From c61850c5607d066a3c322794c1220f26b31103a0 Mon Sep 17 00:00:00 2001
From: Thomas Lenz <tlenz@iaik.tugraz.at>
Date: Wed, 16 May 2018 09:29:09 +0200
Subject: add initial version of Security-Layer 2.0 Authentication module

---
 ...iz.components.spring.api.SpringResourceProvider |  1 +
 .../src/main/resources/moaid_sl20_auth.beans.xml   | 33 ++++++++++++++++++++++
 .../main/resources/sl20.Authentication.process.xml | 20 +++++++++++++
 3 files changed, 54 insertions(+)
 create mode 100644 id/server/modules/moa-id-module-sl20_authentication/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider
 create mode 100644 id/server/modules/moa-id-module-sl20_authentication/src/main/resources/moaid_sl20_auth.beans.xml
 create mode 100644 id/server/modules/moa-id-module-sl20_authentication/src/main/resources/sl20.Authentication.process.xml

(limited to 'id/server/modules/moa-id-module-sl20_authentication/src/main/resources')

diff --git a/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider b/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider
new file mode 100644
index 000000000..48a3d2450
--- /dev/null
+++ b/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/META-INF/services/at.gv.egiz.components.spring.api.SpringResourceProvider
@@ -0,0 +1 @@
+at.gv.egovernment.moa.id.auth.modules.sl20_auth.SL20AuthenticationSpringResourceProvider
\ No newline at end of file
diff --git a/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/moaid_sl20_auth.beans.xml b/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/moaid_sl20_auth.beans.xml
new file mode 100644
index 000000000..37551b3f5
--- /dev/null
+++ b/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/moaid_sl20_auth.beans.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:context="http://www.springframework.org/schema/context"
+	xmlns:tx="http://www.springframework.org/schema/tx"
+	xmlns:aop="http://www.springframework.org/schema/aop"
+	xsi:schemaLocation="http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.1.xsd
+		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd
+		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd">
+
+	<context:annotation-config />
+
+	<bean id="sl20AuthModule" class="at.gv.egovernment.moa.id.auth.modules.sl20_auth.SL20AuthenticationModulImpl">
+		<property name="priority" value="3" />
+	</bean>
+ 
+	<bean id="SL20SignalServlet"
+				class="at.gv.egovernment.moa.id.auth.modules.sl20_auth.SL20SignalServlet"/>
+
+	<bean id="firstJOSETests"
+				class="at.gv.egovernment.moa.id.auth.modules.sl20_auth.sl20.JsonSecurityUtils"/>							
+							
+<!-- Authentication Process Tasks --> 
+	<bean id="CreateQualeIDRequestTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.sl20_auth.tasks.CreateQualeIDRequestTask"
+				scope="prototype"/>
+	
+	<bean id="ReceiveQualeIDResponseTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.sl20_auth.tasks.ReceiveQualeIDTask"
+				scope="prototype"/>
+																						
+</beans>
\ No newline at end of file
diff --git a/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/sl20.Authentication.process.xml b/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/sl20.Authentication.process.xml
new file mode 100644
index 000000000..bcd74f84c
--- /dev/null
+++ b/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/sl20.Authentication.process.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<pd:ProcessDefinition id="SL20Authentication" xmlns:pd="http://reference.e-government.gv.at/namespace/moa/process/definition/v1">
+
+	<pd:Task id="createQualifiedeIDRequest" class="CreateQualeIDRequestTask" />
+	<pd:Task id="receiveQualifiedeID" class="ReceiveQualeIDResponseTask"  async="true"/>
+	
+	<!-- <pd:Task id="finalizeAuthentication" class="FinalizeAuthenticationTask" /> -->
+
+	<pd:StartEvent id="start" />
+	<pd:Transition from="start" to="createQualifiedeIDRequest" />	
+	<pd:Transition from="createQualifiedeIDRequest" to="receiveQualifiedeID" />
+	<pd:Transition from="receiveQualifiedeID" to="end" />
+
+	<!-- It's only required if we can not use the finalize redirect on SL20 redirect command -->
+	<!-- <pd:Transition from="receiveQualifiedeID" to="finalizeAuthentication" />		
+	<pd:Transition from="finalizeAuthentication"    to="end" />	 -->
+	
+	<pd:EndEvent id="end" />
+
+</pd:ProcessDefinition>
-- 
cgit v1.2.3


From ecf9de84e76dde785ced8c1632c7909d1d57f94a Mon Sep 17 00:00:00 2001
From: Thomas Lenz <tlenz@iaik.tugraz.at>
Date: Wed, 30 May 2018 14:36:39 +0200
Subject: add error handling and some more validation to SL2.0 module

---
 .../src/main/resources/moaid_sl20_auth.beans.xml           |  4 ++++
 .../src/main/resources/sl20.Authentication.process.xml     | 14 ++++++--------
 2 files changed, 10 insertions(+), 8 deletions(-)

(limited to 'id/server/modules/moa-id-module-sl20_authentication/src/main/resources')

diff --git a/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/moaid_sl20_auth.beans.xml b/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/moaid_sl20_auth.beans.xml
index 37551b3f5..a9c9bac8e 100644
--- a/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/moaid_sl20_auth.beans.xml
+++ b/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/moaid_sl20_auth.beans.xml
@@ -29,5 +29,9 @@
 	<bean id="ReceiveQualeIDResponseTask" 
 				class="at.gv.egovernment.moa.id.auth.modules.sl20_auth.tasks.ReceiveQualeIDTask"
 				scope="prototype"/>
+				
+	<bean id="VerifyQualifiedeIDTask" 
+				class="at.gv.egovernment.moa.id.auth.modules.sl20_auth.tasks.VerifyQualifiedeIDTask"
+				scope="prototype"/>				
 																						
 </beans>
\ No newline at end of file
diff --git a/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/sl20.Authentication.process.xml b/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/sl20.Authentication.process.xml
index bcd74f84c..4975dc2d7 100644
--- a/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/sl20.Authentication.process.xml
+++ b/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/sl20.Authentication.process.xml
@@ -3,17 +3,15 @@
 
 	<pd:Task id="createQualifiedeIDRequest" class="CreateQualeIDRequestTask" />
 	<pd:Task id="receiveQualifiedeID" class="ReceiveQualeIDResponseTask"  async="true"/>
-	
-	<!-- <pd:Task id="finalizeAuthentication" class="FinalizeAuthenticationTask" /> -->
+	<pd:Task id="verifyQualifiedeIDTask" class="VerifyQualifiedeIDTask" async="true"/>	
+	<pd:Task id="finalizeAuthentication" class="FinalizeAuthenticationTask" />
 
 	<pd:StartEvent id="start" />
 	<pd:Transition from="start" to="createQualifiedeIDRequest" />	
-	<pd:Transition from="createQualifiedeIDRequest" to="receiveQualifiedeID" />
-	<pd:Transition from="receiveQualifiedeID" to="end" />
-
-	<!-- It's only required if we can not use the finalize redirect on SL20 redirect command -->
-	<!-- <pd:Transition from="receiveQualifiedeID" to="finalizeAuthentication" />		
-	<pd:Transition from="finalizeAuthentication"    to="end" />	 -->
+	<pd:Transition from="createQualifiedeIDRequest" to="receiveQualifiedeID" />	
+	<pd:Transition from="receiveQualifiedeID" to="verifyQualifiedeIDTask" />
+	<pd:Transition from="verifyQualifiedeIDTask" to="finalizeAuthentication" />			
+	<pd:Transition from="finalizeAuthentication"    to="end" />
 	
 	<pd:EndEvent id="end" />
 
-- 
cgit v1.2.3


From 709197ce12c5502f86e16da1167b97ca318f47fa Mon Sep 17 00:00:00 2001
From: Thomas Lenz <tlenz@iaik.tugraz.at>
Date: Tue, 5 Jun 2018 10:44:40 +0200
Subject: implement user restriction based on whitelisting

---
 .../src/main/resources/sl20.Authentication.process.xml            | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

(limited to 'id/server/modules/moa-id-module-sl20_authentication/src/main/resources')

diff --git a/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/sl20.Authentication.process.xml b/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/sl20.Authentication.process.xml
index 4975dc2d7..673144b06 100644
--- a/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/sl20.Authentication.process.xml
+++ b/id/server/modules/moa-id-module-sl20_authentication/src/main/resources/sl20.Authentication.process.xml
@@ -3,16 +3,20 @@
 
 	<pd:Task id="createQualifiedeIDRequest" class="CreateQualeIDRequestTask" />
 	<pd:Task id="receiveQualifiedeID" class="ReceiveQualeIDResponseTask"  async="true"/>
-	<pd:Task id="verifyQualifiedeIDTask" class="VerifyQualifiedeIDTask" async="true"/>	
+	<pd:Task id="verifyQualifiedeIDTask" class="VerifyQualifiedeIDTask" async="true"/>
+	<pd:Task id="userRestrictionTask" class="UserRestrictionTask" />	
 	<pd:Task id="finalizeAuthentication" class="FinalizeAuthenticationTask" />
 
 	<pd:StartEvent id="start" />
 	<pd:Transition from="start" to="createQualifiedeIDRequest" />	
 	<pd:Transition from="createQualifiedeIDRequest" to="receiveQualifiedeID" />	
 	<pd:Transition from="receiveQualifiedeID" to="verifyQualifiedeIDTask" />
-	<pd:Transition from="verifyQualifiedeIDTask" to="finalizeAuthentication" />			
+	<pd:Transition from="verifyQualifiedeIDTask" to="userRestrictionTask" />			
+	<pd:Transition from="userRestrictionTask" to="finalizeAuthentication" />
 	<pd:Transition from="finalizeAuthentication"    to="end" />
 	
+	
+	
 	<pd:EndEvent id="end" />
 
 </pd:ProcessDefinition>
-- 
cgit v1.2.3