1.1-rc2

git-svn-id: https://joinup.ec.europa.eu/svn/mocca/trunk@310 8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4

8 files changed, 141 insertions, 79 deletions

diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/CardMgmtGUI.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/CardMgmtGUI.java
index 4059f0e2..ac9ab78b 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/CardMgmtGUI.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/CardMgmtGUI.java
@@ -40,6 +40,12 @@ public class CardMgmtGUI extends BKUGUIImpl {
           AbstractHelpListener helpListener) {
     super(contentPane, locale, guiStyle, backgroundImgURL, helpListener);
 
+  }
+
+  @Override
+  protected void loadMessageBundle(Locale locale) {
+    super.loadMessageBundle(locale);
+
     if (locale != null) {
         Locale lang = new Locale(locale.getLanguage().substring(0,2));
         log.debug("loading applet resources for language: " + lang.toString());
@@ -47,6 +53,18 @@ public class CardMgmtGUI extends BKUGUIImpl {
     } else {
         cardmgmtMessages = ResourceBundle.getBundle(CARDMGMT_MESSAGES_BUNDLE);
     }
+  }
+
+  @Override
+  protected String getMessage(String key) {
+    if (super.hasMessage(key)) {
+      return super.getMessage(key);
+    }
+    return cardmgmtMessages.getString(key);
+  }
 
+  @Override
+  protected boolean hasMessage(String key) {
+    return (cardmgmtMessages.containsKey(key) || super.hasMessage(key));
   }
 }
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
index 8eef8aea..1276f2d0 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUI.java
@@ -39,13 +39,17 @@ import javax.swing.ListSelectionModel;
 import javax.swing.SwingUtilities;
 import javax.swing.event.ListSelectionEvent;
 import javax.swing.event.ListSelectionListener;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
 
 /**
  * TODO pull out ResourceBundle to common superclass for activationGUI and pinMgmtGUI
  * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
  */
-public class PINManagementGUI extends ActivationGUI implements PINManagementGUIFacade {
+public class PINManagementGUI extends CardMgmtGUI implements PINManagementGUIFacade {
 
+  protected static final Log log = LogFactory.getLog(PINManagementGUI.class);
+  
   /** remember the pinfield to return to worker */
   protected JPasswordField oldPinField;
   /** remember the pinSpec to return to worker */
@@ -70,7 +74,7 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
   }
 
   @Override
-  public PINSpec getSelectedPIN() {
+  public PINSpec getSelectedPINSpec() {
     return pinSpec;
   }
 
@@ -100,11 +104,11 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
                 mgmtLabel.setFont(mgmtLabel.getFont().deriveFont(mgmtLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
 
                 if (renderHeaderPanel) {
-                  titleLabel.setText(cardmgmtMessages.getString(TITLE_PINMGMT));
-                  String infoPattern = cardmgmtMessages.getString(MESSAGE_PINMGMT);
+                  titleLabel.setText(getMessage(TITLE_PINMGMT));
+                  String infoPattern = getMessage(MESSAGE_PINMGMT);
                   mgmtLabel.setText(MessageFormat.format(infoPattern, pins.size()));
                 } else {
-                  mgmtLabel.setText(cardmgmtMessages.getString(TITLE_PINMGMT));
+                  mgmtLabel.setText(getMessage(TITLE_PINMGMT));
                 }
 
                 final PINStatusTableModel tableModel = new PINStatusTableModel(pins);
@@ -146,19 +150,19 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
                           STATUS status = (STATUS) tableModel.getValueAt(selectionIdx, 1);
 
                           if (status == STATUS.NOT_ACTIV) {
-                            activateButton.setText(cardmgmtMessages.getString(BUTTON_ACTIVATE));
+                            activateButton.setText(getMessage(BUTTON_ACTIVATE));
                             activateButton.setEnabled(true);
                             activateButton.setActionCommand(activateCmd);
                           } else if (status == STATUS.BLOCKED) {
-                            activateButton.setText(cardmgmtMessages.getString(BUTTON_UNBLOCK));
+                            activateButton.setText(getMessage(BUTTON_UNBLOCK));
                             activateButton.setEnabled(true);
                             activateButton.setActionCommand(unblockCmd);
                           } else if (status == STATUS.ACTIV) {
-                            activateButton.setText(cardmgmtMessages.getString(BUTTON_CHANGE));
+                            activateButton.setText(getMessage(BUTTON_CHANGE));
                             activateButton.setEnabled(true);
                             activateButton.setActionCommand(changeCmd);
                           } else {
-                            activateButton.setText(cardmgmtMessages.getString(BUTTON_ACTIVATE));
+                            activateButton.setText(getMessage(BUTTON_ACTIVATE));
                             activateButton.setEnabled(false);
                           }
                         }
@@ -200,7 +204,7 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
 
                 JButton cancelButton = new JButton();
                 cancelButton.setFont(cancelButton.getFont().deriveFont(cancelButton.getFont().getStyle() & ~java.awt.Font.BOLD));
-                cancelButton.setText(messages.getString(BUTTON_CANCEL));
+                cancelButton.setText(getMessage(BUTTON_CLOSE));
                 cancelButton.setActionCommand(cancelCmd);
                 cancelButton.addActionListener(cancelListener);
 
@@ -266,27 +270,27 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
                 mgmtLabel.setFont(mgmtLabel.getFont().deriveFont(mgmtLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
 
                 if (renderHeaderPanel) {
-                  titleLabel.setText(cardmgmtMessages.getString(TITLE));
-                  String mgmtPattern = cardmgmtMessages.getString(MESSAGE_MGMT);
+                  titleLabel.setText(getMessage(TITLE));
+                  String mgmtPattern = getMessage(MESSAGE_MGMT);
                   if (shortText) {
                     mgmtLabel.setText(MessageFormat.format(mgmtPattern, "PIN"));
                   } else {
                     mgmtLabel.setText(MessageFormat.format(mgmtPattern, pinSpec.getLocalizedName()));
                   }
                 } else {
-                  mgmtLabel.setText(cardmgmtMessages.getString(TITLE));
+                  mgmtLabel.setText(getMessage(TITLE));
                 }
 
                 JButton okButton = new JButton();
                 okButton.setFont(okButton.getFont().deriveFont(okButton.getFont().getStyle() & ~java.awt.Font.BOLD));
-                okButton.setText(messages.getString(BUTTON_OK));
+                okButton.setText(getMessage(BUTTON_OK));
                 okButton.setEnabled(false);
                 okButton.setActionCommand(okCommand);
                 okButton.addActionListener(okListener);
 
                 JLabel pinLabel = new JLabel();
                 pinLabel.setFont(pinLabel.getFont().deriveFont(pinLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
-                String pinLabelPattern = (changePin) ? cardmgmtMessages.getString(LABEL_NEW_PIN) : messages.getString(LABEL_PIN);
+                String pinLabelPattern = (changePin) ? getMessage(LABEL_NEW_PIN) : getMessage(LABEL_PIN);
                 pinLabel.setText(MessageFormat.format(pinLabelPattern, new Object[]{pinSpec.getLocalizedName()}));
 
                 final JPasswordField repeatPinField = new JPasswordField();
@@ -305,7 +309,7 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
                 });
                 JLabel repeatPinLabel = new JLabel();
                 repeatPinLabel.setFont(pinLabel.getFont());
-                String repeatPinLabelPattern = cardmgmtMessages.getString(LABEL_REPEAT_PIN);
+                String repeatPinLabelPattern = getMessage(LABEL_REPEAT_PIN);
                 repeatPinLabel.setText(MessageFormat.format(repeatPinLabelPattern, new Object[]{pinSpec.getLocalizedName()}));
 
                 repeatPinField.setText("");
@@ -325,7 +329,7 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
                 if (changePin) {
                   oldPinLabel = new JLabel();
                   oldPinLabel.setFont(oldPinLabel.getFont().deriveFont(oldPinLabel.getFont().getStyle() & ~java.awt.Font.BOLD));
-                  String oldPinLabelPattern = cardmgmtMessages.getString(LABEL_OLD_PIN);
+                  String oldPinLabelPattern = getMessage(LABEL_OLD_PIN);
                   oldPinLabel.setText(MessageFormat.format(oldPinLabelPattern, new Object[]{pinSpec.getLocalizedName()}));
 
                   oldPinField = new JPasswordField();
@@ -345,7 +349,7 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
                 
                 JLabel pinsizeLabel = new JLabel();
                 pinsizeLabel.setFont(pinsizeLabel.getFont().deriveFont(pinsizeLabel.getFont().getStyle() & ~java.awt.Font.BOLD, pinsizeLabel.getFont().getSize()-2));
-                String pinsizePattern = messages.getString(LABEL_PINSIZE);
+                String pinsizePattern = getMessage(LABEL_PINSIZE);
                 String pinSize = String.valueOf(pinSpec.getMinLength());
                 if (pinSpec.getMinLength() != pinSpec.getMaxLength()) {
                     pinSize += "-" + pinSpec.getMaxLength();
@@ -468,7 +472,7 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
 
                 JButton cancelButton = new JButton();
                 cancelButton.setFont(cancelButton.getFont().deriveFont(cancelButton.getFont().getStyle() & ~java.awt.Font.BOLD));
-                cancelButton.setText(messages.getString(BUTTON_CANCEL));
+                cancelButton.setText(getMessage(BUTTON_CANCEL));
                 cancelButton.setActionCommand(cancelCommand);
                 cancelButton.addActionListener(cancelListener);
 
@@ -522,12 +526,12 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
                 buttonPanel.removeAll();
 
                 if (renderHeaderPanel) {
-                  titleLabel.setText(messages.getString(TITLE_ERROR));
+                  titleLabel.setText(getMessage(TITLE_ERROR));
                 }
 
                 helpListener.setHelpTopic(HELP_PINMGMT);
 
-                String errorMsgPattern = cardmgmtMessages.getString(ERR_UNBLOCK);
+                String errorMsgPattern = getMessage(ERR_UNBLOCK);
                 String errorMsg = MessageFormat.format(errorMsgPattern, pin.getLocalizedName());
 
                 JLabel errorMsgLabel = new JLabel();
@@ -543,7 +547,7 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
                 if (!renderHeaderPanel) {
                   JLabel errorTitleLabel = new JLabel();
                   errorTitleLabel.setFont(errorTitleLabel.getFont().deriveFont(errorTitleLabel.getFont().getStyle() | java.awt.Font.BOLD));
-                  errorTitleLabel.setText(messages.getString(TITLE_ERROR));
+                  errorTitleLabel.setText(getMessage(TITLE_ERROR));
                   errorTitleLabel.setForeground(ERROR_COLOR);
 
                   mainHorizontal
@@ -564,7 +568,7 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
 
                 JButton okButton = new JButton();
                 okButton.setFont(okButton.getFont().deriveFont(okButton.getFont().getStyle() & ~java.awt.Font.BOLD));
-                okButton.setText(messages.getString(BUTTON_OK));
+                okButton.setText(getMessage(BUTTON_OK));
                 okButton.setActionCommand(cancelCommand);
                 okButton.addActionListener(cancelListener);
 
@@ -584,5 +588,28 @@ public class PINManagementGUI extends ActivationGUI implements PINManagementGUIF
         });
   }
 
+  @Override
+  protected int initButtonSize() {
+    int bs = super.initButtonSize();
 
+    JButton b = new JButton();
+    b.setText(getMessage(BUTTON_ACTIVATE));
+    if (b.getPreferredSize().width > bs) {
+      bs = b.getPreferredSize().width;
+    }
+    b.setText(getMessage(BUTTON_CHANGE));
+    if (b.getPreferredSize().width > bs) {
+      bs = b.getPreferredSize().width;
+    }
+    b.setText(getMessage(BUTTON_UNBLOCK));
+    if (b.getPreferredSize().width > bs) {
+      bs = b.getPreferredSize().width;
+    }
+    b.setText(getMessage(BUTTON_CANCEL));
+    if (b.getPreferredSize().width > bs) {
+      bs = b.getPreferredSize().width;
+    }
+
+    return bs;
+  }
 }
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
index 2a8f28d2..ffdc230d 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINManagementGUIFacade.java
@@ -43,6 +43,7 @@ public interface PINManagementGUIFacade extends BKUGUIFacade {
   public static final String ERR_ACTIVATE = "err.activate";
   public static final String ERR_CHANGE = "err.change";
   public static final String ERR_UNBLOCK = "err.unblock";
+  public static final String ERR_RETRIES = "err.retries";
 
   public static final String BUTTON_ACTIVATE = "button.activate";
   public static final String BUTTON_UNBLOCK = "button.unblock";
@@ -73,5 +74,5 @@ public interface PINManagementGUIFacade extends BKUGUIFacade {
 
   public char[] getOldPin();
 
-  public PINSpec getSelectedPIN();
+  public PINSpec getSelectedPINSpec();
 }
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusRenderer.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusRenderer.java
index 2f8852ff..4cb84b77 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusRenderer.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/gui/PINStatusRenderer.java
@@ -31,7 +31,7 @@ import org.apache.commons.logging.LogFactory;
  */
 public class PINStatusRenderer extends DefaultTableCellRenderer {
   
-  private static final Log log = LogFactory.getLog(PINStatusRenderer.class);
+//  private static final Log log = LogFactory.getLog(PINStatusRenderer.class);
 
   public static final Color RED = new Color(0.9f, 0.0f, 0.0f);
   public static final Color GREEN = new Color(0.0f, 0.8f, 0.0f);
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/online/applet/PINManagementBKUWorker.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/online/applet/PINManagementBKUWorker.java
index ffd83e42..85892026 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/online/applet/PINManagementBKUWorker.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/online/applet/PINManagementBKUWorker.java
@@ -25,8 +25,6 @@ import at.gv.egiz.stal.ext.PINManagementRequest;
 import at.gv.egiz.stal.ext.PINManagementResponse;
 import java.util.Collections;
 import java.util.List;
-import java.util.logging.Level;
-import java.util.logging.Logger;
 
 /**
  * This BKU Worker does not connect to STAL webservice
@@ -52,8 +50,9 @@ public class PINManagementBKUWorker extends AppletBKUWorker {
       if (responses.size() == 1) {
         STALResponse response = responses.get(0);
         if (response instanceof PINManagementResponse) {
-          log.debug("PIN management dialog finished");
+          log.debug("PIN management dialog terminated");
         } else if (response instanceof ErrorResponse) {
+          log.debug("PIN management dialog terminated with error");
           showErrorDialog(BKUGUIFacade.ERR_UNKNOWN, null);
         } else {
           throw new RuntimeException("Invalid STAL response: " + response.getClass().getName());
diff --git a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java
index fcef3191..851bff21 100644
--- a/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java
+++ b/BKUAppletExt/src/main/java/at/gv/egiz/bku/smccstal/ext/PINManagementRequestHandler.java
@@ -22,6 +22,7 @@ import at.gv.egiz.bku.gui.PINManagementGUIFacade.STATUS;
 import at.gv.egiz.bku.smccstal.AbstractRequestHandler;
 import at.gv.egiz.smcc.PINSpec;
 import at.gv.egiz.smcc.SignatureCardException;
+import at.gv.egiz.smcc.VerificationFailedException;
 import at.gv.egiz.smcc.util.SMCCHelper;
 import at.gv.egiz.stal.ErrorResponse;
 import at.gv.egiz.stal.STALRequest;
@@ -31,6 +32,8 @@ import at.gv.egiz.stal.ext.PINManagementResponse;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.logging.Level;
+import java.util.logging.Logger;
 import javax.smartcardio.Card;
 import javax.smartcardio.CardChannel;
 import javax.smartcardio.CardException;
@@ -45,7 +48,6 @@ import org.apache.commons.logging.LogFactory;
  */
 public class PINManagementRequestHandler extends AbstractRequestHandler {
 
-  public static final String ERR_NOPIN_SELECTED = "err.no.pin.selected";
   protected static final Log log = LogFactory.getLog(PINManagementRequestHandler.class);
 
 //  protected ResourceBundle messages;
@@ -70,7 +72,7 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
         } else if ("back".equals(actionCommand)) {
           showPINManagementDialog(gui);
         } else {
-          PINSpec selectedPIN = gui.getSelectedPIN();
+          PINSpec selectedPIN = gui.getSelectedPINSpec();
 
           if (selectedPIN == null) {
             throw new RuntimeException("no PIN selected for activation/change");
@@ -99,6 +101,11 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
               byte[] pin = encodePIN(gui.getPin()); //new byte[]{(byte) 0x25, (byte) 0x40};
               changePIN(selectedPIN.getKID(), selectedPIN.getContextAID(), oldPin, pin);
               showPINManagementDialog(gui);
+            } catch (VerificationFailedException ex) {
+              log.error("failed to change " + selectedPIN.getLocalizedName() + ": " + ex.getMessage());
+              gui.showErrorDialog(PINManagementGUIFacade.ERR_RETRIES,
+                      new Object[] {selectedPIN.getLocalizedName(), ex.getRetries()},
+                      this, "back");
             } catch (SignatureCardException ex) {
               log.error("failed to change " + selectedPIN.getLocalizedName() + ": " + ex.getMessage());
               gui.showErrorDialog(PINManagementGUIFacade.ERR_CHANGE, 
@@ -132,8 +139,8 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
    * @throws at.gv.egiz.smcc.SignatureCardException
    */
   private void activatePIN(byte kid, byte[] contextAID, byte[] pin) throws SignatureCardException {
+    Card icc = card.getCard();
     try {
-      Card icc = card.getCard();
       icc.beginExclusive();
       CardChannel channel = icc.getBasicChannel();
 
@@ -141,6 +148,7 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
         CommandAPDU selectAPDU = new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, contextAID);
         ResponseAPDU responseAPDU = channel.transmit(selectAPDU);
         if (responseAPDU.getSW() != 0x9000) {
+          icc.endExclusive();
           String msg = "Failed to activate PIN " + SMCCHelper.toString(new byte[]{kid}) +
                   ": Failed to select AID " + SMCCHelper.toString(contextAID) +
                   ": " + SMCCHelper.toString(responseAPDU.getBytes());
@@ -150,8 +158,9 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
       }
 
       if (pin.length > 7) {
-        log.error("Invalid PIN");
-        throw new SignatureCardException("Invalid PIN");
+        icc.endExclusive();
+        log.error("PIN too long");
+        throw new SignatureCardException("PIN too long");
       }
       byte length = (byte) (0x20 | pin.length * 2);
 
@@ -166,24 +175,27 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
       ResponseAPDU responseAPDU = channel.transmit(verifyAPDU);
 
       if (responseAPDU.getSW() != 0x9000) {
+        icc.endExclusive();
         String msg = "Failed to activate PIN " + SMCCHelper.toString(new byte[]{kid}) + ": " + SMCCHelper.toString(responseAPDU.getBytes());
         log.error(msg);
         throw new SignatureCardException(msg);
       }
-
-
       icc.endExclusive();
-
-
     } catch (CardException ex) {
-      log.error("Failed to get PIN status: " + ex.getMessage());
-      throw new SignatureCardException("Failed to get PIN status", ex);
+      log.error("Failed to activate PIN: " + ex.getMessage());
+      throw new SignatureCardException(ex.getMessage(), ex);
+    } finally {
+      try {
+        icc.endExclusive();
+      } catch (CardException ex) {
+        log.trace("failed to end exclusive card access");
+      }
     }
   }
 
-  private void changePIN(byte kid, byte[] contextAID, byte[] oldPIN, byte[] newPIN) throws SignatureCardException {
+  private void changePIN(byte kid, byte[] contextAID, byte[] oldPIN, byte[] newPIN) throws SignatureCardException, VerificationFailedException {
+    Card icc = card.getCard();
     try {
-      Card icc = card.getCard();
       icc.beginExclusive();
       CardChannel channel = icc.getBasicChannel();
 
@@ -191,6 +203,7 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
         CommandAPDU selectAPDU = new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, contextAID);
         ResponseAPDU responseAPDU = channel.transmit(selectAPDU);
         if (responseAPDU.getSW() != 0x9000) {
+          icc.endExclusive();
           String msg = "Failed to change PIN " + SMCCHelper.toString(new byte[]{kid}) +
                   ": Failed to select AID " + SMCCHelper.toString(contextAID) +
                   ": " + SMCCHelper.toString(responseAPDU.getBytes());
@@ -200,8 +213,9 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
       }
 
       if (oldPIN.length > 7 || newPIN.length > 7) {
-        log.error("Invalid PIN");
-        throw new SignatureCardException("Invalid PIN");
+        icc.endExclusive();
+        log.error("PIN too long");
+        throw new SignatureCardException("PIN too long");
       }
       byte oldLength = (byte) (0x20 | oldPIN.length * 2);
       byte newLength = (byte) (0x20 | newPIN.length * 2);
@@ -220,49 +234,43 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
       CommandAPDU verifyAPDU = new CommandAPDU(apdu);
       ResponseAPDU responseAPDU = channel.transmit(verifyAPDU);
 
+      if (responseAPDU.getSW1() == 0x63 && responseAPDU.getSW2() >> 4 == 0xc) {
+        icc.endExclusive();
+        int retries = responseAPDU.getSW2() & 0x0f;
+        log.error("Wrong PIN, " + retries + " tries left");
+        throw new VerificationFailedException(retries);
+      }
       if (responseAPDU.getSW() != 0x9000) {
-        String msg = "Failed to change PIN " + SMCCHelper.toString(new byte[]{kid}) + ": " + SMCCHelper.toString(responseAPDU.getBytes());
+        icc.endExclusive();
+        String msg = "Failed to change PIN " 
+                + SMCCHelper.toString(new byte[]{kid}) + ": "
+                + SMCCHelper.toString(responseAPDU.getBytes());
         log.error(msg);
         throw new SignatureCardException(msg);
       }
-
-
-      icc.endExclusive();
-
+      
 
     } catch (CardException ex) {
-      log.error("Failed to get PIN status: " + ex.getMessage());
-      throw new SignatureCardException("Failed to get PIN status", ex);
+      log.error("Failed to change PIN: " + ex.getMessage());
+      throw new SignatureCardException(ex.getMessage(), ex);
+    } finally {
+      try {
+        icc.endExclusive();
+      } catch (CardException ex) {
+        log.trace("failed to end exclusive card access");
+      }
     }
   }
 
   public Map<PINSpec, STATUS> getPINStatuses() throws SignatureCardException {
+    Card icc = card.getCard();
     try {
-      Card icc = card.getCard();
       icc.beginExclusive();
       CardChannel channel = icc.getBasicChannel();
 
       HashMap<PINSpec, STATUS> pinStatuses = new HashMap<PINSpec, STATUS>();
       List<PINSpec> pins = card.getPINSpecs();
 
-      //select DF_SichereSignatur 00 A4 04 0C 08 D0 40 00 00 17 00 12 01
-//      CommandAPDU selectAPDU = new CommandAPDU(new byte[]{(byte) 0x00, (byte) 0xa4, (byte) 0x04, (byte) 0x0c, (byte) 0x08,
-//                (byte) 0xd0, (byte) 0x40, (byte) 0x00, (byte) 0x00, (byte) 0x17, (byte) 0x00, (byte) 0x12, (byte) 0x01});
-//      ResponseAPDU rAPDU = channel.transmit(selectAPDU);
-//      log.debug("SELECT FILE DF_SichereSignatur: " + SMCCHelper.toString(rAPDU.getBytes()));
-
-      //select DF_SIG DF 70
-//      CommandAPDU selectAPDU = new CommandAPDU(new byte[]{(byte) 0x00, (byte) 0xa4, (byte) 0x00, (byte) 0x0c, (byte) 0x02,
-//                (byte) 0xdf, (byte) 0x70 });
-//      ResponseAPDU rAPDU = channel.transmit(selectAPDU);
-//      log.debug("SELECT FILE DF_SIG: " + SMCCHelper.toString(rAPDU.getBytes()));
-
-      //select DF_DEC DF 71
-//      CommandAPDU selectAPDU = new CommandAPDU(new byte[]{(byte) 0x00, (byte) 0xa4, (byte) 0x04, (byte) 0x0c, (byte) 0x08,
-//                (byte) 0xd0, (byte) 0x40, (byte) 0x00, (byte) 0x00, (byte) 0x17, (byte) 0x00, (byte) 0x12, (byte) 0x01});
-//      ResponseAPDU rAPDU = channel.transmit(selectAPDU);
-//      log.debug("SELECT FILE DF_SichereSignatur: " + SMCCHelper.toString(rAPDU.getBytes()));
-
       for (PINSpec pinSpec : pins) {
         byte kid = pinSpec.getKID();
         byte[] contextAID = pinSpec.getContextAID();
@@ -271,6 +279,7 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
           CommandAPDU selectAPDU = new CommandAPDU(0x00, 0xa4, 0x04, 0x0c, contextAID);
           ResponseAPDU responseAPDU = channel.transmit(selectAPDU);
           if (responseAPDU.getSW() != 0x9000) {
+            icc.endExclusive();
             String msg = "Failed to activate PIN " + SMCCHelper.toString(new byte[]{kid}) +
                     ": Failed to select AID " + SMCCHelper.toString(contextAID) +
                     ": " + SMCCHelper.toString(responseAPDU.getBytes());
@@ -296,13 +305,19 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
 
         pinStatuses.put(pinSpec, status);
       }
-      icc.endExclusive();
+//      icc.endExclusive();
 
       return pinStatuses;
 
     } catch (CardException ex) {
       log.error("Failed to get PIN status: " + ex.getMessage());
-      throw new SignatureCardException("Failed to get PIN status", ex);
+      throw new SignatureCardException(ex.getMessage(), ex);
+    } finally {
+      try {
+        icc.endExclusive();
+      } catch (CardException ex) {
+        log.trace("failed to end exclusive card access");
+      }
     }
   }
 
@@ -312,7 +327,7 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
     for (int i = 0; i < length; i++) {
       pin[i] = (byte) (16*Character.digit(pinChars[i*2], 16) + Character.digit(pinChars[i*2+1], 16));
     }
-    log.trace("***** "  + SMCCHelper.toString(pin) + " ******");
+//    log.trace("***** "  + SMCCHelper.toString(pin) + " ******");
     return pin;
   }
 
@@ -324,7 +339,7 @@ public class PINManagementRequestHandler extends AbstractRequestHandler {
               this, "cancel");
     } catch (SignatureCardException ex) {
       gui.showErrorDialog(BKUGUIFacade.ERR_UNKNOWN_WITH_PARAM, 
-              new Object[]{"FAILED TO GET PIN STATUSES: " + ex.getMessage()},
+              new Object[]{ex.getMessage()},
               this, "cancel");
     }
   }
diff --git a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
index e51044af..b6099db6 100644
--- a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
+++ b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages.properties
@@ -41,6 +41,7 @@ help.pin.mgmt=help.pin.mgmt
 err.activate=<html>Beim Aktivieren der {0} trat ein Fehler auf.</html>
 err.change=<html>Beim \u00C4ndern der {0} trat ein Fehler auf.</html>
 err.unblock=<html>Das Entsperren der {0} wird nicht unterst\u00FCtzt.</html>
+err.retries=<html>Falscher {0}, noch {1} Versuche</html>
 
 status.not.active=NICHT AKTIV
 status.active=AKTIV
diff --git a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
index 1cf4a102..40332826 100644
--- a/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
+++ b/BKUAppletExt/src/main/resources/at/gv/egiz/bku/gui/ActivationMessages_en.properties
@@ -38,11 +38,12 @@ button.unblock=Unblock
 help.activation=help.activation
 help.pin.mgmt=help.pin.mgmt
 
-err.activate=<html>An error occured during activation of {0}.</html>
-err.change=<html>An error occured during changing of {0}.</html>
+err.activate=<html>An error occured during the activation of {0}.</html>
+err.change=<html>An error occured during the changing of {0}.</html>
 err.unblock=<html>Unblocking of {0} is not supported.</html>
+err.retries=<html>Wrong {0}, {1} tries remaining</html>
 
-status.not.active=Not active
-status.active=Active
-status.blocked=Blocked
-status.unknown=Unknown
+status.not.active=NOT ACTIVE
+status.active=ACTIVE
+status.blocked=BLOCKED
+status.unknown=UNKNOWN