From 1ad814ccbbe4f65f430ac738104e3f3c8256c229 Mon Sep 17 00:00:00 2001 From: Klaus Stranacher Date: Tue, 16 Apr 2013 14:44:08 +0200 Subject: Update digest algorithm, XAdES version, whitelisting --- .../server/config/ConfigurationPartsBuilder.java | 103 +++++++++++++- .../spss/server/config/ConfigurationProvider.java | 35 ++++- .../moa/spss/server/config/KeyGroup.java | 16 ++- .../xmlsign/XMLSignatureCreationProfileImpl.java | 156 +++++++++++++++++---- .../invoke/XMLSignatureCreationProfileFactory.java | 89 ++++++++++-- .../moa/spss/util/ExternalURIVerifier.java | 45 +++++- 6 files changed, 390 insertions(+), 54 deletions(-) (limited to 'spss/server/serverlib/src/main/java/at') diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java index 09f496c74..e335139aa 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java @@ -101,6 +101,10 @@ public class ConfigurationPartsBuilder { ROOT + CONF + "SignatureCreation/" + CONF + "XMLDSig/" + CONF + "DigestMethodAlgorithm"; + private static final String XADES_VERSION_XPATH = + ROOT + CONF + "SignatureCreation/" + + CONF + "XAdES/" + + CONF + "Version"; private static final String C14N_ALGORITHM_XPATH = ROOT + CONF + "SignatureCreation/" + CONF + "XMLDSig/" @@ -115,6 +119,13 @@ public class ConfigurationPartsBuilder { ROOT + CONF + "Common/" + CONF + "PermitExternalUris/" + CONF + "BlackListUri"; + private static final String FORBID_EXTERNAL_URIS_XPATH = + ROOT + CONF + "Common/" + + CONF + "ForbidExternalUris"; + private static final String WHITE_LIST_URIS_XPATH = + ROOT + CONF + "Common/" + + CONF + "ForbidExternalUris/" + + CONF + "WhiteListUri"; private static final String HARDWARE_KEY_XPATH = ROOT + CONF + "SignatureCreation/" @@ -263,15 +274,19 @@ public class ConfigurationPartsBuilder { /** The accepted digest method algorithm URIs, as an array */ private static final String[] ACCEPTED_DIGEST_ALGORITHMS_ARRAY = - { Constants.SHA1_URI }; + { Constants.SHA1_URI, + Constants.SHA256_URI, + Constants.SHA384_URI, + Constants.SHA512_URI}; /** The accepted digest method algorithm URIs, as a Set */ private static final Set ACCEPTED_DIGEST_ALGORITHMS = new HashSet(Arrays.asList(ACCEPTED_DIGEST_ALGORITHMS_ARRAY)); - + + /** Default digest algorithm URI, if none/illegal has been configured */ private static final String DIGEST_ALGORITHM_DEFAULT = Constants.SHA1_URI; - + /** The root element of the MOA configuration */ private Element configElem; @@ -333,7 +348,7 @@ public class ConfigurationPartsBuilder { public String getDigestMethodAlgorithmName() { String digestMethod = getElementValue(getConfigElem(), DIGEST_METHOD_XPATH, null); - + if (digestMethod == null || !ACCEPTED_DIGEST_ALGORITHMS.contains(digestMethod)) { info( @@ -344,7 +359,20 @@ public class ConfigurationPartsBuilder { return digestMethod; } - + + /** + * Returns the digest method algorithm name. + * + * @return The digest method algorithm name from the configuration. + */ + public String getXAdESVersion() + { + String xadesVersion = getElementValue(getConfigElem(), XADES_VERSION_XPATH, null); + + return xadesVersion; + } + + /** * Returns the canonicalization algorithm name. * @@ -409,6 +437,7 @@ public class ConfigurationPartsBuilder { } } + /** * * @return @@ -448,10 +477,12 @@ public class ConfigurationPartsBuilder { array[1] = port; blacklist.add(array); - } + } + // set blacklist for iaik-moa ExternalReferenceChecker.setBlacklist(blackListIaikMoa); + if(blacklist.isEmpty()) // no blacklisted uris given info("config.36", null); @@ -459,7 +490,64 @@ public class ConfigurationPartsBuilder { return blacklist; } + + /** + * + * @return + */ + public List buildForbidExternalUris() { + + //info("config.47", null); + + List whitelist = new ArrayList(); + List whiteListIaikMoa = new ArrayList(); + + NodeIterator forbidExtIter = XPathUtils.selectNodeIterator( + getConfigElem(), + WHITE_LIST_URIS_XPATH); + + Element permitExtElem = null; + while ((permitExtElem = (Element) forbidExtIter.nextNode()) != null) { + String host = getElementValue(permitExtElem, CONF + "IP", null); + String port = getElementValue(permitExtElem, CONF + "Port", null); + + // TODO WhiteListeEntry +// WhiteListEntry entry =null; + if (port == null) { +// entry = new WhiteListEntry(host, -1); + info("config.49", new Object[]{host}); + } + else { +// entry = new WhiteListEntry(host, new Integer(port).intValue()); + info("config.49", new Object[]{host + ":" + port}); + } +// +// // add entry to iaik-moa whitelist +// whiteListIaikMoa.add(entry); + + + String array[] = new String[2]; + array[0] = host; + array[1] = port; + whitelist.add(array); + + } + + + // set whitelist for iaik-moa + // TODO +// ExternalReferenceChecker.setWhitelist(whiteListIaikMoa); + + + if(whitelist.isEmpty()) // no whitelisted uris given + info("config.48", null); + + + return whitelist; + } + + /** * Build the configured hardware keys. * @@ -573,9 +661,10 @@ public class ConfigurationPartsBuilder { while ((keyGroupElem = (Element) kgIter.nextNode()) != null) { String keyGroupId = getElementValue(keyGroupElem, CONF + "Id", null); + String keyGroupDigestMethodAlgorithm = getElementValue(keyGroupElem, CONF + "DigestMethodAlgorithm", null); Set keyGroupEntries = buildKeyGroupEntries(keyGroupId, keyModuleIds, keyGroupElem); - KeyGroup keyGroup = new KeyGroup(keyGroupId, keyGroupEntries); + KeyGroup keyGroup = new KeyGroup(keyGroupId, keyGroupEntries, keyGroupDigestMethodAlgorithm); if (keyGroups.containsKey(keyGroupId)) { diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java index 25fa0d6ad..b40a6bfa5 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java @@ -99,7 +99,10 @@ public class ConfigurationProvider /** The default canonicalization algorithm name */ private String canonicalizationAlgorithmName; - + + /** The XAdES version used for signature creation */ + private String xadesVersion; + /** * A List of HardwareCryptoModule objects for * configuring hardware modules. @@ -251,6 +254,11 @@ public class ConfigurationProvider */ private List blackListedUris_; + /** + * A List of white listed URIs (host and port) + */ + private List whiteListedUris_; + /** * A TSLConfiguration that represents the global TSL configuration */ @@ -351,6 +359,8 @@ public class ConfigurationProvider keyGroups = builder.buildKeyGroups(allKeyModules); keyGroupMappings = builder.buildKeyGroupMappings(keyGroups, ANONYMOUS_ISSUER_SERIAL); + + xadesVersion = builder.getXAdESVersion(); defaultChainingMode = builder.getDefaultChainingMode(); chainingModes = builder.buildChainingModes(); useAuthorityInfoAccess_ = builder.getUseAuthorityInfoAccess(); @@ -382,11 +392,14 @@ public class ConfigurationProvider allowExternalUris_= builder.allowExternalUris(); - if (allowExternalUris_) + if (allowExternalUris_) { blackListedUris_ = builder.buildPermitExternalUris(); + whiteListedUris_ = null; + } else { info("config.35", null); blackListedUris_ = null; + whiteListedUris_ = builder.buildForbidExternalUris(); } @@ -457,6 +470,16 @@ public class ConfigurationProvider return digestMethodAlgorithmName; } + /** + * Return the XAdES version used for signature creation. + * + * @return The XAdES version used for signature creation, or an empty String, + * if none has been configured. + */ + public String getXAdESVersion() { + return xadesVersion; + } + public boolean getAllowExternalUris() { return this.allowExternalUris_; } @@ -464,6 +487,9 @@ public class ConfigurationProvider public List getBlackListedUris() { return this.blackListedUris_; } + public List getWhiteListedUris() { + return this.whiteListedUris_; + } /** * Return the name of the canonicalization algorithm used during signature @@ -515,6 +541,11 @@ public class ConfigurationProvider public Map getKeyGroups() { return keyGroups; } + + public KeyGroup getKeyGroup(String keyGroupId) { + KeyGroup keyGroup = (KeyGroup) keyGroups.get(keyGroupId); + return keyGroup; + } /** * Return the set of KeyGroupEntrys of a given key group, which a diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/KeyGroup.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/KeyGroup.java index 22ed8ae83..c2490f9a3 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/KeyGroup.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/KeyGroup.java @@ -40,16 +40,20 @@ public class KeyGroup { private Set keyGroupEntries; /** The key group ID. */ private String id; + /** The digest method algorithm for the key group */ + private String digestMethodAlgorithm; /** * Create a KeyGroup. * * @param id The ID of this KeyGroup. * @param keyGroupEntries The keys belonging to this KeyGroup. + * @param digestMethodAlgorithm The signature algorithm used for this key group */ - public KeyGroup(String id, Set keyGroupEntries) { + public KeyGroup(String id, Set keyGroupEntries, String digestMethodAlgorithm) { this.id = id; this.keyGroupEntries = keyGroupEntries; + this.digestMethodAlgorithm = digestMethodAlgorithm; } /** @@ -60,6 +64,14 @@ public class KeyGroup { public Set getKeyGroupEntries() { return keyGroupEntries; } + + /** + * Returnd the digest method algorithm used for this key group + * @return The digest method signature algorithm used for this key group + */ + public String getDigestMethodAlgorithm() { + return digestMethodAlgorithm; + } /** * Return the ID of this KeyGroup. @@ -87,7 +99,7 @@ public class KeyGroup { sb.append(" " + i.next()); } } - return "(KeyGroup - ID:" + id + " " + sb.toString() + ")"; + return "(KeyGroup - ID:" + id + " " + sb.toString() + ")" + "DigestMethodAlgorithm: " + digestMethodAlgorithm; } } diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/xmlsign/XMLSignatureCreationProfileImpl.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/xmlsign/XMLSignatureCreationProfileImpl.java index 9b5dce883..479f0aac9 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/xmlsign/XMLSignatureCreationProfileImpl.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/xmlsign/XMLSignatureCreationProfileImpl.java @@ -24,9 +24,6 @@ package at.gv.egovernment.moa.spss.server.iaik.xmlsign; -import java.util.List; -import java.util.Set; - import iaik.server.modules.algorithms.SignatureAlgorithms; import iaik.server.modules.keys.AlgorithmUnavailableException; import iaik.server.modules.keys.KeyEntryID; @@ -37,6 +34,10 @@ import iaik.server.modules.xml.Canonicalization; import iaik.server.modules.xmlsign.XMLSignatureCreationProfile; import iaik.server.modules.xmlsign.XMLSignatureInsertionLocation; +import java.util.List; +import java.util.Set; + +import at.gv.egovernment.moa.logging.Logger; import at.gv.egovernment.moa.spss.server.logging.TransactionId; import at.gv.egovernment.moa.spss.server.transaction.TransactionContext; import at.gv.egovernment.moa.spss.server.transaction.TransactionContextManager; @@ -75,7 +76,10 @@ public class XMLSignatureCreationProfileImpl private IdGenerator dsigManifestIDGenerator; /** The ID generator for signed property IDs. */ private IdGenerator propertyIDGenerator; - + /** The selected digest method algorithm if XAdES 1.4.2 is used */ + private String digestMethodXAdES142; + + /** * Create a new XMLSignatureCreationProfileImpl. * @@ -86,7 +90,8 @@ public class XMLSignatureCreationProfileImpl */ public XMLSignatureCreationProfileImpl( int createProfileCount, - Set reservedIDs) { + Set reservedIDs, + String digestMethodXAdES142) { signatureIDGenerator = new IdGenerator("signature-" + createProfileCount, reservedIDs); manifestIDGenerator = @@ -95,6 +100,7 @@ public class XMLSignatureCreationProfileImpl new IdGenerator("dsig-manifest-" + createProfileCount, reservedIDs); propertyIDGenerator = new IdGenerator("etsi-signed-" + createProfileCount, reservedIDs); + this.digestMethodXAdES142 = digestMethodXAdES142; } /** @@ -168,27 +174,127 @@ public class XMLSignatureCreationProfileImpl e, null); } - - if (algorithms.contains(SignatureAlgorithms.MD2_WITH_RSA) // TODO retournierten Algorithmus abhängig von der Schlüssellänge machen (bei längeren Schlüsseln SHA256 statt SHA1) - || algorithms.contains(SignatureAlgorithms.MD5_WITH_RSA) - || algorithms.contains(SignatureAlgorithms.RIPEMD128_WITH_RSA) - || algorithms.contains(SignatureAlgorithms.RIPEMD160_WITH_RSA) - || algorithms.contains(SignatureAlgorithms.SHA1_WITH_RSA) - || algorithms.contains(SignatureAlgorithms.SHA256_WITH_RSA)) { - - return SignatureAlgorithms.SHA1_WITH_RSA; - } else if ( - algorithms.contains(SignatureAlgorithms.ECDSA)) { - return SignatureAlgorithms.ECDSA; - } else if ( - algorithms.contains(SignatureAlgorithms.DSA)) { - return SignatureAlgorithms.DSA; - } else { - throw new AlgorithmUnavailableException( - "No algorithm for key entry: " + selectedKeyID, - null, - null); + + if (digestMethodXAdES142 == null) { + // XAdES 1.4.2 not enabled - legacy MOA + if (algorithms.contains(SignatureAlgorithms.MD2_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.MD5_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.RIPEMD128_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.RIPEMD160_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.SHA1_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.SHA256_WITH_RSA)) { + + return SignatureAlgorithms.SHA1_WITH_RSA; + } else if ( + algorithms.contains(SignatureAlgorithms.ECDSA)) { + return SignatureAlgorithms.ECDSA; + } else if ( + algorithms.contains(SignatureAlgorithms.DSA)) { + return SignatureAlgorithms.DSA; + } else { + throw new AlgorithmUnavailableException( + "No algorithm for key entry: " + selectedKeyID, + null, + null); + } + } + else { + // XAdES 1.4.2 is enabled: select signature algorithm according to selected digest method + if (digestMethodXAdES142.compareTo("SHA-1") == 0) { + Logger.warn("XAdES version 1.4.2 is enabled, but SHA-1 is configured as digest algorithm. Please revise a use a more secure digest algorithm out of the SHA-2 family (e.g. SHA-256, SHA-384, SHA-512)"); + if (algorithms.contains(SignatureAlgorithms.MD2_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.MD5_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.RIPEMD128_WITH_RSA) //? + || algorithms.contains(SignatureAlgorithms.RIPEMD160_WITH_RSA) //? + || algorithms.contains(SignatureAlgorithms.RIPEMD160_WITH_RSA_OLD) //? + || algorithms.contains(SignatureAlgorithms.SHA1_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.WHIRLPOOL_WITH_RSA)) { //? + + return SignatureAlgorithms.SHA1_WITH_RSA; + + } else if (algorithms.contains(SignatureAlgorithms.ECDSA) + || algorithms.contains(SignatureAlgorithms.RIPEMD160_WITH_ECDSA) + || algorithms.contains(SignatureAlgorithms.RIPEMD160_WITH_ECDSA_PLAIN) + || algorithms.contains(SignatureAlgorithms.WHIRLPOOL_WITH_ECDSA) + || algorithms.contains(SignatureAlgorithms.SHA1_WITH_ECDSA_PLAIN)) { + return SignatureAlgorithms.ECDSA; + } else if ( + algorithms.contains(SignatureAlgorithms.DSA)) { + return SignatureAlgorithms.DSA; + } else { + throw new AlgorithmUnavailableException( + "No algorithm for key entry: " + selectedKeyID, + null, + null); + } + } else if (digestMethodXAdES142.compareTo("SHA-256") == 0) { + if (algorithms.contains(SignatureAlgorithms.SHA224_WITH_RSA) + || algorithms.contains(SignatureAlgorithms.SHA256_WITH_RSA)) { + + return SignatureAlgorithms.SHA256_WITH_RSA; + + } else if (algorithms.contains(SignatureAlgorithms.SHA224_WITH_ECDSA) + || algorithms.contains(SignatureAlgorithms.SHA256_WITH_ECDSA) + || algorithms.contains(SignatureAlgorithms.SHA224_WITH_ECDSA_PLAIN) + || algorithms.contains(SignatureAlgorithms.SHA256_WITH_ECDSA_PLAIN)) { + return SignatureAlgorithms.SHA256_WITH_ECDSA; + + } else if ( + algorithms.contains(SignatureAlgorithms.DSA)) { + return SignatureAlgorithms.DSA; + } else { + throw new AlgorithmUnavailableException( + "No algorithm for key entry: " + selectedKeyID, + null, + null); + } + } else if (digestMethodXAdES142.compareTo("SHA-384") == 0) { + if (algorithms.contains(SignatureAlgorithms.SHA384_WITH_RSA)) { + + return SignatureAlgorithms.SHA384_WITH_RSA; + + } else if (algorithms.contains(SignatureAlgorithms.SHA384_WITH_ECDSA) + || algorithms.contains(SignatureAlgorithms.SHA384_WITH_ECDSA_PLAIN)) { + return SignatureAlgorithms.SHA384_WITH_ECDSA; + + } else if ( + algorithms.contains(SignatureAlgorithms.DSA)) { + return SignatureAlgorithms.DSA; + } else { + throw new AlgorithmUnavailableException( + "No algorithm for key entry: " + selectedKeyID, + null, + null); + } + } else if (digestMethodXAdES142.compareTo("SHA-512") == 0) { + if (algorithms.contains(SignatureAlgorithms.SHA512_WITH_RSA)) { + + return SignatureAlgorithms.SHA512_WITH_RSA; + + } else if (algorithms.contains(SignatureAlgorithms.SHA512_WITH_ECDSA) + || algorithms.contains(SignatureAlgorithms.SHA512_WITH_ECDSA_PLAIN)) { + return SignatureAlgorithms.SHA512_WITH_ECDSA; + + } else if ( + algorithms.contains(SignatureAlgorithms.DSA)) { + return SignatureAlgorithms.DSA; + } else { + throw new AlgorithmUnavailableException( + "No algorithm for key entry: " + selectedKeyID, + null, + null); + } + } + else { + throw new AlgorithmUnavailableException( + "No signature algorithm found for digest algorithm '" + digestMethodXAdES142, + null, + null); + } + } + + } /** diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureCreationProfileFactory.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureCreationProfileFactory.java index 5c4a2c76a..d1281c1f1 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureCreationProfileFactory.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureCreationProfileFactory.java @@ -56,6 +56,7 @@ import at.gv.egovernment.moa.spss.api.xmlsign.CreateXMLSignatureRequest; import at.gv.egovernment.moa.spss.api.xmlsign.DataObjectInfo; import at.gv.egovernment.moa.spss.api.xmlsign.SingleSignatureInfo; import at.gv.egovernment.moa.spss.server.config.ConfigurationProvider; +import at.gv.egovernment.moa.spss.server.config.KeyGroup; import at.gv.egovernment.moa.spss.server.config.KeyGroupEntry; import at.gv.egovernment.moa.spss.server.iaik.xml.CanonicalizationImpl; import at.gv.egovernment.moa.spss.server.iaik.xmlsign.DataObjectTreatmentImpl; @@ -83,6 +84,9 @@ public class XMLSignatureCreationProfileFactory { static { HASH_ALGORITHM_MAPPING = new HashMap(); HASH_ALGORITHM_MAPPING.put(Constants.SHA1_URI, HashAlgorithms.SHA1); + HASH_ALGORITHM_MAPPING.put(Constants.SHA256_URI, HashAlgorithms.SHA256); + HASH_ALGORITHM_MAPPING.put(Constants.SHA384_URI, HashAlgorithms.SHA384); + HASH_ALGORITHM_MAPPING.put(Constants.SHA512_URI, HashAlgorithms.SHA512); } /** The CreateXMLSignatureRequest for which to create the @@ -129,18 +133,62 @@ public class XMLSignatureCreationProfileFactory { HashSet allReservedIDs = new HashSet(reserved); allReservedIDs.addAll(sigInfoReservedIDs); - XMLSignatureCreationProfileImpl profile = - new XMLSignatureCreationProfileImpl(createProfileCount, allReservedIDs); TransactionContext context = TransactionContextManager.getInstance().getTransactionContext(); ConfigurationProvider config = context.getConfiguration(); CanonicalizationImpl canonicalization; List dataObjectTreatmentList; - String keyGroupID; Set keySet; List transformationSupplements; List createTransformsProfiles; + // get the key group id + String keyGroupID = request.getKeyIdentifier(); + // get digest method on key group level (if configured) + String configDigestMethodKG = config.getKeyGroup(keyGroupID).getDigestMethodAlgorithm(); + // get default digest method (if configured) + String configDigestMethod = config.getDigestMethodAlgorithmName(); + + String xadesVersion = config.getXAdESVersion(); + + String digestMethodXAdES142 = null; + boolean isXAdES142 = false; + // if XAdES Version 1.4.2 is configured + if (xadesVersion != null && xadesVersion.compareTo("1.4.2") == 0) { + isXAdES142 = true; + Logger.debug("XAdES version '" + xadesVersion + "' used"); + } + + if (isXAdES142) { + if (configDigestMethodKG != null) { + // if KG specific digest method is configured + digestMethodXAdES142 = (String) HASH_ALGORITHM_MAPPING.get(configDigestMethodKG); + if (digestMethodXAdES142 == null) { + error( + "config.17", + new Object[] { configDigestMethodKG}); + throw new MOASystemException("2900", null); + } + Logger.debug("Digest algorithm: " + digestMethodXAdES142 + "(configured in KeyGroup)"); + } + else { + // else get default configured digest method + digestMethodXAdES142 = (String) HASH_ALGORITHM_MAPPING.get(configDigestMethod); + if (digestMethodXAdES142 == null) { + error( + "config.17", + new Object[] { configDigestMethod}); + throw new MOASystemException("2900", null); + } + Logger.debug("Digest algorithm: " + digestMethodXAdES142 + "(default)"); + + } + } + + XMLSignatureCreationProfileImpl profile = + new XMLSignatureCreationProfileImpl(createProfileCount, allReservedIDs, digestMethodXAdES142); + + // build the transformation supplements createTransformsProfiles = getCreateTransformsInfoProfiles(singleSignatureInfo); @@ -153,11 +201,11 @@ public class XMLSignatureCreationProfileFactory { singleSignatureInfo, createTransformsProfiles, transformationSupplements, - allReservedIDs); + allReservedIDs, + digestMethodXAdES142); profile.setDataObjectTreatmentList(dataObjectTreatmentList); // set the key set - keyGroupID = request.getKeyIdentifier(); keySet = buildKeySet(keyGroupID); if (keySet == null) { throw new MOAApplicationException("2231", null); @@ -184,7 +232,7 @@ public class XMLSignatureCreationProfileFactory { canonicalization = new CanonicalizationImpl(config.getCanonicalizationAlgorithmName()); profile.setSignedInfoCanonicalization(canonicalization); - + // set the signed properties profile.setSignedProperties(Collections.EMPTY_LIST); @@ -299,7 +347,8 @@ public class XMLSignatureCreationProfileFactory { SingleSignatureInfo singleSignatureInfo, List createTransformsInfoProfiles, List transformationSupplements, - Set reservedIDs) + Set reservedIDs, + String digestMethodXAdES142) throws MOASystemException, MOAApplicationException { TransactionContext context = @@ -329,15 +378,25 @@ public class XMLSignatureCreationProfileFactory { treatment.setTransformationList(buildTransformationList(profile)); treatment.setReferenceInManifest(dataObjInfo.isChildOfManifest()); - hashAlgorithmName = - (String) HASH_ALGORITHM_MAPPING.get( - config.getDigestMethodAlgorithmName()); - if (hashAlgorithmName == null) { - error( - "config.17", - new Object[] { config.getDigestMethodAlgorithmName()}); - throw new MOASystemException("2900", null); + // if XAdES version is 1.4.2 + if (digestMethodXAdES142 != null) { + // use configured digest algorithm + hashAlgorithmName = digestMethodXAdES142; + } + else { + // stay as it is + hashAlgorithmName = (String) HASH_ALGORITHM_MAPPING.get( + config.getDigestMethodAlgorithmName()); + if (hashAlgorithmName == null) { + error( + "config.17", + new Object[] { config.getDigestMethodAlgorithmName()}); + throw new MOASystemException("2900", null); + } } + + + treatment.setHashAlgorithmName(hashAlgorithmName); treatment.setIncludedInSignature( diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/util/ExternalURIVerifier.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/util/ExternalURIVerifier.java index dafb89f16..219bb7cdf 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/util/ExternalURIVerifier.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/util/ExternalURIVerifier.java @@ -26,12 +26,14 @@ public class ExternalURIVerifier { boolean allowExternalUris = config.getAllowExternalUris(); List blacklist = config.getBlackListedUris(); + List whitelist = config.getWhiteListedUris(); InetAddress hostInetAddress = InetAddress.getByName(host); String ip = hostInetAddress.getHostAddress(); if (allowExternalUris) { + // external URIs are allowed - check blacklist Iterator it = blacklist.iterator(); while (it.hasNext()) { String[] array = (String[])it.next(); @@ -55,9 +57,46 @@ public class ExternalURIVerifier { } } } - else { - Logger.debug(new LogMsg("No external URIs allowed (" + host + ")")); - throw new MOAApplicationException("4001", new Object[]{host}); + else { + // external uris are forbidden - check whitelist + Iterator it = whitelist.iterator(); + boolean allowed = false; + while (it.hasNext()) { + String[] array = (String[])it.next(); + String bhost = array[0]; + String bport = array[1]; + if (bport == null || port == -1) { + // check only host + if (ip.startsWith(bhost)) { + Logger.debug(new LogMsg("Whitelist check: " + host + " (" + ip + ") whitelisted")); + allowed = true; + //throw new MOAApplicationException("4002", new Object[]{host + "(" + ip + ")"}); + } + } + else { + // check host and port + int iport = new Integer(bport).intValue(); + if (ip.startsWith(bhost) && (iport == port)) { + Logger.debug(new LogMsg("Whitelist check: " + host + ":" + port + " (" + ip + ":" + port + " whitelisted")); + //throw new MOAApplicationException("4002", new Object[]{host + ":" + port + " (" + ip + ":" + port + ")"}); + allowed = true; + } + + } + } + + if (!allowed) { + if (port != -1) { + Logger.debug(new LogMsg("No external URIs allowed (" + host + ")")); + throw new MOAApplicationException("4001", new Object[]{host + "(" + ip + ")"}); + } + else { + Logger.debug(new LogMsg("No external URIs allowed (" + host + ":" + port + ")")); + throw new MOAApplicationException("4001", new Object[]{host + ":" + port + " (" + ip + ":" + port + ")"}); + } + + } + } Logger.debug(new LogMsg("URI allowed: " + ip + ":" + port)); -- cgit v1.2.3 From dcaa12f3f801363bf6034a48b80fab60cfe9a39f Mon Sep 17 00:00:00 2001 From: Klaus Stranacher Date: Tue, 23 Apr 2013 12:07:03 +0200 Subject: Update textkeys and testcertificates Update signature algorithm selection Update repository Updates documentation --- id/oa/.settings/org.eclipse.wst.common.component | 6 +- .../org.eclipse.wst.common.project.facet.core.xml | 6 +- .../.settings/org.eclipse.wst.common.component | 168 ++------------------ .../.settings/org.eclipse.wst.common.component | 7 +- .../.settings/org.eclipse.wst.common.component | 173 ++------------------- id/templates/.classpath | 28 +++- id/templates/.project | 69 ++++---- .../.settings/org.eclipse.wst.common.component | 10 +- .../org.eclipse.wst.common.project.facet.core.xml | 4 +- pom.xml | 61 ++++---- .../serializer/2.7.1/serializer-2.7.1.jar | Bin 0 -> 278281 bytes .../2.7.1/serializer-2.7.1.jar.lastUpdated | 20 +++ .../serializer/2.7.1/serializer-2.7.1.jar.md5 | 1 + .../serializer/2.7.1/serializer-2.7.1.jar.sha1 | 1 + .../serializer/2.7.1/serializer-2.7.1.pom | 9 ++ .../2.7.1/serializer-2.7.1.pom.lastUpdated | 12 ++ .../serializer/2.7.1/serializer-2.7.1.pom.md5 | 1 + .../serializer/2.7.1/serializer-2.7.1.pom.sha1 | 1 + .../xml-apis/2.7.1/xml-apis-2.7.1.jar | Bin 0 -> 194354 bytes .../xml-apis/2.7.1/xml-apis-2.7.1.jar.lastUpdated | 20 +++ .../xml-apis/2.7.1/xml-apis-2.7.1.jar.md5 | 1 + .../xml-apis/2.7.1/xml-apis-2.7.1.jar.sha1 | 1 + .../xml-apis/2.7.1/xml-apis-2.7.1.pom | 9 ++ .../xml-apis/2.7.1/xml-apis-2.7.1.pom.lastUpdated | 12 ++ .../xml-apis/2.7.1/xml-apis-2.7.1.pom.md5 | 1 + .../xml-apis/2.7.1/xml-apis-2.7.1.pom.sha1 | 1 + spss/assembly.xml | 18 +++ spss/handbook/clients/api/pom.xml | 6 +- spss/handbook/clients/webservice/.classpath | 64 +++----- spss/handbook/clients/webservice/.project | 74 +++++---- spss/handbook/clients/webservice/pom.xml | 7 +- .../resources/sslKeys/customer1/moa-ssl-kunde1.cer | Bin 0 -> 1075 bytes .../resources/sslKeys/customer1/moa-ssl-kunde1.der | Bin 882 -> 0 bytes .../customer1/moa-ssl-kunde1[pwd=kunde1].p12 | Bin 3926 -> 4126 bytes .../customer1/trustedServers[pwd=servers].keystore | Bin 943 -> 1185 bytes .../resources/sslKeys/customer2/moa-ssl-kunde2.cer | Bin 0 -> 1075 bytes .../resources/sslKeys/customer2/moa-ssl-kunde2.der | Bin 882 -> 0 bytes .../customer2/moa-ssl-kunde2[pwd=kunde2].p12 | Bin 3926 -> 4126 bytes .../customer2/trustedServers[pwd=servers].keystore | Bin 943 -> 1185 bytes .../resources/sslKeys/server/localhost.cer | Bin 0 -> 1091 bytes .../sslKeys/server/tomcat[pwd=server].keystore | Bin 0 -> 2473 bytes .../server/trustedClients[pwd=clients].keystore | Bin 0 -> 2318 bytes .../moa/spss/handbook/clients/webservice/HTTP.java | 1 + .../keys/common/moa-signaturdienst-allekunden.cer | Bin 0 -> 1071 bytes .../keys/common/moa-signaturdienst-allekunden.der | Bin 1074 -> 0 bytes ...a-signaturdienst-allekunden[pwd=allekunden].p12 | Bin 3901 -> 2995 bytes .../keys/customer1/moa-signaturdienst-kunde1.cer | Bin 0 -> 1067 bytes .../keys/customer1/moa-signaturdienst-kunde1.der | Bin 1106 -> 0 bytes .../moa-signaturdienst-kunde1[pwd=kunde1].p12 | Bin 4877 -> 4150 bytes .../keys/customer2/moa-signaturdienst-kunde2.cer | Bin 0 -> 1067 bytes .../keys/customer2/moa-signaturdienst-kunde2.der | Bin 1254 -> 0 bytes .../moa-signaturdienst-kunde2[pwd=kunde2].p12 | Bin 4133 -> 4303 bytes spss/handbook/handbook/config/config.html | 21 ++- spss/handbook/handbook/install/install.html | 37 +++-- spss/handbook/handbook/intro/intro.html | 5 +- spss/handbook/handbook/usage/usage.html | 9 +- .../.settings/org.eclipse.wst.common.component | 2 + spss/server/serverlib/pom.xml | 6 +- .../server/config/ConfigurationPartsBuilder.java | 26 +++- .../spss/server/config/ConfigurationProvider.java | 11 ++ .../xmlsign/XMLSignatureCreationProfileImpl.java | 77 ++++----- .../server/invoke/XMLSignatureCreationInvoker.java | 33 +++- 62 files changed, 463 insertions(+), 556 deletions(-) create mode 100644 repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.jar create mode 100644 repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.jar.lastUpdated create mode 100644 repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.jar.md5 create mode 100644 repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.jar.sha1 create mode 100644 repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.pom create mode 100644 repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.pom.lastUpdated create mode 100644 repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.pom.md5 create mode 100644 repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.pom.sha1 create mode 100644 repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.jar create mode 100644 repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.jar.lastUpdated create mode 100644 repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.jar.md5 create mode 100644 repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.jar.sha1 create mode 100644 repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.pom create mode 100644 repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.pom.lastUpdated create mode 100644 repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.pom.md5 create mode 100644 repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.pom.sha1 create mode 100644 spss/handbook/clients/webservice/resources/sslKeys/customer1/moa-ssl-kunde1.cer delete mode 100644 spss/handbook/clients/webservice/resources/sslKeys/customer1/moa-ssl-kunde1.der create mode 100644 spss/handbook/clients/webservice/resources/sslKeys/customer2/moa-ssl-kunde2.cer delete mode 100644 spss/handbook/clients/webservice/resources/sslKeys/customer2/moa-ssl-kunde2.der create mode 100644 spss/handbook/clients/webservice/resources/sslKeys/server/localhost.cer create mode 100644 spss/handbook/clients/webservice/resources/sslKeys/server/tomcat[pwd=server].keystore create mode 100644 spss/handbook/clients/webservice/resources/sslKeys/server/trustedClients[pwd=clients].keystore create mode 100644 spss/handbook/conf/moa-spss/keys/common/moa-signaturdienst-allekunden.cer delete mode 100644 spss/handbook/conf/moa-spss/keys/common/moa-signaturdienst-allekunden.der create mode 100644 spss/handbook/conf/moa-spss/keys/customer1/moa-signaturdienst-kunde1.cer delete mode 100644 spss/handbook/conf/moa-spss/keys/customer1/moa-signaturdienst-kunde1.der create mode 100644 spss/handbook/conf/moa-spss/keys/customer2/moa-signaturdienst-kunde2.cer delete mode 100644 spss/handbook/conf/moa-spss/keys/customer2/moa-signaturdienst-kunde2.der (limited to 'spss/server/serverlib/src/main/java/at') diff --git a/id/oa/.settings/org.eclipse.wst.common.component b/id/oa/.settings/org.eclipse.wst.common.component index 9c72656e2..4395ccd72 100644 --- a/id/oa/.settings/org.eclipse.wst.common.component +++ b/id/oa/.settings/org.eclipse.wst.common.component @@ -1,10 +1,10 @@ - - + - + + diff --git a/id/oa/.settings/org.eclipse.wst.common.project.facet.core.xml b/id/oa/.settings/org.eclipse.wst.common.project.facet.core.xml index a801c94a0..fec12087a 100644 --- a/id/oa/.settings/org.eclipse.wst.common.project.facet.core.xml +++ b/id/oa/.settings/org.eclipse.wst.common.project.facet.core.xml @@ -2,6 +2,6 @@ - - - \ No newline at end of file + + + diff --git a/id/server/auth/.settings/org.eclipse.wst.common.component b/id/server/auth/.settings/org.eclipse.wst.common.component index 174ea5a4f..70a85d980 100644 --- a/id/server/auth/.settings/org.eclipse.wst.common.component +++ b/id/server/auth/.settings/org.eclipse.wst.common.component @@ -1,165 +1,21 @@ + + uses + + + uses + + + uses + + + uses + - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - diff --git a/id/server/idserverlib/.settings/org.eclipse.wst.common.component b/id/server/idserverlib/.settings/org.eclipse.wst.common.component index a5eb3d4d8..8f3380621 100644 --- a/id/server/idserverlib/.settings/org.eclipse.wst.common.component +++ b/id/server/idserverlib/.settings/org.eclipse.wst.common.component @@ -1,7 +1,8 @@ - - + + + - \ No newline at end of file + diff --git a/id/server/proxy/.settings/org.eclipse.wst.common.component b/id/server/proxy/.settings/org.eclipse.wst.common.component index 07ce6f6f9..cc61830e7 100644 --- a/id/server/proxy/.settings/org.eclipse.wst.common.component +++ b/id/server/proxy/.settings/org.eclipse.wst.common.component @@ -1,164 +1,19 @@ - - + + + uses + + + uses + + + uses + + + uses + - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - - uses - - \ No newline at end of file + diff --git a/id/templates/.classpath b/id/templates/.classpath index 0173dfd90..767a2a2de 100644 --- a/id/templates/.classpath +++ b/id/templates/.classpath @@ -1,5 +1,27 @@ - - - \ No newline at end of file + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/id/templates/.project b/id/templates/.project index 3089d3e1f..bbb999ed8 100644 --- a/id/templates/.project +++ b/id/templates/.project @@ -1,31 +1,42 @@ - moa-id-templates - NO_M2ECLIPSE_SUPPORT: Project files created with the maven-eclipse-plugin are not supported in M2Eclipse. - - - - org.eclipse.jdt.core.javabuilder - - - org.eclipse.wst.validation.validationbuilder - - - org.maven.ide.eclipse.maven2Builder - - - org.eclipse.m2e.core.maven2Builder - - - org.eclipse.wst.common.project.facet.core.builder - - - - org.eclipse.m2e.core.maven2Nature - org.maven.ide.eclipse.maven2Nature - org.eclipse.wst.common.project.facet.core.nature - org.eclipse.jdt.core.javanature - org.eclipse.wst.common.modulecore.ModuleCoreNature - org.eclipse.jem.workbench.JavaEMFNature - - \ No newline at end of file + moa-id-templates + NO_M2ECLIPSE_SUPPORT: Project files created with the maven-eclipse-plugin are not supported in M2Eclipse. + + + + + org.eclipse.jdt.core.javabuilder + + + + + org.eclipse.wst.validation.validationbuilder + + + + + org.maven.ide.eclipse.maven2Builder + + + + + org.eclipse.wst.common.project.facet.core.builder + + + + + org.eclipse.m2e.core.maven2Builder + + + + + + org.eclipse.m2e.core.maven2Nature + org.maven.ide.eclipse.maven2Nature + org.eclipse.wst.common.project.facet.core.nature + org.eclipse.jdt.core.javanature + org.eclipse.wst.common.modulecore.ModuleCoreNature + org.eclipse.jem.workbench.JavaEMFNature + + diff --git a/id/templates/.settings/org.eclipse.wst.common.component b/id/templates/.settings/org.eclipse.wst.common.component index 0d2cb24b4..8ef19dd6b 100644 --- a/id/templates/.settings/org.eclipse.wst.common.component +++ b/id/templates/.settings/org.eclipse.wst.common.component @@ -1,8 +1,8 @@ - - + - - + + + - \ No newline at end of file + diff --git a/id/templates/.settings/org.eclipse.wst.common.project.facet.core.xml b/id/templates/.settings/org.eclipse.wst.common.project.facet.core.xml index 564572b10..ac59587b0 100644 --- a/id/templates/.settings/org.eclipse.wst.common.project.facet.core.xml +++ b/id/templates/.settings/org.eclipse.wst.common.project.facet.core.xml @@ -2,6 +2,6 @@ - - \ No newline at end of file + + diff --git a/pom.xml b/pom.xml index 4f8d9cd55..1d44cd676 100644 --- a/pom.xml +++ b/pom.xml @@ -68,10 +68,10 @@ moa - id/assembly-auth.xml - id/assembly-proxy.xml + spss/assembly.xml - spss/assembly-lib.xml + @@ -101,13 +101,13 @@ compile - axis + org.apache.axis axis-jaxrpc 1.4 compile - axis + org.apache.axis axis-saaj 1.4 compile @@ -121,59 +121,59 @@ jaxen jaxen - 1.0-FCS + 1.0-FCS saxpath saxpath - 1.0-FCS - compile + 1.0-FCS + compile log4j log4j - 1.2.14 + 1.2.14 runtime postgresql postgresql - 7.2 + 7.2 runtime javax.mail mail - 1.4 + 1.4 commons-fileupload commons-fileupload - 1.1.1 + 1.1.1 commons-httpclient commons-httpclient - 3.1 + 3.1 dav4j dav4j - 0.1 + 0.1 compile httpsclient httpsclient - JSSE-1.0 + JSSE-1.0 compile regexp regexp - 1.3 + 1.3 @@ -211,31 +211,32 @@ junit junit - 3.8.1 + 3.8.1 test commons-logging commons-logging - 1.0.4 + 1.0.4 compile + - javax.servlet - servlet-api - 2.4 - compile + javax.servlet + servlet-api + 2.4 + provide javax.activation activation - 1.1 + 1.1 compile commons-discovery commons-discovery - 0.2 + 0.2 compile @@ -248,7 +249,7 @@ iaik.prod iaik_moa - 1.32 + 1.33.1 compile @@ -376,8 +377,8 @@ xerces xercesImpl - 2.7.1 - compile + 2.9.0 + compile + 2.7.1 runtime xalan-bin-dist serializer - 2.7.0 + 2.7.1 runtime diff --git a/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.jar b/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.jar new file mode 100644 index 000000000..99f98db9b Binary files /dev/null and b/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.jar differ diff --git a/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.jar.lastUpdated b/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.jar.lastUpdated new file mode 100644 index 000000000..72e5744b0 --- /dev/null +++ b/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.jar.lastUpdated @@ -0,0 +1,20 @@ +#NOTE: This is an internal implementation file, its format can be changed without prior notice. +#Wed Apr 17 12:01:34 CEST 2013 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\handbook\\clients\\api/../../../../../repository/.lastUpdated=1366192894894 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\idserverlib/../../../repository/.lastUpdated=1366192894629 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\common/../repository/.lastUpdated=1366192893795 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverlib/../../../repository/.lastUpdated=1366192894406 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverws/../../../repository/.lastUpdated=1366192894480 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverws/../../../repository/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\auth/../../../repository/.lastUpdated=1366192894830 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\auth/../../../repository/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\handbook\\clients\\webservice/../../../../../repository/.lastUpdated=1366192894987 +http\://repo.maven.apache.org/maven2/.lastUpdated=1366192894218 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverlib/../../../repository/.error= +http\://repo.maven.apache.org/maven2/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\proxy/../../../repository/.lastUpdated=1366192894710 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\proxy/../../../repository/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\idserverlib/../../../repository/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\handbook\\clients\\api/../../../../../repository/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\common/../repository/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\handbook\\clients\\webservice/../../../../../repository/.error= diff --git a/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.jar.md5 b/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.jar.md5 new file mode 100644 index 000000000..adbc53599 --- /dev/null +++ b/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.jar.md5 @@ -0,0 +1 @@ +a6b64dfe58229bdd810263fa0cc54cff \ No newline at end of file diff --git a/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.jar.sha1 b/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.jar.sha1 new file mode 100644 index 000000000..6c4691731 --- /dev/null +++ b/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.jar.sha1 @@ -0,0 +1 @@ +4b4b18df434451249bb65a63f2fb69e215a6a020 \ No newline at end of file diff --git a/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.pom b/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.pom new file mode 100644 index 000000000..a1f3cde6f --- /dev/null +++ b/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.pom @@ -0,0 +1,9 @@ + + + 4.0.0 + xalan-bin-dist + serializer + 2.7.1 + POM was created from install:install-file + diff --git a/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.pom.lastUpdated b/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.pom.lastUpdated new file mode 100644 index 000000000..e04390820 --- /dev/null +++ b/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.pom.lastUpdated @@ -0,0 +1,12 @@ +#NOTE: This is an internal implementation file, its format can be changed without prior notice. +#Wed Apr 17 12:01:37 CEST 2013 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\common/../repository/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverws/../../../repository/.error= +http\://repo.maven.apache.org/maven2/.lastUpdated=1366192893730 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\proxy/../../../repository/.lastUpdated=1366192895946 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverws/../../../repository/.lastUpdated=1366192897001 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\auth/../../../repository/.error= +http\://repo.maven.apache.org/maven2/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\common/../repository/.lastUpdated=1366192893425 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\proxy/../../../repository/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\auth/../../../repository/.lastUpdated=1366192896653 diff --git a/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.pom.md5 b/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.pom.md5 new file mode 100644 index 000000000..6a6605da3 --- /dev/null +++ b/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.pom.md5 @@ -0,0 +1 @@ +c548ff7c5b2531e2e8052759451a5b61 \ No newline at end of file diff --git a/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.pom.sha1 b/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.pom.sha1 new file mode 100644 index 000000000..cb273050a --- /dev/null +++ b/repository/xalan-bin-dist/serializer/2.7.1/serializer-2.7.1.pom.sha1 @@ -0,0 +1 @@ +f82a66ca40abfcbd03af124884077f7f0aa37e04 \ No newline at end of file diff --git a/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.jar b/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.jar new file mode 100644 index 000000000..d42c0ea6c Binary files /dev/null and b/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.jar differ diff --git a/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.jar.lastUpdated b/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.jar.lastUpdated new file mode 100644 index 000000000..e61976db2 --- /dev/null +++ b/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.jar.lastUpdated @@ -0,0 +1,20 @@ +#NOTE: This is an internal implementation file, its format can be changed without prior notice. +#Wed Apr 17 12:01:34 CEST 2013 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\handbook\\clients\\api/../../../../../repository/.lastUpdated=1366192894892 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\idserverlib/../../../repository/.lastUpdated=1366192894628 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\common/../repository/.lastUpdated=1366192893794 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverlib/../../../repository/.lastUpdated=1366192894405 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverws/../../../repository/.lastUpdated=1366192894479 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverws/../../../repository/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\auth/../../../repository/.lastUpdated=1366192894829 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\auth/../../../repository/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\handbook\\clients\\webservice/../../../../../repository/.lastUpdated=1366192894985 +http\://repo.maven.apache.org/maven2/.lastUpdated=1366192894217 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverlib/../../../repository/.error= +http\://repo.maven.apache.org/maven2/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\proxy/../../../repository/.lastUpdated=1366192894709 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\proxy/../../../repository/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\idserverlib/../../../repository/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\handbook\\clients\\api/../../../../../repository/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\common/../repository/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\handbook\\clients\\webservice/../../../../../repository/.error= diff --git a/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.jar.md5 b/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.jar.md5 new file mode 100644 index 000000000..1587d2a8e --- /dev/null +++ b/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.jar.md5 @@ -0,0 +1 @@ +9ae9c29e4497fc35a3eade1e6dd0bbeb \ No newline at end of file diff --git a/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.jar.sha1 b/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.jar.sha1 new file mode 100644 index 000000000..6b27a7311 --- /dev/null +++ b/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.jar.sha1 @@ -0,0 +1 @@ +90b215f48fe42776c8c7f6e3509ec54e84fd65ef \ No newline at end of file diff --git a/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.pom b/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.pom new file mode 100644 index 000000000..d3fdfc96c --- /dev/null +++ b/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.pom @@ -0,0 +1,9 @@ + + + 4.0.0 + xalan-bin-dist + xml-apis + 2.7.1 + POM was created from install:install-file + diff --git a/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.pom.lastUpdated b/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.pom.lastUpdated new file mode 100644 index 000000000..b90a46001 --- /dev/null +++ b/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.pom.lastUpdated @@ -0,0 +1,12 @@ +#NOTE: This is an internal implementation file, its format can be changed without prior notice. +#Wed Apr 17 12:01:36 CEST 2013 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\common/../repository/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverws/../../../repository/.error= +http\://repo.maven.apache.org/maven2/.lastUpdated=1366192893413 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\proxy/../../../repository/.lastUpdated=1366192895941 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverws/../../../repository/.lastUpdated=1366192896997 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\auth/../../../repository/.error= +http\://repo.maven.apache.org/maven2/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\common/../repository/.lastUpdated=1366192893124 +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\proxy/../../../repository/.error= +file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\auth/../../../repository/.lastUpdated=1366192896649 diff --git a/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.pom.md5 b/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.pom.md5 new file mode 100644 index 000000000..643470a61 --- /dev/null +++ b/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.pom.md5 @@ -0,0 +1 @@ +e9e8dbab4192e9717da818229d2c1d75 \ No newline at end of file diff --git a/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.pom.sha1 b/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.pom.sha1 new file mode 100644 index 000000000..5732193c8 --- /dev/null +++ b/repository/xalan-bin-dist/xml-apis/2.7.1/xml-apis-2.7.1.pom.sha1 @@ -0,0 +1 @@ +e7af06cd1c18a4182b4465fb144a51bcac56b913 \ No newline at end of file diff --git a/spss/assembly.xml b/spss/assembly.xml index 8adeef5d9..1c560fe5d 100644 --- a/spss/assembly.xml +++ b/spss/assembly.xml @@ -39,6 +39,24 @@ ${artifactId}.${extension} + + + javax.servlet:servlet-api + javax.activation:activation + axis:axis + org.apache.axis:axis-jaxrpc + org.apache.axis:axis-saaj + axis:axis-wsdl4j + commons-discovery:commons-discovery + commons-logging:commons-logging + javax.mail:mail + xalan-bin-dist:serializer + xerces:xercesImpl + + /doc/clients/webservice/lib + + ${artifactId}-${version}.${extension} + moa-spss.${extension} false diff --git a/spss/handbook/clients/api/pom.xml b/spss/handbook/clients/api/pom.xml index 6a38fbb2d..5a978964b 100644 --- a/spss/handbook/clients/api/pom.xml +++ b/spss/handbook/clients/api/pom.xml @@ -22,11 +22,11 @@ axis - axis + org.apache.axis axis-jaxrpc - axis + org.apache.axis axis-saaj @@ -64,7 +64,7 @@ javax.servlet servlet-api - provided + xalan-bin-dist diff --git a/spss/handbook/clients/webservice/.classpath b/spss/handbook/clients/webservice/.classpath index cb29bfb96..d687b9b02 100644 --- a/spss/handbook/clients/webservice/.classpath +++ b/spss/handbook/clients/webservice/.classpath @@ -1,41 +1,27 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/spss/handbook/clients/webservice/.project b/spss/handbook/clients/webservice/.project index d23223048..cddae3823 100644 --- a/spss/handbook/clients/webservice/.project +++ b/spss/handbook/clients/webservice/.project @@ -1,34 +1,44 @@ - moa-spss-handbook-webserviceClient - NO_M2ECLIPSE_SUPPORT: Project files created with the maven-eclipse-plugin are not supported in M2Eclipse. - - moa-common - moa-spss-lib - - - - org.eclipse.jdt.core.javabuilder - - - org.eclipse.wst.common.project.facet.core.builder - - - org.eclipse.wst.validation.validationbuilder - - - org.maven.ide.eclipse.maven2Builder - - - org.eclipse.m2e.core.maven2Builder - - - - org.eclipse.m2e.core.maven2Nature - org.maven.ide.eclipse.maven2Nature - org.eclipse.wst.common.project.facet.core.nature - org.eclipse.jdt.core.javanature - org.eclipse.wst.common.modulecore.ModuleCoreNature - org.eclipse.jem.workbench.JavaEMFNature - - \ No newline at end of file + moa-spss-handbook-webserviceClient + NO_M2ECLIPSE_SUPPORT: Project files created with the maven-eclipse-plugin are not supported in M2Eclipse. + + moa-common + moa-spss-lib + + + + org.eclipse.jdt.core.javabuilder + + + + + org.eclipse.wst.common.project.facet.core.builder + + + + + org.eclipse.wst.validation.validationbuilder + + + + + org.maven.ide.eclipse.maven2Builder + + + + + org.eclipse.m2e.core.maven2Builder + + + + + + org.eclipse.m2e.core.maven2Nature + org.maven.ide.eclipse.maven2Nature + org.eclipse.wst.common.project.facet.core.nature + org.eclipse.jdt.core.javanature + org.eclipse.wst.common.modulecore.ModuleCoreNature + org.eclipse.jem.workbench.JavaEMFNature + + diff --git a/spss/handbook/clients/webservice/pom.xml b/spss/handbook/clients/webservice/pom.xml index 70aefa4bc..4221e6cc1 100644 --- a/spss/handbook/clients/webservice/pom.xml +++ b/spss/handbook/clients/webservice/pom.xml @@ -22,11 +22,11 @@ axis - axis + org.apache.axis axis-jaxrpc - axis + org.apache.axis axis-saaj @@ -61,10 +61,9 @@ postgresql postgresql - + javax.servlet servlet-api - provided xalan-bin-dist diff --git a/spss/handbook/clients/webservice/resources/sslKeys/customer1/moa-ssl-kunde1.cer b/spss/handbook/clients/webservice/resources/sslKeys/customer1/moa-ssl-kunde1.cer new file mode 100644 index 000000000..dc8a6921f Binary files /dev/null and b/spss/handbook/clients/webservice/resources/sslKeys/customer1/moa-ssl-kunde1.cer differ diff --git a/spss/handbook/clients/webservice/resources/sslKeys/customer1/moa-ssl-kunde1.der b/spss/handbook/clients/webservice/resources/sslKeys/customer1/moa-ssl-kunde1.der deleted file mode 100644 index b6091332c..000000000 Binary files a/spss/handbook/clients/webservice/resources/sslKeys/customer1/moa-ssl-kunde1.der and /dev/null differ diff --git a/spss/handbook/clients/webservice/resources/sslKeys/customer1/moa-ssl-kunde1[pwd=kunde1].p12 b/spss/handbook/clients/webservice/resources/sslKeys/customer1/moa-ssl-kunde1[pwd=kunde1].p12 index 33f76bf9c..ea67e4ae0 100644 Binary files a/spss/handbook/clients/webservice/resources/sslKeys/customer1/moa-ssl-kunde1[pwd=kunde1].p12 and b/spss/handbook/clients/webservice/resources/sslKeys/customer1/moa-ssl-kunde1[pwd=kunde1].p12 differ diff --git a/spss/handbook/clients/webservice/resources/sslKeys/customer1/trustedServers[pwd=servers].keystore b/spss/handbook/clients/webservice/resources/sslKeys/customer1/trustedServers[pwd=servers].keystore index 9c6c55359..db78c54ab 100644 Binary files a/spss/handbook/clients/webservice/resources/sslKeys/customer1/trustedServers[pwd=servers].keystore and b/spss/handbook/clients/webservice/resources/sslKeys/customer1/trustedServers[pwd=servers].keystore differ diff --git a/spss/handbook/clients/webservice/resources/sslKeys/customer2/moa-ssl-kunde2.cer b/spss/handbook/clients/webservice/resources/sslKeys/customer2/moa-ssl-kunde2.cer new file mode 100644 index 000000000..63f5dc755 Binary files /dev/null and b/spss/handbook/clients/webservice/resources/sslKeys/customer2/moa-ssl-kunde2.cer differ diff --git a/spss/handbook/clients/webservice/resources/sslKeys/customer2/moa-ssl-kunde2.der b/spss/handbook/clients/webservice/resources/sslKeys/customer2/moa-ssl-kunde2.der deleted file mode 100644 index 20bc38e14..000000000 Binary files a/spss/handbook/clients/webservice/resources/sslKeys/customer2/moa-ssl-kunde2.der and /dev/null differ diff --git a/spss/handbook/clients/webservice/resources/sslKeys/customer2/moa-ssl-kunde2[pwd=kunde2].p12 b/spss/handbook/clients/webservice/resources/sslKeys/customer2/moa-ssl-kunde2[pwd=kunde2].p12 index ec7bf8e48..db7072544 100644 Binary files a/spss/handbook/clients/webservice/resources/sslKeys/customer2/moa-ssl-kunde2[pwd=kunde2].p12 and b/spss/handbook/clients/webservice/resources/sslKeys/customer2/moa-ssl-kunde2[pwd=kunde2].p12 differ diff --git a/spss/handbook/clients/webservice/resources/sslKeys/customer2/trustedServers[pwd=servers].keystore b/spss/handbook/clients/webservice/resources/sslKeys/customer2/trustedServers[pwd=servers].keystore index d32a22f0f..cbf43b046 100644 Binary files a/spss/handbook/clients/webservice/resources/sslKeys/customer2/trustedServers[pwd=servers].keystore and b/spss/handbook/clients/webservice/resources/sslKeys/customer2/trustedServers[pwd=servers].keystore differ diff --git a/spss/handbook/clients/webservice/resources/sslKeys/server/localhost.cer b/spss/handbook/clients/webservice/resources/sslKeys/server/localhost.cer new file mode 100644 index 000000000..7bee8af02 Binary files /dev/null and b/spss/handbook/clients/webservice/resources/sslKeys/server/localhost.cer differ diff --git a/spss/handbook/clients/webservice/resources/sslKeys/server/tomcat[pwd=server].keystore b/spss/handbook/clients/webservice/resources/sslKeys/server/tomcat[pwd=server].keystore new file mode 100644 index 000000000..a24520345 Binary files /dev/null and b/spss/handbook/clients/webservice/resources/sslKeys/server/tomcat[pwd=server].keystore differ diff --git a/spss/handbook/clients/webservice/resources/sslKeys/server/trustedClients[pwd=clients].keystore b/spss/handbook/clients/webservice/resources/sslKeys/server/trustedClients[pwd=clients].keystore new file mode 100644 index 000000000..44a40723b Binary files /dev/null and b/spss/handbook/clients/webservice/resources/sslKeys/server/trustedClients[pwd=clients].keystore differ diff --git a/spss/handbook/clients/webservice/src/main/java/at/gv/egovernment/moa/spss/handbook/clients/webservice/HTTP.java b/spss/handbook/clients/webservice/src/main/java/at/gv/egovernment/moa/spss/handbook/clients/webservice/HTTP.java index 518017fd2..ffea02533 100644 --- a/spss/handbook/clients/webservice/src/main/java/at/gv/egovernment/moa/spss/handbook/clients/webservice/HTTP.java +++ b/spss/handbook/clients/webservice/src/main/java/at/gv/egovernment/moa/spss/handbook/clients/webservice/HTTP.java @@ -1,5 +1,6 @@ /* * Copyright 2003 Federal Chancellery Austria + * MOA-SPSS has been developed in a cooperation between BRZ, the Federal * Chancellery Austria - ICT staff unit, and Graz University of Technology. * diff --git a/spss/handbook/conf/moa-spss/keys/common/moa-signaturdienst-allekunden.cer b/spss/handbook/conf/moa-spss/keys/common/moa-signaturdienst-allekunden.cer new file mode 100644 index 000000000..ad989001a Binary files /dev/null and b/spss/handbook/conf/moa-spss/keys/common/moa-signaturdienst-allekunden.cer differ diff --git a/spss/handbook/conf/moa-spss/keys/common/moa-signaturdienst-allekunden.der b/spss/handbook/conf/moa-spss/keys/common/moa-signaturdienst-allekunden.der deleted file mode 100644 index a4a327a3a..000000000 Binary files a/spss/handbook/conf/moa-spss/keys/common/moa-signaturdienst-allekunden.der and /dev/null differ diff --git a/spss/handbook/conf/moa-spss/keys/common/moa-signaturdienst-allekunden[pwd=allekunden].p12 b/spss/handbook/conf/moa-spss/keys/common/moa-signaturdienst-allekunden[pwd=allekunden].p12 index fe837fd6e..9c6669eba 100644 Binary files a/spss/handbook/conf/moa-spss/keys/common/moa-signaturdienst-allekunden[pwd=allekunden].p12 and b/spss/handbook/conf/moa-spss/keys/common/moa-signaturdienst-allekunden[pwd=allekunden].p12 differ diff --git a/spss/handbook/conf/moa-spss/keys/customer1/moa-signaturdienst-kunde1.cer b/spss/handbook/conf/moa-spss/keys/customer1/moa-signaturdienst-kunde1.cer new file mode 100644 index 000000000..65e33329e Binary files /dev/null and b/spss/handbook/conf/moa-spss/keys/customer1/moa-signaturdienst-kunde1.cer differ diff --git a/spss/handbook/conf/moa-spss/keys/customer1/moa-signaturdienst-kunde1.der b/spss/handbook/conf/moa-spss/keys/customer1/moa-signaturdienst-kunde1.der deleted file mode 100644 index 505e7dd05..000000000 Binary files a/spss/handbook/conf/moa-spss/keys/customer1/moa-signaturdienst-kunde1.der and /dev/null differ diff --git a/spss/handbook/conf/moa-spss/keys/customer1/moa-signaturdienst-kunde1[pwd=kunde1].p12 b/spss/handbook/conf/moa-spss/keys/customer1/moa-signaturdienst-kunde1[pwd=kunde1].p12 index a8073b02b..29585f1ce 100644 Binary files a/spss/handbook/conf/moa-spss/keys/customer1/moa-signaturdienst-kunde1[pwd=kunde1].p12 and b/spss/handbook/conf/moa-spss/keys/customer1/moa-signaturdienst-kunde1[pwd=kunde1].p12 differ diff --git a/spss/handbook/conf/moa-spss/keys/customer2/moa-signaturdienst-kunde2.cer b/spss/handbook/conf/moa-spss/keys/customer2/moa-signaturdienst-kunde2.cer new file mode 100644 index 000000000..a3ebd91f7 Binary files /dev/null and b/spss/handbook/conf/moa-spss/keys/customer2/moa-signaturdienst-kunde2.cer differ diff --git a/spss/handbook/conf/moa-spss/keys/customer2/moa-signaturdienst-kunde2.der b/spss/handbook/conf/moa-spss/keys/customer2/moa-signaturdienst-kunde2.der deleted file mode 100644 index 3c21c9b2b..000000000 Binary files a/spss/handbook/conf/moa-spss/keys/customer2/moa-signaturdienst-kunde2.der and /dev/null differ diff --git a/spss/handbook/conf/moa-spss/keys/customer2/moa-signaturdienst-kunde2[pwd=kunde2].p12 b/spss/handbook/conf/moa-spss/keys/customer2/moa-signaturdienst-kunde2[pwd=kunde2].p12 index dce18ac78..cc28f167d 100644 Binary files a/spss/handbook/conf/moa-spss/keys/customer2/moa-signaturdienst-kunde2[pwd=kunde2].p12 and b/spss/handbook/conf/moa-spss/keys/customer2/moa-signaturdienst-kunde2[pwd=kunde2].p12 differ diff --git a/spss/handbook/handbook/config/config.html b/spss/handbook/handbook/config/config.html index 5561a3696..2421deb1b 100644 --- a/spss/handbook/handbook/config/config.html +++ b/spss/handbook/handbook/config/config.html @@ -115,6 +115,7 @@

1.1.1 Namenskonventionen

Folgende Namenraum-Präfixe werden in diesem Handbuch zur Kennzeichnung der Namenräume von XML-Elementen verwendet:

+

TODO Weitere Namespaces? Aktuell?

@@ -213,6 +214,7 @@
Präfix

2.1.2 Auflösen externer URIs

+

TODO Update Whitelisting

@@ -325,7 +327,8 @@ - - +

TODO Default-wert wenn XAdES 1.4.2?

+ 
http://www.w3.org/2000/09/xmldsig#sha1

Für die genaue Bedeutung der Werte siehe die Spezifikation für XML-Signaturen.

Name
Erläuterung

Mit diesem Element wird in MOA SS eine Schlüsselgruppe definiert. Eine Schlüsselgruppe +

TODO Update DigestMethod

+

Mit diesem Element wird in MOA SS eine Schlüsselgruppe definiert. Eine Schlüsselgruppe ist eine Zusammenfassung von einem oder mehreren privaten Schlüsseln, die in Hardware- bzw. Softwareschlüsselspeichern (vergleiche Abschnitte 2.2.1.1 bzw. 2.2.1.2) verwaltet werden. Die Schlüsselgruppe wird vom Kunden von MOA SS über einen eindeutigen Bezeichner @@ -334,7 +337,7 @@ es, dass MOA SS selbst entscheidet, welcher konkrete Schlüssel aus der Schlüsselgruppe zur Erstellung der Signatur verwendet wird. Durch die somit mögliche Parallelisierung (mehrere private Schlüssel werden parallel für Anfragen, die auf die gleiche Schlüsselgruppe - referenzieren) lässt sich der Durchsatz der erstellten Signaturen verbessern.

+ referenzieren) lässt sich der Durchsatz der erstellten Signaturen verbessern.

Das Element cfg:SignatureCreation/cfg:KeyGroup hat folgenden Element-Inhalt:

  • Element cfg:Id: Dieses obligatorische Element vom Typ xs:token enthält @@ -481,13 +484,15 @@ IssuerDN (RFC2253) :
Erläuterung

Als Inhalt des Elements kann der Digest-Algorithmus, der für das Erstellen von XML-Signaturen verwendet werden soll und in der Signatur als Inhalt von dsig:Signature/dsig:SignedInfo/dsig:Reference/dsig:DigestMethod aufscheint, spezifiziert werden. Folgende Werte dürfen verwendet werden:

+

TODO Update Beschreibung hinsichtlich XAdES 1.4.2

+

Als Inhalt des Elements kann der Digest-Algorithmus, der für das Erstellen von XML-Signaturen verwendet werden soll und in der Signatur als Inhalt von dsig:Signature/dsig:SignedInfo/dsig:Reference/dsig:DigestMethod aufscheint, spezifiziert werden. Folgende Werte dürfen verwendet werden:

- 

http://www.w3.org/2000/09/xmldsig#sha1
+      
http://www.w3.org/2000/09/xmldsig#sha1
 

           

           
Wird das Element nicht angegeben, wird folgender Wert als Default-Wert verwendet:

-          
http://www.w3.org/2000/09/xmldsig#sha1
          
Für die genaue Bedeutung der Werte siehe die Spezifikation für XML-Signaturen.

2.2.5 Profil für Transformationen

@@ -561,8 +566,9 @@ IssuerDN (RFC2253) : +

TODO XAdES 1.4.2 Möglichkeit

2.3 - Parameter für MOA SP

+Parameter für MOA SP

2.3.1 Zertifikatsvalidierung

2.3.1.1 @@ -1124,7 +1130,8 @@ Wird der Wert auf -1 gesetzt, dann bedeutet das ein unendlich langes Intervall.

3 Beispielkonfigurationen

-

3.1 Minimale Konfiguration für MOA SS

+

TODO Update Konfigurations (Simple, Expert)

+

3.1 Minimale Konfiguration für MOA SS

Nachfolgend finden Sie eine zentrale Konfigurationsdatei mit den minimal notwendigen Einträgen für den alleinigen Betrieb von MOA SS. Darin sind als Kinder des Wurzelelements cfg:MOAConfiguration folgende Konfigurationselemente enthalten:

diff --git a/spss/handbook/handbook/install/install.html b/spss/handbook/handbook/install/install.html index 7abb103bd..5de55163f 100644 --- a/spss/handbook/handbook/install/install.html +++ b/spss/handbook/handbook/install/install.html @@ -113,36 +113,43 @@

2.1.1 Einführung

Die Basisinstallation des Webservices stellt einerseits die minimalen Anforderungen für den Betrieb von MOA SP/SS als Webservices dar, andererseits dient sie als Ausgangspunkt für optionale Erweiterungsmöglichkeiten.

Folgende Software ist Voraussetzung für die Basisinstallation des Webservices:

+

TODO: Update Versions

+

TODO Empfohlene Versionen?

In diesem Betriebs-Szenario wird das MOA SP/SS Webservice in Tomcat zum Einsatz gebracht. Tomcat fungiert gleichzeitig als HTTP- und HTTPS-Endpunkt für das MOA SP/SS Webservice. Beide Protokolle werden direkt in Tomcat konfiguriert. Das MOA SP/SS Webservice verwendet Log4j als Logging Toolkit.

-

2.1.2 Installation

+

2.1.2 Installation

2.1.2.1 Vorbereitung

Die folgenden Schritte dienen der Vorbereitung der Installation.

Installation von J2SE SDK
+
TODO Update Versions
Installieren Sie J2SE 1.4.x SDK oder J2SE 5.0 SDK in ein beliebiges Verzeichnis. Wir empfehlen die Installation von J2SE 5.0 SDK. Das Wurzelverzeichnis der J2SE SDK Installation wird im weiteren Verlauf als $JAVA_HOME bezeichnet.
Installation von Apache Tomcat 4.1
+
TODO Update Versions
Installieren Sie Apache Tomcat 4.1.18 oder höher in ein Verzeichnis, das keine Leerzeichen im Pfadnamen enthält. Wir empfehlen die Installation von Apache Tomcat 4.1.31. Verwenden Sie bitte die zu Ihrem J2SE SDK passende Distribution von Tomcat. Das Wurzelverzeichnis der Tomcat-Installation wird im weiteren Verlauf als $CATALINA_HOME bezeichnet.
Entpacken der MOA SP/SS Webservice Distribution
+
TODO Update Versions
Entpacken Sie die Datei moa-spss-1.5.1.zip in ein beliebiges Verzeichnis. Dieses Verzeichnis wird im weiteren Verlauf als $MOA_SPSS_INST bezeichnet.
Installation der Krypographiebibliotheken von SIC/IAIK

Die Installation der Kryptographiebibliotheken von SIC/IAIK:

J2SE 1.4.2 SDK oder JSE 5.0 SDK
+
TODO Update Versions
Kopieren Sie alle Dateien aus dem Verzeichnis $MOA_SPSS_INST/ext in das Verzeichnis $JAVA_HOME/jre/lib/ext. Zusätzlich müssen Sie die Rechtedateien Ihres J2SE 1.4.x SDK bzw. J2SE 5.0 SDK austauschen. Laden Sie dazu die Unlimited Strength - - - Jurisdiction Policy Files von der J2SE 1.4.x SDK Downloadseite bzw. J2SE 5.0 SDK Downloadseite und folgen Sie der darin enthaltenen Installationsanweisung.
+ + + Jurisdiction Policy Files von der J2SE 1.4.x SDK Downloadseite bzw. J2SE 5.0 SDK Downloadseite und folgen Sie der darin enthaltenen Installationsanweisung.
-

2.1.2.2 Konfiguration von Apache Tomcat

-

Die zentrale Konfigurations-Datei von Tomcat ist $CATALINA_HOME/conf/server.xml. Tomcat wird grundsätzlich mit einer funktionierenden Default-Konfiguration ausgeliefert, die jedoch einiges an Ballast enthält und viele Ports offen lässt.

-
2.1.2.2.1 Konfiguration des HTTP Connectors
+

2.1.2.2 Konfiguration von Apache Tomcat

+

TODO Update Beispiel server.xml für empfohlenen Tomcat-Version

+

Die zentrale Konfigurations-Datei von Tomcat ist $CATALINA_HOME/conf/server.xml. Tomcat wird grundsätzlich mit einer funktionierenden Default-Konfiguration ausgeliefert, die jedoch einiges an Ballast enthält und viele Ports offen lässt.

+
2.1.2.2.1 Konfiguration des HTTP Connectors

Die Datei $MOA_SPSS_INST/tomcat/server.xml enthält eine minimale Tomcat-Konfiguration, die ausschließlich den Connector für HTTP auf Port 8080 freischaltet. Durch kopieren dieser Datei nach $CATALINA_HOME/conf/server.xml kann Tomcat mit dieser Konfiguration gestartet werden. Wir empfehlen diese Konfiguration nur für Fälle, in denen das MOA SP/SS Webservice in einer abgeschlossenen Netzwerkumgebung betrieben wird.

2.1.2.2.2 Konfiguration des HTTPS Connectors

Wird das MOA SP/SS Webservice in einer nicht abgeschlossenen Umgebung (z.B. Erreichbarkeit über das Internet) betrieben, ist die gegenseitige Identitätsfeststellung von Kunde und Webservice essentiell:

@@ -171,7 +178,8 @@
  • Die Datei $MOA_SPSS_INST/moa-spss.war enthält das einsatzfertige MOA SP/SS Webarchiv und muss ins Verzeichnis $CATALINA_HOME/webapps kopiert werden. Dort wird sie beim ersten Start von Tomcat automatisch ins Verzeichnis $CATALINA_HOME/webapps/moa-spss entpackt.
  • Die zentrale Konfigurationsdatei für MOA SP/SS und die zugehörigen Profil-Verzeichnisse müssen in ein beliebiges Verzeichnis im Dateisystem kopiert werden (z.B. $CATALINA_HOME/conf/moa-spss). Eine funktionsfähige Konfiguration, die als Ausgangspunkt für die Konfiguration des MOA SP/SS Webservices dienen kann, finden Sie hier.
    • -
  • Wird Tomcat unter J2SE 1.4.x SDK oder höher betrieben, müssen die Dateien xalan.jar, xercesImpl.jar, serializer.jar und xml-apis.jar aus dem Verzeichnis $MOA_SPSS_INST/endorsed in das Tomcat-Verzeichnis $CATALINA_HOME/common/endorsed kopiert werden. Sind gleichnamige Dateien dort bereits vorhanden, müssen sie überschrieben werden. Die ggf. in diesem Verzeichnis vorhandene Datei xmlParserAPIs.jar muss gelöscht werden.
    • +
  • TODO Update Versions
    + Wird Tomcat unter J2SE 1.4.x SDK oder höher betrieben, müssen die Dateien xalan.jar, xercesImpl.jar, serializer.jar und xml-apis.jar aus dem Verzeichnis $MOA_SPSS_INST/endorsed in das Tomcat-Verzeichnis $CATALINA_HOME/common/endorsed kopiert werden. Sind gleichnamige Dateien dort bereits vorhanden, müssen sie überschrieben werden. Die ggf. in diesem Verzeichnis vorhandene Datei xmlParserAPIs.jar muss gelöscht werden.
  • Folgende System Properties können gesetzt werden (wird beim Starten von Tomcat der Java Virtual Machine in der Umgebungsvariablen CATALINA_OPTS in der Form -D<name>=<wert> übergeben):
    • moa.spss.server.configuration: Pfad und Name der zentralen Konfigurationsdatei für MOA SP/SS. Eine beispielhafte Konfigurationsdatei finden Sie hier. Wird ein relativer Pfad angegeben, wird dieser relativ zum Startverzeichnis der Java Virtual Machine interpretiert. Ist diese System Property nicht gesetzt, wird automatisch eine im Webarchiv unter WEB-INF/conf enthaltene Default-Konfiguration herangezogen.
      • @@ -297,7 +305,8 @@ INFO | 01 21:25:26,540 | Thread-3 | TID=1049225059594-100 NID=<null>

      2.2 Erweiterungsmöglichkeiten

      Ausgehend von der Basisinstallation können die optionalen Erweiterungen, die in den nachfolgenden Abschnitten beschrieben werden, unabhängig und in beliebiger Kombination aufgesetzt werden.

      -

      2.2.1 Vorgeschalteter Webserver

      +

      TODO Update Versions?

      +

      2.2.1 Vorgeschalteter Webserver

      2.2.1.1 Microsoft Internet Information Server (MS IIS)

      Den MOA SP/SS Webservices kann optional ein MS IIS vorgeschaltet sein. In diesem Fall übernimmt der MS IIS die HTTP- bzw. HTTPS-Kommunikation mit dem Aufrufer des Webservices. Die Kommunikation zwischen MS IIS und dem in Tomcat eingerichteten MOA SP/SS Webservice wird durch Jakarta mod_jk durchgeführt. Die angeführten Konfigurationsschritte gehen von einer MS IIS Standard-Installation aus.

      2.2.1.1.1 Konfiguration von Jakarta mod_jk im MS IIS
      @@ -371,6 +380,7 @@ INFO | 01 21:25:26,540 | Thread-3 | TID=1049225059594-100 NID=<null>

      3.1.1 Einführung

      Die Basisinstallation der Klassenbibliothek stellt einerseits die minimalen Anforderungen für den Einsatz von MOA SP/SS als Klassenbibliothek dar, andererseits dient sie als Ausgangspunkt für optionale Erweiterungsmöglichkeiten.

      Folgende Software ist Voraussetzung für die Basisinstallation der Klassenbibliothek:

      +

      TODO Update Versions

      @@ -378,21 +388,25 @@ INFO | 01 21:25:26,540 | Thread-3 | TID=1049225059594-100 NID=<null>

      Die folgenden Schritte dienen der Vorbereitung der Installation.

      Installation von J2SE SDK
      +
      TODO Update Versions
      Installieren Sie J2SE 1.4.x SDK oder J2SE 5.0 SDK in ein beliebiges Verzeichnis. Wir empfehlen die Installation von J2SE 5.0 SDK. Das Wurzelverzeichnis der J2SE SDK Installation wird im weiteren Verlauf als $JAVA_HOME bezeichnet.
      Entpacken der MOA SP/SS Klassenbibliotheks-Distribution
      +
      TODO Update Versions
      Entpacken Sie die Datei moa-spss-1.5.1-lib.zip in ein beliebiges Verzeichnis. Dieses Verzeichnis wird im weiteren Verlauf als $MOA_SPSS_INST bezeichnet.
      Installation der Krypographiebibliotheken von SIC/IAIK

      Die Installation der Kryptographiebibliotheken von SIC/IAIK:

      J2SE 1.4.x SDK oder JSE 5.0 SDK
      +
      TODO Update Versions
      Kopieren Sie alle Dateien aus dem Verzeichnis $MOA_SPSS_INST/ext in das Verzeichnis $JAVA_HOME/jre/lib/ext. Zusätzlich müssen Sie die Rechtedateien Ihres J2SE 1.4.x SDK bzw. J2SE 5.0 SDK austauschen. Laden Sie dazu die Unlimited Strength Jurisdiction Policy Files von der J2SE 1.4.x SDK Downloadseite bzw. J2SE 5.0 SDK Downloadseite und folgen Sie der darin enthaltenen Installationsanweisung.
      -

      3.1.3 Verwendung

      +

      3.1.3 Verwendung

      Um die MOA SP/SS Klassenbibliothek in einer Applikation verwenden zu können, müssen die mit MOA SP/SS ausgelieferten Bibliotheken in den Java Klassenpfad der Applikation eingebunden werden.

      Die nachfolgende Tabelle listet diese Klassenbibliotheken auf; die Einträge in der Spalte Dateien sind relativ zum Verzeichnis $MOA_SPSS_INST zu interpretieren.

      +

      TODO Update Versions

      @@ -463,6 +477,7 @@ INFO | 01 21:25:26,540 | Thread-3 | TID=1049225059594-100 NID=<null>

      Die im Abschnitt 2.2 angeführten Erweiterungsmöglichkeiten für die MOA SP/SS Webservices gelten in analoger Weise auch für die Klassenbibliothek.

      A Referenzierte Software

      Auf folgende Software-Pakete wird in diesem Handbuch verwiesen:

      +

      TODO Update Versions

      KlassenbibliothekVersionDateien
      diff --git a/spss/handbook/handbook/intro/intro.html b/spss/handbook/handbook/intro/intro.html index baa240263..a01a825b2 100644 --- a/spss/handbook/handbook/intro/intro.html +++ b/spss/handbook/handbook/intro/intro.html @@ -31,8 +31,9 @@

      1 Allgemeines

      Die Module Serversignatur (SS) und Signaturprüfung (SP) können von Anwendungen verwendet werden, um elektronische Signaturen zu erstellen bzw. vorliegende elektronische Signaturen zu überprüfen.

      -

      Die Funktionalität und der Aufbau der Schnittstelle zu den beiden Modulen ist in der Spezifikation MOA SP/SS (V1.3) detailliert beschrieben. Da diese Spezifikation auf der Schnittstellenspezifikation des Security-Layers (V 1.1) aufbaut, ist deren Kenntnis zum Verstehen der Schnittstellen zu SS und SP erforderlich.

      -

      2 Modul Serversignatur (SS)

      +

      TODO: CAdES auf SL1.2x aufbauend - wie siehts mir Rest aus?

      +

      Die Funktionalität und der Aufbau der Schnittstelle zu den beiden Modulen ist in der Spezifikation MOA SP/SS (V1.3) detailliert beschrieben. Da diese Spezifikation auf der Schnittstellenspezifikation des Security-Layers (V 1.1) aufbaut, ist deren Kenntnis zum Verstehen der Schnittstellen zu SS und SP erforderlich.

      +

      2 Modul Serversignatur (SS)

      Das Modul Serversignatur (SS) dient zum Erstellen von XML-Signaturen in Anlehnung an die Schnittstellenspezifikation des Security-Layers (V 1.1). Eine Signatur kann entweder rein in Software erstellt werden, oder aber unter Zuhilfenahme eines Hardware Security Modules (HSM), das den privaten Schlüssel geschützt enthält und die Signatur berechnet.

      Der Zugriff auf einzelne Signaturschlüssel in MOA SS kann basierend auf dem für TLS-Client-Authentisierung verwendeten Zertifikat eingeschränkt werden.

      Anwendungen können das Modul entweder als Web-Service oder über ein Java-API ansprechen.

      diff --git a/spss/handbook/handbook/usage/usage.html b/spss/handbook/handbook/usage/usage.html index 8d2f002e6..1ac817a45 100644 --- a/spss/handbook/handbook/usage/usage.html +++ b/spss/handbook/handbook/usage/usage.html @@ -79,7 +79,9 @@

      2.1 XML-Requests

      Dieser Abschnitt stellt typische XML-Requests für die Erstellung einer XML-Signatur mittels SS bzw. zur Prüfung einer CMS- bzw. XML-Signatur mittels SP vor. Zu jedem Request wird jeweils auch eine typische Response des Services besprochen.

      Bitte beachten Sie: Einige der vorgestellten Requests referenzieren beispielhafte Daten auf localhost, z.B. http://localhost:8080/referencedData/Text.txt. Wenn Sie diese Beispiele ausprobieren möchten, müssen Sie dafür sorgen, dass MOA SS bzw. SP diese Daten auch tatsächlich auflösen kann. Wenn Sie Ihre Tomcat-Installation auf localhost:8080 betreiben, ist es ausreichend, wenn sie die diesem Handbuch beiliegende Webapplikation referencedData.war in das Verzeichnis webapps Ihrer Tomcat-Installation kopieren. Ansonsten müssen Sie zusätzlich die URLs in den Requests anpassen.

      -

      2.1.1 Erstellung einer XML-Signatur

      +

       

      +

      TODO Erstellung einer CMS/CAdES Signatur

      +

      2.1.1 Erstellung einer XML-Signatur

      2.1.1.1 Einfaches Beispiel

      Request

      CreateXMLSignatureRequest.Simple.xml ist ein einfacher XML-Request zur Erzeugung einer XML-Signatur. Sein Aufbau wird nachfolgend analysiert:

      @@ -1121,6 +1123,8 @@ Ich habe weiters ein eigenens ID-Attribut bekommen.</doc:Paragraph> </VerifyXMLSignatureResponse>

      Das Element CertificateCheck enthält das Resultat der Zertifikatsprüfung (siehe Einfaches Beispiel).

      +

       

      +

      TODO Beispiel-Request mit TSL-Prüfung

      2.2 Webservice-Clients

      Abschnitt 2.1 bespricht eine Reihe von typischen XML-Requests, die über die Webservice-Schnittstelle an MOA SP/SS gesendet werden können, um entweder Signaturen zu erstellen (MOA SS) oder Signaturen zu prüfen (MOA SP). Dieser Abschnitt zeigt die Verwendung des prototypischen Webservice-Clients, der mit dieser Dokumentation zu MOA SP/SS ausgeliefert wird.

      2.2.1 Übersicht

      @@ -1135,6 +1139,8 @@ Ich habe weiters ein eigenens ID-Attribut bekommen.</doc:Paragraph>

      2.2.2 Gemeinsamkeiten

      Dieser Abschnitt beschreibt die Gemeinsamkeiten aller drei Varianten des Webservice-Clients.

      Zunächst einmal benötigen alle drei Varianten die folgenden Java-Bibliotheken, die im Ordner clients/webservice/lib/ dieses Handbuchs bereits enthalten sind:

      +

      TODO Update Versions

      +

      TODO kein lib Verzeichnis

      Name
      @@ -1199,6 +1205,7 @@ Ich habe weiters ein eigenens ID-Attribut bekommen.</doc:Paragraph>

      A Referenzierte Software

      Auf folgende Software-Pakete wird in diesem Handbuch verwiesen:

      +

      TODO Update Versions

      diff --git a/spss/server/serverlib/.settings/org.eclipse.wst.common.component b/spss/server/serverlib/.settings/org.eclipse.wst.common.component index ee24ef8ba..fe4fd3290 100644 --- a/spss/server/serverlib/.settings/org.eclipse.wst.common.component +++ b/spss/server/serverlib/.settings/org.eclipse.wst.common.component @@ -2,5 +2,7 @@ + + diff --git a/spss/server/serverlib/pom.xml b/spss/server/serverlib/pom.xml index d425edb83..2a6fd382f 100644 --- a/spss/server/serverlib/pom.xml +++ b/spss/server/serverlib/pom.xml @@ -22,11 +22,11 @@ axis - axis + org.apache.axis axis-jaxrpc - axis + org.apache.axis axis-saaj @@ -64,7 +64,7 @@ javax.servlet servlet-api - provided + compile xalan-bin-dist diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java index e335139aa..bc53ca4f9 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java @@ -284,8 +284,11 @@ public class ConfigurationPartsBuilder { new HashSet(Arrays.asList(ACCEPTED_DIGEST_ALGORITHMS_ARRAY)); - /** Default digest algorithm URI, if none/illegal has been configured */ - private static final String DIGEST_ALGORITHM_DEFAULT = Constants.SHA1_URI; + /** Default digest algorithm URI, if none/illegal has been configured (for XAdES 1.1.1) */ + private static final String DIGEST_ALGORITHM_DEFAULT_XADES_1_1_1 = Constants.SHA1_URI; + + /** Default digest algorithm URI, if none/illegal has been configured (for XAdES 1.4.2) */ + private static final String DIGEST_ALGORITHM_DEFAULT_XADES_1_4_2 = Constants.SHA256_URI; /** The root element of the MOA configuration */ private Element configElem; @@ -351,10 +354,21 @@ public class ConfigurationPartsBuilder { if (digestMethod == null || !ACCEPTED_DIGEST_ALGORITHMS.contains(digestMethod)) { - info( - "config.23", - new Object[] { "DigestMethodAlgorithm", DIGEST_ALGORITHM_DEFAULT }); - digestMethod = DIGEST_ALGORITHM_DEFAULT; + String xadesVersion = this.getXAdESVersion(); + if (xadesVersion == null) { + info( + "config.23", + new Object[] { "DigestMethodAlgorithm", DIGEST_ALGORITHM_DEFAULT_XADES_1_1_1 }); + digestMethod = DIGEST_ALGORITHM_DEFAULT_XADES_1_1_1; + } + else { + info( + "config.23", + new Object[] { "DigestMethodAlgorithm", DIGEST_ALGORITHM_DEFAULT_XADES_1_4_2 }); + digestMethod = DIGEST_ALGORITHM_DEFAULT_XADES_1_4_2; + } + + } return digestMethod; diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java index b40a6bfa5..08478b717 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java @@ -41,6 +41,7 @@ import java.util.Collections; import java.util.Iterator; import java.util.List; import java.util.Map; +import java.util.Map.Entry; import java.util.Set; import org.w3c.dom.Element; @@ -573,6 +574,16 @@ public class ConfigurationProvider issuerAndSerial = new IssuerAndSerial(issuer, serial); } +// System.out.println("Issuer: " + issuer); +// System.out.println("serial: " + serial); +// +// Iterator entries = keyGroupMappings.entrySet().iterator(); +// while (entries.hasNext()) { +// Entry thisEntry = (Entry) entries.next(); +// System.out.println("Entry: " + thisEntry.getKey()); +// System.out.println("Value: " + thisEntry.getValue()); +// } + mapping = (Map) keyGroupMappings.get(issuerAndSerial); if (mapping != null) { KeyGroup keyGroup = (KeyGroup) mapping.get(keyGroupId); diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/xmlsign/XMLSignatureCreationProfileImpl.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/xmlsign/XMLSignatureCreationProfileImpl.java index 479f0aac9..edc3922e2 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/xmlsign/XMLSignatureCreationProfileImpl.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/xmlsign/XMLSignatureCreationProfileImpl.java @@ -202,46 +202,33 @@ public class XMLSignatureCreationProfileImpl // XAdES 1.4.2 is enabled: select signature algorithm according to selected digest method if (digestMethodXAdES142.compareTo("SHA-1") == 0) { Logger.warn("XAdES version 1.4.2 is enabled, but SHA-1 is configured as digest algorithm. Please revise a use a more secure digest algorithm out of the SHA-2 family (e.g. SHA-256, SHA-384, SHA-512)"); - if (algorithms.contains(SignatureAlgorithms.MD2_WITH_RSA) - || algorithms.contains(SignatureAlgorithms.MD5_WITH_RSA) - || algorithms.contains(SignatureAlgorithms.RIPEMD128_WITH_RSA) //? - || algorithms.contains(SignatureAlgorithms.RIPEMD160_WITH_RSA) //? - || algorithms.contains(SignatureAlgorithms.RIPEMD160_WITH_RSA_OLD) //? - || algorithms.contains(SignatureAlgorithms.SHA1_WITH_RSA) - || algorithms.contains(SignatureAlgorithms.WHIRLPOOL_WITH_RSA)) { //? - - return SignatureAlgorithms.SHA1_WITH_RSA; - - } else if (algorithms.contains(SignatureAlgorithms.ECDSA) - || algorithms.contains(SignatureAlgorithms.RIPEMD160_WITH_ECDSA) - || algorithms.contains(SignatureAlgorithms.RIPEMD160_WITH_ECDSA_PLAIN) - || algorithms.contains(SignatureAlgorithms.WHIRLPOOL_WITH_ECDSA) - || algorithms.contains(SignatureAlgorithms.SHA1_WITH_ECDSA_PLAIN)) { - return SignatureAlgorithms.ECDSA; - } else if ( - algorithms.contains(SignatureAlgorithms.DSA)) { - return SignatureAlgorithms.DSA; - } else { - throw new AlgorithmUnavailableException( - "No algorithm for key entry: " + selectedKeyID, - null, - null); + + if (algorithms.contains(SignatureAlgorithms.SHA1_WITH_RSA)) { + return SignatureAlgorithms.SHA1_WITH_RSA; + + } else if (algorithms.contains(SignatureAlgorithms.ECDSA)) { + return SignatureAlgorithms.ECDSA; + + } else if (algorithms.contains(SignatureAlgorithms.DSA)) { + return SignatureAlgorithms.DSA; + + } else { + throw new AlgorithmUnavailableException( + "No algorithm for key entry: " + selectedKeyID, + null, + null); } + } else if (digestMethodXAdES142.compareTo("SHA-256") == 0) { - if (algorithms.contains(SignatureAlgorithms.SHA224_WITH_RSA) - || algorithms.contains(SignatureAlgorithms.SHA256_WITH_RSA)) { - + if (algorithms.contains(SignatureAlgorithms.SHA256_WITH_RSA)) { return SignatureAlgorithms.SHA256_WITH_RSA; - } else if (algorithms.contains(SignatureAlgorithms.SHA224_WITH_ECDSA) - || algorithms.contains(SignatureAlgorithms.SHA256_WITH_ECDSA) - || algorithms.contains(SignatureAlgorithms.SHA224_WITH_ECDSA_PLAIN) - || algorithms.contains(SignatureAlgorithms.SHA256_WITH_ECDSA_PLAIN)) { + } else if (algorithms.contains(SignatureAlgorithms.SHA256_WITH_ECDSA)) { return SignatureAlgorithms.SHA256_WITH_ECDSA; - } else if ( - algorithms.contains(SignatureAlgorithms.DSA)) { - return SignatureAlgorithms.DSA; + } else if (algorithms.contains(SignatureAlgorithms.DSA)) { + return SignatureAlgorithms.DSA; + } else { throw new AlgorithmUnavailableException( "No algorithm for key entry: " + selectedKeyID, @@ -249,17 +236,15 @@ public class XMLSignatureCreationProfileImpl null); } } else if (digestMethodXAdES142.compareTo("SHA-384") == 0) { - if (algorithms.contains(SignatureAlgorithms.SHA384_WITH_RSA)) { - + if (algorithms.contains(SignatureAlgorithms.SHA384_WITH_RSA)) { return SignatureAlgorithms.SHA384_WITH_RSA; - } else if (algorithms.contains(SignatureAlgorithms.SHA384_WITH_ECDSA) - || algorithms.contains(SignatureAlgorithms.SHA384_WITH_ECDSA_PLAIN)) { + } else if (algorithms.contains(SignatureAlgorithms.SHA384_WITH_ECDSA)) { return SignatureAlgorithms.SHA384_WITH_ECDSA; - } else if ( - algorithms.contains(SignatureAlgorithms.DSA)) { - return SignatureAlgorithms.DSA; + } else if (algorithms.contains(SignatureAlgorithms.DSA)) { + return SignatureAlgorithms.DSA; + } else { throw new AlgorithmUnavailableException( "No algorithm for key entry: " + selectedKeyID, @@ -267,17 +252,15 @@ public class XMLSignatureCreationProfileImpl null); } } else if (digestMethodXAdES142.compareTo("SHA-512") == 0) { - if (algorithms.contains(SignatureAlgorithms.SHA512_WITH_RSA)) { - + if (algorithms.contains(SignatureAlgorithms.SHA512_WITH_RSA)) { return SignatureAlgorithms.SHA512_WITH_RSA; - } else if (algorithms.contains(SignatureAlgorithms.SHA512_WITH_ECDSA) - || algorithms.contains(SignatureAlgorithms.SHA512_WITH_ECDSA_PLAIN)) { + } else if (algorithms.contains(SignatureAlgorithms.SHA512_WITH_ECDSA)) { return SignatureAlgorithms.SHA512_WITH_ECDSA; - } else if ( - algorithms.contains(SignatureAlgorithms.DSA)) { + } else if (algorithms.contains(SignatureAlgorithms.DSA)) { return SignatureAlgorithms.DSA; + } else { throw new AlgorithmUnavailableException( "No algorithm for key entry: " + selectedKeyID, diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureCreationInvoker.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureCreationInvoker.java index 759af813c..8bebff974 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureCreationInvoker.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureCreationInvoker.java @@ -243,14 +243,31 @@ public class XMLSignatureCreationInvoker { } try { - // create the signature - signature = - module.createSignature( - dataObjectList, - profile, - additionalSignedProperties, - signatureParent, - new TransactionId(context.getTransactionID())); + ConfigurationProvider config = context.getConfiguration(); + String xadesVersion = config.getXAdESVersion(); + + if (xadesVersion!= null && xadesVersion.compareTo(XMLSignatureCreationModule.XADES_VERSION_1_4_2) == 0) { + // create the signature (XAdES 1.4.2) + signature = + module.createSignature( + dataObjectList, + profile, + additionalSignedProperties, + signatureParent, + XMLSignatureCreationModule.XADES_VERSION_1_4_2, + new TransactionId(context.getTransactionID())); + } + else { + // create the signature (XAdES 1.1.1 = default) + signature = + module.createSignature( + dataObjectList, + profile, + additionalSignedProperties, + signatureParent, + XMLSignatureCreationModule.XADES_VERSION_1_1_1, + new TransactionId(context.getTransactionID())); + } // insert the result into the response if (signatureParent != null) { -- cgit v1.2.3 From a544afcf4ad581ab7b76e85dc597ccf5643cd55a Mon Sep 17 00:00:00 2001 From: Klaus Stranacher Date: Mon, 6 May 2013 21:43:00 +0200 Subject: - Update MOA-SS Interface (CreateCMSignatureRequest) - Whitelisting in MOA-SPSS --- .settings/org.eclipse.jdt.core.prefs | 7 - common/.settings/org.eclipse.jdt.core.prefs | 17 +- .../org.eclipse.wst.common.project.facet.core.xml | 4 +- .../java/at/gv/egovernment/moa/util/Constants.java | 9 +- .../resources/resources/schemas/MOA-SPSS-1.5.2.xsd | 541 ++++++++++++++++++++ id/oa/.settings/org.eclipse.jdt.core.prefs | 6 +- .../org.eclipse.wst.common.project.facet.core.xml | 2 +- .../.settings/org.eclipse.wst.common.component | 5 +- .../org.eclipse.wst.common.project.facet.core.xml | 4 +- id/server/auth/pom.xml | 3 +- id/server/auth/src/main/wsdl/MOA-ID-1.x.wsdl | 2 +- id/server/doc/MOA ID 1.x.wsdl | 2 +- .../.settings/org.eclipse.jdt.core.prefs | 11 +- .../org.eclipse.wst.common.project.facet.core.xml | 4 +- .../main/resources/resources/wsdl/MOA-ID-1.x.wsdl | 2 +- .../proxy/.settings/org.eclipse.jdt.core.prefs | 3 + .../.settings/org.eclipse.wst.common.component | 3 +- .../org.eclipse.wst.common.project.facet.core.xml | 4 +- id/server/proxy/pom.xml | 3 +- id/templates/.classpath | 8 +- id/templates/.settings/org.eclipse.jdt.core.prefs | 12 +- .../org.eclipse.wst.common.project.facet.core.xml | 2 +- pom.xml | 22 +- spss/handbook/clients/api/.classpath | 82 +-- .../api/.settings/org.eclipse.jdt.core.prefs | 12 +- spss/handbook/clients/referencedData/.classpath | 10 +- .../.settings/org.eclipse.jdt.core.prefs | 12 +- .../.settings/org.eclipse.wst.common.component | 5 +- .../org.eclipse.wst.common.project.facet.core.xml | 4 +- spss/handbook/clients/webservice/.classpath | 8 +- .../.settings/org.eclipse.jdt.core.prefs | 12 +- ...rifyXMLSignatureRequest.FileURIs.DataObject.xml | 2 +- ...SignatureRequest.FileURIs.ServerSupplements.xml | 2 +- ...ifyXMLSignatureRequest.FileURIs.Supplements.xml | 2 +- ...AIK-Test-Root-CA_20080114-20180114.SerNo.01.der | Bin 0 -> 880 bytes spss/handbook/handbook/intro/intro.html | 8 +- spss/handbook/handbook/spec/MOA-SPSS-1.3.wsdl | 105 ---- spss/handbook/handbook/spec/MOA-SPSS-1.3.xsd | 469 ------------------ spss/handbook/handbook/spec/MOA-SPSS-1.5.2.wsdl | 128 +++++ spss/handbook/handbook/spec/MOA-SPSS-1.5.2.xsd | 474 ++++++++++++++++++ spss/handbook/handbook/usage/usage.html | 23 +- .../serverlib/.settings/org.eclipse.jdt.core.prefs | 5 - .../org.eclipse.wst.common.project.facet.core.xml | 4 +- .../gv/egovernment/moa/spss/api/SPSSFactory.java | 87 ++++ .../moa/spss/api/cmssign/CMSSignatureResponse.java | 41 ++ .../api/cmssign/CreateCMSSignatureRequest.java | 49 ++ .../api/cmssign/CreateCMSSignatureResponse.java | 42 ++ .../cmssign/CreateCMSSignatureResponseElement.java | 51 ++ .../moa/spss/api/cmssign/DataObjectInfo.java | 58 +++ .../moa/spss/api/cmssign/SingleSignatureInfo.java | 51 ++ .../spss/api/impl/CMSSignatureResponseImpl.java | 64 +++ .../api/impl/CreateCMSSignatureRequestImpl.java | 77 +++ .../api/impl/CreateCMSSignatureResponseImpl.java | 60 +++ .../moa/spss/api/impl/DataObjectInfoCMSImpl.java | 69 +++ .../moa/spss/api/impl/SPSSFactoryImpl.java | 49 ++ .../spss/api/impl/SingleSignatureInfoCMSImpl.java | 62 +++ .../xmlbind/CreateCMSSignatureRequestParser.java | 247 +++++++++ .../xmlbind/CreateCMSSignatureResponseBuilder.java | 145 ++++++ .../server/config/ConfigurationPartsBuilder.java | 3 +- .../cmssign/CMSSignatureCreationProfileImpl.java | 249 ++++++++++ .../xmlsign/XMLSignatureCreationProfileImpl.java | 2 +- .../server/invoke/CMSSignatureCreationInvoker.java | 396 +++++++++++++++ .../invoke/CMSSignatureVerificationInvoker.java | 3 +- .../invoke/CreateCMSSignatureResponseBuilder.java | 93 ++++ .../spss/server/invoke/IaikExceptionMapper.java | 3 +- .../invoke/VerifyCMSSignatureResponseBuilder.java | 5 +- .../moa/spss/server/service/AxisHandler.java | 3 +- .../server/service/SignatureCreationService.java | 88 ++++ .../properties/spss_messages_de.properties | 2 + .../resources/resources/wsdl/MOA-SPSS-1.3.wsdl | 105 ---- .../main/resources/resources/wsdl/MOA-SPSS-1.3.xsd | 469 ------------------ .../resources/resources/wsdl/MOA-SPSS-1.5.2.wsdl | 128 +++++ .../resources/resources/wsdl/MOA-SPSS-1.5.2.xsd | 471 ++++++++++++++++++ spss/server/serverws/.classpath | 1 + spss/server/serverws/.project | 9 +- .../serverws/.settings/org.eclipse.jdt.core.prefs | 14 +- .../.settings/org.eclipse.wst.common.component | 3 + spss/server/serverws/pom.xml | 3 +- .../serverws/resources/wsdl/MOA-SPSS-1.3.wsdl | 105 ---- .../serverws/resources/wsdl/MOA-SPSS-1.3.xsd | 469 ------------------ .../serverws/resources/wsdl/MOA-SPSS-1.5.2.wsdl | 128 +++++ .../serverws/resources/wsdl/MOA-SPSS-1.5.2.xsd | 551 +++++++++++++++++++++ .../src/main/webapp/WEB-INF/server-config.wsdd | 9 +- spss/server/tools/.classpath | 24 +- .../tools/.settings/org.eclipse.jdt.core.prefs | 12 +- 85 files changed, 4614 insertions(+), 1929 deletions(-) delete mode 100644 .settings/org.eclipse.jdt.core.prefs create mode 100644 common/src/main/resources/resources/schemas/MOA-SPSS-1.5.2.xsd create mode 100644 spss/handbook/conf/moa-spss/trustProfiles/test/IAIK-Test-Root-CA_20080114-20180114.SerNo.01.der delete mode 100644 spss/handbook/handbook/spec/MOA-SPSS-1.3.wsdl delete mode 100644 spss/handbook/handbook/spec/MOA-SPSS-1.3.xsd create mode 100644 spss/handbook/handbook/spec/MOA-SPSS-1.5.2.wsdl create mode 100644 spss/handbook/handbook/spec/MOA-SPSS-1.5.2.xsd create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/CMSSignatureResponse.java create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/CreateCMSSignatureRequest.java create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/CreateCMSSignatureResponse.java create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/CreateCMSSignatureResponseElement.java create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/DataObjectInfo.java create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/SingleSignatureInfo.java create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/CMSSignatureResponseImpl.java create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/CreateCMSSignatureRequestImpl.java create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/CreateCMSSignatureResponseImpl.java create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/DataObjectInfoCMSImpl.java create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SingleSignatureInfoCMSImpl.java create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/CreateCMSSignatureRequestParser.java create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/CreateCMSSignatureResponseBuilder.java create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/cmssign/CMSSignatureCreationProfileImpl.java create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureCreationInvoker.java create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CreateCMSSignatureResponseBuilder.java delete mode 100644 spss/server/serverlib/src/main/resources/resources/wsdl/MOA-SPSS-1.3.wsdl delete mode 100644 spss/server/serverlib/src/main/resources/resources/wsdl/MOA-SPSS-1.3.xsd create mode 100644 spss/server/serverlib/src/main/resources/resources/wsdl/MOA-SPSS-1.5.2.wsdl create mode 100644 spss/server/serverlib/src/main/resources/resources/wsdl/MOA-SPSS-1.5.2.xsd delete mode 100644 spss/server/serverws/resources/wsdl/MOA-SPSS-1.3.wsdl delete mode 100644 spss/server/serverws/resources/wsdl/MOA-SPSS-1.3.xsd create mode 100644 spss/server/serverws/resources/wsdl/MOA-SPSS-1.5.2.wsdl create mode 100644 spss/server/serverws/resources/wsdl/MOA-SPSS-1.5.2.xsd (limited to 'spss/server/serverlib/src/main/java/at') diff --git a/.settings/org.eclipse.jdt.core.prefs b/.settings/org.eclipse.jdt.core.prefs deleted file mode 100644 index 638b39a15..000000000 --- a/.settings/org.eclipse.jdt.core.prefs +++ /dev/null @@ -1,7 +0,0 @@ -#Thu Jan 03 11:06:02 CET 2013 -eclipse.preferences.version=1 -org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.2 -org.eclipse.jdt.core.compiler.compliance=1.4 -org.eclipse.jdt.core.compiler.problem.assertIdentifier=warning -org.eclipse.jdt.core.compiler.problem.enumIdentifier=warning -org.eclipse.jdt.core.compiler.source=1.3 diff --git a/common/.settings/org.eclipse.jdt.core.prefs b/common/.settings/org.eclipse.jdt.core.prefs index 926e77f2f..c788ee346 100644 --- a/common/.settings/org.eclipse.jdt.core.prefs +++ b/common/.settings/org.eclipse.jdt.core.prefs @@ -1,13 +1,8 @@ -#Thu Dec 27 15:45:20 CET 2012 -org.eclipse.jdt.core.compiler.debug.localVariable=generate -org.eclipse.jdt.core.compiler.compliance=1.5 -org.eclipse.jdt.core.compiler.codegen.unusedLocal=preserve -org.eclipse.jdt.core.compiler.debug.sourceFile=generate -org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning -org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5 -org.eclipse.jdt.core.compiler.problem.enumIdentifier=warning -org.eclipse.jdt.core.compiler.debug.lineNumber=generate eclipse.preferences.version=1 org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled -org.eclipse.jdt.core.compiler.source=1.5 -org.eclipse.jdt.core.compiler.problem.assertIdentifier=warning +org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7 +org.eclipse.jdt.core.compiler.compliance=1.7 +org.eclipse.jdt.core.compiler.problem.assertIdentifier=error +org.eclipse.jdt.core.compiler.problem.enumIdentifier=error +org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning +org.eclipse.jdt.core.compiler.source=1.7 diff --git a/common/.settings/org.eclipse.wst.common.project.facet.core.xml b/common/.settings/org.eclipse.wst.common.project.facet.core.xml index 656f15b87..6c09452f2 100644 --- a/common/.settings/org.eclipse.wst.common.project.facet.core.xml +++ b/common/.settings/org.eclipse.wst.common.project.facet.core.xml @@ -3,5 +3,5 @@ - - \ No newline at end of file + + diff --git a/common/src/main/java/at/gv/egovernment/moa/util/Constants.java b/common/src/main/java/at/gv/egovernment/moa/util/Constants.java index 7e98f0427..120c222cf 100644 --- a/common/src/main/java/at/gv/egovernment/moa/util/Constants.java +++ b/common/src/main/java/at/gv/egovernment/moa/util/Constants.java @@ -83,7 +83,7 @@ public interface Constants { /** Local location of the MOA XML schema definition. */ public static final String MOA_SCHEMA_LOCATION = - SCHEMA_ROOT + "MOA-SPSS-1.4.7.xsd"; + SCHEMA_ROOT + "MOA-SPSS-1.5.2.xsd"; /** URI of the MOA configuration XML namespace. */ public static final String MOA_CONFIG_NS_URI = @@ -410,8 +410,6 @@ public interface Constants { public static final String SHA512_URI = "http://www.w3.org/2000/09/xmldsig#sha512"; - // TODO Supported Hash-Algorithms? - /** URI of the Canonical XML algorithm */ public static final String C14N_URI = "http://www.w3.org/TR/2001/REC-xml-c14n-20010315"; @@ -437,6 +435,11 @@ public interface Constants { */ public static final String MOA_SPSS_CREATE_XML_REQUEST = "CreateXMLSignatureRequest"; + /** + * Local name of request for creating a CMS signature. + */ + public static final String MOA_SPSS_CREATE_CMS_REQUEST = "CreateCMSSignatureRequest"; + /** * Local name of request for verifying an XML signature. */ diff --git a/common/src/main/resources/resources/schemas/MOA-SPSS-1.5.2.xsd b/common/src/main/resources/resources/schemas/MOA-SPSS-1.5.2.xsd new file mode 100644 index 000000000..de49a4c75 --- /dev/null +++ b/common/src/main/resources/resources/schemas/MOA-SPSS-1.5.2.xsd @@ -0,0 +1,541 @@ + + + + + + + + + + + + + + + + + + + + Ermöglichung der Stapelsignatur durch wiederholte Angabe dieses Elements + + + + + + + + + + + + + + + + + + + + + + Kardinalität 1..oo erlaubt die Antwort auf eine Stapelsignatur-Anfrage + + + + Resultat, falls die Signaturerstellung erfolgreich war + + + + + + + + + + + + + + + + + + + + Ermöglichung der Stapelsignatur durch wiederholte Angabe dieses Elements + + + + + + + + + + + + + + + + + + + Auswahl: Entweder explizite Angabe des Signaturorts sowie ggf. sinnvoller Supplements im Zshg. mit der Signaturumgebung, oder Verweis auf ein benanntes Profil + + + + + + + + + + + + + + + + + + Kardinalität 1..oo erlaubt die Antwort auf eine Stapelsignatur-Anfrage + + + + Resultat, falls die Signaturerstellung erfolgreich war + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + mit diesem Profil wird eine Menge von vertrauenswürdigen Wurzelzertifikaten spezifiziert + + + + + + + + + + + only ds:X509Data and RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any;publicAuthority is included as X509Data/any + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Pro dsig:Reference-Element in der zu überprüfenden XML-Signatur muss hier ein ReferenceInfo-Element erscheinen. Die Reihenfolge der einzelnen ReferenceInfo Elemente entspricht jener der dsig:Reference Elemente in der XML-Signatur. + + + + + + + + + + mit diesem Profil wird eine Menge von vertrauenswürdigen Wurzelzertifikaten spezifiziert + + + + + + + + + + + only ds:X509Data and ds:RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any; PublicAuthority is included as X509Data/any + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Auswahl: Entweder explizite Angabe EINER Transformationskette inklusive ggf. sinnvoller Supplements oder Verweis auf ein benanntes Profil + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Resultat, falls die Signaturerstellung gescheitert ist + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Ein oder mehrere Transformationswege können von der Applikation an MOA mitgeteilt werden. Die zu prüfende Signatur hat zumindest einem dieser Transformationswege zu entsprechen. Die Angabe kann explizit oder als Profilbezeichner erfolgen. + + + + + Profilbezeichner für einen Transformationsweg + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Die Angabe des Transformationsparameters (explizit oder als Hashwert) kann unterlassen werden, wenn die Applikation von der Unveränderlichkeit des Inhalts der in "Transformationsparamter", Attribut "URI" angegebenen URI ausgehen kann. + + + + Der Transformationsparameter explizit angegeben. + + + + + Der Hashwert des Transformationsparameters. + + + + + + + + + + + + + + + + + + + + + + Explizite Angabe des Transformationswegs + + + + + + + Alle impliziten Transformationsparameter, die zum Durchlaufen der oben angeführten Transformationskette bekannt sein müssen, müssen hier angeführt werden. Das Attribut "URI" bezeichnet den Transformationsparameter in exakt jener Weise, wie er in der zu überprüfenden Signatur gebraucht wird. + + + + + + + + + + + + + + + + diff --git a/id/oa/.settings/org.eclipse.jdt.core.prefs b/id/oa/.settings/org.eclipse.jdt.core.prefs index dc0892a32..c788ee346 100644 --- a/id/oa/.settings/org.eclipse.jdt.core.prefs +++ b/id/oa/.settings/org.eclipse.jdt.core.prefs @@ -1,8 +1,8 @@ eclipse.preferences.version=1 org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled -org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5 -org.eclipse.jdt.core.compiler.compliance=1.5 +org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7 +org.eclipse.jdt.core.compiler.compliance=1.7 org.eclipse.jdt.core.compiler.problem.assertIdentifier=error org.eclipse.jdt.core.compiler.problem.enumIdentifier=error org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning -org.eclipse.jdt.core.compiler.source=1.5 +org.eclipse.jdt.core.compiler.source=1.7 diff --git a/id/oa/.settings/org.eclipse.wst.common.project.facet.core.xml b/id/oa/.settings/org.eclipse.wst.common.project.facet.core.xml index fec12087a..c4dff31bf 100644 --- a/id/oa/.settings/org.eclipse.wst.common.project.facet.core.xml +++ b/id/oa/.settings/org.eclipse.wst.common.project.facet.core.xml @@ -2,6 +2,6 @@ - + diff --git a/id/server/auth/.settings/org.eclipse.wst.common.component b/id/server/auth/.settings/org.eclipse.wst.common.component index 70a85d980..a4365e482 100644 --- a/id/server/auth/.settings/org.eclipse.wst.common.component +++ b/id/server/auth/.settings/org.eclipse.wst.common.component @@ -13,13 +13,12 @@ uses - - - + + diff --git a/id/server/auth/.settings/org.eclipse.wst.common.project.facet.core.xml b/id/server/auth/.settings/org.eclipse.wst.common.project.facet.core.xml index 564572b10..ac59587b0 100644 --- a/id/server/auth/.settings/org.eclipse.wst.common.project.facet.core.xml +++ b/id/server/auth/.settings/org.eclipse.wst.common.project.facet.core.xml @@ -2,6 +2,6 @@ - - \ No newline at end of file + + diff --git a/id/server/auth/pom.xml b/id/server/auth/pom.xml index 816e41df0..d03fcdad4 100644 --- a/id/server/auth/pom.xml +++ b/id/server/auth/pom.xml @@ -23,7 +23,8 @@ org.apache.maven.plugins maven-war-plugin - 2.0.2 + 2.1.1 + diff --git a/id/server/auth/src/main/wsdl/MOA-ID-1.x.wsdl b/id/server/auth/src/main/wsdl/MOA-ID-1.x.wsdl index 5466a0b6f..1e922e081 100644 --- a/id/server/auth/src/main/wsdl/MOA-ID-1.x.wsdl +++ b/id/server/auth/src/main/wsdl/MOA-ID-1.x.wsdl @@ -1,6 +1,6 @@ - + diff --git a/id/server/doc/MOA ID 1.x.wsdl b/id/server/doc/MOA ID 1.x.wsdl index 86c08226a..e54075f24 100644 --- a/id/server/doc/MOA ID 1.x.wsdl +++ b/id/server/doc/MOA ID 1.x.wsdl @@ -1,7 +1,7 @@ - + diff --git a/id/server/idserverlib/.settings/org.eclipse.jdt.core.prefs b/id/server/idserverlib/.settings/org.eclipse.jdt.core.prefs index 735c5ab7c..c788ee346 100644 --- a/id/server/idserverlib/.settings/org.eclipse.jdt.core.prefs +++ b/id/server/idserverlib/.settings/org.eclipse.jdt.core.prefs @@ -1,13 +1,8 @@ -#Thu Dec 27 16:30:52 CET 2012 eclipse.preferences.version=1 org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled -org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5 -org.eclipse.jdt.core.compiler.codegen.unusedLocal=preserve -org.eclipse.jdt.core.compiler.compliance=1.5 -org.eclipse.jdt.core.compiler.debug.lineNumber=generate -org.eclipse.jdt.core.compiler.debug.localVariable=generate -org.eclipse.jdt.core.compiler.debug.sourceFile=generate +org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7 +org.eclipse.jdt.core.compiler.compliance=1.7 org.eclipse.jdt.core.compiler.problem.assertIdentifier=error org.eclipse.jdt.core.compiler.problem.enumIdentifier=error org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning -org.eclipse.jdt.core.compiler.source=1.5 +org.eclipse.jdt.core.compiler.source=1.7 diff --git a/id/server/idserverlib/.settings/org.eclipse.wst.common.project.facet.core.xml b/id/server/idserverlib/.settings/org.eclipse.wst.common.project.facet.core.xml index 656f15b87..6c09452f2 100644 --- a/id/server/idserverlib/.settings/org.eclipse.wst.common.project.facet.core.xml +++ b/id/server/idserverlib/.settings/org.eclipse.wst.common.project.facet.core.xml @@ -3,5 +3,5 @@ - - \ No newline at end of file + + diff --git a/id/server/idserverlib/src/main/resources/resources/wsdl/MOA-ID-1.x.wsdl b/id/server/idserverlib/src/main/resources/resources/wsdl/MOA-ID-1.x.wsdl index 45152cb38..7368691b6 100644 --- a/id/server/idserverlib/src/main/resources/resources/wsdl/MOA-ID-1.x.wsdl +++ b/id/server/idserverlib/src/main/resources/resources/wsdl/MOA-ID-1.x.wsdl @@ -1,6 +1,6 @@ - + diff --git a/id/server/proxy/.settings/org.eclipse.jdt.core.prefs b/id/server/proxy/.settings/org.eclipse.jdt.core.prefs index 862602624..dc0892a32 100644 --- a/id/server/proxy/.settings/org.eclipse.jdt.core.prefs +++ b/id/server/proxy/.settings/org.eclipse.jdt.core.prefs @@ -1,5 +1,8 @@ eclipse.preferences.version=1 +org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5 org.eclipse.jdt.core.compiler.compliance=1.5 +org.eclipse.jdt.core.compiler.problem.assertIdentifier=error +org.eclipse.jdt.core.compiler.problem.enumIdentifier=error org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning org.eclipse.jdt.core.compiler.source=1.5 diff --git a/id/server/proxy/.settings/org.eclipse.wst.common.component b/id/server/proxy/.settings/org.eclipse.wst.common.component index cc61830e7..e68415025 100644 --- a/id/server/proxy/.settings/org.eclipse.wst.common.component +++ b/id/server/proxy/.settings/org.eclipse.wst.common.component @@ -13,7 +13,8 @@ uses - + + diff --git a/id/server/proxy/.settings/org.eclipse.wst.common.project.facet.core.xml b/id/server/proxy/.settings/org.eclipse.wst.common.project.facet.core.xml index 564572b10..ac59587b0 100644 --- a/id/server/proxy/.settings/org.eclipse.wst.common.project.facet.core.xml +++ b/id/server/proxy/.settings/org.eclipse.wst.common.project.facet.core.xml @@ -2,6 +2,6 @@ - - \ No newline at end of file + + diff --git a/id/server/proxy/pom.xml b/id/server/proxy/pom.xml index 4e7ca3d3a..ca91c6139 100644 --- a/id/server/proxy/pom.xml +++ b/id/server/proxy/pom.xml @@ -21,7 +21,8 @@ org.apache.maven.plugins maven-war-plugin - 2.0.2 + 2.1.1 + diff --git a/id/templates/.classpath b/id/templates/.classpath index 767a2a2de..3f17a7f21 100644 --- a/id/templates/.classpath +++ b/id/templates/.classpath @@ -12,15 +12,15 @@ - + + - + - - + diff --git a/id/templates/.settings/org.eclipse.jdt.core.prefs b/id/templates/.settings/org.eclipse.jdt.core.prefs index ac2f76dec..c788ee346 100644 --- a/id/templates/.settings/org.eclipse.jdt.core.prefs +++ b/id/templates/.settings/org.eclipse.jdt.core.prefs @@ -1,6 +1,8 @@ -#Thu Dec 27 15:45:24 CET 2012 -org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning -org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5 eclipse.preferences.version=1 -org.eclipse.jdt.core.compiler.source=1.5 -org.eclipse.jdt.core.compiler.compliance=1.5 +org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled +org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7 +org.eclipse.jdt.core.compiler.compliance=1.7 +org.eclipse.jdt.core.compiler.problem.assertIdentifier=error +org.eclipse.jdt.core.compiler.problem.enumIdentifier=error +org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning +org.eclipse.jdt.core.compiler.source=1.7 diff --git a/id/templates/.settings/org.eclipse.wst.common.project.facet.core.xml b/id/templates/.settings/org.eclipse.wst.common.project.facet.core.xml index ac59587b0..c4dff31bf 100644 --- a/id/templates/.settings/org.eclipse.wst.common.project.facet.core.xml +++ b/id/templates/.settings/org.eclipse.wst.common.project.facet.core.xml @@ -2,6 +2,6 @@ - + diff --git a/pom.xml b/pom.xml index 1d44cd676..d2d3f7bf7 100644 --- a/pom.xml +++ b/pom.xml @@ -121,59 +121,59 @@ jaxen jaxen - 1.0-FCS + 1.0-FCS saxpath saxpath - 1.0-FCS + 1.0-FCS compile log4j log4j - 1.2.14 - runtime + 1.2.14 + compile postgresql postgresql - 7.2 + 7.2 runtime javax.mail mail - 1.4 + 1.4 commons-fileupload commons-fileupload - 1.1.1 + 1.1.1 commons-httpclient commons-httpclient - 3.1 + 3.1 dav4j dav4j - 0.1 + 0.1 compile httpsclient httpsclient - JSSE-1.0 + JSSE-1.0 compile regexp regexp - 1.3 + 1.3 diff --git a/spss/handbook/clients/api/.classpath b/spss/handbook/clients/api/.classpath index cb29bfb96..95a3df914 100644 --- a/spss/handbook/clients/api/.classpath +++ b/spss/handbook/clients/api/.classpath @@ -1,41 +1,45 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/spss/handbook/clients/api/.settings/org.eclipse.jdt.core.prefs b/spss/handbook/clients/api/.settings/org.eclipse.jdt.core.prefs index 48249af31..c788ee346 100644 --- a/spss/handbook/clients/api/.settings/org.eclipse.jdt.core.prefs +++ b/spss/handbook/clients/api/.settings/org.eclipse.jdt.core.prefs @@ -1,6 +1,8 @@ -#Thu Dec 27 15:45:23 CET 2012 -org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning -org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5 eclipse.preferences.version=1 -org.eclipse.jdt.core.compiler.source=1.5 -org.eclipse.jdt.core.compiler.compliance=1.5 +org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled +org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7 +org.eclipse.jdt.core.compiler.compliance=1.7 +org.eclipse.jdt.core.compiler.problem.assertIdentifier=error +org.eclipse.jdt.core.compiler.problem.enumIdentifier=error +org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning +org.eclipse.jdt.core.compiler.source=1.7 diff --git a/spss/handbook/clients/referencedData/.classpath b/spss/handbook/clients/referencedData/.classpath index 0173dfd90..d888b90e9 100644 --- a/spss/handbook/clients/referencedData/.classpath +++ b/spss/handbook/clients/referencedData/.classpath @@ -1,5 +1,9 @@ - - - \ No newline at end of file + + + + + + + diff --git a/spss/handbook/clients/referencedData/.settings/org.eclipse.jdt.core.prefs b/spss/handbook/clients/referencedData/.settings/org.eclipse.jdt.core.prefs index 86859a78d..c788ee346 100644 --- a/spss/handbook/clients/referencedData/.settings/org.eclipse.jdt.core.prefs +++ b/spss/handbook/clients/referencedData/.settings/org.eclipse.jdt.core.prefs @@ -1,6 +1,8 @@ -#Thu Dec 27 15:45:22 CET 2012 -org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning -org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5 eclipse.preferences.version=1 -org.eclipse.jdt.core.compiler.source=1.5 -org.eclipse.jdt.core.compiler.compliance=1.5 +org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled +org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7 +org.eclipse.jdt.core.compiler.compliance=1.7 +org.eclipse.jdt.core.compiler.problem.assertIdentifier=error +org.eclipse.jdt.core.compiler.problem.enumIdentifier=error +org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning +org.eclipse.jdt.core.compiler.source=1.7 diff --git a/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.component b/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.component index 0929e364c..2063ba643 100644 --- a/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.component +++ b/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.component @@ -1,8 +1,7 @@ - - + - \ No newline at end of file + diff --git a/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.project.facet.core.xml b/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.project.facet.core.xml index 564572b10..47b82b84e 100644 --- a/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.project.facet.core.xml +++ b/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.project.facet.core.xml @@ -3,5 +3,5 @@ - - \ No newline at end of file + + diff --git a/spss/handbook/clients/webservice/.classpath b/spss/handbook/clients/webservice/.classpath index d687b9b02..b75cb2821 100644 --- a/spss/handbook/clients/webservice/.classpath +++ b/spss/handbook/clients/webservice/.classpath @@ -12,15 +12,15 @@ - + + - + - - + diff --git a/spss/handbook/clients/webservice/.settings/org.eclipse.jdt.core.prefs b/spss/handbook/clients/webservice/.settings/org.eclipse.jdt.core.prefs index 48249af31..c788ee346 100644 --- a/spss/handbook/clients/webservice/.settings/org.eclipse.jdt.core.prefs +++ b/spss/handbook/clients/webservice/.settings/org.eclipse.jdt.core.prefs @@ -1,6 +1,8 @@ -#Thu Dec 27 15:45:23 CET 2012 -org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning -org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5 eclipse.preferences.version=1 -org.eclipse.jdt.core.compiler.source=1.5 -org.eclipse.jdt.core.compiler.compliance=1.5 +org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled +org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7 +org.eclipse.jdt.core.compiler.compliance=1.7 +org.eclipse.jdt.core.compiler.problem.assertIdentifier=error +org.eclipse.jdt.core.compiler.problem.enumIdentifier=error +org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning +org.eclipse.jdt.core.compiler.source=1.7 diff --git a/spss/handbook/clients/webservice/resources/requests/VerifyXMLSignatureRequest.FileURIs.DataObject.xml b/spss/handbook/clients/webservice/resources/requests/VerifyXMLSignatureRequest.FileURIs.DataObject.xml index 5b4b61938..26fe42d8f 100644 --- a/spss/handbook/clients/webservice/resources/requests/VerifyXMLSignatureRequest.FileURIs.DataObject.xml +++ b/spss/handbook/clients/webservice/resources/requests/VerifyXMLSignatureRequest.FileURIs.DataObject.xml @@ -3,7 +3,7 @@ xmlns="http://reference.e-government.gv.at/namespace/moa/20020822#" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - xsi:schemaLocation="http://reference.e-government.gv.at/namespace/moa/20020822# file:D:/_java/moa-idspss/trunk/common/src/main/resources/resources/schemas/MOA-SPSS-1.3.xsd + xsi:schemaLocation="http://reference.e-government.gv.at/namespace/moa/20020822# file:D:/_java/moa-idspss/trunk/common/src/main/resources/resources/schemas/MOA-SPSS-1.5.2.xsd http://www.w3.org/2000/09/xmldsig# http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsig-core-schema.xsd"> diff --git a/spss/handbook/clients/webservice/resources/requests/VerifyXMLSignatureRequest.FileURIs.ServerSupplements.xml b/spss/handbook/clients/webservice/resources/requests/VerifyXMLSignatureRequest.FileURIs.ServerSupplements.xml index 4b9fa43fe..417c29b3a 100644 --- a/spss/handbook/clients/webservice/resources/requests/VerifyXMLSignatureRequest.FileURIs.ServerSupplements.xml +++ b/spss/handbook/clients/webservice/resources/requests/VerifyXMLSignatureRequest.FileURIs.ServerSupplements.xml @@ -3,7 +3,7 @@ xmlns="http://reference.e-government.gv.at/namespace/moa/20020822#" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - xsi:schemaLocation="http://reference.e-government.gv.at/namespace/moa/20020822# file:D:/_java/moa-idspss/trunk/common/src/main/resources/resources/schemas/MOA-SPSS-1.3.xsd + xsi:schemaLocation="http://reference.e-government.gv.at/namespace/moa/20020822# file:D:/_java/moa-idspss/trunk/common/src/main/resources/resources/schemas/MOA-SPSS-1.5.2.xsd http://www.w3.org/2000/09/xmldsig# http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsig-core-schema.xsd"> diff --git a/spss/handbook/clients/webservice/resources/requests/VerifyXMLSignatureRequest.FileURIs.Supplements.xml b/spss/handbook/clients/webservice/resources/requests/VerifyXMLSignatureRequest.FileURIs.Supplements.xml index 27929cefd..ab8c1efd1 100644 --- a/spss/handbook/clients/webservice/resources/requests/VerifyXMLSignatureRequest.FileURIs.Supplements.xml +++ b/spss/handbook/clients/webservice/resources/requests/VerifyXMLSignatureRequest.FileURIs.Supplements.xml @@ -3,7 +3,7 @@ xmlns="http://reference.e-government.gv.at/namespace/moa/20020822#" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - xsi:schemaLocation="http://reference.e-government.gv.at/namespace/moa/20020822# file:D:/_java/moa-idspss/trunk/common/src/main/resources/resources/schemas/MOA-SPSS-1.3.xsd + xsi:schemaLocation="http://reference.e-government.gv.at/namespace/moa/20020822# file:D:/_java/moa-idspss/trunk/common/src/main/resources/resources/schemas/MOA-SPSS-1.5.2.xsd http://www.w3.org/2000/09/xmldsig# http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsig-core-schema.xsd"> diff --git a/spss/handbook/conf/moa-spss/trustProfiles/test/IAIK-Test-Root-CA_20080114-20180114.SerNo.01.der b/spss/handbook/conf/moa-spss/trustProfiles/test/IAIK-Test-Root-CA_20080114-20180114.SerNo.01.der new file mode 100644 index 000000000..38c2de589 Binary files /dev/null and b/spss/handbook/conf/moa-spss/trustProfiles/test/IAIK-Test-Root-CA_20080114-20180114.SerNo.01.der differ diff --git a/spss/handbook/handbook/intro/intro.html b/spss/handbook/handbook/intro/intro.html index a01a825b2..af479d2c5 100644 --- a/spss/handbook/handbook/intro/intro.html +++ b/spss/handbook/handbook/intro/intro.html @@ -32,14 +32,14 @@

      1 Allgemeines

      Die Module Serversignatur (SS) und Signaturprüfung (SP) können von Anwendungen verwendet werden, um elektronische Signaturen zu erstellen bzw. vorliegende elektronische Signaturen zu überprüfen.

      TODO: CAdES auf SL1.2x aufbauend - wie siehts mir Rest aus?

      -

      Die Funktionalität und der Aufbau der Schnittstelle zu den beiden Modulen ist in der Spezifikation MOA SP/SS (V1.3) detailliert beschrieben. Da diese Spezifikation auf der Schnittstellenspezifikation des Security-Layers (V 1.1) aufbaut, ist deren Kenntnis zum Verstehen der Schnittstellen zu SS und SP erforderlich.

      +

      Die Funktionalität und der Aufbau der Schnittstelle zu den beiden Modulen ist in der Spezifikation MOA SP/SS (V2.0) detailliert beschrieben. Da diese Spezifikation auf der Schnittstellenspezifikation des Security-Layers (V 1.2x) TODO aufbaut, ist deren Kenntnis zum Verstehen der Schnittstellen zu SS und SP erforderlich.

      2 Modul Serversignatur (SS)

      -

      Das Modul Serversignatur (SS) dient zum Erstellen von XML-Signaturen in Anlehnung an die Schnittstellenspezifikation des Security-Layers (V 1.1). Eine Signatur kann entweder rein in Software erstellt werden, oder aber unter Zuhilfenahme eines Hardware Security Modules (HSM), das den privaten Schlüssel geschützt enthält und die Signatur berechnet.

      +

      Das Modul Serversignatur (SS) dient zum Erstellen von XML-Signaturen in Anlehnung an die Schnittstellenspezifikation des Security-Layers (V 1.2x TODO). Eine Signatur kann entweder rein in Software erstellt werden, oder aber unter Zuhilfenahme eines Hardware Security Modules (HSM), das den privaten Schlüssel geschützt enthält und die Signatur berechnet.

      Der Zugriff auf einzelne Signaturschlüssel in MOA SS kann basierend auf dem für TLS-Client-Authentisierung verwendeten Zertifikat eingeschränkt werden.

      Anwendungen können das Modul entweder als Web-Service oder über ein Java-API ansprechen.

      3 Modul Signaturprüfung (SP)

      -

      Das Modul Signaturprüfung (SP) dient zum Überprüfen von XML-Signaturen und CMS-Signaturen.

      -

      Im Zuge der Verifikation einer XML-Signatur werden die Signatur, gegebenenfalls vorhandene XMLDSIG-Manifeste, als auch die Gültigkeit und Anwendbarkeit des Zertifikats überprüft. Bei XML-Signaturen kann zusätzlich überprüft werden, ob sie den speziellen Anforderungen Schnittstellenspezifikation des Security-Layers (V 1.1) entsprechen (vgl. Signaturmanifest).

      +

      Das Modul Signaturprüfung (SP) dient zum Überprüfen von XML-Signaturen und CMS-Signaturen sowie den fortgeschrittenen Signaturen XAdES (TODO Link + Versionen) und CAdES (TODO Link + Versionen).

      +

      Im Zuge der Verifikation einer XML-Signatur werden die Signatur, gegebenenfalls vorhandene XMLDSIG-Manifeste, als auch die Gültigkeit und Anwendbarkeit des Zertifikats überprüft. Bei XML-Signaturen kann zusätzlich überprüft werden, ob sie den speziellen Anforderungen Schnittstellenspezifikation des Security-Layers (V 1.2x TODO) entsprechen (vgl. Signaturmanifest).

      Anwendungen können das Modul entweder als Web-Service oder über ein Java-API ansprechen.

      diff --git a/spss/handbook/handbook/spec/MOA-SPSS-1.3.wsdl b/spss/handbook/handbook/spec/MOA-SPSS-1.3.wsdl deleted file mode 100644 index 8ae1c1ff4..000000000 --- a/spss/handbook/handbook/spec/MOA-SPSS-1.3.wsdl +++ /dev/null @@ -1,105 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/spss/handbook/handbook/spec/MOA-SPSS-1.3.xsd b/spss/handbook/handbook/spec/MOA-SPSS-1.3.xsd deleted file mode 100644 index 756b51279..000000000 --- a/spss/handbook/handbook/spec/MOA-SPSS-1.3.xsd +++ /dev/null @@ -1,469 +0,0 @@ - - - - - - - - - - - - - - - - - - - - Ermöglichung der Stapelsignatur durch wiederholte Angabe dieses Elements - - - - - - - - - - - - - - - - - - - Auswahl: Entweder explizite Angabe des Signaturorts sowie ggf. sinnvoller Supplements im Zshg. mit der Signaturumgebung, oder Verweis auf ein benanntes Profil - - - - - - - - - - - - - - - - - - Kardinalität 1..oo erlaubt die Antwort auf eine Stapelsignatur-Anfrage - - - - Resultat, falls die Signaturerstellung erfolgreich war - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - mit diesem Profil wird eine Menge von vertrauenswürdigen Wurzelzertifikaten spezifiziert - - - - - - - - - - - only ds:X509Data and RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any;publicAuthority is included as X509Data/any - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Pro dsig:Reference-Element in der zu überprüfenden XML-Signatur muss hier ein ReferenceInfo-Element erscheinen. Die Reihenfolge der einzelnen ReferenceInfo Elemente entspricht jener der dsig:Reference Elemente in der XML-Signatur. - - - - - - - - - - mit diesem Profil wird eine Menge von vertrauenswürdigen Wurzelzertifikaten spezifiziert - - - - - - - - - - - only ds:X509Data and ds:RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any; PublicAuthority is included as X509Data/any - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Auswahl: Entweder explizite Angabe EINER Transformationskette inklusive ggf. sinnvoller Supplements oder Verweis auf ein benanntes Profil - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Resultat, falls die Signaturerstellung gescheitert ist - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Ein oder mehrere Transformationswege können von der Applikation an MOA mitgeteilt werden. Die zu prüfende Signatur hat zumindest einem dieser Transformationswege zu entsprechen. Die Angabe kann explizit oder als Profilbezeichner erfolgen. - - - - - Profilbezeichner für einen Transformationsweg - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Die Angabe des Transformationsparameters (explizit oder als Hashwert) kann unterlassen werden, wenn die Applikation von der Unveränderlichkeit des Inhalts der in "Transformationsparamter", Attribut "URI" angegebenen URI ausgehen kann. - - - - Der Transformationsparameter explizit angegeben. - - - - - Der Hashwert des Transformationsparameters. - - - - - - - - - - - - - - - - - - - - - - Explizite Angabe des Transformationswegs - - - - - - - Alle impliziten Transformationsparameter, die zum Durchlaufen der oben angeführten Transformationskette bekannt sein müssen, müssen hier angeführt werden. Das Attribut "URI" bezeichnet den Transformationsparameter in exakt jener Weise, wie er in der zu überprüfenden Signatur gebraucht wird. - - - - - - - - - - - - - - - - diff --git a/spss/handbook/handbook/spec/MOA-SPSS-1.5.2.wsdl b/spss/handbook/handbook/spec/MOA-SPSS-1.5.2.wsdl new file mode 100644 index 000000000..135f26f68 --- /dev/null +++ b/spss/handbook/handbook/spec/MOA-SPSS-1.5.2.wsdl @@ -0,0 +1,128 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/spss/handbook/handbook/spec/MOA-SPSS-1.5.2.xsd b/spss/handbook/handbook/spec/MOA-SPSS-1.5.2.xsd new file mode 100644 index 000000000..137ad6deb --- /dev/null +++ b/spss/handbook/handbook/spec/MOA-SPSS-1.5.2.xsd @@ -0,0 +1,474 @@ + + + + + + + + + + + + + + + + + + + + + + + + + Ermöglichung der Stapelsignatur durch wiederholte Angabe dieses Elements + + + + + + + + + + + + + + + + + + + Auswahl: Entweder explizite Angabe des Signaturorts sowie ggf. sinnvoller Supplements im Zshg. mit der Signaturumgebung, oder Verweis auf ein benanntes Profil + + + + + + + + + + + + + + + + + + Kardinalität 1..oo erlaubt die Antwort auf eine Stapelsignatur-Anfrage + + + + Resultat, falls die Signaturerstellung erfolgreich war + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + mit diesem Profil wird eine Menge von vertrauenswürdigen Wurzelzertifikaten spezifiziert + + + + + + + + + + + only ds:X509Data and RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any;publicAuthority is included as X509Data/any + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Pro dsig:Reference-Element in der zu überprüfenden XML-Signatur muss hier ein ReferenceInfo-Element erscheinen. Die Reihenfolge der einzelnen ReferenceInfo Elemente entspricht jener der dsig:Reference Elemente in der XML-Signatur. + + + + + + + + + + mit diesem Profil wird eine Menge von vertrauenswürdigen Wurzelzertifikaten spezifiziert + + + + + + + + + + + only ds:X509Data and ds:RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any; PublicAuthority is included as X509Data/any + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Auswahl: Entweder explizite Angabe EINER Transformationskette inklusive ggf. sinnvoller Supplements oder Verweis auf ein benanntes Profil + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Resultat, falls die Signaturerstellung gescheitert ist + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Ein oder mehrere Transformationswege können von der Applikation an MOA mitgeteilt werden. Die zu prüfende Signatur hat zumindest einem dieser Transformationswege zu entsprechen. Die Angabe kann explizit oder als Profilbezeichner erfolgen. + + + + + Profilbezeichner für einen Transformationsweg + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Die Angabe des Transformationsparameters (explizit oder als Hashwert) kann unterlassen werden, wenn die Applikation von der Unveränderlichkeit des Inhalts der in "Transformationsparamter", Attribut "URI" angegebenen URI ausgehen kann. + + + + Der Transformationsparameter explizit angegeben. + + + + + Der Hashwert des Transformationsparameters. + + + + + + + + + + + + + + + + + + + + + + Explizite Angabe des Transformationswegs + + + + + + + Alle impliziten Transformationsparameter, die zum Durchlaufen der oben angeführten Transformationskette bekannt sein müssen, müssen hier angeführt werden. Das Attribut "URI" bezeichnet den Transformationsparameter in exakt jener Weise, wie er in der zu überprüfenden Signatur gebraucht wird. + + + + + + + + + + + + + + + + diff --git a/spss/handbook/handbook/usage/usage.html b/spss/handbook/handbook/usage/usage.html index bafb6da29..4d14ab917 100644 --- a/spss/handbook/handbook/usage/usage.html +++ b/spss/handbook/handbook/usage/usage.html @@ -85,7 +85,8 @@

      2 Verwendung des Webservices

      Dieser Abschnitt beschreibt die Verwendung der Module SP und SS über die Webservice-Schnittstelle. Im ersten Unterabschnitt werden typische XML-Requests zur Signaturerstellung mittels SS bzw. zur Signaturprüfung mittels SP vorgestellt, wie sie an das Webservice gesendet werden können. Der zweite Unterabschnitt stellt beispielhafte Implementierungen eines Webservice-Clients in Java vor, mit dem die Requests aus dem ersten Unterabschnitt an das Webservice gesendet werden können.

      2.1 XML-Requests

      -

      Dieser Abschnitt stellt typische XML-Requests für die Erstellung einer XML-Signatur mittels SS bzw. zur Prüfung einer CMS- bzw. XML-Signatur mittels SP vor. Zu jedem Request wird jeweils auch eine typische Response des Services besprochen.

      +

      TODO: Auch plain CMS unterstützt?

      +

      Dieser Abschnitt stellt typische XML-Requests für die Erstellung einer XML/XAdES- und CMS/CAdES-Signatur mittels SS bzw. zur Prüfung einer CMS/CAdES- bzw. XML/XAdES-Signatur mittels SP vor. Zu jedem Request wird jeweils auch eine typische Response des Services besprochen.

      Bitte beachten Sie: Einige der vorgestellten Requests referenzieren beispielhafte Daten auf localhost, z.B. http://localhost:8080/referencedData/Text.txt. Wenn Sie diese Beispiele ausprobieren möchten, müssen Sie dafür sorgen, dass MOA SS bzw. SP diese Daten auch tatsächlich auflösen kann. Wenn Sie Ihre Tomcat-Installation auf localhost:8080 betreiben, ist es ausreichend, wenn sie die diesem Handbuch beiliegende Webapplikation referencedData.war in das Verzeichnis webapps Ihrer Tomcat-Installation kopieren. Ansonsten müssen Sie zusätzlich die URLs in den Requests anpassen.

      2.1.1 Erstellung einer CMS bzw. CAdES-Signatur

      2.1.1.1 Einfaches Beispiel

      @@ -95,7 +96,7 @@

      TODO

      2.1.2 Erstellung einer XML bzw. XAdES-Signatur

      -

      MOA-SS ermöglicht die Erstellung einer herkömmlichen XML-Signatur und einer XAdES-Signatur gemäß der Security-Layer Spezifikation V1.1. Die Auswahl ob eine herkömmliche XML oder eine Security-Layer konforme XAdES-Signatur erstellt wird, erfolgt durch das Attribute SecurityLayerConformity im Signaturerstelltungs-Request (siehe auch folgende Beispiele).

      +

      MOA-SS ermöglicht die Erstellung einer herkömmlichen XML-Signatur und einer XAdES-Signatur gemäß der Security-Layer Spezifikation V1.2x. Die Auswahl ob eine herkömmliche XML oder eine Security-Layer konforme XAdES-Signatur erstellt wird, erfolgt durch das Attribute SecurityLayerConformity im Signaturerstelltungs-Request (siehe auch folgende Beispiele).

      Im Falle einer XAdES-Signatur, kann entweder eine XAdES-Signatur in der Version 1.1.1 oder in der Version 1.4.2 erstellt werden. Dies hängt von der in der MOA-SS Konfiguration angegeben XAdES-Version ab (siehe hierzu Konfiguration der XAdES Version).

      2.1.2.1 Einfaches Beispiel

      Request
      @@ -103,7 +104,7 @@ 
        <KeyIdentifier>KG_allgemein</KeyIdentifier>

      KG_allgemein bezeichnet eine Schlüsselgruppe, aus der SS einen Signaturschlüssel selektieren soll und muss einer in der SP/SS-Konfigurationsdatei definierten Schlüsselgruppe entsprechen. 

        <SingleSignatureInfo SecurityLayerConformity="false">
      -

      Für jedes SingleSignatureInfoElement wird eine eigene XML-Signatur erzeugt. Wird das Attribut SecurityLayerConformity auf true gesetzt, dann wird eine XML-Signatur gemäß Security-Layer Spezifikation V1.1 erzeugt; d.h. es werden signierte Properties (Zeitpunkt der Signaturerstellung, das für die Signaturüberprüfung zu verwendende Zertifikat, Metainformationen zu den signierten Datenobjekten) und ein Manifest, das alle implizite Transformationsparameter enthält, zur Signatur hinzugefügt (=eine XAdES Signatur).

      +

      Für jedes SingleSignatureInfoElement wird eine eigene XML-Signatur erzeugt. Wird das Attribut SecurityLayerConformity auf true gesetzt, dann wird eine XML-Signatur gemäß Security-Layer Spezifikation V1.2x TODO erzeugt; d.h. es werden signierte Properties (Zeitpunkt der Signaturerstellung, das für die Signaturüberprüfung zu verwendende Zertifikat, Metainformationen zu den signierten Datenobjekten) und ein Manifest, das alle implizite Transformationsparameter enthält, zur Signatur hinzugefügt (=eine XAdES Signatur).

          <DataObjectInfo Structure="enveloping">
       <DataObject>
         <XMLContent>Diese Daten werden signiert.<XMLContent>
@@ -652,19 +653,19 @@ O=A-Trust Ges. für Sicherheitssysteme im elektr. Datenverkehr GmbH,C=AT<

      Die Response enthält zunächst in SignerInfo/dsig:X509Data Informationen über den Signator, die aus dem in der CMS-Signatur enthaltenen Signatorzertifikat entnommen sind.

      dsig:X509SubjectName ist immer vorhanden und enthält den Namen des Signators. dsig:X509IssuerSerial ist ebenfalls immer vorhanden und enthält den Namen des Austellers des Signatorzertifikats (dsig:X509IssuerName) sowie die Seriennummer des Zertifikats (dsig:X509SerialNumber). Auch dsig:X509Certificate ist immer vorhanden und enthält das Signatorzertifikat in base64 kodierter Form.

      -

      Optional vorhanden ist das inhaltslose Element QualifiedCertificate, und zwar dann, wenn es sich beim Signatorzertifikat um ein qualifiziertes Zertifikat handelt. Ebenfalls optional vorhanden ist schließlich - in diesem Beispiel nicht ersichtlich - das Element PublicAuthority, und zwar dann, wenn das Signatorzertifikat die österreichspezifische Zertifikatserweiterung Verwaltungseigenschaft aufweist. Ist in dieser Zertifikatserweiterung das Verwaltungskennzeichen mitkodiert, wird dieses Kennzeichen als Textinhalt des optionalen Elements PublicAuthority/Code geliefert.

      +

      Optional vorhanden ist das inhaltslose Element QualifiedCertificate, und zwar dann, wenn es sich beim Signatorzertifikat um ein qualifiziertes Zertifikat handelt. Ebenfalls optional vorhanden ist schließlich - in diesem Beispiel nicht ersichtlich - das Element PublicAuthority, und zwar dann, wenn das Signatorzertifikat die österreichspezifische Zertifikatserweiterung Verwaltungseigenschaft aufweist. Ist in dieser Zertifikatserweiterung das Verwaltungskennzeichen mitkodiert, wird dieses Kennzeichen als Textinhalt des optionalen Elements PublicAuthority/Code geliefert.

         <SignatureCheck>
     <Code>0</Code>
   </SignatureCheck>
      -

      Anschließend an SignerInfo enthält die Response mit SignatureCheck/Code das Resultat der kryptographischen Prüfung der Signatur. In unserem Beispiel ist dort der Wert 0 enthalten, d. h. die Signatur konnte erfolgreich validiert werden. Für eine Übersicht der möglichen Kodes siehe Security-Layer 1.2.

      +

      Anschließend an SignerInfo enthält die Response mit SignatureCheck/Code das Resultat der kryptographischen Prüfung der Signatur. In unserem Beispiel ist dort der Wert 0 enthalten, d. h. die Signatur konnte erfolgreich validiert werden. Für eine Übersicht der möglichen Kodes siehe Security-Layer 1.2x TODO.

         <CertificateCheck>
     <Code>1</Code>
   </CertificateCheck>
      -

      Abschließend enthält die Response mit CertificateCheck/Code das Resultat der Prüfung des Signatorzertifikats. Zunächst prüft MOA SP, ob ausgehend vom Signatorzertifikat eine Zertifikatskette zu einem im zugehörigen Vertrauensprofil konfigurierten sog. Trust Anchor gebildet werden kann. Gelingt dies, wird die Gültigkeit jedes Zertifikats dieser Kette überprüft. In unserem Beispiel enthält Code den Wert 1, d. h. MOA SP konnte die oben erläuterte Zertifikatskette nicht bilden. Für eine Übersicht der möglichen Kodes siehe Security-Layer 1.2.

      +

      Abschließend enthält die Response mit CertificateCheck/Code das Resultat der Prüfung des Signatorzertifikats. Zunächst prüft MOA SP, ob ausgehend vom Signatorzertifikat eine Zertifikatskette zu einem im zugehörigen Vertrauensprofil konfigurierten sog. Trust Anchor gebildet werden kann. Gelingt dies, wird die Gültigkeit jedes Zertifikats dieser Kette überprüft. In unserem Beispiel enthält Code den Wert 1, d. h. MOA SP konnte die oben erläuterte Zertifikatskette nicht bilden. Für eine Übersicht der möglichen Kodes siehe Security-Layer 1.2x TODO.

      2.1.3.2 Erweitertes Beispiel

      Request

      Dieses erweiterte Beispiel zur Prüfung einer CMS-Signatur (VerifyCMSSignatureRequest.Extended.xml) demonstriert die Prüfung mehrerer Signatoren einer CMS-Signatur, die Angabe des Prüfzeitpunkts sowie die Prüfung einer Detached Signature, d. h. einer Signatur, in der die signierten Daten nicht enthalten sind und daher extra angegeben werden müssen.

      @@ -750,19 +751,19 @@ O=A-Trust Ges. für Sicherheitssysteme im elektr. Datenverkehr GmbH,C=AT<

      Die Response enthält zunächst in SignerInfo/dsig:X509Data Informationen über den Signator, die aus dem in der XML-Signatur enthaltenen Signatorzertifikat entnommen sind.

      dsig:X509SubjectName ist immer vorhanden und enthält den Namen des Signators. dsig:X509IssuerSerial ist ebenfalls immer vorhanden und enthält den Namen des Austellers des Signatorzertifikats (dsig:X509IssuerName) sowie die Seriennummer des Zertifikats (dsig:X509SerialNumber). Auch dsig:X509Certificate ist ist immer vorhanden und enthält das Signatorzertifikat in base64 kodierter Form.

      -

      Optional vorhanden - in diesem Beispiel nicht ersichtlich - ist das inhaltslose Element QualifiedCertificate, und zwar dann, wenn es sich beim Signatorzertifikat um ein qualifiziertes Zertifikat handelt. Ebenfalls optional vorhanden ist schließlich das Element PublicAuthority, und zwar dann, wenn das Signatorzertifikat die österreichspezifische Zertifikatserweiterung Verwaltungseigenschaft aufweist. Ist in dieser Zertifikatserweiterung das Verwaltungskennzeichen mitkodiert, wird dieses Kennzeichen als Textinhalt des optionalen Elements PublicAuthority/Code geliefert.

      +

      Optional vorhanden - in diesem Beispiel nicht ersichtlich - ist das inhaltslose Element QualifiedCertificate, und zwar dann, wenn es sich beim Signatorzertifikat um ein qualifiziertes Zertifikat handelt. Ebenfalls optional vorhanden ist schließlich das Element PublicAuthority, und zwar dann, wenn das Signatorzertifikat die österreichspezifische Zertifikatserweiterung Verwaltungseigenschaft aufweist. Ist in dieser Zertifikatserweiterung das Verwaltungskennzeichen mitkodiert, wird dieses Kennzeichen als Textinhalt des optionalen Elements PublicAuthority/Code geliefert.

         <SignatureCheck>
     <Code>0</Code>
   </SignatureCheck>
      -

      Anschließend an SignerInfo enthält die Response mit SignatureCheck/Code das Resultat der kryptographischen Prüfung der Signatur. In unserem Beispiel ist dort der Wert 0 enthalten, d. h. die Signatur konnte erfolgreich validiert werden. Für eine Übersicht der möglichen Kodes siehe Security-Layer 1.2.

      +

      Anschließend an SignerInfo enthält die Response mit SignatureCheck/Code das Resultat der kryptographischen Prüfung der Signatur. In unserem Beispiel ist dort der Wert 0 enthalten, d. h. die Signatur konnte erfolgreich validiert werden. Für eine Übersicht der möglichen Kodes siehe Security-Layer 1.2x TODO.

         <CertificateCheck>
     <Code>0</Code>
   </CertificateCheck>
      -

      Abschließend enthält die Response mit CertificateCheck/Code das Resultat der Prüfung des Signatorzertifikats. Zunächst prüft MOA SP, ob ausgehend vom Signatorzertifikat eine Zertifikatskette zu einem im zugehörigen Vertrauensprofil konfigurierten sog. Trust Anchor gebildet werden kann. Gelingt dies, wird die Gültigkeit jedes Zertifikats dieser Kette überprüft. In unserem Beispiel enthält Code den Wert 0, d. h. MOA SP konnte die Kette bilden, und alle Zertifikate der Kette sind gültig. Für eine Übersicht der möglichen Kodes siehe Security-Layer 1.2.

      +

      Abschließend enthält die Response mit CertificateCheck/Code das Resultat der Prüfung des Signatorzertifikats. Zunächst prüft MOA SP, ob ausgehend vom Signatorzertifikat eine Zertifikatskette zu einem im zugehörigen Vertrauensprofil konfigurierten sog. Trust Anchor gebildet werden kann. Gelingt dies, wird die Gültigkeit jedes Zertifikats dieser Kette überprüft. In unserem Beispiel enthält Code den Wert 0, d. h. MOA SP konnte die Kette bilden, und alle Zertifikate der Kette sind gültig. Für eine Übersicht der möglichen Kodes siehe Security-Layer 1.2x TODO.

      2.1.4.2 Erweitertes Beispiel

      Request

      Dieses erweiterte Beispiel zur Prüfung einer XML-Signatur (VerifyXMLSignatureRequest.Enveloped.xml) demonstriert die Prüfung einer Enveloped Signature, d. h. einer Signatur, die in ein XML-Dokument integriert ist, die Angabe des Prüfzeitpunkts sowie die Anweisung an MOA SP, in der Response die von der Signatur abgedeckten Daten zu retournieren.

      @@ -898,7 +899,7 @@ positive Ganzzahl repräsentiert, die auf das beinhaltende dsig:Manife </XMLDSIGManifestCheck>

      Neu ist in dieser Response das an SignatureCheck anschließende Element XMLDSIGManifestCheck. Ein oder mehrere solche Elemente werden immer dann zurückgeliefert, wenn in dsig:SignedInfo der XML-Signatur dsig:Reference Elemente existieren, die sich auf ein Manifest nach XMLDSIG beziehen (siehe oben). Je solcher dsig:Reference enthält die Antwort ein korrespondierendes Element XMLDSIGManifestCheck, im konkreten Beispiel als eines.

      -

      Das Element Code gibt das Ergebnis der durchgeführten Prüfung des XMLDSIG-Manifests an. In diesem Fall bedeutet 0, dass die Prüfung jeder dsig:Reference im dsig:Manifest (im konkreten Beispiel also genau einer dsig:Reference) erfolgreich durchgeführt werden konnte. Für eine Übersicht der möglichen Kodes siehe Security-Layer 1.2.

      +

      Das Element Code gibt das Ergebnis der durchgeführten Prüfung des XMLDSIG-Manifests an. In diesem Fall bedeutet 0, dass die Prüfung jeder dsig:Reference im dsig:Manifest (im konkreten Beispiel also genau einer dsig:Reference) erfolgreich durchgeführt werden konnte. Für eine Übersicht der möglichen Kodes siehe Security-Layer 1.2x TODO.

      Das Element Info/ReferringSigReference enthält als Textinhalt die Nummer jenes dsig:Reference Elements in dsig:SignedInfo der XML-Signatur, welches auf das untersuchte Manifest nach XMLDSIG verweist, wobei mit 1 zu zählen begonnen wird.

         <CertificateCheck>
@@ -1130,7 +1131,7 @@ Ich habe weiters ein eigenens ID-Attribut bekommen.</doc:Paragraph>
     <Code>0</Code>
   </SignatureManifestCheck>
      -

      Das Element SignatureManifestCheck enhält das Resultat der Prüfung des Zusammenhangs zwischen Referenz-Eingangsdaten und Hash-Eingangsdaten. Der Kode 0 im konkreten Beispiel bedeutet, dass alle Referenzen die in der Anfrage zur Überprüfung der XML-Signatur gemachten Einschränkungen bezüglich der erlaubten Transformationskette(n) einhalten, sowie dass die Anforderungen hinsichtlich des Signaturmanifests werden eingehalten. Für eine Übersicht der möglichen Kodes siehe die Spezifikation zu MOA SP/SS, Abschnitt 5.1.3.1.4.

      +

      Das Element SignatureManifestCheck enhält das Resultat der Prüfung des Zusammenhangs zwischen Referenz-Eingangsdaten und Hash-Eingangsdaten. Der Kode 0 im konkreten Beispiel bedeutet, dass alle Referenzen die in der Anfrage zur Überprüfung der XML-Signatur gemachten Einschränkungen bezüglich der erlaubten Transformationskette(n) einhalten, sowie dass die Anforderungen hinsichtlich des Signaturmanifests werden eingehalten. Für eine Übersicht der möglichen Kodes siehe die Spezifikation zu MOA SP/SS (Link TODO), Abschnitt 5.1.3.1.4.

         <CertificateCheck>
     <Code>0</Code>
diff --git a/spss/server/serverlib/.settings/org.eclipse.jdt.core.prefs b/spss/server/serverlib/.settings/org.eclipse.jdt.core.prefs
index 81f1dbf57..dc0892a32 100644
--- a/spss/server/serverlib/.settings/org.eclipse.jdt.core.prefs
+++ b/spss/server/serverlib/.settings/org.eclipse.jdt.core.prefs
@@ -1,12 +1,7 @@
-#Thu Dec 27 13:40:40 CET 2012
 eclipse.preferences.version=1
 org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
 org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5
-org.eclipse.jdt.core.compiler.codegen.unusedLocal=preserve
 org.eclipse.jdt.core.compiler.compliance=1.5
-org.eclipse.jdt.core.compiler.debug.lineNumber=generate
-org.eclipse.jdt.core.compiler.debug.localVariable=generate
-org.eclipse.jdt.core.compiler.debug.sourceFile=generate
 org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
 org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
 org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
diff --git a/spss/server/serverlib/.settings/org.eclipse.wst.common.project.facet.core.xml b/spss/server/serverlib/.settings/org.eclipse.wst.common.project.facet.core.xml
index 656f15b87..69dc9cc0f 100644
--- a/spss/server/serverlib/.settings/org.eclipse.wst.common.project.facet.core.xml
+++ b/spss/server/serverlib/.settings/org.eclipse.wst.common.project.facet.core.xml
@@ -3,5 +3,5 @@
   
   
   
-  
-
\ No newline at end of file
+  
+
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/SPSSFactory.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/SPSSFactory.java
index fbf40be88..26cce1a82 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/SPSSFactory.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/SPSSFactory.java
@@ -35,6 +35,9 @@ import org.apache.commons.discovery.tools.DiscoverClass;
 import org.w3c.dom.Element;
 import org.w3c.dom.NodeList;
 
+import at.gv.egovernment.moa.spss.api.cmssign.CMSSignatureResponse;
+import at.gv.egovernment.moa.spss.api.cmssign.CreateCMSSignatureRequest;
+import at.gv.egovernment.moa.spss.api.cmssign.CreateCMSSignatureResponse;
 import at.gv.egovernment.moa.spss.api.cmsverify.CMSContent;
 import at.gv.egovernment.moa.spss.api.cmsverify.CMSDataObject;
 import at.gv.egovernment.moa.spss.api.cmsverify.VerifyCMSSignatureRequest;
@@ -137,6 +140,26 @@ public abstract class SPSSFactory {
     String keyIdentifier,
     List singleSignatureInfos);
 
+  /**
+   * Create a new CreateCMSSignatureRequest object.
+   * 
+   * @param keyIdentifier The identifier for the key group to use for signing.
+   * @param singleSignatureInfos A List of 
+   * SingleSignatureInfo objects containing information about a
+   * single signature to be created.
+   * @return The CreateCMSSignatureRequest containing the above
+   * data.
+   * 
+   * @pre keyIdentifier != null && keyIdentifier.length() > 0
+   * @pre singleSignatureInfos != null
+   * @pre forall Object o in singleSignatureInfos | 
+   *        o instanceof at.gv.egovernment.moa.spss.api.common.SingleSignatureInfo 
+   * @post return != null
+   */
+  public abstract CreateCMSSignatureRequest createCreateCMSSignatureRequest(
+    String keyIdentifier,
+    List singleSignatureInfos);
+  
   /**
    * Create a new SingleSignatureInfo object.
    * 
@@ -156,6 +179,23 @@ public abstract class SPSSFactory {
   public abstract SingleSignatureInfo createSingleSignatureInfo(
     List dataObjectInfos,
     CreateSignatureInfo createSignatureInfo, boolean securityLayerConform);
+  
+  /**
+   * Create a new SingleSignatureInfo object.
+   * 
+   * @param dataObjectInfo The data object that will be signed.
+   * @param securityLayerConform If true, a Security Layer conform
+   * signature manifest is created, otherwise not.
+   * @return The SingleSignatureInfo containing the above data.
+   * 
+   * @post return != null
+   */
+  public abstract at.gv.egovernment.moa.spss.api.cmssign.SingleSignatureInfo createSingleSignatureInfoCMS(	
+    at.gv.egovernment.moa.spss.api.cmssign.DataObjectInfo dataObjectInfo,
+    boolean securityLayerConform);
+  
+
+  
 
   /**
    * Create a new DataObjectInfo object.
@@ -181,6 +221,22 @@ public abstract class SPSSFactory {
     Content dataObject,
     CreateTransformsInfoProfile createTransformsInfoProfile);
 
+  /**
+   * Create a new DataObjectInfo object.
+   * 
+   * @param structure The type of signature to create.
+   * @param dataObject The data object that will be signed.
+   * @return The DataObjectInfo containing the above data.
+   * 
+   * @pre DataObjectInfo.STRUCTURE_DETACHED.equals(structure) ||
+   *      DataObjectInfo.STRUCTURE_ENVELOPING.equals(structure)
+   * @pre dataObject != null
+   * @post return != null
+   */
+  public abstract at.gv.egovernment.moa.spss.api.cmssign.DataObjectInfo createDataObjectInfo(
+    String structure,
+    CMSDataObject dataObject);
+  
   /**
    * Create a new CreateTransformsInfoProfile object containing a
    * reference to a locally stored profile.
@@ -321,6 +377,37 @@ public abstract class SPSSFactory {
    */
   public abstract CreateXMLSignatureResponse createCreateXMLSignatureResponse(List responseElements);
 
+  
+  /**
+   * Create a new CreateCMSSignatureResponse object.
+   * 
+   * @param responseElements The elements of the response, either 
+   * CMSSignatureResponse objects, or 
+   * ErrorResponse objects.
+   * @return The new CreateCMSSignatureResponse containing the
+   * above data.
+   * 
+   * @pre responseElements != null && responseElements.size() > 0
+   * @pre forall Object o in responseElements | 
+   *        o instanceof at.gv.egovernment.moa.spss.api.cmssign.CMSSignatureResponse
+   * @post return != null
+   */
+  public abstract CreateCMSSignatureResponse createCreateCMSSignatureResponse(List responseElements);
+  
+  
+  /**
+   * Create a new SignatureEnvironmentResponse object.
+   * 
+   * @param signatureEnvironment The signature environment containing the
+   * signature.
+   * @return The SignatureEnvironmentResponse containing the
+   * signatureEnvironment.
+   * 
+   * @pre signatureEnvironment != null
+   * @post return != null
+   */
+  public abstract CMSSignatureResponse createCMSSignatureResponse(String base64value);
+  
   /**
    * Create a new SignatureEnvironmentResponse object.
    * 
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/CMSSignatureResponse.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/CMSSignatureResponse.java
new file mode 100644
index 000000000..10db67627
--- /dev/null
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/CMSSignatureResponse.java
@@ -0,0 +1,41 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-SPSS has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.spss.api.cmssign;
+
+
+/**
+ * Contains the signature if the signature creation was successful.
+ *  
+ * @version $Id$
+ */
+public interface CMSSignatureResponse
+  extends CreateCMSSignatureResponseElement {
+  /** 
+   * Gets the CMS signature (Base64 encoded).
+   * 
+   * @return The CMS signature
+   */
+  public String getCMSSignature();
+}
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/CreateCMSSignatureRequest.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/CreateCMSSignatureRequest.java
new file mode 100644
index 000000000..9d5cd7a0d
--- /dev/null
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/CreateCMSSignatureRequest.java
@@ -0,0 +1,49 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-SPSS has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.spss.api.cmssign;
+
+import java.util.List;
+
+
+/**
+ * Object that encapsulates a request to create a CMS Signature.
+ * 
+ * 
+ * @version $Id$
+ */
+public interface CreateCMSSignatureRequest {
+  /**
+   * Gets the identifier for the keys to be used for the signature.
+   * 
+   * @return The identifier for the keys to be used.
+   */
+  public String getKeyIdentifier();
+  /**
+   * Gets the information of the singleSignatureInfo elements. 
+   * 
+   * @return The information of singleSignatureInfo elements.
+   */
+  public List getSingleSignatureInfos();
+}
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/CreateCMSSignatureResponse.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/CreateCMSSignatureResponse.java
new file mode 100644
index 000000000..6062a1162
--- /dev/null
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/CreateCMSSignatureResponse.java
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-SPSS has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.spss.api.cmssign;
+
+import java.util.List;
+
+/**
+ * Object that encapsulates the response on to a 
+ * CreateCMSSignatureRequest to create an XML signature.
+ * 
+ * @version $Id$
+ */
+public interface CreateCMSSignatureResponse {
+  /**
+   * Gets the response elements.
+   * 
+   * @return The response elements.
+   */
+  public List getResponseElements();
+}
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/CreateCMSSignatureResponseElement.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/CreateCMSSignatureResponseElement.java
new file mode 100644
index 000000000..8e4e61145
--- /dev/null
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/CreateCMSSignatureResponseElement.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-SPSS has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.spss.api.cmssign;
+
+/**
+ * Base class for CMSSignature and 
+ * ErrorResponse elements in a 
+ * CreateXMLSignatureResponse.
+ * 
+ * @version $Id$
+ */
+public interface CreateCMSSignatureResponseElement {
+  /**
+   * Indicates that this object contains a CMSSignature.
+   */
+  public static final int CMS_SIGNATURE = 0;
+  /**
+   * Indicates that this objet contains an ErrorResponse.
+   */
+  public static final int ERROR_RESPONSE = 1;
+  
+  /**
+   * Gets the type of response object.
+   * 
+   * @return The type of response object, either 
+   * CMS_SIGNATURE or ERROR_RESPONSE.
+   */
+  public int getResponseType();
+}
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/DataObjectInfo.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/DataObjectInfo.java
new file mode 100644
index 000000000..b9f363061
--- /dev/null
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/DataObjectInfo.java
@@ -0,0 +1,58 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-SPSS has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.spss.api.cmssign;
+
+import at.gv.egovernment.moa.spss.api.cmsverify.CMSDataObject;
+
+/**
+ * Encapsulates information required to create a single signature.
+ * 
+ * @version $Id$
+ */
+public interface DataObjectInfo {
+  /**
+   * Indicates that a detached signature will be created.
+   */
+  public static final String STRUCTURE_DETACHED = "detached"; 
+  /**
+   * Indicates that an enveloping signature will be created.
+   */
+  public static final String STRUCTURE_ENVELOPING = "enveloping";
+
+  /**
+   * Gets the structure of the signature.
+   * 
+   * @return The structure of the signature.
+   */
+  public String getStructure();
+
+  /**
+   * Gets information related to a single data object.
+   * 
+   * @return Information related to a single data object.
+   */
+  public CMSDataObject getDataObject();
+  
+}
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/SingleSignatureInfo.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/SingleSignatureInfo.java
new file mode 100644
index 000000000..1f87a50ca
--- /dev/null
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/cmssign/SingleSignatureInfo.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-SPSS has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.spss.api.cmssign;
+
+
+
+/**
+ * Encapsulates data to create a single signature.
+ * 
+ * @author Patrick Peck
+ * @author Stephan Grill
+ * @version $Id$
+ */
+public interface SingleSignatureInfo {
+  /**
+   * Gets the dataObjectInfo information.
+   * 
+   * @return The dataObjectInfo information.
+   */
+  public DataObjectInfo getDataObjectInfo();
+  
+  /**
+   * Check whether a Security Layer conform signature manifest will be created.
+   * 
+   * @return true, if a Security Layer conform signature manifest 
+   * will be created, false otherwise.
+   */
+  public boolean isSecurityLayerConform();
+}
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/CMSSignatureResponseImpl.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/CMSSignatureResponseImpl.java
new file mode 100644
index 000000000..b512dd0bd
--- /dev/null
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/CMSSignatureResponseImpl.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-SPSS has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.spss.api.impl;
+
+import org.w3c.dom.Element;
+
+import at.gv.egovernment.moa.spss.api.cmssign.CMSSignatureResponse;
+
+/**
+ * Default implementation of CMSSignatureResponse.
+ * 
+ * @version $Id$
+ */
+public class CMSSignatureResponseImpl
+  implements CMSSignatureResponse {
+
+  /** The base64 value of the CMS signature. */
+  private String cmsSignature;
+
+  /** 
+   * Sets the CMS signature.
+   * 
+   * @param cmsSignature The Base64 encoded value CMS signature.
+   */
+  public void setCMSSignature(String cmsSignature) {
+    this.cmsSignature = cmsSignature;
+  }
+
+  public String getCMSSignature() {
+    return cmsSignature;
+  }
+
+  /**
+   * Gets the type of CreateCMSSignatureResponseElement.
+   * 
+   * @return CMS_SIGNATURE
+   */
+  public int getResponseType() {
+    return CMS_SIGNATURE;
+  }
+
+}
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/CreateCMSSignatureRequestImpl.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/CreateCMSSignatureRequestImpl.java
new file mode 100644
index 000000000..e8408bc55
--- /dev/null
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/CreateCMSSignatureRequestImpl.java
@@ -0,0 +1,77 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-SPSS has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.spss.api.impl;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import at.gv.egovernment.moa.spss.api.cmssign.CreateCMSSignatureRequest;
+
+/**
+ * Default implementation of CreateCMSSignatureRequest.
+ * 
+ * @author Fatemeh Philippi
+ * @version $Id$
+ */
+public class CreateCMSSignatureRequestImpl
+  implements CreateCMSSignatureRequest {
+
+  /** The identifier for selecting the private keys for creating the signature.*/
+  private String keyIdentifier;
+  /** Information for creating a single signature. */
+  private List singleSignatureInfos = new ArrayList();
+
+  /**
+   * Sets the identifier for selecting the private keys for creating the 
+   * signature.
+   * 
+   * @param keyIdentifier The identifier for selecting the private keys.
+   */
+  public void setKeyIdentifier(String keyIdentifier) {
+    this.keyIdentifier = keyIdentifier;
+  }
+
+  public String getKeyIdentifier() {
+    return keyIdentifier;
+  }
+
+  /**
+   * Sets the information for creating single signatures.
+   * 
+   * @param singleSignaureInfos The information for creating single signatures.
+   */
+  public void setSingleSignatureInfos(List singleSignaureInfos) {
+    this.singleSignatureInfos =
+      singleSignaureInfos != null
+        ? Collections.unmodifiableList(new ArrayList(singleSignaureInfos))
+        : null;
+  }
+
+  public List getSingleSignatureInfos() {
+    return singleSignatureInfos;
+  }
+
+}
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/CreateCMSSignatureResponseImpl.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/CreateCMSSignatureResponseImpl.java
new file mode 100644
index 000000000..d596058c6
--- /dev/null
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/CreateCMSSignatureResponseImpl.java
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-SPSS has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.spss.api.impl;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import at.gv.egovernment.moa.spss.api.cmssign.CreateCMSSignatureResponse;
+
+/**
+ * Default implementation of CreateCMSSignatureResponse.
+ * 
+ * @version $Id$
+ */
+public class CreateCMSSignatureResponseImpl
+  implements CreateCMSSignatureResponse {
+
+  /** The elements contained in the response. */
+  private List responseElements = new ArrayList();
+
+  /**
+   * Sets the elements contained in the response.
+   * 
+   * @param responseElements The response elements.
+   */
+  public void setResponseElements(List responseElements) {
+    this.responseElements =
+      responseElements != null
+        ? Collections.unmodifiableList(new ArrayList(responseElements))
+        : null;
+  }
+
+  public List getResponseElements() {
+    return responseElements;
+  }
+
+}
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/DataObjectInfoCMSImpl.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/DataObjectInfoCMSImpl.java
new file mode 100644
index 000000000..702086b6f
--- /dev/null
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/DataObjectInfoCMSImpl.java
@@ -0,0 +1,69 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-SPSS has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.spss.api.impl;
+
+import at.gv.egovernment.moa.spss.api.cmssign.DataObjectInfo;
+import at.gv.egovernment.moa.spss.api.cmsverify.CMSDataObject;
+
+/**
+ * Default implementation of DataObjectInfo for CMS.
+ * 
+ * @author Fatemeh Philippi
+ * @version $Id$
+ */
+public class DataObjectInfoCMSImpl implements DataObjectInfo {
+  /** The signature structure type. */
+  private String stucture;
+  /** The data object to be signed. */
+  private CMSDataObject dataObject;
+
+  /**
+   * Sets the signature structure type.
+   * 
+   * @param structure The signature structure type.
+   */
+  public void setStructure(String structure) {
+    this.stucture = structure;
+  }
+
+  public String getStructure() {
+    return stucture;
+  }
+
+
+  /**
+   * Sets the data object to be signed.
+   * 
+   * @param dataObject The data object to be signed.
+   */
+  public void setDataObject(CMSDataObject dataObject) {
+    this.dataObject = dataObject;
+  }
+
+  public CMSDataObject getDataObject() {
+    return dataObject;
+  }
+
+}
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SPSSFactoryImpl.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SPSSFactoryImpl.java
index a23a1d98f..7c1208e8f 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SPSSFactoryImpl.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SPSSFactoryImpl.java
@@ -25,6 +25,7 @@
 package at.gv.egovernment.moa.spss.api.impl;
 
 import java.io.InputStream;
+
 import java.math.BigInteger;
 import java.security.cert.X509Certificate;
 import java.util.Date;
@@ -35,6 +36,9 @@ import org.w3c.dom.Element;
 import org.w3c.dom.NodeList;
 
 import at.gv.egovernment.moa.spss.api.SPSSFactory;
+import at.gv.egovernment.moa.spss.api.cmssign.CMSSignatureResponse;
+import at.gv.egovernment.moa.spss.api.cmssign.CreateCMSSignatureRequest;
+import at.gv.egovernment.moa.spss.api.cmssign.CreateCMSSignatureResponse;
 import at.gv.egovernment.moa.spss.api.cmsverify.CMSContent;
 import at.gv.egovernment.moa.spss.api.cmsverify.CMSDataObject;
 import at.gv.egovernment.moa.spss.api.cmsverify.VerifyCMSSignatureRequest;
@@ -90,6 +94,32 @@ public class SPSSFactoryImpl extends SPSSFactory {
     createXMLSignatureRequest.setSingleSignatureInfos(singleSignatureInfos);
     return createXMLSignatureRequest;
   }
+  
+  public CreateCMSSignatureRequest createCreateCMSSignatureRequest(
+    String keyIdentifier,
+    List singleSignatureInfos) {
+	  CreateCMSSignatureRequestImpl createCMSSignatureRequest =
+		      new CreateCMSSignatureRequestImpl();
+	  createCMSSignatureRequest.setKeyIdentifier(keyIdentifier);
+	  createCMSSignatureRequest.setSingleSignatureInfos(singleSignatureInfos);
+	  return createCMSSignatureRequest;
+	  
+  }
+  
+  public CreateCMSSignatureResponse createCreateCMSSignatureResponse(List responseElements) {
+	  CreateCMSSignatureResponseImpl createCMSSignatureResponse = new CreateCMSSignatureResponseImpl();
+	  createCMSSignatureResponse.setResponseElements(responseElements);
+	  return createCMSSignatureResponse;
+  }
+  
+  
+  public CMSSignatureResponse createCMSSignatureResponse(String base64value) {
+	  CMSSignatureResponseImpl cmsSignatureResponse = new CMSSignatureResponseImpl();
+	  cmsSignatureResponse.setCMSSignature(base64value);
+	  
+	  return cmsSignatureResponse;
+  }
+  
 
   public SingleSignatureInfo createSingleSignatureInfo(
     List dataObjectInfos,
@@ -101,6 +131,16 @@ public class SPSSFactoryImpl extends SPSSFactory {
     singleSignatureInfo.setSecurityLayerConform(securityLayerConform);
     return singleSignatureInfo;
   }
+  
+  public at.gv.egovernment.moa.spss.api.cmssign.SingleSignatureInfo createSingleSignatureInfoCMS(
+		  at.gv.egovernment.moa.spss.api.cmssign.DataObjectInfo dataObjectInfo,		    
+		    boolean securityLayerConform) {
+		    SingleSignatureInfoCMSImpl singleSignatureInfo = new SingleSignatureInfoCMSImpl();
+		    singleSignatureInfo.setDataObjectInfo(dataObjectInfo);
+		    singleSignatureInfo.setSecurityLayerConform(securityLayerConform);
+		    return singleSignatureInfo;
+		  }
+  
   public DataObjectInfo createDataObjectInfo(
     String structure,
     boolean childOfManifest,
@@ -113,6 +153,15 @@ public class SPSSFactoryImpl extends SPSSFactory {
     dataObjectInfo.setCreateTransformsInfoProfile(createTransformsInfoProfile);
     return dataObjectInfo;
   }
+  
+  public at.gv.egovernment.moa.spss.api.cmssign.DataObjectInfo createDataObjectInfo(
+		    String structure,
+		    CMSDataObject dataObject) {
+		    DataObjectInfoCMSImpl dataObjectInfo = new DataObjectInfoCMSImpl();
+		    dataObjectInfo.setStructure(structure);
+		    dataObjectInfo.setDataObject(dataObject);
+		    return dataObjectInfo;
+		  }
 
   public CreateTransformsInfoProfile createCreateTransformsInfoProfile(String profileID) {
 
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SingleSignatureInfoCMSImpl.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SingleSignatureInfoCMSImpl.java
new file mode 100644
index 000000000..cb3651587
--- /dev/null
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SingleSignatureInfoCMSImpl.java
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-SPSS has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.spss.api.impl;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import at.gv.egovernment.moa.spss.api.cmssign.DataObjectInfo;
+import at.gv.egovernment.moa.spss.api.cmssign.SingleSignatureInfo;
+
+/**
+ * @version $Id$
+ */
+public class SingleSignatureInfoCMSImpl implements SingleSignatureInfo {
+
+  private DataObjectInfo dataObjectInfo = null;
+
+
+  private boolean securityLayerConform = true;
+
+  public void setDataObjectInfo(DataObjectInfo dataObjectInfo) {
+    this.dataObjectInfo = dataObjectInfo;
+  }
+
+  public DataObjectInfo getDataObjectInfo() {
+    return dataObjectInfo;
+  }
+
+
+
+  public void setSecurityLayerConform(boolean securityLayerConform) {
+    this.securityLayerConform = securityLayerConform;
+  }
+
+  public boolean isSecurityLayerConform() {
+    return securityLayerConform;
+  }
+
+}
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/CreateCMSSignatureRequestParser.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/CreateCMSSignatureRequestParser.java
new file mode 100644
index 000000000..737915ecd
--- /dev/null
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/CreateCMSSignatureRequestParser.java
@@ -0,0 +1,247 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-SPSS has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.spss.api.xmlbind;
+
+import java.io.InputStream;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.w3c.dom.Element;
+import org.w3c.dom.traversal.NodeIterator;
+
+import at.gv.egovernment.moa.spss.MOAApplicationException;
+import at.gv.egovernment.moa.spss.api.SPSSFactory;
+import at.gv.egovernment.moa.spss.api.cmssign.CreateCMSSignatureRequest;
+import at.gv.egovernment.moa.spss.api.cmssign.DataObjectInfo;
+import at.gv.egovernment.moa.spss.api.cmssign.SingleSignatureInfo;
+import at.gv.egovernment.moa.spss.api.cmsverify.CMSContent;
+import at.gv.egovernment.moa.spss.api.cmsverify.CMSDataObject;
+import at.gv.egovernment.moa.spss.api.common.Content;
+import at.gv.egovernment.moa.spss.api.common.MetaInfo;
+import at.gv.egovernment.moa.util.Base64Utils;
+import at.gv.egovernment.moa.util.BoolUtils;
+import at.gv.egovernment.moa.util.Constants;
+import at.gv.egovernment.moa.util.DOMUtils;
+import at.gv.egovernment.moa.util.XPathUtils;
+
+/**
+ * A parser to parse CreateCMSSignatureRequest DOM trees into
+ * CreateCMSSignatureRequest API objects.
+ * 
+ * @author Patrick Peck
+ * @version $Id$
+ */
+public class CreateCMSSignatureRequestParser {
+
+  //
+  // XPath expresssions to select elements in the CreateCMSSignatureRequest
+  //
+  private static final String MOA = Constants.MOA_PREFIX + ":";
+  private static final String KEY_IDENTIFIER_XPATH =
+    "/" + MOA + "CreateCMSSignatureRequest/" + MOA + "KeyIdentifier";
+  private static final String SINGLE_SIGNATURE_INFO_XPATH =
+    "/" + MOA + "CreateCMSSignatureRequest/" + MOA + "SingleSignatureInfo";
+  private static final String DATA_OBJECT_INFO_XPATH = MOA + "DataObjectInfo";
+  private static final String DATA_OBJECT_XPATH = MOA + "DataObject";
+  
+  private static final String SL_CONFORM_ATTR_NAME = "SecurityLayerConformity";
+
+  private static final String META_INFO_XPATH = MOA + "MetaInfo";
+  private static final String CONTENT_XPATH = MOA + "Content";
+  private static final String BASE64_CONTENT_XPATH = MOA + "Base64Content";
+
+  
+  /** The factory to create API objects. */
+  private SPSSFactory factory;
+
+  /**
+   * Create a new CreateCMSSignatureRequestParser.
+   */
+  public CreateCMSSignatureRequestParser() {
+    this.factory = SPSSFactory.getInstance();
+  }
+
+  /**
+   * Parse a CreateCMSSignatureRequest DOM element, as defined
+   * by the MOA schema.
+   * 
+   * @param requestElem The CreateCMSSignatureRequest to parse. The
+   * request must have been successfully parsed against the schema for this
+   * method to succeed.
+   * @return A CreateCMSSignatureRequest API object containing
+   * the data from the DOM element.
+   * @throws MOAApplicationException An error occurred parsing the request.
+   */
+  public CreateCMSSignatureRequest parse(Element requestElem)
+    throws MOAApplicationException {
+
+    List singleSignatureInfos = parseSingleSignatureInfos(requestElem);
+    String keyIdentifier =
+      XPathUtils.getElementValue(requestElem, KEY_IDENTIFIER_XPATH, null);
+
+    return factory.createCreateCMSSignatureRequest(
+      keyIdentifier,
+      singleSignatureInfos);
+  }
+
+  /**
+   * Parse all SingleSignatureInfo elements of the 
+   * CreateCMSSignatureRequest.
+   * 
+   * @param requestElem The CreateCMSSignatureRequest to parse.
+   * @return A List of SingleSignatureInfo API 
+   * objects.
+   * @throws MOAApplicationException An error occurred parsing on of the 
+   * SingleSignatureInfo elements.
+   */
+  private List parseSingleSignatureInfos(Element requestElem)
+    throws MOAApplicationException {
+
+    List singleSignatureInfos = new ArrayList();
+    NodeIterator sigInfoElems =
+      XPathUtils.selectNodeIterator(requestElem, SINGLE_SIGNATURE_INFO_XPATH);
+    Element sigInfoElem;
+
+    while ((sigInfoElem = (Element) sigInfoElems.nextNode()) != null) {
+      singleSignatureInfos.add(parseSingleSignatureInfo(sigInfoElem));
+    }
+
+    return singleSignatureInfos;
+  }
+
+  /**
+   * Parse a SingleSignatureInfo DOM element.
+   * 
+   * @param sigInfoElem The SingleSignatureInfo DOM element to 
+   * parse.
+   * @return A SingleSignatureInfo API object containing the 
+   * information of sigInfoElem.
+   * @throws MOAApplicationException An error occurred parsing the 
+   * SingleSignatureInfo.
+   */
+  private SingleSignatureInfo parseSingleSignatureInfo(Element sigInfoElem)
+    throws MOAApplicationException {
+
+    DataObjectInfo dataObjectInfo = parseDataObjectInfo(sigInfoElem);
+    boolean securityLayerConform;
+
+    if (sigInfoElem.hasAttribute(SL_CONFORM_ATTR_NAME)) {
+      securityLayerConform =
+        BoolUtils.valueOf(sigInfoElem.getAttribute(SL_CONFORM_ATTR_NAME));
+    } else {
+      securityLayerConform = true;
+    }
+
+    return factory.createSingleSignatureInfoCMS(
+      dataObjectInfo,
+      securityLayerConform);
+  }
+
+  /**
+   * Parse the DataObjectInfo DOM elements contained in the given
+   * SingleSignatureInfo DOM element.
+   * 
+   * @param sigInfoElem The  SingleSignatureInfo DOM element
+   * whose DataObjectInfos to parse.
+   * @return A List of DataObjectInfo API objects
+   * containing the data from the DataObjectInfo DOM elements.
+   * @throws MOAApplicationException An error occurred parsing one of the
+   * DataObjectInfos.
+   */
+  private DataObjectInfo parseDataObjectInfo(Element sigInfoElem)
+    throws MOAApplicationException {
+
+	  Element dataObjInfoElem = (Element)XPathUtils.selectSingleNode(sigInfoElem, DATA_OBJECT_INFO_XPATH);
+	  
+	  String structure = dataObjInfoElem.getAttribute("Structure");
+	    Element dataObjectElem =
+	      (Element) XPathUtils.selectSingleNode(dataObjInfoElem, DATA_OBJECT_XPATH);
+	  
+	    CMSDataObject dataObject = parseDataObject(dataObjectElem);
+
+	    return factory.createDataObjectInfo(
+	      structure,
+	      dataObject);
+	    
+  }
+  
+ 
+
+ 
+
+  /**
+   * Parse a the DataObject DOM element contained in a given 
+   * CreateCMSSignatureRequest DOM element.
+   * 
+   * @param requestElem The DataObject DOM element of the VerifyCMSSignatureRequest 
+   * to parse.
+   * @return The CMSDataObject API object containing the data
+   * from the DataObject DOM element.
+   */
+  private CMSDataObject parseDataObject(Element dataObjectElem) {
+
+    if (dataObjectElem != null) {
+      Element metaInfoElem = (Element) XPathUtils.selectSingleNode(dataObjectElem, META_INFO_XPATH);
+      MetaInfo metaInfo = null;
+      Element contentElem = (Element) XPathUtils.selectSingleNode(dataObjectElem, CONTENT_XPATH);
+      CMSContent content = parseContent(contentElem);
+
+      if (metaInfoElem != null) {
+        metaInfo = RequestParserUtils.parseMetaInfo(metaInfoElem);
+      }
+
+      return factory.createCMSDataObject(metaInfo, content);
+    } 
+    else {
+      return null;
+    }
+  }
+
+    
+
+    /**
+     * Parse the content contained in a CMSContentBaseType kind of
+     * DOM element.
+     * 
+     * @param contentElem The CMSContentBaseType kind of element to
+     * parse.
+     * @return A CMSDataObject API object containing the data
+     * from the given DOM element.
+     */
+    private CMSContent parseContent(Element contentElem) {
+      Element base64ContentElem =
+        (Element) XPathUtils.selectSingleNode(contentElem, BASE64_CONTENT_XPATH);
+
+      if (base64ContentElem != null) {
+        String base64Str = DOMUtils.getText(base64ContentElem);
+        InputStream binaryContent = Base64Utils.decodeToStream(base64Str, true);
+        return factory.createCMSContent(binaryContent);
+      } else {
+        return factory.createCMSContent(
+          contentElem.getAttribute("Reference"));
+      }
+    } 
+
+}
\ No newline at end of file
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/CreateCMSSignatureResponseBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/CreateCMSSignatureResponseBuilder.java
new file mode 100644
index 000000000..907f90d32
--- /dev/null
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/CreateCMSSignatureResponseBuilder.java
@@ -0,0 +1,145 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-SPSS has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.spss.api.xmlbind;
+
+import java.io.IOException;
+import java.util.Iterator;
+
+import javax.xml.transform.TransformerException;
+
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+
+import at.gv.egovernment.moa.spss.MOASystemException;
+import at.gv.egovernment.moa.spss.api.cmssign.CMSSignatureResponse;
+import at.gv.egovernment.moa.spss.api.cmssign.CreateCMSSignatureResponse;
+import at.gv.egovernment.moa.spss.api.cmssign.CreateCMSSignatureResponseElement;
+import at.gv.egovernment.moa.spss.api.xmlsign.ErrorResponse;
+import at.gv.egovernment.moa.spss.api.xmlsign.SignatureEnvironmentResponse;
+import at.gv.egovernment.moa.util.Constants;
+import at.gv.egovernment.moa.util.DOMUtils;
+
+/**
+ * Convert a CreateCMSSignatureResponse API object into its
+ * XML representation, according to the MOA XML schema.
+ * 
+ * @version $Id$
+ */
+public class CreateCMSSignatureResponseBuilder {
+  private static final String MOA_NS_URI = Constants.MOA_NS_URI;
+
+  /** The XML document containing the response element. */
+  private Document responseDoc;
+  /** The response CreateCMSSignatureResponse DOM element. */
+  private Element responseElem;
+
+  /**
+   * Create a new CreateCMSSignatureResponseBuilder:
+   * 
+   * @throws MOASystemException An error occurred setting up the resulting
+   * XML document.
+   */
+  public CreateCMSSignatureResponseBuilder() throws MOASystemException {
+    responseDoc =
+      ResponseBuilderUtils.createResponse("CreateCMSSignatureResponse");
+    responseElem = responseDoc.getDocumentElement();
+  }
+
+  /**
+   * Build a document containing a CreateCMSSignatureResponse
+   * DOM element being the XML representation of the given 
+   * CreateCMSSignatureResponse API object.
+   * 
+   * @param response The CreateCMSSignatureResponse to convert
+   * to XML.
+   * @return A document containing the CreateCMSSignatureResponse
+   * DOM element.
+   */
+  public Document build(CreateCMSSignatureResponse response) {
+    Iterator iter;
+
+        
+    for (iter = response.getResponseElements().iterator(); iter.hasNext();) {
+      CreateCMSSignatureResponseElement responseElement =
+        (CreateCMSSignatureResponseElement) iter.next();
+      
+      switch (responseElement.getResponseType()) {
+        case CreateCMSSignatureResponseElement.CMS_SIGNATURE :
+        	CMSSignatureResponse cmsSignatureResponse = (CMSSignatureResponse) responseElement;
+        	addCMSSignature(cmsSignatureResponse);
+          break;
+
+        case CreateCMSSignatureResponseElement.ERROR_RESPONSE :
+          ErrorResponse errorResponse = (ErrorResponse) responseElement;
+          addErrorResponse(errorResponse);
+          break;
+      }
+
+    }
+
+    return responseDoc;
+  }
+
+
+
+  /**
+   * Add a CMSSignature element to the response.
+   * 
+   * @param cmsSignatureResponse The content to put under the
+   * CMSSignature element.
+   */
+  private void addCMSSignature(CMSSignatureResponse cmsSignatureResponse) {
+	  String base64Value = cmsSignatureResponse.getCMSSignature();
+	  
+	  Element cmsSignature = responseDoc.createElementNS(MOA_NS_URI, "CMSSignature");	  
+	  cmsSignature.setTextContent(base64Value);
+	  
+	  responseElem.appendChild(cmsSignature);
+	  
+}
+  
+  /**
+   * Add a ErrorResponse element to the response.
+   *  
+   * @param errorResponse The API object containing the information to put into
+   * the ErrorResponse DOM element.
+   */
+  private void addErrorResponse(ErrorResponse errorResponse) {
+    Element errorElem =
+      responseDoc.createElementNS(MOA_NS_URI, "ErrorResponse");
+    Element errorCodeElem =
+      responseDoc.createElementNS(MOA_NS_URI, "ErrorCode");
+    Element infoElem = responseDoc.createElementNS(MOA_NS_URI, "Info");
+    String errorCodeStr = Integer.toString(errorResponse.getErrorCode());
+
+    errorCodeElem.appendChild(responseDoc.createTextNode(errorCodeStr));
+    errorElem.appendChild(errorCodeElem);
+    infoElem.appendChild(responseDoc.createTextNode(errorResponse.getInfo()));
+    errorElem.appendChild(errorCodeElem);
+    errorElem.appendChild(infoElem);
+    responseElem.appendChild(errorElem);
+  }
+
+}
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java
index bc53ca4f9..4fcc5daa9 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java
@@ -548,8 +548,7 @@ public class ConfigurationPartsBuilder {
 	  }
 	  
 	  
-	  // set whitelist for iaik-moa
-	  // TODO 
+	  // TODO set whitelist for iaik-moa
 //	  ExternalReferenceChecker.setWhitelist(whiteListIaikMoa);
 
 	  
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/cmssign/CMSSignatureCreationProfileImpl.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/cmssign/CMSSignatureCreationProfileImpl.java
new file mode 100644
index 000000000..49e5ecc10
--- /dev/null
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/cmssign/CMSSignatureCreationProfileImpl.java
@@ -0,0 +1,249 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-SPSS has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.spss.server.iaik.cmssign;
+
+import iaik.server.modules.algorithms.SignatureAlgorithms;
+import iaik.server.modules.cmssign.CMSSignatureCreationProfile;
+import iaik.server.modules.keys.AlgorithmUnavailableException;
+import iaik.server.modules.keys.KeyEntryID;
+import iaik.server.modules.keys.KeyModule;
+import iaik.server.modules.keys.KeyModuleFactory;
+import iaik.server.modules.keys.UnknownKeyException;
+
+import java.util.List;
+import java.util.Set;
+
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.spss.server.logging.TransactionId;
+import at.gv.egovernment.moa.spss.server.transaction.TransactionContext;
+import at.gv.egovernment.moa.spss.server.transaction.TransactionContextManager;
+
+/**
+ * An object providing auxiliary information for creating a CMS signature.
+ * 
+ * @author Patrick Peck
+ * @version $Id$
+ */
+public class CMSSignatureCreationProfileImpl
+  implements CMSSignatureCreationProfile {
+
+  /** The set of keys available to the signing process. */
+  private Set keySet;
+  /** The MIME type of the data to be signed*/
+  private String mimeType;
+  /** Whether the created signature is to be Security Layer conform. */ 
+  private boolean securityLayerConform;
+  /** Properties to be signed during signature creation. */ 
+  private List signedProperties;
+  /** Specifies whether the content data shall be included in the CMS SignedData or shall be not included. */
+  private boolean includeData;
+  /** Digest Method algorithm  */
+  private String digestMethod;
+  
+  
+  /**
+   * Create a new XMLSignatureCreationProfileImpl.
+   * 
+   * @param createProfileCount Provides external information about the 
+   * number of calls to the signature creation module, using the same request.
+   * @param reservedIDs The set of IDs that must not be used while generating
+   * new IDs.
+   */
+  public CMSSignatureCreationProfileImpl(
+    Set keySet,
+    String digestMethod,
+    List signedProperties,
+    boolean securityLayerConform,
+    boolean includeData,
+    String mimeType) {
+	  this.keySet = keySet;
+	  this.signedProperties = signedProperties;
+	  this.securityLayerConform = securityLayerConform;
+	  this.includeData = includeData;
+	  this.mimeType = mimeType;
+	  this.digestMethod = digestMethod;
+
+  }
+
+  
+  /**
+   * @see iaik.server.modules.xmlsign.XMLSignatureCreationProfile#getKeySet()
+   */
+  public Set getKeySet() {
+    return keySet;
+  }
+
+  /**
+   * Set the set of KeyEntryIDs which may be used for signature
+   * creation.
+   * 
+   * @param keySet The set of KeyEntryIDs to set.
+   */
+  public void setKeySet(Set keySet) {
+    this.keySet = keySet;
+  }
+
+
+  /**
+   * @see iaik.server.modules.xmlsign.XMLSignatureCreationProfile#getSignatureAlgorithmName(KeyEntryID)
+   */
+  public String getSignatureAlgorithmName(KeyEntryID selectedKeyID)
+    throws AlgorithmUnavailableException {
+
+	  
+    TransactionContext context =
+      TransactionContextManager.getInstance().getTransactionContext();
+    TransactionId tid = new TransactionId(context.getTransactionID());
+    KeyModule module = KeyModuleFactory.getInstance(tid);
+    Set algorithms;
+
+    try {
+      algorithms = module.getSupportedSignatureAlgorithms(selectedKeyID);
+    } catch (UnknownKeyException e) {
+      throw new AlgorithmUnavailableException(
+        "Unknown key entry: " + selectedKeyID,
+        e,
+        null);
+    }
+    
+      	if (digestMethod.compareTo("SHA-1") == 0) {
+    		Logger.warn("SHA-1 is configured as digest algorithm. Please revise a use of a more secure digest algorithm out of the SHA-2 family (e.g. SHA-256, SHA-384, SHA-512)");
+    		
+    		if  (algorithms.contains(SignatureAlgorithms.SHA1_WITH_RSA)) {
+                  return SignatureAlgorithms.SHA1_WITH_RSA;
+                  
+    		} else if (algorithms.contains(SignatureAlgorithms.ECDSA)) {
+                  return SignatureAlgorithms.ECDSA;
+                  
+    		} else if (algorithms.contains(SignatureAlgorithms.DSA)) {
+    			return SignatureAlgorithms.DSA;
+    			
+    		} else {
+    			throw new AlgorithmUnavailableException(
+    					"No algorithm for key entry: " + selectedKeyID,
+                         null,
+                         null);
+             }
+    		
+    	} else if (digestMethod.compareTo("SHA-256") == 0) {
+    		if (algorithms.contains(SignatureAlgorithms.SHA256_WITH_RSA)) { 
+             	return SignatureAlgorithms.SHA256_WITH_RSA;
+             	
+    		} else if (algorithms.contains(SignatureAlgorithms.SHA256_WITH_ECDSA)) {
+             	return SignatureAlgorithms.SHA256_WITH_ECDSA;
+             	
+             } else if (algorithms.contains(SignatureAlgorithms.DSA)) {
+             	return SignatureAlgorithms.DSA;
+             	
+             } else {
+             	throw new AlgorithmUnavailableException(
+             			"No algorithm for key entry: " + selectedKeyID,
+             			null,
+             	        null);
+             }
+    	} else if (digestMethod.compareTo("SHA-384") == 0) {
+    		if (algorithms.contains(SignatureAlgorithms.SHA384_WITH_RSA)) {
+             	return SignatureAlgorithms.SHA384_WITH_RSA;
+             	
+             } else if (algorithms.contains(SignatureAlgorithms.SHA384_WITH_ECDSA)) {
+             	return SignatureAlgorithms.SHA384_WITH_ECDSA;
+             	
+             } else if (algorithms.contains(SignatureAlgorithms.DSA)) {
+             	return SignatureAlgorithms.DSA;
+             	
+             } else {
+             	throw new AlgorithmUnavailableException(
+             			"No algorithm for key entry: " + selectedKeyID,
+             			null,
+             	        null);
+             }
+    	} else if (digestMethod.compareTo("SHA-512") == 0) {
+    		if (algorithms.contains(SignatureAlgorithms.SHA512_WITH_RSA)) {
+             	return SignatureAlgorithms.SHA512_WITH_RSA;
+             	
+             } else if (algorithms.contains(SignatureAlgorithms.SHA512_WITH_ECDSA)) {
+             	return SignatureAlgorithms.SHA512_WITH_ECDSA;
+             	
+             } else if (algorithms.contains(SignatureAlgorithms.DSA)) {
+             	return SignatureAlgorithms.DSA; 
+             	
+             } else {
+             	throw new AlgorithmUnavailableException(
+             			"No algorithm for key entry: " + selectedKeyID,
+             			null,
+             	        null);
+             }
+    	}	
+    	else {
+         	throw new AlgorithmUnavailableException(
+         			"No signature algorithm found for digest algorithm '" + digestMethod,
+         			null,
+         	        null);
+         }
+  
+
+  }
+
+
+ 
+  /**
+   * @see iaik.server.modules.xmlsign.XMLSignatureCreationProfile#getSignedProperties()
+   */
+  public List getSignedProperties() {
+    return signedProperties;
+  }
+
+  /**
+   * @see iaik.server.modules.xmlsign.XMLSignatureCreationProfile#isSecurityLayerConform()
+   */
+  public boolean isSecurityLayerConform() {
+    return securityLayerConform;
+  }
+
+  /**
+   * Sets the security layer conformity.
+   * 
+   * @param securityLayerConform true, if the created signature
+   * is to be conform to the Security Layer specification.
+   */
+  public void setSecurityLayerConform(boolean securityLayerConform) {
+    this.securityLayerConform = securityLayerConform;
+  }
+
+ 
+  public void setDigestMethod(String digestMethod) {
+	  this.digestMethod = digestMethod;
+  }
+ 
+
+  public String getMimeType() {
+	  return mimeType;
+  }
+
+  public boolean includeData() {
+	return this.includeData;
+  }
+
+}
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/xmlsign/XMLSignatureCreationProfileImpl.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/xmlsign/XMLSignatureCreationProfileImpl.java
index edc3922e2..7d0c5a062 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/xmlsign/XMLSignatureCreationProfileImpl.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/iaik/xmlsign/XMLSignatureCreationProfileImpl.java
@@ -201,7 +201,7 @@ public class XMLSignatureCreationProfileImpl
     else {
     	// XAdES 1.4.2 is enabled: select signature algorithm according to selected digest method
     	if (digestMethodXAdES142.compareTo("SHA-1") == 0) {
-    		Logger.warn("XAdES version 1.4.2 is enabled, but SHA-1 is configured as digest algorithm. Please revise a use a more secure digest algorithm out of the SHA-2 family (e.g. SHA-256, SHA-384, SHA-512)");
+    		Logger.warn("XAdES version 1.4.2 is enabled, but SHA-1 is configured as digest algorithm. Please revise a use of a more secure digest algorithm out of the SHA-2 family (e.g. SHA-256, SHA-384, SHA-512)");
     		
     		if  (algorithms.contains(SignatureAlgorithms.SHA1_WITH_RSA)) {
                   return SignatureAlgorithms.SHA1_WITH_RSA;
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureCreationInvoker.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureCreationInvoker.java
new file mode 100644
index 000000000..e058c8a4b
--- /dev/null
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureCreationInvoker.java
@@ -0,0 +1,396 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-SPSS has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.spss.server.invoke;
+
+import iaik.server.modules.algorithms.HashAlgorithms;
+import iaik.server.modules.cmssign.CMSSignature;
+import iaik.server.modules.cmssign.CMSSignatureCreationException;
+import iaik.server.modules.cmssign.CMSSignatureCreationModule;
+import iaik.server.modules.cmssign.CMSSignatureCreationModuleFactory;
+import iaik.server.modules.cmssign.CMSSignatureCreationProfile;
+import iaik.server.modules.keys.KeyEntryID;
+import iaik.server.modules.keys.KeyModule;
+import iaik.server.modules.keys.KeyModuleFactory;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.math.BigInteger;
+import java.security.Principal;
+import java.security.cert.X509Certificate;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import at.gv.egovernment.moa.logging.LogMsg;
+import at.gv.egovernment.moa.logging.Logger;
+import at.gv.egovernment.moa.logging.LoggingContext;
+import at.gv.egovernment.moa.logging.LoggingContextManager;
+import at.gv.egovernment.moa.spss.MOAApplicationException;
+import at.gv.egovernment.moa.spss.MOAException;
+import at.gv.egovernment.moa.spss.MOASystemException;
+import at.gv.egovernment.moa.spss.api.cmssign.CreateCMSSignatureRequest;
+import at.gv.egovernment.moa.spss.api.cmssign.CreateCMSSignatureResponse;
+import at.gv.egovernment.moa.spss.api.cmssign.DataObjectInfo;
+import at.gv.egovernment.moa.spss.api.cmssign.SingleSignatureInfo;
+import at.gv.egovernment.moa.spss.api.cmsverify.CMSContent;
+import at.gv.egovernment.moa.spss.api.cmsverify.CMSContentExcplicit;
+import at.gv.egovernment.moa.spss.api.cmsverify.CMSContentReference;
+import at.gv.egovernment.moa.spss.api.cmsverify.CMSDataObject;
+import at.gv.egovernment.moa.spss.api.common.MetaInfo;
+import at.gv.egovernment.moa.spss.api.impl.CreateCMSSignatureResponseImpl;
+import at.gv.egovernment.moa.spss.server.config.ConfigurationProvider;
+import at.gv.egovernment.moa.spss.server.config.KeyGroupEntry;
+import at.gv.egovernment.moa.spss.server.iaik.cmssign.CMSSignatureCreationProfileImpl;
+import at.gv.egovernment.moa.spss.server.logging.TransactionId;
+import at.gv.egovernment.moa.spss.server.transaction.TransactionContext;
+import at.gv.egovernment.moa.spss.server.transaction.TransactionContextManager;
+import at.gv.egovernment.moa.spss.util.MessageProvider;
+import at.gv.egovernment.moa.util.Constants;
+
+/**
+ * A class providing an API based interface to the
+ * CMSSignatureCreationModule.
+ * 
+ * This class performs the invocation of the 
+ * iaik.server.modules.cmssign.CMSSignatureCreationModule from a
+ * CreateCMSSignatureRequest given as an API object. The result of
+ * the invocation is integrated into a CreateCMSSignatureResponse
+ * and returned.
+ * 
+ * @version $Id$
+ */
+public class CMSSignatureCreationInvoker {
+	
+	 private static Map HASH_ALGORITHM_MAPPING;
+
+	  static {
+	    HASH_ALGORITHM_MAPPING = new HashMap();
+	    HASH_ALGORITHM_MAPPING.put(Constants.SHA1_URI, HashAlgorithms.SHA1);
+	    HASH_ALGORITHM_MAPPING.put(Constants.SHA256_URI, HashAlgorithms.SHA256);
+	    HASH_ALGORITHM_MAPPING.put(Constants.SHA384_URI, HashAlgorithms.SHA384);
+	    HASH_ALGORITHM_MAPPING.put(Constants.SHA512_URI, HashAlgorithms.SHA512);
+	  }
+	  
+
+  /** The single instance of this class. */
+  private static CMSSignatureCreationInvoker instance = null;
+
+  /**
+   * Get the only instance of this class.
+   * 
+   * @return The only instance of this class.
+   */
+  public static synchronized CMSSignatureCreationInvoker getInstance() {
+    if (instance == null) {
+      instance = new CMSSignatureCreationInvoker();
+    }
+    return instance;
+  }
+
+  /**
+   * Create a new CMSSignatureCreationInvoker.
+   * 
+   * Protected to disallow multiple instances.
+   */
+  protected CMSSignatureCreationInvoker() {
+  }
+  
+ 
+
+  /**
+   * Process the CreateCMSSignatureRequest message and invoke the
+   * XMLSignatureCreationModule for every
+   * SingleSignatureInfo contained in the request.
+   * 
+   * @param request A CreateCMSSignatureRequest API object
+   * containing the information for creating the signature(s).
+   * @param reserved A Set of reserved object IDs.
+   * 
+   * @return A CreateCMSSignatureResponse API object containing
+   * the created signature(s). The response contains either a
+   * SignatureEnvironment or a ErrorResponse
+   * for each SingleSignatureInfo in the request.
+   * @throws MOAException An error occurred during signature creation. 
+   */
+  public CreateCMSSignatureResponse createCMSSignature(
+    CreateCMSSignatureRequest request,
+    Set reserved)
+    throws MOAException {
+
+	  TransactionContext context = TransactionContextManager.getInstance().getTransactionContext();	  
+	  //LoggingContext loggingCtx = LoggingContextManager.getInstance().getLoggingContext();
+
+	  CreateCMSSignatureResponseBuilder responseBuilder = new CreateCMSSignatureResponseBuilder();
+	  CreateCMSSignatureResponse response = new CreateCMSSignatureResponseImpl();
+
+	  boolean isSecurityLayerConform = false;
+	  String structure = null;
+	  String mimetype = null;
+	  
+	  // select the SingleSignatureInfo elements
+	  Iterator singleSignatureInfoIter = request.getSingleSignatureInfos().iterator();
+
+    // iterate over all the SingleSignatureInfo elements in the request
+	  while (singleSignatureInfoIter.hasNext()) {
+		  SingleSignatureInfo singleSignatureInfo = (SingleSignatureInfo) singleSignatureInfoIter.next();
+		  isSecurityLayerConform = singleSignatureInfo.isSecurityLayerConform();
+		  
+		  
+		  DataObjectInfo dataObjectInfo = singleSignatureInfo.getDataObjectInfo();
+		  structure = dataObjectInfo.getStructure();
+		  
+		  CMSDataObject dataobject = dataObjectInfo.getDataObject();
+		  MetaInfo metainfo = dataobject.getMetaInfo();
+		  mimetype = metainfo.getMimeType();
+			  
+		  CMSContent content = dataobject.getContent();
+		  InputStream contentIs = null;
+		  // build the content data
+		  switch (content.getContentType()) {
+		  	case CMSContent.EXPLICIT_CONTENT :			    	  
+		  		contentIs = ((CMSContentExcplicit) content).getBinaryContent();
+		  		break;
+		  	case CMSContent.REFERENCE_CONTENT :
+		  		String reference = ((CMSContentReference) content).getReference();
+		  		if (!"".equals(reference)) {
+		  			ExternalURIResolver resolver = new ExternalURIResolver();
+		  			contentIs = resolver.resolve(reference);
+		  		} else {
+		  			throw new MOAApplicationException("2301", null);
+		  		}
+			    break;
+		  	default : {
+		  		throw new MOAApplicationException("2301", null);
+		  	}
+		  }
+			
+		  // create CMSSignatureCreationModuleFactory
+		  CMSSignatureCreationModule module = CMSSignatureCreationModuleFactory.getInstance();			    
+			    
+		  List signedProperties = null;
+		  boolean includeData = true;
+		  if (structure.compareTo("enveloping") == 0)
+			  includeData = true;
+		  if (structure.compareTo("detached") == 0)
+			  includeData = false;
+			    
+		  ConfigurationProvider config = context.getConfiguration();
+			    
+		  // get the key group id
+		  String keyGroupID = request.getKeyIdentifier();
+		  // set the key set
+		  Set keySet = buildKeySet(keyGroupID);
+		  if (keySet == null) {
+			  throw new MOAApplicationException("2231", null);
+		  } else if (keySet.size() == 0) {
+			  throw new MOAApplicationException("2232", null);
+		  }
+			    
+		  // get digest algorithm
+		  String digestAlgorithm = getDigestAlgorithm(config, keyGroupID);
+			    
+		  // create CMSSignatureCreation profile:			    
+		  CMSSignatureCreationProfile profile = new CMSSignatureCreationProfileImpl(
+				  keySet,
+				  digestAlgorithm, 
+				  signedProperties,
+				  isSecurityLayerConform, 
+				  includeData, 
+				  mimetype);
+		  
+		  // create CMSSignature from the CMSSignatureCreationModule
+		  // build the additionalSignedProperties
+		  List additionalSignedProperties = buildAdditionalSignedProperties();
+		  TransactionId tid = new TransactionId(context.getTransactionID());
+		  try {
+			  CMSSignature signature = module.createSignature(profile, additionalSignedProperties, tid);
+			  ByteArrayOutputStream out = new ByteArrayOutputStream();
+			  // get CMS SignedData output stream from the CMSSignature and wrap it around out
+			  boolean base64 = true;
+			  OutputStream  signedDataStream = signature.getSignature(out, base64);
+					 
+			  // now write the data to be signed to the signedDataStream
+			  byte[] buf = new byte[4096];
+			  int bytesRead;
+			  while ((bytesRead = contentIs.read(buf)) >= 0) {
+				  signedDataStream.write(buf, 0, bytesRead);
+			  } 
+					 
+			  // finish SignedData processing by closing signedDataStream
+			  signedDataStream.close();
+			  String base64value = out.toString();
+					 
+			  responseBuilder.addCMSSignature(base64value);
+					
+					
+		  } catch (CMSSignatureCreationException e) {
+			  MOAException moaException = IaikExceptionMapper.getInstance().map(e);
+
+	          responseBuilder.addError(
+	            moaException.getMessageId(),
+	            moaException.getMessage());
+	          Logger.warn(moaException.getMessage(), e);
+	          
+		  } 
+		  catch (IOException e) {
+			  throw new MOAApplicationException("2301", null, e);			  
+		  }
+			
+	  }
+	  
+
+    return responseBuilder.getResponse();
+  }
+
+  
+  private String getDigestAlgorithm(ConfigurationProvider config, String keyGroupID) throws MOASystemException {
+	// get digest method on key group level (if configured)
+	    String configDigestMethodKG = config.getKeyGroup(keyGroupID).getDigestMethodAlgorithm();
+	    // get default digest method (if configured)
+	    String configDigestMethod = config.getDigestMethodAlgorithmName();
+	    
+	    
+	    String digestMethod = null;
+	    if (configDigestMethodKG != null) {
+	    	// if KG specific digest method is configured
+	    	digestMethod = (String) HASH_ALGORITHM_MAPPING.get(configDigestMethodKG);
+	    	if (digestMethod == null) {
+	    		error(
+	    				"config.17",
+	    				new Object[] { configDigestMethodKG});
+	    		throw new MOASystemException("2900", null);    			
+	    	}
+	    	Logger.debug("Digest algorithm: " + digestMethod + "(configured in KeyGroup)");
+	    }	    	
+	    else {
+	    	// else get default configured digest method
+	    	digestMethod = (String) HASH_ALGORITHM_MAPPING.get(configDigestMethod);
+	    	if (digestMethod == null) {
+	    		error(
+	    				"config.17",
+	    				new Object[] { configDigestMethod});
+	    		throw new MOASystemException("2900", null);	
+	    	}
+	    	Logger.debug("Digest algorithm: " + digestMethod + "(default)");
+	    	
+	    }
+		return digestMethod;
+  }
+  
+  /**
+   * Utility function to issue an error message to the log.
+   * 
+   * @param messageId The ID of the message to log.
+   * @param parameters Additional message parameters.
+   */
+  private static void error(String messageId, Object[] parameters) {
+    MessageProvider msg = MessageProvider.getInstance();
+
+    Logger.error(new LogMsg(msg.getMessage(messageId, parameters)));
+  }
+  
+  /**
+   * Build the set of KeyEntryIDs available to the given
+   * keyGroupID.
+   * 
+   * @param keyGroupID The keygroup ID for which the available keys should be
+   * returned.
+   * @return The Set of KeyEntryIDs
+   * identifying the available keys.
+   */
+  private Set buildKeySet(String keyGroupID) {
+    TransactionContext context =
+      TransactionContextManager.getInstance().getTransactionContext();
+    ConfigurationProvider config = context.getConfiguration();
+    Set keyGroupEntries;
+
+    // get the KeyGroup entries from the configuration
+    if (context.getClientCertificate() != null) {
+      X509Certificate cert = context.getClientCertificate()[0];
+      Principal issuer = cert.getIssuerDN();
+      BigInteger serialNumber = cert.getSerialNumber();
+
+      keyGroupEntries =
+        config.getKeyGroupEntries(issuer, serialNumber, keyGroupID);
+    } else {
+      keyGroupEntries = config.getKeyGroupEntries(null, null, keyGroupID);
+    }
+
+    // map the KeyGroup entries to a set of KeyEntryIDs
+    if (keyGroupEntries == null) {
+      return null;
+    } else if (keyGroupEntries.size() == 0) {
+      return Collections.EMPTY_SET;
+    } else {
+      KeyModule module =
+        KeyModuleFactory.getInstance(
+          new TransactionId(context.getTransactionID()));
+      Set keyEntryIDs = module.getPrivateKeyEntryIDs();
+      Set keySet = new HashSet();
+      Iterator iter;
+
+      // filter out the keys that do not exist in the IAIK configuration
+      // by walking through the key entries and checking if the exist in the
+      // keyGroupEntries
+      for (iter = keyEntryIDs.iterator(); iter.hasNext();) {
+        KeyEntryID entryID = (KeyEntryID) iter.next();
+        KeyGroupEntry entry =
+          new KeyGroupEntry(
+            entryID.getModuleID(),
+            entryID.getCertificateIssuer(),
+            entryID.getCertificateSerialNumber());
+        if (keyGroupEntries.contains(entry)) {
+          keySet.add(entryID);
+        }
+      }
+      return keySet;
+    }
+  }
+
+  /**
+   * Build the list of additional signed properties.
+   * 
+   * Based on the generic configuration setting
+   * ConfigurationProvider.TEST_SIGNING_TIME_PROPERTY, a
+   * constant SigningTime will be added to the properties.
+   * 
+   * @return The List of additional signed properties.
+   */
+  private List buildAdditionalSignedProperties() {
+    TransactionContext context =
+      TransactionContextManager.getInstance().getTransactionContext();
+    ConfigurationProvider config = context.getConfiguration();
+    List additionalSignedProperties = Collections.EMPTY_LIST;
+
+    return additionalSignedProperties;
+  }
+
+}
\ No newline at end of file
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureVerificationInvoker.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureVerificationInvoker.java
index 2c4bbd4eb..c979d8407 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureVerificationInvoker.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureVerificationInvoker.java
@@ -136,7 +136,7 @@ public class CMSSignatureVerificationInvoker {
     try {
       // get the signed content
       signedContent = getSignedContent(request);
-
+      
       // build the profile
       profile = profileFactory.createProfile();
 
@@ -159,6 +159,7 @@ public class CMSSignatureVerificationInvoker {
       while (input.read(buf) > 0);
       results = module.verifySignature(signingTime);
       
+      
     } catch (IAIKException e) {
       MOAException moaException = IaikExceptionMapper.getInstance().map(e);
       throw moaException;
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CreateCMSSignatureResponseBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CreateCMSSignatureResponseBuilder.java
new file mode 100644
index 000000000..aa52fe09a
--- /dev/null
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CreateCMSSignatureResponseBuilder.java
@@ -0,0 +1,93 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-SPSS has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.spss.server.invoke;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import at.gv.egovernment.moa.spss.api.SPSSFactory;
+import at.gv.egovernment.moa.spss.api.cmssign.CMSSignatureResponse;
+import at.gv.egovernment.moa.spss.api.cmssign.CreateCMSSignatureResponse;
+import at.gv.egovernment.moa.spss.api.xmlsign.ErrorResponse;
+
+/**
+ * A class to build a CreateCMSSignatureResponse.
+ * 
+ * 
      The methods addSignature() and addError() may be
+ * called in any combination to add CMSignature and
+ * ErrorResponse elements to the response. One of these functions
+ * must be called at least once to produce a 
+ * CreateCMSSignatureResponse.
      
+ * 
+ * 
      The getResponseElement() method then returns the
+ * CreateXMLSignatureResponse built so far.
      
+ * 
+ * @author Patrick Peck
+ * @version $Id$
+ */
+public class CreateCMSSignatureResponseBuilder {
+
+  /** The SPSSFactory for creating API objects. */
+  private SPSSFactory factory = SPSSFactory.getInstance();
+  /** The elements to add to the response. */
+  private List responseElements = new ArrayList();
+
+  /**
+   * Get the CreateCMSSignatureResponse built so far.
+   * 
+   * @return The CreateCMSSignatureResponse built so far.
+   */
+  public CreateCMSSignatureResponse getResponse() {
+    return factory.createCreateCMSSignatureResponse(responseElements);
+  }
+
+  /**
+   * Add a SignatureEnvironment element to the response.
+   * 
+   * @param signatureEnvironment The content to put under the
+   * SignatureEnvironment element. This should either be a
+   * dsig:Signature element (in case of a detached signature) or
+   * the signature environment containing the signature (in case of
+   * an enveloping signature).
+   */
+  public void addCMSSignature(String base64value) {
+    CMSSignatureResponse responseElement = 
+      factory.createCMSSignatureResponse(base64value);
+    responseElements.add(responseElement);
+  }
+
+  /**
+   * Add a ErrorResponse element to the response.
+   *  
+   * @param errorCode The error code.
+   * @param info Additional information about the error.
+   */
+  public void addError(String errorCode, String info) {
+    ErrorResponse errorResponse = 
+      factory.createErrorResponse(Integer.parseInt(errorCode), info);
+    responseElements.add(errorResponse);
+  }
+
+}
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/IaikExceptionMapper.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/IaikExceptionMapper.java
index 869cfefa1..348cb84aa 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/IaikExceptionMapper.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/IaikExceptionMapper.java
@@ -85,7 +85,8 @@ public class IaikExceptionMapper {
       { iaik.server.modules.xmlverify.TransformationException.class, "2265", MOAApplicationException.class },
       { iaik.server.modules.xmlverify.TransformationParsingException.class, "2269", MOAApplicationException.class },
       { iaik.xml.crypto.tsl.ex.TSLEngineDiedException.class, "2290", MOAApplicationException.class },
-      { iaik.xml.crypto.tsl.ex.TSLSearchException.class, "2290", MOAApplicationException.class }
+      { iaik.xml.crypto.tsl.ex.TSLSearchException.class, "2290", MOAApplicationException.class } ,
+      { iaik.server.modules.cmssign.CMSSignatureCreationException.class, "2300", MOAApplicationException.class } ,
       
       
   };
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyCMSSignatureResponseBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyCMSSignatureResponseBuilder.java
index 3b82c6caf..605716d5b 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyCMSSignatureResponseBuilder.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyCMSSignatureResponseBuilder.java
@@ -80,6 +80,7 @@ public class VerifyCMSSignatureResponseBuilder {
   public void addResult(CMSSignatureVerificationResult result, TrustProfile trustProfile, boolean checkQCFromTSL, boolean checkSSCDFromTSL)
     throws MOAException {
 
+	  
     CertificateValidationResult certResult =
       result.getCertificateValidationResult();
     int signatureCheckCode =
@@ -90,8 +91,7 @@ public class VerifyCMSSignatureResponseBuilder {
     SignerInfo signerInfo;
     CheckResult signatureCheck;
     CheckResult certificateCheck;
-    
-    
+
     boolean qualifiedCertificate = false;
     
     // verify qualified certificate checks (certificate or TSL)
@@ -112,6 +112,7 @@ public class VerifyCMSSignatureResponseBuilder {
         certResult.isPublicAuthorityCertificate(),
         certResult.getPublicAuthorityID(),
         checkSSCDFromTSL);
+    
 
     // add SignatureCheck element
     signatureCheck = factory.createCheckResult(signatureCheckCode, null);
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/service/AxisHandler.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/service/AxisHandler.java
index 6bf2317b4..591e26ac2 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/service/AxisHandler.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/service/AxisHandler.java
@@ -393,6 +393,7 @@ public class AxisHandler extends BasicHandler {
 
     try {
       String filename = MOA_SPSS_WSDL_RESOURCE_;
+      
       File file = new File(filename);
       if (file.exists()) {
         //if this resolves to a file, load it
@@ -400,7 +401,7 @@ public class AxisHandler extends BasicHandler {
       } else {
         //else load a named resource in our classloader. 
         instream = this.getClass().getResourceAsStream(filename);
-        if (instream == null) {
+        if (instream == null) {        	
           String errorText = Messages.getMessage("wsdlFileMissing", filename);
           throw new AxisFault(errorText);
         }
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/service/SignatureCreationService.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/service/SignatureCreationService.java
index 7a7bb88bb..e5b12bd8c 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/service/SignatureCreationService.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/service/SignatureCreationService.java
@@ -35,10 +35,15 @@ import org.w3c.dom.Element;
 import at.gv.egovernment.moa.logging.Logger;
 import at.gv.egovernment.moa.spss.MOAException;
 import at.gv.egovernment.moa.spss.MOASystemException;
+import at.gv.egovernment.moa.spss.api.cmssign.CreateCMSSignatureRequest;
+import at.gv.egovernment.moa.spss.api.cmssign.CreateCMSSignatureResponse;
+import at.gv.egovernment.moa.spss.api.xmlbind.CreateCMSSignatureRequestParser;
+import at.gv.egovernment.moa.spss.api.xmlbind.CreateCMSSignatureResponseBuilder;
 import at.gv.egovernment.moa.spss.api.xmlbind.CreateXMLSignatureRequestParser;
 import at.gv.egovernment.moa.spss.api.xmlbind.CreateXMLSignatureResponseBuilder;
 import at.gv.egovernment.moa.spss.api.xmlsign.CreateXMLSignatureRequest;
 import at.gv.egovernment.moa.spss.api.xmlsign.CreateXMLSignatureResponse;
+import at.gv.egovernment.moa.spss.server.invoke.CMSSignatureCreationInvoker;
 import at.gv.egovernment.moa.spss.server.invoke.XMLSignatureCreationInvoker;
 import at.gv.egovernment.moa.spss.server.transaction.TransactionContext;
 import at.gv.egovernment.moa.spss.server.transaction.TransactionContextManager;
@@ -52,6 +57,89 @@ import at.gv.egovernment.moa.util.StreamUtils;
  * @version $Id$
  */
 public class SignatureCreationService {
+	
+	 /**
+	   * Handle a CreateXMLSignatureRequest.
+	   * 
+	   * @param request The CreateXMLSignatureRequest to work on
+	   * (contained in the 0th element of the array).
+	   * @return A CreateXMLSignatureResponse as the only element of
+	   * the Element array.
+	   * @throws AxisFault An error occurred during handling of the message.
+	   */
+	  public Element[] CreateCMSSignatureRequest(Element[] request)
+	    throws AxisFault {
+		  Logger.trace("---- Entering SignatureCreationService");
+	    CMSSignatureCreationInvoker invoker =
+	      CMSSignatureCreationInvoker.getInstance();
+	    Element[] response = new Element[1];
+
+	    // check that we have a CreateXMLSignatureRequest; if not, create an
+	    // AxisFault, just like the org.apache.axis.providers.java.MsgProvider
+	    if (!Constants.MOA_SPSS_CREATE_CMS_REQUEST.equals(request[0].getLocalName()) ||
+	      !Constants.MOA_NS_URI.equals(request[0].getNamespaceURI()))
+	    {
+	      QName qname =
+	        new QName(request[0].getNamespaceURI(), request[0].getLocalName());
+	      throw new AxisFault(
+	        Messages.getMessage("noOperationForQName", qname.toString())); // TODO GK Operation name does not make it into the error repsonse
+	    }
+
+	    // handle the request
+	    try {
+	        
+	      // create a parser and builder for binding API objects to/from XML
+	      CreateCMSSignatureRequestParser requestParser =
+	        new CreateCMSSignatureRequestParser();
+	      CreateCMSSignatureResponseBuilder responseBuilder =
+	        new CreateCMSSignatureResponseBuilder();
+	      Element reparsedReq;
+	      CreateCMSSignatureRequest requestObj;
+	      CreateCMSSignatureResponse responseObj;
+
+	      //since Axis (1.1 ff) has problem with namespaces we take the raw request stored by the Axishandler.
+	      TransactionContext context = TransactionContextManager.getInstance().getTransactionContext();
+	  
+	      // validate the request
+	      reparsedReq = ServiceUtils.reparseRequest(request[0]);//context.getRequest());
+
+	      // convert to API objects
+		  Logger.trace(">>> preparsing Request");
+	      requestObj = requestParser.parse(reparsedReq);
+		  Logger.trace("<<< preparsed Request");
+	      
+		  Logger.trace(">>> creating Signature");
+	      // invoke the core logic
+	      responseObj = invoker.createCMSSignature(requestObj, Collections.EMPTY_SET);
+		  Logger.trace("<<< created Signature");
+
+		  Logger.trace(">>> building Response");
+	      // map back to XML
+	      response[0] = responseBuilder.build(responseObj).getDocumentElement();
+		  Logger.trace("<<< built Response");
+	      
+	      // save response in transaction
+	      context.setResponse(response[0]);
+		  Logger.trace("---- Leaving SignatureCreationService");
+		  
+
+	    } catch (MOAException e) {
+	      AxisFault fault = AxisFault.makeFault(e);
+	      fault.setFaultDetail(new Element[] { e.toErrorResponse()});
+	      Logger.debug("Anfrage zur Signaturerstellung wurde nicht erfolgreich beendet:" 
+	        + System.getProperty("line.separator") + StreamUtils.getStackTraceAsString(e));
+	      throw fault;
+	    } catch (Throwable t) {
+	      MOASystemException e = new MOASystemException("2900", null, t);
+	      AxisFault fault = AxisFault.makeFault(e);
+	      fault.setFaultDetail(new Element[] { e.toErrorResponse()});
+	      Logger.debug("Anfrage zur Signaturerstellung wurde nicht erfolgreich beendet:" 
+	        + System.getProperty("line.separator") + StreamUtils.getStackTraceAsString(e));
+	      throw fault;
+	    }
+
+	    return response;
+	  }
 
   /**
    * Handle a CreateXMLSignatureRequest.
diff --git a/spss/server/serverlib/src/main/resources/resources/properties/spss_messages_de.properties b/spss/server/serverlib/src/main/resources/resources/properties/spss_messages_de.properties
index 5919cebbc..1a6e54089 100644
--- a/spss/server/serverlib/src/main/resources/resources/properties/spss_messages_de.properties
+++ b/spss/server/serverlib/src/main/resources/resources/properties/spss_messages_de.properties
@@ -81,6 +81,8 @@
 2281=XML-Supplement kann nicht serialisiert werden (Reference="{0}")
 2282=Datenobjekt mit der URI={0} wurde dem Request nicht bereit gestellt
 2290=Fehler bei der QC bzw. SSCD Prüfung via TSL
+2300=Fehler bei der Erstellen der CMS Signatur
+2301=Fehler beim Lesen des zu signierenden Datenobjekts
 
 
 2900=Interner Server-Fehler
diff --git a/spss/server/serverlib/src/main/resources/resources/wsdl/MOA-SPSS-1.3.wsdl b/spss/server/serverlib/src/main/resources/resources/wsdl/MOA-SPSS-1.3.wsdl
deleted file mode 100644
index c5cd8fc0f..000000000
--- a/spss/server/serverlib/src/main/resources/resources/wsdl/MOA-SPSS-1.3.wsdl
+++ /dev/null
@@ -1,105 +0,0 @@
-
-
-
-  
-  
-    
-  
-  
-    
-  
-  
-    
-  
-  
-    
-  
-  
-    
-  
-  
-    
-  
-  
-    
-  
-  
-    
-      
-      
-      
-    
-  
-  
-    
-      
-      
-      
-    
-    
-      
-      
-      
-    
-  
-  
-    
-    
-      
-      
-        
-      
-      
-        
-      
-      
-        
-      
-    
-  
-  
-    
-    
-      
-      
-        
-      
-      
-        
-      
-      
-        
-      
-    
-    
-      
-      
-        
-      
-      
-        
-      
-      
-        
-      
-    
-  
-  
-    
-      
-    
-  
-  
-    
-      
-    
-  
-
diff --git a/spss/server/serverlib/src/main/resources/resources/wsdl/MOA-SPSS-1.3.xsd b/spss/server/serverlib/src/main/resources/resources/wsdl/MOA-SPSS-1.3.xsd
deleted file mode 100644
index 756b51279..000000000
--- a/spss/server/serverlib/src/main/resources/resources/wsdl/MOA-SPSS-1.3.xsd
+++ /dev/null
@@ -1,469 +0,0 @@
-
-
-
-  
-  
-  
-  
-  
-    
-      
-        
-      
-    
-  
-  
-    
-      
-      
-        
-          Ermöglichung der Stapelsignatur durch wiederholte Angabe dieses Elements
-        
-        
-          
-            
-              
-                
-                  
-                    
-                  
-                
-              
-            
-            
-              
-                
-                  
-                  
-                    
-                      Auswahl: Entweder explizite Angabe des Signaturorts sowie ggf. sinnvoller Supplements im Zshg. mit der Signaturumgebung, oder Verweis auf ein benanntes Profil
-                    
-                    
-                    
-                  
-                
-              
-            
-          
-          
-        
-      
-    
-  
-  
-  
-    
-      
-        Kardinalität 1..oo erlaubt die Antwort auf eine Stapelsignatur-Anfrage
-      
-      
-        
-          Resultat, falls die Signaturerstellung erfolgreich war
-        
-        
-          
-            
-          
-        
-      
-      
-    
-  
-  
-  
-  
-  
-    
-      
-        
-          
-        
-      
-    
-  
-  
-    
-      
-      
-      
-      
-        
-          mit diesem Profil wird eine Menge von vertrauenswürdigen Wurzelzertifikaten spezifiziert
-        
-      
-    
-  
-  
-  
-  
-    
-      
-        
-          only ds:X509Data and RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any;publicAuthority is included as X509Data/any
-        
-      
-      
-      
-    
-  
-  
-  
-  
-  
-    
-      
-      
-        
-          
-            
-            
-          
-        
-      
-      
-        
-        
-      
-      
-        
-          
-            
-              
-                Pro dsig:Reference-Element in der zu überprüfenden XML-Signatur muss hier ein ReferenceInfo-Element erscheinen. Die Reihenfolge der einzelnen ReferenceInfo Elemente entspricht jener der dsig:Reference Elemente in der XML-Signatur.
-              
-            
-          
-          
-        
-      
-      
-      
-        
-          mit diesem Profil wird eine Menge von vertrauenswürdigen Wurzelzertifikaten spezifiziert
-        
-      
-    
-  
-  
-  
-  
-    
-      
-        
-          only ds:X509Data and ds:RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any; PublicAuthority is included as X509Data/any
-        
-      
-      
-      
-      
-      
-      
-      
-    
-  
-  
-    
-  
-  
-    
-      
-        
-          
-            
-              
-              
-            
-          
-        
-        
-      
-    
-  
-  
-    
-      
-      
-      
-    
-  
-  
-    
-      
-        
-          
-        
-      
-    
-  
-  
-    
-      
-        
-          
-            
-          
-        
-      
-      
-        
-          Auswahl: Entweder explizite Angabe EINER Transformationskette inklusive ggf. sinnvoller Supplements oder Verweis auf ein benanntes Profil
-        
-        
-        
-      
-    
-    
-      
-        
-          
-          
-        
-      
-    
-  
-  
-    
-      
-      
-    
-  
-  
-    
-      
-      
-    
-  
-  
-    
-      
-      
-    
-  
-  
-    
-      
-        
-          
-        
-      
-    
-  
-  
-    
-      
-      
-    
-  
-  
-    
-      
-        
-          
-          
-        
-      
-    
-  
-  
-    
-      
-        
-          
-          
-        
-      
-    
-  
-  
-    
-      
-        
-          
-          
-        
-      
-    
-  
-  
-    
-      
-        
-          
-          
-          
-        
-      
-    
-  
-  
-  
-    
-      Resultat, falls die Signaturerstellung gescheitert ist
-    
-  
-  
-    
-      
-      
-    
-  
-  
-  
-    
-  
-  
-    
-      
-      
-    
-  
-  
-    
-  
-  
-    
-      
-    
-  
-  
-    
-      
-        
-      
-    
-  
-  
-    
-      
-      
-      
-    
-  
-  
-    
-      
-        
-          
-          
-        
-      
-    
-  
-  
-    
-      
-        
-      
-    
-  
-  
-    
-      
-        
-          
-          
-          
-        
-        
-      
-    
-  
-  
-    
-      
-        Ein oder mehrere Transformationswege können von der Applikation an MOA mitgeteilt werden. Die zu prüfende Signatur hat zumindest einem dieser Transformationswege zu entsprechen. Die Angabe kann explizit oder als Profilbezeichner erfolgen.
-      
-      
-      
-        
-          Profilbezeichner für einen Transformationsweg
-        
-      
-    
-  
-  
-  
-  
-    
-      
-    
-  
-  
-    
-      
-        
-      
-    
-  
-  
-    
-      
-    
-  
-  
-    
-      
-        
-      
-    
-  
-  
-    
-      
-        Die Angabe des Transformationsparameters (explizit oder als Hashwert) kann unterlassen werden, wenn die Applikation von der Unveränderlichkeit des Inhalts der in "Transformationsparamter", Attribut "URI" angegebenen URI ausgehen kann.
-      
-      
-        
-          Der Transformationsparameter explizit angegeben.
-        
-      
-      
-        
-          Der Hashwert des Transformationsparameters.
-        
-        
-          
-            
-            
-          
-        
-      
-    
-    
-  
-  
-    
-      
-        
-        
-      
-    
-  
-  
-    
-      Explizite Angabe des Transformationswegs
-    
-    
-      
-        
-        
-          
-            Alle impliziten Transformationsparameter, die zum Durchlaufen der oben angeführten Transformationskette bekannt sein müssen, müssen hier angeführt werden. Das Attribut "URI" bezeichnet den Transformationsparameter in exakt jener Weise, wie er in der zu überprüfenden Signatur gebraucht wird.
-          
-        
-      
-    
-  
-  
-  
-  
-    
-      
-        
-        
-      
-    
-  
-
diff --git a/spss/server/serverlib/src/main/resources/resources/wsdl/MOA-SPSS-1.5.2.wsdl b/spss/server/serverlib/src/main/resources/resources/wsdl/MOA-SPSS-1.5.2.wsdl
new file mode 100644
index 000000000..be40c110d
--- /dev/null
+++ b/spss/server/serverlib/src/main/resources/resources/wsdl/MOA-SPSS-1.5.2.wsdl
@@ -0,0 +1,128 @@
+
+
+
+	
+	
+		
+	
+	
+		
+	
+	
+		
+	
+	
+		
+	
+	
+		
+	
+	
+		
+	
+	
+		
+	
+	
+		
+	
+	
+		
+	
+	
+		
+			
+			
+			
+		
+		
+			
+			
+			
+		
+	
+	
+		
+			
+			
+			
+		
+		
+			
+			
+			
+		
+	
+	
+		
+		
+			
+			
+				
+			
+			
+				
+			
+			
+				
+			
+		
+		
+			
+			
+				
+			
+			
+				
+			
+			
+				
+			
+		
+	
+	
+		
+		
+			
+			
+				
+			
+			
+				
+			
+			
+				
+			
+		
+		
+			
+			
+				
+			
+			
+				
+			
+			
+				
+			
+		
+	
+	
+		
+			
+		
+	
+	
+		
+			
+		
+	
+
diff --git a/spss/server/serverlib/src/main/resources/resources/wsdl/MOA-SPSS-1.5.2.xsd b/spss/server/serverlib/src/main/resources/resources/wsdl/MOA-SPSS-1.5.2.xsd
new file mode 100644
index 000000000..4ae327ab3
--- /dev/null
+++ b/spss/server/serverlib/src/main/resources/resources/wsdl/MOA-SPSS-1.5.2.xsd
@@ -0,0 +1,471 @@
+
+
+
+
+	
+	
+	
+	
+	
+		
+			
+				
+			
+		
+	
+	
+		
+			
+			
+				
+					Ermöglichung der Stapelsignatur durch wiederholte Angabe dieses Elements
+				
+				
+					
+						
+							
+								
+									
+										
+									
+								
+							
+						
+						
+							
+								
+									
+									
+										
+											Auswahl: Entweder explizite Angabe des Signaturorts sowie ggf. sinnvoller Supplements im Zshg. mit der Signaturumgebung, oder Verweis auf ein benanntes Profil
+										
+										
+										
+									
+								
+							
+						
+					
+					
+				
+			
+		
+	
+	
+	
+		
+			
+				Kardinalität 1..oo erlaubt die Antwort auf eine Stapelsignatur-Anfrage
+			
+			
+				
+					Resultat, falls die Signaturerstellung erfolgreich war
+				
+				
+					
+						
+					
+				
+			
+			
+		
+	
+	
+	
+	
+	
+		
+			
+				
+					
+				
+			
+		
+	
+	
+		
+			
+			
+			
+			
+				
+					mit diesem Profil wird eine Menge von vertrauenswürdigen Wurzelzertifikaten spezifiziert
+				
+			
+		
+	
+	
+	
+	
+		
+			
+				
+					only ds:X509Data and RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any;publicAuthority is included as X509Data/any
+				
+			
+			
+			
+		
+	
+	
+	
+	
+	
+		
+			
+			
+				
+					
+						
+						
+					
+				
+			
+			
+				
+				
+			
+			
+				
+					
+						
+							
+								Pro dsig:Reference-Element in der zu überprüfenden XML-Signatur muss hier ein ReferenceInfo-Element erscheinen. Die Reihenfolge der einzelnen ReferenceInfo Elemente entspricht jener der dsig:Reference Elemente in der XML-Signatur.
+							
+						
+					
+					
+				
+			
+			
+			
+				
+					mit diesem Profil wird eine Menge von vertrauenswürdigen Wurzelzertifikaten spezifiziert
+				
+			
+		
+	
+	
+	
+	
+		
+			
+				
+					only ds:X509Data and ds:RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any; PublicAuthority is included as X509Data/any
+				
+			
+			
+			
+			
+			
+			
+						
+		
+	
+	
+		
+	
+	
+		
+			
+				
+					
+						
+							
+							
+						
+					
+				
+				
+			
+		
+	
+	
+		
+			
+			
+			
+		
+	
+	
+		
+			
+				
+					
+				
+			
+		
+	
+	
+		
+			
+				
+					
+						
+					
+				
+			
+			
+				
+					Auswahl: Entweder explizite Angabe EINER Transformationskette inklusive ggf. sinnvoller Supplements oder Verweis auf ein benanntes Profil
+				
+				
+				
+			
+		
+		
+			
+				
+					
+					
+				
+			
+		
+	
+	
+		
+			
+			
+		
+	
+	
+		
+			
+			
+		
+	
+	
+		
+			
+			
+		
+	
+	
+		
+			
+				
+					
+				
+			
+		
+	
+	
+		
+			
+			
+		
+	
+	
+		
+			
+				
+					
+					
+				
+			
+		
+	
+	
+		
+			
+				
+					
+					
+				
+			
+		
+	
+	
+		
+			
+				
+					
+					
+				
+			
+		
+	
+	
+		
+			
+				
+					
+					
+					
+				
+			
+		
+	
+	
+	
+		
+			Resultat, falls die Signaturerstellung gescheitert ist
+		
+	
+	
+		
+			
+			
+		
+	
+	
+	
+		
+	
+	
+		
+			
+			
+		
+	
+	
+		
+	
+	
+		
+			
+		
+	
+	
+		
+			
+				
+			
+		
+	
+	
+		
+			
+			
+			
+		
+	
+	
+		
+			
+				
+					
+					
+				
+			
+		
+	
+	
+		
+			
+				
+			
+		
+	
+	
+		
+			
+				
+					
+					
+					
+				
+				
+			
+		
+	
+	
+		
+			
+				Ein oder mehrere Transformationswege können von der Applikation an MOA mitgeteilt werden. Die zu prüfende Signatur hat zumindest einem dieser Transformationswege zu entsprechen. Die Angabe kann explizit oder als Profilbezeichner erfolgen.
+			
+			
+			
+				
+					Profilbezeichner für einen Transformationsweg
+				
+			
+		
+	
+	
+	
+	
+	
+		
+			
+		
+	
+	
+		
+			
+				
+			
+		
+	
+	
+		
+			
+		
+	
+	
+		
+			
+				
+			
+		
+	
+	
+		
+			
+				Die Angabe des Transformationsparameters (explizit oder als Hashwert) kann unterlassen werden, wenn die Applikation von der Unveränderlichkeit des Inhalts der in "Transformationsparamter", Attribut "URI" angegebenen URI ausgehen kann.
+			
+			
+				
+					Der Transformationsparameter explizit angegeben.
+				
+			
+			
+				
+					Der Hashwert des Transformationsparameters.
+				
+				
+					
+						
+						
+					
+				
+			
+		
+		
+	
+	
+		
+			
+				
+				
+			
+		
+	
+	
+		
+			Explizite Angabe des Transformationswegs
+		
+		
+			
+				
+				
+					
+						Alle impliziten Transformationsparameter, die zum Durchlaufen der oben angeführten Transformationskette bekannt sein müssen, müssen hier angeführt werden. Das Attribut "URI" bezeichnet den Transformationsparameter in exakt jener Weise, wie er in der zu überprüfenden Signatur gebraucht wird.
+					
+				
+			
+		
+	
+	
+	
+	
+		
+			
+				
+				
+			
+		
+	
+
diff --git a/spss/server/serverws/.classpath b/spss/server/serverws/.classpath
index 767a2a2de..a0edd58fe 100644
--- a/spss/server/serverws/.classpath
+++ b/spss/server/serverws/.classpath
@@ -6,6 +6,7 @@
 			
 		
 	
+	
 	
 		
 			
diff --git a/spss/server/serverws/.project b/spss/server/serverws/.project
index fa2286335..7b8e89662 100644
--- a/spss/server/serverws/.project
+++ b/spss/server/serverws/.project
@@ -22,11 +22,6 @@
 			
 			
 		
-		
-			org.maven.ide.eclipse.maven2Builder
-			
-			
-		
 		
 			org.eclipse.m2e.core.maven2Builder
 			
@@ -35,11 +30,9 @@
 	
 	
 		org.eclipse.m2e.core.maven2Nature
-		org.eclipse.jdt.core.javanature
-		org.maven.ide.eclipse.maven2Nature
 		org.eclipse.wst.common.project.facet.core.nature
+		org.eclipse.jdt.core.javanature
 		org.eclipse.wst.common.modulecore.ModuleCoreNature
 		org.eclipse.jem.workbench.JavaEMFNature
-		org.eclipse.wst.jsdt.core.jsNature
 	
 
diff --git a/spss/server/serverws/.settings/org.eclipse.jdt.core.prefs b/spss/server/serverws/.settings/org.eclipse.jdt.core.prefs
index cbb750c06..9ab0af09b 100644
--- a/spss/server/serverws/.settings/org.eclipse.jdt.core.prefs
+++ b/spss/server/serverws/.settings/org.eclipse.jdt.core.prefs
@@ -1,12 +1,6 @@
-eclipse.preferences.version=1
-org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
-org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5
-org.eclipse.jdt.core.compiler.codegen.unusedLocal=preserve
-org.eclipse.jdt.core.compiler.compliance=1.5
-org.eclipse.jdt.core.compiler.debug.lineNumber=generate
-org.eclipse.jdt.core.compiler.debug.localVariable=generate
-org.eclipse.jdt.core.compiler.debug.sourceFile=generate
-org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
-org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
+#Mon Apr 29 14:25:29 CEST 2013
 org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
+org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5
+eclipse.preferences.version=1
 org.eclipse.jdt.core.compiler.source=1.5
+org.eclipse.jdt.core.compiler.compliance=1.5
diff --git a/spss/server/serverws/.settings/org.eclipse.wst.common.component b/spss/server/serverws/.settings/org.eclipse.wst.common.component
index c325a5007..82f65bee6 100644
--- a/spss/server/serverws/.settings/org.eclipse.wst.common.component
+++ b/spss/server/serverws/.settings/org.eclipse.wst.common.component
@@ -8,6 +8,9 @@
         
         
         
+        
+        
+        
     
         
   
diff --git a/spss/server/serverws/pom.xml b/spss/server/serverws/pom.xml
index dd0027df6..c61d1ae2b 100644
--- a/spss/server/serverws/pom.xml
+++ b/spss/server/serverws/pom.xml
@@ -22,7 +22,8 @@
             
                 org.apache.maven.plugins
                 maven-war-plugin
-                2.0.2
+                2.1.1
+                
                 
                     
                         
diff --git a/spss/server/serverws/resources/wsdl/MOA-SPSS-1.3.wsdl b/spss/server/serverws/resources/wsdl/MOA-SPSS-1.3.wsdl
deleted file mode 100644
index 68c3d0ebd..000000000
--- a/spss/server/serverws/resources/wsdl/MOA-SPSS-1.3.wsdl
+++ /dev/null
@@ -1,105 +0,0 @@
-
-
-
-  
-  
-    
-  
-  
-    
-  
-  
-    
-  
-  
-    
-  
-  
-    
-  
-  
-    
-  
-  
-    
-  
-  
-    
-      
-      
-      
-    
-  
-  
-    
-      
-      
-      
-    
-    
-      
-      
-      
-    
-  
-  
-    
-    
-      
-      
-        
-      
-      
-        
-      
-      
-        
-      
-    
-  
-  
-    
-    
-      
-      
-        
-      
-      
-        
-      
-      
-        
-      
-    
-    
-      
-      
-        
-      
-      
-        
-      
-      
-        
-      
-    
-  
-  
-    
-      
-    
-  
-  
-    
-      
-    
-  
-
diff --git a/spss/server/serverws/resources/wsdl/MOA-SPSS-1.3.xsd b/spss/server/serverws/resources/wsdl/MOA-SPSS-1.3.xsd
deleted file mode 100644
index 756b51279..000000000
--- a/spss/server/serverws/resources/wsdl/MOA-SPSS-1.3.xsd
+++ /dev/null
@@ -1,469 +0,0 @@
-
-
-
-  
-  
-  
-  
-  
-    
-      
-        
-      
-    
-  
-  
-    
-      
-      
-        
-          Ermöglichung der Stapelsignatur durch wiederholte Angabe dieses Elements
-        
-        
-          
-            
-              
-                
-                  
-                    
-                  
-                
-              
-            
-            
-              
-                
-                  
-                  
-                    
-                      Auswahl: Entweder explizite Angabe des Signaturorts sowie ggf. sinnvoller Supplements im Zshg. mit der Signaturumgebung, oder Verweis auf ein benanntes Profil
-                    
-                    
-                    
-                  
-                
-              
-            
-          
-          
-        
-      
-    
-  
-  
-  
-    
-      
-        Kardinalität 1..oo erlaubt die Antwort auf eine Stapelsignatur-Anfrage
-      
-      
-        
-          Resultat, falls die Signaturerstellung erfolgreich war
-        
-        
-          
-            
-          
-        
-      
-      
-    
-  
-  
-  
-  
-  
-    
-      
-        
-          
-        
-      
-    
-  
-  
-    
-      
-      
-      
-      
-        
-          mit diesem Profil wird eine Menge von vertrauenswürdigen Wurzelzertifikaten spezifiziert
-        
-      
-    
-  
-  
-  
-  
-    
-      
-        
-          only ds:X509Data and RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any;publicAuthority is included as X509Data/any
-        
-      
-      
-      
-    
-  
-  
-  
-  
-  
-    
-      
-      
-        
-          
-            
-            
-          
-        
-      
-      
-        
-        
-      
-      
-        
-          
-            
-              
-                Pro dsig:Reference-Element in der zu überprüfenden XML-Signatur muss hier ein ReferenceInfo-Element erscheinen. Die Reihenfolge der einzelnen ReferenceInfo Elemente entspricht jener der dsig:Reference Elemente in der XML-Signatur.
-              
-            
-          
-          
-        
-      
-      
-      
-        
-          mit diesem Profil wird eine Menge von vertrauenswürdigen Wurzelzertifikaten spezifiziert
-        
-      
-    
-  
-  
-  
-  
-    
-      
-        
-          only ds:X509Data and ds:RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any; PublicAuthority is included as X509Data/any
-        
-      
-      
-      
-      
-      
-      
-      
-    
-  
-  
-    
-  
-  
-    
-      
-        
-          
-            
-              
-              
-            
-          
-        
-        
-      
-    
-  
-  
-    
-      
-      
-      
-    
-  
-  
-    
-      
-        
-          
-        
-      
-    
-  
-  
-    
-      
-        
-          
-            
-          
-        
-      
-      
-        
-          Auswahl: Entweder explizite Angabe EINER Transformationskette inklusive ggf. sinnvoller Supplements oder Verweis auf ein benanntes Profil
-        
-        
-        
-      
-    
-    
-      
-        
-          
-          
-        
-      
-    
-  
-  
-    
-      
-      
-    
-  
-  
-    
-      
-      
-    
-  
-  
-    
-      
-      
-    
-  
-  
-    
-      
-        
-          
-        
-      
-    
-  
-  
-    
-      
-      
-    
-  
-  
-    
-      
-        
-          
-          
-        
-      
-    
-  
-  
-    
-      
-        
-          
-          
-        
-      
-    
-  
-  
-    
-      
-        
-          
-          
-        
-      
-    
-  
-  
-    
-      
-        
-          
-          
-          
-        
-      
-    
-  
-  
-  
-    
-      Resultat, falls die Signaturerstellung gescheitert ist
-    
-  
-  
-    
-      
-      
-    
-  
-  
-  
-    
-  
-  
-    
-      
-      
-    
-  
-  
-    
-  
-  
-    
-      
-    
-  
-  
-    
-      
-        
-      
-    
-  
-  
-    
-      
-      
-      
-    
-  
-  
-    
-      
-        
-          
-          
-        
-      
-    
-  
-  
-    
-      
-        
-      
-    
-  
-  
-    
-      
-        
-          
-          
-          
-        
-        
-      
-    
-  
-  
-    
-      
-        Ein oder mehrere Transformationswege können von der Applikation an MOA mitgeteilt werden. Die zu prüfende Signatur hat zumindest einem dieser Transformationswege zu entsprechen. Die Angabe kann explizit oder als Profilbezeichner erfolgen.
-      
-      
-      
-        
-          Profilbezeichner für einen Transformationsweg
-        
-      
-    
-  
-  
-  
-  
-    
-      
-    
-  
-  
-    
-      
-        
-      
-    
-  
-  
-    
-      
-    
-  
-  
-    
-      
-        
-      
-    
-  
-  
-    
-      
-        Die Angabe des Transformationsparameters (explizit oder als Hashwert) kann unterlassen werden, wenn die Applikation von der Unveränderlichkeit des Inhalts der in "Transformationsparamter", Attribut "URI" angegebenen URI ausgehen kann.
-      
-      
-        
-          Der Transformationsparameter explizit angegeben.
-        
-      
-      
-        
-          Der Hashwert des Transformationsparameters.
-        
-        
-          
-            
-            
-          
-        
-      
-    
-    
-  
-  
-    
-      
-        
-        
-      
-    
-  
-  
-    
-      Explizite Angabe des Transformationswegs
-    
-    
-      
-        
-        
-          
-            Alle impliziten Transformationsparameter, die zum Durchlaufen der oben angeführten Transformationskette bekannt sein müssen, müssen hier angeführt werden. Das Attribut "URI" bezeichnet den Transformationsparameter in exakt jener Weise, wie er in der zu überprüfenden Signatur gebraucht wird.
-          
-        
-      
-    
-  
-  
-  
-  
-    
-      
-        
-        
-      
-    
-  
-
diff --git a/spss/server/serverws/resources/wsdl/MOA-SPSS-1.5.2.wsdl b/spss/server/serverws/resources/wsdl/MOA-SPSS-1.5.2.wsdl
new file mode 100644
index 000000000..135f26f68
--- /dev/null
+++ b/spss/server/serverws/resources/wsdl/MOA-SPSS-1.5.2.wsdl
@@ -0,0 +1,128 @@
+
+
+
+	
+	
+		
+	
+	
+		
+	
+	
+		
+	
+	
+		
+	
+	
+		
+	
+	
+		
+	
+	
+		
+	
+	
+		
+	
+	
+		
+	
+	
+		
+			
+			
+			
+		
+		
+			
+			
+			
+		
+	
+	
+		
+			
+			
+			
+		
+		
+			
+			
+			
+		
+	
+	
+		
+		
+			
+			
+				
+			
+			
+				
+			
+			
+				
+			
+		
+		
+			
+			
+				
+			
+			
+				
+			
+			
+				
+			
+		
+	
+	
+		
+		
+			
+			
+				
+			
+			
+				
+			
+			
+				
+			
+		
+		
+			
+			
+				
+			
+			
+				
+			
+			
+				
+			
+		
+	
+	
+		
+			
+		
+	
+	
+		
+			
+		
+	
+
diff --git a/spss/server/serverws/resources/wsdl/MOA-SPSS-1.5.2.xsd b/spss/server/serverws/resources/wsdl/MOA-SPSS-1.5.2.xsd
new file mode 100644
index 000000000..06232f189
--- /dev/null
+++ b/spss/server/serverws/resources/wsdl/MOA-SPSS-1.5.2.xsd
@@ -0,0 +1,551 @@
+
+
+
+	
+	
+	
+	
+	
+		
+			
+				
+			
+		
+	
+	
+		
+			
+			
+				
+					Ermöglichung der Stapelsignatur durch wiederholte Angabe dieses Elements
+				
+				
+					
+						
+							
+								
+									
+								
+							
+						
+					
+					
+				
+			
+		
+	
+	
+	
+	
+		
+			
+				Kardinalität 1..oo erlaubt die Antwort auf eine Stapelsignatur-Anfrage
+			
+			
+				
+					Resultat, falls die Signaturerstellung erfolgreich war
+				
+			
+			
+		
+	
+	
+	
+	
+		
+			
+				
+			
+		
+	
+	
+		
+			
+			
+				
+					Ermöglichung der Stapelsignatur durch wiederholte Angabe dieses Elements
+				
+				
+					
+						
+							
+								
+									
+										
+									
+								
+							
+						
+						
+							
+								
+									
+									
+										
+											Auswahl: Entweder explizite Angabe des Signaturorts sowie ggf. sinnvoller Supplements im Zshg. mit der Signaturumgebung, oder Verweis auf ein benanntes Profil
+										
+										
+										
+									
+								
+							
+						
+					
+					
+				
+			
+		
+	
+	
+	
+		
+			
+				Kardinalität 1..oo erlaubt die Antwort auf eine Stapelsignatur-Anfrage
+			
+			
+				
+					Resultat, falls die Signaturerstellung erfolgreich war
+				
+				
+					
+						
+					
+				
+			
+			
+		
+	
+	
+	
+	
+	
+		
+			
+				
+					
+				
+			
+		
+	
+	
+		
+			
+			
+			
+			
+				
+					mit diesem Profil wird eine Menge von vertrauenswürdigen Wurzelzertifikaten spezifiziert
+				
+			
+		
+	
+	
+	
+	
+		
+			
+				
+					only ds:X509Data and RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any;publicAuthority is included as X509Data/any
+				
+			
+			
+			
+		
+	
+	
+	
+	
+	
+		
+			
+			
+				
+					
+						
+						
+					
+				
+			
+			
+				
+				
+			
+			
+				
+					
+						
+							
+								Pro dsig:Reference-Element in der zu überprüfenden XML-Signatur muss hier ein ReferenceInfo-Element erscheinen. Die Reihenfolge der einzelnen ReferenceInfo Elemente entspricht jener der dsig:Reference Elemente in der XML-Signatur.
+							
+						
+					
+					
+				
+			
+			
+			
+				
+					mit diesem Profil wird eine Menge von vertrauenswürdigen Wurzelzertifikaten spezifiziert
+				
+			
+		
+	
+	
+	
+	
+		
+			
+				
+					only ds:X509Data and ds:RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any; PublicAuthority is included as X509Data/any
+				
+			
+			
+			
+			
+			
+			
+			
+		
+	
+	
+		
+	
+	
+		
+			
+				
+					
+						
+							
+							
+						
+					
+				
+				
+			
+		
+	
+	
+		
+			
+			
+			
+		
+	
+	
+		
+			
+				
+					
+				
+			
+		
+	
+	
+		
+			
+				
+					
+						
+					
+				
+			
+			
+				
+					Auswahl: Entweder explizite Angabe EINER Transformationskette inklusive ggf. sinnvoller Supplements oder Verweis auf ein benanntes Profil
+				
+				
+				
+			
+		
+		
+			
+				
+					
+					
+				
+			
+		
+	
+	
+		
+			
+				
+					
+						
+					
+				
+			
+		
+		
+			
+				
+					
+					
+				
+			
+		
+	
+	
+		
+			
+			
+		
+	
+	
+		
+			
+			
+		
+	
+	
+		
+			
+			
+		
+	
+	
+		
+			
+			
+		
+	
+	
+		
+			
+				
+					
+				
+			
+		
+	
+	
+		
+			
+				
+					
+					
+				
+			
+		
+	
+	
+		
+			
+			
+		
+	
+	
+		
+			
+				
+					
+					
+				
+			
+		
+	
+	
+		
+			
+				
+					
+					
+				
+			
+		
+	
+	
+		
+			
+				
+					
+					
+				
+			
+		
+	
+	
+		
+			
+				
+					
+					
+					
+				
+			
+		
+	
+	
+	
+		
+			Resultat, falls die Signaturerstellung gescheitert ist
+		
+	
+	
+		
+			
+			
+		
+	
+	
+	
+		
+	
+	
+		
+			
+			
+		
+	
+	
+		
+	
+	
+		
+			
+		
+	
+	
+		
+			
+				
+			
+		
+	
+	
+		
+			
+			
+			
+		
+	
+	
+		
+			
+				
+					
+					
+				
+			
+		
+	
+	
+		
+			
+				
+			
+		
+	
+	
+		
+			
+				
+					
+					
+					
+				
+				
+			
+		
+	
+	
+		
+			
+				Ein oder mehrere Transformationswege können von der Applikation an MOA mitgeteilt werden. Die zu prüfende Signatur hat zumindest einem dieser Transformationswege zu entsprechen. Die Angabe kann explizit oder als Profilbezeichner erfolgen.
+			
+			
+			
+				
+					Profilbezeichner für einen Transformationsweg
+				
+			
+		
+	
+	
+	
+	
+	
+		
+			
+		
+	
+	
+		
+			
+				
+			
+		
+	
+	
+		
+			
+		
+	
+	
+		
+			
+				
+			
+		
+	
+	
+		
+			
+				Die Angabe des Transformationsparameters (explizit oder als Hashwert) kann unterlassen werden, wenn die Applikation von der Unveränderlichkeit des Inhalts der in "Transformationsparamter", Attribut "URI" angegebenen URI ausgehen kann.
+			
+			
+				
+					Der Transformationsparameter explizit angegeben.
+				
+			
+			
+				
+					Der Hashwert des Transformationsparameters.
+				
+				
+					
+						
+						
+					
+				
+			
+		
+		
+	
+	
+		
+			
+				
+				
+			
+		
+	
+	
+		
+			Explizite Angabe des Transformationswegs
+		
+		
+			
+				
+				
+					
+						Alle impliziten Transformationsparameter, die zum Durchlaufen der oben angeführten Transformationskette bekannt sein müssen, müssen hier angeführt werden. Das Attribut "URI" bezeichnet den Transformationsparameter in exakt jener Weise, wie er in der zu überprüfenden Signatur gebraucht wird.
+					
+				
+			
+		
+	
+	
+	
+	
+		
+			
+				
+				
+			
+		
+	
+
diff --git a/spss/server/serverws/src/main/webapp/WEB-INF/server-config.wsdd b/spss/server/serverws/src/main/webapp/WEB-INF/server-config.wsdd
index 088fe76fd..eaa50865d 100644
--- a/spss/server/serverws/src/main/webapp/WEB-INF/server-config.wsdd
+++ b/spss/server/serverws/src/main/webapp/WEB-INF/server-config.wsdd
@@ -14,9 +14,12 @@
 
   
     http://reference.e-government.gv.at/namespace/moa/20020822#
-    
+    
     
-    /resources/wsdl/MOA-SPSS-1.3.wsdl
+    
+    C:\eclipse_workspaces\MOA_Git01\moa-idspss\spss\server\serverws\resources\wsdl\MOA-SPSS-1.5.2.wsdl
+    
+    
     
       
     
@@ -29,7 +32,7 @@
     http://reference.e-government.gv.at/namespace/moa/20020822#
     
     
-    /resources/wsdl/MOA-SPSS-1.3.wsdl
+    /resources/wsdl/MOA-SPSS-1.5.2.wsdl
     
       
     
diff --git a/spss/server/tools/.classpath b/spss/server/tools/.classpath
index 65abf443d..21bdbd0bc 100644
--- a/spss/server/tools/.classpath
+++ b/spss/server/tools/.classpath
@@ -1,12 +1,16 @@
 
 
-  
-  
-  
-  
-  
-  
-  
-  
-  
-
\ No newline at end of file
+	
+	
+	
+	
+	
+	
+	
+	
+		
+			
+		
+	
+	
+
diff --git a/spss/server/tools/.settings/org.eclipse.jdt.core.prefs b/spss/server/tools/.settings/org.eclipse.jdt.core.prefs
index 3bfb290ea..c788ee346 100644
--- a/spss/server/tools/.settings/org.eclipse.jdt.core.prefs
+++ b/spss/server/tools/.settings/org.eclipse.jdt.core.prefs
@@ -1,6 +1,8 @@
-#Thu Dec 27 15:45:21 CET 2012
-org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
-org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5
 eclipse.preferences.version=1
-org.eclipse.jdt.core.compiler.source=1.5
-org.eclipse.jdt.core.compiler.compliance=1.5
+org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
+org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7
+org.eclipse.jdt.core.compiler.compliance=1.7
+org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
+org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
+org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
+org.eclipse.jdt.core.compiler.source=1.7
-- 
cgit v1.2.3


From fe75121d894e86d29a2804f44438ed594c717097 Mon Sep 17 00:00:00 2001
From: Klaus Stranacher 
Date: Wed, 15 May 2013 15:19:21 +0200
Subject: Update iaik libraries: iaik-moa and jce Update iaik-moa exception
 import whitelisting activated in iaik-moa

---
 pom.xml                                            |   9 +++++----
 .../iaik_jce_full/5.101/iaik_jce_full-5.101.jar    | Bin 0 -> 1115849 bytes
 .../5.101/iaik_jce_full-5.101.jar.lastUpdated      |  22 +++++++++++++++++++++
 .../5.101/iaik_jce_full-5.101.jar.md5              |   1 +
 .../5.101/iaik_jce_full-5.101.jar.sha1             |   1 +
 .../iaik_jce_full/5.101/iaik_jce_full-5.101.pom    |   9 +++++++++
 .../5.101/iaik_jce_full-5.101.pom.lastUpdated      |  12 +++++++++++
 .../5.101/iaik_jce_full-5.101.pom.md5              |   1 +
 .../5.101/iaik_jce_full-5.101.pom.sha1             |   1 +
 repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar | Bin 0 -> 767868 bytes
 .../prod/iaik_moa/1.5/iaik_moa-1.5.jar.lastUpdated |  22 +++++++++++++++++++++
 .../iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar.md5    |   1 +
 .../iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar.sha1   |   1 +
 repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom |   9 +++++++++
 .../prod/iaik_moa/1.5/iaik_moa-1.5.pom.lastUpdated |  12 +++++++++++
 .../iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom.md5    |   1 +
 .../iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom.sha1   |   1 +
 .../iaik/prod/iaik_moa/maven-metadata-MOA.xml      |   5 +++--
 .../iaik/prod/iaik_moa/maven-metadata-local.xml    |   6 +++---
 .../server/config/ConfigurationPartsBuilder.java   |  19 +++++++++---------
 .../invoke/CMSSignatureVerificationInvoker.java    |   4 ++--
 .../spss/server/invoke/IaikExceptionMapper.java    |   8 ++++----
 .../server/invoke/XMLSignatureCreationInvoker.java |   4 ++--
 .../invoke/XMLSignatureVerificationInvoker.java    |   4 ++--
 24 files changed, 125 insertions(+), 28 deletions(-)
 create mode 100644 repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.jar
 create mode 100644 repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.jar.lastUpdated
 create mode 100644 repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.jar.md5
 create mode 100644 repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.jar.sha1
 create mode 100644 repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.pom
 create mode 100644 repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.pom.lastUpdated
 create mode 100644 repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.pom.md5
 create mode 100644 repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.pom.sha1
 create mode 100644 repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar
 create mode 100644 repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar.lastUpdated
 create mode 100644 repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar.md5
 create mode 100644 repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar.sha1
 create mode 100644 repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom
 create mode 100644 repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom.lastUpdated
 create mode 100644 repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom.md5
 create mode 100644 repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom.sha1

(limited to 'spss/server/serverlib/src/main/java/at')

diff --git a/pom.xml b/pom.xml
index d2d3f7bf7..19674de20 100644
--- a/pom.xml
+++ b/pom.xml
@@ -68,8 +68,8 @@
                 
                     moa
                     
-                        
+                        id/assembly-auth.xml-->
+                        
                         spss/assembly.xml
                         
                     
@@ -243,13 +243,14 @@
             
                 iaik.prod
                 iaik_jce_full
-                4.0_MOA
+                
+                5.101
                 compile
             
             
                 iaik.prod
                 iaik_moa
-                1.33.1
+                1.5
                 compile
             
             
diff --git a/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.jar b/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.jar
new file mode 100644
index 000000000..fd0457332
Binary files /dev/null and b/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.jar differ
diff --git a/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.jar.lastUpdated b/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.jar.lastUpdated
new file mode 100644
index 000000000..42ff556c7
--- /dev/null
+++ b/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.jar.lastUpdated
@@ -0,0 +1,22 @@
+#NOTE: This is an internal implementation file, its format can be changed without prior notice.
+#Wed May 15 13:18:02 CEST 2013
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\handbook\\clients\\api/../../../../../repository/.lastUpdated=1368616682476
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\idserverlib/../../../repository/.lastUpdated=1368616682207
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\common/../repository/.lastUpdated=1368616681300
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverlib/../../../repository/.lastUpdated=1368616681996
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverws/../../../repository/.lastUpdated=1368616682060
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverws/../../../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\auth/../../../repository/.lastUpdated=1368616682416
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\auth/../../../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\handbook\\clients\\webservice/../../../../../repository/.lastUpdated=1368616682584
+http\://repo.maven.apache.org/maven2/.lastUpdated=1368616681623
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverlib/../../../repository/.error=
+http\://repo.maven.apache.org/maven2/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\tools/../../../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\proxy/../../../repository/.lastUpdated=1368616682294
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\tools/../../../repository/.lastUpdated=1368616681780
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\proxy/../../../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\idserverlib/../../../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\handbook\\clients\\api/../../../../../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\common/../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\handbook\\clients\\webservice/../../../../../repository/.error=
diff --git a/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.jar.md5 b/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.jar.md5
new file mode 100644
index 000000000..9c56fb171
--- /dev/null
+++ b/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.jar.md5
@@ -0,0 +1 @@
+af60ce7b632e2f9871e0a66caf61d6f5
\ No newline at end of file
diff --git a/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.jar.sha1 b/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.jar.sha1
new file mode 100644
index 000000000..9f9892687
--- /dev/null
+++ b/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.jar.sha1
@@ -0,0 +1 @@
+219988809f988c415491cecf007663c838cba88e
\ No newline at end of file
diff --git a/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.pom b/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.pom
new file mode 100644
index 000000000..7ca126e32
--- /dev/null
+++ b/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.pom
@@ -0,0 +1,9 @@
+
+
+  4.0.0
+  iaik.prod
+  iaik_jce_full
+  5.101
+  POM was created from install:install-file
+
diff --git a/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.pom.lastUpdated b/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.pom.lastUpdated
new file mode 100644
index 000000000..65ee40f75
--- /dev/null
+++ b/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.pom.lastUpdated
@@ -0,0 +1,12 @@
+#NOTE: This is an internal implementation file, its format can be changed without prior notice.
+#Wed May 15 13:18:07 CEST 2013
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\common/../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverws/../../../repository/.error=
+http\://repo.maven.apache.org/maven2/.lastUpdated=1368616681271
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\proxy/../../../repository/.lastUpdated=1368616685249
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverws/../../../repository/.lastUpdated=1368616687679
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\auth/../../../repository/.error=
+http\://repo.maven.apache.org/maven2/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\common/../repository/.lastUpdated=1368616680663
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\proxy/../../../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\auth/../../../repository/.lastUpdated=1368616687203
diff --git a/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.pom.md5 b/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.pom.md5
new file mode 100644
index 000000000..554ae2add
--- /dev/null
+++ b/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.pom.md5
@@ -0,0 +1 @@
+85210f5905c1b5b256c49ef421135393
\ No newline at end of file
diff --git a/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.pom.sha1 b/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.pom.sha1
new file mode 100644
index 000000000..ba732463f
--- /dev/null
+++ b/repository/iaik/prod/iaik_jce_full/5.101/iaik_jce_full-5.101.pom.sha1
@@ -0,0 +1 @@
+e40fc538b46ef614833d2cc38349b32e3ee691c3
\ No newline at end of file
diff --git a/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar b/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar
new file mode 100644
index 000000000..f6864c9c2
Binary files /dev/null and b/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar differ
diff --git a/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar.lastUpdated b/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar.lastUpdated
new file mode 100644
index 000000000..39508d157
--- /dev/null
+++ b/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar.lastUpdated
@@ -0,0 +1,22 @@
+#NOTE: This is an internal implementation file, its format can be changed without prior notice.
+#Wed May 15 13:18:18 CEST 2013
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\handbook\\clients\\api/../../../../../repository/.lastUpdated=1368616698028
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\idserverlib/../../../repository/.lastUpdated=1368616697758
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\common/../repository/.lastUpdated=1368616696933
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverlib/../../../repository/.lastUpdated=1368616697582
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverws/../../../repository/.lastUpdated=1368616697635
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverws/../../../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\auth/../../../repository/.lastUpdated=1368616697964
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\auth/../../../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\handbook\\clients\\webservice/../../../../../repository/.lastUpdated=1368616698288
+http\://repo.maven.apache.org/maven2/.lastUpdated=1368616697395
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverlib/../../../repository/.error=
+http\://repo.maven.apache.org/maven2/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\tools/../../../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\proxy/../../../repository/.lastUpdated=1368616697883
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\tools/../../../repository/.lastUpdated=1368616697505
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\proxy/../../../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\idserverlib/../../../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\handbook\\clients\\api/../../../../../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\common/../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\handbook\\clients\\webservice/../../../../../repository/.error=
diff --git a/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar.md5 b/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar.md5
new file mode 100644
index 000000000..83d2687ab
--- /dev/null
+++ b/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar.md5
@@ -0,0 +1 @@
+991b90b2e379270abd9a7fbeb7820ac8
\ No newline at end of file
diff --git a/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar.sha1 b/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar.sha1
new file mode 100644
index 000000000..e8fb9d47f
--- /dev/null
+++ b/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.jar.sha1
@@ -0,0 +1 @@
+dc87fadbd50c9549f96b238830526bf470a89201
\ No newline at end of file
diff --git a/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom b/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom
new file mode 100644
index 000000000..5661eeda3
--- /dev/null
+++ b/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom
@@ -0,0 +1,9 @@
+
+
+  4.0.0
+  iaik.prod
+  iaik_moa
+  1.5
+  POM was created from install:install-file
+
diff --git a/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom.lastUpdated b/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom.lastUpdated
new file mode 100644
index 000000000..728b1a824
--- /dev/null
+++ b/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom.lastUpdated
@@ -0,0 +1,12 @@
+#NOTE: This is an internal implementation file, its format can be changed without prior notice.
+#Wed May 15 13:18:20 CEST 2013
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\common/../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverws/../../../repository/.error=
+http\://repo.maven.apache.org/maven2/.lastUpdated=1368616696896
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\proxy/../../../repository/.lastUpdated=1368616698745
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\spss\\server\\serverws/../../../repository/.lastUpdated=1368616700109
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\auth/../../../repository/.error=
+http\://repo.maven.apache.org/maven2/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\common/../repository/.lastUpdated=1368616696561
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\proxy/../../../repository/.error=
+file\://C\:\\eclipse_workspaces\\MOA_Git01\\moa-idspss\\id\\server\\auth/../../../repository/.lastUpdated=1368616699566
diff --git a/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom.md5 b/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom.md5
new file mode 100644
index 000000000..5c3ab00ad
--- /dev/null
+++ b/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom.md5
@@ -0,0 +1 @@
+21650af41d52222d315568a424266fb6
\ No newline at end of file
diff --git a/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom.sha1 b/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom.sha1
new file mode 100644
index 000000000..3435065de
--- /dev/null
+++ b/repository/iaik/prod/iaik_moa/1.5/iaik_moa-1.5.pom.sha1
@@ -0,0 +1 @@
+b24c98f538e82790db37b83e784919b68f652a82
\ No newline at end of file
diff --git a/repository/iaik/prod/iaik_moa/maven-metadata-MOA.xml b/repository/iaik/prod/iaik_moa/maven-metadata-MOA.xml
index 6190bccb0..2f997cbd7 100644
--- a/repository/iaik/prod/iaik_moa/maven-metadata-MOA.xml
+++ b/repository/iaik/prod/iaik_moa/maven-metadata-MOA.xml
@@ -1,7 +1,7 @@
 
   iaik.prod
   iaik_moa
-  1.32
+  1.5
   
     
       1.23
@@ -10,7 +10,8 @@
       1.27
       1.28
       1.29
+      1.32
     
-    20090810074128
+    20130516074128
   
 
\ No newline at end of file
diff --git a/repository/iaik/prod/iaik_moa/maven-metadata-local.xml b/repository/iaik/prod/iaik_moa/maven-metadata-local.xml
index 44703a321..b7745401c 100644
--- a/repository/iaik/prod/iaik_moa/maven-metadata-local.xml
+++ b/repository/iaik/prod/iaik_moa/maven-metadata-local.xml
@@ -2,11 +2,11 @@
 
   iaik.prod
   iaik_moa
-  1.32
+  1.5
   
     
-      1.32
+      1.5
     
-    20100618102247
+    20130515102247
   
 
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java
index 4fcc5daa9..2dcffa014 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java
@@ -30,6 +30,7 @@ import iaik.pki.pathvalidation.ChainingModes;
 import iaik.pki.revocation.RevocationSourceTypes;
 import iaik.server.modules.xml.BlackListEntry;
 import iaik.server.modules.xml.ExternalReferenceChecker;
+import iaik.server.modules.xml.WhiteListEntry;
 import iaik.utils.RFC2253NameParser;
 import iaik.utils.RFC2253NameParserException;
 
@@ -525,19 +526,19 @@ public class ConfigurationPartsBuilder {
 	      String host = getElementValue(permitExtElem, CONF + "IP", null);
 	      String port = getElementValue(permitExtElem, CONF + "Port", null);
 	      
-	      // TODO WhiteListeEntry
-//	      WhiteListEntry entry =null;
+	      // WhiteListeEntry
+	      WhiteListEntry entry =null;
 	      if (port == null) {
-//	    	  entry = new WhiteListEntry(host, -1);
+	    	  entry = new WhiteListEntry(host, -1);
 	    	  info("config.49", new Object[]{host});
       }
 	      else {	    	  
-//	    	  entry = new WhiteListEntry(host, new Integer(port).intValue());
+	    	  entry = new WhiteListEntry(host, new Integer(port).intValue());
 	    	  info("config.49", new Object[]{host + ":" + port});
 	      }
-//	      
-//	      // add entry to iaik-moa whitelist	      
-//	      whiteListIaikMoa.add(entry);
+	      
+	      // add entry to iaik-moa whitelist	      
+	      whiteListIaikMoa.add(entry);
 	      	       
 	      
 	      String array[] = new String[2];
@@ -548,8 +549,8 @@ public class ConfigurationPartsBuilder {
 	  }
 	  
 	  
-	  // TODO set whitelist for iaik-moa
-//	  ExternalReferenceChecker.setWhitelist(whiteListIaikMoa);
+	  // set whitelist for iaik-moa
+	  ExternalReferenceChecker.setWhitelist(whiteListIaikMoa);
 
 	  
 	  if(whitelist.isEmpty()) // no whitelisted uris given
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureVerificationInvoker.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureVerificationInvoker.java
index c979d8407..00f96f205 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureVerificationInvoker.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureVerificationInvoker.java
@@ -24,8 +24,8 @@
 
 package at.gv.egovernment.moa.spss.server.invoke;
 
-import iaik.IAIKException;
-import iaik.IAIKRuntimeException;
+import iaik.server.modules.IAIKException;
+import iaik.server.modules.IAIKRuntimeException;
 import iaik.server.modules.cmsverify.CMSSignatureVerificationModule;
 import iaik.server.modules.cmsverify.CMSSignatureVerificationModuleFactory;
 import iaik.server.modules.cmsverify.CMSSignatureVerificationProfile;
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/IaikExceptionMapper.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/IaikExceptionMapper.java
index 348cb84aa..1136ff2f8 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/IaikExceptionMapper.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/IaikExceptionMapper.java
@@ -24,8 +24,8 @@
 
 package at.gv.egovernment.moa.spss.server.invoke;
 
-import iaik.IAIKException;
-import iaik.IAIKRuntimeException;
+import iaik.server.modules.IAIKException;
+import iaik.server.modules.IAIKRuntimeException;
 
 import java.lang.reflect.Constructor;
 import java.util.HashMap;
@@ -51,8 +51,8 @@ public class IaikExceptionMapper {
   /** The exception mapping, as an array. */
   private static final Object[][] MESSAGES =
     {
-      { iaik.IAIKException.class, "9900", MOASystemException.class },
-      { iaik.IAIKRuntimeException.class, "9901", MOASystemException.class },
+      { iaik.server.modules.IAIKException.class, "9900", MOASystemException.class },
+      { iaik.server.modules.IAIKRuntimeException.class, "9901", MOASystemException.class },
       { iaik.server.modules.xmlsign.XMLSignatureCreationException.class, "2220", MOAApplicationException.class },
       { iaik.server.modules.xmlsign.XMLSignatureCreationRuntimeException.class, "2220", MOAApplicationException.class },
       { iaik.server.modules.xmlsign.InvalidKeyException.class, "2221", MOAApplicationException.class }, 
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureCreationInvoker.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureCreationInvoker.java
index 8bebff974..7debb7b3a 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureCreationInvoker.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureCreationInvoker.java
@@ -24,8 +24,8 @@
 
 package at.gv.egovernment.moa.spss.server.invoke;
 
-import iaik.IAIKException;
-import iaik.IAIKRuntimeException;
+import iaik.server.modules.IAIKException;
+import iaik.server.modules.IAIKRuntimeException;
 import iaik.server.modules.xml.DataObject;
 import iaik.server.modules.xml.XMLDataObject;
 import iaik.server.modules.xml.XMLSignature;
diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java
index 8a5b6f5b7..f3ac72520 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java
@@ -24,10 +24,10 @@
 
 package at.gv.egovernment.moa.spss.server.invoke;
 
-import iaik.IAIKException;
-import iaik.IAIKRuntimeException;
 import iaik.ixsil.exceptions.URIException;
 import iaik.ixsil.util.URI;
+import iaik.server.modules.IAIKException;
+import iaik.server.modules.IAIKRuntimeException;
 import iaik.server.modules.xml.DataObject;
 import iaik.server.modules.xml.XMLDataObject;
 import iaik.server.modules.xml.XMLSignature;
-- 
cgit v1.2.3


From a52d3300d20837b12b45a0d4fb2b0ee520f6e641 Mon Sep 17 00:00:00 2001
From: Klaus Stranacher 
Date: Wed, 14 Aug 2013 16:36:40 +0200
Subject: TSL integration updates: - Setting of hashcache parameter in MOA -
 Update MOA-SP Response (Source attribute in QualifiedCertificate and
 SecureSignatureCreationDevice element) - Hidden truststores (for TSL enabled
 truststore: given certificates are copied to hidden truststore, where TSL
 certificates are copied) - Update of QC and SSCD detection - Update MOA-SPSS
 config: EU TSL URL can be set via configuration

---
 common/.settings/org.eclipse.jdt.core.prefs        |  11 +-
 common/.settings/org.eclipse.wst.common.component  |   3 +-
 .../org.eclipse.wst.common.project.facet.core.xml  |   4 +-
 .../java/at/gv/egovernment/moa/util/FileUtils.java |  33 ++++++
 .../resources/resources/schemas/MOA-SPSS-1.5.2.xsd |  17 ++-
 .../resources/schemas/MOA-SPSS-config-1.5.2.xsd    |   1 +
 id/oa/.settings/org.eclipse.wst.common.component   |  12 +--
 .../org.eclipse.wst.common.project.facet.core.xml  |   6 +-
 .../.settings/org.eclipse.wst.common.component     |   9 +-
 .../org.eclipse.wst.common.project.facet.core.xml  |   4 +-
 .../.settings/org.eclipse.jdt.core.prefs           |  11 +-
 .../.settings/org.eclipse.wst.common.component     |   3 +-
 .../org.eclipse.wst.common.project.facet.core.xml  |   4 +-
 .../.settings/org.eclipse.wst.common.component     |   7 +-
 .../org.eclipse.wst.common.project.facet.core.xml  |   4 +-
 id/templates/.classpath                            |  28 +----
 id/templates/.project                              |  69 ++++++------
 id/templates/.settings/org.eclipse.jdt.core.prefs  |  11 +-
 .../.settings/org.eclipse.wst.common.component     |  10 +-
 .../org.eclipse.wst.common.project.facet.core.xml  |   6 +-
 spss/handbook/clients/api/.classpath               |  84 ++++++++-------
 .../api/.settings/org.eclipse.jdt.core.prefs       |  11 +-
 spss/handbook/clients/referencedData/.classpath    |  10 +-
 .../.settings/org.eclipse.jdt.core.prefs           |  11 +-
 .../.settings/org.eclipse.wst.common.component     |   5 +-
 .../org.eclipse.wst.common.project.facet.core.xml  |   4 +-
 spss/handbook/clients/webservice/.classpath        |  66 +++++++-----
 spss/handbook/clients/webservice/.project          |  74 ++++++-------
 .../.settings/org.eclipse.jdt.core.prefs           |  11 +-
 spss/handbook/handbook/config/config.html          |   1 -
 spss/handbook/handbook/install/install.html        |   5 +-
 spss/handbook/handbook/intro/intro.html            |   8 +-
 spss/handbook/handbook/usage/usage.html            |  37 +++++--
 .../.settings/org.eclipse.wst.common.component     |   1 -
 .../org.eclipse.wst.common.project.facet.core.xml  |   4 +-
 .../gv/egovernment/moa/spss/api/SPSSFactory.java   |   8 +-
 .../moa/spss/api/common/SignerInfo.java            |  11 ++
 .../moa/spss/api/common/TSLConfiguration.java      |   7 ++
 .../moa/spss/api/impl/SPSSFactoryImpl.java         |   6 +-
 .../moa/spss/api/impl/SignerInfoImpl.java          |  31 +++++-
 .../moa/spss/api/impl/TSLConfigurationImpl.java    |  23 +++-
 .../moa/spss/api/xmlbind/ResponseBuilderUtils.java |   6 +-
 .../xmlbind/VerifyCMSSignatureResponseBuilder.java |   5 +-
 .../xmlbind/VerifyXMLSignatureResponseBuilder.java |   4 +-
 .../server/config/ConfigurationPartsBuilder.java   |  91 ++++++++++++++--
 .../spss/server/config/ConfigurationProvider.java  |   6 +-
 .../moa/spss/server/config/TrustProfile.java       |  29 +++---
 .../moa/spss/server/init/SystemInitializer.java    |   8 +-
 .../invoke/CMSSignatureVerificationInvoker.java    | 116 +++++++++++++++++++--
 .../invoke/VerifyCMSSignatureResponseBuilder.java  |  27 ++---
 .../invoke/VerifyXMLSignatureResponseBuilder.java  |  30 +++---
 .../invoke/XMLSignatureVerificationInvoker.java    |  65 ++++++++++--
 .../moa/spss/tsl/connector/TSLConnector.java       |  27 +++--
 .../moa/spss/tsl/timer/TSLUpdaterTimerTask.java    |  26 +++--
 .../properties/spss_messages_de.properties         |   1 +
 .../.settings/org.eclipse.wst.common.component     |   6 +-
 spss/server/serverws/pom.xml                       |  36 +++++++
 spss/server/tools/.classpath                       |  26 +++--
 .../tools/.settings/org.eclipse.jdt.core.prefs     |  11 +-
 59 files changed, 780 insertions(+), 411 deletions(-)

(limited to 'spss/server/serverlib/src/main/java/at')

diff --git a/common/.settings/org.eclipse.jdt.core.prefs b/common/.settings/org.eclipse.jdt.core.prefs
index c788ee346..1cd6f082c 100644
--- a/common/.settings/org.eclipse.jdt.core.prefs
+++ b/common/.settings/org.eclipse.jdt.core.prefs
@@ -1,8 +1,9 @@
+#Mon Aug 05 10:52:30 CEST 2013
+org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
+org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
+org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5
 eclipse.preferences.version=1
 org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
-org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7
-org.eclipse.jdt.core.compiler.compliance=1.7
+org.eclipse.jdt.core.compiler.source=1.5
 org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
-org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
-org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
-org.eclipse.jdt.core.compiler.source=1.7
+org.eclipse.jdt.core.compiler.compliance=1.5
diff --git a/common/.settings/org.eclipse.wst.common.component b/common/.settings/org.eclipse.wst.common.component
index d304ccdfa..0b1b59ec8 100644
--- a/common/.settings/org.eclipse.wst.common.component
+++ b/common/.settings/org.eclipse.wst.common.component
@@ -2,6 +2,7 @@
   
     
     
-        
+        
+        
   
 
diff --git a/common/.settings/org.eclipse.wst.common.project.facet.core.xml b/common/.settings/org.eclipse.wst.common.project.facet.core.xml
index 6c09452f2..656f15b87 100644
--- a/common/.settings/org.eclipse.wst.common.project.facet.core.xml
+++ b/common/.settings/org.eclipse.wst.common.project.facet.core.xml
@@ -3,5 +3,5 @@
   
   
   
-  
-
+  
+
\ No newline at end of file
diff --git a/common/src/main/java/at/gv/egovernment/moa/util/FileUtils.java b/common/src/main/java/at/gv/egovernment/moa/util/FileUtils.java
index 7effe8b4f..cac179a75 100644
--- a/common/src/main/java/at/gv/egovernment/moa/util/FileUtils.java
+++ b/common/src/main/java/at/gv/egovernment/moa/util/FileUtils.java
@@ -27,8 +27,10 @@ package at.gv.egovernment.moa.util;
 import java.io.BufferedInputStream;
 import java.io.File;
 import java.io.FileInputStream;
+import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.OutputStream;
 import java.net.URL;
 
 /**
@@ -136,5 +138,36 @@ public class FileUtils {
       return newURL;
     }
 	}  
+	
+	
+	 private static void copy( InputStream fis, OutputStream fos )
+	  {
+	    try
+	    {
+	      byte[] buffer = new byte[ 0xFFFF ];
+	      for ( int len; (len = fis.read(buffer)) != -1; )
+	        fos.write( buffer, 0, len );
+	    }
+	    catch( IOException e ) {
+	      System.err.println( e );
+	    }
+	    finally {
+	      if ( fis != null )
+	        try { fis.close(); } catch ( IOException e ) { e.printStackTrace(); }
+	      if ( fos != null )
+	        try { fos.close(); } catch ( IOException e ) { e.printStackTrace(); }
+	    }
+	  }
+	 
+	 public static void copyFile(File src, File dest)
+	  {
+	    try
+	    {
+	      copy( new FileInputStream( src ), new FileOutputStream( dest ) );
+	    }
+	    catch( IOException e ) {
+	      e.printStackTrace();
+	    }
+	  }
   
 }
diff --git a/common/src/main/resources/resources/schemas/MOA-SPSS-1.5.2.xsd b/common/src/main/resources/resources/schemas/MOA-SPSS-1.5.2.xsd
index de49a4c75..640f577aa 100644
--- a/common/src/main/resources/resources/schemas/MOA-SPSS-1.5.2.xsd
+++ b/common/src/main/resources/resources/schemas/MOA-SPSS-1.5.2.xsd
@@ -147,7 +147,7 @@
 		
 			
 				
-					only ds:X509Data and RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any;publicAuthority is included as X509Data/any
+					only ds:X509Data and RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any;publicAuthority is included as X509Data/any; SecureSignatureCreationDevice is included as X509Data/any
 				
 			
 			
@@ -198,7 +198,7 @@
 		
 			
 				
-					only ds:X509Data and ds:RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any; PublicAuthority is included as X509Data/any
+					only ds:X509Data and ds:RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any; PublicAuthority is included as X509Data/any; SecureSignatureCreationDevice is included as X509Data/any
 				
 			
 			
@@ -455,7 +455,18 @@
 		
 	
 	
-	
+	
+		
+			
+					
+						
+							
+							
+						
+					
+				
+		
+	
 	
 	
 		
diff --git a/common/src/main/resources/resources/schemas/MOA-SPSS-config-1.5.2.xsd b/common/src/main/resources/resources/schemas/MOA-SPSS-config-1.5.2.xsd
index 63b09f45a..91d281171 100644
--- a/common/src/main/resources/resources/schemas/MOA-SPSS-config-1.5.2.xsd
+++ b/common/src/main/resources/resources/schemas/MOA-SPSS-config-1.5.2.xsd
@@ -313,6 +313,7 @@
 										
 											
 												
+													
 													
 														
 															
diff --git a/id/oa/.settings/org.eclipse.wst.common.component b/id/oa/.settings/org.eclipse.wst.common.component
index 004255b9e..7e38d20b7 100644
--- a/id/oa/.settings/org.eclipse.wst.common.component
+++ b/id/oa/.settings/org.eclipse.wst.common.component
@@ -1,10 +1,8 @@
-
+
+
   
+    
+    
     
-        
-    
-        
-        
-        
   
-
+
\ No newline at end of file
diff --git a/id/oa/.settings/org.eclipse.wst.common.project.facet.core.xml b/id/oa/.settings/org.eclipse.wst.common.project.facet.core.xml
index c4dff31bf..a801c94a0 100644
--- a/id/oa/.settings/org.eclipse.wst.common.project.facet.core.xml
+++ b/id/oa/.settings/org.eclipse.wst.common.project.facet.core.xml
@@ -2,6 +2,6 @@
 
   
   
-  
-  
-
+  
+  
+
\ No newline at end of file
diff --git a/id/server/auth/.settings/org.eclipse.wst.common.component b/id/server/auth/.settings/org.eclipse.wst.common.component
index 7bcce39aa..e667e1ee5 100644
--- a/id/server/auth/.settings/org.eclipse.wst.common.component
+++ b/id/server/auth/.settings/org.eclipse.wst.common.component
@@ -9,12 +9,13 @@
         
             uses
         
+        
+            uses
+        
     
+    
+    
     
-    
     
-        
-        
-        
   
 
diff --git a/id/server/auth/.settings/org.eclipse.wst.common.project.facet.core.xml b/id/server/auth/.settings/org.eclipse.wst.common.project.facet.core.xml
index ac59587b0..564572b10 100644
--- a/id/server/auth/.settings/org.eclipse.wst.common.project.facet.core.xml
+++ b/id/server/auth/.settings/org.eclipse.wst.common.project.facet.core.xml
@@ -2,6 +2,6 @@
 
   
   
+  
   
-  
-
+
\ No newline at end of file
diff --git a/id/server/idserverlib/.settings/org.eclipse.jdt.core.prefs b/id/server/idserverlib/.settings/org.eclipse.jdt.core.prefs
index c788ee346..78a34d46c 100644
--- a/id/server/idserverlib/.settings/org.eclipse.jdt.core.prefs
+++ b/id/server/idserverlib/.settings/org.eclipse.jdt.core.prefs
@@ -1,8 +1,9 @@
+#Mon Aug 05 10:52:32 CEST 2013
+org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
+org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
+org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5
 eclipse.preferences.version=1
 org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
-org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7
-org.eclipse.jdt.core.compiler.compliance=1.7
+org.eclipse.jdt.core.compiler.source=1.5
 org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
-org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
-org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
-org.eclipse.jdt.core.compiler.source=1.7
+org.eclipse.jdt.core.compiler.compliance=1.5
diff --git a/id/server/idserverlib/.settings/org.eclipse.wst.common.component b/id/server/idserverlib/.settings/org.eclipse.wst.common.component
index 0d5e207d9..8f3380621 100644
--- a/id/server/idserverlib/.settings/org.eclipse.wst.common.component
+++ b/id/server/idserverlib/.settings/org.eclipse.wst.common.component
@@ -2,6 +2,7 @@
   
     
     
-        
+        
+        
   
 
diff --git a/id/server/idserverlib/.settings/org.eclipse.wst.common.project.facet.core.xml b/id/server/idserverlib/.settings/org.eclipse.wst.common.project.facet.core.xml
index 6c09452f2..656f15b87 100644
--- a/id/server/idserverlib/.settings/org.eclipse.wst.common.project.facet.core.xml
+++ b/id/server/idserverlib/.settings/org.eclipse.wst.common.project.facet.core.xml
@@ -3,5 +3,5 @@
   
   
   
-  
-
+  
+
\ No newline at end of file
diff --git a/id/server/proxy/.settings/org.eclipse.wst.common.component b/id/server/proxy/.settings/org.eclipse.wst.common.component
index 1df5c5506..cc61830e7 100644
--- a/id/server/proxy/.settings/org.eclipse.wst.common.component
+++ b/id/server/proxy/.settings/org.eclipse.wst.common.component
@@ -9,10 +9,11 @@
         
             uses
         
+        
+            uses
+        
     
-        
-        
-        
+    
     
   
 
diff --git a/id/server/proxy/.settings/org.eclipse.wst.common.project.facet.core.xml b/id/server/proxy/.settings/org.eclipse.wst.common.project.facet.core.xml
index ac59587b0..564572b10 100644
--- a/id/server/proxy/.settings/org.eclipse.wst.common.project.facet.core.xml
+++ b/id/server/proxy/.settings/org.eclipse.wst.common.project.facet.core.xml
@@ -2,6 +2,6 @@
 
   
   
+  
   
-  
-
+
\ No newline at end of file
diff --git a/id/templates/.classpath b/id/templates/.classpath
index 3f17a7f21..0173dfd90 100644
--- a/id/templates/.classpath
+++ b/id/templates/.classpath
@@ -1,27 +1,5 @@
 
 
-	
-		
-			
-			
-		
-	
-	
-		
-			
-			
-		
-	
-	
-		
-			
-			
-		
-	
-	
-		
-			
-		
-	
-	
-
+  
+  
+
\ No newline at end of file
diff --git a/id/templates/.project b/id/templates/.project
index bbb999ed8..444626a3f 100644
--- a/id/templates/.project
+++ b/id/templates/.project
@@ -1,42 +1,31 @@
 
 
-	moa-id-templates
-	NO_M2ECLIPSE_SUPPORT: Project files created with the maven-eclipse-plugin are not supported in M2Eclipse.
-	
-	
-	
-		
-			org.eclipse.jdt.core.javabuilder
-			
-			
-		
-		
-			org.eclipse.wst.validation.validationbuilder
-			
-			
-		
-		
-			org.maven.ide.eclipse.maven2Builder
-			
-			
-		
-		
-			org.eclipse.wst.common.project.facet.core.builder
-			
-			
-		
-		
-			org.eclipse.m2e.core.maven2Builder
-			
-			
-		
-	
-	
-		org.eclipse.m2e.core.maven2Nature
-		org.maven.ide.eclipse.maven2Nature
-		org.eclipse.wst.common.project.facet.core.nature
-		org.eclipse.jdt.core.javanature
-		org.eclipse.wst.common.modulecore.ModuleCoreNature
-		org.eclipse.jem.workbench.JavaEMFNature
-	
-
+  moa-id-templates
+  NO_M2ECLIPSE_SUPPORT: Project files created with the maven-eclipse-plugin are not supported in M2Eclipse.
+  
+  
+    
+      org.eclipse.jdt.core.javabuilder
+    
+    
+      org.eclipse.wst.validation.validationbuilder
+    
+    
+      org.maven.ide.eclipse.maven2Builder
+    
+    
+      org.eclipse.wst.common.project.facet.core.builder
+    
+    
+      org.eclipse.m2e.core.maven2Builder
+    
+  
+  
+    org.eclipse.m2e.core.maven2Nature
+    org.maven.ide.eclipse.maven2Nature
+    org.eclipse.wst.common.project.facet.core.nature
+    org.eclipse.jdt.core.javanature
+    org.eclipse.wst.common.modulecore.ModuleCoreNature
+    org.eclipse.jem.workbench.JavaEMFNature
+  
+
\ No newline at end of file
diff --git a/id/templates/.settings/org.eclipse.jdt.core.prefs b/id/templates/.settings/org.eclipse.jdt.core.prefs
index c788ee346..5bdae7434 100644
--- a/id/templates/.settings/org.eclipse.jdt.core.prefs
+++ b/id/templates/.settings/org.eclipse.jdt.core.prefs
@@ -1,8 +1,9 @@
+#Mon Aug 05 10:52:31 CEST 2013
+org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
+org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
+org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5
 eclipse.preferences.version=1
 org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
-org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7
-org.eclipse.jdt.core.compiler.compliance=1.7
+org.eclipse.jdt.core.compiler.source=1.5
 org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
-org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
-org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
-org.eclipse.jdt.core.compiler.source=1.7
+org.eclipse.jdt.core.compiler.compliance=1.5
diff --git a/id/templates/.settings/org.eclipse.wst.common.component b/id/templates/.settings/org.eclipse.wst.common.component
index 8ef19dd6b..0d2cb24b4 100644
--- a/id/templates/.settings/org.eclipse.wst.common.component
+++ b/id/templates/.settings/org.eclipse.wst.common.component
@@ -1,8 +1,8 @@
-
+
+
   
-        
-        
+    
+    
     
-        
   
-
+
\ No newline at end of file
diff --git a/id/templates/.settings/org.eclipse.wst.common.project.facet.core.xml b/id/templates/.settings/org.eclipse.wst.common.project.facet.core.xml
index c4dff31bf..564572b10 100644
--- a/id/templates/.settings/org.eclipse.wst.common.project.facet.core.xml
+++ b/id/templates/.settings/org.eclipse.wst.common.project.facet.core.xml
@@ -2,6 +2,6 @@
 
   
   
-  
-  
-
+  
+  
+
\ No newline at end of file
diff --git a/spss/handbook/clients/api/.classpath b/spss/handbook/clients/api/.classpath
index 95a3df914..ea8736aef 100644
--- a/spss/handbook/clients/api/.classpath
+++ b/spss/handbook/clients/api/.classpath
@@ -1,45 +1,43 @@
 
 
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-	
-		
-			
-		
-	
-	
-
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+
\ No newline at end of file
diff --git a/spss/handbook/clients/api/.settings/org.eclipse.jdt.core.prefs b/spss/handbook/clients/api/.settings/org.eclipse.jdt.core.prefs
index c788ee346..5bdae7434 100644
--- a/spss/handbook/clients/api/.settings/org.eclipse.jdt.core.prefs
+++ b/spss/handbook/clients/api/.settings/org.eclipse.jdt.core.prefs
@@ -1,8 +1,9 @@
+#Mon Aug 05 10:52:31 CEST 2013
+org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
+org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
+org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5
 eclipse.preferences.version=1
 org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
-org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7
-org.eclipse.jdt.core.compiler.compliance=1.7
+org.eclipse.jdt.core.compiler.source=1.5
 org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
-org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
-org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
-org.eclipse.jdt.core.compiler.source=1.7
+org.eclipse.jdt.core.compiler.compliance=1.5
diff --git a/spss/handbook/clients/referencedData/.classpath b/spss/handbook/clients/referencedData/.classpath
index d888b90e9..0173dfd90 100644
--- a/spss/handbook/clients/referencedData/.classpath
+++ b/spss/handbook/clients/referencedData/.classpath
@@ -1,9 +1,5 @@
 
 
-	
-		
-			
-		
-	
-	
-
+  
+  
+
\ No newline at end of file
diff --git a/spss/handbook/clients/referencedData/.settings/org.eclipse.jdt.core.prefs b/spss/handbook/clients/referencedData/.settings/org.eclipse.jdt.core.prefs
index c788ee346..5bdae7434 100644
--- a/spss/handbook/clients/referencedData/.settings/org.eclipse.jdt.core.prefs
+++ b/spss/handbook/clients/referencedData/.settings/org.eclipse.jdt.core.prefs
@@ -1,8 +1,9 @@
+#Mon Aug 05 10:52:31 CEST 2013
+org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
+org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
+org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5
 eclipse.preferences.version=1
 org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
-org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7
-org.eclipse.jdt.core.compiler.compliance=1.7
+org.eclipse.jdt.core.compiler.source=1.5
 org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
-org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
-org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
-org.eclipse.jdt.core.compiler.source=1.7
+org.eclipse.jdt.core.compiler.compliance=1.5
diff --git a/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.component b/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.component
index 2063ba643..0929e364c 100644
--- a/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.component
+++ b/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.component
@@ -1,7 +1,8 @@
-
+
+
   
     
     
     
   
-
+
\ No newline at end of file
diff --git a/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.project.facet.core.xml b/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.project.facet.core.xml
index 47b82b84e..564572b10 100644
--- a/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.project.facet.core.xml
+++ b/spss/handbook/clients/referencedData/.settings/org.eclipse.wst.common.project.facet.core.xml
@@ -3,5 +3,5 @@
   
   
   
-  
-
+  
+
\ No newline at end of file
diff --git a/spss/handbook/clients/webservice/.classpath b/spss/handbook/clients/webservice/.classpath
index b75cb2821..ea8736aef 100644
--- a/spss/handbook/clients/webservice/.classpath
+++ b/spss/handbook/clients/webservice/.classpath
@@ -1,27 +1,43 @@
 
 
-	
-		
-			
-			
-		
-	
-	
-		
-			
-			
-		
-	
-	
-		
-			
-			
-		
-	
-	
-		
-			
-		
-	
-	
-
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+
\ No newline at end of file
diff --git a/spss/handbook/clients/webservice/.project b/spss/handbook/clients/webservice/.project
index cddae3823..d23223048 100644
--- a/spss/handbook/clients/webservice/.project
+++ b/spss/handbook/clients/webservice/.project
@@ -1,44 +1,34 @@
 
 
-	moa-spss-handbook-webserviceClient
-	NO_M2ECLIPSE_SUPPORT: Project files created with the maven-eclipse-plugin are not supported in M2Eclipse.
-	
-		moa-common
-		moa-spss-lib
-	
-	
-		
-			org.eclipse.jdt.core.javabuilder
-			
-			
-		
-		
-			org.eclipse.wst.common.project.facet.core.builder
-			
-			
-		
-		
-			org.eclipse.wst.validation.validationbuilder
-			
-			
-		
-		
-			org.maven.ide.eclipse.maven2Builder
-			
-			
-		
-		
-			org.eclipse.m2e.core.maven2Builder
-			
-			
-		
-	
-	
-		org.eclipse.m2e.core.maven2Nature
-		org.maven.ide.eclipse.maven2Nature
-		org.eclipse.wst.common.project.facet.core.nature
-		org.eclipse.jdt.core.javanature
-		org.eclipse.wst.common.modulecore.ModuleCoreNature
-		org.eclipse.jem.workbench.JavaEMFNature
-	
-
+  moa-spss-handbook-webserviceClient
+  NO_M2ECLIPSE_SUPPORT: Project files created with the maven-eclipse-plugin are not supported in M2Eclipse.
+  
+    moa-common
+    moa-spss-lib
+  
+  
+    
+      org.eclipse.jdt.core.javabuilder
+    
+    
+      org.eclipse.wst.common.project.facet.core.builder
+    
+    
+      org.eclipse.wst.validation.validationbuilder
+    
+    
+      org.maven.ide.eclipse.maven2Builder
+    
+    
+      org.eclipse.m2e.core.maven2Builder
+    
+  
+  
+    org.eclipse.m2e.core.maven2Nature
+    org.maven.ide.eclipse.maven2Nature
+    org.eclipse.wst.common.project.facet.core.nature
+    org.eclipse.jdt.core.javanature
+    org.eclipse.wst.common.modulecore.ModuleCoreNature
+    org.eclipse.jem.workbench.JavaEMFNature
+  
+
\ No newline at end of file
diff --git a/spss/handbook/clients/webservice/.settings/org.eclipse.jdt.core.prefs b/spss/handbook/clients/webservice/.settings/org.eclipse.jdt.core.prefs
index c788ee346..5bdae7434 100644
--- a/spss/handbook/clients/webservice/.settings/org.eclipse.jdt.core.prefs
+++ b/spss/handbook/clients/webservice/.settings/org.eclipse.jdt.core.prefs
@@ -1,8 +1,9 @@
+#Mon Aug 05 10:52:31 CEST 2013
+org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
+org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
+org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5
 eclipse.preferences.version=1
 org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
-org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7
-org.eclipse.jdt.core.compiler.compliance=1.7
+org.eclipse.jdt.core.compiler.source=1.5
 org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
-org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
-org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning
-org.eclipse.jdt.core.compiler.source=1.7
+org.eclipse.jdt.core.compiler.compliance=1.5
diff --git a/spss/handbook/handbook/config/config.html b/spss/handbook/handbook/config/config.html
index b0247180c..96270bde1 100644
--- a/spss/handbook/handbook/config/config.html
+++ b/spss/handbook/handbook/config/config.html
@@ -1218,6 +1218,5 @@ Wird der Wert auf -1 gesetzt, dann bedeutet das ein unendlich langes Intervall.
 
      3.4 Typische Konfiguration für MOA SP/SS
      
   
      Nachfolgend finden Sie eine typische zentrale Konfigurationsdatei mit Einträgen für den kombinierten Betrieb von MOA SP und SS. Diese Datei wird auch als Konfiguration von MOA SP und SS verwendet, die für das Ausführen der Beispiele des Anwenderhandbuchs notwendig ist.
      
   
      Typische Konfiguration für MOA SP/SS  
      
-  
        
      
 
 
diff --git a/spss/handbook/handbook/install/install.html b/spss/handbook/handbook/install/install.html
index 382f9633f..3c3414d29 100644
--- a/spss/handbook/handbook/install/install.html
+++ b/spss/handbook/handbook/install/install.html
@@ -118,7 +118,7 @@
   
   
      Wir empfehlen jedoch jeweils aktuelle Version zu verwenden:
      
   
   
      In diesem Betriebs-Szenario wird das MOA SP/SS Webservice in Tomcat zum Einsatz gebracht. Tomcat fungiert gleichzeitig als HTTP- und HTTPS-Endpunkt für das MOA SP/SS Webservice. Beide Protokolle werden direkt in Tomcat konfiguriert. Das MOA SP/SS Webservice verwendet Log4j als Logging Toolkit.
      
@@ -377,7 +377,7 @@ INFO | 01 21:25:26,540 | Thread-3 | TID=1049225059594-100 NID=<null>
 
   
      Wir empfehlen jedoch jeweils aktuelle Version zu verwenden:
      
   
 
      3.1.2 Vorbereitung 
      
 
      Die folgenden Schritte dienen der Vorbereitung der Installation.
      
@@ -487,5 +487,6 @@ INFO | 01 21:25:26,540 | Thread-3 | TID=1049225059594-100 NID=<null>
      Logging Framework
      + diff --git a/spss/handbook/handbook/intro/intro.html b/spss/handbook/handbook/intro/intro.html index 077a1dabe..caa7fcc58 100644 --- a/spss/handbook/handbook/intro/intro.html +++ b/spss/handbook/handbook/intro/intro.html @@ -30,14 +30,14 @@

      1 Allgemeines

      Die Module Serversignatur (SS) und Signaturprüfung (SP) können von Anwendungen verwendet werden, um elektronische Signaturen zu erstellen bzw. vorliegende elektronische Signaturen zu überprüfen.

      -

      Die Funktionalität und der Aufbau der Schnittstelle zu den beiden Modulen ist in der Spezifikation MOA SP/SS (V1.5.2) detailliert beschrieben. Da diese Spezifikation auf der Schnittstellenspezifikation des Security-Layers (V 1.2x) TODO aufbaut, ist deren Kenntnis zum Verstehen der Schnittstellen zu SS und SP erforderlich.

      +

      Die Funktionalität und der Aufbau der Schnittstelle zu den beiden Modulen ist in der Spezifikation MOA SP/SS (V1.5.2) detailliert beschrieben. Da diese Spezifikation auf der @TODO (Update auf neue abgestimmte Spezifikation) Schnittstellenspezifikation des Security-Layers (V 1.2x) aufbaut, ist deren Kenntnis zum Verstehen der Schnittstellen zu SS und SP erforderlich.

      2 Modul Serversignatur (SS)

      -

      Das Modul Serversignatur (SS) dient zum Erstellen von XML-Signaturen in Anlehnung an die Schnittstellenspezifikation des Security-Layers (V 1.2x TODO). Eine Signatur kann entweder rein in Software erstellt werden, oder aber unter Zuhilfenahme eines Hardware Security Modules (HSM), das den privaten Schlüssel geschützt enthält und die Signatur berechnet.

      +

      Das Modul Serversignatur (SS) dient zum Erstellen von XML-Signaturen in Anlehnung an die @TODO (Update auf neue abgestimmte Spezifikation) Schnittstellenspezifikation des Security-Layers (V 1.2x TODO). Eine Signatur kann entweder rein in Software erstellt werden, oder aber unter Zuhilfenahme eines Hardware Security Modules (HSM), das den privaten Schlüssel geschützt enthält und die Signatur berechnet.

      Der Zugriff auf einzelne Signaturschlüssel in MOA SS kann basierend auf dem für TLS-Client-Authentisierung verwendeten Zertifikat eingeschränkt werden.

      Anwendungen können das Modul entweder als Web-Service oder über ein Java-API ansprechen.

      3 Modul Signaturprüfung (SP)

      -

      Das Modul Signaturprüfung (SP) dient zum Überprüfen von XML-Signaturen und CMS-Signaturen sowie den fortgeschrittenen Signaturen XAdES (TODO Link + Versionen) und CAdES (TODO Link + Versionen).

      -

      Im Zuge der Verifikation einer XML-Signatur werden die Signatur, gegebenenfalls vorhandene XMLDSIG-Manifeste, als auch die Gültigkeit und Anwendbarkeit des Zertifikats überprüft. Bei XML-Signaturen kann zusätzlich überprüft werden, ob sie den speziellen Anforderungen Schnittstellenspezifikation des Security-Layers (V 1.2x TODO) entsprechen (vgl. Signaturmanifest).

      +

      Das Modul Signaturprüfung (SP) dient zum Überprüfen von XML-Signaturen und CMS-Signaturen sowie den fortgeschrittenen Signaturen XAdES (@TODO Link + Versionen basierend auf Update SL) und CAdES (@TODO Link + Versionen basierend auf Update SL).

      +

      Im Zuge der Verifikation einer XML-Signatur werden die Signatur, gegebenenfalls vorhandene XMLDSIG-Manifeste, als auch die Gültigkeit und Anwendbarkeit des Zertifikats überprüft. Bei XML-Signaturen kann zusätzlich überprüft werden, ob sie den speziellen Anforderungen @TODO (Update auf neue abgestimmte Spezifikation) Schnittstellenspezifikation des Security-Layers (V 1.2x) entsprechen (vgl. Signaturmanifest).

      Anwendungen können das Modul entweder als Web-Service oder über ein Java-API ansprechen.

      diff --git a/spss/handbook/handbook/usage/usage.html b/spss/handbook/handbook/usage/usage.html index 8bd1cdc46..53d699689 100644 --- a/spss/handbook/handbook/usage/usage.html +++ b/spss/handbook/handbook/usage/usage.html @@ -77,7 +77,9 @@
      1. Referenzierte Software
        2. +
      2. Referenzierte Spezifikation
      +

      1 Übersicht

      Die Module Signaturprüfung (SP) und Serversignatur (SS) sind als plattformunabhängige Module ausgelegt, die entweder als Webservice über HTTP bzw. HTTPS oder als Klassenbibliothek über ein API angesprochen werden können. Dieses Handbuch beschreibt die Anwendung der beiden Module auf jede dieser beiden Arten.

      @@ -87,14 +89,14 @@

      Dieser Abschnitt stellt typische XML-Requests für die Erstellung einer XML/XAdES- und CMS/CAdES-Signatur mittels SS bzw. zur Prüfung einer CMS/CAdES- bzw. XML/XAdES-Signatur mittels SP vor. Zu jedem Request wird jeweils auch eine typische Response des Services besprochen.

      Bitte beachten Sie: Einige der vorgestellten Requests referenzieren beispielhafte Daten auf localhost, z.B. http://localhost:8080/referencedData/Text.txt. Wenn Sie diese Beispiele ausprobieren möchten, müssen Sie dafür sorgen, dass MOA SS bzw. SP diese Daten auch tatsächlich auflösen kann. Wenn Sie Ihre Tomcat-Installation auf localhost:8080 betreiben, ist es ausreichend, wenn sie die diesem Handbuch beiliegende Webapplikation referencedData.war in das Verzeichnis webapps Ihrer Tomcat-Installation kopieren. Ansonsten müssen Sie zusätzlich die URLs in den Requests anpassen.

      2.1.1 Erstellung einer CMS bzw. CAdES-Signatur

      -

      MOA-SS ermöglicht die Erstellung einer herkömmlichen CMS-Signatur und einer CAdES-Signatur gemäß der Security-Layer Spezifikation V1.2x TODO. Die Auswahl ob eine herkömmliche XML oder eine Security-Layer konforme CAdES-Signatur erstellt wird, erfolgt durch das Attribute SecurityLayerConformity im Signaturerstelltungs-Request (siehe auch folgende Beispiele).

      +

      MOA-SS ermöglicht die Erstellung einer herkömmlichen CMS-Signatur und einer CAdES-Signatur gemäß der Security-Layer Spezifikation. Die Auswahl ob eine herkömmliche XML oder eine Security-Layer konforme CAdES-Signatur erstellt wird, erfolgt durch das Attribute SecurityLayerConformity im Signaturerstelltungs-Request (siehe auch folgende Beispiele).

      2.1.1.1 Beispiel (Base64-codiertes Datenobjekt)

      Request

      CreateCMSSignatureRequest.Base64Content.xml ist ein einfacher XML-Request zur Erzeugung einer CAdES-Signatur. Sein Aufbau wird nachfolgend analysiert:

        <KeyIdentifier>KG_allgemein</KeyIdentifier>

      KG_allgemein bezeichnet eine Schlüsselgruppe, aus der SS einen Signaturschlüssel selektieren soll und muss einer in der SP/SS-Konfigurationsdatei definierten Schlüsselgruppe entsprechen. 

        <SingleSignatureInfo SecurityLayerConformity="true">
      -

      Für jedes SingleSignatureInfoElement wird eine eigene CMS/CAdES-Signatur erzeugt. Wird das Attribut SecurityLayerConformity auf true gesetzt, dann wird eine CAdES-Signatur gemäß Security-Layer Spezifikation V1.2x TODO erzeugt; d.h. es werden signierte Properties (Zeitpunkt der Signaturerstellung, das für die Signaturüberprüfung zu verwendende Zertifikat, Metainformationen zu den signierten Datenobjekten).

      +

      Für jedes SingleSignatureInfoElement wird eine eigene CMS/CAdES-Signatur erzeugt. Wird das Attribut SecurityLayerConformity auf true gesetzt, dann wird eine CAdES-Signatur gemäß Security-Layer Spezifikation erzeugt; d.h. es werden signierte Properties (Zeitpunkt der Signaturerstellung, das für die Signaturüberprüfung zu verwendende Zertifikat, Metainformationen zu den signierten Datenobjekten).

        <DataObjectInfo Structure="enveloping">
 	  <DataObject>
 	    <MetaInfo>
@@ -121,7 +123,7 @@
 
        <KeyIdentifier>KG_allgemein</KeyIdentifier> 
      
 
      KG_allgemein bezeichnet eine Schlüsselgruppe, aus der SS einen Signaturschlüssel selektieren soll und muss einer in der SP/SS-Konfigurationsdatei definierten Schlüsselgruppe entsprechen. 
      
 
        <SingleSignatureInfo SecurityLayerConformity="false">
      
-
       Für jedes SingleSignatureInfoElement wird eine eigene CMS/CAdES-Signatur erzeugt. Wird das Attribut SecurityLayerConformity auf true gesetzt, dann wird eine CAdES-Signatur gemäß Security-Layer Spezifikation V1.2x TODO  erzeugt; d.h. es werden signierte Properties (Zeitpunkt der Signaturerstellung, das für die Signaturüberprüfung zu verwendende Zertifikat, Metainformationen zu den signierten Datenobjekten).
      
+
       Für jedes SingleSignatureInfoElement wird eine eigene CMS/CAdES-Signatur erzeugt. Wird das Attribut SecurityLayerConformity auf true gesetzt, dann wird eine CAdES-Signatur gemäß  Security-Layer Spezifikation erzeugt; d.h. es werden signierte Properties (Zeitpunkt der Signaturerstellung, das für die Signaturüberprüfung zu verwendende Zertifikat, Metainformationen zu den signierten Datenobjekten).
      
 
        <DataObjectInfo Structure="detached">
 	  <DataObject>
 	    <MetaInfo>
@@ -140,7 +142,7 @@
     xmlns="http://reference.e-government.gv.at/namespace/moa/20020822#" 
          xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
      	  <CMSSignature>MIAGCSqGSI...SwxhbA9pAAAAAAAA</CMSSignature>
        </CreateCMSSignatureResponse>
      
 
      CreateCMSSignatureResponse enthält je erzeugter Signatur ein Element CMSSignature (in diesem Fall genau ein Element). CMSSignature enthält die von SS erzeugte CMS-Signatur (da SecurityLayerConformity="false" im Request angegeben wurde) als Base64-codierten Wert. Das unterzeichnete Datenobjekt ist in der Signaturstruktur nicht enthalten (detached).
      
 
      2.1.2 Erstellung einer XML bzw. XAdES-Signatur
      
-
      MOA-SS ermöglicht die Erstellung einer herkömmlichen XML-Signatur und einer XAdES-Signatur gemäß der Security-Layer Spezifikation V1.2x TODO. Die Auswahl ob eine herkömmliche XML oder eine Security-Layer konforme XAdES-Signatur erstellt wird, erfolgt durch das Attribute SecurityLayerConformity im Signaturerstelltungs-Request (siehe auch folgende Beispiele). 
      
+
      MOA-SS ermöglicht die Erstellung einer herkömmlichen XML-Signatur und einer XAdES-Signatur gemäß der  Security-Layer Spezifikation. Die Auswahl ob eine herkömmliche XML oder eine Security-Layer konforme XAdES-Signatur erstellt wird, erfolgt durch das Attribute SecurityLayerConformity im Signaturerstelltungs-Request (siehe auch folgende Beispiele). 
      
 
      Im Falle einer XAdES-Signatur, kann entweder eine XAdES-Signatur in der Version 1.1.1 oder in der Version 1.4.2 erstellt werden. Dies hängt von der in der MOA-SS Konfiguration angegeben XAdES-Version ab (siehe hierzu Konfiguration der XAdES Version).
      
 
      2.1.2.1 Einfaches Beispiel
      
   
      Request
      
@@ -148,7 +150,7 @@
   
        <KeyIdentifier>KG_allgemein</KeyIdentifier> 
      
   
      KG_allgemein bezeichnet eine Schlüsselgruppe, aus der SS einen Signaturschlüssel selektieren soll und muss einer in der SP/SS-Konfigurationsdatei definierten Schlüsselgruppe entsprechen. 
      
   
        <SingleSignatureInfo SecurityLayerConformity="false">
      
-  
       Für jedes SingleSignatureInfoElement wird eine eigene XML-Signatur erzeugt. Wird das Attribut SecurityLayerConformity auf true gesetzt, dann wird eine XML-Signatur gemäß Security-Layer Spezifikation V1.2x TODO  erzeugt; d.h. es werden signierte Properties (Zeitpunkt der Signaturerstellung, das für die Signaturüberprüfung zu verwendende Zertifikat, Metainformationen zu den signierten Datenobjekten) und ein Manifest, das alle implizite Transformationsparameter enthält, zur Signatur hinzugefügt (=eine XAdES Signatur).
      
+  
       Für jedes SingleSignatureInfoElement wird eine eigene XML-Signatur erzeugt. Wird das Attribut SecurityLayerConformity auf true gesetzt, dann wird eine XML-Signatur gemäß  Security-Layer Spezifikation erzeugt; d.h. es werden signierte Properties (Zeitpunkt der Signaturerstellung, das für die Signaturüberprüfung zu verwendende Zertifikat, Metainformationen zu den signierten Datenobjekten) und ein Manifest, das alle implizite Transformationsparameter enthält, zur Signatur hinzugefügt (=eine XAdES Signatur).
      
 
        <DataObjectInfo Structure="enveloping">
     <DataObject>
       <XMLContent>Diese Daten werden signiert.<XMLContent>
@@ -703,13 +705,13 @@ O=A-Trust Ges. für Sicherheitssysteme im elektr. Datenverkehr GmbH,C=AT<
     <Code>0</Code>
   </SignatureCheck>
 
      
-
       Anschließend an SignerInfo enthält die Response mit SignatureCheck/Code das Resultat der kryptographischen Prüfung der Signatur. In unserem Beispiel ist dort der Wert 0 enthalten, d. h. die Signatur konnte erfolgreich validiert werden. Für eine Übersicht der möglichen Kodes siehe Security-Layer 1.2x TODO.
      
+
       Anschließend an SignerInfo enthält die Response mit SignatureCheck/Code das Resultat der kryptographischen Prüfung der Signatur. In unserem Beispiel ist dort der Wert 0 enthalten, d. h. die Signatur konnte erfolgreich validiert werden. Für eine Übersicht der möglichen Kodes siehe  Security-Layer Spezifikation.
      
 
         <CertificateCheck>
     <Code>1</Code>
   </CertificateCheck>
 
      
-
      Abschließend enthält die Response mit CertificateCheck/Code das Resultat der Prüfung des Signatorzertifikats. Zunächst prüft MOA SP, ob ausgehend vom Signatorzertifikat eine Zertifikatskette zu einem im zugehörigen Vertrauensprofil konfigurierten sog. Trust Anchor gebildet werden kann. Gelingt dies, wird die Gültigkeit jedes Zertifikats dieser Kette überprüft. In unserem Beispiel enthält Code den Wert 1, d. h. MOA SP konnte die oben erläuterte Zertifikatskette nicht bilden. Für eine Übersicht der möglichen Kodes siehe Security-Layer 1.2x TODO.
      
+
      Abschließend enthält die Response mit CertificateCheck/Code das Resultat der Prüfung des Signatorzertifikats. Zunächst prüft MOA SP, ob ausgehend vom Signatorzertifikat eine Zertifikatskette zu einem im zugehörigen Vertrauensprofil konfigurierten sog. Trust Anchor gebildet werden kann. Gelingt dies, wird die Gültigkeit jedes Zertifikats dieser Kette überprüft. In unserem Beispiel enthält Code den Wert 1, d. h. MOA SP konnte die oben erläuterte Zertifikatskette nicht bilden. Für eine Übersicht der möglichen Kodes siehe  Security-Layer Spezifikation.
      
 
      2.1.3.2 Erweitertes Beispiel
      
 
      Request
      
 
      Dieses erweiterte Beispiel zur Prüfung einer CMS-Signatur (VerifyCMSSignatureRequest.Extended.xml) demonstriert die Prüfung mehrerer Signatoren einer CMS-Signatur, die Angabe des Prüfzeitpunkts sowie die Prüfung einer Detached Signature, d. h. einer Signatur, in der die signierten Daten nicht enthalten sind und daher extra angegeben werden müssen. 
      
@@ -801,13 +803,13 @@ O=A-Trust Ges. für Sicherheitssysteme im elektr. Datenverkehr GmbH,C=AT<
     <Code>0</Code>
   </SignatureCheck>
      -

      Anschließend an SignerInfo enthält die Response mit SignatureCheck/Code das Resultat der kryptographischen Prüfung der Signatur. In unserem Beispiel ist dort der Wert 0 enthalten, d. h. die Signatur konnte erfolgreich validiert werden. Für eine Übersicht der möglichen Kodes siehe Security-Layer 1.2x TODO.

      +

      Anschließend an SignerInfo enthält die Response mit SignatureCheck/Code das Resultat der kryptographischen Prüfung der Signatur. In unserem Beispiel ist dort der Wert 0 enthalten, d. h. die Signatur konnte erfolgreich validiert werden. Für eine Übersicht der möglichen Kodes siehe Security-Layer Spezifikation.

         <CertificateCheck>
     <Code>0</Code>
   </CertificateCheck>
      -

      Abschließend enthält die Response mit CertificateCheck/Code das Resultat der Prüfung des Signatorzertifikats. Zunächst prüft MOA SP, ob ausgehend vom Signatorzertifikat eine Zertifikatskette zu einem im zugehörigen Vertrauensprofil konfigurierten sog. Trust Anchor gebildet werden kann. Gelingt dies, wird die Gültigkeit jedes Zertifikats dieser Kette überprüft. In unserem Beispiel enthält Code den Wert 0, d. h. MOA SP konnte die Kette bilden, und alle Zertifikate der Kette sind gültig. Für eine Übersicht der möglichen Kodes siehe Security-Layer 1.2x TODO.

      +

      Abschließend enthält die Response mit CertificateCheck/Code das Resultat der Prüfung des Signatorzertifikats. Zunächst prüft MOA SP, ob ausgehend vom Signatorzertifikat eine Zertifikatskette zu einem im zugehörigen Vertrauensprofil konfigurierten sog. Trust Anchor gebildet werden kann. Gelingt dies, wird die Gültigkeit jedes Zertifikats dieser Kette überprüft. In unserem Beispiel enthält Code den Wert 0, d. h. MOA SP konnte die Kette bilden, und alle Zertifikate der Kette sind gültig. Für eine Übersicht der möglichen Kodes siehe Security-Layer Spezifikation.

      2.1.4.2 Erweitertes Beispiel

      Request

      Dieses erweiterte Beispiel zur Prüfung einer XML-Signatur (VerifyXMLSignatureRequest.Enveloped.xml) demonstriert die Prüfung einer Enveloped Signature, d. h. einer Signatur, die in ein XML-Dokument integriert ist, die Angabe des Prüfzeitpunkts sowie die Anweisung an MOA SP, in der Response die von der Signatur abgedeckten Daten zu retournieren.

      @@ -943,7 +945,7 @@ positive Ganzzahl repräsentiert, die auf das beinhaltende dsig:Manife </XMLDSIGManifestCheck>

      Neu ist in dieser Response das an SignatureCheck anschließende Element XMLDSIGManifestCheck. Ein oder mehrere solche Elemente werden immer dann zurückgeliefert, wenn in dsig:SignedInfo der XML-Signatur dsig:Reference Elemente existieren, die sich auf ein Manifest nach XMLDSIG beziehen (siehe oben). Je solcher dsig:Reference enthält die Antwort ein korrespondierendes Element XMLDSIGManifestCheck, im konkreten Beispiel als eines.

      -

      Das Element Code gibt das Ergebnis der durchgeführten Prüfung des XMLDSIG-Manifests an. In diesem Fall bedeutet 0, dass die Prüfung jeder dsig:Reference im dsig:Manifest (im konkreten Beispiel also genau einer dsig:Reference) erfolgreich durchgeführt werden konnte. Für eine Übersicht der möglichen Kodes siehe Security-Layer 1.2x TODO.

      +

      Das Element Code gibt das Ergebnis der durchgeführten Prüfung des XMLDSIG-Manifests an. In diesem Fall bedeutet 0, dass die Prüfung jeder dsig:Reference im dsig:Manifest (im konkreten Beispiel also genau einer dsig:Reference) erfolgreich durchgeführt werden konnte. Für eine Übersicht der möglichen Kodes siehe Security-Layer Spezifikation.

      Das Element Info/ReferringSigReference enthält als Textinhalt die Nummer jenes dsig:Reference Elements in dsig:SignedInfo der XML-Signatur, welches auf das untersuchte Manifest nach XMLDSIG verweist, wobei mit 1 zu zählen begonnen wird.

         <CertificateCheck>
@@ -1184,7 +1186,7 @@ Ich habe weiters ein eigenens ID-Attribut bekommen.</doc:Paragraph>

      Das Element CertificateCheck enthält das Resultat der Zertifikatsprüfung (siehe Einfaches Beispiel).

       

      -

      TODO Beispiel-Request mit TSL-Prüfung

      +

      @TODO Beispiel-Request mit TSL-Prüfung

      2.2 Webservice-Clients

      Abschnitt 2.1 bespricht eine Reihe von typischen XML-Requests, die über die Webservice-Schnittstelle an MOA SP/SS gesendet werden können, um entweder Signaturen zu erstellen (MOA SS) oder Signaturen zu prüfen (MOA SP). Dieser Abschnitt zeigt die Verwendung des prototypischen Webservice-Clients, der mit dieser Dokumentation zu MOA SP/SS ausgeliefert wird.

      2.2.1 Übersicht

      @@ -1280,5 +1282,18 @@ Ich habe weiters ein eigenens ID-Attribut bekommen.</doc:Paragraph> +

      B Referenzierte Spezifikation

      + + + + + + + + + + + +
      SpezifikationLink

      Security Layer Spezifikation V x.x @TODO Version einfügen

      		@TODO Link
      diff --git a/spss/server/serverlib/.settings/org.eclipse.wst.common.component b/spss/server/serverlib/.settings/org.eclipse.wst.common.component index 7170b56ac..ee24ef8ba 100644 --- a/spss/server/serverlib/.settings/org.eclipse.wst.common.component +++ b/spss/server/serverlib/.settings/org.eclipse.wst.common.component @@ -2,6 +2,5 @@ - diff --git a/spss/server/serverlib/.settings/org.eclipse.wst.common.project.facet.core.xml b/spss/server/serverlib/.settings/org.eclipse.wst.common.project.facet.core.xml index 69dc9cc0f..656f15b87 100644 --- a/spss/server/serverlib/.settings/org.eclipse.wst.common.project.facet.core.xml +++ b/spss/server/serverlib/.settings/org.eclipse.wst.common.project.facet.core.xml @@ -3,5 +3,5 @@ - - + + \ No newline at end of file diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/SPSSFactory.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/SPSSFactory.java index 26cce1a82..80f996b36 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/SPSSFactory.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/SPSSFactory.java @@ -1090,6 +1090,8 @@ public abstract class SPSSFactory { * @param signerCertificate The signer certificate in binary form. * @param qualifiedCertificate true, if the signer certificate is * a qualified certificate, otherwise false. + * @param qcSourceTSL true, if the QC information comes from the TSL, + * otherwise false. * @param publicAuthority true, if the signer certificate is a * public authority certificate, otherwise false. * @param publicAuthorityID The identification of the public authority @@ -1097,6 +1099,8 @@ public abstract class SPSSFactory { * null. * @param sscd true, if the TSL check verifies the * signature based on a SSDC, otherwise false. + * @param sscdSourceTSL true, if the SSCD information comes from the TSL, + * otherwise false. * @return The SignerInfo containing the above data. * * @pre signerCertSubjectName != null @@ -1106,9 +1110,11 @@ public abstract class SPSSFactory { public abstract SignerInfo createSignerInfo( X509Certificate signerCertificate, boolean qualifiedCertificate, + boolean qcSourceTSL, boolean publicAuthority, String publicAuthorityID, - boolean sscd); + boolean sscd, + boolean sscdSourceTSL); /** * Create a new X509IssuerSerial object. diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/common/SignerInfo.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/common/SignerInfo.java index 7a1942214..337f775bf 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/common/SignerInfo.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/common/SignerInfo.java @@ -58,6 +58,17 @@ public interface SignerInfo { */ public boolean isSSCD(); + /** + * Returns the source of the SSCD check (TSL or Certificate) * + */ + public String getSSCDSource(); + + /** + * Returns the source of the QC check (TSL or Certificate) * + */ + public String getQCSource(); + + /** * Checks, whether the certificate contained in this object is a * public authority certificate. diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/common/TSLConfiguration.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/common/TSLConfiguration.java index fd7d38217..29529322c 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/common/TSLConfiguration.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/common/TSLConfiguration.java @@ -24,6 +24,8 @@ package at.gv.egovernment.moa.spss.api.common; +import iaik.ixsil.util.URI; + import java.util.Date; @@ -70,5 +72,10 @@ public interface TSLConfiguration { */ public String getWorkingDirectory(); + /** + * + * @return + */ + public URI getWorkingDirectoryAsURI(); } diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SPSSFactoryImpl.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SPSSFactoryImpl.java index 7c1208e8f..74f65cb70 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SPSSFactoryImpl.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SPSSFactoryImpl.java @@ -622,15 +622,19 @@ public class SPSSFactoryImpl extends SPSSFactory { public SignerInfo createSignerInfo( X509Certificate signerCertificate, boolean qualifiedCertificate, + boolean qcSourceTSL, boolean publicAuthority, String publicAuthorityID, - boolean sscd) { + boolean sscd, + boolean sscdSourceTSL) { SignerInfoImpl signerInfo = new SignerInfoImpl(); signerInfo.setSignerCertificate(signerCertificate); signerInfo.setQualifiedCertificate(qualifiedCertificate); + signerInfo.setQCSourceTSL(qcSourceTSL); signerInfo.setPublicAuthority(publicAuthority); signerInfo.setPublicAuhtorityID(publicAuthorityID); signerInfo.setSSCD(sscd); + signerInfo.setSSCDSourceTSL(sscdSourceTSL); return signerInfo; } diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SignerInfoImpl.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SignerInfoImpl.java index 56a9004fc..5d26397c5 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SignerInfoImpl.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SignerInfoImpl.java @@ -49,6 +49,13 @@ public class SignerInfoImpl implements SignerInfo { /** Determines, whether the signature is based on an SSCD */ private boolean sscd; + + /** Determines, if the SSCD check bases upon on TSL */ + private boolean sscdSourceTSL; + + /** Determines, if the QC check bases upon on TSL */ + private boolean qcSourceTSL; + /** * Sets the signer certificate. * @@ -87,7 +94,29 @@ public class SignerInfoImpl implements SignerInfo { } public boolean isSSCD() { return sscd; - } + } + + public void setSSCDSourceTSL(boolean sscdSourceTSL) { + this.sscdSourceTSL = sscdSourceTSL; + } + + public String getSSCDSource() { + if (sscdSourceTSL) + return "TSL"; + else + return "Certificate"; + } + + public void setQCSourceTSL(boolean qcSourceTSL) { + this.qcSourceTSL = qcSourceTSL; + } + + public String getQCSource() { + if (qcSourceTSL) + return "TSL"; + else + return "Certificate"; + } /** * Sets, whether the certificate contained in this object is an diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/TSLConfigurationImpl.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/TSLConfigurationImpl.java index 15d66614e..87314e1f7 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/TSLConfigurationImpl.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/TSLConfigurationImpl.java @@ -24,6 +24,8 @@ package at.gv.egovernment.moa.spss.api.impl; +import iaik.ixsil.util.URI; + import java.util.Date; import at.gv.egovernment.moa.spss.api.common.TSLConfiguration; @@ -38,7 +40,7 @@ public class TSLConfigurationImpl implements TSLConfiguration { /** The EU TSL URL. */ -// private String euTSLUrl; + private String euTSLUrl; /** update period in milliseconds */ private long updateSchedulePeriod; @@ -48,9 +50,12 @@ public class TSLConfigurationImpl implements TSLConfiguration { /** Working directory */ private String workingDirectory; + + /** Working directory */ + private URI workingDirectoryAsURI; public String getEuTSLUrl() { - return this.DEFAULT_EU_TSL_URL; + return this.euTSLUrl; } public long getUpdateSchedulePeriod() { @@ -64,10 +69,14 @@ public class TSLConfigurationImpl implements TSLConfiguration { public String getWorkingDirectory() { return this.workingDirectory; } + + public URI getWorkingDirectoryAsURI() { + return this.workingDirectoryAsURI; + } -// public void setEuTSLUrl(String euTSLUrl) { -// this.euTSLUrl = euTSLUrl; -// } + public void setEuTSLUrl(String euTSLUrl) { + this.euTSLUrl = euTSLUrl; + } public void setUpdateSchedulePeriod(long updateSchedulePeriod) { this.updateSchedulePeriod = updateSchedulePeriod; @@ -80,6 +89,10 @@ public class TSLConfigurationImpl implements TSLConfiguration { public void setWorkingDirectory(String workingDirectory) { this.workingDirectory = workingDirectory; } + + public void setWorkingDirectoryURI(URI workingDirectoryAsURI) { + this.workingDirectoryAsURI = workingDirectoryAsURI; + } diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/ResponseBuilderUtils.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/ResponseBuilderUtils.java index a228a0db8..505303bc1 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/ResponseBuilderUtils.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/ResponseBuilderUtils.java @@ -117,9 +117,11 @@ class ResponseBuilderUtils { Element root, X509Certificate cert, boolean isQualified, + String qcSource, boolean isPublicAuthority, String publicAuthorityID, - boolean isSSCD) + boolean isSSCD, + String sscdSource) throws MOAApplicationException { Element signerInfoElem = response.createElementNS(MOA_NS_URI, "SignerInfo"); @@ -182,6 +184,7 @@ class ResponseBuilderUtils { x509DataElem.appendChild(x509IssuerSerialElem); x509DataElem.appendChild(x509CertificateElem); if (isQualified) { + qualifiedCertificateElem.setAttributeNS(MOA_NS_URI, "Source", qcSource); x509DataElem.appendChild(qualifiedCertificateElem); } if (isPublicAuthority) { @@ -192,6 +195,7 @@ class ResponseBuilderUtils { } } if (isSSCD) { + sscdElem.setAttributeNS(MOA_NS_URI, "Source", sscdSource); x509DataElem.appendChild(sscdElem); } signerInfoElem.appendChild(x509DataElem); diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/VerifyCMSSignatureResponseBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/VerifyCMSSignatureResponseBuilder.java index 7ad838822..238875351 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/VerifyCMSSignatureResponseBuilder.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/VerifyCMSSignatureResponseBuilder.java @@ -99,14 +99,17 @@ public class VerifyCMSSignatureResponseBuilder { CheckResult signatureCheck = responseElement.getSignatureCheck(); CheckResult certCheck = responseElement.getCertificateCheck(); + //TODO ResponseBuilderUtils.addSignerInfo( responseDoc, responseElem, signerInfo.getSignerCertificate(), signerInfo.isQualifiedCertificate(), + signerInfo.getQCSource(), signerInfo.isPublicAuthority(), signerInfo.getPublicAuhtorityID(), - signerInfo.isSSCD()); + signerInfo.isSSCD(), + signerInfo.getSSCDSource()); ResponseBuilderUtils.addCodeInfoElement( responseDoc, diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/VerifyXMLSignatureResponseBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/VerifyXMLSignatureResponseBuilder.java index 0d3e0c18e..8673fba1c 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/VerifyXMLSignatureResponseBuilder.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/VerifyXMLSignatureResponseBuilder.java @@ -96,9 +96,11 @@ public class VerifyXMLSignatureResponseBuilder { responseElem, response.getSignerInfo().getSignerCertificate(), response.getSignerInfo().isQualifiedCertificate(), + response.getSignerInfo().getQCSource(), response.getSignerInfo().isPublicAuthority(), response.getSignerInfo().getPublicAuhtorityID(), - response.getSignerInfo().isSSCD()); + response.getSignerInfo().isSSCD(), + response.getSignerInfo().getSSCDSource()); // add HashInputData elements responseData = response.getHashInputDatas(); diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java index 2dcffa014..d2ee75116 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java @@ -67,6 +67,7 @@ import at.gv.egovernment.moa.spss.api.impl.TSLConfigurationImpl; import at.gv.egovernment.moa.spss.util.MessageProvider; import at.gv.egovernment.moa.util.Constants; import at.gv.egovernment.moa.util.DOMUtils; +import at.gv.egovernment.moa.util.FileUtils; import at.gv.egovernment.moa.util.StringUtils; import at.gv.egovernment.moa.util.XPathUtils; @@ -1135,11 +1136,11 @@ public class ConfigurationPartsBuilder { } /** - * Bulid the trust profile mapping. + * Build the trust profile mapping. * * @return The profile ID to profile mapping. */ - public Map buildTrustProfiles() + public Map buildTrustProfiles(String tslWorkingDir) { Map trustProfiles = new HashMap(); NodeIterator profileIter = XPathUtils.selectNodeIterator(getConfigElem(), TRUST_PROFILE_XPATH); @@ -1213,8 +1214,62 @@ public class ConfigurationPartsBuilder { } signerCertsLocStr = (signerCertsLocURI != null) ? signerCertsLocURI.toString() : null; - TrustProfile profile = new TrustProfile(id, trustAnchorsLocURI.toString(), signerCertsLocStr, tslEnabled, countries); + + TrustProfile profile = null; + + if (tslEnabled) { + // create new trust anchor location (=tslworking trust profile) + File fTslWorkingDir = new File(tslWorkingDir); + File tp = new File(fTslWorkingDir, "trustprofiles"); + if (!tp.exists()) + tp.mkdir(); + if (!tp.isDirectory()) { + error("config.50", new Object[] { tp.getPath() }); + // TODO? + } + + File tpid = new File(tp, id); + if (!tpid.exists()) + tpid.mkdir(); + if (!tpid.isDirectory()) { + error("config.50", new Object[] { tpid.getPath() }); + // TODO? + } + + + //System.out.println("tps: " + tpid.getAbsolutePath()); + + // create profile + profile = new TrustProfile(id, tpid.getAbsolutePath(), signerCertsLocStr, tslEnabled, countries); + + // set original uri (save original trust anchor location) + profile.setUriOrig(trustAnchorsLocURI.getPath()); + + // delete files in tslworking trust profile + File[] files = tpid.listFiles(); + for (File file : files) + file.delete(); + + // copy files from trustAnchorsLocURI into tslworking trust profile kopieren + File src = new File(trustAnchorsLocURI.getPath()); + files = src.listFiles(); + for (File file : files) { + FileUtils.copyFile(file, new File(tpid, file.getName())); + } + +// System.out.println("ID: " + id); +// System.out.println("Str: " + trustAnchorsLocStr); +// System.out.println("URI: " + trustAnchorsLocURI.toString()); +// System.out.println("tslWorkingDir: " + tslWorkingDir); + + } else { + + profile = new TrustProfile(id, trustAnchorsLocURI.toString(), signerCertsLocStr, tslEnabled, countries); + + } + trustProfiles.put(id, profile); + } return trustProfiles; @@ -1531,11 +1586,11 @@ public class ConfigurationPartsBuilder { TSLConfigurationImpl tslconfiguration = new TSLConfigurationImpl(); -// String euTSLUrl = getElementValue(getConfigElem(), TSL_CONFIGURATION_XPATH + CONF + "EUTSLUrl", null); -// if (StringUtils.isEmpty(euTSLUrl)) { -// warn("config.39", new Object[] { "EUTSL", euTSLUrl }); -// return null; -// } + String euTSLUrl = getElementValue(getConfigElem(), TSL_CONFIGURATION_XPATH + CONF + "EUTSLUrl", null); + if (StringUtils.isEmpty(euTSLUrl)) { + euTSLUrl = TSLConfiguration.DEFAULT_EU_TSL_URL; + warn("config.39", new Object[] { "EUTSL", euTSLUrl }); + } String updateSchedulePeriod = getElementValue(getConfigElem(), TSL_CONFIGURATION_XPATH + CONF + "UpdateSchedule/" + CONF + "Period" , null); @@ -1591,17 +1646,31 @@ public class ConfigurationPartsBuilder { return null; } + File hashcache = new File(tslWorkingDir, "hashcache"); + if (!hashcache.exists()) { + hashcache.mkdir(); + } + if (!hashcache.isDirectory()) { + error("config.38", new Object[] { hashcache.getAbsolutePath() }); + return null; + } + + System.setProperty("iaik.xml.crypto.tsl.BinaryHashCache.DIR", hashcache.getAbsolutePath()); +// String hashcachedir = System.getProperty("iaik.xml.crypto.tsl.BinaryHashCache.DIR"); +// System.out.println("Hashcache: " + hashcachedir); + + debug("TSL Konfiguration - EUTSLUrl: " + euTSLUrl); debug("TSL Konfiguration - UpdateSchedule/Period: " + updateSchedulePeriod); debug("TSL Konfiguration - UpdateSchedule/StartTime: " + updateScheduleStartTime); debug("TSL Konfiguration - TSLWorkingDirectory: " + tslWorkingDir.getAbsolutePath()); + debug("TSL Konfiguration - Hashcache: " + hashcache.getAbsolutePath()); // set TSL configuration - //tslconfiguration.setEuTSLUrl(euTSLUrl); + tslconfiguration.setEuTSLUrl(euTSLUrl); tslconfiguration.setUpdateSchedulePeriod(Long.valueOf(updateSchedulePeriod).longValue()); tslconfiguration.setUpdateScheduleStartTime(updateScheduleStartTimeDate); tslconfiguration.setWorkingDirectory(tslWorkingDir.getAbsolutePath()); - - + tslconfiguration.setWorkingDirectoryURI(workingDirectoryURI); return tslconfiguration; } diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java index 08478b717..2cad35763 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationProvider.java @@ -361,12 +361,14 @@ public class ConfigurationProvider keyGroupMappings = builder.buildKeyGroupMappings(keyGroups, ANONYMOUS_ISSUER_SERIAL); + tslconfiguration_ = builder.getTSLConfiguration(); + xadesVersion = builder.getXAdESVersion(); defaultChainingMode = builder.getDefaultChainingMode(); chainingModes = builder.buildChainingModes(); useAuthorityInfoAccess_ = builder.getUseAuthorityInfoAccess(); autoAddCertificates_ = builder.getAutoAddCertificates(); - trustProfiles = builder.buildTrustProfiles(); + trustProfiles = builder.buildTrustProfiles(tslconfiguration_.getWorkingDirectory()); distributionPoints = builder.buildDistributionPoints(); enableRevocationChecking_ = builder.getEnableRevocationChecking(); maxRevocationAge_ = builder.getMaxRevocationAge(); @@ -376,7 +378,7 @@ public class ConfigurationProvider revocationArchiveJDBCURL_ = builder.getRevocationArchiveJDBCURL(); revocationArchiveJDBCDriverClass_ = builder.getRevocationArchiveJDBCDriverClass(); - tslconfiguration_ = builder.getTSLConfiguration(); + //check TSL configuration checkTSLConfiguration(); diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/TrustProfile.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/TrustProfile.java index 1b5f4473d..21063c77f 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/TrustProfile.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/TrustProfile.java @@ -41,6 +41,8 @@ public class TrustProfile { private String signerCertsUri; /** Defines if Trustprofile makes use of EU TSL*/ private boolean tslEnabled; + /** The original URI (out of the configuration) giving the location of the trust profile (used when TSL is enabled) */ + private String uriOrig; /** The countries given */ private String countries; /** */ @@ -80,6 +82,15 @@ public class TrustProfile { public String getUri() { return uri; } + + /** + * Return the original URI of this TrustProfile. + * + * @return The original URI of TrustProfile. + */ + public String getUriOrig() { + return uriOrig; + } /** * Return the URI giving the location of the allowed signer certificates @@ -108,20 +119,14 @@ public class TrustProfile { return countries; } + /** - * Return the old certificates (from previous TSL update) to be removed from the truststore before performing a new TSL update - * @return The old certificates (from previous TSL update) to be removed from the truststore before performing a new TSL update + * Sets the original URI of this TrustProfile. + * + * @return The original URI of TrustProfile. */ - public X509Certificate[] getCertficatesToBeRemoved() { - return certificatesToBeRemoved; + public void setUriOrig(String uriOrig) { + this.uriOrig = uriOrig; } - /** - * Sets the old certificates (from previous TSL update) to be removed from the truststore before performing a new TSL update - * @param certificates The old certificates (from previous TSL update) to be removed from the truststore before performing a new TSL update - */ - public void setCertificatesToBeRemoved(X509Certificate[] certificates) { - this.certificatesToBeRemoved = new X509Certificate[certificates.length]; - this.certificatesToBeRemoved = certificates; - } } diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/init/SystemInitializer.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/init/SystemInitializer.java index c9b76dd7e..3640dc23f 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/init/SystemInitializer.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/init/SystemInitializer.java @@ -31,15 +31,12 @@ import iaik.server.ConfigurationData; import iaik.xml.crypto.tsl.ex.TSLEngineDiedException; import iaik.xml.crypto.tsl.ex.TSLSearchException; -import java.io.File; import java.io.FileNotFoundException; import java.io.IOException; import java.security.cert.CertificateException; -import java.util.ArrayList; import java.util.Calendar; import java.util.Date; import java.util.GregorianCalendar; -import java.util.Iterator; import java.util.Timer; import at.gv.egovernment.moa.logging.LogMsg; @@ -125,6 +122,7 @@ public class SystemInitializer { //initialize TSL module TSLConfiguration tslconfig = config.getTSLConfiguration(); + TSLConnector tslconnector = new TSLConnector(); if (tslconfig != null) { //Logger.info(new LogMsg(msg.getMessage("init.01", null))); @@ -133,10 +131,14 @@ public class SystemInitializer { } +// System.out.println("Hashcache 1: " + BinaryHashCache.DIR); + //start TSL Update TSLUpdaterTimerTask.tslconnector_ = tslconnector; TSLUpdaterTimerTask.update(); +// System.out.println("Hashcache 2: " + BinaryHashCache.DIR); + //initialize TSL Update Task initTSLUpdateTask(tslconfig); diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureVerificationInvoker.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureVerificationInvoker.java index 00f96f205..6aa34573e 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureVerificationInvoker.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureVerificationInvoker.java @@ -58,6 +58,7 @@ import at.gv.egovernment.moa.spss.server.logging.TransactionId; import at.gv.egovernment.moa.spss.server.transaction.TransactionContext; import at.gv.egovernment.moa.spss.server.transaction.TransactionContextManager; import at.gv.egovernment.moa.spss.tsl.timer.TSLUpdaterTimerTask; +import at.gv.egovernment.moa.spss.util.CertificateUtils; import at.gv.egovernment.moa.spss.util.MessageProvider; /** @@ -191,12 +192,61 @@ public class CMSSignatureVerificationInvoker { for (resultIter = results.iterator(); resultIter.hasNext();) { result = (CMSSignatureVerificationResult) resultIter.next(); + boolean sscdSourceTSL = false; + boolean qcSourceTSL = false; + boolean checkQC = false; + boolean checkSSCD = false; + + List chain = result.getCertificateValidationResult().getCertificateChain(); // check QC and SSCD via TSL (if enabled) - boolean checkQCFromTSL = checkQC(trustProfile.isTSLEnabled(), result.getCertificateValidationResult().getCertificateChain()); - boolean checkSSCDFromTSL = checkSSCD(trustProfile.isTSLEnabled(), result.getCertificateValidationResult().getCertificateChain());; + boolean checkQCFromTSL = checkQC(trustProfile.isTSLEnabled(), chain); + boolean checkSSCDFromTSL = checkSSCD(trustProfile.isTSLEnabled(), chain); + + if (!checkSSCDFromTSL) { + + boolean checkQCPPlus = CertificateUtils.checkQCPPlus((X509Certificate)chain.get(0)); + boolean checkQcEuSSCD = CertificateUtils.checkQcEuSSCD((X509Certificate)chain.get(0)); + + if (checkQCPPlus) + checkSSCD = true; + if (checkQcEuSSCD) + checkSSCD = true; + + sscdSourceTSL = false; + + System.out.println("checkSSCDFromTSL: " + checkSSCDFromTSL); + System.out.println("checkQCPPlus: " + checkQCPPlus); + System.out.println("checkQcEuSSCD: " + checkQcEuSSCD); + } + else { + checkSSCD = true; + sscdSourceTSL = true; + } + + if (!checkQCFromTSL) { + + boolean checkQCP = CertificateUtils.checkQCP((X509Certificate)chain.get(0)); + boolean checkQcEuCompliance = CertificateUtils.checkQcEuCompliance((X509Certificate)chain.get(0)); + + if (checkQCP) + checkQC = true; + if (checkQcEuCompliance) + checkQC = true; + + qcSourceTSL = false; + + System.out.println("checkQCFromTSL: " + checkQCFromTSL); + System.out.println("checkQCP: " + checkQCP); + System.out.println("checkQcEuCompliance: " + checkQcEuCompliance); + } + else { + checkQC = true; + qcSourceTSL = true; + } + - responseBuilder.addResult(result, trustProfile, checkQCFromTSL, checkSSCDFromTSL); + responseBuilder.addResult(result, trustProfile, checkQC, qcSourceTSL, checkSSCD, sscdSourceTSL); } } else { int i; @@ -207,12 +257,64 @@ public class CMSSignatureVerificationInvoker { try { result = (CMSSignatureVerificationResult) results.get(signatories[i] - 1); + boolean sscdSourceTSL = false; + boolean qcSourceTSL = false; + + boolean checkQC = false; + boolean checkSSCD = false; + + List chain = result.getCertificateValidationResult().getCertificateChain(); // check QC and SSCD via TSL (if enabled) - boolean checkQCFromTSL = checkQC(trustProfile.isTSLEnabled(), result.getCertificateValidationResult().getCertificateChain()); - boolean checkSSCDFromTSL = checkSSCD(trustProfile.isTSLEnabled(), result.getCertificateValidationResult().getCertificateChain());; + boolean checkQCFromTSL = checkQC(trustProfile.isTSLEnabled(), chain); + boolean checkSSCDFromTSL = checkSSCD(trustProfile.isTSLEnabled(), chain); + + if (!checkSSCDFromTSL) { + + boolean checkQCPPlus = CertificateUtils.checkQCPPlus((X509Certificate)chain.get(0)); + boolean checkQcEuSSCD = CertificateUtils.checkQcEuSSCD((X509Certificate)chain.get(0)); + + if (checkQCPPlus) + checkSSCD = true; + if (checkQcEuSSCD) + checkSSCD = true; + + sscdSourceTSL = false; + + System.out.println("checkSSCDFromTSL: " + checkSSCDFromTSL); + System.out.println("checkQCPPlus: " + checkQCPPlus); + System.out.println("checkQcEuSSCD: " + checkQcEuSSCD); + } + else { + checkSSCD = true; + sscdSourceTSL = true; + } + + if (!checkQCFromTSL) { + + boolean checkQCP = CertificateUtils.checkQCP((X509Certificate)chain.get(0)); + boolean checkQcEuCompliance = CertificateUtils.checkQcEuCompliance((X509Certificate)chain.get(0)); + + if (checkQCP) + checkQC = true; + if (checkQcEuCompliance) + checkQC = true; + + qcSourceTSL = false; + + System.out.println("checkQCFromTSL: " + checkQCFromTSL); + System.out.println("checkQCP: " + checkQCP); + System.out.println("checkQcEuCompliance: " + checkQcEuCompliance); - - responseBuilder.addResult(result, trustProfile, checkQCFromTSL, checkSSCDFromTSL); + } + else { + checkQC = true; + qcSourceTSL = true; + } + + + + + responseBuilder.addResult(result, trustProfile, checkQC, qcSourceTSL, checkSSCD, sscdSourceTSL); } catch (IndexOutOfBoundsException e) { throw new MOAApplicationException( "2249", diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyCMSSignatureResponseBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyCMSSignatureResponseBuilder.java index 605716d5b..f44cce62a 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyCMSSignatureResponseBuilder.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyCMSSignatureResponseBuilder.java @@ -73,13 +73,14 @@ public class VerifyCMSSignatureResponseBuilder { * @param trustprofile The actual trustprofile * @param checkQCFromTSL true, if the TSL check verifies the * certificate as qualified, otherwise false. - * @param checkSSCDFromTSL true, if the TSL check verifies the + * @param checkSSCD true, if the TSL check verifies the * signature based on a SSDC, otherwise false. + * @param sscdSourceTSL true, if the SSCD information comes from the TSL, + * otherwise false. * @throws MOAException */ - public void addResult(CMSSignatureVerificationResult result, TrustProfile trustProfile, boolean checkQCFromTSL, boolean checkSSCDFromTSL) + public void addResult(CMSSignatureVerificationResult result, TrustProfile trustProfile, boolean checkQC, boolean qcSourceTSL, boolean checkSSCD, boolean sscdSourceTSL) throws MOAException { - CertificateValidationResult certResult = result.getCertificateValidationResult(); @@ -92,27 +93,18 @@ public class VerifyCMSSignatureResponseBuilder { CheckResult signatureCheck; CheckResult certificateCheck; - boolean qualifiedCertificate = false; - - // verify qualified certificate checks (certificate or TSL) - if (trustProfile.isTSLEnabled()) { - // take TSL result - qualifiedCertificate = checkQCFromTSL; - } - else { - // take result from certificate - qualifiedCertificate = certResult.isQualifiedCertificate(); - } + boolean qualifiedCertificate = checkQC; // add SignerInfo element signerInfo = factory.createSignerInfo( (X509Certificate) certResult.getCertificateChain().get(0), qualifiedCertificate, + qcSourceTSL, certResult.isPublicAuthorityCertificate(), certResult.getPublicAuthorityID(), - checkSSCDFromTSL); - + checkSSCD, + sscdSourceTSL); // add SignatureCheck element signatureCheck = factory.createCheckResult(signatureCheckCode, null); @@ -120,9 +112,6 @@ public class VerifyCMSSignatureResponseBuilder { // add CertificateCheck element certificateCheck = factory.createCheckResult(certificateCheckCode, null); - - - // build the response element responseElement = factory.createVerifyCMSSignatureResponseElement( diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyXMLSignatureResponseBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyXMLSignatureResponseBuilder.java index 755ca82b6..4fdb1eeb7 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyXMLSignatureResponseBuilder.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyXMLSignatureResponseBuilder.java @@ -125,10 +125,12 @@ public class VerifyXMLSignatureResponseBuilder { * @param transformsSignatureManifestCheck The overall result for the signature * manifest check. * @param certificateCheck The overall result for the certificate check. - * @param checkQCFromTSL true, if the TSL check verifies the - * certificate as qualified, otherwise false. - * @param checkSSCDFromTSL true, if the TSL check verifies the - * signature based on a SSDC, otherwise false. + * @param checkQC true, if the certificate is QC, otherwise false. + * @param qcSourceTSL true, if the QC information comes from the TSL, + * otherwise false. + * @param checkSSCD true, if the signature is created by an SSCD, otherwise false. + * @param sscdSourceTSL true, if the SSCD information comes from the TSL, + * otherwise false. * @throws MOAApplicationException An error occurred adding the result. */ public void setResult( @@ -136,8 +138,10 @@ public class VerifyXMLSignatureResponseBuilder { XMLSignatureVerificationProfile profile, ReferencesCheckResult transformsSignatureManifestCheck, CheckResult certificateCheck, - boolean checkQCFromTSL, - boolean checkSSCDFromTSL, + boolean checkQC, + boolean qcSourceTSL, + boolean checkSSCD, + boolean sscdSourceTSL, boolean isTSLEnabledTrustprofile) throws MOAApplicationException { @@ -152,24 +156,18 @@ public class VerifyXMLSignatureResponseBuilder { boolean qualifiedCertificate = false; - // verify qualified certificate checks (certificate or TSL) - if (isTSLEnabledTrustprofile) { - // take TSL result - qualifiedCertificate = checkQCFromTSL; - } - else { - // take result from certificate - qualifiedCertificate = certResult.isQualifiedCertificate(); - } + qualifiedCertificate = checkQC; // create the SignerInfo; signerInfo = factory.createSignerInfo( (X509Certificate) certResult.getCertificateChain().get(0), qualifiedCertificate, + qcSourceTSL, certResult.isPublicAuthorityCertificate(), certResult.getPublicAuthorityID(), - checkSSCDFromTSL); + checkSSCD, + sscdSourceTSL); // Create HashInputData Content objects referenceDataList = result.getReferenceDataList(); diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java index f3ac72520..c3cc8bfe8 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java @@ -24,7 +24,10 @@ package at.gv.egovernment.moa.spss.server.invoke; +import at.gv.egovernment.moa.spss.util.CertificateUtils; + import iaik.ixsil.exceptions.URIException; + import iaik.ixsil.util.URI; import iaik.server.modules.IAIKException; import iaik.server.modules.IAIKRuntimeException; @@ -208,8 +211,11 @@ public class XMLSignatureVerificationInvoker { requestElement); } - boolean checkQCFromTSL = false; - boolean checkSSCDFromTSL = false; + boolean sscdSourceTSL = false; + boolean qcSourceTSL = false; + + boolean checkQC = false; + boolean checkSSCD = false; String tpID = profile.getCertificateValidationProfile().getTrustStoreProfile().getId(); ConfigurationProvider config = ConfigurationProvider.getInstance(); @@ -242,7 +248,6 @@ public class XMLSignatureVerificationInvoker { if (list != null) { X509Certificate[] chain = new X509Certificate[list.size()]; - Iterator it = list.iterator(); int i = 0; while(it.hasNext()) { @@ -250,8 +255,49 @@ public class XMLSignatureVerificationInvoker { i++; } - checkQCFromTSL = TSLUpdaterTimerTask.tslconnector_.checkQC(chain); - checkSSCDFromTSL = TSLUpdaterTimerTask.tslconnector_.checkSSCD(chain); + boolean checkQCFromTSL = TSLUpdaterTimerTask.tslconnector_.checkQC(chain); + boolean checkSSCDFromTSL = TSLUpdaterTimerTask.tslconnector_.checkSSCD(chain); + + if (!checkSSCDFromTSL) { + + boolean checkQCPPlus = CertificateUtils.checkQCPPlus(chain[0]); + boolean checkQcEuSSCD = CertificateUtils.checkQcEuSSCD(chain[0]); + + if (checkQCPPlus) + checkSSCD = true; + if (checkQcEuSSCD) + checkSSCD = true; + + sscdSourceTSL = false; + } + else { + checkSSCD = true; + sscdSourceTSL = true; + } + + if (!checkQCFromTSL) { + + boolean checkQCP = CertificateUtils.checkQCP(chain[0]); + boolean checkQcEuCompliance = CertificateUtils.checkQcEuCompliance(chain[0]); + + if (checkQCP) + checkQC = true; + if (checkQcEuCompliance) + checkQC = true; + + qcSourceTSL = false; + } + else { + checkQC = true; + qcSourceTSL = true; + } + +// System.out.println("chain[0]: " + chain[0]); +// +// System.out.println("checkQCFromTSL: " + checkQCFromTSL); +// System.out.println("checkSSCDFromTSL: " + checkSSCDFromTSL); +// System.out.println("checkQCPPlus: " + checkQCPPlus); +// System.out.println("checkQcEuSSCD: " + checkQcEuSSCD); } } } @@ -278,9 +324,14 @@ public class XMLSignatureVerificationInvoker { // Check if signer certificate is in trust profile's allowed signer certificates pool TrustProfile trustProfile = context.getConfiguration().getTrustProfile(request.getTrustProfileId()); CheckResult certificateCheck = validateSignerCertificate(result, trustProfile); - + +// System.out.println("checkQC: " + checkQC); +// System.out.println("qcSourceTSL: " + qcSourceTSL); +// System.out.println("checkSSCD: " + checkSSCD); +// System.out.println("sscdSourceTSL: " + sscdSourceTSL); + // build the response - responseBuilder.setResult(result, profile, signatureManifestCheck, certificateCheck, checkQCFromTSL, checkSSCDFromTSL, tp.isTSLEnabled()); + responseBuilder.setResult(result, profile, signatureManifestCheck, certificateCheck, checkQC, qcSourceTSL, checkSSCD, sscdSourceTSL, tp.isTSLEnabled()); return responseBuilder.getResponse(); } diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/connector/TSLConnector.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/connector/TSLConnector.java index 2e4af2817..49f715cb8 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/connector/TSLConnector.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/connector/TSLConnector.java @@ -88,23 +88,20 @@ public class TSLConnector implements TSLConnectorInterface { if (Configurator.is_isInitialised() == false) new TSLEngineFatalException("The TSL Engine is not initialized!"); - - //TODO: clean hascash and TLS Download folder - String hashcachedir = System.getProperty("iaik.xml.crypto.tsl.BinaryHashCache.DIR"); - - if (hashcachedir==null) - hashcachedir = DEFAULT_HASHCACHE_DIR; - + String tsldownloaddir = Configurator.get_TSLWorkingDirectoryPath() + "TslDownload"; - File hashcachefile = new File(hashcachedir); - - - File[] filelist = hashcachefile.listFiles(); - if (filelist != null) { - for (File f : filelist) - f.delete(); - } +// String hashcachedir = System.getProperty("iaik.xml.crypto.tsl.BinaryHashCache.DIR"); +// System.out.println("hashcachedir: " + hashcachedir); +// if (hashcachedir==null) +// hashcachedir = DEFAULT_HASHCACHE_DIR; + +// File hashcachefile = new File(hashcachedir); +// File[] filelist = hashcachefile.listFiles(); +// if (filelist != null) { +// for (File f : filelist) +// f.delete(); +// } File tsldownloadfile = new File(tsldownloaddir); if (!tsldownloadfile.exists()) { diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/timer/TSLUpdaterTimerTask.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/timer/TSLUpdaterTimerTask.java index c365a1121..76be8217a 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/timer/TSLUpdaterTimerTask.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/timer/TSLUpdaterTimerTask.java @@ -33,6 +33,7 @@ import at.gv.egovernment.moa.spss.server.iaik.pki.store.truststore.TrustStorePro import at.gv.egovernment.moa.spss.server.logging.TransactionId; import at.gv.egovernment.moa.spss.tsl.connector.TSLConnector; import at.gv.egovernment.moa.spss.util.MessageProvider; +import at.gv.egovernment.moa.util.FileUtils; import at.gv.egovernment.moa.util.StringUtils; @@ -130,7 +131,14 @@ public class TSLUpdaterTimerTask extends TimerTask { // create store updater for each TSL enabled truststore Logger.debug(new LogMsg(msg.getMessage("config.45", null))); StoreUpdater storeUpdater = new StoreUpdater(certStoreParameters, trustStoreProfiles, tid); + + // delete files in trustprofile + File ftp = new File(tp.getUri()); + File[] files = ftp.listFiles(); + for (File file : files) + file.delete(); + // convert ArrayList to X509Certificate[] X509Certificate[] addCertificates = new X509Certificate[tsl_certs.size()]; Iterator itcert = tsl_certs.iterator(); @@ -143,20 +151,18 @@ public class TSLUpdaterTimerTask extends TimerTask { i++; } - // get certificates to be removed - X509Certificate[] removeCertificates = tp.getCertficatesToBeRemoved(); - - - //Logger.debug(new LogMsg(msg.getMessage("config.44", null))); - Logger.debug(new LogMsg("Remove " + removeCertificates.length + " certificates.")); - storeUpdater.removeCertificatesFromTrustStores(removeCertificates, tid); - + // copy files from original trustAnchorsLocURI into tslworking trust profile + File src = new File(tp.getUriOrig()); + files = src.listFiles(); + for (File file : files) { + FileUtils.copyFile(file, new File(tp.getUri(), file.getName())); + } + Logger.debug(new LogMsg("Add " + addCertificates.length + " certificates.")); storeUpdater.addCertificatesToTrustStores(addCertificates, tid); + storeUpdater.addCertificatesToCertStores(addCertificates, tid); - // set the certifcates to be removed for the next TSL update - tp.setCertificatesToBeRemoved(addCertificates); } } diff --git a/spss/server/serverlib/src/main/resources/resources/properties/spss_messages_de.properties b/spss/server/serverlib/src/main/resources/resources/properties/spss_messages_de.properties index 1a6e54089..e4ee607c0 100644 --- a/spss/server/serverlib/src/main/resources/resources/properties/spss_messages_de.properties +++ b/spss/server/serverlib/src/main/resources/resources/properties/spss_messages_de.properties @@ -158,6 +158,7 @@ config.45=Create store updater config.46=Start periodical TSL update task at {0} and then every {1} milliseconds config.48=No whitelisted URIs given. config.49=Whitelisted URI: {0}. +config.50=Fehler beim Erstellen des TSL Vertrauensprofils: Das Verzeichnis ({0}) ist kein Verzeichnis. handler.00=Starte neue Transaktion: TID={0}, Service={1} handler.01=Aufruf von Adresse={0} diff --git a/spss/server/serverws/.settings/org.eclipse.wst.common.component b/spss/server/serverws/.settings/org.eclipse.wst.common.component index 1b3789e29..c325a5007 100644 --- a/spss/server/serverws/.settings/org.eclipse.wst.common.component +++ b/spss/server/serverws/.settings/org.eclipse.wst.common.component @@ -6,11 +6,9 @@ uses - - - - + + diff --git a/spss/server/serverws/pom.xml b/spss/server/serverws/pom.xml index c61d1ae2b..101b16882 100644 --- a/spss/server/serverws/pom.xml +++ b/spss/server/serverws/pom.xml @@ -68,6 +68,42 @@ iaik.prod iaik_ixsil + + iaik.prod + iaik_tsl + + + log4j + log4j + + + iaik.prod + iaik_util + + + iaik.prod + iaik_xsect + + + javax.xml.bind + jaxb-api + + + com.sun.xml.bind + jaxb-impl + + + org.xerial + sqlite-jdbc + + + iaik.prod + iaik_jsse + + + iaik.prod + iaik_util + iaik.prod diff --git a/spss/server/tools/.classpath b/spss/server/tools/.classpath index 21bdbd0bc..3922cc795 100644 --- a/spss/server/tools/.classpath +++ b/spss/server/tools/.classpath @@ -1,16 +1,14 @@ - - - - - - - - - - - - - - + + + + + + + + + + + + \ No newline at end of file diff --git a/spss/server/tools/.settings/org.eclipse.jdt.core.prefs b/spss/server/tools/.settings/org.eclipse.jdt.core.prefs index c788ee346..1cd6f082c 100644 --- a/spss/server/tools/.settings/org.eclipse.jdt.core.prefs +++ b/spss/server/tools/.settings/org.eclipse.jdt.core.prefs @@ -1,8 +1,9 @@ +#Mon Aug 05 10:52:30 CEST 2013 +org.eclipse.jdt.core.compiler.problem.enumIdentifier=error +org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning +org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5 eclipse.preferences.version=1 org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled -org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7 -org.eclipse.jdt.core.compiler.compliance=1.7 +org.eclipse.jdt.core.compiler.source=1.5 org.eclipse.jdt.core.compiler.problem.assertIdentifier=error -org.eclipse.jdt.core.compiler.problem.enumIdentifier=error -org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning -org.eclipse.jdt.core.compiler.source=1.7 +org.eclipse.jdt.core.compiler.compliance=1.5 -- cgit v1.2.3 From 5b697c424d24a7523dccd210454d029368e34898 Mon Sep 17 00:00:00 2001 From: Klaus Stranacher Date: Wed, 21 Aug 2013 13:12:26 +0200 Subject: Update QC/SSCD check WSDL location updated --- .../resources/resources/schemas/MOA-SPSS-1.5.2.xsd | 34 +- id/oa/.settings/org.eclipse.jdt.core.prefs | 6 +- id/oa/.settings/org.eclipse.wst.common.component | 10 +- .../org.eclipse.wst.common.project.facet.core.xml | 6 +- .../.settings/org.eclipse.wst.common.component | 3 - .../.settings/org.eclipse.wst.common.component | 7 +- .../.settings/org.eclipse.wst.common.component | 3 - pom.xml | 16 +- spss/handbook/clients/api/.classpath | 82 +-- .../handbook/config/MOA-SPSS-config-1.5.2.xsd | 61 ++- spss/handbook/handbook/config/config.html | 6 +- spss/handbook/handbook/spec/MOA-SPSS-1.5.2.xsd | 104 +++- .../resources/data/deploy/tomcat/unix/moa-env.sh | 5 +- .../data/deploy/tomcat/win32/startTomcat.bat | 5 +- .../gv/egovernment/moa/spss/api/SPSSFactory.java | 4 +- .../moa/spss/api/common/SignerInfo.java | 6 +- .../moa/spss/api/impl/SPSSFactoryImpl.java | 4 +- .../moa/spss/api/impl/SignerInfoImpl.java | 10 + .../moa/spss/api/xmlbind/ResponseBuilderUtils.java | 20 +- .../xmlbind/VerifyCMSSignatureResponseBuilder.java | 4 +- .../xmlbind/VerifyXMLSignatureResponseBuilder.java | 3 +- .../server/config/ConfigurationPartsBuilder.java | 9 - .../moa/spss/server/init/SystemInitializer.java | 10 +- .../invoke/CMSSignatureVerificationInvoker.java | 209 ++------ .../invoke/VerifyCMSSignatureResponseBuilder.java | 5 +- .../invoke/VerifyXMLSignatureResponseBuilder.java | 6 +- .../invoke/XMLSignatureVerificationInvoker.java | 104 +--- .../moa/spss/tsl/connector/TSLConnector.java | 252 ++++++++++ .../moa/spss/tsl/timer/TSLUpdaterTimerTask.java | 200 ++++---- .../moa/spss/util/CertificateUtils.java | 286 +++++++++++ .../gv/egovernment/moa/spss/util/QCSSCDResult.java | 37 ++ spss/server/serverws/pom.xml | 3 +- .../serverws/resources/wsdl/MOA-SPSS-1.5.2.wsdl | 128 ----- .../serverws/resources/wsdl/MOA-SPSS-1.5.2.xsd | 551 --------------------- .../src/main/webapp/WEB-INF/server-config.wsdd | 8 +- 35 files changed, 1046 insertions(+), 1161 deletions(-) create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/util/CertificateUtils.java create mode 100644 spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/util/QCSSCDResult.java delete mode 100644 spss/server/serverws/resources/wsdl/MOA-SPSS-1.5.2.wsdl delete mode 100644 spss/server/serverws/resources/wsdl/MOA-SPSS-1.5.2.xsd (limited to 'spss/server/serverlib/src/main/java/at') diff --git a/common/src/main/resources/resources/schemas/MOA-SPSS-1.5.2.xsd b/common/src/main/resources/resources/schemas/MOA-SPSS-1.5.2.xsd index 640f577aa..144918778 100644 --- a/common/src/main/resources/resources/schemas/MOA-SPSS-1.5.2.xsd +++ b/common/src/main/resources/resources/schemas/MOA-SPSS-1.5.2.xsd @@ -147,7 +147,7 @@ - only ds:X509Data and RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any;publicAuthority is included as X509Data/any; SecureSignatureCreationDevice is included as X509Data/any + only ds:X509Data and RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any;publicAuthority is included as X509Data/any; SecureSignatureCreationDevice is included as X509Data/any, IssuingCountry is included as X509Data/any @@ -198,7 +198,7 @@ - only ds:X509Data and ds:RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any; PublicAuthority is included as X509Data/any; SecureSignatureCreationDevice is included as X509Data/any + only ds:X509Data and ds:RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any; PublicAuthority is included as X509Data/any; SecureSignatureCreationDevice is included as X509Data/any, IssuingCountry is included as X509Data/any @@ -454,19 +454,31 @@ - + + + + + + + + + + + + - - - - - - - - + + + + + + + + + diff --git a/id/oa/.settings/org.eclipse.jdt.core.prefs b/id/oa/.settings/org.eclipse.jdt.core.prefs index c788ee346..dc0892a32 100644 --- a/id/oa/.settings/org.eclipse.jdt.core.prefs +++ b/id/oa/.settings/org.eclipse.jdt.core.prefs @@ -1,8 +1,8 @@ eclipse.preferences.version=1 org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled -org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7 -org.eclipse.jdt.core.compiler.compliance=1.7 +org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5 +org.eclipse.jdt.core.compiler.compliance=1.5 org.eclipse.jdt.core.compiler.problem.assertIdentifier=error org.eclipse.jdt.core.compiler.problem.enumIdentifier=error org.eclipse.jdt.core.compiler.problem.forbiddenReference=warning -org.eclipse.jdt.core.compiler.source=1.7 +org.eclipse.jdt.core.compiler.source=1.5 diff --git a/id/oa/.settings/org.eclipse.wst.common.component b/id/oa/.settings/org.eclipse.wst.common.component index 7e38d20b7..beb49b957 100644 --- a/id/oa/.settings/org.eclipse.wst.common.component +++ b/id/oa/.settings/org.eclipse.wst.common.component @@ -1,8 +1,8 @@ - - + - - + + + - \ No newline at end of file + diff --git a/id/oa/.settings/org.eclipse.wst.common.project.facet.core.xml b/id/oa/.settings/org.eclipse.wst.common.project.facet.core.xml index a801c94a0..fec12087a 100644 --- a/id/oa/.settings/org.eclipse.wst.common.project.facet.core.xml +++ b/id/oa/.settings/org.eclipse.wst.common.project.facet.core.xml @@ -2,6 +2,6 @@ - - - \ No newline at end of file + + + diff --git a/id/server/auth/.settings/org.eclipse.wst.common.component b/id/server/auth/.settings/org.eclipse.wst.common.component index e667e1ee5..90413a56a 100644 --- a/id/server/auth/.settings/org.eclipse.wst.common.component +++ b/id/server/auth/.settings/org.eclipse.wst.common.component @@ -6,9 +6,6 @@ uses - - uses - uses diff --git a/id/server/idserverlib/.settings/org.eclipse.wst.common.component b/id/server/idserverlib/.settings/org.eclipse.wst.common.component index 8f3380621..a5eb3d4d8 100644 --- a/id/server/idserverlib/.settings/org.eclipse.wst.common.component +++ b/id/server/idserverlib/.settings/org.eclipse.wst.common.component @@ -1,8 +1,7 @@ - + + - - - + \ No newline at end of file diff --git a/id/server/proxy/.settings/org.eclipse.wst.common.component b/id/server/proxy/.settings/org.eclipse.wst.common.component index cc61830e7..eeb0e2248 100644 --- a/id/server/proxy/.settings/org.eclipse.wst.common.component +++ b/id/server/proxy/.settings/org.eclipse.wst.common.component @@ -6,9 +6,6 @@ uses - - uses - uses diff --git a/pom.xml b/pom.xml index 19674de20..d7e107a2d 100644 --- a/pom.xml +++ b/pom.xml @@ -68,10 +68,10 @@ moa - id/assembly-auth.xml--> - + id/assembly-auth.xml + id/assembly-proxy.xml spss/assembly.xml - + spss/assembly-lib.xml @@ -211,32 +211,32 @@ junit junit - 3.8.1 + 3.8.1 test commons-logging commons-logging - 1.0.4 + 1.0.4 compile javax.servlet servlet-api - 2.4 + 2.4 provide javax.activation activation - 1.1 + 1.1 compile commons-discovery commons-discovery - 0.2 + 0.2 compile diff --git a/spss/handbook/clients/api/.classpath b/spss/handbook/clients/api/.classpath index ea8736aef..53806d1e8 100644 --- a/spss/handbook/clients/api/.classpath +++ b/spss/handbook/clients/api/.classpath @@ -1,43 +1,43 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/spss/handbook/handbook/config/MOA-SPSS-config-1.5.2.xsd b/spss/handbook/handbook/config/MOA-SPSS-config-1.5.2.xsd index 669ebe53f..91d281171 100644 --- a/spss/handbook/handbook/config/MOA-SPSS-config-1.5.2.xsd +++ b/spss/handbook/handbook/config/MOA-SPSS-config-1.5.2.xsd @@ -19,20 +19,36 @@ - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -78,6 +94,7 @@ + @@ -99,6 +116,19 @@ + + + + + + + + + + + + + @@ -147,7 +177,7 @@ - + @@ -283,6 +313,7 @@ + diff --git a/spss/handbook/handbook/config/config.html b/spss/handbook/handbook/config/config.html index 96270bde1..f44bd7dc0 100644 --- a/spss/handbook/handbook/config/config.html +++ b/spss/handbook/handbook/config/config.html @@ -1071,7 +1071,10 @@ Wird der Wert auf -1 gesetzt, dann bedeutet das ein unendlich langes Intervall.

      Das Element cfg:TSLConfiguration legt die TSL Konfiguration fest, wenn Vertrauensprofile mit TSL Unterstützung konfiguriert sind. Das Element weist folgende Kind-Elemente auf:

          -
        • Element cfg:UpdateSchedule: Dieses Element legt fest wann und in welchem Intervall die EU-TSL erneut eingelesen werden soll. Das Element cfg:UpdateSchedule besteht dabei aus folgenden Kind-Elementen:
          • +
        • Element cfg:EUTSLUrl: Dieses optionale Element legt die URL zur EU-TSL fest.
          +
          • + Hinweis: Wird kein cfg:EUTSLUrl Element angegeben so wird defaultmäßig https://ec.europa.eu/information_society/policy/esignature/trusted-list/tl-mp.xml als EU-TSL URL herangezogen. +
        • Element cfg:UpdateSchedule: Dieses optionale Element legt fest wann und in welchem Intervall die EU-TSL erneut eingelesen werden soll. Das Element cfg:UpdateSchedule besteht dabei aus folgenden Kind-Elementen:
          • Element cfg:StartTime: Legt eine Startzeit im Format hh:mm:ss fest.
          • Element cfg:Period: Legt das Intervall (in Millisekunden) fest, in welchem die EU-TSL erneut eingelesen werden soll
            • @@ -1085,7 +1088,6 @@ Wird der Wert auf -1 gesetzt, dann bedeutet das ein unendlich langes Intervall. Wichtig: Das angegebene Verzeichnis muss jedenfalls die Unterverzeichnis "trust" aus der Beispiel-Konfiguration beinhalten. In dessen Unterverzeichnis "eu" müssen jene vertrauenswürdigen Zertifikate angegeben werden, mit denen die EU-TSL signiert ist.
          -

          Wichtig: Beim Tomcat-Start muss zusätzlich noch ein so genannten Hashcache Verzeichnis angegeben werden. Dies erfolgt mit dem Parameter iaik.xml.crypto.tsl.BinaryHashCache.DIR (siehe auch Starten und Stoppen von Tomcat).

          Hinweis: Um die TSL Überprüfung zu aktivieren muss auch (zumindest) ein Vertrauensprofil mit TSL Überprüfung konfiguriert werden (siehe Vertrauensprofil)

          diff --git a/spss/handbook/handbook/spec/MOA-SPSS-1.5.2.xsd b/spss/handbook/handbook/spec/MOA-SPSS-1.5.2.xsd index 137ad6deb..144918778 100644 --- a/spss/handbook/handbook/spec/MOA-SPSS-1.5.2.xsd +++ b/spss/handbook/handbook/spec/MOA-SPSS-1.5.2.xsd @@ -1,15 +1,56 @@ - - - + + + + + + + + + + + + + Ermöglichung der Stapelsignatur durch wiederholte Angabe dieses Elements + + + + + + + + + + + + + + + + + + + + + + Kardinalität 1..oo erlaubt die Antwort auf eine Stapelsignatur-Anfrage + + + + Resultat, falls die Signaturerstellung erfolgreich war + + + + + @@ -106,7 +147,7 @@ - only ds:X509Data and RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any;publicAuthority is included as X509Data/any + only ds:X509Data and RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any;publicAuthority is included as X509Data/any; SecureSignatureCreationDevice is included as X509Data/any, IssuingCountry is included as X509Data/any @@ -157,7 +198,7 @@ - only ds:X509Data and ds:RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any; PublicAuthority is included as X509Data/any + only ds:X509Data and ds:RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any; PublicAuthority is included as X509Data/any; SecureSignatureCreationDevice is included as X509Data/any, IssuingCountry is included as X509Data/any @@ -228,6 +269,25 @@ + + + + + + + + + + + + + + + + + + + @@ -246,6 +306,12 @@ + + + + + + @@ -388,7 +454,31 @@ - + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/spss/server/serverlib/resources/data/deploy/tomcat/unix/moa-env.sh b/spss/server/serverlib/resources/data/deploy/tomcat/unix/moa-env.sh index 6d5be35c0..f114a40f8 100644 --- a/spss/server/serverlib/resources/data/deploy/tomcat/unix/moa-env.sh +++ b/spss/server/serverlib/resources/data/deploy/tomcat/unix/moa-env.sh @@ -3,14 +3,11 @@ MOA_START=`pwd` CONFIG_OPT=-Dmoa.spss.server.configuration=$MOA_START/conf/moa-spss/spss.config.xml LOGGING_OPT=-Dlog4j.configuration=file:$MOA_START/conf/moa-spss/log4j.properties -# Hashcache Parameter für TSL Unterstuetzung bei MOA-SP -#PARAM_HASHCACHE=-Diaik.xml.crypto.tsl.BinaryHashCache.DIR=$MOA_START/conf/moa-spss/hashcache/ - # NODE_ID_OPT=-Dmoa.node-id=node1 # TRUST_STORE_OPT=-Djavax.net.ssl.trustStore=truststore.jks # TRUST_STORE_PASS_OPT=-Djavax.net.ssl.trustStorePassword=changeit # TRUST_STORE_TYPE_OPT=-Djavax.net.ssl.trustStoreType=jks -export CATALINA_OPTS="$CONFIG_OPT $LOGGING_OPT $NODE_ID_OPT $PARAM_HASHCACHE $TRUST_STORE_OPT $TRUST_STORE_PASS_OPT $TRUST_STORE_TYPE_OPT" +export CATALINA_OPTS="$CONFIG_OPT $LOGGING_OPT $NODE_ID_OPT $TRUST_STORE_OPT $TRUST_STORE_PASS_OPT $TRUST_STORE_TYPE_OPT" echo CATALINA_OPTS=$CATALINA_OPTS diff --git a/spss/server/serverlib/resources/data/deploy/tomcat/win32/startTomcat.bat b/spss/server/serverlib/resources/data/deploy/tomcat/win32/startTomcat.bat index 729bddbf3..de36fd5c4 100644 --- a/spss/server/serverlib/resources/data/deploy/tomcat/win32/startTomcat.bat +++ b/spss/server/serverlib/resources/data/deploy/tomcat/win32/startTomcat.bat @@ -15,10 +15,7 @@ set PARAM_SPSSCONFIG=-Dmoa.spss.server.configuration=%MOA_SPSS_CFG_HOME%\spss.co set PARAM_LOGGING=-Dlog4j.configuration=file:%MOA_SPSS_CFG_HOME%\log4j.properties set PARAM_NODEID=-Dmoa.node-id=Node1 -rem Hashcache Parameter für TSL Unterstuetzung bei MOA-SP -rem set PARAM_HASHCACHE=-Diaik.xml.crypto.tsl.BinaryHashCache.DIR=%MOA_SPSS_CFG_HOME%\hashcache\ - -set PARAMS_MOA=%PARAM_SPSSCONFIG% %PARAM_LOGGING% %PARAM_NODEID% %PARAM_HASHCACHE% +set PARAMS_MOA=%PARAM_SPSSCONFIG% %PARAM_LOGGING% %PARAM_NODEID% rem set PARAM_TRUST_STORE=-Djavax.net.ssl.trustStore=truststore.jks rem set PARAM_TRUST_STORE_PASS=-Djavax.net.ssl.trustStorePassword=changeit diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/SPSSFactory.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/SPSSFactory.java index 80f996b36..b5cc96a04 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/SPSSFactory.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/SPSSFactory.java @@ -1101,6 +1101,7 @@ public abstract class SPSSFactory { * signature based on a SSDC, otherwise false. * @param sscdSourceTSL true, if the SSCD information comes from the TSL, * otherwise false. + * @param issuerCountryCode contains the signer certificate issuer country code. * @return The SignerInfo containing the above data. * * @pre signerCertSubjectName != null @@ -1114,7 +1115,8 @@ public abstract class SPSSFactory { boolean publicAuthority, String publicAuthorityID, boolean sscd, - boolean sscdSourceTSL); + boolean sscdSourceTSL, + String issuerCountryCode); /** * Create a new X509IssuerSerial object. diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/common/SignerInfo.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/common/SignerInfo.java index 337f775bf..777365ad3 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/common/SignerInfo.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/common/SignerInfo.java @@ -68,7 +68,11 @@ public interface SignerInfo { */ public String getQCSource(); - + /** + * Returns the signer certificate issuer country code + * @return + */ + public String getIssuerCountryCode(); /** * Checks, whether the certificate contained in this object is a * public authority certificate. diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SPSSFactoryImpl.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SPSSFactoryImpl.java index 74f65cb70..8e3bb7636 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SPSSFactoryImpl.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SPSSFactoryImpl.java @@ -626,7 +626,8 @@ public class SPSSFactoryImpl extends SPSSFactory { boolean publicAuthority, String publicAuthorityID, boolean sscd, - boolean sscdSourceTSL) { + boolean sscdSourceTSL, + String issuerCountryCode) { SignerInfoImpl signerInfo = new SignerInfoImpl(); signerInfo.setSignerCertificate(signerCertificate); signerInfo.setQualifiedCertificate(qualifiedCertificate); @@ -635,6 +636,7 @@ public class SPSSFactoryImpl extends SPSSFactory { signerInfo.setPublicAuhtorityID(publicAuthorityID); signerInfo.setSSCD(sscd); signerInfo.setSSCDSourceTSL(sscdSourceTSL); + signerInfo.setIssuerCountryCode(issuerCountryCode); return signerInfo; } diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SignerInfoImpl.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SignerInfoImpl.java index 5d26397c5..7a108e8a4 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SignerInfoImpl.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/impl/SignerInfoImpl.java @@ -56,6 +56,9 @@ public class SignerInfoImpl implements SignerInfo { /** Determines, if the QC check bases upon on TSL */ private boolean qcSourceTSL; + /** The certificate issuer country code */ + private String issuerCountryCode; + /** * Sets the signer certificate. * @@ -118,6 +121,13 @@ public class SignerInfoImpl implements SignerInfo { return "Certificate"; } + public void setIssuerCountryCode(String issuerCountryCode) { + this.issuerCountryCode = issuerCountryCode; + } + public String getIssuerCountryCode() { + return issuerCountryCode; + } + /** * Sets, whether the certificate contained in this object is an * e-government certificate or not. diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/ResponseBuilderUtils.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/ResponseBuilderUtils.java index 505303bc1..2e2afaf7c 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/ResponseBuilderUtils.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/ResponseBuilderUtils.java @@ -121,7 +121,8 @@ class ResponseBuilderUtils { boolean isPublicAuthority, String publicAuthorityID, boolean isSSCD, - String sscdSource) + String sscdSource, + String issuerCountryCode) throws MOAApplicationException { Element signerInfoElem = response.createElementNS(MOA_NS_URI, "SignerInfo"); @@ -147,6 +148,12 @@ class ResponseBuilderUtils { isSSCD ? response.createElementNS(MOA_NS_URI, "SecureSignatureCreationDevice") : null; + Element issuerCountryCodeElem = null; + if (issuerCountryCode != null) { + issuerCountryCodeElem = response.createElementNS(MOA_NS_URI, "IssuerCountryCode"); + issuerCountryCodeElem.setTextContent(issuerCountryCode); + } + Element publicAuthorityElem = isPublicAuthority ? response.createElementNS(MOA_NS_URI, "PublicAuthority") @@ -184,8 +191,10 @@ class ResponseBuilderUtils { x509DataElem.appendChild(x509IssuerSerialElem); x509DataElem.appendChild(x509CertificateElem); if (isQualified) { - qualifiedCertificateElem.setAttributeNS(MOA_NS_URI, "Source", qcSource); - x509DataElem.appendChild(qualifiedCertificateElem); + if (qcSource.compareToIgnoreCase("TSL") == 0) + qualifiedCertificateElem.setAttributeNS(MOA_NS_URI, "Source", qcSource); + + x509DataElem.appendChild(qualifiedCertificateElem); } if (isPublicAuthority) { x509DataElem.appendChild(publicAuthorityElem); @@ -195,9 +204,12 @@ class ResponseBuilderUtils { } } if (isSSCD) { - sscdElem.setAttributeNS(MOA_NS_URI, "Source", sscdSource); + sscdElem.setAttributeNS(MOA_NS_URI, "Source", sscdSource); x509DataElem.appendChild(sscdElem); } + if (issuerCountryCodeElem != null) + x509DataElem.appendChild(issuerCountryCodeElem); + signerInfoElem.appendChild(x509DataElem); root.appendChild(signerInfoElem); } diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/VerifyCMSSignatureResponseBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/VerifyCMSSignatureResponseBuilder.java index 238875351..b11560b28 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/VerifyCMSSignatureResponseBuilder.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/VerifyCMSSignatureResponseBuilder.java @@ -99,7 +99,6 @@ public class VerifyCMSSignatureResponseBuilder { CheckResult signatureCheck = responseElement.getSignatureCheck(); CheckResult certCheck = responseElement.getCertificateCheck(); - //TODO ResponseBuilderUtils.addSignerInfo( responseDoc, responseElem, @@ -109,7 +108,8 @@ public class VerifyCMSSignatureResponseBuilder { signerInfo.isPublicAuthority(), signerInfo.getPublicAuhtorityID(), signerInfo.isSSCD(), - signerInfo.getSSCDSource()); + signerInfo.getSSCDSource(), + signerInfo.getIssuerCountryCode()); ResponseBuilderUtils.addCodeInfoElement( responseDoc, diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/VerifyXMLSignatureResponseBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/VerifyXMLSignatureResponseBuilder.java index 8673fba1c..dd4e13ad9 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/VerifyXMLSignatureResponseBuilder.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/api/xmlbind/VerifyXMLSignatureResponseBuilder.java @@ -100,7 +100,8 @@ public class VerifyXMLSignatureResponseBuilder { response.getSignerInfo().isPublicAuthority(), response.getSignerInfo().getPublicAuhtorityID(), response.getSignerInfo().isSSCD(), - response.getSignerInfo().getSSCDSource()); + response.getSignerInfo().getSSCDSource(), + response.getSignerInfo().getIssuerCountryCode()); // add HashInputData elements responseData = response.getHashInputDatas(); diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java index d2ee75116..0908d88c9 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java @@ -1225,7 +1225,6 @@ public class ConfigurationPartsBuilder { tp.mkdir(); if (!tp.isDirectory()) { error("config.50", new Object[] { tp.getPath() }); - // TODO? } File tpid = new File(tp, id); @@ -1233,11 +1232,8 @@ public class ConfigurationPartsBuilder { tpid.mkdir(); if (!tpid.isDirectory()) { error("config.50", new Object[] { tpid.getPath() }); - // TODO? } - - //System.out.println("tps: " + tpid.getAbsolutePath()); // create profile profile = new TrustProfile(id, tpid.getAbsolutePath(), signerCertsLocStr, tslEnabled, countries); @@ -1257,10 +1253,6 @@ public class ConfigurationPartsBuilder { FileUtils.copyFile(file, new File(tpid, file.getName())); } -// System.out.println("ID: " + id); -// System.out.println("Str: " + trustAnchorsLocStr); -// System.out.println("URI: " + trustAnchorsLocURI.toString()); -// System.out.println("tslWorkingDir: " + tslWorkingDir); } else { @@ -1698,7 +1690,6 @@ public class ConfigurationPartsBuilder { map.put(x509IssuerName, interval); } - //System.out.println("Name: " + x509IssuerName + " - Interval: " + interval); } return map; diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/init/SystemInitializer.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/init/SystemInitializer.java index 3640dc23f..12d8b0126 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/init/SystemInitializer.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/init/SystemInitializer.java @@ -119,7 +119,7 @@ public class SystemInitializer { try { ConfigurationProvider config = ConfigurationProvider.getInstance(); ConfigurationData configData = new IaikConfigurator().configure(config); - + //initialize TSL module TSLConfiguration tslconfig = config.getTSLConfiguration(); @@ -131,13 +131,11 @@ public class SystemInitializer { } -// System.out.println("Hashcache 1: " + BinaryHashCache.DIR); //start TSL Update TSLUpdaterTimerTask.tslconnector_ = tslconnector; TSLUpdaterTimerTask.update(); -// System.out.println("Hashcache 2: " + BinaryHashCache.DIR); //initialize TSL Update Task initTSLUpdateTask(tslconfig); @@ -156,13 +154,13 @@ public class SystemInitializer { Logger.fatal(new LogMsg(msg.getMessage("init.00", null)), e); } catch (TrustStoreException e) { Logger.fatal(new LogMsg(msg.getMessage("init.00", null)), e); - } catch (CertificateException e) { - Logger.fatal(new LogMsg(msg.getMessage("init.00", null)), e); } catch (FileNotFoundException e) { Logger.fatal(new LogMsg(msg.getMessage("init.00", null)), e); } catch (IOException e) { Logger.fatal(new LogMsg(msg.getMessage("init.00", null)), e); - } + } catch (CertificateException e) { + Logger.fatal(new LogMsg(msg.getMessage("init.00", null)), e); + } // set IXSIL debug output IXSILInit.setPrintDebugLog( diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureVerificationInvoker.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureVerificationInvoker.java index 6aa34573e..7a4103957 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureVerificationInvoker.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/CMSSignatureVerificationInvoker.java @@ -60,6 +60,7 @@ import at.gv.egovernment.moa.spss.server.transaction.TransactionContextManager; import at.gv.egovernment.moa.spss.tsl.timer.TSLUpdaterTimerTask; import at.gv.egovernment.moa.spss.util.CertificateUtils; import at.gv.egovernment.moa.spss.util.MessageProvider; +import at.gv.egovernment.moa.spss.util.QCSSCDResult; /** * A class providing an interface to the @@ -185,6 +186,8 @@ public class CMSSignatureVerificationInvoker { } } + QCSSCDResult qcsscdresult = new QCSSCDResult(); + // build the response: for each signatory add the result to the response signatories = request.getSignatories(); if (signatories == VerifyCMSSignatureRequest.ALL_SIGNATORIES) { @@ -192,61 +195,28 @@ public class CMSSignatureVerificationInvoker { for (resultIter = results.iterator(); resultIter.hasNext();) { result = (CMSSignatureVerificationResult) resultIter.next(); - boolean sscdSourceTSL = false; - boolean qcSourceTSL = false; - - boolean checkQC = false; - boolean checkSSCD = false; - - List chain = result.getCertificateValidationResult().getCertificateChain(); - // check QC and SSCD via TSL (if enabled) - boolean checkQCFromTSL = checkQC(trustProfile.isTSLEnabled(), chain); - boolean checkSSCDFromTSL = checkSSCD(trustProfile.isTSLEnabled(), chain); - - if (!checkSSCDFromTSL) { - - boolean checkQCPPlus = CertificateUtils.checkQCPPlus((X509Certificate)chain.get(0)); - boolean checkQcEuSSCD = CertificateUtils.checkQcEuSSCD((X509Certificate)chain.get(0)); - - if (checkQCPPlus) - checkSSCD = true; - if (checkQcEuSSCD) - checkSSCD = true; - - sscdSourceTSL = false; - - System.out.println("checkSSCDFromTSL: " + checkSSCDFromTSL); - System.out.println("checkQCPPlus: " + checkQCPPlus); - System.out.println("checkQcEuSSCD: " + checkQcEuSSCD); - } - else { - checkSSCD = true; - sscdSourceTSL = true; - } - - if (!checkQCFromTSL) { - - boolean checkQCP = CertificateUtils.checkQCP((X509Certificate)chain.get(0)); - boolean checkQcEuCompliance = CertificateUtils.checkQcEuCompliance((X509Certificate)chain.get(0)); - - if (checkQCP) - checkQC = true; - if (checkQcEuCompliance) - checkQC = true; - - qcSourceTSL = false; - - System.out.println("checkQCFromTSL: " + checkQCFromTSL); - System.out.println("checkQCP: " + checkQCP); - System.out.println("checkQcEuCompliance: " + checkQcEuCompliance); - } - else { - checkQC = true; - qcSourceTSL = true; + String issuerCountryCode = null; + // QC/SSCD check + List list = result.getCertificateValidationResult().getCertificateChain(); + if (list != null) { + X509Certificate[] chain = new X509Certificate[list.size()]; + + Iterator it = list.iterator(); + int i = 0; + while(it.hasNext()) { + chain[i] = (X509Certificate)it.next(); + i++; + } + + + qcsscdresult = CertificateUtils.checkQCSSCD(chain, trustProfile.isTSLEnabled()); + + // get signer certificate issuer country code + issuerCountryCode = CertificateUtils.getIssuerCountry((X509Certificate)list.get(0)); + } - - responseBuilder.addResult(result, trustProfile, checkQC, qcSourceTSL, checkSSCD, sscdSourceTSL); + responseBuilder.addResult(result, trustProfile, qcsscdresult.isQC(), qcsscdresult.isQCSourceTSL(), qcsscdresult.isSSCD(), qcsscdresult.isSSCDSourceTSL(), issuerCountryCode); } } else { int i; @@ -257,64 +227,27 @@ public class CMSSignatureVerificationInvoker { try { result = (CMSSignatureVerificationResult) results.get(signatories[i] - 1); - boolean sscdSourceTSL = false; - boolean qcSourceTSL = false; - boolean checkQC = false; - boolean checkSSCD = false; - - List chain = result.getCertificateValidationResult().getCertificateChain(); - // check QC and SSCD via TSL (if enabled) - boolean checkQCFromTSL = checkQC(trustProfile.isTSLEnabled(), chain); - boolean checkSSCDFromTSL = checkSSCD(trustProfile.isTSLEnabled(), chain); - - if (!checkSSCDFromTSL) { - - boolean checkQCPPlus = CertificateUtils.checkQCPPlus((X509Certificate)chain.get(0)); - boolean checkQcEuSSCD = CertificateUtils.checkQcEuSSCD((X509Certificate)chain.get(0)); - - if (checkQCPPlus) - checkSSCD = true; - if (checkQcEuSSCD) - checkSSCD = true; - - sscdSourceTSL = false; - - System.out.println("checkSSCDFromTSL: " + checkSSCDFromTSL); - System.out.println("checkQCPPlus: " + checkQCPPlus); - System.out.println("checkQcEuSSCD: " + checkQcEuSSCD); - } - else { - checkSSCD = true; - sscdSourceTSL = true; - } - - if (!checkQCFromTSL) { - - boolean checkQCP = CertificateUtils.checkQCP((X509Certificate)chain.get(0)); - boolean checkQcEuCompliance = CertificateUtils.checkQcEuCompliance((X509Certificate)chain.get(0)); - - if (checkQCP) - checkQC = true; - if (checkQcEuCompliance) - checkQC = true; - - qcSourceTSL = false; - - System.out.println("checkQCFromTSL: " + checkQCFromTSL); - System.out.println("checkQCP: " + checkQCP); - System.out.println("checkQcEuCompliance: " + checkQcEuCompliance); - - } - else { - checkQC = true; - qcSourceTSL = true; + String issuerCountryCode = null; + // QC/SSCD check + List list = result.getCertificateValidationResult().getCertificateChain(); + if (list != null) { + X509Certificate[] chain = new X509Certificate[list.size()]; + + Iterator it = list.iterator(); + int j = 0; + while(it.hasNext()) { + chain[j] = (X509Certificate)it.next(); + j++; + } + + + qcsscdresult = CertificateUtils.checkQCSSCD(chain, trustProfile.isTSLEnabled()); + + issuerCountryCode = CertificateUtils.getIssuerCountry((X509Certificate)list.get(0)); } - - - - responseBuilder.addResult(result, trustProfile, checkQC, qcSourceTSL, checkSSCD, sscdSourceTSL); + responseBuilder.addResult(result, trustProfile, qcsscdresult.isQC(), qcsscdresult.isQCSourceTSL(), qcsscdresult.isSSCD(), qcsscdresult.isSSCDSourceTSL(), issuerCountryCode); } catch (IndexOutOfBoundsException e) { throw new MOAApplicationException( "2249", @@ -326,65 +259,7 @@ public class CMSSignatureVerificationInvoker { return responseBuilder.getResponse(); } - private boolean checkQC(boolean tslEnabledTrustProfile, List chainlist) { - boolean checkQCFromTSL = false; - try { - if (tslEnabledTrustProfile) { - if (chainlist != null) { - X509Certificate[] chain = new X509Certificate[chainlist.size()]; - - Iterator it = chainlist.iterator(); - int i = 0; - while(it.hasNext()) { - chain[i] = (X509Certificate)it.next(); - i++; - } - - checkQCFromTSL = TSLUpdaterTimerTask.tslconnector_.checkQC(chain); - //checkSSCDFromTSL = TSLUpdaterTimerTask.tslconnector_.checkSSCD(chain); - } - } - } - catch (TSLEngineDiedException e) { - MessageProvider msg = MessageProvider.getInstance(); - Logger.error(new LogMsg(msg.getMessage("tsl.01", null)), e); - } catch (TSLSearchException e) { - MessageProvider msg = MessageProvider.getInstance(); - Logger.error(new LogMsg(msg.getMessage("tsl.01", null)), e); - } - - return checkQCFromTSL; - } - - private boolean checkSSCD(boolean tslEnabledTrustProfile, List chainlist) { - boolean checkSSCDFromTSL = false; - try { - if (tslEnabledTrustProfile) { - if (chainlist != null) { - X509Certificate[] chain = new X509Certificate[chainlist.size()]; - - Iterator it = chainlist.iterator(); - int i = 0; - while(it.hasNext()) { - chain[i] = (X509Certificate)it.next(); - i++; - } - - checkSSCDFromTSL = TSLUpdaterTimerTask.tslconnector_.checkSSCD(chain); - } - } - } - catch (TSLEngineDiedException e) { - MessageProvider msg = MessageProvider.getInstance(); - Logger.error(new LogMsg(msg.getMessage("tsl.01", null)), e); - } catch (TSLSearchException e) { - MessageProvider msg = MessageProvider.getInstance(); - Logger.error(new LogMsg(msg.getMessage("tsl.01", null)), e); - } - - return checkSSCDFromTSL; - } - + /** * Get the signed content contained either in the request itself or given as a * reference to external data. diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyCMSSignatureResponseBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyCMSSignatureResponseBuilder.java index f44cce62a..1ea10cb4e 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyCMSSignatureResponseBuilder.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyCMSSignatureResponseBuilder.java @@ -79,7 +79,7 @@ public class VerifyCMSSignatureResponseBuilder { * otherwise false. * @throws MOAException */ - public void addResult(CMSSignatureVerificationResult result, TrustProfile trustProfile, boolean checkQC, boolean qcSourceTSL, boolean checkSSCD, boolean sscdSourceTSL) + public void addResult(CMSSignatureVerificationResult result, TrustProfile trustProfile, boolean checkQC, boolean qcSourceTSL, boolean checkSSCD, boolean sscdSourceTSL, String issuerCountryCode) throws MOAException { CertificateValidationResult certResult = @@ -104,7 +104,8 @@ public class VerifyCMSSignatureResponseBuilder { certResult.isPublicAuthorityCertificate(), certResult.getPublicAuthorityID(), checkSSCD, - sscdSourceTSL); + sscdSourceTSL, + issuerCountryCode); // add SignatureCheck element signatureCheck = factory.createCheckResult(signatureCheckCode, null); diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyXMLSignatureResponseBuilder.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyXMLSignatureResponseBuilder.java index 4fdb1eeb7..193495171 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyXMLSignatureResponseBuilder.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/VerifyXMLSignatureResponseBuilder.java @@ -142,7 +142,8 @@ public class VerifyXMLSignatureResponseBuilder { boolean qcSourceTSL, boolean checkSSCD, boolean sscdSourceTSL, - boolean isTSLEnabledTrustprofile) + boolean isTSLEnabledTrustprofile, + String issuerCountryCode) throws MOAApplicationException { CertificateValidationResult certResult = @@ -167,7 +168,8 @@ public class VerifyXMLSignatureResponseBuilder { certResult.isPublicAuthorityCertificate(), certResult.getPublicAuthorityID(), checkSSCD, - sscdSourceTSL); + sscdSourceTSL, + issuerCountryCode); // Create HashInputData Content objects referenceDataList = result.getReferenceDataList(); diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java index c3cc8bfe8..c90bc534a 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java @@ -24,10 +24,7 @@ package at.gv.egovernment.moa.spss.server.invoke; -import at.gv.egovernment.moa.spss.util.CertificateUtils; - import iaik.ixsil.exceptions.URIException; - import iaik.ixsil.util.URI; import iaik.server.modules.IAIKException; import iaik.server.modules.IAIKRuntimeException; @@ -43,8 +40,6 @@ import iaik.server.modules.xmlverify.XMLSignatureVerificationModuleFactory; import iaik.server.modules.xmlverify.XMLSignatureVerificationProfile; import iaik.server.modules.xmlverify.XMLSignatureVerificationResult; import iaik.x509.X509Certificate; -import iaik.xml.crypto.tsl.ex.TSLEngineDiedException; -import iaik.xml.crypto.tsl.ex.TSLSearchException; import java.io.File; import java.io.FileInputStream; @@ -90,8 +85,9 @@ import at.gv.egovernment.moa.spss.server.logging.IaikLog; import at.gv.egovernment.moa.spss.server.logging.TransactionId; import at.gv.egovernment.moa.spss.server.transaction.TransactionContext; import at.gv.egovernment.moa.spss.server.transaction.TransactionContextManager; -import at.gv.egovernment.moa.spss.tsl.timer.TSLUpdaterTimerTask; +import at.gv.egovernment.moa.spss.util.CertificateUtils; import at.gv.egovernment.moa.spss.util.MessageProvider; +import at.gv.egovernment.moa.spss.util.QCSSCDResult; import at.gv.egovernment.moa.util.CollectionUtils; import at.gv.egovernment.moa.util.Constants; @@ -211,12 +207,7 @@ public class XMLSignatureVerificationInvoker { requestElement); } - boolean sscdSourceTSL = false; - boolean qcSourceTSL = false; - - boolean checkQC = false; - boolean checkSSCD = false; - + QCSSCDResult qcsscdresult = new QCSSCDResult(); String tpID = profile.getCertificateValidationProfile().getTrustStoreProfile().getId(); ConfigurationProvider config = ConfigurationProvider.getInstance(); TrustProfile tp = config.getTrustProfile(tpID); @@ -242,73 +233,27 @@ public class XMLSignatureVerificationInvoker { MOAException moaException = IaikExceptionMapper.getInstance().map(e); throw moaException; } - try { - if (tp.isTSLEnabled()) { - List list = result.getCertificateValidationResult().getCertificateChain(); - if (list != null) { - X509Certificate[] chain = new X509Certificate[list.size()]; - - Iterator it = list.iterator(); - int i = 0; - while(it.hasNext()) { - chain[i] = (X509Certificate)it.next(); - i++; - } - - boolean checkQCFromTSL = TSLUpdaterTimerTask.tslconnector_.checkQC(chain); - boolean checkSSCDFromTSL = TSLUpdaterTimerTask.tslconnector_.checkSSCD(chain); - - if (!checkSSCDFromTSL) { - - boolean checkQCPPlus = CertificateUtils.checkQCPPlus(chain[0]); - boolean checkQcEuSSCD = CertificateUtils.checkQcEuSSCD(chain[0]); - - if (checkQCPPlus) - checkSSCD = true; - if (checkQcEuSSCD) - checkSSCD = true; - - sscdSourceTSL = false; - } - else { - checkSSCD = true; - sscdSourceTSL = true; - } - - if (!checkQCFromTSL) { - - boolean checkQCP = CertificateUtils.checkQCP(chain[0]); - boolean checkQcEuCompliance = CertificateUtils.checkQcEuCompliance(chain[0]); - - if (checkQCP) - checkQC = true; - if (checkQcEuCompliance) - checkQC = true; - - qcSourceTSL = false; - } - else { - checkQC = true; - qcSourceTSL = true; - } - -// System.out.println("chain[0]: " + chain[0]); -// -// System.out.println("checkQCFromTSL: " + checkQCFromTSL); -// System.out.println("checkSSCDFromTSL: " + checkSSCDFromTSL); -// System.out.println("checkQCPPlus: " + checkQCPPlus); -// System.out.println("checkQcEuSSCD: " + checkQcEuSSCD); + + + // QC/SSCD check + List list = result.getCertificateValidationResult().getCertificateChain(); + if (list != null) { + X509Certificate[] chain = new X509Certificate[list.size()]; + + Iterator it = list.iterator(); + int i = 0; + while(it.hasNext()) { + chain[i] = (X509Certificate)it.next(); + i++; } - } + + qcsscdresult = CertificateUtils.checkQCSSCD(chain, tp.isTSLEnabled()); } - catch (TSLEngineDiedException e) { - MessageProvider msg = MessageProvider.getInstance(); - Logger.error(new LogMsg(msg.getMessage("tsl.01", null)), e); - } catch (TSLSearchException e) { - MessageProvider msg = MessageProvider.getInstance(); - Logger.error(new LogMsg(msg.getMessage("tsl.01", null)), e); - } + + // get signer certificate issuer country code + String issuerCountryCode = CertificateUtils.getIssuerCountry((X509Certificate)list.get(0)); + // swap back in the request as root document if (requestElement != signatureEnvironment.getElement()) { requestElement.getOwnerDocument().replaceChild( @@ -325,14 +270,9 @@ public class XMLSignatureVerificationInvoker { TrustProfile trustProfile = context.getConfiguration().getTrustProfile(request.getTrustProfileId()); CheckResult certificateCheck = validateSignerCertificate(result, trustProfile); -// System.out.println("checkQC: " + checkQC); -// System.out.println("qcSourceTSL: " + qcSourceTSL); -// System.out.println("checkSSCD: " + checkSSCD); -// System.out.println("sscdSourceTSL: " + sscdSourceTSL); // build the response - responseBuilder.setResult(result, profile, signatureManifestCheck, certificateCheck, checkQC, qcSourceTSL, checkSSCD, sscdSourceTSL, tp.isTSLEnabled()); - + responseBuilder.setResult(result, profile, signatureManifestCheck, certificateCheck, qcsscdresult.isQC(), qcsscdresult.isQCSourceTSL(), qcsscdresult.isSSCD(), qcsscdresult.isSSCDSourceTSL(), tp.isTSLEnabled(), issuerCountryCode); return responseBuilder.getResponse(); } diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/connector/TSLConnector.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/connector/TSLConnector.java index 49f715cb8..07da0a998 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/connector/TSLConnector.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/connector/TSLConnector.java @@ -83,6 +83,15 @@ public class TSLConnector implements TSLConnectorInterface { return updateAndGetQualifiedCACertificates(dateTime, null, serviceLevelStatus); } + public void updateTSLs(Date dateTime, + String[] serviceLevelStatus) throws TSLEngineDiedException, TSLSearchException { + + if (Configurator.is_isInitialised() == false) + new TSLEngineFatalException("The TSL Engine is not initialized!"); + + updateTSLs(dateTime, null, serviceLevelStatus); + } + public ArrayList updateAndGetQualifiedCACertificates(Date dateTime, String[] countries, String[] serviceLevelStatus) throws TSLEngineDiedException, TSLSearchException { @@ -326,6 +335,249 @@ public class TSLConnector implements TSLConnectorInterface { return getQualifiedCACertificates(dateTime, countries, serviceLevelStatus); } + public void updateTSLs(Date dateTime, + String[] countries, String[] serviceLevelStatus) throws TSLEngineDiedException, TSLSearchException { + + if (Configurator.is_isInitialised() == false) + new TSLEngineFatalException("The TSL Engine is not initialized!"); + + String tsldownloaddir = Configurator.get_TSLWorkingDirectoryPath() + "TslDownload"; + +// String hashcachedir = System.getProperty("iaik.xml.crypto.tsl.BinaryHashCache.DIR"); +// System.out.println("hashcachedir: " + hashcachedir); +// if (hashcachedir==null) +// hashcachedir = DEFAULT_HASHCACHE_DIR; + +// File hashcachefile = new File(hashcachedir); +// File[] filelist = hashcachefile.listFiles(); +// if (filelist != null) { +// for (File f : filelist) +// f.delete(); +// } + + File tsldownloadfile = new File(tsldownloaddir); + if (!tsldownloadfile.exists()) { + tsldownloadfile.mkdir(); + } + File[] tslfilelist = tsldownloadfile.listFiles(); + if (tslfilelist != null) { + for (File f : tslfilelist) + f.delete(); + } + + //create sqlLite database + File dbFile = new File(Configurator.get_TempdbFile()); + try { + dbFile.delete(); + dbFile.createNewFile(); + } catch (IOException e) { + throw new TSLEngineDiedException("Could not create temporary data base file", e); + } + + //the TSL library uses the iaik.util.logging environment. + //iaik.util.logging.Log.setLogLevel(iaik.util.logging.LogLevels.WARN); + iaik.util.logging.Log.setLogLevel(iaik.util.logging.LogLevels.OFF); + + log.info("Starting EU TSL import."); + + // Certificates in Germany, Estonia, Greece, Cyprus, + // Lithuainia, Hungary, Poland, Finland, Norway use SURNAME + log.debug("### SURNAME registered as " + ObjectID.surName + " ###"); + RFC2253NameParser.register("SURNAME", ObjectID.surName); + + XSecProvider.addAsProvider(false); + + TSLEngine tslEngine; + TslSqlConnectionWrapper connection = null; + + try { + // register the Https JSSE Wrapper + TLS.register(); + log.trace("### Https JSSE Wrapper registered ###"); + + + log.debug("### Connect to Database.###"); + connection = DbTables.connectToDatabaBase(dbFile, MODE.AUTO_COMMIT_ON); + + log.trace("### Connected ###"); + + // empty the database and recreate the tables + tslEngine = new TSLEngine(dbFile, Configurator.get_TSLWorkingDirectoryPath(), + connection, true, true); + + } catch (TSLEngineFatalException e1) { + throw new TSLEngineDiedException(e1); + + } + + // H.2.2.1 Same-scheme searching + // H.2.2.2 Known scheme searching + // H.2.2.3 "Blind" (unknown) scheme searching + Number tId = null; + Countries euTerritory = Countries.EU; + TSLImportContext topLevelTslContext = new TSLEUImportFromFileContext( + euTerritory, Configurator.get_euTSLURL(), Configurator.get_TSLWorkingDirectoryPath(), + Configurator.is_sqlMultithreaded(), + Configurator.is_throwExceptions(), Configurator.is_logExceptions(), + Configurator.is_throwWarnings(), Configurator.is_logWarnings(), + Configurator.is_nullRedundancies()); + + TSLEngineEU tslengineEU; + try { + tslengineEU = tslEngine.new TSLEngineEU(); + + } catch (TSLEngineFatalException e1) { + throw new TSLEngineDiedException(e1); + } + + // establish EU TSL trust anchor + ListIterator expectedEuTslSignerCerts = + tslEngine.loadCertificatesFromResource( + Configurator.get_euTrustAnchorsPath(), topLevelTslContext); + + log.debug("Process EU TSL"); + // process the EU TSL to receive the pointers to the other TSLs + // and the trust anchors for the TSL signers + Set> pointersToMsTSLs = null; + + try { + + tId = tslengineEU.processEUTSL(topLevelTslContext, expectedEuTslSignerCerts); + log.info("Process EU TSL finished"); + + log.debug(Thread.currentThread() + " waiting for other threads ..."); + + topLevelTslContext.waitForAllOtherThreads(); + log.debug(Thread.currentThread() + + " reactivated after other threads finished ..."); + + + // get the TSLs pointed from the EU TSL + LinkedHashMap tslMap = tslengineEU + .getOtherTslMap(tId, topLevelTslContext); + + pointersToMsTSLs = tslMap.entrySet(); + + //set Errors and Warrnings + + } catch (TSLEngineFatalRuntimeException e) { + throw new TSLEngineDiedException(topLevelTslContext.dumpFatals()); + + } catch (TSLTransactionFailedRuntimeException e) { + throw new TSLEngineDiedException(topLevelTslContext.dumpTransactionFaliures()); + } + + //Backup implementation if the EU TSL includes a false signer certificate + // establish additional trust anchors for member states +// Countries[] countriesWithPotentiallyWrongCertsOnEuTsl = { +// Countries.CZ, +// Countries.LU, +// Countries.ES, +// Countries.AT, +// }; + Countries[] countriesWithPotentiallyWrongCertsOnEuTsl = {}; + + Map> + trustAnchorsWrongOnEuTsl = loadCertificatesFromResource( + Configurator.get_msTrustAnchorsPath(), tslEngine, topLevelTslContext, + countriesWithPotentiallyWrongCertsOnEuTsl); + + log.info("Starting EU member TSL import."); + + for (Entry entry : pointersToMsTSLs) { + + TSLImportContext msTslContext; + + Countries expectedTerritory = entry.getValue().getSchemeTerritory(); + try { + +// if (expectedTerritory.equals("RO")) +// System.out.println("Stop"); + + Number otpId = entry.getKey(); + LocationAndCertHash lac = entry.getValue(); + + URL uriReference = null; + try { + uriReference = new URL(lac.getUrl()); + + } catch (MalformedURLException e) { + log.warn("Could not process: " + uriReference, e); + continue; + } + + String baseURI = uriReference == null ? "" : "" + uriReference; + + msTslContext = new TSLImportFromFileContext( + expectedTerritory, uriReference, otpId, Configurator.get_TSLWorkingDirectoryPath(), + Configurator.is_sqlMultithreaded(), + Configurator.is_throwExceptions(), Configurator.is_logExceptions(), + Configurator.is_throwWarnings(), Configurator.is_logWarnings(), + Configurator.is_nullRedundancies(), baseURI, trustAnchorsWrongOnEuTsl, + topLevelTslContext); + + ListIterator expectedTslSignerCerts = null; + expectedTslSignerCerts = tslEngine.getCertificates(lac, msTslContext); + + if (expectedTslSignerCerts == null) { + + // no signer certificate on the EU TSL + // ignore this msTSL and log a warning + log.warn("NO signer certificate found on EU TSL! " + + lac.getSchemeTerritory() + "TSL ignored."); + + } + else { + tslEngine.processMSTSL(topLevelTslContext, msTslContext, expectedTslSignerCerts); + } + + } catch (TSLExceptionB e) { + log.warn("Failed to process TSL. " + entry.getValue().getSchemeTerritory() + + " TSL ignored."); + log.debug("Failed to process TSL. " + entry, e); + continue; + } catch (TSLRuntimeException e) { + log.warn("Failed to process TSL. " + entry.getValue().getSchemeTerritory() + + " TSL ignored."); + log.debug("Failed to process TSL. " + entry, e); + continue; + } + } + + log.debug(Thread.currentThread() + " waiting for other threads ..."); + topLevelTslContext.waitForAllOtherThreads(); + + log.debug(_.dumpAllThreads()); + log.debug(Thread.currentThread() + " reactivated after other threads finished ..."); + + connection = null; + try { + connection = DbTables.connectToDatabaBase(dbFile, MODE.AUTO_COMMIT_ON); + tslEngine.recreateTablesInvalidatedByImport(connection); + + + //TODO: implement database copy operation! + File working_database = new File(Configurator.get_dbFile()); + working_database.delete(); + copy(dbFile, working_database); + + + } catch (TSLEngineFatalException e) { + throw new TSLEngineDiedException(e); + + } finally { + try { + connection.closeConnection(); + + } catch (TSLEngineFatalException e) { + throw new TSLEngineDiedException(e); + + } + } + + //return getQualifiedCACertificates(dateTime, countries, serviceLevelStatus); + } + public ArrayList getQualifiedCACertificates(Date dateTime, String[] serviceLevelStatus) throws TSLEngineDiedException, TSLSearchException { diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/timer/TSLUpdaterTimerTask.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/timer/TSLUpdaterTimerTask.java index 76be8217a..0cb18a08e 100644 --- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/timer/TSLUpdaterTimerTask.java +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/timer/TSLUpdaterTimerTask.java @@ -33,13 +33,14 @@ import at.gv.egovernment.moa.spss.server.iaik.pki.store.truststore.TrustStorePro import at.gv.egovernment.moa.spss.server.logging.TransactionId; import at.gv.egovernment.moa.spss.tsl.connector.TSLConnector; import at.gv.egovernment.moa.spss.util.MessageProvider; -import at.gv.egovernment.moa.util.FileUtils; import at.gv.egovernment.moa.util.StringUtils; public class TSLUpdaterTimerTask extends TimerTask { public static TSLConnector tslconnector_; + + public static ConfigurationData configData_ = null; @Override public void run() { @@ -49,10 +50,6 @@ public class TSLUpdaterTimerTask extends TimerTask { } catch (TSLEngineDiedException e) { MessageProvider msg = MessageProvider.getInstance(); Logger.error(new LogMsg(msg.getMessage("tsl.00", null)), e); - - // TODO wenn update nicht erfolgreich, dann soll TSL-Trustprofil nicht zur - // Verfügung stehen? - } catch (TSLSearchException e) { MessageProvider msg = MessageProvider.getInstance(); Logger.error(new LogMsg(msg.getMessage("tsl.00", null)), e); @@ -68,105 +65,138 @@ public class TSLUpdaterTimerTask extends TimerTask { } catch (TrustStoreException e) { MessageProvider msg = MessageProvider.getInstance(); Logger.error(new LogMsg(msg.getMessage("tsl.00", null)), e); - } catch (CertificateException e) { + } catch (FileNotFoundException e) { MessageProvider msg = MessageProvider.getInstance(); Logger.error(new LogMsg(msg.getMessage("tsl.00", null)), e); - } catch (FileNotFoundException e) { + } catch (IOException e) { MessageProvider msg = MessageProvider.getInstance(); Logger.error(new LogMsg(msg.getMessage("tsl.00", null)), e); - } catch (IOException e) { + } catch (CertificateException e) { MessageProvider msg = MessageProvider.getInstance(); Logger.error(new LogMsg(msg.getMessage("tsl.00", null)), e); } } - public static void update() throws TSLEngineDiedException, TSLSearchException, ConfigurationException, MOAApplicationException, CertStoreException, TrustStoreException, CertificateException, FileNotFoundException, IOException { + public static void update() throws TSLEngineDiedException, TSLSearchException, ConfigurationException, MOAApplicationException, CertStoreException, TrustStoreException, CertificateException, IOException { MessageProvider msg = MessageProvider.getInstance(); - //get TSl configuration - ConfigurationProvider config = ConfigurationProvider.getInstance(); - ConfigurationData configData = new IaikConfigurator().configure(config); - TSLConfiguration tslconfig = config.getTSLConfiguration(); - if (tslconfig != null) { - - Logger.info(new LogMsg(msg.getMessage("config.42", null))); + //TrustProfile tp = null; + TrustStoreProfile tsp = null; + StoreUpdater storeUpdater = null; + TransactionId tid = null; + + //get TSl configuration + ConfigurationProvider config = ConfigurationProvider.getInstance(); + if (configData_ == null) + configData_ = new IaikConfigurator().configure(config); - // get certstore parameters - CertStoreParameters[] certStoreParameters = configData.getPKIConfiguration().getCertStoreConfiguration().getParameters(); + TSLConfiguration tslconfig = config.getTSLConfiguration(); + if (tslconfig != null) { - // iterate over all truststores - Map mapTrustProfiles = config.getTrustProfiles(); - Iterator it = mapTrustProfiles.entrySet().iterator(); - while (it.hasNext()) { - Map.Entry pairs = (Map.Entry)it.next(); - TrustProfile tp = (TrustProfile) pairs.getValue(); - if (tp.isTSLEnabled()) { - TrustStoreProfile tsp = new TrustStoreProfileImpl(config, tp.getId()); - TrustStoreProfile[] trustStoreProfiles = new TrustStoreProfile[1]; - trustStoreProfiles[0] = tsp; - - Logger.debug(new LogMsg(msg.getMessage("config.43", new String[]{tp.getId()}))); - - TransactionId tid = new TransactionId("TSLConfigurator-" + tp.getId()); - ArrayList tsl_certs = null; - if (StringUtils.isEmpty(tp.getCountries())) { - Logger.debug(new LogMsg(msg.getMessage("config.44", null))); - - // get certificates from TSL from all countries - tsl_certs = tslconnector_.updateAndGetQualifiedCACertificates(new Date(), new String[]{"accredited","undersupervision"}); - } - else { - Logger.debug(new LogMsg(msg.getMessage("config.44", null))); - // get selected countries as array - String countries = tp.getCountries(); - String[] array = countries.split(","); - for (int i = 0; i < array.length; i++) - array[i] = array[i].trim(); - - // get certificates from TSL from given countries - tsl_certs = tslconnector_.updateAndGetQualifiedCACertificates(new Date(), array, new String[]{"accredited","undersupervision"}); - } - - // create store updater for each TSL enabled truststore - Logger.debug(new LogMsg(msg.getMessage("config.45", null))); - StoreUpdater storeUpdater = new StoreUpdater(certStoreParameters, trustStoreProfiles, tid); - - - // delete files in trustprofile - File ftp = new File(tp.getUri()); - File[] files = ftp.listFiles(); - for (File file : files) - file.delete(); + tslconnector_.updateTSLs(new Date(), new String[]{"accredited","undersupervision"}); + + Logger.info(new LogMsg(msg.getMessage("config.42", null))); + + // get certstore parameters + CertStoreParameters[] certStoreParameters = configData_.getPKIConfiguration().getCertStoreConfiguration().getParameters(); - // convert ArrayList to X509Certificate[] - X509Certificate[] addCertificates = new X509Certificate[tsl_certs.size()]; - Iterator itcert = tsl_certs.iterator(); - int i = 0; - while(itcert.hasNext()) { - File f = (File)itcert.next(); - X509Certificate cert = new X509Certificate(new FileInputStream(f)); - addCertificates[i] = cert; + // iterate over all truststores + Map mapTrustProfiles = config.getTrustProfiles(); + Iterator it = mapTrustProfiles.entrySet().iterator(); + while (it.hasNext()) { + Map.Entry pairs = (Map.Entry)it.next(); + TrustProfile tp = (TrustProfile) pairs.getValue(); + if (tp.isTSLEnabled()) { + tsp = new TrustStoreProfileImpl(config, tp.getId()); + TrustStoreProfile[] trustStoreProfiles = new TrustStoreProfile[1]; + trustStoreProfiles[0] = tsp; + + Logger.debug(new LogMsg(msg.getMessage("config.43", new String[]{tp.getId()}))); + + tid = new TransactionId("TSLConfigurator-" + tp.getId()); + ArrayList tsl_certs = null; + if (StringUtils.isEmpty(tp.getCountries())) { + Logger.debug(new LogMsg(msg.getMessage("config.44", null))); + + // get certificates from TSL from all countries + tsl_certs = tslconnector_.getQualifiedCACertificates(new Date(), new String[]{"accredited","undersupervision"}); + } + else { + Logger.debug(new LogMsg(msg.getMessage("config.44", null))); + // get selected countries as array + String countries = tp.getCountries(); + String[] array = countries.split(","); + for (int i = 0; i < array.length; i++) + array[i] = array[i].trim(); + + // get certificates from TSL from given countries + tsl_certs = tslconnector_.getQualifiedCACertificates(new Date(), array, new String[]{"accredited","undersupervision"}); + } + + // create store updater for each TSL enabled truststore + Logger.debug(new LogMsg(msg.getMessage("config.45", null))); + storeUpdater = new StoreUpdater(certStoreParameters, trustStoreProfiles, tid); + + // delete files in trustprofile + + File ftp = new File(tp.getUri()); + File[] files = ftp.listFiles(); + X509Certificate[] removeCertificates = new X509Certificate[files.length]; + int i = 0; + for (File file : files) { + FileInputStream fis = new FileInputStream(file); + removeCertificates[i] = new X509Certificate(fis); + i++; + fis.close(); + //file.delete(); + } + + // remove all certificates + storeUpdater.removeCertificatesFromTrustStores(removeCertificates, tid); + storeUpdater.removeCertificatesFromCertStores(removeCertificates, tid); + - i++; + // copy files from original trustAnchorsLocURI into tslworking trust profile + File src = new File(tp.getUriOrig()); + files = src.listFiles(); + X509Certificate[] addCertificates = new X509Certificate[files.length]; + i = 0; + for (File file : files) { + FileInputStream fis = new FileInputStream(file); + addCertificates[i] = new X509Certificate(fis); + //FileUtils.copyFile(file, new File(tp.getUri(), file.getName())); + i++; + fis.close(); + } + + // convert ArrayList to X509Certificate[] + X509Certificate[] addCertificatesTSL = new X509Certificate[tsl_certs.size()]; + Iterator itcert = tsl_certs.iterator(); + i = 0; + File f = null; + while(itcert.hasNext()) { + f = (File)itcert.next(); + FileInputStream fis = new FileInputStream(f); + X509Certificate cert = new X509Certificate(fis); + addCertificatesTSL[i] = cert; + + i++; + fis.close(); + } + + Logger.debug(new LogMsg("Add " + addCertificatesTSL.length + " certificates.")); + storeUpdater.addCertificatesToTrustStores(addCertificatesTSL, tid); + storeUpdater.addCertificatesToCertStores(addCertificatesTSL, tid); + + Logger.debug(new LogMsg("Add " + addCertificates.length + " certificates.")); + storeUpdater.addCertificatesToTrustStores(addCertificates, tid); + storeUpdater.addCertificatesToCertStores(addCertificates, tid); + + } - - - // copy files from original trustAnchorsLocURI into tslworking trust profile - File src = new File(tp.getUriOrig()); - files = src.listFiles(); - for (File file : files) { - FileUtils.copyFile(file, new File(tp.getUri(), file.getName())); - } - - Logger.debug(new LogMsg("Add " + addCertificates.length + " certificates.")); - storeUpdater.addCertificatesToTrustStores(addCertificates, tid); - storeUpdater.addCertificatesToCertStores(addCertificates, tid); - - } } - } diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/util/CertificateUtils.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/util/CertificateUtils.java new file mode 100644 index 000000000..544ea916c --- /dev/null +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/util/CertificateUtils.java @@ -0,0 +1,286 @@ +package at.gv.egovernment.moa.spss.util; + +import iaik.asn1.ObjectID; +import iaik.asn1.structures.Name; +import iaik.asn1.structures.PolicyInformation; +import iaik.utils.RFC2253NameParser; +import iaik.utils.RFC2253NameParserException; +import iaik.x509.X509Certificate; +import iaik.x509.X509ExtensionInitException; +import iaik.x509.extensions.CertificatePolicies; +import iaik.x509.extensions.qualified.QCStatements; +import iaik.x509.extensions.qualified.structures.QCStatement; +import iaik.x509.extensions.qualified.structures.etsi.QcEuCompliance; +import iaik.x509.extensions.qualified.structures.etsi.QcEuSSCD; +import iaik.xml.crypto.tsl.ex.TSLEngineDiedException; +import iaik.xml.crypto.tsl.ex.TSLSearchException; + +import java.security.Principal; + +import at.gv.egovernment.moa.logging.LogMsg; +import at.gv.egovernment.moa.logging.Logger; +import at.gv.egovernment.moa.spss.tsl.timer.TSLUpdaterTimerTask; + +public class CertificateUtils { + + + /** + * Verifies if the given certificate contains QCP+ statement + * @param cert X509Certificate + * @return true if the given certificate contains QCP+ statement, else false + */ + private static boolean checkQCPPlus(X509Certificate cert) { + Logger.debug("Checking QCP+ extension"); + String OID_QCPPlus = "0.4.0.1456.1.1"; + try { + CertificatePolicies certPol = (CertificatePolicies) cert.getExtension(CertificatePolicies.oid); + if (certPol == null) { + Logger.debug("No CertificatePolicies extension found"); + return false; + } + + PolicyInformation[] polInfo = certPol.getPolicyInformation(); + if (polInfo == null) { + Logger.debug("No policy information found"); + return false; + } + + for (int i = 0; i < polInfo.length; i++) { + ObjectID oid = polInfo[i].getPolicyIdentifier(); + String oidStr = oid.getID(); + if (oidStr.compareToIgnoreCase(OID_QCPPlus) == 0) { + Logger.debug("QCP+ extension found"); + return true; + } + } + + Logger.debug("No QCP+ extension found"); + + return false; + } catch (X509ExtensionInitException e) { + Logger.debug("No QCP+ extension found"); + + return false; + } + + } + + /** + * Verifies if the given certificate contains QCP statement + * @param cert X509Certificate + * @return true if the given certificate contains QCP statement, else false + */ + private static boolean checkQCP(X509Certificate cert) { + Logger.debug("Checking QCP extension"); + String OID_QCP = "0.4.0.1456.1.2"; + try { + CertificatePolicies certPol = (CertificatePolicies) cert.getExtension(CertificatePolicies.oid); + if (certPol == null) { + Logger.debug("No CertificatePolicies extension found"); + return false; + } + + PolicyInformation[] polInfo = certPol.getPolicyInformation(); + if (polInfo == null) { + Logger.debug("No policy information found"); + return false; + } + + for (int i = 0; i < polInfo.length; i++) { + ObjectID oid = polInfo[i].getPolicyIdentifier(); + String oidStr = oid.getID(); + if (oidStr.compareToIgnoreCase(OID_QCP) == 0) { + Logger.debug("QCP extension found"); + return true; + } + + } + + Logger.debug("No QCP extension found"); + return false; + + } catch (X509ExtensionInitException e) { + Logger.debug("No QCP extension found"); + return false; + } + + } + + /** + * Verifies if the given certificate contains QcEuCompliance statement + * @param cert X509Certificate + * @return true if the given certificate contains QcEuCompliance statement, else false + */ + private static boolean checkQcEuCompliance(X509Certificate cert) { + Logger.debug("Checking QcEUCompliance extension"); + try { + QCStatements qcStatements = (QCStatements) cert.getExtension(QCStatements.oid); + + if (qcStatements == null) { + Logger.debug("No QcStatements extension found"); + return false; + } + + QCStatement qcEuCompliance = qcStatements.getQCStatements(QcEuCompliance.statementID); + + if (qcEuCompliance != null) { + Logger.debug("QcEuCompliance extension found"); + return true; + } + + Logger.debug("No QcEuCompliance extension found"); + return false; + + } catch (X509ExtensionInitException e) { + Logger.debug("No QcEuCompliance extension found"); + return false; + } + + } + + /** + * Verifies if the given certificate contains QcEuSSCD statement + * @param cert X509Certificate + * @return true if the given certificate contains QcEuSSCD statement, else false + */ + private static boolean checkQcEuSSCD(X509Certificate cert) { + Logger.debug("Checking QcEuSSCD extension"); + try { + QCStatements qcStatements = (QCStatements) cert.getExtension(QCStatements.oid); + if (qcStatements == null) { + Logger.debug("No QcStatements extension found"); + return false; + } + + QCStatement qcEuSSCD = qcStatements.getQCStatements(QcEuSSCD.statementID); + + if (qcEuSSCD != null) { + Logger.debug("QcEuSSCD extension found"); + return true; + } + + Logger.debug("No QcEuSSCD extension found"); + return false; + + } catch (X509ExtensionInitException e) { + Logger.debug("No QcEuSSCD extension found"); + return false; + } + + } + + public static QCSSCDResult checkQCSSCD(X509Certificate[] chain, boolean isTSLenabledTrustprofile) { + + boolean qc = false; + boolean qcSourceTSL = false; + boolean sscd = false; + boolean sscdSourceTSL = false; + + try { + + if (isTSLenabledTrustprofile) { + // perform QC check via TSL + boolean checkQCFromTSL = TSLUpdaterTimerTask.tslconnector_.checkQC(chain); + if (!checkQCFromTSL) { + // if QC check via TSL returns false + // try certificate extensions QCP and QcEuCompliance + Logger.debug("QC check via TSL returned false - checking certificate extensions"); + boolean checkQCP = CertificateUtils.checkQCP(chain[0]); + boolean checkQcEuCompliance = CertificateUtils.checkQcEuCompliance(chain[0]); + + if (checkQCP || checkQcEuCompliance) { + Logger.debug("Certificate is QC (Source: Certificate)"); + qc = true; + } + + qcSourceTSL = false; + } + else { + // use TSL result + Logger.debug("Certificate is QC (Source: TSL)"); + qc = true; + qcSourceTSL = true; + } + + // perform SSCD check via TSL + boolean checkSSCDFromTSL = TSLUpdaterTimerTask.tslconnector_.checkSSCD(chain); + if (!checkSSCDFromTSL) { + // if SSCD check via TSL returns false + // try certificate extensions QCP+ and QcEuSSCD + Logger.debug("SSCD check via TSL returned false - checking certificate extensions"); + boolean checkQCPPlus = CertificateUtils.checkQCPPlus(chain[0]); + boolean checkQcEuSSCD = CertificateUtils.checkQcEuSSCD(chain[0]); + + if (checkQCPPlus || checkQcEuSSCD) { + Logger.debug("Certificate is SSCD (Source: Certificate)"); + sscd = true; + } + + sscdSourceTSL = false; + } + else { + // use TSL result + Logger.debug("Certificate is SSCD (Source: TSL)"); + sscd = true; + sscdSourceTSL = true; + } + + } + else { + // Trustprofile is not TSL enabled - use certificate extensions only + + // perform QC check + // try certificate extensions QCP and QcEuCompliance + boolean checkQCP = CertificateUtils.checkQCP(chain[0]); + boolean checkQcEuCompliance = CertificateUtils.checkQcEuCompliance(chain[0]); + + if (checkQCP || checkQcEuCompliance) + qc = true; + + qcSourceTSL = false; + + // perform SSCD check + // try certificate extensions QCP+ and QcEuSSCD + boolean checkQCPPlus = CertificateUtils.checkQCPPlus(chain[0]); + boolean checkQcEuSSCD = CertificateUtils.checkQcEuSSCD(chain[0]); + + if (checkQCPPlus || checkQcEuSSCD) + sscd = true; + + sscdSourceTSL = false; + } + } + catch (TSLEngineDiedException e) { + MessageProvider msg = MessageProvider.getInstance(); + Logger.error(new LogMsg(msg.getMessage("tsl.01", null)), e); + } catch (TSLSearchException e) { + MessageProvider msg = MessageProvider.getInstance(); + Logger.error(new LogMsg(msg.getMessage("tsl.01", null)), e); + } + + QCSSCDResult result = new QCSSCDResult(qc, qcSourceTSL, sscd, sscdSourceTSL); + + return result; + } + + /** + * Gets the country from the certificate issuer + * @param cert X509 certificate + * @return Country code from the certificate issuer + */ + public static String getIssuerCountry(X509Certificate cert) { + String country = null; + Principal issuerdn = cert.getIssuerX500Principal(); + RFC2253NameParser nameParser = new RFC2253NameParser(issuerdn.getName()); + + try { + Name name = nameParser.parse(); + country = name.getRDN(ObjectID.country); + } catch (RFC2253NameParserException e) { + Logger.warn("Could not get country code from issuer."); + } + + + return country; + } +} diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/util/QCSSCDResult.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/util/QCSSCDResult.java new file mode 100644 index 000000000..99af84308 --- /dev/null +++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/util/QCSSCDResult.java @@ -0,0 +1,37 @@ +package at.gv.egovernment.moa.spss.util; + +public class QCSSCDResult { + + private boolean qc; + private boolean qcSourceTSL; + + private boolean sscd; + private boolean sscdSourceTSL; + + public QCSSCDResult() { + this.qc = false; + this.qcSourceTSL = false; + this.sscd = false; + this.sscdSourceTSL = false; + } + + public QCSSCDResult(boolean qc, boolean qcSourceTSL, boolean sscd, boolean sscdSourceTSL) { + this.qc = qc; + this.qcSourceTSL = qcSourceTSL; + this.sscd = sscd; + this.sscdSourceTSL = sscdSourceTSL; + } + + public boolean isQC() { + return this.qc; + } + public boolean isQCSourceTSL() { + return this.qcSourceTSL; + } + public boolean isSSCD() { + return this.sscd; + } + public boolean isSSCDSourceTSL() { + return this.sscdSourceTSL; + } +} diff --git a/spss/server/serverws/pom.xml b/spss/server/serverws/pom.xml index 101b16882..4372c76d0 100644 --- a/spss/server/serverws/pom.xml +++ b/spss/server/serverws/pom.xml @@ -38,7 +38,8 @@ ${basedir}/resources/wsdl resources/schemas - *.xsd + *.xsd + *.wsdl diff --git a/spss/server/serverws/resources/wsdl/MOA-SPSS-1.5.2.wsdl b/spss/server/serverws/resources/wsdl/MOA-SPSS-1.5.2.wsdl deleted file mode 100644 index 135f26f68..000000000 --- a/spss/server/serverws/resources/wsdl/MOA-SPSS-1.5.2.wsdl +++ /dev/null @@ -1,128 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/spss/server/serverws/resources/wsdl/MOA-SPSS-1.5.2.xsd b/spss/server/serverws/resources/wsdl/MOA-SPSS-1.5.2.xsd deleted file mode 100644 index 06232f189..000000000 --- a/spss/server/serverws/resources/wsdl/MOA-SPSS-1.5.2.xsd +++ /dev/null @@ -1,551 +0,0 @@ - - - - - - - - - - - - - - - - - - - - Ermöglichung der Stapelsignatur durch wiederholte Angabe dieses Elements - - - - - - - - - - - - - - - - - - - - - - Kardinalität 1..oo erlaubt die Antwort auf eine Stapelsignatur-Anfrage - - - - Resultat, falls die Signaturerstellung erfolgreich war - - - - - - - - - - - - - - - - - - - - Ermöglichung der Stapelsignatur durch wiederholte Angabe dieses Elements - - - - - - - - - - - - - - - - - - - Auswahl: Entweder explizite Angabe des Signaturorts sowie ggf. sinnvoller Supplements im Zshg. mit der Signaturumgebung, oder Verweis auf ein benanntes Profil - - - - - - - - - - - - - - - - - - Kardinalität 1..oo erlaubt die Antwort auf eine Stapelsignatur-Anfrage - - - - Resultat, falls die Signaturerstellung erfolgreich war - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - mit diesem Profil wird eine Menge von vertrauenswürdigen Wurzelzertifikaten spezifiziert - - - - - - - - - - - only ds:X509Data and RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any;publicAuthority is included as X509Data/any - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Pro dsig:Reference-Element in der zu überprüfenden XML-Signatur muss hier ein ReferenceInfo-Element erscheinen. Die Reihenfolge der einzelnen ReferenceInfo Elemente entspricht jener der dsig:Reference Elemente in der XML-Signatur. - - - - - - - - - - mit diesem Profil wird eine Menge von vertrauenswürdigen Wurzelzertifikaten spezifiziert - - - - - - - - - - - only ds:X509Data and ds:RetrievalMethod is supported; QualifiedCertificate is included as X509Data/any; PublicAuthority is included as X509Data/any - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Auswahl: Entweder explizite Angabe EINER Transformationskette inklusive ggf. sinnvoller Supplements oder Verweis auf ein benanntes Profil - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Resultat, falls die Signaturerstellung gescheitert ist - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Ein oder mehrere Transformationswege können von der Applikation an MOA mitgeteilt werden. Die zu prüfende Signatur hat zumindest einem dieser Transformationswege zu entsprechen. Die Angabe kann explizit oder als Profilbezeichner erfolgen. - - - - - Profilbezeichner für einen Transformationsweg - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Die Angabe des Transformationsparameters (explizit oder als Hashwert) kann unterlassen werden, wenn die Applikation von der Unveränderlichkeit des Inhalts der in "Transformationsparamter", Attribut "URI" angegebenen URI ausgehen kann. - - - - Der Transformationsparameter explizit angegeben. - - - - - Der Hashwert des Transformationsparameters. - - - - - - - - - - - - - - - - - - - - - - Explizite Angabe des Transformationswegs - - - - - - - Alle impliziten Transformationsparameter, die zum Durchlaufen der oben angeführten Transformationskette bekannt sein müssen, müssen hier angeführt werden. Das Attribut "URI" bezeichnet den Transformationsparameter in exakt jener Weise, wie er in der zu überprüfenden Signatur gebraucht wird. - - - - - - - - - - - - - - - - diff --git a/spss/server/serverws/src/main/webapp/WEB-INF/server-config.wsdd b/spss/server/serverws/src/main/webapp/WEB-INF/server-config.wsdd index eaa50865d..86d37c8bc 100644 --- a/spss/server/serverws/src/main/webapp/WEB-INF/server-config.wsdd +++ b/spss/server/serverws/src/main/webapp/WEB-INF/server-config.wsdd @@ -1,6 +1,6 @@ http://reference.e-government.gv.at/namespace/moa/20020822# - - C:\eclipse_workspaces\MOA_Git01\moa-idspss\spss\server\serverws\resources\wsdl\MOA-SPSS-1.5.2.wsdl + webapps/moa-spss/resources/schemas/MOA-SPSS-1.5.2.wsdl - @@ -32,7 +30,7 @@ http://reference.e-government.gv.at/namespace/moa/20020822# - /resources/wsdl/MOA-SPSS-1.5.2.wsdl + webapps/moa-spss/resources/schemas/MOA-SPSS-1.5.2.wsdl -- cgit v1.2.3