + /** + * Constructor with initial capacity for the PersonalAttributeList size. + * + * @param capacity The initial capacity for the PersonalAttributeList. + */ + public MOAPersonalAttributeList(final int capacity) { + super(capacity); + } + + /** + * {@inheritDoc} + */ + public Iterator iterator() { + return new MOAOrderedAttributeIterator(this); + } + + /** + * {@inheritDoc} + */ + public PersonalAttribute get(final Object key) { + String attrName = (String) key; + + if (this.latestAttrAlias == null) + this.latestAttrAlias = new HashMap(); + + if (this.attrAliasNumber == null) + this.attrAliasNumber = new HashMap(); + + if (this.latestAttrAlias.containsKey(key)) { + attrName = attrName + this.latestAttrAlias.get(key); + } else { + if (this.attrAliasNumber.containsKey(key)) { + this.latestAttrAlias.put(attrName, this.attrAliasNumber.get(key)); + } + } + return super.get(attrName); + } + + /** + * {@inheritDoc} + */ + public void add(final PersonalAttribute value) { + if (value != null) { + this.put(value.getName(), value); + } + } + + /** + * {@inheritDoc} + */ + public PersonalAttribute put(final String key, final PersonalAttribute val) { + if (StringUtils.isNotEmpty(key) && val != null) { + // Validate if attribute name already exists! + String attrAlias = key; + if (this.containsKey(attrAlias)) { + if (this.attrAliasNumber == null) + this.attrAliasNumber = new HashMap(); + if (!val.isEmptyValue() && StringUtils.isNumeric(val.getValue().get(0))) { + final String attrValue = val.getValue().get(0); + attrAlias = key + attrValue; + this.attrAliasNumber.put(key, Integer.valueOf(attrValue)); + } else { + final PersonalAttribute attr = super.get(key); + if (!attr.isEmptyValue() + && StringUtils.isNumeric(attr.getValue().get(0))) { + attrAlias = key + attr.getValue().get(0); + super.put(key, (PersonalAttribute) attr); + this.attrAliasNumber.put(key, null); + } + } + } else { + if (insertOrder == null) + insertOrder = new ArrayList(); + + insertOrder.add(key); + } + return super.put(attrAlias, val); + } else { + return null; + } + } + + @Override + public PersonalAttribute remove(Object key) { + insertOrder.remove(key); + return super.remove(key); + } + + /** + * {@inheritDoc} + */ + public void populate(final String attrList) { + final StringTokenizer strToken = + new StringTokenizer(attrList, EIDASValues.ATTRIBUTE_SEP.toString()); + + while (strToken.hasMoreTokens()) { + final PersonalAttribute persAttr = new PersonalAttribute(); + String[] tuples = + strToken.nextToken().split(EIDASValues.ATTRIBUTE_TUPLE_SEP.toString(), + AttributeConstants.NUMBER_TUPLES.intValue()); + + // Convert to the new format if needed! + tuples = convertFormat(tuples); + + if (AttributeUtil.hasValidTuples(tuples)) { + final int attrValueIndex = + AttributeConstants.ATTR_VALUE_INDEX.intValue(); + final String tmpAttrValue = + tuples[attrValueIndex].substring(1, + tuples[attrValueIndex].length() - 1); + final String[] vals = + tmpAttrValue.split(EIDASValues.ATTRIBUTE_VALUE_SEP.toString()); + + persAttr.setName(tuples[AttributeConstants.ATTR_NAME_INDEX.intValue()]); + persAttr.setIsRequired(Boolean + .valueOf(tuples[AttributeConstants.ATTR_TYPE_INDEX.intValue()])); + // check if it is a complex value + if (tuples[AttributeConstants.ATTR_NAME_INDEX.intValue()] + .equals(EIDASParameters.COMPLEX_ADDRESS_VALUE.toString())) { + persAttr.setComplexValue(createComplexValue(vals)); + } else { + persAttr.setValue(createValues(vals)); + } + + if (tuples.length == AttributeConstants.NUMBER_TUPLES.intValue()) { + persAttr.setStatus(tuples[AttributeConstants.ATTR_STATUS_INDEX + .intValue()]); + } + this.put(tuples[AttributeConstants.ATTR_NAME_INDEX.intValue()], + persAttr); + + } else { + Logger.info("BUSINESS EXCEPTION : Invalid personal attribute list tuples"); + } + + } + } + + /** + * Returns a copy of this IPersonalAttributeList instance. + * + * @return The copy of this IPersonalAttributeList. + */ + public Object clone() { + try { + MOAPersonalAttributeList theClone= (MOAPersonalAttributeList)super.clone(); + theClone.insertOrder=new ArrayList(insertOrder); + return theClone; + + } catch (CloneNotSupportedException e) { + throw new InternalErrorEIDASException( + EIDASUtil.getConfig(EIDASErrors.INTERNAL_ERROR.errorCode()), + EIDASUtil.getConfig(EIDASErrors.INTERNAL_ERROR.errorMessage()), e); + } + } + + /** + * Creates a string in the following format. + * + * attrName:attrType:[attrValue1,attrValue2=attrComplexValue]:attrStatus; + * + * @return {@inheritDoc} + */ + @Override + public String toString() { + final StringBuilder strBuilder = new StringBuilder(); + final Iterator iteratorInsertOrder = insertOrder.iterator(); + while (iteratorInsertOrder.hasNext()) { + String key = iteratorInsertOrder.next(); + final PersonalAttribute attr = get(key); + strBuilder.append(attr.toString()); + if (isNumberAlias(key)) { + strBuilder.append(get(key).toString()); + } + } + return strBuilder.toString(); + } + + /** + * Validates and creates the attribute's complex values. + * + * @param values The complex values. + * @return The {@link Map} with the complex values. + * @see Map + */ + private Map createComplexValue(final String[] values) { + final Map complexValue = new HashMap(); + for (final String val : values) { + final String[] tVal = val.split("="); + if (StringUtils.isNotEmpty(val) && tVal.length == 2) { + complexValue.put(tVal[0], AttributeUtil.unescape(tVal[1])); + } + } + return complexValue; + } + + /** + * Validates and creates the attribute values. + * + * @param vals The attribute values. + * @return The {@link List} with the attribute values. + * @see List + */ + private List createValues(final String[] vals) { + final List values = new ArrayList(); + for (final String val : vals) { + if (StringUtils.isNotEmpty(val)) { + values.add(AttributeUtil.unescape(val)); + } + } + return values; + } + + ////////////////// + /** + * Converts the attribute tuple (attrName:attrType...) to the new format. + * + * @param tuples The attribute tuples to convert. + * @return The attribute tuples in the new format. + */ + private String[] convertFormat(final String[] tuples) { + final String[] newFormatTuples = + new String[AttributeConstants.NUMBER_TUPLES.intValue()]; + if (tuples != null) { + System.arraycopy(tuples, 0, newFormatTuples, 0, tuples.length); + + for (int i = tuples.length; i < newFormatTuples.length; i++) { + if (i == AttributeConstants.ATTR_VALUE_INDEX.intValue()) { + newFormatTuples[i] = "[]"; + } else { + newFormatTuples[i] = ""; + } + } + } + return newFormatTuples; + } + + public boolean isNumberAlias(String key) { + return this.attrAliasNumber.containsKey(key); + } + + + +} diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/resources/at/gv/egovernment/moa/id/auth/modules/eidas/eIDAS.Authentication.process.xml b/id/server/modules/moa-id-module-eIDAS/src/main/resources/at/gv/egovernment/moa/id/auth/modules/eidas/eIDAS.Authentication.process.xml index 2a16b2e23..f24ff1c28 100644 --- a/id/server/modules/moa-id-module-eIDAS/src/main/resources/at/gv/egovernment/moa/id/auth/modules/eidas/eIDAS.Authentication.process.xml +++ b/id/server/modules/moa-id-module-eIDAS/src/main/resources/at/gv/egovernment/moa/id/auth/modules/eidas/eIDAS.Authentication.process.xml @@ -5,17 +5,14 @@ + - - - - - + + - - - - + + + diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/resources/resources/xmldata/fakeIdL_IdL_template.xml b/id/server/modules/moa-id-module-eIDAS/src/main/resources/resources/xmldata/fakeIdL_IdL_template.xml new file mode 100644 index 000000000..09084a34f --- /dev/null +++ b/id/server/modules/moa-id-module-eIDAS/src/main/resources/resources/xmldata/fakeIdL_IdL_template.xml @@ -0,0 +1,51 @@ + + + + + urn:oasis:names:tc:SAML:1.0:cm:sender-vouches + + wJO/bvDJjUysG0yARn7I6w==urn:publicid:gv.at:baseidXXXRúùdXXXVàn Nisteĺrooy1969-02-13 + + + + 4Y4FL09VhczsfYQgFPuycP8quJNZBAAu1R1rFXNodI2711B6BTMjAGQn6xuFWfd3/nyFav/MLTr/ +t2VazvANS4TRFxJAcWyIx7xbxCdzZr6gJ+FCmq4g5JPrQvt50v3JX+wKSYft1gHBOWlDn90Ia4Gm +P8MVuze21T+VVKM6ZklmS6d5PT1er/uYQFydGErmJ17xlSQG6Fi5xuftopBDyJxG1tL1KIebpLFg +gaM2EyuB1HxH8/+Mfqa4UgeqIH65AQAB + + + + + + + + not(ancestor-or-self::pr:Identification) + + + + + KEQEPY2O3Z3IRaISSSoRZVPzsHE= + + + + gzGhjH1kdmPcPbgen0xojNIoJLk= + + + + 06wqWHgplwpu3N5HMhzb6QC5NkXMO1z4N4oc1L6eDqwZlvFJ9X1XGW//QqviKO9oog3il7IzdfJwnjygR4trgGCIqx+JYCDHJCrG9l8zlxlSW0ZqfsygGXthutcQ1aeUpfO6jYuhnWOUywa8BgzukRtWT+AOJBQZPRYTb8IBmey+uAwlhFLni94eMOd81l+efCvkWi3jRajwsG8ZOaNxSZT3aEV5vj+32Aqtx2MPEVzQWtIA7GqZi+EzcdSdHQvHhg7UB+8kqbU70ENAJbEMTANFZYvLOJ0Om9KfDtPf/+R2TvTc360fNo9RnPl04pHPhCIjcGZhFZorBpUhXFwd2Q== + MIIF3TCCBMWgAwIBAgIDByniMA0GCSqGSIb3DQEBBQUAMIGfMQswCQYDVQQGEwJBVDFIMEYGA1UECgw/QS1UcnVzdCBHZXMuIGYuIFNpY2hlcmhlaXRzc3lzdGVtZSBpbSBlbGVrdHIuIERhdGVudmVya2VociBHbWJIMSIwIAYDVQQLDBlhLXNpZ24tY29ycG9yYXRlLWxpZ2h0LTAyMSIwIAYDVQQDDBlhLXNpZ24tY29ycG9yYXRlLWxpZ2h0LTAyMB4XDTEwMDcyODExMzY0M1oXDTE1MDcyODExMzY0M1owgbYxCzAJBgNVBAYTAkFUMR4wHAYDVQQKDBVEYXRlbnNjaHV0emtvbW1pc3Npb24xIjAgBgNVBAsMGVN0YW1temFobHJlZ2lzdGVyYmVob2VyZGUxLjAsBgNVBAMMJVNpZ25hdHVyc2VydmljZSBEYXRlbnNjaHV0emtvbW1pc3Npb24xFTATBgNVBAUTDDMyNTkyODMyMzk5ODEcMBoGCSqGSIb3DQEJARYNZHNrQGRzay5ndi5hdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN+dBSEBGj2jUXIK1Mp3lVxc/Za+pJMiyKrX3G1ZxgX/ikx7D9scsPYMt473LlAWl9cmCbHbJK+PV2XNNdURLMUCIX+4vUNs2MHeDTQtX8BXjJFpwJYSoaRJQ39FVS/1r5sWcra9Hhdm7w5Gtx/2ukyDX0kdkxawkhP4EQEzi/SI+Fugn+WqgQ1nAdlbxb/dcBw5w1h9b3lmuwUf4z3ooQWUD2DgA/kKd1KejNR43mLUsmvSzevPxT9zs78pOR1OacB7IszTVJPXeOEaaNZHnnB/UeO3g8LEV/3OkXcUgcMkbIIiaBHlll71Pq0COj9kqjXoe7OrRjLY5i3KwOpa6TMCAwEAAaOCAgcwggIDMBMGA1UdIwQMMAqACEkcWDpP6A0DMH8GCCsGAQUFBwEBBHMwcTAnBggrBgEFBQcwAYYbaHR0cDovL29jc3AuYS10cnVzdC5hdC9vY3NwMEYGCCsGAQUFBzAChjpodHRwOi8vd3d3LmEtdHJ1c3QuYXQvY2VydHMvYS1zaWduLWNvcnBvcmF0ZS1saWdodC0wMmEuY3J0MFQGA1UdIARNMEswSQYGKigAEQESMD8wPQYIKwYBBQUHAgEWMWh0dHA6Ly93d3cuYS10cnVzdC5hdC9kb2NzL2NwL2Etc2lnbi1BbXRzc2lnbmF0dXIwgZ4GA1UdHwSBljCBkzCBkKCBjaCBioaBh2xkYXA6Ly9sZGFwLmEtdHJ1c3QuYXQvb3U9YS1zaWduLWNvcnBvcmF0ZS1saWdodC0wMixvPUEtVHJ1c3QsYz1BVD9jZXJ0aWZpY2F0ZXJldm9jYXRpb25saXN0P2Jhc2U/b2JqZWN0Y2xhc3M9ZWlkQ2VydGlmaWNhdGlvbkF1dGhvcml0eTARBgNVHQ4ECgQITAgOnhr0tbowDgYDVR0PAQH/BAQDAgSwMCAGA1UdEQQZMBeBFW1hcmN1cy5oaWxkQGRzay5ndi5hdDAJBgNVHRMEAjAAMA4GByooAAoBBwEEAwEB/zAUBgcqKAAKAQEBBAkMB0JTQi1EU0swDQYJKoZIhvcNAQEFBQADggEBAHTklnvPCH/bJSOlIPbLUEkSGuFHsektSZ8Vr22x/Yv7EzsxoQrJIiz2mQ2gQqFuExdWYxvsowjiSbiis9iUf1c0zscvDS3mIZxGs4M89XHsjHnIyb+Fuwnamw65QrFvM1tNB1ZMjxJ3x+YmHLHdtT3BEBcr3/NCRHd2S0HoBspNz9HVgJaZY1llR7poKBvnAc4g1i+QTvyVb00PtKxR9Lw/9ABInX/1pzpxqrPy7Ib2OP8z6dd3WHmIsCiSHUaj0Dxwwln6fYJjhxZ141SnbovlCLYtrsZLXoi9ljIqX4xO0PwMI2RfNc9cXxTRrRS6rEOvX7PpvgXiDXhp592Yyp4= + + + + + + not(ancestor-or-self::dsig:Signature) + + + + 8e7RjLnA4Mgltq5ruIJzheKGxu0= + + + + + \ No newline at end of file -- cgit v1.2.3 From 320485ae06e93da206049f4c3706db4e4fec554b Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Wed, 13 Jan 2016 14:03:03 +0100 Subject: refactor PVP Metadata provider functionality --- .../auth/builder/SignatureVerificationUtils.java | 172 +++++++++++++++++ .../auth/invoke/SignatureVerificationInvoker.java | 142 ++++++++++++++ .../parser/VerifyXMLSignatureResponseParser.java | 211 +++++++++++++++++++++ .../pvp2x/metadata/MOAMetadataProvider.java | 10 +- .../verification/metadata/MetadataFilterChain.java | 82 -------- .../metadata/PVPMetadataFilterChain.java | 54 ++++++ .../moa/id/saml2/MetadataFilterChain.java | 73 +++++++ .../auth/invoke/SignatureVerificationInvoker.java | 142 -------------- .../parser/VerifyXMLSignatureResponseParser.java | 211 --------------------- .../engine/MOAeIDASMetadataSignatureFilter.java | 132 +++++++++++++ 10 files changed, 789 insertions(+), 440 deletions(-) create mode 100644 id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SignatureVerificationUtils.java create mode 100644 id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java create mode 100644 id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/VerifyXMLSignatureResponseParser.java delete mode 100644 id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/metadata/MetadataFilterChain.java create mode 100644 id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/metadata/PVPMetadataFilterChain.java create mode 100644 id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/saml2/MetadataFilterChain.java delete mode 100644 id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java delete mode 100644 id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/parser/VerifyXMLSignatureResponseParser.java create mode 100644 id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASMetadataSignatureFilter.java (limited to 'id/server/idserverlib/src') diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SignatureVerificationUtils.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SignatureVerificationUtils.java new file mode 100644 index 000000000..e321c9d05 --- /dev/null +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/builder/SignatureVerificationUtils.java @@ -0,0 +1,172 @@ +/* + * Copyright 2014 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + */ +package at.gv.egovernment.moa.id.auth.builder; + +import javax.xml.parsers.DocumentBuilder; +import javax.xml.parsers.DocumentBuilderFactory; + +import org.w3c.dom.Document; +import org.w3c.dom.Element; +import org.w3c.dom.Node; + +import at.gv.egovernment.moa.id.auth.data.VerifyXMLSignatureResponse; +import at.gv.egovernment.moa.id.auth.exception.BuildException; +import at.gv.egovernment.moa.id.auth.exception.MOAIDException; +import at.gv.egovernment.moa.id.auth.exception.ParseException; +import at.gv.egovernment.moa.id.auth.exception.ServiceException; +import at.gv.egovernment.moa.id.auth.invoke.SignatureVerificationInvoker; +import at.gv.egovernment.moa.id.auth.parser.VerifyXMLSignatureResponseParser; +import at.gv.egovernment.moa.logging.Logger; +import at.gv.egovernment.moa.util.Base64Utils; +import at.gv.egovernment.moa.util.Constants; + +/** + * @author tlenz + * + */ +public class SignatureVerificationUtils { + /** shortcut for XMLNS namespace URI */ + private static final String XMLNS_NS_URI = Constants.XMLNS_NS_URI; + /** shortcut for MOA namespace URI */ + private static final String MOA_NS_URI = Constants.MOA_NS_URI; + /** The DSIG-Prefix */ + private static final String DSIG = Constants.DSIG_PREFIX + ":"; + + /** The document containing the VerifyXMLsignatureRequest */ + private Document requestDoc_; + /** the VerifyXMLsignatureRequest root element */ + private Element requestElem_; + + + public SignatureVerificationUtils() throws BuildException { + try { + DocumentBuilder docBuilder = DocumentBuilderFactory.newInstance().newDocumentBuilder(); + requestDoc_ = docBuilder.newDocument(); + requestElem_ = requestDoc_.createElementNS(MOA_NS_URI, "VerifyXMLSignatureRequest"); + requestElem_.setAttributeNS(XMLNS_NS_URI, "xmlns", MOA_NS_URI); + requestElem_.setAttributeNS(XMLNS_NS_URI, "xmlns:" + Constants.DSIG_PREFIX, Constants.DSIG_NS_URI); + requestDoc_.appendChild(requestElem_); + + } catch (Throwable t) { + throw new BuildException( + "builder.00", + new Object[] {"VerifyXMLSignatureRequest", t.toString()}, + t); + } + } + + public VerifyXMLSignatureResponse verify(byte[] signature, String trustProfileID) throws MOAIDException { + try { + //build signature-verification request + Element domVerifyXMLSignatureRequest = build(signature, trustProfileID); + + //send signature-verification to MOA-SP + Element domVerifyXMLSignatureResponse = new SignatureVerificationInvoker() + .verifyXMLSignature(domVerifyXMLSignatureRequest); + + // parses the + VerifyXMLSignatureResponse verifyXMLSignatureResponse = new VerifyXMLSignatureResponseParser( + domVerifyXMLSignatureResponse).parseData(); + + return verifyXMLSignatureResponse; + + } catch (ParseException e) { + Logger.error("Build signature-verification request FAILED." ,e); + throw e; + + } catch (ServiceException e) { + Logger.error("MOA-SP signature verification FAILED." ,e); + throw e; + + } + + } + + /** + * Builds a <VerifyXMLSignatureRequest> + * from an IdentityLink with a known trustProfileID which + * has to exist in MOA-SP + * @param signature - The XML signature as byte[] + * @param trustProfileID - a preconfigured TrustProfile at MOA-SP + * + * @return Element - The complete request as Dom-Element + * + * @throws ParseException + */ + private Element build(byte[] signature, String trustProfileID) + throws ParseException + { + try { + // build the request + Element verifiySignatureInfoElem = + requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureInfo"); + requestElem_.appendChild(verifiySignatureInfoElem); + Element verifySignatureEnvironmentElem = + requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureEnvironment"); + verifiySignatureInfoElem.appendChild(verifySignatureEnvironmentElem); + Element base64ContentElem = requestDoc_.createElementNS(MOA_NS_URI, "Base64Content"); + verifySignatureEnvironmentElem.appendChild(base64ContentElem); + + // insert the base64 encoded signature + String base64EncodedAssertion = Base64Utils.encode(signature); + //replace all '\r' characters by no char. + StringBuffer replaced = new StringBuffer(); + for (int i = 0; i < base64EncodedAssertion.length(); i ++) { + char c = base64EncodedAssertion.charAt(i); + if (c != '\r') { + replaced.append(c); + } + } + base64EncodedAssertion = replaced.toString(); + Node base64Content = requestDoc_.createTextNode(base64EncodedAssertion); + base64ContentElem.appendChild(base64Content); + + // specify the signature location + Element verifySignatureLocationElem = + requestDoc_.createElementNS(MOA_NS_URI, "VerifySignatureLocation"); + verifiySignatureInfoElem.appendChild(verifySignatureLocationElem); + Node signatureLocation = requestDoc_.createTextNode(DSIG + "Signature"); + verifySignatureLocationElem.appendChild(signatureLocation); + + // signature manifest params + Element signatureManifestCheckParamsElem = + requestDoc_.createElementNS(MOA_NS_URI, "SignatureManifestCheckParams"); + requestElem_.appendChild(signatureManifestCheckParamsElem); + signatureManifestCheckParamsElem.setAttribute("ReturnReferenceInputData", "false"); + + Element returnHashInputDataElem = + requestDoc_.createElementNS(MOA_NS_URI, "ReturnHashInputData"); + requestElem_.appendChild(returnHashInputDataElem); + + //add trustProfileID + Element trustProfileIDElem = requestDoc_.createElementNS(MOA_NS_URI, "TrustProfileID"); + trustProfileIDElem.appendChild(requestDoc_.createTextNode(trustProfileID)); + requestElem_.appendChild(trustProfileIDElem); + } catch (Throwable t) { + throw new ParseException("builder.00", + new Object[] { "VerifyXMLSignatureRequest (IdentityLink)" }, t); + } + + return requestElem_; + } +} diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java new file mode 100644 index 000000000..72a7d3ba1 --- /dev/null +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java @@ -0,0 +1,142 @@ +/******************************************************************************* + * Copyright 2014 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + ******************************************************************************/ +/* + * Copyright 2003 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + */ + + +package at.gv.egovernment.moa.id.auth.invoke; + +import java.util.Vector; + +import javax.xml.namespace.QName; +import javax.xml.rpc.Call; +import javax.xml.rpc.Service; +import javax.xml.rpc.ServiceFactory; + +import org.apache.axis.message.SOAPBodyElement; +import org.w3c.dom.Document; +import org.w3c.dom.Element; + +import at.gv.egovernment.moa.id.auth.exception.ServiceException; +import at.gv.egovernment.moa.id.config.ConnectionParameter; +import at.gv.egovernment.moa.id.config.auth.AuthConfiguration; +import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory; +import at.gv.egovernment.moa.logging.Logger; +import at.gv.egovernment.moa.spss.api.SignatureVerificationService; +import at.gv.egovernment.moa.spss.api.xmlbind.VerifyXMLSignatureRequestParser; +import at.gv.egovernment.moa.spss.api.xmlbind.VerifyXMLSignatureResponseBuilder; +import at.gv.egovernment.moa.spss.api.xmlverify.VerifyXMLSignatureRequest; +import at.gv.egovernment.moa.spss.api.xmlverify.VerifyXMLSignatureResponse; +import at.gv.egovernment.moa.util.MiscUtil; + +/** + * Invoker of the SignatureVerification web service of MOA-SPSS.
+ * Either invokes the web service, or calls the corresponding API, depending on configuration data. + * + * @author Stefan Knirsch + * @version $Id$ + */ +public class SignatureVerificationInvoker { + /** This QName Object identifies the SignatureVerification endpoint of the web service */ + private static final QName SERVICE_QNAME = new QName("SignatureVerification"); + + /** + * Method verifyXMLSignature. + * @param request to be sent + * @return Element with the answer + * @throws ServiceException if an error occurs + */ + public Element verifyXMLSignature(Element request) throws ServiceException { + return doCall(SERVICE_QNAME, request); + } + + /** + * Method doCall. + * @param serviceName the name of the service + * @param request the request to be sent + * @return Element the answer + * @throws ServiceException if an error occurs + */ + protected Element doCall(QName serviceName, Element request) throws ServiceException { + ConnectionParameter authConnParam = null; + try { + Service service = ServiceFactory.newInstance().createService(serviceName); + Call call = service.createCall(); + SOAPBodyElement body = new SOAPBodyElement(request); + SOAPBodyElement[] params = new SOAPBodyElement[] { body }; + Vector responses; + SOAPBodyElement response; + + String endPoint; + AuthConfiguration authConfigProvider = AuthConfigurationProviderFactory.getInstance(); + authConnParam = authConfigProvider.getMoaSpConnectionParameter(); + //If the ConnectionParameter do NOT exist, we try to get the api to work.... + if (authConnParam != null && MiscUtil.isNotEmpty(authConnParam.getUrl())) { + Logger.debug("Connecting using auth url: " + authConnParam.getUrl() + ", service " + serviceName.getNamespaceURI() + " : " + serviceName.getLocalPart() + " : "+ serviceName.getPrefix()); + endPoint = authConnParam.getUrl(); + call.setTargetEndpointAddress(endPoint); + responses = (Vector) call.invoke(serviceName, params); + Logger.debug("Got responses: " + responses.size()); // TODO handle axis 302 response when incorrect service url is used + response = (SOAPBodyElement) responses.get(0); + return response.getAsDOM(); + } + else { + SignatureVerificationService svs = SignatureVerificationService.getInstance(); + VerifyXMLSignatureRequest vsrequest = new VerifyXMLSignatureRequestParser().parse(request); + + VerifyXMLSignatureResponse vsresponse = svs.verifyXMLSignature(vsrequest); + Document result = new VerifyXMLSignatureResponseBuilder().build(vsresponse); + + //Logger.setHierarchy("moa.id.auth"); + return result.getDocumentElement(); + } + } + catch (Exception ex) { + if (authConnParam != null) { + throw new ServiceException("service.00", new Object[] { ex.toString()}, ex); + } else { + throw new ServiceException("service.03", new Object[] { ex.toString()}, ex); + } + } + } +} diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/VerifyXMLSignatureResponseParser.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/VerifyXMLSignatureResponseParser.java new file mode 100644 index 000000000..7bce406e0 --- /dev/null +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/parser/VerifyXMLSignatureResponseParser.java @@ -0,0 +1,211 @@ +/******************************************************************************* + * Copyright 2014 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + ******************************************************************************/ +/* + * Copyright 2003 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + */ + + +package at.gv.egovernment.moa.id.auth.parser; + +import iaik.utils.Base64InputStream; +import iaik.x509.X509Certificate; + +import java.io.ByteArrayInputStream; +import java.io.InputStream; + +import org.w3c.dom.Element; + +import at.gv.egovernment.moa.id.auth.data.VerifyXMLSignatureResponse; +import at.gv.egovernment.moa.id.auth.exception.ParseException; +import at.gv.egovernment.moa.util.Constants; +import at.gv.egovernment.moa.util.DOMUtils; +import at.gv.egovernment.moa.util.XPathUtils; + +/** + * Parses a <VerifyXMLSignatureResponse> returned by + * MOA-SPSS. + * This class implements the Singleton pattern + * + * @author Stefan Knirsch + * @version $Id$ + */ + + +public class VerifyXMLSignatureResponseParser { + // + // XPath namespace prefix shortcuts + // + /** Xpath prefix for reaching MOA Namespaces */ + private static final String MOA = Constants.MOA_PREFIX + ":"; + /** Xpath prefix for reaching DSIG Namespaces */ + private static final String DSIG = Constants.DSIG_PREFIX + ":"; + /** Xpath expression to the root element */ + private static final String ROOT = "/" + MOA + "VerifyXMLSignatureResponse/"; + + /** Xpath expression to the X509SubjectName element */ + private static final String DSIG_SUBJECT_NAME_XPATH = + ROOT + MOA + "SignerInfo/" + DSIG + "X509Data/" + + DSIG + "X509SubjectName"; + /** Xpath expression to the X509Certificate element */ + private static final String DSIG_X509_CERTIFICATE_XPATH = + ROOT + MOA + "SignerInfo/" + DSIG + "X509Data/" + + DSIG + "X509Certificate"; + /** Xpath expression to the PublicAuthority element */ + private static final String PUBLIC_AUTHORITY_XPATH = + ROOT + MOA + "SignerInfo/" + DSIG + "X509Data/" + + MOA + "PublicAuthority"; + /** Xpath expression to the PublicAuthorityCode element */ + private static final String PUBLIC_AUTHORITY_CODE_XPATH = + PUBLIC_AUTHORITY_XPATH + "/" + MOA + "Code"; + /** Xpath expression to the QualifiedCertificate element */ + private static final String QUALIFIED_CERTIFICATE_XPATH = + ROOT + MOA + "SignerInfo/" + DSIG + "X509Data/" + + MOA + "QualifiedCertificate"; + + /** Xpath expression to the SignatureCheckCode element */ + private static final String SIGNATURE_CHECK_CODE_XPATH = + ROOT + MOA + "SignatureCheck/" + MOA + "Code"; + /** Xpath expression to the XMLDSIGManifestCheckCode element */ + private static final String XMLDSIG_MANIFEST_CHECK_CODE_XPATH = + ROOT + MOA + "XMLDSIGManifestCheck/" + MOA + "Code"; + /** Xpath expression to the SignatureManifestCheckCode element */ + private static final String SIGNATURE_MANIFEST_CHECK_CODE_XPATH = + ROOT + MOA + "SignatureManifestCheck/" + MOA + "Code"; + /** Xpath expression to the CertificateCheckCode element */ + private static final String CERTIFICATE_CHECK_CODE_XPATH = + ROOT + MOA + "CertificateCheck/" + MOA + "Code"; + + + /** This is the root element of the XML-Document provided by the Security Layer Card*/ + private Element verifyXMLSignatureResponse; + + /** + * Constructor for VerifyXMLSignatureResponseParser. + * A DOM-representation of the incoming String will be created + * @param xmlResponse <InfoboxReadResponse> as String + * @throws ParseException on any parsing error + */ + public VerifyXMLSignatureResponseParser(String xmlResponse) throws ParseException{ + try { + InputStream s = new ByteArrayInputStream(xmlResponse.getBytes("UTF-8")); + + verifyXMLSignatureResponse = DOMUtils.parseXmlValidating(s); + } + catch (Throwable t) { + throw new ParseException("parser.01", new Object[] { t.toString() }, t); + } + } + + /** + * Constructor for VerifyXMLSignatureResponseParser. + * A DOM-representation of the incoming Inputstream will be created + * @param xmlResponse <InfoboxReadResponse> as InputStream + * @throws Exception on any parsing error + */ + public VerifyXMLSignatureResponseParser(InputStream xmlResponse) throws Exception + { + try { + verifyXMLSignatureResponse = DOMUtils.parseXmlValidating(xmlResponse); + } + catch (Throwable t) { + throw new ParseException("parser.01", null, t); + } + } + + /** + * Constructor for VerifyXMLSignatureResponseParser. + * The incoming Element will be used for further operations + * @param xmlResponse <InfoboxReadResponse> as Element + */ + public VerifyXMLSignatureResponseParser(Element xmlResponse) + { + verifyXMLSignatureResponse =xmlResponse; + + } + + /** + * Parse identity link from <InfoboxReadResponse> + * @return Identity link + * @throws ParseException on any parsing error + */ + + public VerifyXMLSignatureResponse parseData() throws ParseException { + + VerifyXMLSignatureResponse respData=new VerifyXMLSignatureResponse(); + + try { + + String s = DOMUtils.serializeNode(verifyXMLSignatureResponse); + respData.setXmlDsigSubjectName(XPathUtils.getElementValue(verifyXMLSignatureResponse,DSIG_SUBJECT_NAME_XPATH,"")); + Element e = (Element)XPathUtils.selectSingleNode(verifyXMLSignatureResponse,QUALIFIED_CERTIFICATE_XPATH); + respData.setQualifiedCertificate(e!=null); + + Base64InputStream in = new Base64InputStream(new ByteArrayInputStream(XPathUtils.getElementValue( + verifyXMLSignatureResponse,DSIG_X509_CERTIFICATE_XPATH,"").getBytes("UTF-8")),true); + + respData.setX509certificate(new X509Certificate(in)); + Element publicAuthority = (Element)XPathUtils.selectSingleNode(verifyXMLSignatureResponse,PUBLIC_AUTHORITY_XPATH); + respData.setPublicAuthority(publicAuthority != null); + respData.setPublicAuthorityCode(XPathUtils.getElementValue(verifyXMLSignatureResponse,PUBLIC_AUTHORITY_CODE_XPATH,"")); + respData.setSignatureCheckCode(new Integer(XPathUtils.getElementValue(verifyXMLSignatureResponse,SIGNATURE_CHECK_CODE_XPATH,"")).intValue()); + + String xmlDsigCheckCode = XPathUtils.getElementValue(verifyXMLSignatureResponse,XMLDSIG_MANIFEST_CHECK_CODE_XPATH,null); + if (xmlDsigCheckCode!=null) { + respData.setXmlDSIGManigest(true); + respData.setXmlDSIGManifestCheckCode(new Integer(xmlDsigCheckCode).intValue()); + } else { + respData.setXmlDSIGManigest(false); + } + String signatureManifestCheckCode = XPathUtils.getElementValue(verifyXMLSignatureResponse,SIGNATURE_MANIFEST_CHECK_CODE_XPATH,null); + if (signatureManifestCheckCode != null) { + respData.setSignatureManifestCheckCode(new Integer(signatureManifestCheckCode).intValue()); + } + respData.setCertificateCheckCode(new Integer(XPathUtils.getElementValue(verifyXMLSignatureResponse,CERTIFICATE_CHECK_CODE_XPATH,"")).intValue()); + } + catch (Throwable t) { + throw new ParseException("parser.01", null, t); + } + return respData; + } + + +} diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java index f33cadc41..f4c099878 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java @@ -60,7 +60,7 @@ import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants; import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.filter.SchemaValidationException; import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.filter.SignatureValidationException; import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.InterfederatedIDPPublicServiceFilter; -import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.MetadataFilterChain; +import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.PVPMetadataFilterChain; import at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata.SchemaValidationFilter; import at.gv.egovernment.moa.logging.Logger; import at.gv.egovernment.moa.util.Base64Utils; @@ -422,8 +422,8 @@ public class MOAMetadataProvider implements ObservableMetadataProvider{ internalProvider = chainProvider; } - private MetadataFilterChain buildMetadataFilterChain(OAAuthParameter oaParam, String metadataURL, byte[] certificate) throws CertificateException { - MetadataFilterChain filterChain = new MetadataFilterChain(metadataURL, certificate); + private PVPMetadataFilterChain buildMetadataFilterChain(OAAuthParameter oaParam, String metadataURL, byte[] certificate) throws CertificateException { + PVPMetadataFilterChain filterChain = new PVPMetadataFilterChain(metadataURL, certificate); filterChain.getFilters().add(new SchemaValidationFilter()); if (oaParam.isInderfederationIDP()) { @@ -435,7 +435,7 @@ public class MOAMetadataProvider implements ObservableMetadataProvider{ return filterChain; } - private HTTPMetadataProvider createNewHTTPMetaDataProvider(String metadataURL, byte[] certificate, String oaName, MetadataFilterChain filter) { + private HTTPMetadataProvider createNewHTTPMetaDataProvider(String metadataURL, byte[] certificate, String oaName, PVPMetadataFilterChain filter) { HTTPMetadataProvider httpProvider = null; Timer timer= null; MOAHttpClient httpClient = null; @@ -470,7 +470,7 @@ public class MOAMetadataProvider implements ObservableMetadataProvider{ //httpProvider.setRefreshDelayFactor(0.1F); if (filter == null) { - filter = new MetadataFilterChain(metadataURL, certificate); + filter = new PVPMetadataFilterChain(metadataURL, certificate); } httpProvider.setMetadataFilter(filter); httpProvider.initialize(); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/metadata/MetadataFilterChain.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/metadata/MetadataFilterChain.java deleted file mode 100644 index 4e1d939ff..000000000 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/metadata/MetadataFilterChain.java +++ /dev/null @@ -1,82 +0,0 @@ -/* - * Copyright 2014 Federal Chancellery Austria - * MOA-ID has been developed in a cooperation between BRZ, the Federal - * Chancellery Austria - ICT staff unit, and Graz University of Technology. - * - * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by - * the European Commission - subsequent versions of the EUPL (the "Licence"); - * You may not use this work except in compliance with the Licence. - * You may obtain a copy of the Licence at: - * http://www.osor.eu/eupl/ - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the Licence is distributed on an "AS IS" basis, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the Licence for the specific language governing permissions and - * limitations under the Licence. - * - * This product combines work with different licenses. See the "NOTICE" text - * file for details on the various modules and licenses. - * The "NOTICE" text file is part of the distribution. Any derivative works - * that you distribute must include a readable copy of the "NOTICE" text file. - */ -package at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata; - -import java.security.cert.CertificateException; -import java.util.ArrayList; -import java.util.List; - -import org.opensaml.saml2.metadata.provider.FilterException; -import org.opensaml.saml2.metadata.provider.MetadataFilter; -import org.opensaml.xml.XMLObject; - -import at.gv.egovernment.moa.logging.Logger; - -/** - * @author tlenz - * - */ -public class MetadataFilterChain implements MetadataFilter { - - private List filters = new ArrayList(); - - /** - * @throws CertificateException - * - */ - public MetadataFilterChain(String url, byte[] certificate) throws CertificateException { - addDefaultFilters(url, certificate); - } - - public void addDefaultFilters(String url, byte[] certificate) throws CertificateException { - filters.add(new MetadataSignatureFilter(url, certificate)); - - } - - /** - * @return the filter - */ - public List getFilters() { - return filters; - } - - - /* (non-Javadoc) - * @see org.opensaml.saml2.metadata.provider.MetadataFilter#doFilter(org.opensaml.xml.XMLObject) - */ - @Override - public void doFilter(XMLObject arg0) throws FilterException { - for (MetadataFilter filter : filters) { - Logger.trace("Use MOAMetadatafilter " + filter.getClass().getName()); - filter.doFilter(arg0); - } - - } - - - - - - - -} diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/metadata/PVPMetadataFilterChain.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/metadata/PVPMetadataFilterChain.java new file mode 100644 index 000000000..4c1da747b --- /dev/null +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/metadata/PVPMetadataFilterChain.java @@ -0,0 +1,54 @@ +/* + * Copyright 2014 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + */ +package at.gv.egovernment.moa.id.protocols.pvp2x.verification.metadata; + +import java.security.cert.CertificateException; + +import at.gv.egovernment.moa.id.saml2.MetadataFilterChain; + +/** + * @author tlenz + * + */ +public class PVPMetadataFilterChain extends MetadataFilterChain { + + + /** + * @throws CertificateException + * + */ + public PVPMetadataFilterChain(String url, byte[] certificate) throws CertificateException { + addDefaultFilters(url, certificate); + } + + public void addDefaultFilters(String url, byte[] certificate) throws CertificateException { + addFilter(new MetadataSignatureFilter(url, certificate)); + + } + + + + + + +} diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/saml2/MetadataFilterChain.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/saml2/MetadataFilterChain.java new file mode 100644 index 000000000..e7412a0fc --- /dev/null +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/saml2/MetadataFilterChain.java @@ -0,0 +1,73 @@ +/* + * Copyright 2014 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + */ +package at.gv.egovernment.moa.id.saml2; + +import java.util.ArrayList; +import java.util.List; + +import org.opensaml.saml2.metadata.provider.FilterException; +import org.opensaml.saml2.metadata.provider.MetadataFilter; +import org.opensaml.xml.XMLObject; + +import at.gv.egovernment.moa.logging.Logger; + +/** + * @author tlenz + * + */ +public class MetadataFilterChain implements MetadataFilter { + + private List filters = new ArrayList(); + + /** + * Return all actually used Metadata filters + * + * @return List of Metadata filters + */ + public List getFilters() { + return filters; + } + + /** + * Add a new Metadata filter to filterchain + * + * @param filter + */ + public void addFilter(MetadataFilter filter) { + filters.add(filter); + } + + + /* (non-Javadoc) + * @see org.opensaml.saml2.metadata.provider.MetadataFilter#doFilter(org.opensaml.xml.XMLObject) + */ + @Override + public void doFilter(XMLObject arg0) throws FilterException { + for (MetadataFilter filter : filters) { + Logger.trace("Use MOAMetadataFilter " + filter.getClass().getName()); + filter.doFilter(arg0); + } + + } + +} diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java deleted file mode 100644 index 72a7d3ba1..000000000 --- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/invoke/SignatureVerificationInvoker.java +++ /dev/null @@ -1,142 +0,0 @@ -/******************************************************************************* - * Copyright 2014 Federal Chancellery Austria - * MOA-ID has been developed in a cooperation between BRZ, the Federal - * Chancellery Austria - ICT staff unit, and Graz University of Technology. - * - * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by - * the European Commission - subsequent versions of the EUPL (the "Licence"); - * You may not use this work except in compliance with the Licence. - * You may obtain a copy of the Licence at: - * http://www.osor.eu/eupl/ - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the Licence is distributed on an "AS IS" basis, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the Licence for the specific language governing permissions and - * limitations under the Licence. - * - * This product combines work with different licenses. See the "NOTICE" text - * file for details on the various modules and licenses. - * The "NOTICE" text file is part of the distribution. Any derivative works - * that you distribute must include a readable copy of the "NOTICE" text file. - ******************************************************************************/ -/* - * Copyright 2003 Federal Chancellery Austria - * MOA-ID has been developed in a cooperation between BRZ, the Federal - * Chancellery Austria - ICT staff unit, and Graz University of Technology. - * - * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by - * the European Commission - subsequent versions of the EUPL (the "Licence"); - * You may not use this work except in compliance with the Licence. - * You may obtain a copy of the Licence at: - * http://www.osor.eu/eupl/ - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the Licence is distributed on an "AS IS" basis, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the Licence for the specific language governing permissions and - * limitations under the Licence. - * - * This product combines work with different licenses. See the "NOTICE" text - * file for details on the various modules and licenses. - * The "NOTICE" text file is part of the distribution. Any derivative works - * that you distribute must include a readable copy of the "NOTICE" text file. - */ - - -package at.gv.egovernment.moa.id.auth.invoke; - -import java.util.Vector; - -import javax.xml.namespace.QName; -import javax.xml.rpc.Call; -import javax.xml.rpc.Service; -import javax.xml.rpc.ServiceFactory; - -import org.apache.axis.message.SOAPBodyElement; -import org.w3c.dom.Document; -import org.w3c.dom.Element; - -import at.gv.egovernment.moa.id.auth.exception.ServiceException; -import at.gv.egovernment.moa.id.config.ConnectionParameter; -import at.gv.egovernment.moa.id.config.auth.AuthConfiguration; -import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory; -import at.gv.egovernment.moa.logging.Logger; -import at.gv.egovernment.moa.spss.api.SignatureVerificationService; -import at.gv.egovernment.moa.spss.api.xmlbind.VerifyXMLSignatureRequestParser; -import at.gv.egovernment.moa.spss.api.xmlbind.VerifyXMLSignatureResponseBuilder; -import at.gv.egovernment.moa.spss.api.xmlverify.VerifyXMLSignatureRequest; -import at.gv.egovernment.moa.spss.api.xmlverify.VerifyXMLSignatureResponse; -import at.gv.egovernment.moa.util.MiscUtil; - -/** - * Invoker of the SignatureVerification web service of MOA-SPSS.
- * Either invokes the web service, or calls the corresponding API, depending on configuration data. - * - * @author Stefan Knirsch - * @version $Id$ - */ -public class SignatureVerificationInvoker { - /** This QName Object identifies the SignatureVerification endpoint of the web service */ - private static final QName SERVICE_QNAME = new QName("SignatureVerification"); - - /** - * Method verifyXMLSignature. - * @param request to be sent - * @return Element with the answer - * @throws ServiceException if an error occurs - */ - public Element verifyXMLSignature(Element request) throws ServiceException { - return doCall(SERVICE_QNAME, request); - } - - /** - * Method doCall. - * @param serviceName the name of the service - * @param request the request to be sent - * @return Element the answer - * @throws ServiceException if an error occurs - */ - protected Element doCall(QName serviceName, Element request) throws ServiceException { - ConnectionParameter authConnParam = null; - try { - Service service = ServiceFactory.newInstance().createService(serviceName); - Call call = service.createCall(); - SOAPBodyElement body = new SOAPBodyElement(request); - SOAPBodyElement[] params = new SOAPBodyElement[] { body }; - Vector responses; - SOAPBodyElement response; - - String endPoint; - AuthConfiguration authConfigProvider = AuthConfigurationProviderFactory.getInstance(); - authConnParam = authConfigProvider.getMoaSpConnectionParameter(); - //If the ConnectionParameter do NOT exist, we try to get the api to work.... - if (authConnParam != null && MiscUtil.isNotEmpty(authConnParam.getUrl())) { - Logger.debug("Connecting using auth url: " + authConnParam.getUrl() + ", service " + serviceName.getNamespaceURI() + " : " + serviceName.getLocalPart() + " : "+ serviceName.getPrefix()); - endPoint = authConnParam.getUrl(); - call.setTargetEndpointAddress(endPoint); - responses = (Vector) call.invoke(serviceName, params); - Logger.debug("Got responses: " + responses.size()); // TODO handle axis 302 response when incorrect service url is used - response = (SOAPBodyElement) responses.get(0); - return response.getAsDOM(); - } - else { - SignatureVerificationService svs = SignatureVerificationService.getInstance(); - VerifyXMLSignatureRequest vsrequest = new VerifyXMLSignatureRequestParser().parse(request); - - VerifyXMLSignatureResponse vsresponse = svs.verifyXMLSignature(vsrequest); - Document result = new VerifyXMLSignatureResponseBuilder().build(vsresponse); - - //Logger.setHierarchy("moa.id.auth"); - return result.getDocumentElement(); - } - } - catch (Exception ex) { - if (authConnParam != null) { - throw new ServiceException("service.00", new Object[] { ex.toString()}, ex); - } else { - throw new ServiceException("service.03", new Object[] { ex.toString()}, ex); - } - } - } -} diff --git a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/parser/VerifyXMLSignatureResponseParser.java b/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/parser/VerifyXMLSignatureResponseParser.java deleted file mode 100644 index 7bce406e0..000000000 --- a/id/server/modules/moa-id-modul-citizencard_authentication/src/main/java/at/gv/egovernment/moa/id/auth/parser/VerifyXMLSignatureResponseParser.java +++ /dev/null @@ -1,211 +0,0 @@ -/******************************************************************************* - * Copyright 2014 Federal Chancellery Austria - * MOA-ID has been developed in a cooperation between BRZ, the Federal - * Chancellery Austria - ICT staff unit, and Graz University of Technology. - * - * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by - * the European Commission - subsequent versions of the EUPL (the "Licence"); - * You may not use this work except in compliance with the Licence. - * You may obtain a copy of the Licence at: - * http://www.osor.eu/eupl/ - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the Licence is distributed on an "AS IS" basis, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the Licence for the specific language governing permissions and - * limitations under the Licence. - * - * This product combines work with different licenses. See the "NOTICE" text - * file for details on the various modules and licenses. - * The "NOTICE" text file is part of the distribution. Any derivative works - * that you distribute must include a readable copy of the "NOTICE" text file. - ******************************************************************************/ -/* - * Copyright 2003 Federal Chancellery Austria - * MOA-ID has been developed in a cooperation between BRZ, the Federal - * Chancellery Austria - ICT staff unit, and Graz University of Technology. - * - * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by - * the European Commission - subsequent versions of the EUPL (the "Licence"); - * You may not use this work except in compliance with the Licence. - * You may obtain a copy of the Licence at: - * http://www.osor.eu/eupl/ - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the Licence is distributed on an "AS IS" basis, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the Licence for the specific language governing permissions and - * limitations under the Licence. - * - * This product combines work with different licenses. See the "NOTICE" text - * file for details on the various modules and licenses. - * The "NOTICE" text file is part of the distribution. Any derivative works - * that you distribute must include a readable copy of the "NOTICE" text file. - */ - - -package at.gv.egovernment.moa.id.auth.parser; - -import iaik.utils.Base64InputStream; -import iaik.x509.X509Certificate; - -import java.io.ByteArrayInputStream; -import java.io.InputStream; - -import org.w3c.dom.Element; - -import at.gv.egovernment.moa.id.auth.data.VerifyXMLSignatureResponse; -import at.gv.egovernment.moa.id.auth.exception.ParseException; -import at.gv.egovernment.moa.util.Constants; -import at.gv.egovernment.moa.util.DOMUtils; -import at.gv.egovernment.moa.util.XPathUtils; - -/** - * Parses a <VerifyXMLSignatureResponse> returned by - * MOA-SPSS. - * This class implements the Singleton pattern - * - * @author Stefan Knirsch - * @version $Id$ - */ - - -public class VerifyXMLSignatureResponseParser { - // - // XPath namespace prefix shortcuts - // - /** Xpath prefix for reaching MOA Namespaces */ - private static final String MOA = Constants.MOA_PREFIX + ":"; - /** Xpath prefix for reaching DSIG Namespaces */ - private static final String DSIG = Constants.DSIG_PREFIX + ":"; - /** Xpath expression to the root element */ - private static final String ROOT = "/" + MOA + "VerifyXMLSignatureResponse/"; - - /** Xpath expression to the X509SubjectName element */ - private static final String DSIG_SUBJECT_NAME_XPATH = - ROOT + MOA + "SignerInfo/" + DSIG + "X509Data/" + - DSIG + "X509SubjectName"; - /** Xpath expression to the X509Certificate element */ - private static final String DSIG_X509_CERTIFICATE_XPATH = - ROOT + MOA + "SignerInfo/" + DSIG + "X509Data/" + - DSIG + "X509Certificate"; - /** Xpath expression to the PublicAuthority element */ - private static final String PUBLIC_AUTHORITY_XPATH = - ROOT + MOA + "SignerInfo/" + DSIG + "X509Data/" + - MOA + "PublicAuthority"; - /** Xpath expression to the PublicAuthorityCode element */ - private static final String PUBLIC_AUTHORITY_CODE_XPATH = - PUBLIC_AUTHORITY_XPATH + "/" + MOA + "Code"; - /** Xpath expression to the QualifiedCertificate element */ - private static final String QUALIFIED_CERTIFICATE_XPATH = - ROOT + MOA + "SignerInfo/" + DSIG + "X509Data/" + - MOA + "QualifiedCertificate"; - - /** Xpath expression to the SignatureCheckCode element */ - private static final String SIGNATURE_CHECK_CODE_XPATH = - ROOT + MOA + "SignatureCheck/" + MOA + "Code"; - /** Xpath expression to the XMLDSIGManifestCheckCode element */ - private static final String XMLDSIG_MANIFEST_CHECK_CODE_XPATH = - ROOT + MOA + "XMLDSIGManifestCheck/" + MOA + "Code"; - /** Xpath expression to the SignatureManifestCheckCode element */ - private static final String SIGNATURE_MANIFEST_CHECK_CODE_XPATH = - ROOT + MOA + "SignatureManifestCheck/" + MOA + "Code"; - /** Xpath expression to the CertificateCheckCode element */ - private static final String CERTIFICATE_CHECK_CODE_XPATH = - ROOT + MOA + "CertificateCheck/" + MOA + "Code"; - - - /** This is the root element of the XML-Document provided by the Security Layer Card*/ - private Element verifyXMLSignatureResponse; - - /** - * Constructor for VerifyXMLSignatureResponseParser. - * A DOM-representation of the incoming String will be created - * @param xmlResponse <InfoboxReadResponse> as String - * @throws ParseException on any parsing error - */ - public VerifyXMLSignatureResponseParser(String xmlResponse) throws ParseException{ - try { - InputStream s = new ByteArrayInputStream(xmlResponse.getBytes("UTF-8")); - - verifyXMLSignatureResponse = DOMUtils.parseXmlValidating(s); - } - catch (Throwable t) { - throw new ParseException("parser.01", new Object[] { t.toString() }, t); - } - } - - /** - * Constructor for VerifyXMLSignatureResponseParser. - * A DOM-representation of the incoming Inputstream will be created - * @param xmlResponse <InfoboxReadResponse> as InputStream - * @throws Exception on any parsing error - */ - public VerifyXMLSignatureResponseParser(InputStream xmlResponse) throws Exception - { - try { - verifyXMLSignatureResponse = DOMUtils.parseXmlValidating(xmlResponse); - } - catch (Throwable t) { - throw new ParseException("parser.01", null, t); - } - } - - /** - * Constructor for VerifyXMLSignatureResponseParser. - * The incoming Element will be used for further operations - * @param xmlResponse <InfoboxReadResponse> as Element - */ - public VerifyXMLSignatureResponseParser(Element xmlResponse) - { - verifyXMLSignatureResponse =xmlResponse; - - } - - /** - * Parse identity link from <InfoboxReadResponse> - * @return Identity link - * @throws ParseException on any parsing error - */ - - public VerifyXMLSignatureResponse parseData() throws ParseException { - - VerifyXMLSignatureResponse respData=new VerifyXMLSignatureResponse(); - - try { - - String s = DOMUtils.serializeNode(verifyXMLSignatureResponse); - respData.setXmlDsigSubjectName(XPathUtils.getElementValue(verifyXMLSignatureResponse,DSIG_SUBJECT_NAME_XPATH,"")); - Element e = (Element)XPathUtils.selectSingleNode(verifyXMLSignatureResponse,QUALIFIED_CERTIFICATE_XPATH); - respData.setQualifiedCertificate(e!=null); - - Base64InputStream in = new Base64InputStream(new ByteArrayInputStream(XPathUtils.getElementValue( - verifyXMLSignatureResponse,DSIG_X509_CERTIFICATE_XPATH,"").getBytes("UTF-8")),true); - - respData.setX509certificate(new X509Certificate(in)); - Element publicAuthority = (Element)XPathUtils.selectSingleNode(verifyXMLSignatureResponse,PUBLIC_AUTHORITY_XPATH); - respData.setPublicAuthority(publicAuthority != null); - respData.setPublicAuthorityCode(XPathUtils.getElementValue(verifyXMLSignatureResponse,PUBLIC_AUTHORITY_CODE_XPATH,"")); - respData.setSignatureCheckCode(new Integer(XPathUtils.getElementValue(verifyXMLSignatureResponse,SIGNATURE_CHECK_CODE_XPATH,"")).intValue()); - - String xmlDsigCheckCode = XPathUtils.getElementValue(verifyXMLSignatureResponse,XMLDSIG_MANIFEST_CHECK_CODE_XPATH,null); - if (xmlDsigCheckCode!=null) { - respData.setXmlDSIGManigest(true); - respData.setXmlDSIGManifestCheckCode(new Integer(xmlDsigCheckCode).intValue()); - } else { - respData.setXmlDSIGManigest(false); - } - String signatureManifestCheckCode = XPathUtils.getElementValue(verifyXMLSignatureResponse,SIGNATURE_MANIFEST_CHECK_CODE_XPATH,null); - if (signatureManifestCheckCode != null) { - respData.setSignatureManifestCheckCode(new Integer(signatureManifestCheckCode).intValue()); - } - respData.setCertificateCheckCode(new Integer(XPathUtils.getElementValue(verifyXMLSignatureResponse,CERTIFICATE_CHECK_CODE_XPATH,"")).intValue()); - } - catch (Throwable t) { - throw new ParseException("parser.01", null, t); - } - return respData; - } - - -} diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASMetadataSignatureFilter.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASMetadataSignatureFilter.java new file mode 100644 index 000000000..c9f3e5bcd --- /dev/null +++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASMetadataSignatureFilter.java @@ -0,0 +1,132 @@ +/* + * Copyright 2014 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + */ +package at.gv.egovernment.moa.id.auth.modules.eidas.engine; + +import java.io.IOException; +import java.io.StringWriter; + +import javax.xml.transform.Transformer; +import javax.xml.transform.TransformerConfigurationException; +import javax.xml.transform.TransformerException; +import javax.xml.transform.TransformerFactory; +import javax.xml.transform.TransformerFactoryConfigurationError; +import javax.xml.transform.dom.DOMSource; +import javax.xml.transform.stream.StreamResult; + +import org.opensaml.saml2.metadata.EntityDescriptor; +import org.opensaml.saml2.metadata.provider.FilterException; +import org.opensaml.saml2.metadata.provider.MetadataFilter; +import org.opensaml.xml.XMLObject; + +import at.gv.egovernment.moa.id.auth.builder.SignatureVerificationUtils; +import at.gv.egovernment.moa.id.auth.data.VerifyXMLSignatureResponse; +import at.gv.egovernment.moa.id.auth.exception.BuildException; +import at.gv.egovernment.moa.id.auth.exception.MOAIDException; +import at.gv.egovernment.moa.logging.Logger; + +/** + * @author tlenz + * + */ +public class MOAeIDASMetadataSignatureFilter implements MetadataFilter { + + private String trustProfileID = null; + + /** + * + */ + public MOAeIDASMetadataSignatureFilter(String trustProfileID) { + this.trustProfileID = trustProfileID; + + } + + + /* (non-Javadoc) + * @see org.opensaml.saml2.metadata.provider.MetadataFilter#doFilter(org.opensaml.xml.XMLObject) + */ + @Override + public void doFilter(XMLObject metadata) throws FilterException { + if (metadata instanceof EntityDescriptor) { + if (((EntityDescriptor) metadata).isSigned()) { + EntityDescriptor entityDes = (EntityDescriptor) metadata; + //check signature; + try { + Transformer transformer = TransformerFactory.newInstance() + .newTransformer(); + StringWriter sw = new StringWriter(); + StreamResult sr = new StreamResult(sw); + DOMSource source = new DOMSource(metadata.getDOM()); + transformer.transform(source, sr); + sw.close(); + String metadataXML = sw.toString(); + + SignatureVerificationUtils sigVerify = + new SignatureVerificationUtils(); + VerifyXMLSignatureResponse result = sigVerify.verify( + metadataXML.getBytes(), trustProfileID); + + //check signature-verification result + if (result.getSignatureCheckCode() != 0) { + Logger.warn("eIDAS Metadata signature-verification FAILED!" + + " Metadata: " + entityDes.getEntityID() + + " StatusCode:" + result.getSignatureCheckCode()); + throw new FilterException("eIDAS Metadata signature-verification FAILED!" + + " Metadata: " + entityDes.getEntityID() + + " StatusCode:" + result.getSignatureCheckCode()); + + } + + if (result.getCertificateCheckCode() != 0) { + Logger.warn("eIDAS Metadata certificate-verification FAILED!" + + " Metadata: " + entityDes.getEntityID() + + " StatusCode:" + result.getCertificateCheckCode()); + throw new FilterException("eIDAS Metadata certificate-verification FAILED!" + + " Metadata: " + entityDes.getEntityID() + + " StatusCode:" + result.getCertificateCheckCode()); + + } + + + } catch (MOAIDException | TransformerFactoryConfigurationError | TransformerException | IOException e) { + Logger.error("eIDAS Metadata verification has an interal error.", e); + throw new FilterException("eIDAS Metadata verification has an interal error." + + " Message:" + e.getMessage()); + + } + + + } else { + Logger.warn("eIDAS Metadata root-element MUST be signed."); + throw new FilterException("eIDAS Metadata root-element MUST be signed.'"); + + } + + } else { + Logger.warn("eIDAS Metadata root-element is not of type 'EntityDescriptor'"); + throw new FilterException("eIDAS Metadata root-element is not of type 'EntityDescriptor'"); + + } + + } + +} -- cgit v1.2.3 From ced2df85fa74ea2db9949b18e075e20af6168df0 Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Wed, 13 Jan 2016 14:03:37 +0100 Subject: add JavaDoc --- .../java/at/gv/egovernment/moa/id/config/auth/AuthConfiguration.java | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'id/server/idserverlib/src') diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfiguration.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfiguration.java index ad3268b90..1d8ea4cd4 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfiguration.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfiguration.java @@ -89,6 +89,11 @@ public interface AuthConfiguration extends ConfigurationProvider{ public boolean isAdvancedLoggingActive(); + /** + * Returns the PublicURLPrefix. NOTE: returns {@code null} if no PublicURLPrefix is set. + * + * @return the PublicURLPrefix without trailing slash or {@code null} + */ public String getPublicURLPrefix(); public boolean isPVP2AssertionEncryptionActive(); -- cgit v1.2.3 From be6c425ea5a82ecc3d57ae365ea2c49866d29705 Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Thu, 14 Jan 2016 08:58:44 +0100 Subject: temporary problem fix for default security definitions (PVP / eIDAS SAML-engine) --- ...s-with-OracleDB-and-configuration-storage.patch | 1158 ++++++++++++++++++++ ...ult-filename-in-configuration-download-di.patch | 25 + 0003-update-handbook-and-release-information.patch | 752 +++++++++++++ .../ts_119612v010201_additionaltypes_xsd.xsd | 35 + .../resources/schemas/ts_119612v010201_sie_xsd.xsd | 81 ++ .../resources/schemas/ts_119612v010201_xsd.xsd | 337 ++++++ .../opemsaml/MOAStringRedirectDeflateEncoder.java | 4 + .../id/protocols/pvp2x/binding/PostBinding.java | 8 + .../protocols/pvp2x/binding/RedirectBinding.java | 8 + .../id/protocols/pvp2x/binding/SoapBinding.java | 5 + .../pvp2x/config/MOADefaultBootstrap.java | 5 +- .../iaik_eccelerate/2.51/iaik_eccelerate-2.51.jar | Bin 0 -> 232486 bytes .../iaik_eccelerate/2.51/iaik_eccelerate-2.51.pom | 8 + 13 files changed, 2425 insertions(+), 1 deletion(-) create mode 100644 0001-fix-problems-with-OracleDB-and-configuration-storage.patch create mode 100644 0002-change-default-filename-in-configuration-download-di.patch create mode 100644 0003-update-handbook-and-release-information.patch create mode 100644 common/src/main/resources/resources/schemas/ts_119612v010201_additionaltypes_xsd.xsd create mode 100644 common/src/main/resources/resources/schemas/ts_119612v010201_sie_xsd.xsd create mode 100644 common/src/main/resources/resources/schemas/ts_119612v010201_xsd.xsd create mode 100644 repository/iaik/iaik_eccelerate/2.51/iaik_eccelerate-2.51.jar create mode 100644 repository/iaik/iaik_eccelerate/2.51/iaik_eccelerate-2.51.pom (limited to 'id/server/idserverlib/src') diff --git a/0001-fix-problems-with-OracleDB-and-configuration-storage.patch b/0001-fix-problems-with-OracleDB-and-configuration-storage.patch new file mode 100644 index 000000000..c03696599 --- /dev/null +++ b/0001-fix-problems-with-OracleDB-and-configuration-storage.patch @@ -0,0 +1,1158 @@ +From fa3f73a46151d06c4f80eb0c43d3eda6c23c3709 Mon Sep 17 00:00:00 2001 +From: Thomas Lenz +Date: Tue, 15 Sep 2015 12:55:30 +0200 +Subject: [PATCH 1/3] fix problems with OracleDB and configuration storage + implementation + +--- + .../config/ConfigurationProvider.java | 7 + + .../validation/oa/OAPVP2ConfigValidation.java | 6 +- + .../moa-id-configtool.properties | 1 + + .../data/deploy/conf/moa-id/moa-id.properties | 1 + + .../PropertyBasedAuthConfigurationProvider.java | 12 +- + .../id/storage/AuthenticationSessionStoreage.java | 569 ++++++++++++--------- + .../main/resources/moaid.configuration.beans.xml | 2 +- + .../config/persistence/MOAIDConfiguration.java | 12 + + .../config/persistence/MOAIDConfigurationImpl.java | 110 ++-- + .../moa/id/commons/db/MOASessionDBUtils.java | 10 +- + .../moa/id/commons/db/NewConfigurationDBRead.java | 7 +- + .../db/dao/config/DatabaseConfigPropertyImpl.java | 35 +- + .../src/main/resources/moaid.migration.beans.xml | 2 +- + 13 files changed, 494 insertions(+), 280 deletions(-) + +diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java +index 849e819..e2a55db 100644 +--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java ++++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/config/ConfigurationProvider.java +@@ -188,6 +188,13 @@ public class ConfigurationProvider { + + + /** ++ * @return the props ++ */ ++ public Properties getConfigurationProperties() { ++ return props; ++ } ++ ++ /** + * @return the deprecatedDBWrite + */ + public FileBasedUserConfiguration getUserManagement() { +diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/oa/OAPVP2ConfigValidation.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/oa/OAPVP2ConfigValidation.java +index 18452ed..35b6927 100644 +--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/oa/OAPVP2ConfigValidation.java ++++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/oa/OAPVP2ConfigValidation.java +@@ -76,7 +76,11 @@ public class OAPVP2ConfigValidation { + + else { + try { +- Map oa = ConfigurationProvider.getInstance().getDbRead().getOnlineApplicationKeyValueWithId(oaID); ++ //OracleDB does not allow the selection of a lob in SQL where expression ++ String dbDriver = ConfigurationProvider.getInstance().getConfigurationProperties().getProperty("hibernate.connection.driver_class"); ++ boolean backupVersion = MiscUtil.isNotEmpty(dbDriver) && dbDriver.startsWith("oracle.jdbc."); ++ ++ Map oa = ConfigurationProvider.getInstance().getDbRead().getOnlineApplicationKeyValueWithId(oaID, backupVersion); + if (oa != null && + MiscUtil.isNotEmpty(oa.get(MOAIDConfigurationConstants.SERVICE_PROTOCOLS_PVP2X_CERTIFICATE))) { + certSerialized = Base64Utils.decode(oa.get(MOAIDConfigurationConstants.SERVICE_PROTOCOLS_PVP2X_CERTIFICATE), false); +diff --git a/id/server/data/deploy/conf/moa-id-configuration/moa-id-configtool.properties b/id/server/data/deploy/conf/moa-id-configuration/moa-id-configtool.properties +index 9a3b367..825a9f1 100644 +--- a/id/server/data/deploy/conf/moa-id-configuration/moa-id-configtool.properties ++++ b/id/server/data/deploy/conf/moa-id-configuration/moa-id-configtool.properties +@@ -35,6 +35,7 @@ dbcp.maxWaitMillis=-1 + dbcp.testOnBorrow=true + dbcp.testOnReturn=false + dbcp.testWhileIdle=false ++dbcp.validationQuery=SELECT 1 + + ##Mail + general.mail.host=smtp.localhost... +diff --git a/id/server/data/deploy/conf/moa-id/moa-id.properties b/id/server/data/deploy/conf/moa-id/moa-id.properties +index 66f9afa..49e69c5 100644 +--- a/id/server/data/deploy/conf/moa-id/moa-id.properties ++++ b/id/server/data/deploy/conf/moa-id/moa-id.properties +@@ -107,6 +107,7 @@ configuration.dbcp.maxWaitMillis=-1 + configuration.dbcp.testOnBorrow=true + configuration.dbcp.testOnReturn=false + configuration.dbcp.testWhileIdle=false ++configuration.dbcp.validationQuery=SELECT 1 + + # + #Hibnerate configuration for MOA-ID 2.0 advanced statistic logging +diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java +index 190c5f0..6458314 100644 +--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java ++++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/PropertyBasedAuthConfigurationProvider.java +@@ -980,9 +980,17 @@ public class PropertyBasedAuthConfigurationProvider extends ConfigurationProvide + * @return the requested online application or {@code null} + */ + public Map getActiveOnlineApplication(String id) { +- Logger.trace("Get active OnlineApplication with ID " + id + " from database."); ++ Logger.trace("Get active OnlineApplication with ID " + id + " from database."); ++ Map oaConfig = null; + try { +- Map oaConfig = configuration.getOnlineApplication(id); ++ //OracleDB does not allow the selection of a lob in SQL where expression ++ String dbDriver = properties.getProperty("configuration.hibernate.connection.driver_class"); ++ if (MiscUtil.isNotEmpty(dbDriver) && dbDriver.startsWith("oracle.jdbc.")) ++ oaConfig = configuration.getOnlineApplicationBackupVersion(id); ++ ++ else ++ oaConfig = configuration.getOnlineApplication(id); ++ + if (oaConfig != null) { + String isActiveString = oaConfig.get(MOAIDConfigurationConstants.SERVICE_ISACTIVE); + if (isActiveString != null && Boolean.valueOf(isActiveString)) +diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/storage/AuthenticationSessionStoreage.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/storage/AuthenticationSessionStoreage.java +index 4b4b5dd..829383c 100644 +--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/storage/AuthenticationSessionStoreage.java ++++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/storage/AuthenticationSessionStoreage.java +@@ -206,26 +206,34 @@ public class AuthenticationSessionStoreage { + Session session = MOASessionDBUtils.getCurrentSession(); + + List result; +- +- synchronized (session) { +- +- session.beginTransaction(); +- Query query = session.getNamedQuery("getSessionWithID"); +- query.setParameter("sessionid", moaSessionID); +- result = query.list(); +- +- +- Logger.trace("Found entries: " + result.size()); ++ Transaction tx = null; ++ try { ++ synchronized (session) { ++ ++ tx = session.beginTransaction(); ++ Query query = session.getNamedQuery("getSessionWithID"); ++ query.setParameter("sessionid", moaSessionID); ++ result = query.list(); ++ + +- //Assertion requires an unique artifact +- if (result.size() != 1) { +- Logger.trace("No entries found."); +- throw new MOADatabaseException("No session found with this sessionID"); ++ Logger.trace("Found entries: " + result.size()); ++ ++ //Assertion requires an unique artifact ++ if (result.size() != 1) { ++ Logger.trace("No entries found."); ++ throw new MOADatabaseException("No session found with this sessionID"); ++ } ++ ++ AuthenticatedSessionStore dbsession = (AuthenticatedSessionStore) result.get(0); ++ tx.commit(); ++ cleanDelete(dbsession); + } + +- AuthenticatedSessionStore dbsession = (AuthenticatedSessionStore) result.get(0); +- session.getTransaction().commit(); +- cleanDelete(dbsession); ++ } catch (Exception e) { ++ if (tx != null && !tx.wasCommitted()) ++ tx.rollback(); ++ throw e; ++ + } + + } +@@ -290,28 +298,36 @@ public class AuthenticationSessionStoreage { + Session session = MOASessionDBUtils.getCurrentSession(); + + List result; +- +- synchronized (session) { +- session.beginTransaction(); +- Query query = session.getNamedQuery("getSessionWithSSOID"); +- query.setParameter("sessionid", SSOSessionID); +- result = query.list(); ++ Transaction tx = null; ++ try { ++ synchronized (session) { ++ ++ tx = session.beginTransaction(); ++ Query query = session.getNamedQuery("getSessionWithSSOID"); ++ query.setParameter("sessionid", SSOSessionID); ++ result = query.list(); + +- //send transaction +- session.getTransaction().commit(); +- } ++ //send transaction ++ tx.commit(); ++ ++ } + +- Logger.trace("Found entries: " + result.size()); ++ Logger.trace("Found entries: " + result.size()); + +- //Assertion requires an unique artifact +- if (result.size() != 1) { +- Logger.trace("No entries found."); +- return null; ++ //Assertion requires an unique artifact ++ if (result.size() != 1) { ++ Logger.trace("No entries found."); ++ return null; + +- } else { +- return result.get(0).getSessionid(); ++ } else { ++ return result.get(0).getSessionid(); + +- } ++ } ++ } catch (Exception e) { ++ if (tx != null && !tx.wasCommitted()) ++ tx.rollback(); ++ throw e; ++ } + } + + public static boolean isSSOSession(String sessionID) throws MOADatabaseException { +@@ -331,27 +347,33 @@ public class AuthenticationSessionStoreage { + Session session = MOASessionDBUtils.getCurrentSession(); + + List result; +- +- synchronized (session) { +- session.beginTransaction(); +- Query query = session.getNamedQuery("getSessionWithSSOID"); +- query.setParameter("sessionid", SSOId); +- result = query.list(); ++ Transaction tx = null; ++ try { ++ synchronized (session) { ++ tx = session.beginTransaction(); ++ Query query = session.getNamedQuery("getSessionWithSSOID"); ++ query.setParameter("sessionid", SSOId); ++ result = query.list(); ++ ++ //send transaction ++ tx.commit(); ++ } ++ ++ Logger.trace("Found entries: " + result.size()); + +- //send transaction +- session.getTransaction().commit(); ++ //Assertion requires an unique artifact ++ if (result.size() != 1) { ++ Logger.trace("No entries found."); ++ return null; ++ ++ } else { ++ return result.get(0); ++ } ++ } catch (Exception e) { ++ if (tx != null && !tx.wasCommitted()) ++ tx.rollback(); ++ throw e; + } +- +- Logger.trace("Found entries: " + result.size()); +- +- //Assertion requires an unique artifact +- if (result.size() != 1) { +- Logger.trace("No entries found."); +- return null; +- +- } else { +- return result.get(0); +- } + } + + public static void addSSOInformation(String moaSessionID, String SSOSessionID, +@@ -453,13 +475,15 @@ public class AuthenticationSessionStoreage { + + } catch(HibernateException e) { + Logger.warn("Error during database saveOrUpdate. Rollback.", e); +- tx.rollback(); +- throw new AuthenticationException("SSO Session information can not be stored! --> SSO is deactivated", null); +- } ++ if (tx != null && !tx.wasCommitted()) ++ tx.rollback(); ++ throw new AuthenticationException("SSO Session information can not be stored! --> SSO is deactivated", null); ++ } + } + + public static List getAllActiveOAFromMOASession(AuthenticationSession moaSession) { + MiscUtil.assertNotNull(moaSession, "MOASession"); ++ Session session = null; + + try { + List oas = new ArrayList(); +@@ -467,7 +491,7 @@ public class AuthenticationSessionStoreage { + AuthenticatedSessionStore dbsession = searchInDatabase(moaSession.getSessionID(), false); + oas.addAll(dbsession.getActiveOAsessions()); + +- Session session = MOASessionDBUtils.getCurrentSession(); ++ session = MOASessionDBUtils.getCurrentSession(); + session.getTransaction().commit(); + + return oas; +@@ -475,6 +499,14 @@ public class AuthenticationSessionStoreage { + } catch (MOADatabaseException e) { + Logger.warn("NO session information found for sessionID " + moaSession.getSessionID(), e); + ++ } catch (Exception e) { ++ if (session != null && session.getTransaction() != null ++ && !session.getTransaction().wasCommitted()) { ++ session.getTransaction().rollback(); ++ throw e; ++ ++ } ++ + } + + return null; +@@ -482,13 +514,13 @@ public class AuthenticationSessionStoreage { + + public static List getAllActiveIDPsFromMOASession(AuthenticationSession moaSession) { + MiscUtil.assertNotNull(moaSession, "MOASession"); +- ++ Session session = null; + try { + List idps = new ArrayList(); + AuthenticatedSessionStore dbsession = searchInDatabase(moaSession.getSessionID(), false); + idps.addAll(dbsession.getInderfederation()); + +- Session session = MOASessionDBUtils.getCurrentSession(); ++ session = MOASessionDBUtils.getCurrentSession(); + session.getTransaction().commit(); + + return idps; +@@ -496,6 +528,14 @@ public class AuthenticationSessionStoreage { + } catch (MOADatabaseException e) { + Logger.warn("NO session information found for sessionID " + moaSession.getSessionID(), e); + ++ } catch (Exception e) { ++ if (session != null && session.getTransaction() != null ++ && !session.getTransaction().wasCommitted()) { ++ session.getTransaction().rollback(); ++ throw e; ++ ++ } ++ + } + + return null; +@@ -507,35 +547,42 @@ public class AuthenticationSessionStoreage { + Logger.trace("Get moaSession for userNameID " + userNameID + " and OA " + + oaID + " from database."); + Session session = MOASessionDBUtils.getCurrentSession(); +- +- List result; ++ Transaction tx = null; + +- synchronized (session) { +- session.beginTransaction(); +- Query query = session.getNamedQuery("getMOASessionWithNameIDandOAID"); +- query.setParameter("oaID", oaID); +- query.setParameter("nameID", userNameID); +- result = query.list(); ++ List result = null;; ++ try { ++ synchronized (session) { ++ tx = session.beginTransaction(); ++ Query query = session.getNamedQuery("getMOASessionWithNameIDandOAID"); ++ query.setParameter("oaID", oaID); ++ query.setParameter("nameID", userNameID); ++ result = query.list(); ++ ++ //send transaction ++ tx.commit(); ++ } + +- //send transaction +- session.getTransaction().commit(); +- } +- +- Logger.trace("Found entries: " + result.size()); +- +- //Assertion requires an unique artifact +- if (result.size() != 1) { +- Logger.trace("No unique entry found."); +- return null; +- +- } +- try { +- return decryptSession(result.get(0)); ++ Logger.trace("Found entries: " + result.size()); ++ ++ //Assertion requires an unique artifact ++ if (result.size() != 1) { ++ Logger.trace("No unique entry found."); ++ return null; ++ ++ } ++ ++ return decryptSession(result.get(0)); + + } catch (BuildException e) { +- Logger.warn("MOASession deserialization-exception by using MOASessionID=" + result.get(0).getSessionid(), e); ++ Logger.warn("MOASession deserialization-exception by using MOASessionID=" + result.get(0).getSessionid(), e); + return null; ++ ++ } catch (Exception e) { ++ if (tx != null && !tx.wasCommitted()) ++ tx.rollback(); ++ throw e; + } ++ + } + + public static OASessionStore searchActiveOASSOSession(AuthenticationSession moaSession, String oaID, String protocolType) { +@@ -547,29 +594,36 @@ public class AuthenticationSessionStoreage { + Session session = MOASessionDBUtils.getCurrentSession(); + + List result; +- +- synchronized (session) { +- session.beginTransaction(); +- Query query = session.getNamedQuery("getActiveOAWithSessionIDandOAIDandProtocol"); +- query.setParameter("sessionID", moaSession.getSessionID()); +- query.setParameter("oaID", oaID); +- query.setParameter("protocol", protocolType); +- result = query.list(); ++ Transaction tx = null; ++ try { ++ synchronized (session) { ++ tx = session.beginTransaction(); ++ Query query = session.getNamedQuery("getActiveOAWithSessionIDandOAIDandProtocol"); ++ query.setParameter("sessionID", moaSession.getSessionID()); ++ query.setParameter("oaID", oaID); ++ query.setParameter("protocol", protocolType); ++ result = query.list(); ++ ++ //send transaction ++ tx.commit(); ++ } + +- //send transaction +- session.getTransaction().commit(); +- } +- +- Logger.trace("Found entries: " + result.size()); +- +- //Assertion requires an unique artifact +- if (result.size() == 0) { +- Logger.trace("No entries found."); +- return null; +- +- } +- +- return result.get(0).getActiveOAsessions().get(0); ++ Logger.trace("Found entries: " + result.size()); ++ ++ //Assertion requires an unique artifact ++ if (result.size() == 0) { ++ Logger.trace("No entries found."); ++ return null; ++ ++ } ++ ++ return result.get(0).getActiveOAsessions().get(0); ++ ++ } catch (Exception e) { ++ if (tx != null && !tx.wasCommitted()) ++ tx.rollback(); ++ throw e; ++ } + } + + public static String getPendingRequestID(String sessionID) { +@@ -584,6 +638,7 @@ public class AuthenticationSessionStoreage { + } + + public static AuthenticationSession getSessionWithPendingRequestID(String pedingRequestID) { ++ Transaction tx = null; + try { + MiscUtil.assertNotNull(pedingRequestID, "pedingRequestID"); + Logger.trace("Get authenticated session with pedingRequestID " + pedingRequestID + " from database."); +@@ -592,13 +647,13 @@ public class AuthenticationSessionStoreage { + List result; + + synchronized (session) { +- session.beginTransaction(); ++ tx = session.beginTransaction(); + Query query = session.getNamedQuery("getSessionWithPendingRequestID"); + query.setParameter("sessionid", pedingRequestID); + result = query.list(); + + //send transaction +- session.getTransaction().commit(); ++ tx.commit(); + } + + Logger.trace("Found entries: " + result.size()); +@@ -613,8 +668,13 @@ public class AuthenticationSessionStoreage { + + } catch (Throwable e) { + Logger.warn("MOASession deserialization-exception by using MOASessionID=" + pedingRequestID); ++ ++ if (tx != null && !tx.wasCommitted()) ++ tx.rollback(); ++ + return null; +- } ++ ++ } + } + + public static boolean deleteSessionWithPendingRequestID(String id) { +@@ -623,34 +683,39 @@ public class AuthenticationSessionStoreage { + Session session = MOASessionDBUtils.getCurrentSession(); + + List result; +- +- synchronized (session) { +- session.beginTransaction(); +- Query query = session.getNamedQuery("getSessionWithPendingRequestID"); +- query.setParameter("sessionid", id); +- result = query.list(); ++ Transaction tx = null; ++ try { ++ synchronized (session) { ++ tx = session.beginTransaction(); ++ Query query = session.getNamedQuery("getSessionWithPendingRequestID"); ++ query.setParameter("sessionid", id); ++ result = query.list(); ++ ++ //send transaction ++ tx.commit(); ++ } + +- //send transaction +- session.getTransaction().commit(); +- } +- +- Logger.trace("Found entries: " + result.size()); +- +- //Assertion requires an unique artifact +- if (result.size() != 1) { +- Logger.trace("No entries found."); +- return false; +- +- } else { +- cleanDelete(result.get(0)); +- return true; +- } +- +- ++ Logger.trace("Found entries: " + result.size()); ++ ++ //Assertion requires an unique artifact ++ if (result.size() != 1) { ++ Logger.trace("No entries found."); ++ return false; ++ ++ } else { ++ cleanDelete(result.get(0)); ++ return true; ++ } ++ } catch (Exception e) { ++ if (tx != null && !tx.wasCommitted()) ++ tx.rollback(); ++ throw e; ++ } + } + + public static AuthenticationSession getSessionWithUserNameID(String nameID) { + ++ Transaction tx = null; + try { + MiscUtil.assertNotNull(nameID, "nameID"); + Logger.trace("Get authenticated session with pedingRequestID " + nameID + " from database."); +@@ -659,13 +724,13 @@ public class AuthenticationSessionStoreage { + List result; + + synchronized (session) { +- session.beginTransaction(); ++ tx = session.beginTransaction(); + Query query = session.getNamedQuery("getMOAISessionWithUserNameID"); + query.setParameter("usernameid", StringEscapeUtils.escapeHtml(nameID)); + result = query.list(); + + //send transaction +- session.getTransaction().commit(); ++ tx.commit(); + } + + Logger.trace("Found entries: " + result.size()); +@@ -679,7 +744,9 @@ public class AuthenticationSessionStoreage { + return decryptSession(result.get(0)); + + } catch (Throwable e) { +- Logger.warn("MOASession deserialization-exception by using MOASessionID=" + nameID); ++ Logger.warn("MOASession deserialization-exception by using MOASessionID=" + nameID); ++ if (tx != null && !tx.wasCommitted()) ++ tx.rollback(); + return null; + } + +@@ -691,27 +758,33 @@ public class AuthenticationSessionStoreage { + Session session = MOASessionDBUtils.getCurrentSession(); + + List result; +- +- synchronized (session) { +- session.beginTransaction(); +- Query query = session.getNamedQuery("getInterfederatedIDPForSSOWithSessionID"); +- query.setParameter("sessionID", sessionID); +- result = query.list(); ++ Transaction tx = null; ++ try { ++ synchronized (session) { ++ tx = session.beginTransaction(); ++ Query query = session.getNamedQuery("getInterfederatedIDPForSSOWithSessionID"); ++ query.setParameter("sessionID", sessionID); ++ result = query.list(); ++ ++ //send transaction ++ tx.commit(); ++ } + +- //send transaction +- session.getTransaction().commit(); +- } +- +- Logger.trace("Found entries: " + result.size()); +- +- //Assertion requires an unique artifact +- if (result.size() == 0) { +- Logger.trace("No entries found."); +- return null; +- +- } +- +- return result.get(0).getInderfederation().get(0); ++ Logger.trace("Found entries: " + result.size()); ++ ++ //Assertion requires an unique artifact ++ if (result.size() == 0) { ++ Logger.trace("No entries found."); ++ return null; ++ ++ } ++ ++ return result.get(0).getInderfederation().get(0); ++ } catch (Exception e) { ++ if (tx != null && !tx.wasCommitted()) ++ tx.rollback(); ++ throw e; ++ } + } + + public static InterfederationSessionStore searchInterfederatedIDPFORSSOWithMOASessionIDPID(String sessionID, String idpID) { +@@ -721,28 +794,34 @@ public class AuthenticationSessionStoreage { + Session session = MOASessionDBUtils.getCurrentSession(); + + List result; +- +- synchronized (session) { +- session.beginTransaction(); +- Query query = session.getNamedQuery("getInterfederatedIDPForSSOWithSessionIDIDPID"); +- query.setParameter("sessionID", sessionID); +- query.setParameter("idpID", idpID); +- result = query.list(); ++ Transaction tx = null; ++ try { ++ synchronized (session) { ++ tx = session.beginTransaction(); ++ Query query = session.getNamedQuery("getInterfederatedIDPForSSOWithSessionIDIDPID"); ++ query.setParameter("sessionID", sessionID); ++ query.setParameter("idpID", idpID); ++ result = query.list(); ++ ++ //send transaction ++ tx.commit(); ++ } + +- //send transaction +- session.getTransaction().commit(); +- } +- +- Logger.trace("Found entries: " + result.size()); +- +- //Assertion requires an unique artifact +- if (result.size() == 0) { +- Logger.trace("No entries found."); +- return null; +- +- } +- +- return result.get(0).getInderfederation().get(0); ++ Logger.trace("Found entries: " + result.size()); ++ ++ //Assertion requires an unique artifact ++ if (result.size() == 0) { ++ Logger.trace("No entries found."); ++ return null; ++ ++ } ++ ++ return result.get(0).getInderfederation().get(0); ++ } catch (Exception e) { ++ if (tx != null && !tx.wasCommitted()) ++ tx.rollback(); ++ throw e; ++ } + } + + public static String createInterfederatedSession(IRequest req, boolean isAuthenticated, String ssoID) throws MOADatabaseException, AssertionAttributeExtractorExeption, BuildException { +@@ -847,27 +926,33 @@ public class AuthenticationSessionStoreage { + Session session = MOASessionDBUtils.getCurrentSession(); + + List result; +- +- synchronized (session) { +- session.beginTransaction(); +- Query query = session.getNamedQuery("getInterfederatedIDPForAttributeQueryWithSessionID"); +- query.setParameter("sessionID", moaSession.getSessionID()); +- result = query.list(); ++ Transaction tx = null; ++ try { ++ synchronized (session) { ++ tx = session.beginTransaction(); ++ Query query = session.getNamedQuery("getInterfederatedIDPForAttributeQueryWithSessionID"); ++ query.setParameter("sessionID", moaSession.getSessionID()); ++ result = query.list(); ++ ++ //send transaction ++ tx.commit(); ++ } + +- //send transaction +- session.getTransaction().commit(); +- } +- +- Logger.trace("Found entries: " + result.size()); +- +- //Assertion requires an unique artifact +- if (result.size() == 0) { +- Logger.trace("No entries found."); +- return null; +- +- } +- +- return result.get(0).getInderfederation().get(0); ++ Logger.trace("Found entries: " + result.size()); ++ ++ //Assertion requires an unique artifact ++ if (result.size() == 0) { ++ Logger.trace("No entries found."); ++ return null; ++ ++ } ++ ++ return result.get(0).getInderfederation().get(0); ++ } catch (Exception e) { ++ if (tx != null && !tx.wasCommitted()) ++ tx.rollback(); ++ throw e; ++ } + } + + /** +@@ -930,28 +1015,34 @@ public class AuthenticationSessionStoreage { + + List results; + Session session = MOASessionDBUtils.getCurrentSession(); +- +- synchronized (session) { +- session.beginTransaction(); +- Query query = session.getNamedQuery("getMOAISessionsWithTimeOut"); +- query.setTimestamp("timeoutcreate", expioredatecreate); +- query.setTimestamp("timeoutupdate", expioredateupdate); +- results = query.list(); +- session.getTransaction().commit(); +- } +- +- if (results.size() != 0) { +- for(AuthenticatedSessionStore result : results) { +- try { +- cleanDelete(result); +- Logger.info("Authenticated session with sessionID=" + result.getSessionid() +- + " after session timeout."); +- +- } catch (HibernateException e){ +- Logger.warn("Authenticated session with sessionID=" + result.getSessionid() +- + " not removed after timeout! (Error during Database communication)", e); +- } +- } ++ Transaction tx = null; ++ try { ++ synchronized (session) { ++ tx = session.beginTransaction(); ++ Query query = session.getNamedQuery("getMOAISessionsWithTimeOut"); ++ query.setTimestamp("timeoutcreate", expioredatecreate); ++ query.setTimestamp("timeoutupdate", expioredateupdate); ++ results = query.list(); ++ tx.commit(); ++ } ++ ++ if (results.size() != 0) { ++ for(AuthenticatedSessionStore result : results) { ++ try { ++ cleanDelete(result); ++ Logger.info("Authenticated session with sessionID=" + result.getSessionid() ++ + " after session timeout."); ++ ++ } catch (HibernateException e){ ++ Logger.warn("Authenticated session with sessionID=" + result.getSessionid() ++ + " not removed after timeout! (Error during Database communication)", e); ++ } ++ } ++ } ++ } catch (Exception e) { ++ if (tx != null && !tx.wasCommitted()) ++ tx.rollback(); ++ throw e; + } + } + +@@ -1004,26 +1095,32 @@ public class AuthenticationSessionStoreage { + Session session = MOASessionDBUtils.getCurrentSession(); + + List result; +- +- synchronized (session) { +- session.beginTransaction(); +- Query query = session.getNamedQuery("getSessionWithID"); +- query.setParameter("sessionid", sessionID); +- result = query.list(); ++ Transaction tx = null; ++ try { ++ synchronized (session) { ++ tx = session.beginTransaction(); ++ Query query = session.getNamedQuery("getSessionWithID"); ++ query.setParameter("sessionid", sessionID); ++ result = query.list(); ++ ++ //send transaction ++ if (commit) ++ tx.commit(); ++ } + +- //send transaction +- if (commit) +- session.getTransaction().commit(); +- } +- +- Logger.trace("Found entries: " + result.size()); +- +- //Assertion requires an unique artifact +- if (result.size() != 1) { +- Logger.trace("No entries found."); +- throw new MOADatabaseException("No session found with this sessionID"); +- } +- +- return (AuthenticatedSessionStore) result.get(0); ++ Logger.trace("Found entries: " + result.size()); ++ ++ //Assertion requires an unique artifact ++ if (result.size() != 1) { ++ Logger.trace("No entries found."); ++ throw new MOADatabaseException("No session found with this sessionID"); ++ } ++ ++ return (AuthenticatedSessionStore) result.get(0); ++ } catch (Exception e) { ++ if (tx != null && !tx.wasCommitted() && commit) ++ tx.rollback(); ++ throw e; ++ } + } + } +diff --git a/id/server/idserverlib/src/main/resources/moaid.configuration.beans.xml b/id/server/idserverlib/src/main/resources/moaid.configuration.beans.xml +index 206fde8..7e319e2 100644 +--- a/id/server/idserverlib/src/main/resources/moaid.configuration.beans.xml ++++ b/id/server/idserverlib/src/main/resources/moaid.configuration.beans.xml +@@ -29,7 +29,7 @@ + + + +- ++ + + + +diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/config/persistence/MOAIDConfiguration.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/config/persistence/MOAIDConfiguration.java +index 223f29a..4bd459f 100644 +--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/config/persistence/MOAIDConfiguration.java ++++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/config/persistence/MOAIDConfiguration.java +@@ -61,4 +61,16 @@ public interface MOAIDConfiguration extends Configuration { + * @throws ConfigurationException in case of an configuration access error + */ + public Map getOnlineApplication(String publicURLPrefix) throws ConfigurationException; ++ ++ ++ /** ++ * Load an OnlineApplication configuration and remove the OA key prefix ++ * This is a backup version if direct UniqueID selection does not work ++ * ++ * @param publicURLPrefix: Unique identifier of online application ++ * @return Properties of the online application or null if no OA is found ++ * @throws ConfigurationException in case of an configuration access error ++ */ ++ public Map getOnlineApplicationBackupVersion(String publicURLPrefix) throws ConfigurationException; ++ + } +\ No newline at end of file +diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/config/persistence/MOAIDConfigurationImpl.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/config/persistence/MOAIDConfigurationImpl.java +index 297c63d..b9b5ad6 100644 +--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/config/persistence/MOAIDConfigurationImpl.java ++++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/config/persistence/MOAIDConfigurationImpl.java +@@ -1,5 +1,7 @@ + package at.gv.egovernment.moa.id.commons.config.persistence; + ++import java.sql.SQLSyntaxErrorException; ++import java.util.ArrayList; + import java.util.HashMap; + import java.util.Iterator; + import java.util.List; +@@ -131,13 +133,88 @@ public class MOAIDConfigurationImpl extends DatabaseConfigPropertyImpl implement + String keyId = MOAIDConfigurationConstants.PREFIX_MOAID_SERVICES + + ".%." + + MOAIDConfigurationConstants.SERVICE_UNIQUEIDENTIFIER; +- ++ ++ List oaSearchResult = null; + TypedQuery oaSearchQuery = em.createQuery("select dbconfig from ConfigProperty dbconfig where dbconfig.key like :key and dbconfig.value = SUBSTRING(:uniqueID, 1, LENGTH(dbconfig.value))", ConfigProperty.class); + oaSearchQuery.setParameter("key", keyId); + oaSearchQuery.setParameter("uniqueID", publicURLPrefix); +- List oaSearchResult = oaSearchQuery.getResultList(); ++ oaSearchResult = oaSearchQuery.getResultList(); ++ ++ return postProcessLoadOnlineApplication(em, oaSearchResult); ++ ++ } ++ ++ /* (non-Javadoc) ++ * @see at.gv.egovernment.moa.id.commons.config.persistence.MOAIDConfiguration#getOnlineApplicationBackupVersion(java.lang.String) ++ */ ++ @Override ++ public Map getOnlineApplicationBackupVersion( ++ String publicURLPrefix) throws ConfigurationException { ++ Logger.debug("Use backup implementation to query configuration database"); ++ ++ EntityManager em = this.getPersistenceContext(); ++ if (null == em) { ++ Logger.error("No EntityManager set!"); ++ throw new ConfigurationException("No EntityManager set!"); ++ ++ } ++ ++ //search key prefix for online application with this publicURLPrefix ++ String keyId = MOAIDConfigurationConstants.PREFIX_MOAID_SERVICES ++ + ".%." ++ + MOAIDConfigurationConstants.SERVICE_UNIQUEIDENTIFIER; + +- if (oaSearchResult.size() == 0) { ++ List oaSearchResult = new ArrayList(); ++ ++ TypedQuery oaSearchQuery = em.createQuery("select dbconfig from ConfigProperty dbconfig where dbconfig.key like :key", ConfigProperty.class); ++ oaSearchQuery.setParameter("key", keyId); ++ List intermResult = oaSearchQuery.getResultList(); ++ if (intermResult != null) { ++ for (ConfigProperty el : intermResult) { ++ if (publicURLPrefix.startsWith(el.getValue())) ++ oaSearchResult.add(el); ++ ++ } ++ } ++ ++ return postProcessLoadOnlineApplication(em, oaSearchResult); ++ ++ } ++ ++ /** ++ * Small helper method. NOTE: may return empty configuration properties, but never {@code null}. ++ * ++ * @param propPrefix: the prefix of the desired property. ++ * @param input: List of database objects with key/value information. ++ * @param removePrefix: Indicates if the prefix should be removed from the result key ++ * @return the {@link Map} of configuration properties ++ */ ++ private Map getKeyValueFromDatabaseDAO(Iterator input, final String prefix, boolean removePrefix) { ++ Map configProp = new HashMap(); ++ while (input.hasNext()) { ++ ConfigProperty el = input.next(); ++ if (removePrefix) { ++ if (el.getKey().startsWith(prefix)) { ++ String propertyName = KeyValueUtils.removePrefixFromKey(el.getKey(), prefix); ++ configProp.put(propertyName, el.getValue()); ++ ++ } ++ } else ++ configProp.put(el.getKey(), el.getValue()); ++ ++ } ++ return configProp; ++ } ++ ++ /** ++ * Online-Application load operation post-processing ++ * ++ * @param em EntityManager for Database access ++ * @param oaSearchResult Search result of first OA selection operation ++ * @return Map of post-processed OA configuration key/value pairs ++ */ ++ private Map postProcessLoadOnlineApplication(EntityManager em, List oaSearchResult) { ++ if (oaSearchResult == null || oaSearchResult.size() == 0) { + Logger.debug("No entries found."); + return null; } + +@@ -170,31 +247,6 @@ public class MOAIDConfigurationImpl extends DatabaseConfigPropertyImpl implement + result.put(MOAIDConfigurationConstants.PREFIX_MOAID_SERVICES, oaType); + + return result; ++ + } +- +- /** +- * Small helper method. NOTE: may return empty configuration properties, but never {@code null}. +- * +- * @param propPrefix: the prefix of the desired property. +- * @param input: List of database objects with key/value information. +- * @param removePrefix: Indicates if the prefix should be removed from the result key +- * @return the {@link Map} of configuration properties +- */ +- private Map getKeyValueFromDatabaseDAO(Iterator input, final String prefix, boolean removePrefix) { +- Map configProp = new HashMap(); +- while (input.hasNext()) { +- ConfigProperty el = input.next(); +- if (removePrefix) { +- if (el.getKey().startsWith(prefix)) { +- String propertyName = KeyValueUtils.removePrefixFromKey(el.getKey(), prefix); +- configProp.put(propertyName, el.getValue()); +- +- } +- } else +- configProp.put(el.getKey(), el.getValue()); +- +- } +- return configProp; +- } +- + } +diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/MOASessionDBUtils.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/MOASessionDBUtils.java +index 7621552..49e0634 100644 +--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/MOASessionDBUtils.java ++++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/MOASessionDBUtils.java +@@ -163,8 +163,9 @@ public final class MOASessionDBUtils { + + } catch(HibernateException e) { + Logger.warn("Error during MOASession database saveOrUpdate. Rollback.", e); +- tx.rollback(); +- throw new MOADatabaseException(e); ++ if (tx != null) ++ tx.rollback(); ++ throw new MOADatabaseException(e); + } + } + +@@ -183,8 +184,9 @@ public final class MOASessionDBUtils { + + } catch(HibernateException e) { + Logger.warn("Error during MOASession database delete. Rollback.", e); +- tx.rollback(); +- return false; ++ if (tx != null) ++ tx.rollback(); ++ return false; + } + } + +diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/NewConfigurationDBRead.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/NewConfigurationDBRead.java +index 0f157f1..c049eeb 100644 +--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/NewConfigurationDBRead.java ++++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/NewConfigurationDBRead.java +@@ -41,9 +41,12 @@ public class NewConfigurationDBRead { + + } + +- public Map getOnlineApplicationKeyValueWithId(String id) { ++ public Map getOnlineApplicationKeyValueWithId(String id, boolean backupVersion) { + try { +- return conf.getOnlineApplication(id); ++ if (backupVersion) ++ return conf.getOnlineApplicationBackupVersion(id); ++ else ++ return conf.getOnlineApplication(id); + + } catch (ConfigurationException e) { + Logger.warn("OnlineApplication with Id: " + id + " not found.", e); +diff --git a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/dao/config/DatabaseConfigPropertyImpl.java b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/dao/config/DatabaseConfigPropertyImpl.java +index f59e39a..aad830d 100644 +--- a/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/dao/config/DatabaseConfigPropertyImpl.java ++++ b/id/server/moa-id-commons/src/main/java/at/gv/egovernment/moa/id/commons/db/dao/config/DatabaseConfigPropertyImpl.java +@@ -1,6 +1,10 @@ + package at.gv.egovernment.moa.id.commons.db.dao.config; + ++import java.util.ArrayList; ++import java.util.Iterator; + import java.util.List; ++import java.util.Map.Entry; ++import java.util.regex.Pattern; + + import javax.persistence.EntityManager; + import javax.persistence.PersistenceContext; +@@ -137,10 +141,33 @@ public class DatabaseConfigPropertyImpl extends AbstractConfigurationImpl { + throw new ConfigurationException("No EntityManager set!"); + } + +- TypedQuery query = em.createQuery("select key from ConfigProperty dbconfig where dbconfig.value like :value", String.class); +- query.setParameter("value", searchString.replace("*", "%")); +- List result = query.getResultList(); +- return result.toArray(new String[result.size()]); ++ TypedQuery query = em.createQuery("select * from ConfigProperty dbconfig", ConfigProperty.class); ++ List all = query.getResultList(); ++ ++ searchString = searchString.replace(".", "\\."); ++ String regex = searchString.replace("*", ".*"); ++ regex = regex.replace("%", "\\w*"); ++ log.debug("Searching with regex: {}", regex); ++ Pattern pattern = Pattern.compile(regex); ++ ++ List keyList = new ArrayList(); ++ Iterator keyIt; ++ if (all != null) { ++ keyIt = all.iterator(); ++ while(keyIt.hasNext()) { ++ ConfigProperty entry = keyIt.next(); ++ String value = entry.getValue(); ++ String key = entry.getKey(); ++ ++ if(pattern.matcher(value).matches()) { ++ keyList.add(key); ++ } ++ } ++ } ++ ++ String[] result = new String[keyList.size()]; ++ return keyList.toArray(result); ++ + } + + /* (non-Javadoc) +diff --git a/id/server/moa-id-commons/src/main/resources/moaid.migration.beans.xml b/id/server/moa-id-commons/src/main/resources/moaid.migration.beans.xml +index 3bd1222..c758e23 100644 +--- a/id/server/moa-id-commons/src/main/resources/moaid.migration.beans.xml ++++ b/id/server/moa-id-commons/src/main/resources/moaid.migration.beans.xml +@@ -31,7 +31,7 @@ + + + +- ++ + + + +-- +1.9.5.msysgit.0 + diff --git a/0002-change-default-filename-in-configuration-download-di.patch b/0002-change-default-filename-in-configuration-download-di.patch new file mode 100644 index 000000000..d95f57e38 --- /dev/null +++ b/0002-change-default-filename-in-configuration-download-di.patch @@ -0,0 +1,25 @@ +From 2362892f59b8daccb8c0a2155048c5adc7a1a7ea Mon Sep 17 00:00:00 2001 +From: Thomas Lenz +Date: Tue, 15 Sep 2015 12:56:17 +0200 +Subject: [PATCH 2/3] change default filename in configuration download dialog + +--- + id/ConfigWebTool/src/main/resources/struts.xml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/id/ConfigWebTool/src/main/resources/struts.xml b/id/ConfigWebTool/src/main/resources/struts.xml +index 701cc99..f978e93 100644 +--- a/id/ConfigWebTool/src/main/resources/struts.xml ++++ b/id/ConfigWebTool/src/main/resources/struts.xml +@@ -284,7 +284,7 @@ + + application/octet-stream + fileInputStream +- attachment;filename="MOAID-2.0_config.xml" ++ attachment;filename="MOAID-3.0_config.properties" + 1024 + + +-- +1.9.5.msysgit.0 + diff --git a/0003-update-handbook-and-release-information.patch b/0003-update-handbook-and-release-information.patch new file mode 100644 index 000000000..6c8a4ee2a --- /dev/null +++ b/0003-update-handbook-and-release-information.patch @@ -0,0 +1,752 @@ +From 8149f22dc110b82ef2910db0037d037062628dd5 Mon Sep 17 00:00:00 2001 +From: Thomas Lenz +Date: Tue, 15 Sep 2015 13:02:59 +0200 +Subject: [PATCH 3/3] - update handbook and release information - change + version to 3.0.2 + +--- + id/history.txt | 7 + + id/readme_3.0.2.txt | 644 ++++++++++++++++++++++++++++++ + id/server/doc/handbook/config/config.html | 16 +- + pom.xml | 12 +- + 4 files changed, 672 insertions(+), 7 deletions(-) + create mode 100644 id/readme_3.0.2.txt + +diff --git a/id/history.txt b/id/history.txt +index f1b9adf..6ad08d9 100644 +--- a/id/history.txt ++++ b/id/history.txt +@@ -1,5 +1,12 @@ + Dieses Dokument zeigt die Veränderungen und Erweiterungen von MOA-ID auf. + ++Version MOA-ID Release 3.0.2: Änderungen seit Version MOA-ID 3.0.1 ++- Änderungen ++ - Bug-Fix für Zugriff auf Oracle Datenbanken ++ - ++ ++ ++ ------------------------------------------------------------------------------ + Version MOA-ID Release 3.0.1: Änderungen seit Version MOA-ID 3.0.0 + - Änderungen + - Bug-Fix für Testkarten mit Testkarten-OID +diff --git a/id/readme_3.0.2.txt b/id/readme_3.0.2.txt +new file mode 100644 +index 0000000..cd752a6 +--- /dev/null ++++ b/id/readme_3.0.2.txt +@@ -0,0 +1,644 @@ ++=============================================================================== ++MOA ID Version Release 3.0.2 - Wichtige Informationen zur Installation ++=============================================================================== ++ ++------------------------------------------------------------------------------- ++A. Neuerungen/Änderungen ++------------------------------------------------------------------------------- ++ ++Mit MOA ID Version 3.0.2 wurden folgende Neuerungen und Änderungen eingeführt, ++die jetzt erstmals in der Veröffentlichung enthalten sind (siehe auch ++history.txt im gleichen Verzeichnis). Da es sich bei der Version 3.0.2 nur um ++Version mit minimaler Fehlerbereinigung handelt sind zusätzlich auch alle ++Änderungen aus der Version 3.0.0 und 3.0.1 zur Information gelisted: ++ ++- Änderungen ++ - Bug-Fix für Zugriff auf Oracle Datenbanken ++ ++Anpassungen aus MOA-ID 3.0.0 und 3.0.1 ++- Änderungen ++ - Redesign des Datenmodels für die Configuration ++ - Redesign des Authentifizierungsprozessmanagment ++ - Anpassung VIDP Code für STORK ++ - Update von TrustStore und CertSTore ++ - Kleinere Bug-Fixes ++ - Update von Libraries ++ - Bug-Fix für Testkarten mit Testkarten-OID ++ ++------------------------------------------------------------------------------- ++B. Durchführung eines Updates ++------------------------------------------------------------------------------- ++ ++Es wird generell eine Neuinstallation lt. Handbuch empfohlen! Dennoch ist auch ++eine Aktualisierung bestehender Installationen möglich. Je nachdem von welcher ++MOA-ID Version ausgegangen wird ergibt sich eine Kombination der nachfolgend ++angebebenen Updateschritte. ++ ++Hinweis: Wenn Sie die bestehende Konfiguration von MOA-ID 2.x.x in MOA-ID 3.0.x ++reimportieren möchten, so muss diese vor dem Update mit Hilfe der import/export ++Funktion der grafischen Konfigurationsoberfläche in eine Datei exportiert werden. ++Diese Datei dient dann als Basis für den Import in MOA-ID 3.0.x. ++ ++............................................................................... ++B.0 Durchführung eines Updates von Version 3.0.1 auf Version 3.0.2 ++............................................................................... ++1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird. ++ Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an. ++ ++2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-3.0.0.zip) in ++ ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST ++ bezeichnet. ++ ++3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth ++ beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps, ++ wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation ++ für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war ++ als auch das komplette Verzeichnis moa-id-auth. ++ ++4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach ++ CATALINA_HOME_ID/webapps. ++ ++5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach ++ CATALINA_HOME_ID/webapps. ++ ++6. Hinzufügen der zusätzlichen Konfigurationsparameter in der ++ MOA-ID-Configuration Konfigurationsdatei ++ CATALINA_HOME\conf\moa-id-configuration\moa-id-configtool.properties ++ a.) dbcp.validationQuery=..... (SQL Query zum Validieren der ++ Datenbankverbindung ++ z.B: "SELECT 1" für mySQL ++ "select 1 from dual" für OracleDB) ++ ++7. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth ++ Konfigurationsdatei CATALINA_HOME\conf\moa-id\moa-id.properties ++ a.) configuration.dbcp.validationQuery=..... (SQL Query zum ++ Validieren der Datenbankverbindung ++ z.B: "SELECT 1" für mySQL ++ "select 1 from dual" für OracleDB) ++ ++8. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im ++ Logging von MOA ID beim Einlesen der Konfiguration. ++ ++ ++............................................................................... ++B.1 Durchführung eines Updates von Version 3.0.0 auf Version 3.0.2 ++............................................................................... ++1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird. ++ Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an. ++ ++2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-3.0.0.zip) in ++ ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST ++ bezeichnet. ++ ++3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth ++ beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps, ++ wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation ++ für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war ++ als auch das komplette Verzeichnis moa-id-auth. ++ ++4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach ++ CATALINA_HOME_ID/webapps. ++ ++5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach ++ CATALINA_HOME_ID/webapps. ++ ++6. Update der TrustStores für WebService Zugriffe. ++ a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\certs\ca-certs ++ in das Verzeichnis CATALINA_HOME\conf\moa-id\certs\ca-certs. ++ b.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\certs\certstore\toBeAdded ++ in das Verzeichnis CATALINA_HOME\conf\moa-id\certs\certstore\toBeAdded. ++ ++7. Hinzufügen der zusätzlichen Konfigurationsparameter in der ++ MOA-ID-Configuration Konfigurationsdatei ++ CATALINA_HOME\conf\moa-id-configuration\moa-id-configtool.properties ++ a.) dbcp.validationQuery=..... (SQL Query zum Validieren der ++ Datenbankverbindung ++ z.B: "SELECT 1" für mySQL ++ "select 1 from dual" für OracleDB) ++ ++8. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth ++ Konfigurationsdatei CATALINA_HOME\conf\moa-id\moa-id.properties ++ a.) configuration.dbcp.validationQuery=..... (SQL Query zum ++ Validieren der Datenbankverbindung ++ z.B: "SELECT 1" für mySQL ++ "select 1 from dual" für OracleDB) ++ ++9. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im ++ Logging von MOA ID beim Einlesen der Konfiguration. ++ ++............................................................................... ++B.2 Durchführung eines Updates von Version 2.2.1 auf Version 3.0.2 ++............................................................................... ++ ++1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird. ++ Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an. ++ ++2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-3.0.0.zip) in ++ ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST ++ bezeichnet. ++ ++3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth ++ beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps, ++ wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation ++ für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war und ++ moa-id-configuration.war als auch das komplette Verzeichnis moa-id-auth ++ und das komplette Verzeichnis moa-id-configuration. ++ ++4. Erstellen Sie eine Sicherungskopie aller "*.jar"-Dateien im Verzeichnis ++ CATALINA_HOME_ID\endorsed und loeschen Sie diese Dateien danach. ++ ++5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach ++ CATALINA_HOME_ID/webapps. ++ ++6. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach ++ CATALINA_HOME_ID/webapps. ++ ++7. Update des Cert-Stores. ++ Kopieren Sie den Inhalt des Verzeichnisses ++ MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis ++ CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie ++ vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann ++ bejahen sie das. ++ ++8. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen ++ wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile ++ beibehalten wollen, dann gehen Sie vor, wie in Punkt b). ++ ++ a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen: ++ ++ 1) Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles. ++ 2) Kopieren Sie das Verzeichnis ++ MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis ++ CATALINA_HOME\conf\moa-spss. ++ ++ b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie ++ folgt vor, um die Profile auf den aktuellen Stand zu bringen: ++ ++ 1) Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den ++ entsprechenden Profilen im Verzeichnis ++ MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren ++ Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt ++ der einzelnen Profile aus der Distribution ++ (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden ++ Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) ++ kopieren und dabei die vorhandenen gleichnamigen Zertifikate ++ überschreiben), also z.B: Kopieren des Inhalts von ++ MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\ ++ MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach ++ CATALINA_HOME\conf\moa-spss\trustProfiles\ ++ MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. ++ ++9. Update der Default html-Templates für die Bürgerkartenauswahl. ++ ++ a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\htmlTemplates ++ in das Verzeichnis CATALINA_HOME\conf\moa-id\htmlTemplates. ++ b.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id-configuration\htmlTemplates ++ in das Verzeichnis CATALINA_HOME\conf\moa-id-configuration\htmlTemplates. ++ ++10. Update der STORK Konfiguration ++ a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\stork ++ in das Verzeichnis CATALINA_HOME\conf\moa-id\stork. ++ b.) Passen Sie die STORK Konfiguration laut Handbuch -> Konfiguration -> ++ 2.4 Konfiguration des SamlEngines an. ++ ++11. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth Konfigurationsdatei ++ CATALINA_HOME\conf\moa-id\moa-id.properties ++ ++12. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Configration Konfigurationsdatei ++ CATALINA_HOME\conf\moa-id-configuration\moa-id-configtool.properties ++ ++13. Hinzufügen der zusätzlichen Konfigurationsdatei in der MOA-ID-Configuration ++ CATALINA_HOME\conf\moa-id-configuration\userdatabase.properties ++ ++14. Update der Tomcat Start-Skripts: ++ - Die Konfigurationsdateien für MOA-ID-Auth und MOA-ID-Configuration müssen ++ nur als URI (file:/...) übergeben werden. ++ ++15. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im ++ Logging von MOA ID beim Einlesen der Konfiguration. ++ ++ ++............................................................................... ++B.1 Durchführung eines Updates von Version 2.2.0 auf Version 2.2.1 ++............................................................................... ++1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird. ++ Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an. ++ ++2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.2.1.zip) in ++ ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST ++ bezeichnet. ++ ++3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth ++ beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps, ++ wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation ++ für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war und ++ moa-id-configuration.war als auch das komplette Verzeichnis moa-id-auth ++ und das komplette Verzeichnis moa-id-configuration. ++ ++4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach ++ CATALINA_HOME_ID/webapps. ++ ++5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach ++ CATALINA_HOME_ID/webapps. ++ ++6. Update des Cert-Stores. ++ Kopieren Sie den Inhalt des Verzeichnisses ++ MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis ++ CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie ++ vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann ++ bejahen sie das. ++ ++7. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen ++ wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile ++ beibehalten wollen, dann gehen Sie vor, wie in Punkt b). ++ ++ a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen: ++ ++ 1) Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles. ++ 2) Kopieren Sie das Verzeichnis ++ MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis ++ CATALINA_HOME\conf\moa-spss. ++ ++ b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie ++ folgt vor, um die Profile auf den aktuellen Stand zu bringen: ++ ++ 1) Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den ++ entsprechenden Profilen im Verzeichnis ++ MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren ++ Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt ++ der einzelnen Profile aus der Distribution ++ (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden ++ Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) ++ kopieren und dabei die vorhandenen gleichnamigen Zertifikate ++ überschreiben), also z.B: Kopieren des Inhalts von ++ MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\ ++ MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach ++ CATALINA_HOME\conf\moa-spss\trustProfiles\ ++ MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. ++ ++8. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im ++ Logging von MOA ID beim Einlesen der Konfiguration. ++ ++............................................................................... ++B.1 Durchführung eines Updates von Version 2.1.2 auf Version 2.2.0 ++............................................................................... ++ 1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird. ++ Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an. ++ ++2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.2.0.zip) in ++ ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST ++ bezeichnet. ++ ++3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth ++ beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps, ++ wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation ++ für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war und ++ moa-id-configuration.war als auch das komplette Verzeichnis moa-id-auth ++ und das komplette Verzeichnis moa-id-configuration. ++ ++4. Erstellen Sie eine Sicherungskopie aller "*.jar"-Dateien im Verzeichnis ++ CATALINA_HOME_ID\endorsed und loeschen Sie diese Dateien danach. ++ ++6. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach ++ CATALINA_HOME_ID/webapps. ++ ++7. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach ++ CATALINA_HOME_ID/webapps. ++ ++8. Kopieren der folgenden Dateien: ++ Sollte die Datei bereits vorhanden sein erstellen Sie ein Backup der ++ Datei bevor Sie diese durch die neue Version ersetzen. ++ a.) MOA_ID_AUTH_INST/conf/moa-id/stork/StorkSamlEngine_VIDP.xml -> ++ CATALINA_HOME/conf/moa-id/stork/StorkSamlEngine_VIDP.xml ++ b.) MOA_ID_AUTH_INST/conf/moa-id/stork/StorkSamlEngine_outgoing.xml -> ++ CATALINA_HOME/conf/moa-id/stork/StorkSamlEngine_outgoing.xml ++ ++9. Dem STORK KeyStores unter MOA_ID_AUTH_INST/conf/moa-id/keys/storkDemoKeys.jks ++ (Passwort=local-demo) wurden neue vertrauenswürdige Zertifikate hinzugefügt. ++ Gleichen Sie bei Bedarf die Zertifikate dieses KeyStores mit Ihrem aktuell ++ verwendeten KeyStore ab. ++ ++10. Update des Cert-Stores. ++ Kopieren Sie den Inhalt des Verzeichnisses ++ MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis ++ CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie ++ vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann ++ bejahen sie das. ++ ++11. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen ++ wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile ++ beibehalten wollen, dann gehen Sie vor, wie in Punkt b). ++ ++ a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen: ++ ++ 1) Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles. ++ 2) Kopieren Sie das Verzeichnis ++ MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis ++ CATALINA_HOME\conf\moa-spss. ++ ++ b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie ++ folgt vor, um die Profile auf den aktuellen Stand zu bringen: ++ ++ 1) Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den ++ entsprechenden Profilen im Verzeichnis ++ MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren ++ Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt ++ der einzelnen Profile aus der Distribution ++ (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden ++ Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) ++ kopieren und dabei die vorhandenen gleichnamigen Zertifikate ++ überschreiben), also z.B: Kopieren des Inhalts von ++ MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\ ++ MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach ++ CATALINA_HOME\conf\moa-spss\trustProfiles\ ++ MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. ++ ++ ++12. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im ++ Logging von MOA ID beim Einlesen der Konfiguration. ++ ++............................................................................... ++B.2 Durchführung eines Updates von Version 2.1.1 auf Version 2.1.2 ++............................................................................... ++ 1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird. ++ Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an. ++ ++2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.1.2.zip) in ++ ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST ++ bezeichnet. ++ ++3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth ++ beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps, ++ wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation ++ für MOA ID steht). Löschen Sie darin sowohl die Dateien moa-id-auth.war und ++ moa-id-configuration.war als auch das komplette Verzeichnis moa-id-auth ++ und das komplette Verzeichnis moa-id-configuration. ++ ++4. Erstellen Sie eine Sicherungskopie aller "*.jar"-Dateien im Verzeichnis ++ CATALINA_HOME_ID\endorsed und loeschen Sie diese Dateien danach. ++ ++5. Kopieren Sie alle Dateien aus dem Verzeichnis MOA_ID_AUTH_INST\endorsed in das ++ Verzeichnis CATALINA_HOME_ID\endorsed ++ ++6. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach ++ CATALINA_HOME_ID/webapps. ++ ++7. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach ++ CATALINA_HOME_ID/webapps. ++ ++8. Kopieren der folgenden Dateien ++ a.) MOA_ID_AUTH_INST/conf/moa-id/stork/StorkSamlEngine_VIDP.xml -> ++ CATALINA_HOME/conf/moa-id/stork/StorkSamlEngine_VIDP.xml ++ Sollte die Datei bereits vorhanden sein erstellen Sie ein Backup der ++ Datei slo_template.html bevor Sie diese durch die neue Version ersetzen. ++ ++9. Dem STORK KeyStores unter MOA_ID_AUTH_INST/conf/moa-id/keys/storkDemoKeys.jks ++ (Passwort=local-demo) wurden neue vertrauenswürdige Zertifikate hinzugefügt. ++ Gleichen Sie bei Bedarf die Zertifikate dieses KeyStores mit Ihrem aktuell ++ verwendeten KeyStore ab. ++ ++10. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im ++ Logging von MOA ID beim Einlesen der Konfiguration. ++ ++ ++............................................................................... ++B.3 Durchführung eines Updates von Version 2.1.0 auf Version 2.1.1 ++............................................................................... ++ 1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird. ++ Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an. ++ ++2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.1.0.zip) in ++ ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST ++ bezeichnet. ++ ++3. Erstellen Sie eine Sicherungskopie aller "iaik*.jar"-Dateien im Verzeichnis ++ JAVA_HOME\jre\lib\ext und loeschen Sie diese Dateien danach. ++ ++4. Kopieren Sie alle Dateien aus dem Verzeichnis MOA_ID_AUTH_INST\ext in das ++ Verzeichnis JAVA_HOME\jre\lib\ext (Achtung: Java 1.4.x wird nicht mehr ++ unterstuetzt). ++ ++5. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth ++ beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps, ++ wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation ++ für MOA ID steht). Löschen Sie darin sowohl die Datei moa-id-auth.war als ++ auch das komplette Verzeichnis moa-id-auth. ++ ++6. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach ++ CATALINA_HOME_ID/webapps. ++ ++7. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach ++ CATALINA_HOME_ID/webapps. ++ ++8. Hinzufügen der zusätzlichen Konfigurationsparameter in der ++ MOA-ID-Configuration Konfigurationsdatei ++ CATALINA_HOME\conf\moa-id-configuration\moa-id-configtool.properties ++ a.) general.moaconfig.key=..... (Passwort zum Ver- und ++ Entschlüsseln von Konfigurationsparametern in der Datenbank) ++ ++9. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth ++ Konfigurationsdatei CATALINA_HOME\conf\moa-id\moa-id.properties ++ a.) configuration.moaconfig.key=..... (Passwort zum Ver- und ++ Entschlüsseln von Konfigurationsparametern in der Datenbank) ++ ++10. Kopieren der folgenden Dateien ++ a.) MOA_ID_AUTH_INST/conf/moa-id/htmlTemplates/slo_template.html -> ++ CATALINA_HOME/conf/moa-id/htmlTemplates/slo_template.html ++ Sollte die Datei bereits vorhanden sein erstellen Sie ein Backup der ++ Datei slo_template.html bevor Sie diese durch die neue Version ersetzen. ++ ++11. Update des Cert-Stores. ++ Kopieren Sie den Inhalt des Verzeichnisses ++ MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis ++ CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie ++ vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann ++ bejahen sie das. ++ ++12. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen ++ wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile ++ beibehalten wollen, dann gehen Sie vor, wie in Punkt b). ++ ++ a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen: ++ ++ 1) Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles. ++ 2) Kopieren Sie das Verzeichnis ++ MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis ++ CATALINA_HOME\conf\moa-spss. ++ ++ b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie ++ folgt vor, um die Profile auf den aktuellen Stand zu bringen: ++ ++ 1) Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den ++ entsprechenden Profilen im Verzeichnis ++ MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren ++ Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt ++ der einzelnen Profile aus der Distribution ++ (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden ++ Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) ++ kopieren und dabei die vorhandenen gleichnamigen Zertifikate ++ überschreiben), also z.B: Kopieren des Inhalts von ++ MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\ ++ MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach ++ CATALINA_HOME\conf\moa-spss\trustProfiles\ ++ MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. ++ ++13. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im ++ Logging von MOA ID beim Einlesen der Konfiguration. ++ ++ ++............................................................................... ++B.4 Durchführung eines Updates von Version 2.0.1 auf Version 2.1.0 ++............................................................................... ++ 1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird. ++ Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an. ++ ++2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.1.0.zip) in ++ ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST ++ bezeichnet. ++ ++3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth ++ beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps, ++ wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation ++ für MOA ID steht). Löschen Sie darin sowohl die Datei moa-id-auth.war als ++ auch das komplette Verzeichnis moa-id-auth. ++ ++4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach ++ CATALINA_HOME_ID/webapps. ++ ++5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach ++ CATALINA_HOME_ID/webapps. ++ ++6. Update der STORK Konfiguration ++ a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\stork ++ in das Verzeichnis CATALINA_HOME\conf\moa-id\stork. ++ b.) Passen Sie die STORK Konfiguration laut Handbuch -> Konfiguration -> ++ 2.4 Konfiguration des SamlEngines an. ++ ++7. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Configuration Konfigurationsdatei ++ CATALINA_HOME\conf\moa-id-configuration\moa-id-configtool.properties ++ a.) general.ssl.certstore=certs/certstore ++ b.) general.ssl.truststore=certs/truststore ++ ++8. Kopieren des folgenden zusätzlichen Ordners MOA_ID_AUTH_INST/conf/moa-id-configuration/certs ++ nach CATALINA_HOME\conf\moa-id-configuration\ ++ ++9. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth Konfigurationsdatei ++ CATALINA_HOME\conf\moa-id\moa-id.properties und Anpassung an das zu verwendeten Schlüsselpaar. ++ a.) protocols.pvp2.idp.ks.assertion.encryption.alias=pvp_assertion ++ protocols.pvp2.idp.ks.assertion.encryption.keypassword=password ++ ++10. Kopieren der folgenden zusätzlichen Ordner aus MOA_ID_AUTH_INST/conf/moa-id/ ++ nach CATALINA_HOME\conf\moa-id\ ++ a.) MOA_ID_AUTH_INST/conf/moa-id/SLTemplates -> CATALINA_HOME\conf\moa-id\ ++ b.) MOA_ID_AUTH_INST/conf/moa-id/htmlTemplates/slo_template.html -> ++ CATALINA_HOME/conf/moa-id/htmlTemplates/slo_template.html ++ ++11. Neuinitialisieren des Datenbank Schema für die MOA-Session. Hierfür stehen ++ zwei Varianten zur Verfügung. ++ a.) Ändern Sie in der Konfigurationsdatei für das Modul MOA-ID-Auth ++ CATALINA_HOME\conf\moa-id\moa-id.properties die Zeile ++ moasession.hibernate.hbm2ddl.auto=update ++ zu ++ moasession.hibernate.hbm2ddl.auto=create ++ Danach werden die Tabellen beim nächsten Startvorgang neu generiert. ++ ++ b.) Löschen Sie alle Tabellen aus dem Datenbank Schema für die MOA-Sessixson ++ Informationen per Hand. Alle Tabellen werden beim nächsten Start autmatisch neu generiert. ++ ++12 . Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im ++ Logging von MOA ID beim Einlesen der Konfiguration. ++ ++ ++............................................................................... ++B.5 Durchführung eines Updates von Version 2.0-RC1 auf Version 2.0.1 ++............................................................................... ++ ++1. Stoppen Sie den Tomcat, in dem Ihre bisherige Installation betrieben wird. ++ Fertigen Sie eine Sicherungskopie Ihrer kompletten Tomcat-Installation an. ++ ++2. Entpacken Sie die Distribution von MOA-ID-Auth (moa-id-auth-2.0.1.zip) in ++ ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_AUTH_INST ++ bezeichnet. ++ Für MOA ID Proxy: ++ Entpacken Sie die Distribution von MOA-ID-Proxy (moa-id-proxy-2.0.1.zip) in ++ ein temporäres Verzeichnis, in weiterer Folge als MOA_ID_PROXY_INST ++ bezeichnet. ++ ++3. Wechseln Sie in jenes Verzeichnis, das die Webapplikation von MOA ID Auth ++ beinhaltet (für gewöhnlich ist dieses Verzeichnis CATALINA_HOME_ID/webapps, ++ wobei CATALINA_HOME_ID für das Basisverzeichnis der Tomcat-Installation ++ für MOA ID steht). Löschen Sie darin sowohl die Datei moa-id-auth.war als ++ auch das komplette Verzeichnis moa-id-auth. ++ ++4. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-auth.war nach ++ CATALINA_HOME_ID/webapps. ++ ++5. Kopieren Sie die Datei MOA_ID_AUTH_INST/moa-id-configuration.war nach ++ CATALINA_HOME_ID/webapps. ++ ++6. Update des Cert-Stores. ++ Kopieren Sie den Inhalt des Verzeichnisses ++ MOA_ID_INST_AUTH\conf\moa-spss\certstore in das Verzeichnis ++ CATALINA_HOME\conf\moa-spss\certstore. Wenn Sie gefragt werden, ob Sie ++ vorhandene Dateien oder Unterverzeichnisse überschreiben sollen, dann ++ bejahen sie das. ++ ++7. Update der Trust-Profile. Wenn Sie Ihre alten Trust-Profile durch die Neuen ersetzen ++ wollen, dann gehen Sie vor, wie in Punkt a). Wenn Sie Ihre eigenen Trust-Profile ++ beibehalten wollen, dann gehen Sie vor, wie in Punkt b). ++ ++ a. Gehen Sie wie folgt vor, um die Trust-Profile auszutauschen: ++ ++ 1) Löschen Sie das Verzeichnis CATALINA_HOME\conf\moa-spss\trustprofiles. ++ 2) Kopieren Sie das Verzeichnis ++ MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles in das Verzeichnis ++ CATALINA_HOME\conf\moa-spss. ++ ++ b. Falls Sie Ihre alten Trust-Profile beibehalten wollen, gehen Sie wie ++ folgt vor, um die Profile auf den aktuellen Stand zu bringen: ++ ++ 1) Ergänzen Sie ihre Trustprofile durch alle Zertifikate aus den ++ entsprechenden Profilen im Verzeichnis ++ MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles, die nicht in Ihren ++ Profilen enthalten sind. Am einfachsten ist es, wenn Sie den Inhalt ++ der einzelnen Profile aus der Distribution ++ (MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles) in die entsprechenden ++ Profile Ihrer Installation (CATALINA_HOME\conf\moa-spss\trustProfiles) ++ kopieren und dabei die vorhandenen gleichnamigen Zertifikate ++ überschreiben), also z.B: Kopieren des Inhalts von ++ MOA_ID_INST_AUTH\conf\moa-spss\trustProfiles\ ++ MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten nach ++ CATALINA_HOME\conf\moa-spss\trustProfiles\ ++ MOAIDBuergerkarteAuthentisierungsDatenMitTestkarten usw. ++ ++8. Update der Default html-Templates für die Bürgerkartenauswahl. ++ ++ a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\htmlTemplates ++ in das Verzeichnis CATALINA_HOME\conf\moa-id\htmlTemplates. ++ b.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id-configuration\htmlTemplates ++ in das Verzeichnis CATALINA_HOME\conf\moa-id-configuration\htmlTemplates. ++ ++9. Update der STORK Konfiguration ++ a.) Kopieren Sie die Dateien aus dem Verzeichnis MOA_ID_INST_AUTH\conf\moa-id\stork ++ in das Verzeichnis CATALINA_HOME\conf\moa-id\stork. ++ b.) Passen Sie die STORK Konfiguration laut Handbuch -> Konfiguration -> ++ 2.4 Konfiguration des SamlEngines an. ++ ++10. Hinzufügen der zusätzlichen Konfigurationsparameter in der MOA-ID-Auth Konfigurationsdatei ++ CATALINA_HOME\conf\moa-id\moa-id.properties ++ ++ a.) configuration.validation.certificate.QC.ignore=false ++ b.) protocols.pvp2.assertion.encryption.active=false ++ ++11. Starten Sie den Tomcat neu, achten Sie auf eventuelle Fehlermeldungen im ++ Logging von MOA ID beim Einlesen der Konfiguration. ++ ++ ++............................................................................... ++B.6 Durchführung eines Updates von Version <= 1.5.1 ++............................................................................... ++ ++Bitte führen Sie eine Neuinstallation von MOA ID laut Handbuch durch und passen ++Sie die mitgelieferte Musterkonfiguration entsprechend Ihren Bedürfnissen unter ++Zuhilfenahme Ihrer bisherigen Konfiguration an. ++ +diff --git a/id/server/doc/handbook/config/config.html b/id/server/doc/handbook/config/config.html +index 6f6d13d..4eb5ea2 100644 +--- a/id/server/doc/handbook/config/config.html ++++ b/id/server/doc/handbook/config/config.html +@@ -259,6 +259,13 @@ UNIX: -Duser.properties=file:C:/Programme/apache/tomcat-8.x.x/conf/moa-id-config + moaconfigpassword + Passwort für den Zugriff auf das Datenbank Schema + ++ ++

dbcp.validationQuery

++ SELECT 1 ++

SQL Query zum Validieren der Datenbank Verbindung

++

mySQL: SELECT 1

++

Oracle: select 1 from dual

++ + +

 

+

Die Beispielkonfiguration beinhaltet noch zusätzliche Konfigurationsparameter für den Datenbankzugriff welche direkt aus der Beispielkonfiguration übernommen werden können. Eine detaillierte Beschreibung der einzelnen Einstellungsparameter kann der Hibernate Dokumention entnommen werden.

+@@ -612,10 +619,17 @@ https://<host>:<port>/moa-id-auth/MonitoringServlet + Benutzername für den Zugriff auf das Datenbank Schema + + +-

configuration.hibernate.connection.password

++ configuration.hibernate.connection.password + moaconfigpassword + Passwort für den Zugriff auf das Datenbank Schema + ++ ++

configuration.dbcp.validationQuery

++ SELECT 1 ++

SQL Query zum Validieren der Datenbank Verbindung

++

mySQL: SELECT 1

++

Oracle: select 1 from dual

++ + +

 

+
2.2.2.4.2 Session Informationen
+diff --git a/pom.xml b/pom.xml +index cdffb90..3e7e4ea 100644 +--- a/pom.xml ++++ b/pom.xml +@@ -22,12 +22,12 @@ + --> + + +- 3.0.1-Snapshot +- 3.0.2-Snapshot ++ 3.0.2 ++ 3.0.2 + 2.0.1-Snapshot +- 2.0.5-Snapshot +- 2.0.1-Snapshot +- 2.0.5-Snapshot ++ 2.0.5 ++ 2.0.2 ++ 2.0.5 + + + 4.1.6.RELEASE +@@ -236,7 +236,7 @@ + + + +- --> ++ --> + + + +-- +1.9.5.msysgit.0 + diff --git a/common/src/main/resources/resources/schemas/ts_119612v010201_additionaltypes_xsd.xsd b/common/src/main/resources/resources/schemas/ts_119612v010201_additionaltypes_xsd.xsd new file mode 100644 index 000000000..4af373cf0 --- /dev/null +++ b/common/src/main/resources/resources/schemas/ts_119612v010201_additionaltypes_xsd.xsd @@ -0,0 +1,35 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/common/src/main/resources/resources/schemas/ts_119612v010201_sie_xsd.xsd b/common/src/main/resources/resources/schemas/ts_119612v010201_sie_xsd.xsd new file mode 100644 index 000000000..42a96b78c --- /dev/null +++ b/common/src/main/resources/resources/schemas/ts_119612v010201_sie_xsd.xsd @@ -0,0 +1,81 @@ + + + + + + + + + + + + + + + + + + + Please first try to use the CriteriaList before doing the OtherCriteria extension point. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/common/src/main/resources/resources/schemas/ts_119612v010201_xsd.xsd b/common/src/main/resources/resources/schemas/ts_119612v010201_xsd.xsd new file mode 100644 index 000000000..fb1852ec0 --- /dev/null +++ b/common/src/main/resources/resources/schemas/ts_119612v010201_xsd.xsd @@ -0,0 +1,337 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/opemsaml/MOAStringRedirectDeflateEncoder.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/opemsaml/MOAStringRedirectDeflateEncoder.java index ece1a805d..acbb67b34 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/opemsaml/MOAStringRedirectDeflateEncoder.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/opemsaml/MOAStringRedirectDeflateEncoder.java @@ -27,6 +27,7 @@ import org.opensaml.saml2.binding.encoding.HTTPRedirectDeflateEncoder; import org.opensaml.ws.message.MessageContext; import org.opensaml.ws.message.encoder.MessageEncodingException; +import at.gv.egovernment.moa.id.protocols.pvp2x.config.MOADefaultBootstrap; import at.gv.egovernment.moa.logging.Logger; /** @@ -45,6 +46,9 @@ public class MOAStringRedirectDeflateEncoder extends HTTPRedirectDeflateEncoder "Invalid message context type, this encoder only support SAMLMessageContext"); } + //load default PVP security configurations + MOADefaultBootstrap.initializeDefaultPVPConfiguration(); + SAMLMessageContext samlMsgCtx = (SAMLMessageContext) messageContext; String endpointURL = getEndpointURL(samlMsgCtx).buildURL(); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/PostBinding.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/PostBinding.java index 5402e3dce..65400444d 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/PostBinding.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/PostBinding.java @@ -28,6 +28,7 @@ import javax.servlet.http.HttpServletResponse; import org.apache.velocity.app.VelocityEngine; import org.opensaml.common.SAMLObject; import org.opensaml.common.binding.BasicSAMLMessageContext; +import org.opensaml.common.binding.SAMLMessageContext; import org.opensaml.common.xml.SAMLConstants; import org.opensaml.saml2.binding.decoding.HTTPPostDecoder; import org.opensaml.saml2.binding.encoding.HTTPPostEncoder; @@ -51,6 +52,7 @@ import org.opensaml.xml.security.x509.X509Credential; import at.gv.egovernment.moa.id.config.ConfigurationException; import at.gv.egovernment.moa.id.protocols.pvp2x.PVP2XProtocol; +import at.gv.egovernment.moa.id.protocols.pvp2x.config.MOADefaultBootstrap; import at.gv.egovernment.moa.id.protocols.pvp2x.config.PVPConfiguration; import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.PVP2Exception; import at.gv.egovernment.moa.id.protocols.pvp2x.messages.InboundMessage; @@ -74,6 +76,9 @@ public class PostBinding implements IDecoder, IEncoder { X509Credential credentials = CredentialProvider .getIDPAssertionSigningCredential(); + //load default PVP security configurations + MOADefaultBootstrap.initializeDefaultPVPConfiguration(); + VelocityEngine engine = VelocityProvider.getClassPathVelocityEngine(); HTTPPostEncoder encoder = new HTTPPostEncoder(engine, "resources/templates/pvp_postbinding_template.html"); @@ -109,6 +114,9 @@ public class PostBinding implements IDecoder, IEncoder { X509Credential credentials = CredentialProvider .getIDPAssertionSigningCredential(); + //load default PVP security configurations + MOADefaultBootstrap.initializeDefaultPVPConfiguration(); + Logger.debug("create SAML POSTBinding response"); VelocityEngine engine = VelocityProvider.getClassPathVelocityEngine(); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/RedirectBinding.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/RedirectBinding.java index 81863f48f..9a505a7b0 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/RedirectBinding.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/RedirectBinding.java @@ -27,6 +27,7 @@ import javax.servlet.http.HttpServletResponse; import org.opensaml.common.SAMLObject; import org.opensaml.common.binding.BasicSAMLMessageContext; +import org.opensaml.common.binding.SAMLMessageContext; import org.opensaml.common.xml.SAMLConstants; import org.opensaml.saml2.binding.decoding.HTTPRedirectDeflateDecoder; import org.opensaml.saml2.binding.encoding.HTTPRedirectDeflateEncoder; @@ -51,6 +52,7 @@ import org.opensaml.xml.security.x509.X509Credential; import at.gv.egovernment.moa.id.config.ConfigurationException; import at.gv.egovernment.moa.id.protocols.pvp2x.PVP2XProtocol; +import at.gv.egovernment.moa.id.protocols.pvp2x.config.MOADefaultBootstrap; import at.gv.egovernment.moa.id.protocols.pvp2x.config.PVPConfiguration; import at.gv.egovernment.moa.id.protocols.pvp2x.messages.InboundMessage; import at.gv.egovernment.moa.id.protocols.pvp2x.messages.InboundMessageInterface; @@ -73,6 +75,9 @@ public class RedirectBinding implements IDecoder, IEncoder { X509Credential credentials = CredentialProvider .getIDPAssertionSigningCredential(); + //load default PVP security configurations + MOADefaultBootstrap.initializeDefaultPVPConfiguration(); + Logger.debug("create SAML RedirectBinding response"); HTTPRedirectDeflateEncoder encoder = new HTTPRedirectDeflateEncoder(); @@ -103,6 +108,9 @@ public class RedirectBinding implements IDecoder, IEncoder { X509Credential credentials = CredentialProvider .getIDPAssertionSigningCredential(); + //load default PVP security configurations + MOADefaultBootstrap.initializeDefaultPVPConfiguration(); + Logger.debug("create SAML RedirectBinding response"); HTTPRedirectDeflateEncoder encoder = new HTTPRedirectDeflateEncoder(); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java index a2583c706..fee508d33 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/binding/SoapBinding.java @@ -29,6 +29,7 @@ import javax.servlet.http.HttpServletResponse; import org.opensaml.common.SAMLObject; import org.opensaml.common.binding.BasicSAMLMessageContext; +import org.opensaml.common.binding.SAMLMessageContext; import org.opensaml.common.xml.SAMLConstants; import org.opensaml.saml2.binding.encoding.HTTPSOAP11Encoder; import org.opensaml.saml2.core.RequestAbstractType; @@ -48,6 +49,7 @@ import org.opensaml.xml.security.credential.Credential; import org.opensaml.xml.signature.SignableXMLObject; import at.gv.egovernment.moa.id.protocols.pvp2x.PVP2XProtocol; +import at.gv.egovernment.moa.id.protocols.pvp2x.config.MOADefaultBootstrap; import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.AttributQueryException; import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.BindingNotSupportedException; import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.PVP2Exception; @@ -130,6 +132,9 @@ public class SoapBinding implements IDecoder, IEncoder { Credential credentials = CredentialProvider .getIDPAssertionSigningCredential(); + //load default PVP security configurations + MOADefaultBootstrap.initializeDefaultPVPConfiguration(); + HTTPSOAP11Encoder encoder = new HTTPSOAP11Encoder(); HttpServletResponseAdapter responseAdapter = new HttpServletResponseAdapter( resp, true); diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/config/MOADefaultBootstrap.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/config/MOADefaultBootstrap.java index 80789cd12..b731e2a95 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/config/MOADefaultBootstrap.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/config/MOADefaultBootstrap.java @@ -50,7 +50,10 @@ public class MOADefaultBootstrap extends DefaultBootstrap { } - + public static void initializeDefaultPVPConfiguration() { + initializeGlobalSecurityConfiguration(); + + } /** * Initializes the default global security configuration. diff --git a/repository/iaik/iaik_eccelerate/2.51/iaik_eccelerate-2.51.jar b/repository/iaik/iaik_eccelerate/2.51/iaik_eccelerate-2.51.jar new file mode 100644 index 000000000..d53fcb398 Binary files /dev/null and b/repository/iaik/iaik_eccelerate/2.51/iaik_eccelerate-2.51.jar differ diff --git a/repository/iaik/iaik_eccelerate/2.51/iaik_eccelerate-2.51.pom b/repository/iaik/iaik_eccelerate/2.51/iaik_eccelerate-2.51.pom new file mode 100644 index 000000000..21a800dd7 --- /dev/null +++ b/repository/iaik/iaik_eccelerate/2.51/iaik_eccelerate-2.51.pom @@ -0,0 +1,8 @@ + + + 4.0.0 + iaik + iaik_eccelerate + 2.51 + POM was created by Sonatype Nexus + \ No newline at end of file -- cgit v1.2.3 From 78c50331e83269f25286e172fdfd4f8ae32c8633 Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Thu, 14 Jan 2016 09:28:59 +0100 Subject: fix problem with eIDAS QAA to STORK QAA mapping --- .../src/main/java/at/gv/egovernment/moa/id/util/PVPtoSTORKMapper.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'id/server/idserverlib/src') diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/PVPtoSTORKMapper.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/PVPtoSTORKMapper.java index d0da0003f..099a70470 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/PVPtoSTORKMapper.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/PVPtoSTORKMapper.java @@ -102,7 +102,7 @@ public class PVPtoSTORKMapper { public String mapeIDASQAAToSTORKQAA(String qaaLevel) { if (mapping != null) { String input = qaaLevel.substring(eIDAS_QAA_PREFIX.length()); - String mappedQAA = mapping.getProperty(MAPPING_EIDAS_PREFIX + input); + String mappedQAA = mapping.getProperty(input); if (MiscUtil.isNotEmpty(mappedQAA)) { Logger.info("Map eIDAS-QAA " + qaaLevel + " to STORK-QAA " + mappedQAA); return mappedQAA; -- cgit v1.2.3 From 135583cbc0b9041648ab24456d6cf7081705b814 Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Fri, 15 Jan 2016 13:48:58 +0100 Subject: add garbage collector to remove unsed SAML2 metadata provider (influence PVP and eIDAS metadata) --- .../moa/id/auth/MOAIDAuthInitializer.java | 5 +- .../moa/id/config/auth/AuthConfigLoader.java | 60 -------------- .../config/auth/IGarbageCollectorProcessing.java | 36 +++++++++ .../moa/id/config/auth/MOAGarbageCollector.java | 77 ++++++++++++++++++ .../pvp2x/metadata/MOAMetadataProvider.java | 22 ++++- .../moa/id/auth/modules/eidas/Constants.java | 3 +- .../engine/MOAeIDASChainingMetadataProvider.java | 94 ++++++++++++++++++++-- 7 files changed, 223 insertions(+), 74 deletions(-) delete mode 100644 id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfigLoader.java create mode 100644 id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/IGarbageCollectorProcessing.java create mode 100644 id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/MOAGarbageCollector.java (limited to 'id/server/idserverlib/src') diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthInitializer.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthInitializer.java index 953a478be..b3055eb34 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthInitializer.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/MOAIDAuthInitializer.java @@ -4,7 +4,6 @@ package at.gv.egovernment.moa.id.auth; import iaik.pki.PKIException; -import iaik.pki.jsse.IAIKX509TrustManager; import iaik.security.ecc.provider.ECCProvider; import iaik.security.provider.IAIK; @@ -17,9 +16,9 @@ import javax.net.ssl.SSLSocketFactory; import at.gv.egovernment.moa.id.config.ConfigurationException; import at.gv.egovernment.moa.id.config.ConnectionParameter; -import at.gv.egovernment.moa.id.config.auth.AuthConfigLoader; import at.gv.egovernment.moa.id.config.auth.AuthConfiguration; import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory; +import at.gv.egovernment.moa.id.config.auth.MOAGarbageCollector; import at.gv.egovernment.moa.id.util.AxisSecureSocketFactory; import at.gv.egovernment.moa.id.util.MOAIDMessageProvider; import at.gv.egovernment.moa.id.util.SSLUtils; @@ -184,7 +183,7 @@ public class MOAIDAuthInitializer { // Starts the session cleaner thread to remove unpicked authentication data AuthenticationSessionCleaner.start(); - AuthConfigLoader.start(); + MOAGarbageCollector.start(); } } diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfigLoader.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfigLoader.java deleted file mode 100644 index 1f43a0d8a..000000000 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/AuthConfigLoader.java +++ /dev/null @@ -1,60 +0,0 @@ -/******************************************************************************* - * Copyright 2014 Federal Chancellery Austria - * MOA-ID has been developed in a cooperation between BRZ, the Federal - * Chancellery Austria - ICT staff unit, and Graz University of Technology. - * - * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by - * the European Commission - subsequent versions of the EUPL (the "Licence"); - * You may not use this work except in compliance with the Licence. - * You may obtain a copy of the Licence at: - * http://www.osor.eu/eupl/ - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the Licence is distributed on an "AS IS" basis, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the Licence for the specific language governing permissions and - * limitations under the Licence. - * - * This product combines work with different licenses. See the "NOTICE" text - * file for details on the various modules and licenses. - * The "NOTICE" text file is part of the distribution. Any derivative works - * that you distribute must include a readable copy of the "NOTICE" text file. - *******************************************************************************/ -package at.gv.egovernment.moa.id.config.auth; - - -import at.gv.egovernment.moa.id.protocols.pvp2x.metadata.MOAMetadataProvider; -import at.gv.egovernment.moa.logging.Logger; - - -public class AuthConfigLoader implements Runnable { - - private static final long INTERVAL = 24 * 60 * 60; // 24 hours - - public void run() { - while (true) { - try { - Thread.sleep(INTERVAL * 1000); - Logger.trace("Check consistence of PVP2X metadata"); - MOAMetadataProvider.reInitialize(); - - - } catch (Throwable e) { - Logger.warn("MOA-ID Configuration validation is not possible, actually. Reuse old configuration.", e); - - } finally { - - - } - } - } - - public static void start() { - // start the session cleanup thread - Thread configLoader = new Thread(new AuthConfigLoader(), "ConfigurationChecker"); - configLoader.setName("ConfigurationChecker"); - configLoader.setDaemon(true); - configLoader.setPriority(Thread.MIN_PRIORITY); - configLoader.start(); - } -} diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/IGarbageCollectorProcessing.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/IGarbageCollectorProcessing.java new file mode 100644 index 000000000..a1008e883 --- /dev/null +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/IGarbageCollectorProcessing.java @@ -0,0 +1,36 @@ +/* + * Copyright 2014 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + */ +package at.gv.egovernment.moa.id.config.auth; + +/** + * @author tlenz + * + */ +public interface IGarbageCollectorProcessing { + + /** + * This method gets executed by the MOA garbage collector at regular intervals. + * + */ + public void runGarbageCollector(); +} diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/MOAGarbageCollector.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/MOAGarbageCollector.java new file mode 100644 index 000000000..1072bec5c --- /dev/null +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/config/auth/MOAGarbageCollector.java @@ -0,0 +1,77 @@ +/******************************************************************************* + * Copyright 2014 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + *******************************************************************************/ +package at.gv.egovernment.moa.id.config.auth; + + +import java.util.ArrayList; +import java.util.List; + +import at.gv.egovernment.moa.logging.Logger; + +public class MOAGarbageCollector implements Runnable { + + private static final long INTERVAL = 24 * 60 * 60; // 24 hours + private static final List processModules = + new ArrayList(); + + public void run() { + while (true) { + try { + Thread.sleep(INTERVAL * 1000); + + try { + for (IGarbageCollectorProcessing element : processModules) + element.runGarbageCollector(); + + } catch (Throwable e1) { + Logger.warn("Garbage collection FAILED in some module.", e1); + } + + } catch (Throwable e) { + Logger.warn("MOA-ID garbage collection is not possible, actually.", e); + + } finally { + + } + } + } + + /** + * Add a module to MOA internal garbage collector. Every module is executed once a day + * + * @param modul Module which should be executed by the garbage collector. + */ + public static void addModulForGarbageCollection(IGarbageCollectorProcessing modul) { + processModules.add(modul); + + } + + public static void start() { + // start the session cleanup thread + Thread configLoader = new Thread(new MOAGarbageCollector(), "MOAGarbageCollector"); + configLoader.setName("MOAGarbageCollectorr"); + configLoader.setDaemon(true); + configLoader.setPriority(Thread.MIN_PRIORITY); + configLoader.start(); + } +} diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java index f4c099878..03fa686f9 100644 --- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/metadata/MOAMetadataProvider.java @@ -55,6 +55,8 @@ import at.gv.egovernment.moa.id.commons.utils.MOAHttpProtocolSocketFactory; import at.gv.egovernment.moa.id.config.ConfigurationException; import at.gv.egovernment.moa.id.config.auth.AuthConfiguration; import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory; +import at.gv.egovernment.moa.id.config.auth.IGarbageCollectorProcessing; +import at.gv.egovernment.moa.id.config.auth.MOAGarbageCollector; import at.gv.egovernment.moa.id.config.auth.OAAuthParameter; import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants; import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.filter.SchemaValidationException; @@ -66,7 +68,7 @@ import at.gv.egovernment.moa.logging.Logger; import at.gv.egovernment.moa.util.Base64Utils; import at.gv.egovernment.moa.util.MiscUtil; -public class MOAMetadataProvider implements ObservableMetadataProvider{ +public class MOAMetadataProvider implements ObservableMetadataProvider, IGarbageCollectorProcessing { private static MOAMetadataProvider instance = null; private static Object mutex = new Object(); @@ -77,18 +79,32 @@ public class MOAMetadataProvider implements ObservableMetadataProvider{ synchronized (mutex) { if (instance == null) { instance = new MOAMetadataProvider(); + + //add this to MOA garbage collector + MOAGarbageCollector.addModulForGarbageCollection(instance); + } } } return instance; } - public static void reInitialize() { + /* (non-Javadoc) + * @see at.gv.egovernment.moa.id.config.auth.IGarbageCollectorProcessing#runGarbageCollector() + */ + @Override + public void runGarbageCollector() { + reInitialize(); + + } + + private static void reInitialize() { synchronized (mutex) { /**add new Metadataprovider or remove Metadataprovider which are not in use any more.**/ if (instance != null) - try { + try { + Logger.trace("Check consistence of PVP2X metadata"); instance.addAndRemoveMetadataProvider(); } catch (ConfigurationException e) { diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/Constants.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/Constants.java index 1d4556459..5166f090d 100644 --- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/Constants.java +++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/Constants.java @@ -57,7 +57,8 @@ public class Constants { //timeouts and clock skews public static final long CONFIG_PROPS_SKEWTIME = 2 * 60 * 1000; //2 minutes skew time for response validation public static final int CONFIG_PROPS_METADATA_SOCKED_TIMEOUT = 20 * 1000; //20 seconds metadata socked timeout - + public static final long CONFIG_PROPS_METADATA_GARBAGE_TIMEOUT = 7 * 24 * 60 * 60 * 1000; //remove unused eIDAS metadata after 7 days + //eIDAS attribute names public static final String eIDAS_ATTR_PERSONALIDENTIFIER = "PersonIdentifier"; public static final String eIDAS_ATTR_DATEOFBIRTH = "DateOfBirth"; diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASChainingMetadataProvider.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASChainingMetadataProvider.java index f1b14015b..965abcde1 100644 --- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASChainingMetadataProvider.java +++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/engine/MOAeIDASChainingMetadataProvider.java @@ -1,9 +1,12 @@ package at.gv.egovernment.moa.id.auth.modules.eidas.engine; import java.util.ArrayList; +import java.util.Date; import java.util.HashMap; +import java.util.Iterator; import java.util.List; import java.util.Map; +import java.util.Map.Entry; import java.util.Timer; import javax.net.ssl.SSLHandshakeException; @@ -27,7 +30,8 @@ import at.gv.egovernment.moa.id.commons.ex.MOAHttpProtocolSocketFactoryException import at.gv.egovernment.moa.id.commons.utils.MOAHttpProtocolSocketFactory; import at.gv.egovernment.moa.id.config.auth.AuthConfiguration; import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory; -import at.gv.egovernment.moa.id.protocols.pvp2x.PVPConstants; +import at.gv.egovernment.moa.id.config.auth.IGarbageCollectorProcessing; +import at.gv.egovernment.moa.id.config.auth.MOAGarbageCollector; import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.filter.SchemaValidationException; import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.filter.SignatureValidationException; import at.gv.egovernment.moa.id.saml2.MetadataFilterChain; @@ -35,12 +39,13 @@ import at.gv.egovernment.moa.logging.Logger; import at.gv.egovernment.moa.util.MiscUtil; import eu.eidas.auth.engine.AbstractSAMLEngine; -public class MOAeIDASChainingMetadataProvider implements ObservableMetadataProvider { +public class MOAeIDASChainingMetadataProvider implements ObservableMetadataProvider, IGarbageCollectorProcessing { private static MOAeIDASChainingMetadataProvider instance = null; private static Object mutex = new Object(); private MetadataProvider internalProvider; + private Map lastAccess = null; public static MOAeIDASChainingMetadataProvider getInstance() { @@ -48,6 +53,7 @@ public class MOAeIDASChainingMetadataProvider implements ObservableMetadataProvi synchronized (mutex) { if (instance == null) { instance = new MOAeIDASChainingMetadataProvider(); + MOAGarbageCollector.addModulForGarbageCollection(instance); } } } @@ -57,9 +63,79 @@ public class MOAeIDASChainingMetadataProvider implements ObservableMetadataProvi private MOAeIDASChainingMetadataProvider() { internalProvider = new ChainingMetadataProvider(); + lastAccess = new HashMap(); } - + + /* (non-Javadoc) + * @see at.gv.egovernment.moa.id.config.auth.IGarbageCollectorProcessing#runGarbageCollector() + */ + @Override + public void runGarbageCollector() { + if (!lastAccess.isEmpty()) { + Date now = new Date(); + Date expioredate = new Date(now.getTime() - + Constants.CONFIG_PROPS_METADATA_GARBAGE_TIMEOUT); + Logger.debug("Starting eIDAS Metadata garbag collection (Expioredate:" + + expioredate + ")"); + + List expiredEntities = new ArrayList(); + + Iterator> lastAccessInterator = lastAccess.entrySet().iterator(); + while(lastAccessInterator.hasNext()) { + Entry element = lastAccessInterator.next(); + if (element.getValue().before(expioredate)) { + Logger.debug("Remove unused eIDAS Metadate: " + element.getKey()); + expiredEntities.add(element.getKey()); + + } + } + + if (!expiredEntities.isEmpty()) { + ChainingMetadataProvider chainProvider = (ChainingMetadataProvider) internalProvider; + + //get all actually loaded metadata providers + Map loadedproviders = getAllActuallyLoadedProviders(); + + for (String expired : expiredEntities) { + if (loadedproviders.containsKey(expired)) { + HTTPMetadataProvider provider = loadedproviders.get(expired); + + //destroy metadata provider + provider.destroy(); + + //remove from map + loadedproviders.remove(expired); + + /*OpenSAML ChainingMetadataProvider can not remove a MetadataProvider (UnsupportedOperationException) + *The ChainingMetadataProvider use internal a unmodifiableList to hold all registrated MetadataProviders.*/ + //chainProvider.removeMetadataProvider(provider); + Logger.info("Remove not used eIDAS MetadataProvider " + expired + + " after timeout."); + + } else + Logger.warn("eIDAS metadata for EntityID: " + expired + + " is marked as unsed, but no loaded metadata provider is found."); + + } + + try { + synchronized (chainProvider) { + chainProvider.setProviders(new ArrayList(loadedproviders.values())); + + emitChangeEvent(); + } + + } catch (MetadataProviderException e) { + Logger.warn("ReInitalize eIDASA MetaDataProvider is not possible! MOA-ID Instance has to be restarted manualy", e); + + } + } + } + } + + + private HTTPMetadataProvider createNewHTTPMetaDataProvider(String metadataURL) { HTTPMetadataProvider httpProvider = null; Timer timer= null; @@ -177,7 +253,7 @@ public class MOAeIDASChainingMetadataProvider implements ObservableMetadataProvi } else { //load new Metadata Provider ChainingMetadataProvider chainProvider = (ChainingMetadataProvider) internalProvider; - HTTPMetadataProvider newMetadataProvider = createNewHTTPMetaDataProvider(metadataURL); + HTTPMetadataProvider newMetadataProvider = createNewHTTPMetaDataProvider(metadataURL); chainProvider.addMetadataProvider(newMetadataProvider); emitChangeEvent(); @@ -238,12 +314,12 @@ public class MOAeIDASChainingMetadataProvider implements ObservableMetadataProvi Logger.debug("Can not find eIDAS metadata for entityID: " + entityID + " Start refreshing process ..."); if (refreshMetadataProvider(entityID)) - return internalProvider.getEntityDescriptor(entityID); + entityDesc = internalProvider.getEntityDescriptor(entityID); } else { if (!entityDesc.isValid()) if (refreshMetadataProvider(entityID)) - return internalProvider.getEntityDescriptor(entityID); + entityDesc = internalProvider.getEntityDescriptor(entityID); } @@ -252,10 +328,13 @@ public class MOAeIDASChainingMetadataProvider implements ObservableMetadataProvi Logger.debug("Can not find eIDAS metadata for entityID: " + entityID + " Start refreshing process ..."); if (refreshMetadataProvider(entityID)) - return internalProvider.getEntityDescriptor(entityID); + entityDesc = internalProvider.getEntityDescriptor(entityID); } + if (entityDesc != null) + lastAccess.put(entityID, new Date()); + return entityDesc; } @@ -287,4 +366,5 @@ public class MOAeIDASChainingMetadataProvider implements ObservableMetadataProvi if (observer != null) observer.onEvent(this); } + } -- cgit v1.2.3