From 77cf01db81c74ebbe0e0d2da58e22c5f7c861ab5 Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Fri, 24 Oct 2014 13:48:32 +0200 Subject: add new classes for Role management --- .../conf/moa-spss/SampleMOASPSSConfiguration.xml | 2 +- .../handbook/interfederation/interfederation.html | 12 +++ id/server/doc/handbook/protocol/protocol.html | 8 ++ id/server/idserverlib/pom.xml | 4 + .../moa/id/data/AuthenticationRole.java | 110 +++++++++++++++++++++ .../moa/id/data/AuthenticationRoleFactory.java | 76 ++++++++++++++ 6 files changed, 211 insertions(+), 1 deletion(-) create mode 100644 id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationRole.java create mode 100644 id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationRoleFactory.java (limited to 'id/server') diff --git a/id/server/data/deploy/conf/moa-spss/SampleMOASPSSConfiguration.xml b/id/server/data/deploy/conf/moa-spss/SampleMOASPSSConfiguration.xml index 9759f1ac5..8d26a1893 100644 --- a/id/server/data/deploy/conf/moa-spss/SampleMOASPSSConfiguration.xml +++ b/id/server/data/deploy/conf/moa-spss/SampleMOASPSSConfiguration.xml @@ -79,7 +79,7 @@ - + MOAIDTransformAuthBlockTable_DE_2.0 profiles/MOAIDTransformAuthBlockTable_DE_2.0.xml diff --git a/id/server/doc/handbook/interfederation/interfederation.html b/id/server/doc/handbook/interfederation/interfederation.html index bd97061ab..f0aaf8776 100644 --- a/id/server/doc/handbook/interfederation/interfederation.html +++ b/id/server/doc/handbook/interfederation/interfederation.html @@ -152,6 +152,18 @@   Wenn eingehende SSO Intefederation erlaubt ist besteht zusätzlich die Möglichkeit diesen einmal verwendeten IDP an die Benutzersession zu binden. In diesem Fall können weitere SSO Authentifizierungen über diesen interfederation IDP auch ohne Angabe des IDP Identifiers (siehe Sequenzdiagramm oder Integration in bestehende Systeme) durchgeführt werden. + + Verwende SAML2 isPassive Attribut +   +   + Dieser Parameter kann das isPassive Attribut des SAML2 Authentifizierungsrequests an diesen IDP konfiguriert werden. Wird dieses Attribut gesetzt erfolgt an diesem IDP keine Authentifzierung wenn keine aktive SSO Session vorhanden ist. + + + Im Fehlerfall Authentifizierung lokal durchführen +   +   + Dieser Parameter definert das Verhalten für den Fall dass an diesem IDP keine Authentifizierung möglich war. Bei ausgewähltem Parameter wird im Fehlerfall die Authentifizerung an der lokalen IDP Instanz wiederholt. + AttributQuery Service URL https://demo.egiz.gv.at/moa-id-auth/pvp2/attributequery diff --git a/id/server/doc/handbook/protocol/protocol.html b/id/server/doc/handbook/protocol/protocol.html index e7658875c..c2dcddd03 100644 --- a/id/server/doc/handbook/protocol/protocol.html +++ b/id/server/doc/handbook/protocol/protocol.html @@ -700,6 +700,10 @@ Redirect Binding 4400 Fehler beim Generieren der Anmeldedaten + + 4401 + Die Anmeldung am federierten IDP ist fehlgeschlagen. +

1.3.3 Statuscodes 6xxxx

Alles Statuscodes beginnend mit der Zahl sechs beschreiben protokollspezifische Fehler die nicht durch das jeweilige Authentifizierungsprotokoll abgebildet werden.

@@ -811,6 +815,10 @@ Redirect Binding 9007 Der SZR-Gateway Client konnte nicht initialisiert werden. + + 9008 + Fehlerhafte Interfederation Konfiguration +

1.3.4.2 Interne Fehler (91xxx)

diff --git a/id/server/idserverlib/pom.xml b/id/server/idserverlib/pom.xml index 833f869e5..872ca3916 100644 --- a/id/server/idserverlib/pom.xml +++ b/id/server/idserverlib/pom.xml @@ -257,6 +257,10 @@ org.slf4jlog4j-over-slf4j + + bcprov-jdk15on + org.bouncycastle + diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationRole.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationRole.java new file mode 100644 index 000000000..91514ca62 --- /dev/null +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationRole.java @@ -0,0 +1,110 @@ +/* + * Copyright 2014 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + */ +package at.gv.egovernment.moa.id.data; + +import java.util.ArrayList; +import java.util.Iterator; +import java.util.List; +import java.util.Map; + +/** + * @author tlenz + * + */ +public class AuthenticationRole { + + private String roleName = null; + private List> params = null; + + public AuthenticationRole(String roleName) { + this.roleName = roleName; + } + + public void addParameter(String key, String value) { + if (params == null) + params = new ArrayList>(); + params.add(new Entry(key, value)); + + } + + /** + * @return the roleName + */ + public String getRoleName() { + return roleName; + } + + /** + * @return the params + */ + public List> getParams() { + return params; + } + + /** + * @return the params + */ + public Iterator> getParamsInterator() { + return params.iterator(); + } + + static class Entry implements Map.Entry { + + private K key; + private V value; + + Entry(K k, V v) { + key = k; + value = v; + } + + /* (non-Javadoc) + * @see java.util.Map.Entry#getKey() + */ + @Override + public K getKey() { + return key; + } + + /* (non-Javadoc) + * @see java.util.Map.Entry#getValue() + */ + @Override + public V getValue() { + return value; + } + + /* (non-Javadoc) + * @see java.util.Map.Entry#setValue(java.lang.Object) + */ + @Override + public V setValue(V newValue) { + V oldValue = value; + value = newValue; + return oldValue; + } + + + } + +} diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationRoleFactory.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationRoleFactory.java new file mode 100644 index 000000000..7d4dc6eff --- /dev/null +++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/data/AuthenticationRoleFactory.java @@ -0,0 +1,76 @@ +/* + * Copyright 2014 Federal Chancellery Austria + * MOA-ID has been developed in a cooperation between BRZ, the Federal + * Chancellery Austria - ICT staff unit, and Graz University of Technology. + * + * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by + * the European Commission - subsequent versions of the EUPL (the "Licence"); + * You may not use this work except in compliance with the Licence. + * You may obtain a copy of the Licence at: + * http://www.osor.eu/eupl/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the Licence is distributed on an "AS IS" basis, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the Licence for the specific language governing permissions and + * limitations under the Licence. + * + * This product combines work with different licenses. See the "NOTICE" text + * file for details on the various modules and licenses. + * The "NOTICE" text file is part of the distribution. Any derivative works + * that you distribute must include a readable copy of the "NOTICE" text file. + */ +package at.gv.egovernment.moa.id.data; + +import java.util.Arrays; +import java.util.List; + +import at.gv.egovernment.moa.logging.Logger; + +/** + * @author tlenz + * + */ +public class AuthenticationRoleFactory { + + public static AuthenticationRole buildFormPVPole(String pvprole) { + AuthenticationRole role = null; + + int first = pvprole.indexOf("("); + + if (first < 0) { + //no role paramters found + role = new AuthenticationRole(pvprole.trim()); + Logger.debug("Add authentication role with name=" + pvprole.trim()); + + } else { + role = new AuthenticationRole(pvprole.substring(0, first).trim()); + Logger.debug("Add authentication role with name=" + pvprole.substring(0, first).trim()); + String params = pvprole.substring(first + 1, pvprole.length() - 1); + + List param = Arrays.asList(params.split(",")); + String test = new String(); + for (String el : param) { + test = test.concat(el); + if (!test.endsWith("\\") || + (test.endsWith("\\\\") && !test.endsWith("\\\\\\")) ) { + String[] keyValue = test.split("="); + if (keyValue.length < 2) { + role.addParameter(keyValue[0].trim(), ""); + Logger.debug("Add authentication roleparameter with key=" + keyValue[0].trim()); + + } else { + role.addParameter(keyValue[0].trim(), keyValue[1].trim()); + Logger.debug("Add authentication roleparameter with key=" + keyValue[0].trim() + + " value=" + keyValue[1].trim()); + + } + + test = new String(); + } + } + } + + return role; + } +} -- cgit v1.2.3