[#433] update BKU Web Start CertStore

WebStart configuration refactored

git-svn-id: https://joinup.ec.europa.eu/svn/mocca/trunk@423 8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4

27 files changed, 1604 insertions, 500 deletions

diff --git a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/BKULauncher.java b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/BKULauncher.java
deleted file mode 100644
index abc0b8ee..00000000
--- a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/BKULauncher.java
+++ /dev/null
@@ -1,418 +0,0 @@
-package at.gv.egiz.bku.webstart;

-

-import iaik.asn1.CodingException;

-import java.io.File;

-import java.io.FileNotFoundException;

-import java.io.FileOutputStream;

-import java.io.IOException;

-import java.io.InputStream;

-import java.io.OutputStream;

-import java.net.MalformedURLException;

-import java.security.KeyStore;

-import java.security.KeyStoreException;

-import java.security.NoSuchAlgorithmException;

-import java.security.cert.CertificateException;

-import java.util.Enumeration;

-import java.util.Locale;

-import java.util.MissingResourceException;

-import java.util.ResourceBundle;

-import java.util.logging.Level;

-import java.util.logging.Logger;

-import java.util.zip.ZipEntry;

-import java.util.zip.ZipFile;

-

-//import org.apache.commons.cli.CommandLine;

-//import org.apache.commons.cli.CommandLineParser;

-//import org.apache.commons.cli.HelpFormatter;

-//import org.apache.commons.cli.Options;

-//import org.apache.commons.cli.ParseException;

-//import org.apache.commons.cli.PosixParser;

-import org.apache.commons.logging.Log;

-import org.apache.commons.logging.LogFactory;

-

-import at.gv.egiz.bku.webstart.ui.BKUControllerInterface;

-import at.gv.egiz.bku.webstart.ui.TrayIconDialog;

-import at.gv.egiz.bku.utils.StreamUtil;

-import java.awt.Desktop;

-import java.io.BufferedInputStream;

-import java.io.BufferedOutputStream;

-import java.io.BufferedReader;

-import java.io.BufferedWriter;

-import java.io.FileInputStream;

-import java.io.FileReader;

-import java.io.FileWriter;

-import java.net.BindException;

-import java.net.URI;

-import java.net.URL;

-import java.security.GeneralSecurityException;

-import java.util.UUID;

-import java.util.jar.Attributes;

-import java.util.jar.Manifest;

-import java.util.zip.ZipOutputStream;

-import org.mortbay.util.MultiException;

-

-public class BKULauncher implements BKUControllerInterface {

-

-  /** configurations with less than this (major) version will be backuped and updated */

-  public static final String MIN_CONFIG_VERSION = "1.0.3";

-  public static final String CONFIG_DIR = ".mocca/conf/";

-  public static final String CONF_TEMPLATE_FILE = "configuration.zip";

-  public static final String CONF_TEMPLATE_RESOURCE = "at/gv/egiz/bku/webstart/conf/configuration.zip";

-  public static final String WEBAPP_RESOURCE = "BKULocal.war";

-  public static final String WEBAPP_FILE = "BKULocal.war";

-  public static final String KEYSTORE_FILE = "keystore.ks";

-  public static final String MESSAGES_RESOURCE = "at/gv/egiz/bku/webstart/ui/UIMessages";

-  public static final String PASSWD_FILE = ".secret";

-  /** resource bundle messages */

-  public static final String GREETING_CAPTION = "Greetings.Caption";

-  public static final String GREETING_MESSAGE = "Greetings.Message";

-  public static final String STARTUP_CAPTION = "Startup.Caption";

-  public static final String ERROR_CAPTION = "Error.Caption";

-  public static final String STARTUP_MESSAGE = "Startup.Message";

-  public static final String ERROR_STARTUP_MESSAGE = "Error.Startup.Message";

-  public static final String ERROR_CONF_MESSAGE = "Error.Conf.Message";

-  public static final String ERROR_BIND_MESSAGE = "Error.Bind.Message";

-  public static final String VERSION_FILE = ".version";

-  private static Log log = LogFactory.getLog(BKULauncher.class);

-  private ResourceBundle resourceBundle = null;

-  private Container server;

-

-  private void createConfig(File configDir, File versionFile, String version) throws IOException, CertificateException, GeneralSecurityException, KeyStoreException, FileNotFoundException, NoSuchAlgorithmException {

-    log.debug("creating config directory: " + configDir);

-    configDir.mkdirs();

-    InputStream is = getClass().getClassLoader().getResourceAsStream(CONF_TEMPLATE_RESOURCE);

-    OutputStream os = new FileOutputStream(new File(configDir, CONF_TEMPLATE_FILE));

-    StreamUtil.copyStream(is, os);

-    os.close();

-    File confTemplateFile = new File(configDir, CONF_TEMPLATE_FILE);

-    unzip(confTemplateFile);

-    confTemplateFile.delete();

-    writeVersionFile(versionFile, version);

-  }

-

-  private void createCertificates(File configDir) throws IOException, GeneralSecurityException, CodingException {

-    char[] password = UUID.randomUUID().toString().toCharArray();

-    File passwdFile = new File(configDir, PASSWD_FILE);

-    FileWriter passwdWriter = new FileWriter(passwdFile);

-    passwdWriter.write(password);

-    passwdWriter.close();

-    if (!passwdFile.setReadable(true, true)) {

-      passwdFile.delete();

-      throw new IOException("failed to make " + passwdFile + " owner readable only, deleting file");

-    }

-    TLSServerCA ca = new TLSServerCA();

-    KeyStore ks = ca.generateKeyStore(password);

-    FileOutputStream fos = new FileOutputStream(new File(configDir, KEYSTORE_FILE));

-    ks.store(fos, password);

-    fos.close();

-  }

-

-  private String getFileVersion(File versionFile) throws FileNotFoundException, IOException {

-    //TODO no file?

-    if (versionFile.exists() && versionFile.canRead()) {

-      BufferedReader versionReader = new BufferedReader(new FileReader(versionFile));

-      String versionString = null;

-      while ((versionString = versionReader.readLine().trim()) != null) {

-        if (versionString.length() > 0 && !versionString.startsWith("#")) {

-          log.debug("found existing configuration version " + versionString);

-          break;

-        }

-      }

-      return versionString;

-    }

-    return null;

-  }

-

-  private String getManifestVersion() throws MalformedURLException, IOException {

-    String bkuWebStartJar = BKULauncher.class.getProtectionDomain().getCodeSource().getLocation().toString();

-    URL manifestURL = new URL("jar:" + bkuWebStartJar + "!/META-INF/MANIFEST.MF");

-    String version = null;

-    if (manifestURL != null) {

-      Manifest manifest = new Manifest(manifestURL.openStream());

-      if (log.isTraceEnabled()) {

-        log.trace("read version information from " + manifestURL);

-      }

-      Attributes atts = manifest.getMainAttributes();

-      if (atts != null) {

-        version = atts.getValue("Implementation-Build");

-      }

-    }

-    if (version == null) {

-      version = "UNKNOWN";

-    }

-    log.debug("config version: " + version);

-    return version;

-  }

-

-  /**

-   * change the

-   * @param oldVersion

-   * @param newVersion

-   * @return

-   */

-  private boolean updateRequired(String oldVersion, String newVersion) {

-    if (oldVersion != null) {

-      log.debug("comparing " + oldVersion + " to " + MIN_CONFIG_VERSION);

-      

-      int majorEnd = oldVersion.indexOf('-');

-      String oldMajor = (majorEnd < 0) ? oldVersion : oldVersion.substring(0, majorEnd);

-

-      int compare = oldMajor.compareTo(MIN_CONFIG_VERSION);

-      if (compare < 0 ||

-              // SNAPSHOT versions are pre-releases (update if release required)

-              (compare == 0 && oldVersion.startsWith("-SNAPSHOT", majorEnd))) {

-        return true;

-      } else {

-        return false;

-      }

-    }

-    log.debug("no old version, update required");

-    return true;

-  }

-

-  private boolean updateRequiredStrict(String oldVersion, String newVersion) {

-    String[] oldV = oldVersion.split("-");

-    String[] newV = newVersion.split("-");

-    log.debug("comparing " + oldV[0] + " to " + newV[0]);

-    if (oldV[0].compareTo(newV[0]) < 0) {

-      log.debug("update required");

-      return true;

-    } else {

-      log.debug("comparing " + oldV[oldV.length - 1] + " to " + newV[newV.length - 1]);

-      if (oldV[oldV.length - 1].compareTo(newV[newV.length - 1]) < 0) {

-        log.debug("update required");

-        return true;

-      } else {

-        log.debug("no update required");

-        return false;

-      }

-    }

-  }

-

-  private void writeVersionFile(File versionFile, String version) throws IOException {

-    BufferedWriter versionWriter = new BufferedWriter(new FileWriter(versionFile));

-    versionWriter.write("# MOCCA Web Start configuration version\n");

-    versionWriter.write("# DO NOT MODIFY THIS FILE\n\n");

-    versionWriter.write(version);

-    versionWriter.close();

-  }

-

-//  private SplashScreen splash = SplashScreen.getSplashScreen();

-  private void startUpServer() throws Exception {

-    log.info("init servlet container and MOCCA webapp");

-    server = new Container();

-    // XmlConfiguration xcfg = new XmlConfiguration(getClass().getClassLoader()

-    // .getResourceAsStream("at/gv/egiz/bku/local/app/jetty.xml"));

-    // xcfg.configure(server);

-    server.init();

-    server.start();

-  }

-

-  private void initTrayIcon() {

-    log.debug("init MOCCA tray icon");

-    Locale loc = Locale.getDefault();

-    try {

-      resourceBundle = ResourceBundle.getBundle(

-              MESSAGES_RESOURCE, loc);

-    } catch (MissingResourceException mx) {

-      resourceBundle = ResourceBundle.getBundle(

-              MESSAGES_RESOURCE, Locale.ENGLISH);

-    }

-    TrayIconDialog.getInstance().init(resourceBundle);

-    TrayIconDialog.getInstance().setShutdownHook(this);

-//    TrayIconDialog.getInstance().displayInfo(GREETING_CAPTION, GREETING_MESSAGE);

-  }

-

-  private void initStart() {

-  }

-

-  private void initFinished(boolean installCert) {

-    try {

-//      if (splash != null) {

-//        try {

-//          splash.close();

-//        } catch (IllegalStateException ex) {

-//          log.warn("Failed to close splash screen: " + ex.getMessage());

-//        }

-//      }

-

-      if (installCert) {

-        log.debug("trying install MOCCA certificate on system browser");

-        if (Desktop.isDesktopSupported()) {

-          Desktop desktop = Desktop.getDesktop();

-          if (desktop.isSupported(Desktop.Action.BROWSE)) {

-            try {

-              desktop.browse(new URI("https://localhost:" +

-                      Integer.getInteger(Container.HTTPS_PORT_PROPERTY, 3496).intValue()));

-            } catch (Exception ex) {

-              log.error("failed to open system browser, install MOCCA certificate manually", ex);

-            }

-          } else {

-            log.error("failed to open system browser, install MOCCA certificate manually");

-          }

-        } else {

-          log.error("failed to open system browser, install MOCCA certificate manually");

-        }

-      }

-

-      log.info("init completed, joining server");

-      server.join();

-    } catch (InterruptedException e) {

-      log.warn("failed to join MOCCA server: " + e.getMessage(), e);

-    }

-  }

-

-  private void unzip(File zipfile) throws IOException {

-    File dir = zipfile.getParentFile();

-    ZipFile zipFile = new ZipFile(zipfile);

-    Enumeration<? extends ZipEntry> entries = zipFile.entries();

-    while (entries.hasMoreElements()) {

-      ZipEntry entry = entries.nextElement();

-      File eF = new File(dir, entry.getName());

-      if (entry.isDirectory()) {

-        eF.mkdirs();

-        continue;

-      }

-      File f = new File(eF.getParent());

-      f.mkdirs();

-      StreamUtil.copyStream(zipFile.getInputStream(entry),

-              new FileOutputStream(eF));

-    }

-    zipFile.close();

-  }

-

-  /**

-   * @param args

-   */

-  public static void main(String[] args) throws InterruptedException {

-

-    if (log.isDebugEnabled()) {

-      //System.setProperty("DEBUG", "true");

-      System.setProperty("VERBOSE", "true");

-      System.setProperty("javax.net.debug", "ssl,handshake");

-    }

-    

-//      log.warn("***** DISABLING SECURITY MANAGER *******");

-      System.setSecurityManager(null);

-

-      BKULauncher launcher = new BKULauncher();

-      launcher.initStart();

-

-      boolean installCert = false;

-

-      launcher.initTrayIcon();

-      TrayIconDialog.getInstance().displayInfo(STARTUP_CAPTION, STARTUP_MESSAGE);

-

-      try {

-        File configDir = new File(System.getProperty("user.home") + '/' + CONFIG_DIR);

-        installCert = launcher.ensureConfig(configDir);

-      } catch (Exception ex) {

-        log.fatal("Failed to init MOCCA configuration, exiting", ex);

-        TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_CONF_MESSAGE);

-        Thread.sleep(5000);

-        System.exit(-1000);

-      }

-

-      try {

-        launcher.startUpServer();

-        TrayIconDialog.getInstance().displayInfo(GREETING_CAPTION, GREETING_MESSAGE);

-        launcher.initFinished(installCert);

-      } catch (BindException ex) {

-        log.fatal("Failed to launch MOCCA, " + ex.getMessage(), ex);

-        TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_BIND_MESSAGE);

-        Thread.sleep(5000);

-        System.exit(-1000);

-      } catch (MultiException ex) {

-        log.fatal("Failed to launch MOCCA, " + ex.getMessage(), ex);

-        if (ex.getThrowable(0) instanceof BindException) {

-          TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_BIND_MESSAGE);

-        } else {

-          TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_STARTUP_MESSAGE);

-        }

-        Thread.sleep(5000);

-        System.exit(-1000);

-      } catch (Exception e) {

-        log.fatal("Failed to launch MOCCA, " + e.getMessage(), e);

-        TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_STARTUP_MESSAGE);

-        Thread.sleep(5000);

-        System.exit(-1000);

-      }

-    

-  }

-

-  private void backupAndDelete(File dir, URI relativeTo, ZipOutputStream zip) throws IOException {

-    if (dir.isDirectory()) {

-      File[] subDirs = dir.listFiles();

-      for (File subDir : subDirs) {

-        backupAndDelete(subDir, relativeTo, zip);

-        subDir.delete();

-      }

-    } else {

-      URI relativePath = relativeTo.relativize(dir.toURI());

-      ZipEntry entry = new ZipEntry(relativePath.toString());

-      zip.putNextEntry(entry);

-      BufferedInputStream entryIS = new BufferedInputStream(new FileInputStream(dir));

-      StreamUtil.copyStream(entryIS, zip);

-      entryIS.close();

-      zip.closeEntry();

-      dir.delete();

-    }

-  }

-

-  /**

-   * Checks whether the config directory already exists and creates it otherwise.

-   * @param configDir the config directory to be created

-   * @return true if a new MOCCA cert was created (and needs to be installed in the browser)

-   */

-  private boolean ensureConfig(File configDir) throws IOException, GeneralSecurityException, CodingException {

-    log.debug("config directory: " + configDir);

-    String manifestVersion = getManifestVersion();

-    File versionFile = new File(configDir, VERSION_FILE);

-

-    if (configDir.exists()) {

-      if (configDir.isFile()) {

-        log.error("invalid config directory: " + configDir);

-        throw new IOException("invalid config directory: " + configDir);

-      } else {

-        String fileVersion = getFileVersion(versionFile);

-        if (updateRequired(fileVersion, manifestVersion)) {

-          if (fileVersion == null) {

-            fileVersion = "unknown";

-          }

-          log.info("updating configuration from " + fileVersion + " to " + manifestVersion);

-          File moccaDir = configDir.getParentFile();

-          File zipFile = new File(moccaDir, "conf-" + fileVersion + ".zip");

-          ZipOutputStream zipOS = new ZipOutputStream(new BufferedOutputStream(new FileOutputStream(zipFile)));

-          backupAndDelete(configDir, moccaDir.toURI(), zipOS);

-          zipOS.close();

-          createConfig(configDir, versionFile, manifestVersion);

-          createCertificates(configDir);

-          return true;

-        }

-      }

-    } else {

-      createConfig(configDir, versionFile, manifestVersion);

-      createCertificates(configDir);

-      return true;

-    }

-    return false;

-  }

-

-  public void shutDown() {

-    log.info("Shutting down server");

-    if ((server != null) && (server.isRunning())) {

-      try {

-        if (server.isRunning()) {

-          server.stop();

-        }

-      } catch (Exception e) {

-        log.debug(e.toString());

-      } finally {

-        if (server.isRunning()) {

-          server.destroy();

-        }

-      }

-    }

-    System.exit(0);

-  }

-}

diff --git a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Configurator.java b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Configurator.java
new file mode 100644
index 00000000..ab1746ed
--- /dev/null
+++ b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Configurator.java
@@ -0,0 +1,418 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.webstart;
+
+import at.gv.egiz.bku.utils.StreamUtil;
+import iaik.asn1.CodingException;
+import iaik.xml.crypto.utils.Utils;
+import java.io.BufferedInputStream;
+import java.io.BufferedOutputStream;
+import java.io.BufferedReader;
+import java.io.BufferedWriter;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.FileReader;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.net.URL;
+import java.security.GeneralSecurityException;
+import java.security.KeyStore;
+import java.util.Enumeration;
+import java.util.Iterator;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+import java.util.jar.Attributes;
+import java.util.jar.Manifest;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipFile;
+import java.util.zip.ZipOutputStream;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.eclipse.jdt.core.dom.ThisExpression;
+
+/**
+ *
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class Configurator {
+
+  /**
+   * MOCCA configuration
+   * configurations with less than this (major) version will be backuped and updated
+   * allowed: MAJOR[.MINOR[.X[-SNAPSHOT]]]
+   */
+  public static final String MIN_CONFIG_VERSION = "1.0.9-SNAPSHOT";
+  public static final String CONFIG_DIR = ".mocca/conf/";
+  public static final String CERTS_DIR = ".mocca/certs/";
+  public static final String VERSION_FILE = ".version";
+  public static final String UNKOWN_VERSION = "unknown";
+  public static final String CONF_TEMPLATE_FILE = "conf-tmp.zip";
+  public static final String CONF_TEMPLATE_RESOURCE = "at/gv/egiz/bku/webstart/conf/conf.zip";
+  public static final String CERTIFICATES_PKG = "at/gv/egiz/bku/certs";
+
+  /**
+   * MOCCA TLS certificate
+   */
+  public static final String KEYSTORE_FILE = "keystore.ks";
+  public static final String PASSWD_FILE = ".secret";
+
+  private static final Log log = LogFactory.getLog(Configurator.class);
+  
+  /** currently installed configuration version */
+  private String version;
+  private String certsVersion;
+  /** whether a new MOCCA TLS cert was created during initialization */
+  private boolean certRenewed = false;
+
+  /**
+   * Checks whether the config directory already exists and creates it otherwise.
+   * @param configDir the config directory to be created
+   * @throws IOException config/certificate creation failed
+   * @throws GeneralSecurityException if MOCCA TLS certificate could not be created
+   * @throws CodingException if MOCCA TLS certificate could not be created
+   */
+  public void ensureConfiguration() throws IOException, CodingException, GeneralSecurityException {
+    File configDir = new File(System.getProperty("user.home") + '/' + CONFIG_DIR);
+    if (configDir.exists()) {
+      if (configDir.isFile()) {
+        log.error("invalid config directory: " + configDir);
+        throw new IOException("invalid config directory: " + configDir);
+      } else {
+        version = readVersion(new File(configDir, VERSION_FILE));
+        if (log.isDebugEnabled()) {
+          log.debug("config directory " + configDir + ", version " + version);
+        }
+        if (updateRequired(version)) {
+          File moccaDir = configDir.getParentFile();
+          File zipFile = new File(moccaDir, "conf-" + version + ".zip");
+          ZipOutputStream zipOS = new ZipOutputStream(new BufferedOutputStream(new FileOutputStream(zipFile)));
+          log.info("backup configuration to " + zipFile);
+          backupAndDelete(configDir, moccaDir.toURI(), zipOS);
+          zipOS.close();
+          initConfig(configDir);
+        }
+      }
+    } else {
+      initConfig(configDir);
+    }
+  }
+
+  /**
+   * To be replaced by TSLs in IAIK-PKI
+   * @throws IOException
+   */
+  public void ensureCertificates() throws IOException {
+    File certsDir = new File(System.getProperty("user.home") + '/' + CERTS_DIR);
+    if (certsDir.exists()) {
+      if (certsDir.isFile()) {
+        log.error("invalid certificate store directory: " + certsDir);
+        throw new IOException("invalid config directory: " + certsDir);
+      } else {
+        certsVersion = readVersion(new File(certsDir, VERSION_FILE));
+        if (log.isDebugEnabled()) {
+          log.debug("certificate-store directory " + certsDir + ", version " + certsVersion);
+        }
+        String newCertsVersion = getCertificatesVersion();
+        if (updateRequiredStrict(certsVersion, newCertsVersion)) {
+          File moccaDir = certsDir.getParentFile();
+          File zipFile = new File(moccaDir, "certs-" + certsVersion + ".zip");
+          ZipOutputStream zipOS = new ZipOutputStream(new BufferedOutputStream(new FileOutputStream(zipFile)));
+          log.info("backup certificates to " + zipFile);
+          backupAndDelete(certsDir, moccaDir.toURI(), zipOS);
+          zipOS.close();
+
+          createCerts(certsDir, newCertsVersion);
+          certsVersion = newCertsVersion;
+        }
+      }
+    } else {
+      String newCertsVersion = getCertificatesVersion();
+      createCerts(certsDir, newCertsVersion);
+      certsVersion = newCertsVersion;
+    }
+  }
+
+  /**
+   * 
+   * @return whether a new MOCCA TLS certificate has been created during initialization
+   */
+  public boolean isCertRenewed() {
+    return certRenewed;
+  }
+
+  /**
+   * @return The first valid (not empty, no comment) line of the version file or
+   * "unknown" if version file cannot be read or does not contain such a line.
+   */
+  protected static String readVersion(File versionFile) {
+    if (versionFile.exists() && versionFile.canRead()) {
+      BufferedReader versionReader = null;
+      try {
+        versionReader = new BufferedReader(new FileReader(versionFile));
+        String version;
+        while ((version = versionReader.readLine().trim()) != null) {
+          if (version.length() > 0 && !version.startsWith("#")) {
+            log.debug("configuration version from " + versionFile + ": " + version);
+            return version;
+          }
+        }
+      } catch (IOException ex) {
+        log.error("failed to read configuration version from " + versionFile, ex);
+      } finally {
+        try {
+          versionReader.close();
+        } catch (IOException ex) {
+        }
+      }
+    }
+    log.debug("unknown configuration version");
+    return UNKOWN_VERSION;
+  }
+
+  /**
+   * Temporary workaround, replace with TSLs in IAIK-PKI.
+   * Retrieves version from BKUCertificates.jar Manifest file. 
+   * The (remote) resource URL will be handled by the JNLP loader, 
+   * and the resource retrieved from the cache.
+   *
+   * @return
+   * @throws IOException
+   */
+  private static String getCertificatesVersion() throws IOException {
+    String certsResourceVersion = null;
+    URL certsURL = Configurator.class.getClassLoader().getResource(CERTIFICATES_PKG);
+    if (certsURL != null) {
+      StringBuilder url = new StringBuilder(certsURL.toExternalForm());
+      url = url.replace(url.length() - CERTIFICATES_PKG.length(), url.length(), "META-INF/MANIFEST.MF");
+      log.trace("retrieve certificates resource version from " + url);
+      certsURL = new URL(url.toString());
+      Manifest certsManifest = new Manifest(certsURL.openStream());
+      Attributes atts = certsManifest.getMainAttributes();
+      if (atts != null) {
+        certsResourceVersion = atts.getValue("Implementation-Version");
+        log.debug("certs resource version: " + certsResourceVersion);
+      }
+    } else {
+      log.error("Failed to retrieve certificates resource " + CERTIFICATES_PKG);
+      throw new IOException("Failed to retrieve certificates resource " + CERTIFICATES_PKG);
+    }
+    return certsResourceVersion;
+  }
+
+  protected static boolean updateRequired(String oldVersion) {
+     log.debug("comparing " + oldVersion + " to " + MIN_CONFIG_VERSION);
+     if (oldVersion != null && !UNKOWN_VERSION.equals(oldVersion)) {
+     
+      int majorEnd = oldVersion.indexOf('-');
+      String oldMajor = (majorEnd < 0) ? oldVersion : oldVersion.substring(0, majorEnd);
+
+      String minMajor = MIN_CONFIG_VERSION;
+      boolean releaseRequired = true;
+      if (MIN_CONFIG_VERSION.endsWith("-SNAPSHOT")) {
+        releaseRequired = false;
+        minMajor = minMajor.substring(0, minMajor.length() - 9);
+      }
+
+      int compare = oldMajor.compareTo(minMajor);
+      if (compare < 0 ||
+              // SNAPSHOT versions are pre-releases (update if release required)
+              (compare == 0 && releaseRequired && oldVersion.startsWith("-SNAPSHOT", majorEnd))) {
+        log.debug("configuration update required");
+        return true;
+      } else {
+        log.debug("configuration up to date");
+        return false;
+      }
+    }
+    log.debug("no old version, configuration update required");
+    return true;
+  }
+
+  /**
+   * if unknown old, update in any case
+   * if known old and unknown new, don't update
+   * @param oldVersion
+   * @param newVersion
+   * @return
+   */
+  private boolean updateRequiredStrict(String oldVersion, String newVersion) {
+    log.debug("comparing " + oldVersion + " to " + newVersion);
+    if (oldVersion != null && !UNKOWN_VERSION.equals(oldVersion)) {
+      if (newVersion != null && !UNKOWN_VERSION.equals(newVersion)) {
+        String[] oldV = oldVersion.split("-");
+        String[] newV = newVersion.split("-");
+        log.trace("comparing " + oldV[0] + " to " + newV[0]);
+        if (oldV[0].compareTo(newV[0]) < 0) {
+          log.debug("update required");
+          return true;
+        } else {
+          log.trace("comparing " + oldV[oldV.length - 1] + " to " + newV[newV.length - 1]);
+          if (oldV[oldV.length - 1].compareTo(newV[newV.length - 1]) < 0) {
+            log.debug("update required");
+            return true;
+          } else {
+            log.debug("no update required");
+            return false;
+          }
+        }
+      }
+      log.debug("unknown new version, do not update");
+      return true;
+    }
+    log.debug("unknown old version, update required");
+    return true;
+  }
+  
+  protected static void backupAndDelete(File dir, URI relativeTo, ZipOutputStream zip) throws IOException {
+    if (dir.isDirectory()) {
+      File[] subDirs = dir.listFiles();
+      for (File subDir : subDirs) {
+        backupAndDelete(subDir, relativeTo, zip);
+        subDir.delete();
+      }
+    } else {
+      URI relativePath = relativeTo.relativize(dir.toURI());
+      ZipEntry entry = new ZipEntry(relativePath.toString());
+      zip.putNextEntry(entry);
+      BufferedInputStream entryIS = new BufferedInputStream(new FileInputStream(dir));
+      StreamUtil.copyStream(entryIS, zip);
+      entryIS.close();
+      zip.closeEntry();
+      dir.delete();
+    }
+  }
+
+  /**
+   * set up a new MOCCA local configuration
+   * (not to be called directly, call ensureConfiguration())
+   * @throws IOException config/certificate creation failed
+   * @throws GeneralSecurityException if MOCCA TLS certificate could not be created
+   * @throws CodingException if MOCCA TLS certificate could not be created
+   */
+  protected void initConfig(File configDir) throws IOException, GeneralSecurityException, CodingException {
+    createConfig(configDir, Launcher.version);
+    version = Launcher.version;
+    createKeyStore(configDir);
+    certRenewed = true;
+  }
+
+  private static void createConfig(File configDir, String version) throws IOException {
+    if (log.isDebugEnabled()) {
+      log.debug("creating configuration version " + Launcher.version + " in " + configDir );
+    }
+    configDir.mkdirs();
+    File confTemplateFile = new File(configDir, CONF_TEMPLATE_FILE);
+    InputStream is = Configurator.class.getClassLoader().getResourceAsStream(CONF_TEMPLATE_RESOURCE);
+    OutputStream os = new BufferedOutputStream(new FileOutputStream(confTemplateFile));
+    StreamUtil.copyStream(is, os);
+    os.close();
+    unzip(confTemplateFile, configDir);
+    confTemplateFile.delete();
+    writeVersionFile(new File(configDir, VERSION_FILE), version);
+  }
+
+  /**
+   * set up a new MOCCA local certStore
+   * @throws IOException config/certificate creation failed
+   * @throws GeneralSecurityException if MOCCA TLS certificate could not be created
+   * @throws CodingException if MOCCA TLS certificate could not be created
+   */
+  private static void createCerts(File certsDir, String certsVersion) throws IOException {
+    if (log.isDebugEnabled()) {
+      log.debug("creating certificate-store " + certsDir + ", version " + certsVersion);
+    }
+    URL certsURL = Configurator.class.getClassLoader().getResource(CERTIFICATES_PKG);
+    if (certsURL != null) {
+      StringBuilder url = new StringBuilder(certsURL.toExternalForm());
+      url = url.replace(url.length() - CERTIFICATES_PKG.length(), url.length(), "META-INF/MANIFEST.MF");
+      log.debug("retrieve certificate resource names from " + url);
+      certsURL = new URL(url.toString());
+      Manifest certsManifest = new Manifest(certsURL.openStream());
+      certsDir.mkdirs();
+      Iterator<String> entries = certsManifest.getEntries().keySet().iterator();
+      while (entries.hasNext()) {
+        String entry = entries.next();
+        if (entry.startsWith(CERTIFICATES_PKG)) {
+          String f = entry.substring(CERTIFICATES_PKG.length()); // "/trustStore/..."
+          new File(certsDir, f.substring(0, f.lastIndexOf('/'))).mkdirs();
+          BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(new File(certsDir, f)));
+          log.debug(f);
+          StreamUtil.copyStream(Configurator.class.getClassLoader().getResourceAsStream(entry), bos);
+          bos.close();
+        } else {
+          log.trace("ignore " + entry);
+        }
+      }
+      writeVersionFile(new File(certsDir, VERSION_FILE), certsVersion);
+    } else {
+      log.error("Failed to retrieve certificates resource " + CERTIFICATES_PKG);
+      throw new IOException("Failed to retrieve certificates resource " + CERTIFICATES_PKG);
+    }
+  }
+
+  private static void unzip(File zipfile, File toDir) throws IOException {
+    ZipFile zipFile = new ZipFile(zipfile);
+    Enumeration<? extends ZipEntry> entries = zipFile.entries();
+    while (entries.hasMoreElements()) {
+      ZipEntry entry = entries.nextElement();
+      File eF = new File(toDir, entry.getName());
+      if (entry.isDirectory()) {
+        eF.mkdirs();
+        continue;
+      }
+      File f = new File(eF.getParent());
+      f.mkdirs();
+      StreamUtil.copyStream(zipFile.getInputStream(entry),
+              new FileOutputStream(eF));
+    }
+    zipFile.close();
+  }
+
+  private static void writeVersionFile(File versionFile, String version) throws IOException {
+    BufferedWriter versionWriter = new BufferedWriter(new FileWriter(versionFile));
+    versionWriter.write("# MOCCA Web Start configuration version\n");
+    versionWriter.write("# DO NOT MODIFY THIS FILE\n\n");
+    versionWriter.write(version);
+    versionWriter.close();
+  }
+
+  private static void createKeyStore(File configDir) throws IOException, GeneralSecurityException, CodingException {
+    char[] password = UUID.randomUUID().toString().toCharArray();
+    File passwdFile = new File(configDir, PASSWD_FILE);
+    FileWriter passwdWriter = new FileWriter(passwdFile);
+    passwdWriter.write(password);
+    passwdWriter.close();
+    if (!passwdFile.setReadable(false, false) || !passwdFile.setReadable(true, true)) {
+      passwdFile.delete();
+      throw new IOException("failed to make " + passwdFile + " owner readable only, deleting file");
+    }
+    TLSServerCA ca = new TLSServerCA();
+    KeyStore ks = ca.generateKeyStore(password);
+    File ksFile = new File(configDir, KEYSTORE_FILE);
+    FileOutputStream fos = new FileOutputStream(ksFile);
+    ks.store(fos, password);
+    fos.close();
+  }
+}
diff --git a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Container.java b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Container.java
index 89044486..4df90ab2 100644
--- a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Container.java
+++ b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Container.java
@@ -1,22 +1,28 @@
 package at.gv.egiz.bku.webstart;

 

 import at.gv.egiz.bku.utils.StreamUtil;

+import java.awt.AWTPermission;

 import java.io.BufferedOutputStream;

 import java.io.BufferedReader;

 import java.io.File;

 import java.io.FileNotFoundException;

 import java.io.FileOutputStream;

+import java.io.FilePermission;

 import java.io.FileReader;

 import java.io.IOException;

 import java.io.InputStream;

 import java.io.OutputStream;

+import java.lang.reflect.ReflectPermission;

+import java.net.NetPermission;

+import java.net.SocketPermission;

+import java.security.Permissions;

+import java.security.SecurityPermission;

+import java.util.PropertyPermission;

+import javax.smartcardio.CardPermission;

 import org.apache.commons.logging.Log;

 import org.apache.commons.logging.LogFactory;

 import org.mortbay.jetty.Connector;

-import org.mortbay.jetty.Handler;

 import org.mortbay.jetty.Server;

-import org.mortbay.jetty.handler.DefaultHandler;

-import org.mortbay.jetty.handler.HandlerCollection;

 import org.mortbay.jetty.nio.SelectChannelConnector;

 import org.mortbay.jetty.security.SslSocketConnector;

 import org.mortbay.jetty.webapp.WebAppContext;

@@ -28,12 +34,18 @@ public class Container {
   public static final String HTTPS_PORT_PROPERTY = "mocca.http.port";

 

   private static Log log = LogFactory.getLog(Container.class);

+  static {

+    if (log.isDebugEnabled()) {

+      //Jetty log INFO and WARN, include ignored exceptions

+      //jetty logging may be further restricted by setting level in log4j.properties

+      System.setProperty("VERBOSE", "true");

+      //do not set Jetty DEBUG logging, produces loads of output

+      //System.setProperty("DEBUG", "true");

+    }

+  }

 

   private Server server;

 

-  public Container() {

-  }

-

   public void init() throws IOException {

 //    System.setProperty("DEBUG", "true");

     server = new Server();

@@ -55,15 +67,15 @@ public class Container {
     sslConnector.setPort(Integer.getInteger(HTTPS_PORT_PROPERTY, 3496).intValue());

     sslConnector.setAcceptors(1);

     sslConnector.setHost("127.0.0.1");

-    File configDir = new File(System.getProperty("user.home") + "/" + BKULauncher.CONFIG_DIR);

-    File keystoreFile = new File(configDir, BKULauncher.KEYSTORE_FILE);

+    File configDir = new File(System.getProperty("user.home") + "/" + Configurator.CONFIG_DIR);

+    File keystoreFile = new File(configDir, Configurator.KEYSTORE_FILE);

     if (!keystoreFile.canRead()) {

       log.error("MOCCA keystore file not readable: " + keystoreFile.getAbsolutePath());

       throw new FileNotFoundException("MOCCA keystore file not readable: " + keystoreFile.getAbsolutePath());

     }

     log.debug("loading MOCCA keystore from " + keystoreFile.getAbsolutePath());

     sslConnector.setKeystore(keystoreFile.getAbsolutePath());

-    File passwdFile = new File(configDir, BKULauncher.PASSWD_FILE);

+    File passwdFile = new File(configDir, Configurator.PASSWD_FILE);

     BufferedReader reader = new BufferedReader(new FileReader(passwdFile));

     String pwd;

     while ((pwd = reader.readLine()) != null) {

@@ -107,7 +119,6 @@ public class Container {
 

     sslConnector.setExcludeCipherSuites(RFC4492CipherSuites);

 

-

     server.setConnectors(new Connector[] { connector, sslConnector });

     

     WebAppContext webapp = new WebAppContext();

@@ -116,13 +127,13 @@ public class Container {
     webapp.setExtractWAR(true); 

     webapp.setParentLoaderPriority(false);

 

-    webapp.setWar(copyWebapp(webapp.getTempDirectory())); //getClass().getClassLoader().getResource("BKULocalWar/").toString());

-

+    webapp.setWar(copyWebapp(webapp.getTempDirectory()));

+    webapp.setPermissions(getPermissions(webapp.getTempDirectory()));

+    

     server.setHandler(webapp);

     server.setGracefulShutdown(1000*3);

   }

 

-

   private String copyWebapp(File webappDir) throws IOException {

     File webapp = new File(webappDir, "BKULocal.war");

     log.debug("copying BKULocal classpath resource to " + webapp);

@@ -133,6 +144,44 @@ public class Container {
     return webapp.getPath();

   }

 

+  private Permissions getPermissions(File webappDir) {

+    Permissions perms = new Permissions();

+

+    // jetty-webstart (spring?)

+    perms.add(new RuntimePermission("getClassLoader"));

+

+    // standard permissions

+    perms.add(new PropertyPermission("*", "read"));

+    perms.add(new RuntimePermission("accessDeclaredMembers"));

+    perms.add(new RuntimePermission("accessClassInPackage.*"));

+    perms.add(new RuntimePermission("defineClassInPackage.*"));

+    perms.add(new RuntimePermission("setFactory"));

+    perms.add(new RuntimePermission("getProtectionDomain"));

+    perms.add(new RuntimePermission("modifyThread"));

+    perms.add(new RuntimePermission("modifyThreadGroup"));

+    perms.add(new RuntimePermission("setFactory"));

+    perms.add(new ReflectPermission("suppressAccessChecks"));

+

+    // MOCCA specific

+    perms.add(new SocketPermission("*", "connect,resolve"));

+    perms.add(new NetPermission("specifyStreamHandler"));

+    perms.add(new SecurityPermission("insertProvider.*"));

+    perms.add(new SecurityPermission("putProviderProperty.*"));

+    perms.add(new SecurityPermission("removeProvider.*"));

+    perms.add(new CardPermission("*", "*"));

+    perms.add(new AWTPermission("*"));

+

+    perms.add(new FilePermission(webappDir.getAbsolutePath() + "/-", "read"));

+    perms.add(new FilePermission(new File(System.getProperty("java.home") + "/lib/xalan.properties").getAbsolutePath(), "read"));

+    perms.add(new FilePermission(new File(System.getProperty("java.home") + "/lib/xerces.properties").getAbsolutePath(), "read"));

+    perms.add(new FilePermission(new File(System.getProperty("user.home")).getAbsolutePath(), "read, write"));

+    perms.add(new FilePermission(new File(System.getProperty("user.home") + "/-").getAbsolutePath(), "read, write"));

+    perms.add(new FilePermission(new File(System.getProperty("user.home") + "/.mocca/logs/*").getAbsolutePath(), "read, write,delete"));

+

+

+    return perms;

+  }

+

   public void start() throws Exception {

     server.start();

   }

diff --git a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Launcher.java b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Launcher.java
new file mode 100644
index 00000000..f7be7b65
--- /dev/null
+++ b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/Launcher.java
@@ -0,0 +1,230 @@
+package at.gv.egiz.bku.webstart;

+

+import iaik.asn1.CodingException;

+import java.io.IOException;

+import java.net.URISyntaxException;

+import java.util.Locale;

+import java.util.MissingResourceException;

+import java.util.ResourceBundle;

+

+import javax.jnlp.UnavailableServiceException;

+import org.apache.commons.logging.Log;

+import org.apache.commons.logging.LogFactory;

+

+import at.gv.egiz.bku.webstart.ui.BKUControllerInterface;

+import at.gv.egiz.bku.webstart.ui.TrayIconDialog;

+import com.sun.javaws.security.JavaWebStartSecurity;

+import java.awt.Desktop;

+import java.awt.SplashScreen;

+import java.net.BindException;

+import java.net.URI;

+import java.net.URL;

+import java.security.GeneralSecurityException;

+import java.util.jar.Attributes;

+import java.util.jar.Manifest;

+import javax.jnlp.BasicService;

+import javax.jnlp.ServiceManager;

+import org.mortbay.util.MultiException;

+

+public class Launcher implements BKUControllerInterface {

+

+  public static final String WEBAPP_RESOURCE = "BKULocal.war";

+  public static final String CERTIFICATES_RESOURCE = "BKUCertificates.jar";

+  public static final String WEBAPP_FILE = "BKULocal.war";

+  public static final String MESSAGES_RESOURCE = "at/gv/egiz/bku/webstart/ui/UIMessages";

+  /** resource bundle messages */

+  public static final String GREETING_CAPTION = "Greetings.Caption";

+  public static final String GREETING_MESSAGE = "Greetings.Message";

+  public static final String CONFIG_CAPTION = "Config.Caption";

+  public static final String CONFIG_MESSAGE = "Config.Message";

+  public static final String STARTUP_CAPTION = "Startup.Caption";

+  public static final String STARTUP_MESSAGE = "Startup.Message";

+  public static final String ERROR_CAPTION = "Error.Caption";

+  public static final String ERROR_STARTUP_MESSAGE = "Error.Startup.Message";

+  public static final String ERROR_CONF_MESSAGE = "Error.Conf.Message";

+  public static final String ERROR_BIND_MESSAGE = "Error.Bind.Message";

+  public static final URI HTTPS_SECURITY_LAYER_URI;

+  private static Log log = LogFactory.getLog(Launcher.class);

+

+  static {

+    URI tmp = null;

+    try {

+      tmp = new URI("https://localhost:" + Integer.getInteger(Container.HTTPS_PORT_PROPERTY, 3496).intValue());

+    } catch (URISyntaxException ex) {

+      log.error(ex);

+    } finally {

+      HTTPS_SECURITY_LAYER_URI = tmp;

+    }

+  }

+

+  public static final String version;

+  static {

+    String tmp = Configurator.UNKOWN_VERSION;

+    try {

+      String bkuWebStartJar = Launcher.class.getProtectionDomain().getCodeSource().getLocation().toString();

+      URL manifestURL = new URL("jar:" + bkuWebStartJar + "!/META-INF/MANIFEST.MF");

+      if (log.isTraceEnabled()) {

+        log.trace("read version information from " + manifestURL);

+      }

+      Manifest manifest = new Manifest(manifestURL.openStream());

+      Attributes atts = manifest.getMainAttributes();

+      if (atts != null) {

+        tmp = atts.getValue("Implementation-Build");

+      }

+    } catch (IOException ex) {

+      log.error("failed to read version", ex);

+    } finally {

+      version = tmp;

+      log.info("BKU Web Start " + version);

+    }

+  }

+

+  private Configurator config;

+  private Container server;

+  private BasicService basicService;

+

+  private void initStart() {

+    try {

+      basicService = (BasicService) ServiceManager.lookup("javax.jnlp.BasicService");

+      if (basicService.isOffline()) {

+        log.info("launching MOCCA Web Start offline");

+      } else {

+        log.info("launching MOCCA Web Start online");

+      }

+    } catch (UnavailableServiceException ex) {

+      log.info("Failed to obtain JNLP service: " + ex.getMessage());

+    }

+  }

+

+  private void initTrayIcon() {

+    log.debug("init MOCCA tray icon");

+    Locale loc = Locale.getDefault();

+    ResourceBundle resourceBundle;

+    try {

+      resourceBundle = ResourceBundle.getBundle(

+              MESSAGES_RESOURCE, loc);

+    } catch (MissingResourceException mx) {

+      resourceBundle = ResourceBundle.getBundle(

+              MESSAGES_RESOURCE, Locale.ENGLISH);

+    }

+    TrayIconDialog.getInstance().init(resourceBundle);

+    TrayIconDialog.getInstance().setShutdownHook(this);

+//    TrayIconDialog.getInstance().displayInfo(GREETING_CAPTION, GREETING_MESSAGE);

+  }

+

+  private void initConfig() throws IOException, CodingException, GeneralSecurityException {

+    config = new Configurator();

+    config.ensureConfiguration();

+    config.ensureCertificates();

+  }

+

+  private void startServer() throws Exception {

+    log.info("init servlet container and MOCCA webapp");

+    server = new Container();

+    server.init();

+    server.start();

+  }

+

+  private void initFinished() {

+    try {

+      // standalone (non-webstart) version has splashscreen

+      if (SplashScreen.getSplashScreen() != null) {

+        try {

+          SplashScreen.getSplashScreen().close();

+        } catch (IllegalStateException ex) {

+          log.warn("Failed to close splash screen: " + ex.getMessage());

+        }

+      }

+      if (config.isCertRenewed()) {

+        // don't use basicService.showDocument(), which causes a java ssl warning dialog

+        if (Desktop.isDesktopSupported()) {

+          Desktop desktop = Desktop.getDesktop();

+          if (desktop.isSupported(Desktop.Action.BROWSE)) {

+            try {

+              desktop.browse(HTTPS_SECURITY_LAYER_URI);

+            } catch (Exception ex) {

+              log.error("failed to open system browser, install TLS certificate manually: " + HTTPS_SECURITY_LAYER_URI, ex);

+            }

+          } else {

+            log.error("failed to open system browser, install TLS certificate manually: " + HTTPS_SECURITY_LAYER_URI);

+          }

+        } else {

+          log.error("failed to open system browser, install TLS certificate manually: " + HTTPS_SECURITY_LAYER_URI);

+        }

+      }

+      log.info("BKU successfully started");

+      server.join();

+    } catch (InterruptedException e) {

+      log.warn("failed to join server: " + e.getMessage(), e);

+    }

+  }

+

+  @Override

+  public void shutDown() {

+    log.info("Shutting down server");

+    if ((server != null) && (server.isRunning())) {

+      try {

+        if (server.isRunning()) {

+          server.stop();

+        }

+      } catch (Exception e) {

+        log.debug(e.toString());

+      } finally {

+        if (server.isRunning()) {

+          server.destroy();

+        }

+      }

+    }

+    System.exit(0);

+  }

+

+  public static void main(String[] args) throws InterruptedException, IOException {

+

+    if (log.isTraceEnabled()) {

+      SecurityManager sm = System.getSecurityManager();

+      if (sm instanceof JavaWebStartSecurity) {

+        System.setSecurityManager(new LogSecurityManager((JavaWebStartSecurity) sm));

+      }

+    }

+

+    Launcher launcher = new Launcher();

+    launcher.initStart();

+    launcher.initTrayIcon(); //keep reference? BKULauncher not garbage collected after main()

+    

+    try {

+      TrayIconDialog.getInstance().displayInfo(CONFIG_CAPTION, CONFIG_MESSAGE);

+      launcher.initConfig();

+    } catch (Exception ex) {

+      log.fatal("Failed to initialize configuration", ex);

+      TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_CONF_MESSAGE);

+      Thread.sleep(5000);

+      System.exit(-1000);

+    }

+

+    try {

+      TrayIconDialog.getInstance().displayInfo(STARTUP_CAPTION, STARTUP_MESSAGE);

+      launcher.startServer();

+      TrayIconDialog.getInstance().displayInfo(GREETING_CAPTION, GREETING_MESSAGE);

+      launcher.initFinished();

+    } catch (BindException ex) {

+      log.fatal("Failed to launch server, " + ex.getMessage(), ex);

+      TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_BIND_MESSAGE);

+      Thread.sleep(5000);

+      System.exit(-1000);

+    } catch (MultiException ex) {

+      log.fatal("Failed to launch server, " + ex.getMessage(), ex);

+      if (ex.getThrowable(0) instanceof BindException) {

+        TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_BIND_MESSAGE);

+      } else {

+        TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_STARTUP_MESSAGE);

+      }

+      Thread.sleep(5000);

+      System.exit(-1000);

+    } catch (Exception e) {

+      log.fatal("Failed to launch server, " + e.getMessage(), e);

+      TrayIconDialog.getInstance().displayError(ERROR_CAPTION, ERROR_STARTUP_MESSAGE);

+      Thread.sleep(5000);

+      System.exit(-1000);

+    }

+  }

+}

diff --git a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/LogSecurityManager.java b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/LogSecurityManager.java
new file mode 100644
index 00000000..99fd403b
--- /dev/null
+++ b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/LogSecurityManager.java
@@ -0,0 +1,440 @@
+/*
+ * Copyright 2008 Federal Chancellery Austria and
+ * Graz University of Technology
+ * 
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package at.gv.egiz.bku.webstart;
+
+import com.sun.javaws.security.JavaWebStartSecurity;
+import java.io.FileDescriptor;
+import java.net.InetAddress;
+import java.security.Permission;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ * JVM argument -Djava.security.debug=access,failure
+ * (passed as attribute to java element in jnlp) is ignored.
+ * 
+ * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at>
+ */
+public class LogSecurityManager extends SecurityManager {
+
+  protected static final Log log = LogFactory.getLog(LogSecurityManager.class);
+  JavaWebStartSecurity sm;
+
+  public LogSecurityManager(JavaWebStartSecurity sm) {
+    this.sm = sm;
+//    AppPolicy policy = AppPolicy.getInstance();
+//    SecurityManager sm = System.getSecurityManager();
+  }
+
+  @Override
+  public void checkAccept(String host, int port) {
+    try {
+      sm.checkAccept(host, port);
+    } catch (SecurityException ex) {
+      log.warn("checkAccept(" + host + ", " + port + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkAccess(Thread g) {
+    try {
+      sm.checkAccess(g);
+    } catch (SecurityException ex) {
+      log.warn("checkAccess(" + g + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkAccess(ThreadGroup g) {
+    try {
+      sm.checkAccess(g);
+    } catch (SecurityException ex) {
+      log.warn("checkAccess(" + g + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+
+  }
+
+  @Override
+  public void checkAwtEventQueueAccess() {
+    try {
+      sm.checkAwtEventQueueAccess();
+    } catch (SecurityException ex) {
+      log.warn("checkAwtEventQAccess():" + ex.getMessage(), ex);
+      throw ex;
+    }
+
+  }
+
+  @Override
+  public void checkConnect(String host, int port) {
+    try {
+      sm.checkConnect(host, port);
+    } catch (SecurityException ex) {
+      log.warn("checkConnect(" + host + ", " + port + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkConnect(String host, int port, Object context) {
+    try {
+      sm.checkConnect(host, port, context);
+    } catch (SecurityException ex) {
+      log.warn("checkConnect(" + host + ", " + port + ", " + context + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkCreateClassLoader() {
+    try {
+      sm.checkCreateClassLoader();
+    } catch (SecurityException ex) {
+      log.warn("checkCreateClassLoader(): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkDelete(String file) {
+    try {
+      sm.checkDelete(file);
+    } catch (SecurityException ex) {
+      log.warn("checkDelete(" + file + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkExec(String cmd) {
+    try {
+      sm.checkExec(cmd);
+    } catch (SecurityException ex) {
+      log.warn("checkExec(" + cmd + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkExit(int status) {
+    try {
+      sm.checkExit(status);
+    } catch (SecurityException ex) {
+      log.warn("checkExit(" + status + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkLink(String lib) {
+    try {
+      sm.checkLink(lib);
+    } catch (SecurityException ex) {
+      log.warn("checkLink(" + lib + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkListen(int port) {
+    try {
+      sm.checkListen(port);
+    } catch (SecurityException ex) {
+      log.warn("checkListen(" + port + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkMemberAccess(Class<?> clazz, int which) {
+    try {
+      sm.checkMemberAccess(clazz, which);
+    } catch (SecurityException ex) {
+      log.warn("checkMemberAccess(" + clazz + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkMulticast(InetAddress maddr) {
+    try {
+      sm.checkMulticast(maddr);
+    } catch (SecurityException ex) {
+      log.warn("checkMulticast(" + maddr + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkMulticast(InetAddress maddr, byte ttl) {
+    try {
+      sm.checkMulticast(maddr,ttl);
+    } catch (SecurityException ex) {
+      log.warn("checkMulticast(" + maddr + "," + ttl + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkPackageAccess(String pkg) {
+    try {
+      sm.checkPackageAccess(pkg);
+    } catch (SecurityException ex) {
+      log.warn("checkPackageAccess(" + pkg + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkPackageDefinition(String pkg) {
+    try {
+      sm.checkPackageDefinition(pkg);
+    } catch (SecurityException ex) {
+      log.warn("checkPackageDefinition(" + pkg + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkPermission(Permission perm) {
+    try {
+      sm.checkPermission(perm);
+    } catch (SecurityException ex) {
+      log.warn("checkPermission(" + perm.toString() + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkPermission(Permission perm, Object context) {
+    try {
+      sm.checkPermission(perm, context);
+    } catch (SecurityException ex) {
+      log.warn("checkPermission(" + perm.toString() + ", ctx): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkPrintJobAccess() {
+    try {
+      sm.checkPrintJobAccess();
+    } catch (SecurityException ex) {
+      log.info("checkPrintJobAccess(): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  /**
+   * allowed
+   */
+  @Override
+  public void checkPropertiesAccess() {
+    try {
+      sm.checkPropertiesAccess();
+    } catch (SecurityException ex) {
+      log.info("checkPropertiesAccess(): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  /**
+   * access to all properties allowed
+   * @param key
+   */
+  @Override
+  public void checkPropertyAccess(String key) {
+    try {
+      sm.checkPropertyAccess(key);
+    } catch (SecurityException ex) {
+      log.info("checkPropertyAccess(" + key + "): " + ex.getMessage());
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkRead(FileDescriptor fd) {
+    try {
+      sm.checkRead(fd);
+    } catch (SecurityException ex) {
+      log.warn("checkRead(" + fd + ") " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkRead(String file) {
+    try {
+      sm.checkRead(file);
+    } catch (SecurityException ex) {
+      log.warn("checkRead(" + file + ") " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkRead(String file, Object context) {
+    try {
+      sm.checkRead(file, context);
+    } catch (SecurityException ex) {
+      log.warn("checkRead(" + file + ") " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkSecurityAccess(String target) {
+    try {
+      sm.checkSecurityAccess(target);
+    } catch (SecurityException ex) {
+      log.info("checkSecurityAccess(" + target + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public void checkSetFactory() {
+    log.info("checkSetFactory() ");
+    try {
+      sm.checkSetFactory();
+    } catch (SecurityException ex) {
+      log.warn("checkSetFactroy(): " + ex.getMessage(), ex);
+      throw ex;
+    }
+
+  }
+
+  @Override
+  public void checkSystemClipboardAccess() {
+    try {
+      sm.checkSystemClipboardAccess();
+    } catch (SecurityException ex) {
+      log.info("checkSystemClipboardAccess(): " + ex.getMessage(), ex);
+      throw ex;
+    }
+  }
+
+  @Override
+  public boolean checkTopLevelWindow(Object window) {
+    log.info("checkTopLevelWindow(Object window)");
+    try {
+      return sm.checkTopLevelWindow(window);
+    } catch (SecurityException ex) {
+      log.warn("checkTopLevelWindow(" + window + "): " + ex.getMessage(), ex);
+      throw ex;
+    }
+
+  }
+
+  @Override
+  public void checkWrite(FileDescriptor fd) {
+    try {
+      sm.checkWrite(fd);
+    } catch (SecurityException ex) {
+      log.info("checkWrite(" + fd + "): " + ex.getMessage(), ex);
+    }
+  }
+
+  @Override
+  public void checkWrite(String file) {
+    try {
+      sm.checkWrite(file);
+    } catch (SecurityException ex) {
+      log.info("checkWrite(" + file + "): " + ex.getMessage(), ex);
+    }
+  }
+
+//  @Override
+//  protected int classDepth(String name) {
+//    log.info("classDepth(String name)"); return this.classDepth(name);
+//  }
+//
+//  @Override
+//  protected int classLoaderDepth() {
+//    log.info("classLoaderDepth"); return sm.classLoaderDepth();
+//  }
+//
+//  @Override
+//  protected Object clone() throws CloneNotSupportedException {
+//    log.info("clone"); return sm.clone();
+//  }
+//
+//  @Override
+//  protected ClassLoader currentClassLoader() {
+//    log.info("currentClassLoader"); return sm.currentClassLoader();
+//  }
+//
+//  @Override
+//  protected Class<?> currentLoadedClass() {
+//    log.info("currentLoadedClass"); return sm.currentLoadedClass();
+//  }
+  @Override
+  public boolean equals(Object obj) {
+    log.info("equals");
+    return sm.equals(obj);
+  }
+
+//  @Override
+//  protected void finalize() throws Throwable {
+//    log.info("finalize"); sm.finalize();
+//  }
+//  @Override
+//  protected Class[] getClassContext() {
+//    log.info("getClassContext"); return sm.getClassContext();
+//  }
+  @Override
+  public boolean getInCheck() {
+    log.info("getInCheck");
+    return sm.getInCheck();
+  }
+
+  @Override
+  public Object getSecurityContext() {
+    log.info("getSecurityContext");
+    return sm.getSecurityContext();
+  }
+
+  @Override
+  public ThreadGroup getThreadGroup() {
+    log.info("getThreadGroup");
+    return sm.getThreadGroup();
+  }
+
+  @Override
+  public int hashCode() {
+    log.info("hashCode");
+    return sm.hashCode();
+  }
+
+//  @Override
+//  protected boolean inClass(String name) {
+//    log.info("inClass"); return sm.inClass(name);
+//  }
+//
+//  @Override
+//  protected boolean inClassLoader() {
+//    log.info(""); return sm.inClassLoader();
+//  }
+  @Override
+  public String toString() {
+    log.info("toString");
+    return sm.toString();
+  }
+}
diff --git a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/ui/TrayIconDialog.java b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/ui/TrayIconDialog.java
index 9990b2a0..fb7c40dd 100644
--- a/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/ui/TrayIconDialog.java
+++ b/BKUWebStart/src/main/java/at/gv/egiz/bku/webstart/ui/TrayIconDialog.java
@@ -36,7 +36,7 @@ import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
 public class TrayIconDialog implements TrayIconDialogInterface {
-  public static final String TRAYICON_RESOURCE = "at/gv/egiz/bku/webstart/ui/trayicon.png";
+  public static final String TRAYICON_RESOURCE = "at/gv/egiz/bku/webstart/ui/trayicon_32.png";
   public static final String TRAYMENU_SHUTDOWN = "TrayMenu.Shutdown";
   public static final String TRAYMENU_TOOLTIP = "TrayMenu.Tooltip";
 
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_16.ico b/BKUWebStart/src/main/jnlp/resources/img/logo_16.ico
new file mode 100644
index 00000000..eaedb0ad
--- /dev/null
+++ b/BKUWebStart/src/main/jnlp/resources/img/logo_16.ico
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_16.png b/BKUWebStart/src/main/jnlp/resources/img/logo_16.png
new file mode 100644
index 00000000..f84f108d
--- /dev/null
+++ b/BKUWebStart/src/main/jnlp/resources/img/logo_16.png
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_16.xpm b/BKUWebStart/src/main/jnlp/resources/img/logo_16.xpm
new file mode 100644
index 00000000..de557170
--- /dev/null
+++ b/BKUWebStart/src/main/jnlp/resources/img/logo_16.xpm
@@ -0,0 +1,274 @@
+/* XPM */
+static char * logo_16x16_xpm[] = {
+"16 16 255 2",
+"  	c #EDF2FA",
+". 	c #555249",
+"+ 	c #F3F6FC",
+"@ 	c #ED1C24",
+"# 	c #939698",
+"$ 	c #FFE699",
+"% 	c #BBAA76",
+"& 	c #464749",
+"* 	c #CCCCCC",
+"= 	c #EE262D",
+"- 	c #FCDADC",
+"; 	c #6B6E72",
+"> 	c #FDE4E5",
+", 	c #D0D6DE",
+"' 	c #968C78",
+") 	c #848182",
+"! 	c #535458",
+"~ 	c #76797E",
+"{ 	c #EE2C33",
+"] 	c #444444",
+"^ 	c #80848A",
+"/ 	c #5A636E",
+"( 	c #738974",
+"_ 	c #ACAEB1",
+": 	c #929F98",
+"< 	c #47443F",
+"[ 	c #363436",
+"} 	c #E4ECF7",
+"| 	c #5D5E61",
+"1 	c #F14C53",
+"2 	c #A2A3A5",
+"3 	c #EF333A",
+"4 	c #515052",
+"5 	c #5C685E",
+"6 	c #FDEAEB",
+"7 	c #7A7B7D",
+"8 	c #9FA1A4",
+"9 	c #FBFCFE",
+"0 	c #4B514D",
+"a 	c #888A8C",
+"b 	c #777777",
+"c 	c #525355",
+"d 	c #E7EEF8",
+"e 	c #A4A9AF",
+"f 	c #F04148",
+"g 	c #FFF4D7",
+"h 	c #616365",
+"i 	c #231F20",
+"j 	c #D4DDE9",
+"k 	c #918F8F",
+"l 	c #8A8E95",
+"m 	c #F1CA3F",
+"n 	c #B5BBC5",
+"o 	c #F1F1F1",
+"p 	c #9FA5AD",
+"q 	c #363432",
+"r 	c #888888",
+"s 	c #FFFFFF",
+"t 	c #7D745A",
+"u 	c #94875D",
+"v 	c #999999",
+"w 	c #5F6165",
+"x 	c #635E51",
+"y 	c #C8C7C7",
+"z 	c #CAD1DD",
+"A 	c #5A5758",
+"B 	c #C0C7D1",
+"C 	c #9399A1",
+"D 	c #E4C14B",
+"E 	c #AE9B5E",
+"F 	c #BAB9B9",
+"G 	c #C9AE59",
+"H 	c #767374",
+"I 	c #D6D5D5",
+"J 	c #DDDDDD",
+"K 	c #666666",
+"L 	c #E3E3E3",
+"M 	c #ACABAB",
+"N 	c #222222",
+"O 	c #9E9D9D",
+"P 	c #333333",
+"Q 	c #EEEEEE",
+"R 	c #BBA55C",
+"S 	c #BBBBBB",
+"T 	c #706A56",
+"U 	c #3F3B3C",
+"V 	c #A1915E",
+"W 	c #686566",
+"X 	c #AAB0B9",
+"Y 	c #111111",
+"Z 	c #444344",
+"` 	c #897E5C",
+" .	c #4C494A",
+"..	c #669DCD",
+"+.	c #C6C8CA",
+"@.	c #555556",
+"#.	c #312D2E",
+"$.	c #5F6A78",
+"%.	c #6C95BC",
+"&.	c #D6B853",
+"*.	c #525962",
+"=.	c #636467",
+"-.	c #6C8AAA",
+";.	c #E1E2E3",
+">.	c #DE9E56",
+",.	c #70B76A",
+"'.	c #6C90B3",
+").	c #AB875E",
+"!.	c #F2575D",
+"~.	c #B9BBBD",
+"{.	c #FFF1CC",
+"].	c #424347",
+"^.	c #4A4E55",
+"/.	c #637183",
+"(.	c #ED2028",
+"_.	c #65778C",
+":.	c #688268",
+"<.	c #7C7F81",
+"[.	c #706355",
+"}.	c #B88E5F",
+"|.	c #C5945D",
+"1.	c #565E58",
+"2.	c #D9ECD4",
+"3.	c #72A26F",
+"4.	c #72AA6E",
+"5.	c #FBB161",
+"6.	c #AAAAAA",
+"7.	c #937A5D",
+"8.	c #6B84A0",
+"9.	c #FFEDB5",
+"0.	c #F1CE5D",
+"a.	c #FFDBB4",
+"b.	c #697E96",
+"c.	c #EAA151",
+"d.	c #92CD8B",
+"e.	c #77C371",
+"f.	c #7C6C59",
+"g.	c #719B6E",
+"h.	c #FCBB75",
+"i.	c #FFD742",
+"j.	c #606162",
+"k.	c #6C6C6E",
+"l.	c #E2E3E4",
+"m.	c #6999C5",
+"n.	c #D4D5D7",
+"o.	c #F7F9FD",
+"p.	c #635950",
+"q.	c #F0F0F1",
+"r.	c #FDE3E4",
+"s.	c #706F6D",
+"t.	c #FFDD6F",
+"u.	c #787E88",
+"v.	c #D6BC69",
+"w.	c #EEEFF0",
+"x.	c #63615A",
+"y.	c #89C982",
+"z.	c #AEA58E",
+"A.	c #F3F9F1",
+"B.	c #4D5056",
+"C.	c #6E926C",
+"D.	c #6C8A6A",
+"E.	c #E4C564",
+"F.	c #77A0C8",
+"G.	c #898169",
+"H.	c #FFF7EE",
+"I.	c #333336",
+"J.	c #727878",
+"K.	c #AE9D66",
+"L.	c #607160",
+"M.	c #6B756F",
+"N.	c #71B16C",
+"O.	c #948A6C",
+"P.	c #7DC479",
+"Q.	c #D6BA5E",
+"R.	c #E1F0DE",
+"S.	c #ADD8A4",
+"T.	c #6E737C",
+"U.	c #9E8262",
+"V.	c #535D54",
+"W.	c #7D7766",
+"X.	c #A1A6AD",
+"Y.	c #D3D4D7",
+"Z.	c #ADAAA6",
+"`.	c #B7B9BC",
+" +	c #C39765",
+".+	c #F25E64",
+"++	c #F36268",
+"@+	c #769C74",
+"#+	c #B69166",
+"$+	c #F9FBFD",
+"%+	c #FFFBFB",
+"&+	c #FFE07C",
+"*+	c #646B68",
+"=+	c #6D6965",
+"-+	c #738498",
+";+	c #C8BEA3",
+">+	c #C1C4C9",
+",+	c #A19984",
+"'+	c #E4C979",
+")+	c #F1D375",
+"!+	c #80C679",
+"~+	c #B3B6BC",
+"{+	c #8D9096",
+"]+	c #9FA8A1",
+"^+	c #CFD9CE",
+"/+	c #FED5A9",
+"(+	c #D5D9E0",
+"_+	c #8D877F",
+":+	c #697B6A",
+"<+	c #FFFBF0",
+"[+	c #E3D4AC",
+"}+	c #F1CC4F",
+"|+	c #FFD954",
+"1+	c #C8E4C0",
+"2+	c #BEE0B7",
+"3+	c #D6BE73",
+"4+	c #857869",
+"5+	c #E5E1DC",
+"6+	c #85A7CB",
+"7+	c #C9B26C",
+"8+	c #D4C6B5",
+"9+	c #C9B67E",
+"0+	c #FFE5CA",
+"a+	c #FCB66B",
+"b+	c #E4E4E5",
+"c+	c #E3E4E5",
+"d+	c #E8EBEF",
+"e+	c #EBEDF0",
+"f+	c #87898C",
+"g+	c #B19E7E",
+"h+	c #B5C2BF",
+"i+	c #FDC180",
+"j+	c #EE2930",
+"k+	c #E4E8EE",
+"l+	c #565552",
+"m+	c #E4CE8D",
+"n+	c #636C79",
+"o+	c #A3D49B",
+"p+	c #858B94",
+"q+	c #84868C",
+"r+	c #F1D069",
+"s+	c #D2995A",
+"t+	c #B8BEC6",
+"u+	c #EF3B42",
+"v+	c #474444",
+"w+	c #E1E5EC",
+"x+	c #FDFEFE",
+"y+	c #FFF7E3",
+"z+	c #62A1D7",
+"A+	c #6DC067",
+"B+	c #FAA74A",
+"C+	c #FFD531",
+"D+	c #E0EAF7",
+"E+	c #000000",
+"F+	c #FFFFFF",
+"  9 _ & < K.i.u i T R C+G x C+C+",
+"+.& < E C+R . q q u C+C+T G C+C+",
+"i t m m T q u m m x . m . C+C+C+",
+"t D t q ` m C+C+C+C+t . < G E t ",
+"x . E m C+C+C+C+C+C+C+. T u E m ",
+"i m C+C+C+C+C+C+C+C+m T t C+C+C+",
+"< V C+C+C+C+C+m D ` q x &.C+C+C+",
+"G < C+C+C+E < . i x G C+C+C+C+C+",
+"C+x V E < x E &.i G C+C+C+C+C+C+",
+"}+` i ` D C+C+C+x x C+C+C+C+C+C+",
+". R t E C+C+C+C+G i G C+C+C+C+C+",
+"l+i.m x C+C+C+C+C+< x C+C+C+C+C+",
+"i 7+C+u G C+C+E < q i G C+C+C+C+",
+"i x.C+C+t E < x R C+< t C+C+C+C+",
+"& i '+G x x D C+C+C+E i D C+C+C+",
+"_ i [ V m u C+C+C+C+D i T m u < "};
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_32.png b/BKUWebStart/src/main/jnlp/resources/img/logo_32.png
new file mode 100644
index 00000000..337b144b
--- /dev/null
+++ b/BKUWebStart/src/main/jnlp/resources/img/logo_32.png
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_64.gif b/BKUWebStart/src/main/jnlp/resources/img/logo_64.gif
new file mode 100644
index 00000000..6081d1a1
--- /dev/null
+++ b/BKUWebStart/src/main/jnlp/resources/img/logo_64.gif
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_64.jpeg b/BKUWebStart/src/main/jnlp/resources/img/logo_64.jpeg
new file mode 100644
index 00000000..720157a5
--- /dev/null
+++ b/BKUWebStart/src/main/jnlp/resources/img/logo_64.jpeg
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_64.png b/BKUWebStart/src/main/jnlp/resources/img/logo_64.png
new file mode 100644
index 00000000..9e9b377c
--- /dev/null
+++ b/BKUWebStart/src/main/jnlp/resources/img/logo_64.png
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_64x64.png b/BKUWebStart/src/main/jnlp/resources/img/logo_64x64.png
deleted file mode 100644
index fa6d7f96..00000000
--- a/BKUWebStart/src/main/jnlp/resources/img/logo_64x64.png
+++ /dev/null
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo_90x90.png b/BKUWebStart/src/main/jnlp/resources/img/logo_90x90.png
deleted file mode 100644
index d7f8bbd0..00000000
--- a/BKUWebStart/src/main/jnlp/resources/img/logo_90x90.png
+++ /dev/null
diff --git a/BKUWebStart/src/main/jnlp/resources/img/version.xml b/BKUWebStart/src/main/jnlp/resources/img/version.xml
index 715b6722..31f43441 100644
--- a/BKUWebStart/src/main/jnlp/resources/img/version.xml
+++ b/BKUWebStart/src/main/jnlp/resources/img/version.xml
@@ -2,10 +2,38 @@
 <jnlp-versions>
   <resource>
     <pattern>
-      <name>logo.png</name>
+      <name>logo_16.xpm</name>
       <version-id>1.0-SNAPSHOT</version-id>
     </pattern>
-    <file>logo.png</file>
+    <file>logo_16.xpm</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>logo_16.ico</name>
+      <version-id>1.0-SNAPSHOT</version-id>
+    </pattern>
+    <file>logo_16.ico</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>logo_16.png</name>
+      <version-id>1.0-SNAPSHOT</version-id>
+    </pattern>
+    <file>logo_16.png</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>logo_32.png</name>
+      <version-id>1.0-SNAPSHOT</version-id>
+    </pattern>
+    <file>logo_32.png</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>logo_64.png</name>
+      <version-id>1.0-SNAPSHOT</version-id>
+    </pattern>
+    <file>logo_64.png</file>
   </resource>
   <resource>
     <pattern>
diff --git a/BKUWebStart/src/main/jnlp/resources/version.xml b/BKUWebStart/src/main/jnlp/resources/version.xml
index 763552fc..47c17088 100644
--- a/BKUWebStart/src/main/jnlp/resources/version.xml
+++ b/BKUWebStart/src/main/jnlp/resources/version.xml
@@ -2,12 +2,11 @@
 <jnlp-versions>
   <resource>
     <pattern>
-      <name>BKUWebStart-1.0.5-SNAPSHOT.jar</name>
-      <version-id>1.0.5-SNAPSHOT</version-id>
+      <name>BKUWebStart-1.0.9-SNAPSHOT.jar</name>
+      <version-id>1.0.9-SNAPSHOT</version-id>
     </pattern>
-    <file>BKUWebStart-1.0.5-SNAPSHOT.jar</file>
+    <file>BKUWebStart-1.0.9-SNAPSHOT.jar</file>
   </resource>
-
   <resource>
     <pattern>
       <name>utils-1.2.1-SNAPSHOT.jar</name>
@@ -15,13 +14,20 @@
     </pattern>
     <file>utils-1.2.1-SNAPSHOT.jar</file>
   </resource>
+  <resource>
+    <pattern>
+      <name>BKUCertificates-1.0-SNAPSHOT.jar</name>
+      <version-id>1.0-SNAPSHOT</version-id>
+    </pattern>
+    <file>BKUCertificates-1.0-SNAPSHOT.jar</file>
+  </resource>
 
   <resource>
     <pattern>
-      <name>commons-logging-1.0.4.jar</name>
-      <version-id>1.0.4</version-id>
+      <name>commons-logging-1.1.1.jar</name>
+      <version-id>1.1.1</version-id>
     </pattern>
-    <file>commons-logging-1.0.4.jar</file>
+    <file>commons-logging-1.1.1.jar</file>
   </resource>
 
   <resource>
@@ -64,17 +70,17 @@
 
   <resource>
     <pattern>
-      <name>jetty-6.1.15.jar</name>
-      <version-id>6.1.15</version-id>
+      <name>jetty-6.1.19.jar</name>
+      <version-id>6.1.19</version-id>
     </pattern>
-    <file>jetty-6.1.15.jar</file>
+    <file>jetty-6.1.19.jar</file>
   </resource>
   <resource>
     <pattern>
-      <name>jetty-util-6.1.15.jar</name>
-      <version-id>6.1.15</version-id>
+      <name>jetty-util-6.1.19.jar</name>
+      <version-id>6.1.19</version-id>
     </pattern>
-    <file>jetty-util-6.1.15.jar</file>
+    <file>jetty-util-6.1.19.jar</file>
   </resource>
   <resource>
     <pattern>
@@ -83,6 +89,55 @@
     </pattern>
     <file>servlet-api-2.5-20081211.jar</file>
   </resource>
+  <resource>
+    <pattern>
+      <name>jsp-2.1-jetty-6.1.19.jar</name>
+      <version-id>6.1.19</version-id>
+    </pattern>
+    <file>jsp-2.1-jetty-6.1.19.jar</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>jsp-2.1-glassfish-9.1.1.B60.25.p0.jar</name>
+      <version-id>9.1.1.B60.25.p0</version-id>
+    </pattern>
+    <file>jsp-2.1-glassfish-9.1.1.B60.25.p0.jar</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>jsp-api-2.1-glassfish-9.1.1.B60.25.p0.jar</name>
+      <version-id>9.1.1.B60.25.p0</version-id>
+    </pattern>
+    <file>jsp-api-2.1-glassfish-9.1.1.B60.25.p0.jar</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>ant-1.6.5.jar</name>
+      <version-id>1.6.5</version-id>
+    </pattern>
+    <file>ant-1.6.5.jar</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>core-3.1.1.jar</name>
+      <version-id>3.1.1</version-id>
+    </pattern>
+    <file>core-3.1.1.jar</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>slf4j-api-1.5.8.jar</name>
+      <version-id>1.5.8</version-id>
+    </pattern>
+    <file>slf4j-api-1.5.8.jar</file>
+  </resource>
+  <resource>
+    <pattern>
+      <name>slf4j-log4j12-1.5.8.jar</name>
+      <version-id>1.5.8</version-id>
+    </pattern>
+    <file>slf4j-log4j12-1.5.8.jar</file>
+  </resource>
 
   <resource>
     <pattern>
diff --git a/BKUWebStart/src/main/jnlp/template-local.xml b/BKUWebStart/src/main/jnlp/template-local.xml
new file mode 100644
index 00000000..9135ba1b
--- /dev/null
+++ b/BKUWebStart/src/main/jnlp/template-local.xml
@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="utf-8"?>
+<jnlp spec="$jnlpspec" codebase="file:/home/clemens/workspace/bku/BKUWebStart/target/jnlp" href="$outputFile">
+
+  <information>
+    <!--title>$project.Name</title-->
+    <title>$project.Description</title>
+    <!--vendor>$project.Organization.Name</vendor-->
+    <vendor>E-Government Innovationszentrum (EGIZ)</vendor>
+    <homepage href="$project.Url"/>
+    <description>$project.Description (BKU) MOCCA Web Start</description>
+    <description kind="short">$project.Description</description>
+    <!--icon kind="shortcut" href="img/logo_16.ico" width="16" height="16" version="1.0-SNAPSHOT"/-->
+    <icon kind="shortcut" href="img/logo_32.png" width="32" height="32"/>
+    <icon kind="default" href="img/logo_32.png" width="32" height="32"/>
+    <icon kind="default" href="img/logo_64.png" width="64" height="64"/>
+    <icon kind="splash" href="img/splash.png"/>
+    <shortcut online="false">
+      <desktop/>
+      <menu submenu="e-Government"/>
+    </shortcut>
+
+#if($offlineAllowed)
+    <offline-allowed/>
+#end
+
+  </information>
+  
+#if($allPermissions)
+  <security>
+    <all-permissions/>
+  </security>
+#end
+
+  <update check="timeout" policy="prompt-update"/>
+
+  <resources>
+    <java version="$j2seVersion" java-vm-args="-Djava.security.debug=access,failure"/>
+     $dependencies
+  </resources>
+
+  <application-desc main-class="$mainClass"/>
+</jnlp>
\ No newline at end of file
diff --git a/BKUWebStart/src/main/jnlp/template.xml b/BKUWebStart/src/main/jnlp/template.xml
index a6f6d96e..0176376a 100644
--- a/BKUWebStart/src/main/jnlp/template.xml
+++ b/BKUWebStart/src/main/jnlp/template.xml
@@ -4,12 +4,16 @@
   <information>
     <!--title>$project.Name</title-->
     <title>$project.Description</title>
-    <vendor>$project.Organization.Name</vendor>
+    <!--vendor>$project.Organization.Name</vendor-->
+    <vendor>E-Government Innovationszentrum (EGIZ)</vendor>
     <homepage href="$project.Url"/>
-    <description>$project.Description</description>
+    <description>$project.Description (BKU) MOCCA Web Start</description>
     <description kind="short">$project.Description</description>
-    <icon href="img/logo.png" kind="default" version="1.0-SNAPSHOT"/>
-    <icon href="img/splash.png" kind="splash" version="1.0-SNAPSHOT"/>
+    <!--icon kind="shortcut" href="img/logo_16.ico" width="16" height="16" version="1.0-SNAPSHOT"/-->
+    <icon kind="shortcut" href="img/logo_32.png" width="32" height="32" version="1.0-SNAPSHOT"/>
+    <icon kind="default" href="img/logo_32.png" width="32" height="32" version="1.0-SNAPSHOT"/>
+    <icon kind="default" href="img/logo_64.png" width="64" height="64" version="1.0-SNAPSHOT"/>
+    <icon kind="splash" href="img/splash.png" version="1.0-SNAPSHOT"/>
     <shortcut online="false">
       <desktop/>
       <menu submenu="e-Government"/>
@@ -20,23 +24,23 @@
 #end
 
   </information>
-
-
+  
 #if($allPermissions)
   <security>
     <all-permissions/>
   </security>
 #end
 
+  <update check="timeout" policy="prompt-update"/>
+
   <resources os="Mac OS X">
-    <j2se version="$j2seVersion" java-vm-args="-d32"/>
+    <java version="$j2seVersion" java-vm-args="-d32"/>
     <property name="jnlp.versionEnabled" value="true"/>
      $dependencies
   </resources>
 
   <resources>
-    <!-- initial-heap-size="32m" max-heap-size="128m" -->
-    <j2se version="$j2seVersion"/>
+    <java version="$j2seVersion"/>
     <property name="jnlp.versionEnabled" value="true"/>
      $dependencies
   </resources>
diff --git a/BKUWebStart/src/main/jnlp/template_dev.xml b/BKUWebStart/src/main/jnlp/template_dev.xml
deleted file mode 100644
index 2d8e8133..00000000
--- a/BKUWebStart/src/main/jnlp/template_dev.xml
+++ /dev/null
@@ -1,39 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<jnlp spec="$jnlpspec" codebase="$project.Url" href="$outputFile">
-
-  <information>
-    <title>$project.Name</title>
-    <vendor>$project.Organization.Name</vendor>
-    <homepage href="$project.Url"/>
-    <description>$project.Description</description>
-    <description kind="short">$project.Description</description>
-    <icon href="img/logo.png" kind="default" version="1.0-SNAPSHOT"/>
-    <icon href="img/splash.png" kind="splash" version="1.0-SNAPSHOT"/>
-    <shortcut online="false">
-      <desktop/>
-      <menu submenu="e-Government"/>
-    </shortcut>
-
-#if($offlineAllowed)
-    <offline-allowed/>
-#end
-
-  </information>
-
-
-#if($allPermissions)
-  <security>
-    <all-permissions/>
-  </security>
-#end
-
-  <resources>
-    <!-- initial-heap-size="32m" max-heap-size="128m" -->
-    <j2se version="$j2seVersion"/>
-    <property name="jnlp.versionEnabled" value="true"/>
-
-     $dependencies
-
-  </resources>
-  <application-desc main-class="$mainClass"/>
-</jnlp>
\ No newline at end of file
diff --git a/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/conf/conf.zip b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/conf/conf.zip
new file mode 100644
index 00000000..1df56e5c
--- /dev/null
+++ b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/conf/conf.zip
diff --git a/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/conf/configuration.zip b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/conf/configuration.zip
deleted file mode 100644
index 74465445..00000000
--- a/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/conf/configuration.zip
+++ /dev/null
diff --git a/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/UIMessages.properties b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/UIMessages.properties
index eb2b74c0..bf4e5b8a 100644
--- a/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/UIMessages.properties
+++ b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/UIMessages.properties
@@ -1,11 +1,13 @@
 #-------- tray icon messages -------

-TrayMenu.Tooltip=B\u00FCrgerkartenumgebung (MOCCA Web Start)

+TrayMenu.Tooltip=B\u00FCrgerkartenumgebung

 TrayMenu.Shutdown=B\u00FCrgerkartenumgebung beenden

 

+Config.Message=Zertifikate werden geladen

+Config.Caption=B\u00FCrgerkartenumgebung

 Startup.Message=B\u00FCrgerkartenumgebung wird gestartet...

-Startup.Caption=B\u00FCrgerkartenumgebung (MOCCA Web Start)

+Startup.Caption=B\u00FCrgerkartenumgebung

 Greetings.Message=B\u00FCrgerkartenumgebung erfolgreich gestartet

-Greetings.Caption=B\u00FCrgerkartenumgebung (MOCCA Web Start)

+Greetings.Caption=B\u00FCrgerkartenumgebung

 Error.Caption=Fehler

 Error.Startup.Message=B\u00FCrgerkartenumgebung konnte nicht gestartet werden

 Error.Conf.Message=Konfiguration konnte nicht initialisiert werden, B\u00FCrberkartenumgebung wird nicht gestartet

diff --git a/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/trayicon.png b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/trayicon.png
deleted file mode 100644
index 2c622d88..00000000
--- a/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/trayicon.png
+++ /dev/null
diff --git a/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/trayicon_16.png b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/trayicon_16.png
new file mode 100644
index 00000000..f84f108d
--- /dev/null
+++ b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/trayicon_16.png
diff --git a/BKUWebStart/src/main/jnlp/resources/img/logo.png b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/trayicon_32.png
index 2c622d88..2c622d88 100644
--- a/BKUWebStart/src/main/jnlp/resources/img/logo.png
+++ b/BKUWebStart/src/main/resources/at/gv/egiz/bku/webstart/ui/trayicon_32.png
diff --git a/BKUWebStart/src/main/resources/log4j.properties b/BKUWebStart/src/main/resources/log4j.properties
index 4df33ab5..76de3576 100644
--- a/BKUWebStart/src/main/resources/log4j.properties
+++ b/BKUWebStart/src/main/resources/log4j.properties
@@ -1,5 +1,24 @@
+# Copyright 2008 Federal Chancellery Austria and
+# Graz University of Technology
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # loglever DEBUG, appender STDOUT
-log4j.rootLogger=TRACE, STDOUT, file
+log4j.rootLogger=DEBUG, file
+log4j.logger.org.mortbay.log=INFO
+log4j.logger.pki=INFO
+
+log4j.additivity.pki=false
 
 # STDOUT appender
 log4j.appender.STDOUT=org.apache.log4j.ConsoleAppender
@@ -13,4 +32,4 @@ log4j.appender.file=org.apache.log4j.DailyRollingFileAppender
 log4j.appender.file.datePattern='.'yyyy-MM-dd
 log4j.appender.file.File=${user.home}/.mocca/logs/webstart.log
 log4j.appender.file.layout=org.apache.log4j.PatternLayout
-log4j.appender.file.layout.ConversionPattern=%d{ABSOLUTE} %5p %c{1}:%L - %m%n
\ No newline at end of file
+log4j.appender.file.layout.ConversionPattern=%d{ABSOLUTE} %-5p %c{1}:%L - %m%n
\ No newline at end of file