[#433] update BKU Web Start CertStore

WebStart configuration refactored

git-svn-id: https://joinup.ec.europa.eu/svn/mocca/trunk@423 8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4

28 files changed, 1770 insertions, 671 deletions

diff --git a/BKUWebStart/pom.xml b/BKUWebStart/pom.xml
index 9ef1914f..a8e33a58 100644
--- a/BKUWebStart/pom.xml
+++ b/BKUWebStart/pom.xml
@@ -14,54 +14,24 @@
    | IMPORTANT: update jnlp/resources/version.xml (BKUWebStart and utils) and
    | include-webstart profile in BKUOnline if version changes
    |-->
-  <version>1.0.5-SNAPSHOT</version>
+  <version>1.0.9-SNAPSHOT</version>
   <url>http://mocca.egovlabs.gv.at/</url>
-  <description>Bürgerkartenumgebung (MOCCA Web Start)</description>
-
+  <description>Bürgerkartenumgebung</description>
+  
   <build>
-
     <plugins>
 
-      <!--plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-war-plugin</artifactId>
-        <configuration>
-          <overlays>
-            <overlay>
-              <groupId>at.gv.egiz</groupId>
-              <artifactId>BKULocal</artifactId>
-              <type>war</type>
-              <targetPath>classes/BKULocal</targetPath>
-            </overlay>
-          </overlays>
-        </configuration>
-      </plugin-->
-
+      <!-- Include the BKULocal war artifact in the BKUWebStart jar
+       |   BKULauncher resolves resource and copies it to jetty's webapp dir 
+       |
+       |   don't: overlay BKULocal with maven-war-plugin 
+       |   don't: unpack BKULocal dependency (jetty and webstart classloaders interfere) -->
       <plugin>
-         <!-- unpack BKULocal prior to webstart jar generation to include -->
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-dependency-plugin</artifactId>
         <executions>
-          <!-- unpack BKULocalWar to classpath
           <execution>
-            <id>unpack BKULocal webapp</id>
-            <phase>process-resources</phase>
-            <goals>
-              <goal>unpack-dependencies</goal>
-            </goals>
-            <configuration>
-              <includeGroupIds>at.gv.egiz</includeGroupIds>
-              <includeArtifactIds>BKULocal</includeArtifactIds>
-              <includeTypes>war</includeTypes>
-              <outputDirectory>${project.build.directory}/classes/BKULocalWar</outputDirectory>
-              <overWriteReleases>false</overWriteReleases>
-              <overWriteSnapshots>true</overWriteSnapshots>
-            </configuration>
-          </execution-->
-
-          <!--execution>
-            <id>copy</id>
-            <phase>package</phase>
+            <id>copy-resources</id>
             <goals>
               <goal>copy</goal>
             </goals>
@@ -70,42 +40,43 @@
                 <artifactItem>
                   <groupId>at.gv.egiz</groupId>
                   <artifactId>BKULocal</artifactId>
-                  <version>[ version ]</version>
-                  <type>[ packaging ]</type>
-                  <classifier> [classifier - optional] </classifier>
-                  <overWrite>[ true or false ]</overWrite>
-                  <outputDirectory>[ output directory ]</outputDirectory>
-                  <destFileName>[ filename ]</destFileName>
+                  <type>war</type>
+                  <overWrite>false</overWrite>
+                  <outputDirectory>${project.build.directory}/classes</outputDirectory>
                 </artifactItem>
+                  <!-- 
+                   |   Will be replaced by TSL in IAIK-PKI
+                   |   don't list as dependency, to avoid inclusion in dist zip
+                   |   (BKULocal is of type war, therefore not included in dist)
+                   |
+                <artifactItem>
+                  <groupId>at.gv.egiz</groupId>
+                  <artifactId>BKUCertificates</artifactId>
+                  <version>1.0-SNAPSHOT</version>
+                  <overWrite>false</overWrite>
+                  <outputDirectory>${project.build.directory}/classes</outputDirectory>
+                </artifactItem-->
               </artifactItems>
-            </configuration>
-          </execution-->
-          <execution>
-            <id>copy BKULocal webapp</id>
-            <goals>
-              <goal>copy-dependencies</goal>
-            </goals>
-            <configuration>
-              <includeGroupIds>at.gv.egiz</includeGroupIds>
-              <includeArtifactIds>BKULocal</includeArtifactIds>
-              <includeTypes>war</includeTypes>
-              <outputDirectory>${project.build.directory}/classes/</outputDirectory>
               <stripVersion>true</stripVersion>
             </configuration>
           </execution>
         </executions>
       </plugin>
 
+      <!-- Build the web start app
+       |   Default is to build BKUWebStart.zip incl. jnlp for local execution
+       |   If include-webstart is active, the jnlp will contain DownloadServlet specific placeholders (for codebase, etc) and versioning will be enabled.
+       |   If pkcs11-sign is active (ie. the release build), pack200 will be activated, the the PKCS11 keystore will be used (and the adopted version of the plugin will be used).
+       |-->
       <plugin>
-        <groupId>org.codehaus.mojo.webstart</groupId>
         <artifactId>webstart-maven-plugin</artifactId>
+        <groupId>org.codehaus.mojo.webstart</groupId>
         <executions>
           <execution>
-          <!-- need lifecycle phase binding, otherwise
-           |   LifecycleSpecificationException: No lifecycle phase binding can be found for goal: jnlp -->
+            <!-- no default phase, need lifecycle phase binding -->
             <phase>package</phase>
             <goals>
-             <!-- IMPORTANT: USE jnlp-inline, otherwise no execution in install phase and
+              <!-- IMPORTANT: USE jnlp-inline, otherwise no execution in install phase and
                   the .zip artifact is not installed
                   (parallel lifecycle build finished prior to install phase?) -->
               <goal>jnlp-inline</goal>
@@ -113,56 +84,44 @@
           </execution>
         </executions>
         <configuration>
-
           <excludeTransitive>false</excludeTransitive>
-
           <!-- causes unsignAlreadySignedJars to fail
                (cf. http://jira.codehaus.org/browse/MWEBSTART-107)
           <libPath>lib</libPath-->
-
-          <!--resourcesDirectory>${project.basedir}/src/main/jnlp/resources</resourcesDirectory-->
-
           <jnlp>
             <inputTemplateResourcePath>${project.basedir}/src/main/jnlp</inputTemplateResourcePath>
-            <inputTemplate>template.xml</inputTemplate>
-            <outputFile>mocca.jnlp</outputFile>
-            <mainClass>at.gv.egiz.bku.webstart.BKULauncher</mainClass>
+            <inputTemplate>template-local.xml</inputTemplate>
+            <outputFile>mocca-local.jnlp</outputFile>
+            <mainClass>at.gv.egiz.bku.webstart.Launcher</mainClass>
             <j2seVersion>1.6+</j2seVersion>
             <offlineAllowed>true</offlineAllowed>
             <allPermissions>true</allPermissions>
           </jnlp>
-
           <sign>
             <alias>test-applet signer</alias>
             <keystore>${project.basedir}/keystore.ks</keystore>
+            <!-- Attention: configuration inherited by pkcs11-sign, uncomment!
+                 (fixed in maven-webstart-plugin-1.0-beta-1-SNAPSHOT) -->
             <storepass>storepass</storepass>
-            <keypass>keypass</keypass> <!-- we need to override passwords easily from the command line. ${keypass} -->
-            <verify>true</verify> <!-- verify that the signing operation succeeded -->
+            <keypass>keypass</keypass>
+            <verify>true</verify>
             <keystoreConfig>
-              <delete>false</delete> <!-- delete the keystore -->
-              <gen>false</gen>       <!-- optional shortcut to generate the store. -->
+              <delete>false</delete>
+              <gen>false</gen>
             </keystoreConfig>
           </sign>
-
-          <!-- BUILDING PROCESS -->
-          <pack200>true</pack200>
-          <!--gzip>true</gzip--> <!-- default force when pack200 false, true when pack200 selected ?? -->
-
-          <!-- causes a version attribute to be output in each jar resource element, optional, default is false -->
-          <outputJarVersions>true</outputJarVersions>
-
-          <!-- unsign IAIK-JCE (webstart error:  JAR-Ressourcen in JNLP-Datei sind nicht von demselben Zertifikat signiert) -->
+          <pack200>false</pack200>
+          <!--gzip>true</gzip-->
+          <outputJarVersions>false</outputJarVersions>
+          <!-- unsign IAIK signed libs -->
           <unsignAlreadySignedJars>true</unsignAlreadySignedJars>
-
-          <!--install>false</install--> <!-- not yet supported -->
           <verbose>true</verbose>
-
         </configuration>
       </plugin>
 
       <plugin>
-        <groupId>org.codehaus.mojo</groupId>
         <artifactId>maven-buildnumber-plugin</artifactId>
+        <groupId>org.codehaus.mojo</groupId>
         <executions>
           <execution>
             <phase>validate</phase>
@@ -178,8 +137,8 @@
       </plugin>
 
       <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-jar-plugin</artifactId>
+        <groupId>org.apache.maven.plugins</groupId>
         <configuration>
           <archive>
             <manifest>
@@ -194,114 +153,150 @@
       </plugin>
     </plugins>
   </build>
-  
-  <dependencies>
-    <dependency>
-      <groupId>at.gv.egiz</groupId>
-      <artifactId>BKULocal</artifactId>
-      <version>1.0.6-SNAPSHOT</version>
-      <type>war</type>
-    </dependency>
-    <dependency>
-      <artifactId>utils</artifactId>
-      <groupId>at.gv.egiz</groupId>
-      <version>1.2.1-SNAPSHOT</version>
-      <exclusions>
-        <exclusion>
-          <artifactId>iaik_ecc_signed</artifactId>
-          <groupId>iaik</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>commons-logging</groupId>
-      <artifactId>commons-logging</artifactId>
-      <version>1.0.4</version>
-    </dependency>
-    <dependency>
-      <groupId>org.mortbay.jetty</groupId>
-      <artifactId>jetty</artifactId>
-      <version>6.1.15</version>
-    </dependency>
-  </dependencies>
-
-<!--
 
   <profiles>
     <profile>
-      <id>webapp</id>
+      <id>standalone (non-webstart)</id>
       <build>
         <plugins>
           <plugin>
-            <groupId>org.codehaus.mojo.webstart</groupId>
-            <artifactId>webstart-maven-plugin</artifactId>
-            <executions>
-              <execution>
-                <phase>process-resources</phase>
-                <goals>
-                  <goal>jnlp-download-servlet</goal>
-                </goals>
-              </execution>
-            </executions>
+            <artifactId>maven-jar-plugin</artifactId>
+            <groupId>org.apache.maven.plugins</groupId>
             <configuration>
-              <templateDirectory>${project.basedir}/src/main/jnlp</templateDirectory>
-              <jnlpFiles>
-                <jnlpFile>
-                  <templateFilename>template.xml</templateFilename>
-                  <outputFilename>mocca.jnlp</outputFilename>
-                  <jarResources>
-                    <jarResource>
-                      <groupId>at.gv.egiz</groupId>
-                      <artifactId>BKUWebStart</artifactId>
-                      <version>1.0-SNAPSHOT</version>
-                      <mainClass>at.gv.egiz.bku.webstart.BKULauncher</mainClass>
-                    </jarResource>
-                  </jarResources>
-                </jnlpFile>
-              </jnlpFiles>
+              <archive>
+                <manifest>
+                  <addClasspath>true</addClasspath>
+                  <mainClass>at.gv.egiz.bku.webstart.BKULauncher</mainClass>
+                </manifest>
+                <manifestEntries>
+                  <mode>development</mode>
+                  <url>${pom.url}</url>
+                  <SplashScreen-Image>splash_standalone.png</SplashScreen-Image>
+                </manifestEntries>
+              </archive>
             </configuration>
           </plugin>
         </plugins>
       </build>
     </profile>
-    
-    
+
     <profile>
-      <id>standalone</id>
+      <id>pkcs11-sign</id>
       <build>
         <plugins>
-    ...
+          <plugin>
+            <artifactId>webstart-maven-plugin</artifactId>
+            <groupId>org.codehaus.mojo.webstart</groupId>
+            <!-- use pkcs11-patched webstart-maven-plugin-->
+            <version>1.0-beta-1-SNAPSHOT</version>
+            <configuration>
+              <sign>
+                <keystore>NONE</keystore>
+                <storetype>PKCS11</storetype>
+                <providerClass>iaik.pkcs.pkcs11.provider.IAIKPkcs11</providerClass>
+                <alias>a-sit</alias>
+                <storepass></storepass>
+                <verify>true</verify>
+                <keystoreConfig>
+                  <delete>false</delete>
+                  <gen>false</gen>
+                </keystoreConfig>
+              </sign>
+              <pack200>true</pack200>
+              <!--gzip>false</gzip-->
+              <outputJarVersions>true</outputJarVersions>
+            </configuration>
+          </plugin>
         </plugins>
       </build>
     </profile>
-  </profiles>
-  -->
 
-  <profiles>
     <profile>
-      <id>standalone (non-webstart)</id>
+      <id>include-webstart</id>
       <build>
         <plugins>
           <plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-jar-plugin</artifactId>
-				<configuration>
-					<archive>
-						<manifest>
-							<addClasspath>true</addClasspath>
-							<mainClass>at.gv.egiz.bku.webstart.BKULauncher</mainClass>
-						</manifest>
-						<manifestEntries>
-							<mode>development</mode>
-							<url>${pom.url}</url>
-							<SplashScreen-Image>splash_standalone.png</SplashScreen-Image>
-						</manifestEntries>
-					</archive>
-				</configuration>
-			</plugin>
+            <artifactId>webstart-maven-plugin</artifactId>
+            <groupId>org.codehaus.mojo.webstart</groupId>
+            <configuration>
+              <jnlp>
+                <inputTemplate>template.xml</inputTemplate>
+                <outputFile>mocca.jnlp</outputFile>
+              </jnlp>
+              <pack200>false</pack200>
+              <!--gzip>false</gzip-->
+              <outputJarVersions>true</outputJarVersions>
+            </configuration>
+          </plugin>
         </plugins>
       </build>
     </profile>
   </profiles>
 
-</project>
\ No newline at end of file
+  <dependencies>
+    <dependency>
+      <groupId>at.gv.egiz</groupId>
+      <artifactId>BKULocal</artifactId>
+      <version>1.0.6-SNAPSHOT</version>
+      <type>war</type>
+    </dependency>
+    <dependency>
+      <groupId>at.gv.egiz</groupId>
+      <artifactId>BKUCertificates</artifactId>
+      <version>1.0-SNAPSHOT</version>
+    </dependency>
+    <dependency>
+      <artifactId>utils</artifactId>
+      <groupId>at.gv.egiz</groupId>
+      <version>1.2.1-SNAPSHOT</version>
+      <exclusions>
+        <exclusion>
+          <artifactId>iaik_ecc_signed</artifactId>
+          <groupId>iaik</groupId>
+        </exclusion>
+      </exclusions>
+    </dependency>
+    <dependency>
+      <groupId>commons-logging</groupId>
+      <artifactId>commons-logging</artifactId>
+    </dependency>
+
+    <!-- Jetty 6.1.15+ required, see
+     |   http://jira.codehaus.org/browse/JETTY-843
+     |-->
+    <dependency>
+      <groupId>org.mortbay.jetty</groupId>
+      <artifactId>jetty</artifactId>
+      <version>6.1.19</version>
+    </dependency>
+    <!-- JSP support
+     |   http://jira.codehaus.org/browse/JETTY-827
+     |   jsp-2.1-jetty-6.1.19 depends on the required jsp-2.1-glassfish jars (?)
+     |-->
+    <dependency>
+      <groupId>org.mortbay.jetty</groupId>
+      <artifactId>jsp-2.1-jetty</artifactId>
+      <version>6.1.19</version>
+    </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-api</artifactId>
+      <version>1.5.8</version>
+    </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-log4j12</artifactId>
+      <version>1.5.8</version>
+    </dependency>
+
+    <!-- javax.jnlp.* -->
+    <dependency>
+      <groupId>jre</groupId>
+      <artifactId>javaws</artifactId>
+      <version>6.0</version>
+      <type>jar</type>
+      <scope>system</scope>
+      <systemPath>${java.home}/lib/javaws.jar</systemPath>
+    </dependency>
+  </dependencies>
+</project>
diff --git a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/BKULauncher.java b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/BKULauncher.java
deleted file mode 100644
index abc0b8ee..00000000
--- a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/BKULauncher.java
+++ /dev/null
@@ -1,418 +0,0 @@
-package at.gv.egiz.bku.webstart;

-

-import iaik.asn1.CodingException;

-import java.io.File;

-import java.io.FileNotFoundException;

-import java.io.FileOutputStream;

-import java.io.IOException;

-import java.io.InputStream;

-import java.io.OutputStream;

-import java.net.MalformedURLException;

-import java.security.KeyStore;

-import java.security.KeyStoreException;

-import java.security.NoSuchAlgorithmException;

-import java.security.cert.CertificateException;

-import java.util.Enumeration;

-import java.util.Locale;

-import java.util.MissingResourceException;

-import java.util.ResourceBundle;

-import java.util.logging.Level;

-import java.util.logging.Logger;

-import java.util.zip.ZipEntry;

-import java.util.zip.ZipFile;

-

-//import org.apache.commons.cli.CommandLine;

-//import org.apache.commons.cli.CommandLineParser;

-//import org.apache.commons.cli.HelpFormatter;

-//import org.apache.commons.cli.Options;

-//import org.apache.commons.cli.ParseException;

-//import org.apache.commons.cli.PosixParser;

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

-

-import at.gv.egiz.bku.webstart.ui.BKUControllerInterface;

-import at.gv.egiz.bku.webstart.ui.TrayIconDialog;

-import at.gv.egiz.bku.utils.StreamUtil;

-import java.awt.Desktop;

-import java.io.BufferedInputStream;

-import java.io.BufferedOutputStream;

-import java.io.BufferedReader;

-import java.io.BufferedWriter;

-import java.io.FileInputStream;

-import java.io.FileReader;

-import java.io.FileWriter;

-import java.net.BindException;

-import java.net.URI;

-import java.net.URL;

-import java.security.GeneralSecurityException;

-import java.util.UUID;

-import java.util.jar.Attributes;

-import java.util.jar.Manifest;

-import java.util.zip.ZipOutputStream;

-import org.mortbay.util.MultiException;

-

-public class BKULauncher implements BKUControllerInterface {

-

-  /** configurations with less than this (major) version will be backuped and updated */

-  public static final String MIN_CONFIG_VERSION = "1.0.3";

-  public static final String CONFIG_DIR = ".mocca/conf/";

-  public static final String CONF_TEMPLATE_FILE = "configuration.zip";

-  public static final String CONF_TEMPLATE_RESOURCE = "at/gv/egiz/bku/webstart/conf/configuration.zip";

-  public static final String WEBAPP_RESOURCE = "BKULocal.war";

-  public static final String WEBAPP_FILE = "BKULocal.war";

-  public static final String KEYSTORE_FILE = "keystore.ks";

-  public static final String MESSAGES_RESOURCE = "at/gv/egiz/bku/webstart/ui/UIMessages";

-  public static final String PASSWD_FILE = ".secret";

-  /** resource bundle messages */

-  public static final String GREETING_CAPTION = "Greetings.Caption";

-  public static final String GREETING_MESSAGE = "Greetings.Message";

-  public static final String STARTUP_CAPTION = "Startup.Caption";

-  public static final String ERROR_CAPTION = "Error.Caption";

-  public static final String STARTUP_MESSAGE = "Startup.Message";

-  public static final String ERROR_STARTUP_MESSAGE = "Error.Startup.Message";

-  public static final String ERROR_CONF_MESSAGE = "Error.Conf.Message";

-  public static final String ERROR_BIND_MESSAGE = "Error.Bind.Message";

-  public static final String VERSION_FILE = ".version";

-  private static Log log = LogFactory.getLog(BKULauncher.class);

-  private ResourceBundle resourceBundle = null;

-  private Container server;

-

-  private void createConfig(File configDir, File versionFile, String version) throws IOException, CertificateException, GeneralSecurityException, KeyStoreException, FileNotFoundException, NoSuchAlgorithmException {

-    log.debug("creating config directory: " + configDir);

-    configDir.mkdirs();

-    InputStream is = getClass().getClassLoader().getResourceAsStream(CONF_TEMPLATE_RESOURCE);

-    OutputStream os = new FileOutputStream(new File(configDir, CONF_TEMPLATE_FILE));

-    StreamUtil.copyStream(is, os);

-    os.close();

-    File confTemplateFile = new File(configDir, CONF_TEMPLATE_FILE);

-    unzip(confTemplateFile);

-    confTemplateFile.delete();

-    writeVersionFile(versionFile, version);

-  }

-

-  private void createCertificates(File configDir) throws IOException, GeneralSecurityException, CodingException {

-    char[] password = UUID.randomUUID().toString().toCharArray();

-    File passwdFile = new File(configDir, PASSWD_FILE);

-    FileWriter passwdWriter = new FileWriter(passwdFile);

-    passwdWriter.write(password);

-    passwdWriter.close();

-    if (!passwdFile.setReadable(true, true)) {

-      passwdFile.delete();

-      throw new IOException("failed to make " + passwdFile + " owner readable only, deleting file");

-    }

-    TLSServerCA ca = new TLSServerCA();

-    KeyStore ks = ca.generateKeyStore(password);

-    FileOutputStream fos = new FileOutputStream(new File(configDir, KEYSTORE_FILE));

-    ks.store(fos, password);

-    fos.close();

-  }

-

-  private String getFileVersion(File versionFile) throws FileNotFoundException, IOException {

-    //TODO no file?

-    if (versionFile.exists() && versionFile.canRead()) {

-      BufferedReader versionReader = new BufferedReader(new FileReader(versionFile));

-      String versionString = null;

-      while ((versionString = versionReader.readLine().trim()) != null) {

-        if (versionString.length() > 0 && !versionString.startsWith("#")) {

-          log.debug("found existing configuration version " + versionString);

-          break;

-        }

-      }

-      return versionString;

-    }

-    return null;

-  }

-

-  private String getManifestVersion() throws MalformedURLException, IOException {

-    String bkuWebStartJar = BKULauncher.class.getProtectionDomain().getCodeSource().getLocation().toString();

-    URL manifestURL = new URL("jar:" + bkuWebStartJar + "!/META-INF/MANIFEST.MF");

-    String version = null;

-    if (manifestURL != null) {

-      Manifest manifest = new Manifest(manifestURL.openStream());

-      if (log.isTraceEnabled()) {

-        log.trace("read version information from " + manifestURL);

-      }

-      Attributes atts = manifest.getMainAttributes();

-      if (atts != null) {

-        version = atts.getValue("Implementation-Build");

-      }

-    }

-    if (version == null) {

-      version = "UNKNOWN";

-    }

-    log.debug("config version: " + version);

-    return version;

-  }

-

-  /**

-   * change the

-   * @param oldVersion

-   * @param newVersion

-   * @return

-   */

-  private boolean updateRequired(String oldVersion, String newVersion) {

-    if (oldVersion != null) {

-      log.debug("comparing " + oldVersion + " to " + MIN_CONFIG_VERSION);

-      

-      int majorEnd = oldVersion.indexOf('-');

-      String oldMajor = (majorEnd < 0) ? oldVersion : oldVersion.substring(0, majorEnd);

-

-      int compare = oldMajor.compareTo(MIN_CONFIG_VERSION);

-      if (compare < 0 ||

-              // SNAPSHOT versions are pre-releases (update if release required)

-              (compare == 0 && oldVersion.startsWith("-SNAPSHOT", majorEnd))) {

-        return true;

-      } else {

-        return false;

-      }

-    }

-    log.debug("no old version, update required");

-    return true;

-  }

-

-  private boolean updateRequiredStrict(String oldVersion, String newVersion) {

-    String[] oldV = oldVersion.split("-");

-    String[] newV = newVersion.split("-");

-    log.debug("comparing " + oldV[0] + " to " + newV[0]);

-    if (oldV[0].compareTo(newV[0]) < 0) {

-      log.debug("update required");

-      return true;

-    } else {

-      log.debug("comparing " + oldV[oldV.length - 1] + " to " + newV[newV.length - 1]);

-      if (oldV[oldV.length - 1].compareTo(newV[newV.length - 1]) < 0) {

-        log.debug("update required");

-        return true;

-      } else {

-        log.debug("no update required");

-        return false;

-      }

-    }

-  }

-

-  private void writeVersionFile(File versionFile, String version) throws IOException {

-    BufferedWriter versionWriter = new BufferedWriter(new FileWriter(versionFile));

-    versionWriter.write("# MOCCA Web Start configuration version\n");

-    versionWriter.write("# DO NOT MODIFY THIS FILE\n\n");

-    versionWriter.write(version);

-    versionWriter.close();

-  }

-

-//  private SplashScreen splash = SplashScreen.getSplashScreen();

-  private void startUpServer() throws Exception {

-    log.info("init servlet container and MOCCA webapp");

-    server = new Container();

-    // XmlConfiguration xcfg = new XmlConfiguration(getClass().getClassLoader()

-    // .getResourceAsStream("at/gv/egiz/bku/local/app/jetty.xml"));

-    // xcfg.configure(server);

-    server.init();

-    server.start();

-  }

-

-  private void initTrayIcon() {

-    log.debug("init MOCCA tray icon");

-    Locale loc = Locale.getDefault();

-    try {

-      resourceBundle = ResourceBundle.getBundle(

-              MESSAGES_RESOURCE, loc);

-    } catch (MissingResourceException mx) {

-      resourceBundle = ResourceBundle.getBundle(

-              MESSAGES_RESOURCE, Locale.ENGLISH);

-    }

-    TrayIconDialog.getInstance().init(resourceBundle);

-    TrayIconDialog.getInstance().setShutdownHook(this);

-//    TrayIconDialog.getInstance().displayInfo(GREETING_CAPTION, GREETING_MESSAGE);

-  }

-

-  private void initStart() {

-  }

-

-  private void initFinished(boolean installCert) {

-    try {

-//      if (splash != null) {

-//        try {

-//          splash.close();

-//        } catch (IllegalStateException ex) {

-//          log.warn("Failed to close splash screen: " + ex.getMessage());

-//        }

-//      }

-

-      if (installCert) {

-        log.debug("trying install MOCCA certificate on system browser");

-        if (Desktop.isDesktopSupported()) {

-          Desktop desktop = Desktop.getDesktop();

-          if (desktop.isSupported(Desktop.Action.BROWSE)) {

-            try {

-              desktop.browse(new URI("https://localhost:" +

-                      Integer.getInteger(Container.HTTPS_PORT_PROPERTY, 3496).intValue()));

-            } catch (Exception ex) {

-              log.error("failed to open system browser, install MOCCA certificate manually", ex);

-            }

-          } else {

-            log.error("failed to open system browser, install MOCCA certificate manually");

-          }

-        } else {

-          log.error("failed to open system browser, install MOCCA certificate manually");

-        }

-      }

-

-      log.info("init completed, joining server");

-      server.join();

-    } catch (InterruptedException e) {

-      log.warn("failed to join MOCCA server: " + e.getMessage(), e);

-    }

-  }

-

-  private void unzip(File zipfile) throws IOException {

-    File dir = zipfile.getParentFile();

-    ZipFile zipFile = new ZipFile(zipfile);

-    Enumeration<? extends ZipEntry> entries = zipFile.entries();

-    while (entries.hasMoreElements()) {

-      ZipEntry entry = entries.nextElement();

-      File eF = new File(dir, entry.getName());

-      if (entry.isDirectory()) {

-        eF.mkdirs();

-        continue;

-      }

-      File f = new File(eF.getParent());

-      f.mkdirs();

-      StreamUtil.copyStream(zipFile.getInputStream(entry),

-              new FileOutputStream(eF));

-    }

-    zipFile.close();

-  }

-

-  /**

-   * @param args

-   */

-  public static void main(String[] args) throws InterruptedException {

-

-    if (log.isDebugEnabled()) {

-      //System.setProperty("DEBUG", "true");

-      System.setProperty("VERBOSE", "true");

-      System.setProperty("javax.net.debug", "ssl,handshake");

-    }

-    

-//      log.warn("***** DISABLING SECURITY MANAGER *******");

-      System.setSecurityManager(null);

-

-      BKULauncher launcher = new BKULauncher();

-      launcher.initStart();

-

-      boolean installCert = false;

-

-      launcher.initTrayIcon();

-      TrayIconDialog.getInstance().displayInfo(STARTUP_CAPTION, STARTUP_MESSAGE);

-

-      try {

-        File configDir = new File(System.getProperty("user.home") + '/' + CONFIG_DIR);

-        installCert = launcher.ensureConfig(configDir);

-      } catch (Exception ex) {

-        log.fatal("Failed to init MOCCA configuration, exiting", ex);

-        TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_CONF_MESSAGE);

-        Thread.sleep(5000);

-        System.exit(-1000);

-      }

-

-      try {

-        launcher.startUpServer();

-        TrayIconDialog.getInstance().displayInfo(GREETING_CAPTION, GREETING_MESSAGE);

-        launcher.initFinished(installCert);

-      } catch (BindException ex) {

-        log.fatal("Failed to launch MOCCA, " + ex.getMessage(), ex);

-        TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_BIND_MESSAGE);

-        Thread.sleep(5000);

-        System.exit(-1000);

-      } catch (MultiException ex) {

-        log.fatal("Failed to launch MOCCA, " + ex.getMessage(), ex);

-        if (ex.getThrowable(0) instanceof BindException) {

-          TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_BIND_MESSAGE);

-        } else {

-          TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_STARTUP_MESSAGE);

-        }

-        Thread.sleep(5000);

-        System.exit(-1000);

-      } catch (Exception e) {

-        log.fatal("Failed to launch MOCCA, " + e.getMessage(), e);

-        TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_STARTUP_MESSAGE);

-        Thread.sleep(5000);

-        System.exit(-1000);

-      }

-    

-  }

-

-  private void backupAndDelete(File dir, URI relativeTo, ZipOutputStream zip) throws IOException {

-    if (dir.isDirectory()) {

-      File[] subDirs = dir.listFiles();

-      for (File subDir : subDirs) {

-        backupAndDelete(subDir, relativeTo, zip);

-        subDir.delete();

-      }

-    } else {

-      URI relativePath = relativeTo.relativize(dir.toURI());

-      ZipEntry entry = new ZipEntry(relativePath.toString());

-      zip.putNextEntry(entry);

-      BufferedInputStream entryIS = new BufferedInputStream(new FileInputStream(dir));

-      StreamUtil.copyStream(entryIS, zip);

-      entryIS.close();

-      zip.closeEntry();

-      dir.delete();

-    }

-  }

-

-  /**

-   * Checks whether the config directory already exists and creates it otherwise.

-   * @param configDir the config directory to be created

-   * @return true if a new MOCCA cert was created (and needs to be installed in the browser)

-   */

-  private boolean ensureConfig(File configDir) throws IOException, GeneralSecurityException, CodingException {

-    log.debug("config directory: " + configDir);

-    String manifestVersion = getManifestVersion();

-    File versionFile = new File(configDir, VERSION_FILE);

-

-    if (configDir.exists()) {

-      if (configDir.isFile()) {

-        log.error("invalid config directory: " + configDir);

-        throw new IOException("invalid config directory: " + configDir);

-      } else {

-        String fileVersion = getFileVersion(versionFile);

-        if (updateRequired(fileVersion, manifestVersion)) {

-          if (fileVersion == null) {

-            fileVersion = "unknown";

-          }

-          log.info("updating configuration from " + fileVersion + " to " + manifestVersion);

-          File moccaDir = configDir.getParentFile();

-          File zipFile = new File(moccaDir, "conf-" + fileVersion + ".zip");

-          ZipOutputStream zipOS = new ZipOutputStream(new BufferedOutputStream(new FileOutputStream(zipFile)));

-          backupAndDelete(configDir, moccaDir.toURI(), zipOS);

-          zipOS.close();

-          createConfig(configDir, versionFile, manifestVersion);

-          createCertificates(configDir);

-          return true;

-        }

-      }

-    } else {

-      createConfig(configDir, versionFile, manifestVersion);

-      createCertificates(configDir);

-      return true;

-    }

-    return false;

-  }

-

-  public void shutDown() {

-    log.info("Shutting down server");

-    if ((server != null) && (server.isRunning())) {

-      try {

-        if (server.isRunning()) {

-          server.stop();

-        }

-      } catch (Exception e) {

-        log.debug(e.toString());

-      } finally {

-        if (server.isRunning()) {

-          server.destroy();

-        }

-      }

-    }

-    System.exit(0);

-  }

-}

diff --git a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Configurator.java b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Configurator.java
new file mode 100644
index 00000000..ab1746ed
--- /dev/null
+++ b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Configurator.java
@@ -0,0 +1,418 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.webstart;
+
+import at.gv.egiz.bku.utils.StreamUtil;
+import iaik.asn1.CodingException;
+import iaik.xml.crypto.utils.Utils;
+import java.io.BufferedInputStream;
+import java.io.BufferedOutputStream;
+import java.io.BufferedReader;
+import java.io.BufferedWriter;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.FileReader;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.net.URL;
+import java.security.GeneralSecurityException;
+import java.security.KeyStore;
+import java.util.Enumeration;
+import java.util.Iterator;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+import java.util.jar.Attributes;
+import java.util.jar.Manifest;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipFile;
+import java.util.zip.ZipOutputStream;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.eclipse.jdt.core.dom.ThisExpression;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class Configurator {
+
+  /**
+   * MOCCA configuration
+   * configurations with less than this (major) version will be backuped and updated
+   * allowed: MAJOR[.MINOR[.X[-SNAPSHOT]]]
+   */
+  public static final String MIN_CONFIG_VERSION = "1.0.9-SNAPSHOT";
+  public static final String CONFIG_DIR = ".mocca/conf/";
+  public static final String CERTS_DIR = ".mocca/certs/";
+  public static final String VERSION_FILE = ".version";
+  public static final String UNKOWN_VERSION = "unknown";
+  public static final String CONF_TEMPLATE_FILE = "conf-tmp.zip";
+  public static final String CONF_TEMPLATE_RESOURCE = "at/gv/egiz/bku/webstart/conf/conf.zip";
+  public static final String CERTIFICATES_PKG = "at/gv/egiz/bku/certs";
+
+  /**
+   * MOCCA TLS certificate
+   */
+  public static final String KEYSTORE_FILE = "keystore.ks";
+  public static final String PASSWD_FILE = ".secret";
+
+  private static final Log log = LogFactory.getLog(Configurator.class);
+  
+  /** currently installed configuration version */
+  private String version;
+  private String certsVersion;
+  /** whether a new MOCCA TLS cert was created during initialization */
+  private boolean certRenewed = false;
+
+  /**
+   * Checks whether the config directory already exists and creates it otherwise.
+   * @param configDir the config directory to be created
+   * @throws IOException config/certificate creation failed
+   * @throws GeneralSecurityException if MOCCA TLS certificate could not be created
+   * @throws CodingException if MOCCA TLS certificate could not be created
+   */
+  public void ensureConfiguration() throws IOException, CodingException, GeneralSecurityException {
+    File configDir = new File(System.getProperty("user.home") + '/' + CONFIG_DIR);
+    if (configDir.exists()) {
+      if (configDir.isFile()) {
+        log.error("invalid config directory: " + configDir);
+        throw new IOException("invalid config directory: " + configDir);
+      } else {
+        version = readVersion(new File(configDir, VERSION_FILE));
+        if (log.isDebugEnabled()) {
+          log.debug("config directory " + configDir + ", version " + version);
+        }
+        if (updateRequired(version)) {
+          File moccaDir = configDir.getParentFile();
+          File zipFile = new File(moccaDir, "conf-" + version + ".zip");
+          ZipOutputStream zipOS = new ZipOutputStream(new BufferedOutputStream(new FileOutputStream(zipFile)));
+          log.info("backup configuration to " + zipFile);
+          backupAndDelete(configDir, moccaDir.toURI(), zipOS);
+          zipOS.close();
+          initConfig(configDir);
+        }
+      }
+    } else {
+      initConfig(configDir);
+    }
+  }
+
+  /**
+   * To be replaced by TSLs in IAIK-PKI
+   * @throws IOException
+   */
+  public void ensureCertificates() throws IOException {
+    File certsDir = new File(System.getProperty("user.home") + '/' + CERTS_DIR);
+    if (certsDir.exists()) {
+      if (certsDir.isFile()) {
+        log.error("invalid certificate store directory: " + certsDir);
+        throw new IOException("invalid config directory: " + certsDir);
+      } else {
+        certsVersion = readVersion(new File(certsDir, VERSION_FILE));
+        if (log.isDebugEnabled()) {
+          log.debug("certificate-store directory " + certsDir + ", version " + certsVersion);
+        }
+        String newCertsVersion = getCertificatesVersion();
+        if (updateRequiredStrict(certsVersion, newCertsVersion)) {
+          File moccaDir = certsDir.getParentFile();
+          File zipFile = new File(moccaDir, "certs-" + certsVersion + ".zip");
+          ZipOutputStream zipOS = new ZipOutputStream(new BufferedOutputStream(new FileOutputStream(zipFile)));
+          log.info("backup certificates to " + zipFile);
+          backupAndDelete(certsDir, moccaDir.toURI(), zipOS);
+          zipOS.close();
+
+          createCerts(certsDir, newCertsVersion);
+          certsVersion = newCertsVersion;
+        }
+      }
+    } else {
+      String newCertsVersion = getCertificatesVersion();
+      createCerts(certsDir, newCertsVersion);
+      certsVersion = newCertsVersion;
+    }
+  }
+
+  /**
+   * 
+   * @return whether a new MOCCA TLS certificate has been created during initialization
+   */
+  public boolean isCertRenewed() {
+    return certRenewed;
+  }
+
+  /**
+   * @return The first valid (not empty, no comment) line of the version file or
+   * "unknown" if version file cannot be read or does not contain such a line.
+   */
+  protected static String readVersion(File versionFile) {
+    if (versionFile.exists() && versionFile.canRead()) {
+      BufferedReader versionReader = null;
+      try {
+        versionReader = new BufferedReader(new FileReader(versionFile));
+        String version;
+        while ((version = versionReader.readLine().trim()) != null) {
+          if (version.length() > 0 && !version.startsWith("#")) {
+            log.debug("configuration version from " + versionFile + ": " + version);
+            return version;
+          }
+        }
+      } catch (IOException ex) {
+        log.error("failed to read configuration version from " + versionFile, ex);
+      } finally {
+        try {
+          versionReader.close();
+        } catch (IOException ex) {
+        }
+      }
+    }
+    log.debug("unknown configuration version");
+    return UNKOWN_VERSION;
+  }
+
+  /**
+   * Temporary workaround, replace with TSLs in IAIK-PKI.
+   * Retrieves version from BKUCertificates.jar Manifest file. 
+   * The (remote) resource URL will be handled by the JNLP loader, 
+   * and the resource retrieved from the cache.
+   *
+   * @return
+   * @throws IOException
+   */
+  private static String getCertificatesVersion() throws IOException {
+    String certsResourceVersion = null;
+    URL certsURL = Configurator.class.getClassLoader().getResource(CERTIFICATES_PKG);
+    if (certsURL != null) {
+      StringBuilder url = new StringBuilder(certsURL.toExternalForm());
+      url = url.replace(url.length() - CERTIFICATES_PKG.length(), url.length(), "META-INF/MANIFEST.MF");
+      log.trace("retrieve certificates resource version from " + url);
+      certsURL = new URL(url.toString());
+      Manifest certsManifest = new Manifest(certsURL.openStream());
+      Attributes atts = certsManifest.getMainAttributes();
+      if (atts != null) {
+        certsResourceVersion = atts.getValue("Implementation-Version");
+        log.debug("certs resource version: " + certsResourceVersion);
+      }
+    } else {
+      log.error("Failed to retrieve certificates resource " + CERTIFICATES_PKG);
+      throw new IOException("Failed to retrieve certificates resource " + CERTIFICATES_PKG);
+    }
+    return certsResourceVersion;
+  }
+
+  protected static boolean updateRequired(String oldVersion) {
+     log.debug("comparing " + oldVersion + " to " + MIN_CONFIG_VERSION);
+     if (oldVersion != null && !UNKOWN_VERSION.equals(oldVersion)) {
+     
+      int majorEnd = oldVersion.indexOf('-');
+      String oldMajor = (majorEnd < 0) ? oldVersion : oldVersion.substring(0, majorEnd);
+
+      String minMajor = MIN_CONFIG_VERSION;
+      boolean releaseRequired = true;
+      if (MIN_CONFIG_VERSION.endsWith("-SNAPSHOT")) {
+        releaseRequired = false;
+        minMajor = minMajor.substring(0, minMajor.length() - 9);
+      }
+
+      int compare = oldMajor.compareTo(minMajor);
+      if (compare < 0 ||
+              // SNAPSHOT versions are pre-releases (update if release required)
+              (compare == 0 && releaseRequired && oldVersion.startsWith("-SNAPSHOT", majorEnd))) {
+        log.debug("configuration update required");
+        return true;
+      } else {
+        log.debug("configuration up to date");
+        return false;
+      }
+    }
+    log.debug("no old version, configuration update required");
+    return true;
+  }
+
+  /**
+   * if unknown old, update in any case
+   * if known old and unknown new, don't update
+   * @param oldVersion
+   * @param newVersion
+   * @return
+   */
+  private boolean updateRequiredStrict(String oldVersion, String newVersion) {
+    log.debug("comparing " + oldVersion + " to " + newVersion);
+    if (oldVersion != null && !UNKOWN_VERSION.equals(oldVersion)) {
+      if (newVersion != null && !UNKOWN_VERSION.equals(newVersion)) {
+        String[] oldV = oldVersion.split("-");
+        String[] newV = newVersion.split("-");
+        log.trace("comparing " + oldV[0] + " to " + newV[0]);
+        if (oldV[0].compareTo(newV[0]) < 0) {
+          log.debug("update required");
+          return true;
+        } else {
+          log.trace("comparing " + oldV[oldV.length - 1] + " to " + newV[newV.length - 1]);
+          if (oldV[oldV.length - 1].compareTo(newV[newV.length - 1]) < 0) {
+            log.debug("update required");
+            return true;
+          } else {
+            log.debug("no update required");
+            return false;
+          }
+        }
+      }
+      log.debug("unknown new version, do not update");
+      return true;
+    }
+    log.debug("unknown old version, update required");
+    return true;
+  }
+  
+  protected static void backupAndDelete(File dir, URI relativeTo, ZipOutputStream zip) throws IOException {
+    if (dir.isDirectory()) {
+      File[] subDirs = dir.listFiles();
+      for (File subDir : subDirs) {
+        backupAndDelete(subDir, relativeTo, zip);
+        subDir.delete();
+      }
+    } else {
+      URI relativePath = relativeTo.relativize(dir.toURI());
+      ZipEntry entry = new ZipEntry(relativePath.toString());
+      zip.putNextEntry(entry);
+      BufferedInputStream entryIS = new BufferedInputStream(new FileInputStream(dir));
+      StreamUtil.copyStream(entryIS, zip);
+      entryIS.close();
+      zip.closeEntry();
+      dir.delete();
+    }
+  }
+
+  /**
+   * set up a new MOCCA local configuration
+   * (not to be called directly, call ensureConfiguration())
+   * @throws IOException config/certificate creation failed
+   * @throws GeneralSecurityException if MOCCA TLS certificate could not be created
+   * @throws CodingException if MOCCA TLS certificate could not be created
+   */
+  protected void initConfig(File configDir) throws IOException, GeneralSecurityException, CodingException {
+    createConfig(configDir, Launcher.version);
+    version = Launcher.version;
+    createKeyStore(configDir);
+    certRenewed = true;
+  }
+
+  private static void createConfig(File configDir, String version) throws IOException {
+    if (log.isDebugEnabled()) {
+      log.debug("creating configuration version " + Launcher.version + " in " + configDir );
+    }
+    configDir.mkdirs();
+    File confTemplateFile = new File(configDir, CONF_TEMPLATE_FILE);
+    InputStream is = Configurator.class.getClassLoader().getResourceAsStream(CONF_TEMPLATE_RESOURCE);
+    OutputStream os = new BufferedOutputStream(new FileOutputStream(confTemplateFile));
+    StreamUtil.copyStream(is, os);
+    os.close();
+    unzip(confTemplateFile, configDir);
+    confTemplateFile.delete();
+    writeVersionFile(new File(configDir, VERSION_FILE), version);
+  }
+
+  /**
+   * set up a new MOCCA local certStore
+   * @throws IOException config/certificate creation failed
+   * @throws GeneralSecurityException if MOCCA TLS certificate could not be created
+   * @throws CodingException if MOCCA TLS certificate could not be created
+   */
+  private static void createCerts(File certsDir, String certsVersion) throws IOException {
+    if (log.isDebugEnabled()) {
+      log.debug("creating certificate-store " + certsDir + ", version " + certsVersion);
+    }
+    URL certsURL = Configurator.class.getClassLoader().getResource(CERTIFICATES_PKG);
+    if (certsURL != null) {
+      StringBuilder url = new StringBuilder(certsURL.toExternalForm());
+      url = url.replace(url.length() - CERTIFICATES_PKG.length(), url.length(), "META-INF/MANIFEST.MF");
+      log.debug("retrieve certificate resource names from " + url);
+      certsURL = new URL(url.toString());
+      Manifest certsManifest = new Manifest(certsURL.openStream());
+      certsDir.mkdirs();
+      Iterator<String> entries = certsManifest.getEntries().keySet().iterator();
+      while (entries.hasNext()) {
+        String entry = entries.next();
+        if (entry.startsWith(CERTIFICATES_PKG)) {
+          String f = entry.substring(CERTIFICATES_PKG.length()); // "/trustStore/..."
+          new File(certsDir, f.substring(0, f.lastIndexOf('/'))).mkdirs();
+          BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(new File(certsDir, f)));
+          log.debug(f);
+          StreamUtil.copyStream(Configurator.class.getClassLoader().getResourceAsStream(entry), bos);
+          bos.close();
+        } else {
+          log.trace("ignore " + entry);
+        }
+      }
+      writeVersionFile(new File(certsDir, VERSION_FILE), certsVersion);
+    } else {
+      log.error("Failed to retrieve certificates resource " + CERTIFICATES_PKG);
+      throw new IOException("Failed to retrieve certificates resource " + CERTIFICATES_PKG);
+    }
+  }
+
+  private static void unzip(File zipfile, File toDir) throws IOException {
+    ZipFile zipFile = new ZipFile(zipfile);
+    Enumeration<? extends ZipEntry> entries = zipFile.entries();
+    while (entries.hasMoreElements()) {
+      ZipEntry entry = entries.nextElement();
+      File eF = new File(toDir, entry.getName());
+      if (entry.isDirectory()) {
+        eF.mkdirs();
+        continue;
+      }
+      File f = new File(eF.getParent());
+      f.mkdirs();
+      StreamUtil.copyStream(zipFile.getInputStream(entry),
+              new FileOutputStream(eF));
+    }
+    zipFile.close();
+  }
+
+  private static void writeVersionFile(File versionFile, String version) throws IOException {
+    BufferedWriter versionWriter = new BufferedWriter(new FileWriter(versionFile));
+    versionWriter.write("# MOCCA Web Start configuration version\n");
+    versionWriter.write("# DO NOT MODIFY THIS FILE\n\n");
+    versionWriter.write(version);
+    versionWriter.close();
+  }
+
+  private static void createKeyStore(File configDir) throws IOException, GeneralSecurityException, CodingException {
+    char[] password = UUID.randomUUID().toString().toCharArray();
+    File passwdFile = new File(configDir, PASSWD_FILE);
+    FileWriter passwdWriter = new FileWriter(passwdFile);
+    passwdWriter.write(password);
+    passwdWriter.close();
+    if (!passwdFile.setReadable(false, false) || !passwdFile.setReadable(true, true)) {
+      passwdFile.delete();
+      throw new IOException("failed to make " + passwdFile + " owner readable only, deleting file");
+    }
+    TLSServerCA ca = new TLSServerCA();
+    KeyStore ks = ca.generateKeyStore(password);
+    File ksFile = new File(configDir, KEYSTORE_FILE);
+    FileOutputStream fos = new FileOutputStream(ksFile);
+    ks.store(fos, password);
+    fos.close();
+  }
+}
diff --git a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Container.java b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Container.java
index 89044486..4df90ab2 100644
--- a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Container.java
+++ b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Container.java
@@ -1,22 +1,28 @@
 package at.gv.egiz.bku.webstart;

 

 import at.gv.egiz.bku.utils.StreamUtil;

+import java.awt.AWTPermission;

 import java.io.BufferedOutputStream;

 import java.io.BufferedReader;

 import java.io.File;

 import java.io.FileNotFoundException;

 import java.io.FileOutputStream;

+import java.io.FilePermission;

 import java.io.FileReader;

 import java.io.IOException;

 import java.io.InputStream;

 import java.io.OutputStream;

+import java.lang.reflect.ReflectPermission;

+import java.net.NetPermission;

+import java.net.SocketPermission;

+import java.security.Permissions;

+import java.security.SecurityPermission;

+import java.util.PropertyPermission;

+import javax.smartcardio.CardPermission;

 import org.apache.commons.logging.Log;

 import org.apache.commons.logging.LogFactory;

 import org.mortbay.jetty.Connector;

-import org.mortbay.jetty.Handler;

 import org.mortbay.jetty.Server;

-import org.mortbay.jetty.handler.DefaultHandler;

-import org.mortbay.jetty.handler.HandlerCollection;

 import org.mortbay.jetty.nio.SelectChannelConnector;

 import org.mortbay.jetty.security.SslSocketConnector;

 import org.mortbay.jetty.webapp.WebAppContext;

@@ -28,12 +34,18 @@ public class Container {
   public static final String HTTPS_PORT_PROPERTY = "mocca.http.port";

 

   private static Log log = LogFactory.getLog(Container.class);

+  static {

+    if (log.isDebugEnabled()) {

+      //Jetty log INFO and WARN, include ignored exceptions

+      //jetty logging may be further restricted by setting level in log4j.properties

+      System.setProperty("VERBOSE", "true");

+      //do not set Jetty DEBUG logging, produces loads of output

+      //System.setProperty("DEBUG", "true");

+    }

+  }

 

   private Server server;

 

-  public Container() {

-  }

-

   public void init() throws IOException {

 //    System.setProperty("DEBUG", "true");

     server = new Server();

@@ -55,15 +67,15 @@ public class Container {
     sslConnector.setPort(Integer.getInteger(HTTPS_PORT_PROPERTY, 3496).intValue());

     sslConnector.setAcceptors(1);

     sslConnector.setHost("127.0.0.1");

-    File configDir = new File(System.getProperty("user.home") + "/" + BKULauncher.CONFIG_DIR);

-    File keystoreFile = new File(configDir, BKULauncher.KEYSTORE_FILE);

+    File configDir = new File(System.getProperty("user.home") + "/" + Configurator.CONFIG_DIR);

+    File keystoreFile = new File(configDir, Configurator.KEYSTORE_FILE);

     if (!keystoreFile.canRead()) {

       log.error("MOCCA keystore file not readable: " + keystoreFile.getAbsolutePath());

       throw new FileNotFoundException("MOCCA keystore file not readable: " + keystoreFile.getAbsolutePath());

     }

     log.debug("loading MOCCA keystore from " + keystoreFile.getAbsolutePath());

     sslConnector.setKeystore(keystoreFile.getAbsolutePath());

-    File passwdFile = new File(configDir, BKULauncher.PASSWD_FILE);

+    File passwdFile = new File(configDir, Configurator.PASSWD_FILE);

     BufferedReader reader = new BufferedReader(new FileReader(passwdFile));

     String pwd;

     while ((pwd = reader.readLine()) != null) {

@@ -107,7 +119,6 @@ public class Container {
 

     sslConnector.setExcludeCipherSuites(RFC4492CipherSuites);

 

-

     server.setConnectors(new Connector[] { connector, sslConnector });

     

     WebAppContext webapp = new WebAppContext();

@@ -116,13 +127,13 @@ public class Container {
     webapp.setExtractWAR(true); 

     webapp.setParentLoaderPriority(false);

 

-    webapp.setWar(copyWebapp(webapp.getTempDirectory())); //getClass().getClassLoader().getResource("BKULocalWar/").toString());

-

+    webapp.setWar(copyWebapp(webapp.getTempDirectory()));

+    webapp.setPermissions(getPermissions(webapp.getTempDirectory()));

+    

     server.setHandler(webapp);

     server.setGracefulShutdown(1000*3);

   }

 

-

   private String copyWebapp(File webappDir) throws IOException {

     File webapp = new File(webappDir, "BKULocal.war");

     log.debug("copying BKULocal classpath resource to " + webapp);

@@ -133,6 +144,44 @@ public class Container {
     return webapp.getPath();

   }

 

+  private Permissions getPermissions(File webappDir) {

+    Permissions perms = new Permissions();

+

+    // jetty-webstart (spring?)

+    perms.add(new RuntimePermission("getClassLoader"));

+

+    // standard permissions

+    perms.add(new PropertyPermission("*", "read"));

+    perms.add(new RuntimePermission("accessDeclaredMembers"));

+    perms.add(new RuntimePermission("accessClassInPackage.*"));

+    perms.add(new RuntimePermission("defineClassInPackage.*"));

+    perms.add(new RuntimePermission("setFactory"));

+    perms.add(new RuntimePermission("getProtectionDomain"));

+    perms.add(new RuntimePermission("modifyThread"));

+    perms.add(new RuntimePermission("modifyThreadGroup"));

+    perms.add(new RuntimePermission("setFactory"));

+    perms.add(new ReflectPermission("suppressAccessChecks"));

+

+    // MOCCA specific

+    perms.add(new SocketPermission("*", "connect,resolve"));

+    perms.add(new NetPermission("specifyStreamHandler"));

+    perms.add(new SecurityPermission("insertProvider.*"));

+    perms.add(new SecurityPermission("putProviderProperty.*"));

+    perms.add(new SecurityPermission("removeProvider.*"));

+    perms.add(new CardPermission("*", "*"));

+    perms.add(new AWTPermission("*"));

+

+    perms.add(new FilePermission(webappDir.getAbsolutePath() + "/-", "read"));

+    perms.add(new FilePermission(new File(System.getProperty("java.home") + "/lib/xalan.properties").getAbsolutePath(), "read"));

+    perms.add(new FilePermission(new File(System.getProperty("java.home") + "/lib/xerces.properties").getAbsolutePath(), "read"));

+    perms.add(new FilePermission(new File(System.getProperty("user.home")).getAbsolutePath(), "read, write"));

+    perms.add(new FilePermission(new File(System.getProperty("user.home") + "/-").getAbsolutePath(), "read, write"));

+    perms.add(new FilePermission(new File(System.getProperty("user.home") + "/.mocca/logs/*").getAbsolutePath(), "read, write,delete"));

+

+

+    return perms;

+  }

+

   public void start() throws Exception {

     server.start();

   }

diff --git a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Launcher.java b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Launcher.java
new file mode 100644
index 00000000..f7be7b65
--- /dev/null
+++ b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Launcher.java
@@ -0,0 +1,230 @@
+package at.gv.egiz.bku.webstart;

+

+import iaik.asn1.CodingException;

+import java.io.IOException;

+import java.net.URISyntaxException;

+import java.util.Locale;

+import java.util.MissingResourceException;

+import java.util.ResourceBundle;

+

+import javax.jnlp.UnavailableServiceException;

+import org.apache.commons.logging.Log;

+import org.apache.commons.logging.LogFactory;

+

+import at.gv.egiz.bku.webstart.ui.BKUControllerInterface;

+import at.gv.egiz.bku.webstart.ui.TrayIconDialog;

+import com.sun.javaws.security.JavaWebStartSecurity;

+import java.awt.Desktop;

+import java.awt.SplashScreen;

+import java.net.BindException;

+import java.net.URI;

+import java.net.URL;

+import java.security.GeneralSecurityException;

+import java.util.jar.Attributes;

+import java.util.jar.Manifest;

+import javax.jnlp.BasicService;

+import javax.jnlp.ServiceManager;

+import org.mortbay.util.MultiException;

+

+public class Launcher implements BKUControllerInterface {

+

+  public static final String WEBAPP_RESOURCE = "BKULocal.war";

+  public static final String CERTIFICATES_RESOURCE = "BKUCertificates.jar";

+  public static final String WEBAPP_FILE = "BKULocal.war";

+  public static final String MESSAGES_RESOURCE = "at/gv/egiz/bku/webstart/ui/UIMessages";

+  /** resource bundle messages */

+  public static final String GREETING_CAPTION = "Greetings.Caption";

+  public static final String GREETING_MESSAGE = "Greetings.Message";

+  public static final String CONFIG_CAPTION = "Config.Caption";

+  public static final String CONFIG_MESSAGE = "Config.Message";

+  public static final String STARTUP_CAPTION = "Startup.Caption";

+  public static final String STARTUP_MESSAGE = "Startup.Message";

+  public static final String ERROR_CAPTION = "Error.Caption";

+  public static final String ERROR_STARTUP_MESSAGE = "Error.Startup.Message";

+  public static final String ERROR_CONF_MESSAGE = "Error.Conf.Message";

+  public static final String ERROR_BIND_MESSAGE = "Error.Bind.Message";

+  public static final URI HTTPS_SECURITY_LAYER_URI;

+  private static Log log = LogFactory.getLog(Launcher.class);

+

+  static {

+    URI tmp = null;

+    try {

+      tmp = new URI("https://localhost:" + Integer.getInteger(Container.HTTPS_PORT_PROPERTY, 3496).intValue());

+    } catch (URISyntaxException ex) {

+      log.error(ex);

+    } finally {

+      HTTPS_SECURITY_LAYER_URI = tmp;

+    }

+  }

+

+  public static final String version;

+  static {

+    String tmp = Configurator.UNKOWN_VERSION;

+    try {

+      String bkuWebStartJar = Launcher.class.getProtectionDomain().getCodeSource().getLocation().toString();

+      URL manifestURL = new URL("jar:" + bkuWebStartJar + "!/META-INF/MANIFEST.MF");

+      if (log.isTraceEnabled()) {

+        log.trace("read version information from " + manifestURL);

+      }

+      Manifest manifest = new Manifest(manifestURL.openStream());

+      Attributes atts = manifest.getMainAttributes();

+      if (atts != null) {

+        tmp = atts.getValue("Implementation-Build");

+      }

+    } catch (IOException ex) {

+      log.error("failed to read version", ex);

+    } finally {

+      version = tmp;

+      log.info("BKU Web Start " + version);

+    }

+  }

+

+  private Configurator config;

+  private Container server;

+  private BasicService basicService;

+

+  private void initStart() {

+    try {

+      basicService = (BasicService) ServiceManager.lookup("javax.jnlp.BasicService");

+      if (basicService.isOffline()) {

+        log.info("launching MOCCA Web Start offline");

+      } else {

+        log.info("launching MOCCA Web Start online");

+      }

+    } catch (UnavailableServiceException ex) {

+      log.info("Failed to obtain JNLP service: " + ex.getMessage());

+    }

+  }

+

+  private void initTrayIcon() {

+    log.debug("init MOCCA tray icon");

+    Locale loc = Locale.getDefault();

+    ResourceBundle resourceBundle;

+    try {

+      resourceBundle = ResourceBundle.getBundle(

+              MESSAGES_RESOURCE, loc);

+    } catch (MissingResourceException mx) {

+      resourceBundle = ResourceBundle.getBundle(

+              MESSAGES_RESOURCE, Locale.ENGLISH);

+    }

+    TrayIconDialog.getInstance().init(resourceBundle);

+    TrayIconDialog.getInstance().setShutdownHook(this);

+//    TrayIconDialog.getInstance().displayInfo(GREETING_CAPTION, GREETING_MESSAGE);

+  }

+

+  private void initConfig() throws IOException, CodingException, GeneralSecurityException {

+    config = new Configurator();

+    config.ensureConfiguration();

+    config.ensureCertificates();

+  }

+

+  private void startServer() throws Exception {

+    log.info("init servlet container and MOCCA webapp");

+    server = new Container();

+    server.init();

+    server.start();

+  }

+

+  private void initFinished() {

+    try {

+      // standalone (non-webstart) version has splashscreen

+      if (SplashScreen.getSplashScreen() != null) {

+        try {

+          SplashScreen.getSplashScreen().close();

+        } catch (IllegalStateException ex) {

+          log.warn("Failed to close splash screen: " + ex.getMessage());

+        }

+      }

+      if (config.isCertRenewed()) {

+        // don't use basicService.showDocument(), which causes a java ssl warning dialog

+        if (Desktop.isDesktopSupported()) {

+          Desktop desktop = Desktop.getDesktop();

+          if (desktop.isSupported(Desktop.Action.BROWSE)) {

+            try {

+              desktop.browse(HTTPS_SECURITY_LAYER_URI);

+            } catch (Exception ex) {

+              log.error("failed to open system browser, install TLS certificate manually: " + HTTPS_SECURITY_LAYER_URI, ex);

+            }

+          } else {

+            log.error("failed to open system browser, install TLS certificate manually: " + HTTPS_SECURITY_LAYER_URI);

+          }

+        } else {

+          log.error("failed to open system browser, install TLS certificate manually: " + HTTPS_SECURITY_LAYER_URI);

+        }

+      }

+      log.info("BKU successfully started");

+      server.join();

+    } catch (InterruptedException e) {

+      log.warn("failed to join server: " + e.getMessage(), e);

+    }

+  }

+

+  @Override

+  public void shutDown() {

+    log.info("Shutting down server");

+    if ((server != null) && (server.isRunning())) {

+      try {

+        if (server.isRunning()) {

+          server.stop();

+        }

+      } catch (Exception e) {

+        log.debug(e.toString());

+      } finally {

+        if (server.isRunning()) {

+          server.destroy();

+        }

+      }

+    }

+    System.exit(0);

+  }

+

+  public static void main(String[] args) throws InterruptedException, IOException {

+

+    if (log.isTraceEnabled()) {

+      SecurityManager sm = System.getSecurityManager();

+      if (sm instanceof JavaWebStartSecurity) {

+        System.setSecurityManager(new LogSecurityManager((JavaWebStartSecurity) sm));

+      }

+    }

+

+    Launcher launcher = new Launcher();

+    launcher.initStart();

+    launcher.initTrayIcon(); //keep reference? BKULauncher not garbage collected after main()

+    

+    try {

+      TrayIconDialog.getInstance().displayInfo(CONFIG_CAPTION, CONFIG_MESSAGE);

+      launcher.initConfig();

+    } catch (Exception ex) {

+      log.fatal("Failed to initialize configuration", ex);

+      TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_CONF_MESSAGE);

+      Thread.sleep(5000);

+      System.exit(-1000);

+    }

+

+    try {

+      TrayIconDialog.getInstance().displayInfo(STARTUP_CAPTION, STARTUP_MESSAGE);

+      launcher.startServer();

+      TrayIconDialog.getInstance().displayInfo(GREETING_CAPTION, GREETING_MESSAGE);

+      launcher.initFinished();

+    } catch (BindException ex) {

+      log.fatal("Failed to launch server, " + ex.getMessage(), ex);

+      TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_BIND_MESSAGE);

+      Thread.sleep(5000);

+      System.exit(-1000);

+    } catch (MultiException ex) {

+      log.fatal("Failed to launch server, " + ex.getMessage(), ex);

+      if (ex.getThrowable(0) instanceof BindException) {

+        TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_BIND_MESSAGE);

+      } else {

+        TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_STARTUP_MESSAGE);

+      }

+      Thread.sleep(5000);

+      System.exit(-1000);

+    } catch (Exception e) {

+      log.fatal("Failed to launch server, " + e.getMessage(), e);

+      TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_STARTUP_MESSAGE);

+      Thread.sleep(5000);

+      System.exit(-1000);

+    }

+  }

+}

diff --git a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/LogSecurityManager.java b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/LogSecurityManager.java
new file mode 100644
index 00000000..99fd403b
--- /dev/null
+++ b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/LogSecurityManager.java
@@ -0,0 +1,440 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.webstart;
+
+import com.sun.javaws.security.JavaWebStartSecurity;
+import java.io.FileDescriptor;
+import java.net.InetAddress;
+import java.security.Permission;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ * JVM argument -Djava.security.debug=access,failure
+ * (passed as attribute to java element in jnlp) is ignored.
+ * 
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class LogSecurityManager extends SecurityManager {
+
+  protected static final Log log = LogFactory.getLog(LogSecurityManager.class);
+  JavaWebStartSecurity sm;
+
+  public LogSecurityManager(JavaWebStartSecurity sm) {
+    this.sm = sm;
+//    AppPolicy policy = AppPolicy.getInstance();
+//    SecurityManager sm = System.getSecurityManager();
+  }
+
+  @Override
+  public void checkAccept(String host, int port) {
+    try {
+      sm.checkAccept(host, port);
+    } catch (SecurityException ex) {
+      log.warn("checkAccept(" + host + ", " + port + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkAccess(Thread g) {
+    try {
+      sm.checkAccess(g);
+    } catch (SecurityException ex) {
+      log.warn("checkAccess(" + g + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkAccess(ThreadGroup g) {
+    try {
+      sm.checkAccess(g);
+    } catch (SecurityException ex) {
+      log.warn("checkAccess(" + g + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+
+  }
+
+  @Override
+  public void checkAwtEventQueueAccess() {
+    try {
+      sm.checkAwtEventQueueAccess();
+    } catch (SecurityException ex) {
+      log.warn("checkAwtEventQAccess():" + ex.getMessage(), ex);
+      throw ex;
+    }
+
+  }
+
+  @Override
+  public void checkConnect(String host, int port) {
+    try {
+      sm.checkConnect(host, port);
+    } catch (SecurityException ex) {
+      log.warn("checkConnect(" + host + ", " + port + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkConnect(String host, int port, Object context) {
+    try {
+      sm.checkConnect(host, port, context);
+    } catch (SecurityException ex) {
+      log.warn("checkConnect(" + host + ", " + port + ", " + context + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkCreateClassLoader() {
+    try {
+      sm.checkCreateClassLoader();
+    } catch (SecurityException ex) {
+      log.warn("checkCreateClassLoader(): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkDelete(String file) {
+    try {
+      sm.checkDelete(file);
+    } catch (SecurityException ex) {
+      log.warn("checkDelete(" + file + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkExec(String cmd) {
+    try {
+      sm.checkExec(cmd);
+    } catch (SecurityException ex) {
+      log.warn("checkExec(" + cmd + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkExit(int status) {
+    try {
+      sm.checkExit(status);
+    } catch (SecurityException ex) {
+      log.warn("checkExit(" + status + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkLink(String lib) {
+    try {
+      sm.checkLink(lib);
+    } catch (SecurityException ex) {
+      log.warn("checkLink(" + lib + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkListen(int port) {
+    try {
+      sm.checkListen(port);
+    } catch (SecurityException ex) {
+      log.warn("checkListen(" + port + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkMemberAccess(Class<?> clazz, int which) {
+    try {
+      sm.checkMemberAccess(clazz, which);
+    } catch (SecurityException ex) {
+      log.warn("checkMemberAccess(" + clazz + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkMulticast(InetAddress maddr) {
+    try {
+      sm.checkMulticast(maddr);
+    } catch (SecurityException ex) {
+      log.warn("checkMulticast(" + maddr + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkMulticast(InetAddress maddr, byte ttl) {
+    try {
+      sm.checkMulticast(maddr,ttl);
+    } catch (SecurityException ex) {
+      log.warn("checkMulticast(" + maddr + "," + ttl + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkPackageAccess(String pkg) {
+    try {
+      sm.checkPackageAccess(pkg);
+    } catch (SecurityException ex) {
+      log.warn("checkPackageAccess(" + pkg + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkPackageDefinition(String pkg) {
+    try {
+      sm.checkPackageDefinition(pkg);
+    } catch (SecurityException ex) {
+      log.warn("checkPackageDefinition(" + pkg + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkPermission(Permission perm) {
+    try {
+      sm.checkPermission(perm);
+    } catch (SecurityException ex) {
+      log.warn("checkPermission(" + perm.toString() + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkPermission(Permission perm, Object context) {
+    try {
+      sm.checkPermission(perm, context);
+    } catch (SecurityException ex) {
+      log.warn("checkPermission(" + perm.toString() + ", ctx): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkPrintJobAccess() {
+    try {
+      sm.checkPrintJobAccess();
+    } catch (SecurityException ex) {
+      log.info("checkPrintJobAccess(): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  /**
+   * allowed
+   */
+  @Override
+  public void checkPropertiesAccess() {
+    try {
+      sm.checkPropertiesAccess();
+    } catch (SecurityException ex) {
+      log.info("checkPropertiesAccess(): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  /**
+   * access to all properties allowed
+   * @param key
+   */
+  @Override
+  public void checkPropertyAccess(String key) {
+    try {
+      sm.checkPropertyAccess(key);
+    } catch (SecurityException ex) {
+      log.info("checkPropertyAccess(" + key + "): " + ex.getMessage());
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkRead(FileDescriptor fd) {
+    try {
+      sm.checkRead(fd);
+    } catch (SecurityException ex) {
+      log.warn("checkRead(" + fd + ") " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkRead(String file) {
+    try {
+      sm.checkRead(file);
+    } catch (SecurityException ex) {
+      log.warn("checkRead(" + file + ") " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkRead(String file, Object context) {
+    try {
+      sm.checkRead(file, context);
+    } catch (SecurityException ex) {
+      log.warn("checkRead(" + file + ") " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkSecurityAccess(String target) {
+    try {
+      sm.checkSecurityAccess(target);
+    } catch (SecurityException ex) {
+      log.info("checkSecurityAccess(" + target + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkSetFactory() {
+    log.info("checkSetFactory() ");
+    try {
+      sm.checkSetFactory();
+    } catch (SecurityException ex) {
+      log.warn("checkSetFactroy(): " + ex.getMessage(), ex);
+      throw ex;
+    }
+
+  }
+
+  @Override
+  public void checkSystemClipboardAccess() {
+    try {
+      sm.checkSystemClipboardAccess();
+    } catch (SecurityException ex) {
+      log.info("checkSystemClipboardAccess(): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public boolean checkTopLevelWindow(Object window) {
+    log.info("checkTopLevelWindow(Object window)");
+    try {
+      return sm.checkTopLevelWindow(window);
+    } catch (SecurityException ex) {
+      log.warn("checkTopLevelWindow(" + window + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+
+  }
+
+  @Override
+  public void checkWrite(FileDescriptor fd) {
+    try {
+      sm.checkWrite(fd);
+    } catch (SecurityException ex) {
+      log.info("checkWrite(" + fd + "): " + ex.getMessage(), ex);
+    }
+  }
+
+  @Override
+  public void checkWrite(String file) {
+    try {
+      sm.checkWrite(file);
+    } catch (SecurityException ex) {
+      log.info("checkWrite(" + file + "): " + ex.getMessage(), ex);
+    }
+  }
+
+//  @Override
+//  protected int classDepth(String name) {
+//    log.info("classDepth(String name)"); return this.classDepth(name);
+//  }
+//
+//  @Override
+//  protected int classLoaderDepth() {
+//    log.info("classLoaderDepth"); return sm.classLoaderDepth();
+//  }
+//
+//  @Override
+//  protected Object clone() throws CloneNotSupportedException {
+//    log.info("clone"); return sm.clone();
+//  }
+//
+//  @Override
+//  protected ClassLoader currentClassLoader() {
+//    log.info("currentClassLoader"); return sm.currentClassLoader();
+//  }
+//
+//  @Override
+//  protected Class<?> currentLoadedClass() {
+//    log.info("currentLoadedClass"); return sm.currentLoadedClass();
+//  }
+  @Override
+  public boolean equals(Object obj) {
+    log.info("equals");
+    return sm.equals(obj);
+  }
+
+//  @Override
+//  protected void finalize() throws Throwable {
+//    log.info("finalize"); sm.finalize();
+//  }
+//  @Override
+//  protected Class[] getClassContext() {
+//    log.info("getClassContext"); return sm.getClassContext();
+//  }
+  @Override
+  public boolean getInCheck() {
+    log.info("getInCheck");
+    return sm.getInCheck();
+  }
+
+  @Override
+  public Object getSecurityContext() {
+    log.info("getSecurityContext");
+    return sm.getSecurityContext();
+  }
+
+  @Override
+  public ThreadGroup getThreadGroup() {
+    log.info("getThreadGroup");
+    return sm.getThreadGroup();
+  }
+
+  @Override
+  public int hashCode() {
+    log.info("hashCode");
+    return sm.hashCode();
+  }
+
+//  @Override
+//  protected boolean inClass(String name) {
+//    log.info("inClass"); return sm.inClass(name);
+//  }
+//
+//  @Override
+//  protected boolean inClassLoader() {
+//    log.info(""); return sm.inClassLoader();
+//  }
+  @Override
+  public String toString() {
+    log.info("toString");
+    return sm.toString();
+  }
+}
diff --git a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/ui/TrayIconDialog.java b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/ui/TrayIconDialog.java
index 9990b2a0..fb7c40dd 100644
--- a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/ui/TrayIconDialog.java
+++ b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/ui/TrayIconDialog.java
@@ -36,7 +36,7 @@ import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
 public class TrayIconDialog implements TrayIconDialogInterface {
-  public static final String TRAYICON_RESOURCE = "at/gv/egiz/bku/webstart/ui/trayicon.png";
+  public static final String TRAYICON_RESOURCE = "at/gv/egiz/bku/webstart/ui/trayicon_32.png";
   public static final String TRAYMENU_SHUTDOWN = "TrayMenu.Shutdown";
   public static final String TRAYMENU_TOOLTIP = "TrayMenu.Tooltip";
 
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_16.ico b/BKUWebStart/src/main/jnlp/resources/img/logo_16.ico
new file mode 100644
index 00000000..eaedb0ad
--- /dev/null
+++ b/BKUWebStart/src/main/jnlp/resources/img/logo_16.ico
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_16.png b/BKUWebStart/src/main/jnlp/resources/img/logo_16.png
new file mode 100644
index 00000000..f84f108d
--- /dev/null
+++ b/BKUWebStart/src/main/jnlp/resources/img/logo_16.png
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_16.xpm b/BKUWebStart/src/main/jnlp/resources/img/logo_16.xpm
new file mode 100644
index 00000000..de557170
--- /dev/null
+++ b/BKUWebStart/src/main/jnlp/resources/img/logo_16.xpm
@@ -0,0 +1,274 @@
+/* XPM */
+static char * logo_16x16_xpm[] = {
+"16 16 255 2",
+"  	c #EDF2FA",
+". 	c #555249",
+"+ 	c #F3F6FC",
+"@ 	c #ED1C24",
+"# 	c #939698",
+"$ 	c #FFE699",
+"% 	c #BBAA76",
+"& 	c #464749",
+"* 	c #CCCCCC",
+"= 	c #EE262D",
+"- 	c #FCDADC",
+"; 	c #6B6E72",
+"> 	c #FDE4E5",
+", 	c #D0D6DE",
+"' 	c #968C78",
+") 	c #848182",
+"! 	c #535458",
+"~ 	c #76797E",
+"{ 	c #EE2C33",
+"] 	c #444444",
+"^ 	c #80848A",
+"/ 	c #5A636E",
+"( 	c #738974",
+"_ 	c #ACAEB1",
+": 	c #929F98",
+"< 	c #47443F",
+"[ 	c #363436",
+"} 	c #E4ECF7",
+"| 	c #5D5E61",
+"1 	c #F14C53",
+"2 	c #A2A3A5",
+"3 	c #EF333A",
+"4 	c #515052",
+"5 	c #5C685E",
+"6 	c #FDEAEB",
+"7 	c #7A7B7D",
+"8 	c #9FA1A4",
+"9 	c #FBFCFE",
+"0 	c #4B514D",
+"a 	c #888A8C",
+"b 	c #777777",
+"c 	c #525355",
+"d 	c #E7EEF8",
+"e 	c #A4A9AF",
+"f 	c #F04148",
+"g 	c #FFF4D7",
+"h 	c #616365",
+"i 	c #231F20",
+"j 	c #D4DDE9",
+"k 	c #918F8F",
+"l 	c #8A8E95",
+"m 	c #F1CA3F",
+"n 	c #B5BBC5",
+"o 	c #F1F1F1",
+"p 	c #9FA5AD",
+"q 	c #363432",
+"r 	c #888888",
+"s 	c #FFFFFF",
+"t 	c #7D745A",
+"u 	c #94875D",
+"v 	c #999999",
+"w 	c #5F6165",
+"x 	c #635E51",
+"y 	c #C8C7C7",
+"z 	c #CAD1DD",
+"A 	c #5A5758",
+"B 	c #C0C7D1",
+"C 	c #9399A1",
+"D 	c #E4C14B",
+"E 	c #AE9B5E",
+"F 	c #BAB9B9",
+"G 	c #C9AE59",
+"H 	c #767374",
+"I 	c #D6D5D5",
+"J 	c #DDDDDD",
+"K 	c #666666",
+"L 	c #E3E3E3",
+"M 	c #ACABAB",
+"N 	c #222222",
+"O 	c #9E9D9D",
+"P 	c #333333",
+"Q 	c #EEEEEE",
+"R 	c #BBA55C",
+"S 	c #BBBBBB",
+"T 	c #706A56",
+"U 	c #3F3B3C",
+"V 	c #A1915E",
+"W 	c #686566",
+"X 	c #AAB0B9",
+"Y 	c #111111",
+"Z 	c #444344",
+"` 	c #897E5C",
+" .	c #4C494A",
+"..	c #669DCD",
+"+.	c #C6C8CA",
+"@.	c #555556",
+"#.	c #312D2E",
+"$.	c #5F6A78",
+"%.	c #6C95BC",
+"&.	c #D6B853",
+"*.	c #525962",
+"=.	c #636467",
+"-.	c #6C8AAA",
+";.	c #E1E2E3",
+">.	c #DE9E56",
+",.	c #70B76A",
+"'.	c #6C90B3",
+").	c #AB875E",
+"!.	c #F2575D",
+"~.	c #B9BBBD",
+"{.	c #FFF1CC",
+"].	c #424347",
+"^.	c #4A4E55",
+"/.	c #637183",
+"(.	c #ED2028",
+"_.	c #65778C",
+":.	c #688268",
+"<.	c #7C7F81",
+"[.	c #706355",
+"}.	c #B88E5F",
+"|.	c #C5945D",
+"1.	c #565E58",
+"2.	c #D9ECD4",
+"3.	c #72A26F",
+"4.	c #72AA6E",
+"5.	c #FBB161",
+"6.	c #AAAAAA",
+"7.	c #937A5D",
+"8.	c #6B84A0",
+"9.	c #FFEDB5",
+"0.	c #F1CE5D",
+"a.	c #FFDBB4",
+"b.	c #697E96",
+"c.	c #EAA151",
+"d.	c #92CD8B",
+"e.	c #77C371",
+"f.	c #7C6C59",
+"g.	c #719B6E",
+"h.	c #FCBB75",
+"i.	c #FFD742",
+"j.	c #606162",
+"k.	c #6C6C6E",
+"l.	c #E2E3E4",
+"m.	c #6999C5",
+"n.	c #D4D5D7",
+"o.	c #F7F9FD",
+"p.	c #635950",
+"q.	c #F0F0F1",
+"r.	c #FDE3E4",
+"s.	c #706F6D",
+"t.	c #FFDD6F",
+"u.	c #787E88",
+"v.	c #D6BC69",
+"w.	c #EEEFF0",
+"x.	c #63615A",
+"y.	c #89C982",
+"z.	c #AEA58E",
+"A.	c #F3F9F1",
+"B.	c #4D5056",
+"C.	c #6E926C",
+"D.	c #6C8A6A",
+"E.	c #E4C564",
+"F.	c #77A0C8",
+"G.	c #898169",
+"H.	c #FFF7EE",
+"I.	c #333336",
+"J.	c #727878",
+"K.	c #AE9D66",
+"L.	c #607160",
+"M.	c #6B756F",
+"N.	c #71B16C",
+"O.	c #948A6C",
+"P.	c #7DC479",
+"Q.	c #D6BA5E",
+"R.	c #E1F0DE",
+"S.	c #ADD8A4",
+"T.	c #6E737C",
+"U.	c #9E8262",
+"V.	c #535D54",
+"W.	c #7D7766",
+"X.	c #A1A6AD",
+"Y.	c #D3D4D7",
+"Z.	c #ADAAA6",
+"`.	c #B7B9BC",
+" +	c #C39765",
+".+	c #F25E64",
+"++	c #F36268",
+"@+	c #769C74",
+"#+	c #B69166",
+"$+	c #F9FBFD",
+"%+	c #FFFBFB",
+"&+	c #FFE07C",
+"*+	c #646B68",
+"=+	c #6D6965",
+"-+	c #738498",
+";+	c #C8BEA3",
+">+	c #C1C4C9",
+",+	c #A19984",
+"'+	c #E4C979",
+")+	c #F1D375",
+"!+	c #80C679",
+"~+	c #B3B6BC",
+"{+	c #8D9096",
+"]+	c #9FA8A1",
+"^+	c #CFD9CE",
+"/+	c #FED5A9",
+"(+	c #D5D9E0",
+"_+	c #8D877F",
+":+	c #697B6A",
+"<+	c #FFFBF0",
+"[+	c #E3D4AC",
+"}+	c #F1CC4F",
+"|+	c #FFD954",
+"1+	c #C8E4C0",
+"2+	c #BEE0B7",
+"3+	c #D6BE73",
+"4+	c #857869",
+"5+	c #E5E1DC",
+"6+	c #85A7CB",
+"7+	c #C9B26C",
+"8+	c #D4C6B5",
+"9+	c #C9B67E",
+"0+	c #FFE5CA",
+"a+	c #FCB66B",
+"b+	c #E4E4E5",
+"c+	c #E3E4E5",
+"d+	c #E8EBEF",
+"e+	c #EBEDF0",
+"f+	c #87898C",
+"g+	c #B19E7E",
+"h+	c #B5C2BF",
+"i+	c #FDC180",
+"j+	c #EE2930",
+"k+	c #E4E8EE",
+"l+	c #565552",
+"m+	c #E4CE8D",
+"n+	c #636C79",
+"o+	c #A3D49B",
+"p+	c #858B94",
+"q+	c #84868C",
+"r+	c #F1D069",
+"s+	c #D2995A",
+"t+	c #B8BEC6",
+"u+	c #EF3B42",
+"v+	c #474444",
+"w+	c #E1E5EC",
+"x+	c #FDFEFE",
+"y+	c #FFF7E3",
+"z+	c #62A1D7",
+"A+	c #6DC067",
+"B+	c #FAA74A",
+"C+	c #FFD531",
+"D+	c #E0EAF7",
+"E+	c #000000",
+"F+	c #FFFFFF",
+"  9 _ & < K.i.u i T R C+G x C+C+",
+"+.& < E C+R . q q u C+C+T G C+C+",
+"i t m m T q u m m x . m . C+C+C+",
+"t D t q ` m C+C+C+C+t . < G E t ",
+"x . E m C+C+C+C+C+C+C+. T u E m ",
+"i m C+C+C+C+C+C+C+C+m T t C+C+C+",
+"< V C+C+C+C+C+m D ` q x &.C+C+C+",
+"G < C+C+C+E < . i x G C+C+C+C+C+",
+"C+x V E < x E &.i G C+C+C+C+C+C+",
+"}+` i ` D C+C+C+x x C+C+C+C+C+C+",
+". R t E C+C+C+C+G i G C+C+C+C+C+",
+"l+i.m x C+C+C+C+C+< x C+C+C+C+C+",
+"i 7+C+u G C+C+E < q i G C+C+C+C+",
+"i x.C+C+t E < x R C+< t C+C+C+C+",
+"& i '+G x x D C+C+C+E i D C+C+C+",
+"_ i [ V m u C+C+C+C+D i T m u < "};
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_32.png b/BKUWebStart/src/main/jnlp/resources/img/logo_32.png
new file mode 100644
index 00000000..337b144b
--- /dev/null
+++ b/BKUWebStart/src/main/jnlp/resources/img/logo_32.png
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_64.gif b/BKUWebStart/src/main/jnlp/resources/img/logo_64.gif
new file mode 100644
index 00000000..6081d1a1
--- /dev/null
+++ b/BKUWebStart/src/main/jnlp/resources/img/logo_64.gif
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_64.jpeg b/BKUWebStart/src/main/jnlp/resources/img/logo_64.jpeg
new file mode 100644
index 00000000..720157a5
--- /dev/null
+++ b/BKUWebStart/src/main/jnlp/resources/img/logo_64.jpeg
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_64.png b/BKUWebStart/src/main/jnlp/resources/img/logo_64.png
new file mode 100644
index 00000000..9e9b377c
--- /dev/null
+++ b/BKUWebStart/src/main/jnlp/resources/img/logo_64.png
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_64x64.png b/BKUWebStart/src/main/jnlp/resources/img/logo_64x64.png
deleted file mode 100644
index fa6d7f96..00000000
--- a/BKUWebStart/src/main/jnlp/resources/img/logo_64x64.png
+++ /dev/null
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_90x90.png b/BKUWebStart/src/main/jnlp/resources/img/logo_90x90.png
deleted file mode 100644
index d7f8bbd0..00000000
--- a/BKUWebStart/src/main/jnlp/resources/img/logo_90x90.png
+++ /dev/null
diff --git a/BKUWebStart/src/main/jnlp/resources/img/version.xml b/BKUWebStart/src/main/jnlp/resources/img/version.xml
index 715b6722..31f43441 100644
--- a/BKUWebStart/src/main/jnlp/resources/img/version.xml
+++ b/BKUWebStart/src/main/jnlp/resources/img/version.xml
@@ -2,10 +2,38 @@
 <jnlp-versions>
   <resource>
     <pattern>
-      <name>logo.png</name>
+      <name>logo_16.xpm</name>
       <version-id>1.0-SNAPSHOT</version-id>
     </pattern>
-    <file>logo.png</file>
+    <file>logo_16.xpm</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>logo_16.ico</name>
+      <version-id>1.0-SNAPSHOT</version-id>
+    </pattern>
+    <file>logo_16.ico</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>logo_16.png</name>
+      <version-id>1.0-SNAPSHOT</version-id>
+    </pattern>
+    <file>logo_16.png</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>logo_32.png</name>
+      <version-id>1.0-SNAPSHOT</version-id>
+    </pattern>
+    <file>logo_32.png</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>logo_64.png</name>
+      <version-id>1.0-SNAPSHOT</version-id>
+    </pattern>
+    <file>logo_64.png</file>
   </resource>
   <resource>
     <pattern>
diff --git a/BKUWebStart/src/main/jnlp/resources/version.xml b/BKUWebStart/src/main/jnlp/resources/version.xml
index 763552fc..47c17088 100644
--- a/BKUWebStart/src/main/jnlp/resources/version.xml
+++ b/BKUWebStart/src/main/jnlp/resources/version.xml
@@ -2,12 +2,11 @@
 <jnlp-versions>
   <resource>
     <pattern>
-      <name>BKUWebStart-1.0.5-SNAPSHOT.jar</name>
-      <version-id>1.0.5-SNAPSHOT</version-id>
+      <name>BKUWebStart-1.0.9-SNAPSHOT.jar</name>
+      <version-id>1.0.9-SNAPSHOT</version-id>
     </pattern>
-    <file>BKUWebStart-1.0.5-SNAPSHOT.jar</file>
+    <file>BKUWebStart-1.0.9-SNAPSHOT.jar</file>
   </resource>
-
   <resource>
     <pattern>
       <name>utils-1.2.1-SNAPSHOT.jar</name>
@@ -15,13 +14,20 @@
     </pattern>
     <file>utils-1.2.1-SNAPSHOT.jar</file>
   </resource>
+  <resource>
+    <pattern>
+      <name>BKUCertificates-1.0-SNAPSHOT.jar</name>
+      <version-id>1.0-SNAPSHOT</version-id>
+    </pattern>
+    <file>BKUCertificates-1.0-SNAPSHOT.jar</file>
+  </resource>
 
   <resource>
     <pattern>
-      <name>commons-logging-1.0.4.jar</name>
-      <version-id>1.0.4</version-id>
+      <name>commons-logging-1.1.1.jar</name>
+      <version-id>1.1.1</version-id>
     </pattern>
-    <file>commons-logging-1.0.4.jar</file>
+    <file>commons-logging-1.1.1.jar</file>
   </resource>
 
   <resource>
@@ -64,17 +70,17 @@
 
   <resource>
     <pattern>
-      <name>jetty-6.1.15.jar</name>
-      <version-id>6.1.15</version-id>
+      <name>jetty-6.1.19.jar</name>
+      <version-id>6.1.19</version-id>
     </pattern>
-    <file>jetty-6.1.15.jar</file>
+    <file>jetty-6.1.19.jar</file>
   </resource>
   <resource>
     <pattern>
-      <name>jetty-util-6.1.15.jar</name>
-      <version-id>6.1.15</version-id>
+      <name>jetty-util-6.1.19.jar</name>
+      <version-id>6.1.19</version-id>
     </pattern>
-    <file>jetty-util-6.1.15.jar</file>
+    <file>jetty-util-6.1.19.jar</file>
   </resource>
   <resource>
     <pattern>
@@ -83,6 +89,55 @@
     </pattern>
     <file>servlet-api-2.5-20081211.jar</file>
   </resource>
+  <resource>
+    <pattern>
+      <name>jsp-2.1-jetty-6.1.19.jar</name>
+      <version-id>6.1.19</version-id>
+    </pattern>
+    <file>jsp-2.1-jetty-6.1.19.jar</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>jsp-2.1-glassfish-9.1.1.B60.25.p0.jar</name>
+      <version-id>9.1.1.B60.25.p0</version-id>
+    </pattern>
+    <file>jsp-2.1-glassfish-9.1.1.B60.25.p0.jar</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>jsp-api-2.1-glassfish-9.1.1.B60.25.p0.jar</name>
+      <version-id>9.1.1.B60.25.p0</version-id>
+    </pattern>
+    <file>jsp-api-2.1-glassfish-9.1.1.B60.25.p0.jar</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>ant-1.6.5.jar</name>
+      <version-id>1.6.5</version-id>
+    </pattern>
+    <file>ant-1.6.5.jar</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>core-3.1.1.jar</name>
+      <version-id>3.1.1</version-id>
+    </pattern>
+    <file>core-3.1.1.jar</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>slf4j-api-1.5.8.jar</name>
+      <version-id>1.5.8</version-id>
+    </pattern>
+    <file>slf4j-api-1.5.8.jar</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>slf4j-log4j12-1.5.8.jar</name>
+      <version-id>1.5.8</version-id>
+    </pattern>
+    <file>slf4j-log4j12-1.5.8.jar</file>
+  </resource>
 
   <resource>
     <pattern>
diff --git a/BKUWebStart/src/main/jnlp/template-local.xml b/BKUWebStart/src/main/jnlp/template-local.xml
new file mode 100644
index 00000000..9135ba1b
--- /dev/null
+++ b/BKUWebStart/src/main/jnlp/template-local.xml
@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="utf-8"?>
+<jnlp spec="$jnlpspec" codebase="file:/home/clemens/workspace/bku/BKUWebStart/target/jnlp" href="$outputFile">
+
+  <information>
+    <!--title>$project.Name</title-->
+    <title>$project.Description</title>
+    <!--vendor>$project.Organization.Name</vendor-->
+    <vendor>E-Government Innovationszentrum (EGIZ)</vendor>
+    <homepage href="$project.Url"/>
+    <description>$project.Description (BKU) MOCCA Web Start</description>
+    <description kind="short">$project.Description</description>
+    <!--icon kind="shortcut" href="img/logo_16.ico" width="16" height="16" version="1.0-SNAPSHOT"/-->
+    <icon kind="shortcut" href="img/logo_32.png" width="32" height="32"/>
+    <icon kind="default" href="img/logo_32.png" width="32" height="32"/>
+    <icon kind="default" href="img/logo_64.png" width="64" height="64"/>
+    <icon kind="splash" href="img/splash.png"/>
+    <shortcut online="false">
+      <desktop/>
+      <menu submenu="e-Government"/>
+    </shortcut>
+
+#if($offlineAllowed)
+    <offline-allowed/>
+#end
+
+  </information>
+  
+#if($allPermissions)
+  <security>
+    <all-permissions/>
+  </security>
+#end
+
+  <update check="timeout" policy="prompt-update"/>
+
+  <resources>
+    <java version="$j2seVersion" java-vm-args="-Djava.security.debug=access,failure"/>
+     $dependencies
+  </resources>
+
+  <application-desc main-class="$mainClass"/>
+</jnlp>
\ No newline at end of file
diff --git a/BKUWebStart/src/main/jnlp/template.xml b/BKUWebStart/src/main/jnlp/template.xml
index a6f6d96e..0176376a 100644
--- a/BKUWebStart/src/main/jnlp/template.xml
+++ b/BKUWebStart/src/main/jnlp/template.xml
@@ -4,12 +4,16 @@
   <information>
     <!--title>$project.Name</title-->
     <title>$project.Description</title>
-    <vendor>$project.Organization.Name</vendor>
+    <!--vendor>$project.Organization.Name</vendor-->
+    <vendor>E-Government Innovationszentrum (EGIZ)</vendor>
     <homepage href="$project.Url"/>
-    <description>$project.Description</description>
+    <description>$project.Description (BKU) MOCCA Web Start</description>
     <description kind="short">$project.Description</description>
-    <icon href="img/logo.png" kind="default" version="1.0-SNAPSHOT"/>
-    <icon href="img/splash.png" kind="splash" version="1.0-SNAPSHOT"/>
+    <!--icon kind="shortcut" href="img/logo_16.ico" width="16" height="16" version="1.0-SNAPSHOT"/-->
+    <icon kind="shortcut" href="img/logo_32.png" width="32" height="32" version="1.0-SNAPSHOT"/>
+    <icon kind="default" href="img/logo_32.png" width="32" height="32" version="1.0-SNAPSHOT"/>
+    <icon kind="default" href="img/logo_64.png" width="64" height="64" version="1.0-SNAPSHOT"/>
+    <icon kind="splash" href="img/splash.png" version="1.0-SNAPSHOT"/>
     <shortcut online="false">
       <desktop/>
       <menu submenu="e-Government"/>
@@ -20,23 +24,23 @@
 #end
 
   </information>
-
-
+  
 #if($allPermissions)
   <security>
     <all-permissions/>
   </security>
 #end
 
+  <update check="timeout" policy="prompt-update"/>
+
   <resources os="Mac OS X">
-    <j2se version="$j2seVersion" java-vm-args="-d32"/>
+    <java version="$j2seVersion" java-vm-args="-d32"/>
     <property name="jnlp.versionEnabled" value="true"/>
      $dependencies
   </resources>
 
   <resources>
-    <!-- initial-heap-size="32m" max-heap-size="128m" -->
-    <j2se version="$j2seVersion"/>
+    <java version="$j2seVersion"/>
     <property name="jnlp.versionEnabled" value="true"/>
      $dependencies
   </resources>
diff --git a/BKUWebStart/src/main/jnlp/template_dev.xml b/BKUWebStart/src/main/jnlp/template_dev.xml
deleted file mode 100644
index 2d8e8133..00000000
--- a/BKUWebStart/src/main/jnlp/template_dev.xml
+++ /dev/null
@@ -1,39 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<jnlp spec="$jnlpspec" codebase="$project.Url" href="$outputFile">
-
-  <information>
-    <title>$project.Name</title>
-    <vendor>$project.Organization.Name</vendor>
-    <homepage href="$project.Url"/>
-    <description>$project.Description</description>
-    <description kind="short">$project.Description</description>
-    <icon href="img/logo.png" kind="default" version="1.0-SNAPSHOT"/>
-    <icon href="img/splash.png" kind="splash" version="1.0-SNAPSHOT"/>
-    <shortcut online="false">
-      <desktop/>
-      <menu submenu="e-Government"/>
-    </shortcut>
-
-#if($offlineAllowed)
-    <offline-allowed/>
-#end
-
-  </information>
-
-
-#if($allPermissions)
-  <security>
-    <all-permissions/>
-  </security>
-#end
-
-  <resources>
-    <!-- initial-heap-size="32m" max-heap-size="128m" -->
-    <j2se version="$j2seVersion"/>
-    <property name="jnlp.versionEnabled" value="true"/>
-
-     $dependencies
-
-  </resources>
-  <application-desc main-class="$mainClass"/>
-</jnlp>
\ No newline at end of file
diff --git a/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/conf/conf.zip b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/conf/conf.zip
new file mode 100644
index 00000000..1df56e5c
--- /dev/null
+++ b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/conf/conf.zip
diff --git a/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/conf/configuration.zip b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/conf/configuration.zip
deleted file mode 100644
index 74465445..00000000
--- a/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/conf/configuration.zip
+++ /dev/null
diff --git a/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/UIMessages.properties b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/UIMessages.properties
index eb2b74c0..bf4e5b8a 100644
--- a/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/UIMessages.properties
+++ b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/UIMessages.properties
@@ -1,11 +1,13 @@
 #-------- tray icon messages -------

-TrayMenu.Tooltip=B\u00FCrgerkartenumgebung (MOCCA Web Start)

+TrayMenu.Tooltip=B\u00FCrgerkartenumgebung

 TrayMenu.Shutdown=B\u00FCrgerkartenumgebung beenden

 

+Config.Message=Zertifikate werden geladen

+Config.Caption=B\u00FCrgerkartenumgebung

 Startup.Message=B\u00FCrgerkartenumgebung wird gestartet...

-Startup.Caption=B\u00FCrgerkartenumgebung (MOCCA Web Start)

+Startup.Caption=B\u00FCrgerkartenumgebung

 Greetings.Message=B\u00FCrgerkartenumgebung erfolgreich gestartet

-Greetings.Caption=B\u00FCrgerkartenumgebung (MOCCA Web Start)

+Greetings.Caption=B\u00FCrgerkartenumgebung

 Error.Caption=Fehler

 Error.Startup.Message=B\u00FCrgerkartenumgebung konnte nicht gestartet werden

 Error.Conf.Message=Konfiguration konnte nicht initialisiert werden, B\u00FCrberkartenumgebung wird nicht gestartet

diff --git a/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/trayicon.png b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/trayicon.png
deleted file mode 100644
index 2c622d88..00000000
--- a/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/trayicon.png
+++ /dev/null
diff --git a/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/trayicon_16.png b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/trayicon_16.png
new file mode 100644
index 00000000..f84f108d
--- /dev/null
+++ b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/trayicon_16.png
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo.png b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/trayicon_32.png
index 2c622d88..2c622d88 100644
--- a/BKUWebStart/src/main/jnlp/resources/img/logo.png
+++ b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/trayicon_32.png
diff --git a/BKUWebStart/src/main/resources/log4j.properties b/BKUWebStart/src/main/resources/log4j.properties
index 4df33ab5..76de3576 100644
--- a/BKUWebStart/src/main/resources/log4j.properties
+++ b/BKUWebStart/src/main/resources/log4j.properties
@@ -1,5 +1,24 @@
+# Copyright 2008 Federal Chancellery Austria and
+# Graz University of Technology
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # loglever DEBUG, appender STDOUT
-log4j.rootLogger=TRACE, STDOUT, file
+log4j.rootLogger=DEBUG, file
+log4j.logger.org.mortbay.log=INFO
+log4j.logger.pki=INFO
+
+log4j.additivity.pki=false
 
 # STDOUT appender
 log4j.appender.STDOUT=org.apache.log4j.ConsoleAppender
@@ -13,4 +32,4 @@ log4j.appender.file=org.apache.log4j.DailyRollingFileAppender
 log4j.appender.file.datePattern='.'yyyy-MM-dd
 log4j.appender.file.File=${user.home}/.mocca/logs/webstart.log
 log4j.appender.file.layout=org.apache.log4j.PatternLayout
-log4j.appender.file.layout.ConversionPattern=%d{ABSOLUTE} %5p %c{1}:%L - %m%n
\ No newline at end of file
+log4j.appender.file.layout.ConversionPattern=%d{ABSOLUTE} %-5p %c{1}:%L - %m%n
\ No newline at end of file