From 7cba2dfc31076ac4ec9f4a46bc4901e7dd082121 Mon Sep 17 00:00:00 2001
From: Thomas Lenz <thomas.lenz@egiz.gv.at>
Date: Tue, 21 Nov 2017 12:43:57 +0100
Subject: add eIDAS request validation regarding minimum data-set and SPType

---
 .../moa/id/protocols/eidas/EIDASProtocol.java      | 47 +++++++++++++++-------
 1 file changed, 33 insertions(+), 14 deletions(-)

(limited to 'id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols')

diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASProtocol.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASProtocol.java
index 1ce900ebb..8fb81082f 100644
--- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASProtocol.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/protocols/eidas/EIDASProtocol.java
@@ -24,6 +24,7 @@ package at.gv.egovernment.moa.id.protocols.eidas;
 
 import java.io.IOException;
 import java.io.StringWriter;
+import java.net.URI;
 import java.util.List;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -62,6 +63,7 @@ import at.gv.egovernment.moa.id.protocols.AbstractAuthProtocolModulController;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.util.MiscUtil;
 import eu.eidas.auth.commons.EidasStringUtil;
+import eu.eidas.auth.commons.attribute.ImmutableAttributeMap;
 import eu.eidas.auth.commons.protocol.IAuthenticationRequest;
 import eu.eidas.auth.commons.protocol.IResponseMessage;
 import eu.eidas.auth.commons.protocol.eidas.IEidasAuthenticationRequest;
@@ -302,7 +304,37 @@ public class EIDASProtocol extends AbstractAuthProtocolModulController {
 				
 			}
 			
-						
+			//validate service-provider type from eIDAS request
+			String spType = null;
+			if (eIDASSamlReq.getSpType() != null)
+				spType = eIDASSamlReq.getSpType();
+				
+			if (MiscUtil.isEmpty(spType))
+				spType = MetadataUtil.getSPTypeFromMetadata(eIDASNodeEntityDesc);
+							
+			if (MiscUtil.isNotEmpty(spType))
+				Logger.debug("eIDAS request has SPType:" + spType);			
+			else {
+				Logger.warn("eIDAS request and eIDAS metadata contains NO 'SPType' element.");
+				throw new EIDASAuthnRequestProcessingException("eIDAS.06", 
+						new Object[]{"eIDAS request and eIDAS metadata contains NO 'SPType' element."});
+				
+			}
+				
+			//validate if minimal data-set if it is not fully requested
+			//TODO: must be tested!!!!
+			ImmutableAttributeMap reqAttrList = eIDASSamlReq.getRequestedAttributes();
+			for (URI el : Constants.NATURALPERSONMINIMUMDATASETLIST) {
+				if(reqAttrList.getAttributeValuesByNameUri(el) == null) {
+					Logger.warn("Minimum data-set attribute: " + el + " is not requested.");
+					throw new EIDASAuthnRequestProcessingException("eIDAS.06", 
+							new Object[]{"eIDAS request does not contain all attributes of minimum data-set for natural person"});
+					
+				}
+			}
+			
+			
+			
 			//*************************************************
 			//*****  store eIDAS request information  *********
 			//*************************************************
@@ -335,19 +367,6 @@ public class EIDASProtocol extends AbstractAuthProtocolModulController {
 	
 			// - memorize OA config
 			pendingReq.setOnlineApplicationConfiguration(oaConfig);
-			
-			// - memorize service-provider type from eIDAS request
-			String spType = null;
-			if (eIDASSamlReq.getSpType() != null)
-				spType = eIDASSamlReq.getSpType();
-				
-			if (MiscUtil.isEmpty(spType))
-				spType = MetadataUtil.getSPTypeFromMetadata(eIDASNodeEntityDesc);
-							
-			if (MiscUtil.isNotEmpty(spType))
-				Logger.debug("eIDAS request has SPType:" + spType);			
-			else
-				Logger.info("eIDAS request and eIDAS metadata contains NO 'SPType' element.");
 					
 		} catch (MOAIDException e) {
 			Logger.info("eIDAS AuthnRequest preProcessing FAILED. Msg:" + e.getMessage());
-- 
cgit v1.2.3