Skip to content
This repository was archived by the owner on Aug 10, 2021. It is now read-only.

Commit a809088

Browse files
RasmusSootRasmusSoot
committed
Merge branch 'develop'
2 parents fcb1bb8 + 8112ba6 commit a809088

File tree

63 files changed

+2001
-273
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

63 files changed

+2001
-273
lines changed

‎disain/controlcode.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ <h1 class="c-header__logo">
4747
<div class="c-tab-login__main">
4848
<div class="c-tab-login__content is-active" data-tab="mobile-id">
4949
<div class="c-tab-login__content-wrap">
50-
<div class="c-tab-login__content-icon">
50+
<div class="c-tab-login__content-icon" aria-hidden="true">
5151
<svg class="icon icon-mobile-id"><use xlink:href="#icon-mobile-id"></use></svg>
5252
</div>
5353
<div class="c-tab-login__content-text">

‎disain/login.html‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ <h1 class="c-header__logo">
105105
<!-- ID-card -->
106106
<div class="c-tab-login__content is-active" data-tab="id-card">
107107
<div class="c-tab-login__content-wrap">
108-
<div class="c-tab-login__content-icon">
108+
<div class="c-tab-login__content-icon" aria-hidden="true">
109109
<svg class="icon icon-id-card"><use xlink:href="#icon-id-card"></use></svg>
110110
</div>
111111
<div class="c-tab-login__content-text">
@@ -130,7 +130,7 @@ <h2>ID-kaart</h2>
130130
<!-- Mobile-ID -->
131131
<div class="c-tab-login__content" data-tab="mobile-id">
132132
<div class="c-tab-login__content-wrap">
133-
<div class="c-tab-login__content-icon">
133+
<div class="c-tab-login__content-icon" aria-hidden="true">
134134
<svg class="icon icon-mobile-id"><use xlink:href="#icon-mobile-id"></use></svg>
135135
</div>
136136
<div class="c-tab-login__content-text">
@@ -189,7 +189,7 @@ <h2>Mobiil-ID</h2>
189189
<!-- Banklink -->
190190
<div class="c-tab-login__content" data-tab="bank-link">
191191
<div class="c-tab-login__content-wrap">
192-
<div class="c-tab-login__content-icon">
192+
<div class="c-tab-login__content-icon" aria-hidden="true">
193193
<svg class="icon icon-bank-link"><use xlink:href="#icon-bank-link"></use></svg>
194194
</div>
195195
<div class="c-tab-login__content-text">
@@ -224,7 +224,7 @@ <h2>Pangalink</h2>
224224
<!-- Smart-ID -->
225225
<div class="c-tab-login__content" data-tab="smart-id">
226226
<div class="c-tab-login__content-wrap">
227-
<div class="c-tab-login__content-icon">
227+
<div class="c-tab-login__content-icon" aria-hidden="true">
228228
<svg class="icon icon-smart-id"><use xlink:href="#icon-smart-id"></use></svg>
229229
</div>
230230
<div class="c-tab-login__content-text">
@@ -269,7 +269,7 @@ <h2>Smart-ID</h2>
269269
<!-- EU Citizen -->
270270
<div class="c-tab-login__content" data-tab="eu-citizen">
271271
<div class="c-tab-login__content-wrap">
272-
<div class="c-tab-login__content-icon">
272+
<div class="c-tab-login__content-icon" aria-hidden="true">
273273
<svg class="icon icon-eu-citizen"><use xlink:href="#icon-eu-citizen"></use></svg>
274274
</div>
275275
<div class="c-tab-login__content-text">

‎disain/scripts/main/main.js‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,11 +236,13 @@ jQuery(function ($) {
236236

237237
function showAlert(alert) {
238238
alert.attr("role", "alert");
239+
alert.removeAttr("aria-hidden");
239240
alert.addClass('show');
240241
}
241242

242243
function hideAlert(alert) {
243244
alert.removeAttr("role");
245+
alert.attr("aria-hidden", "true");
244246
alert.removeClass('show');
245247
}
246248

‎doc/Configuration.md‎

Lines changed: 65 additions & 24 deletions
Large diffs are not rendered by default.

‎pom.xml‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,13 @@
66
<groupId>ee.ria.tara</groupId>
77
<artifactId>tara-server</artifactId>
88
<packaging>war</packaging>
9-
<version>1.4.11</version>
9+
<version>1.4.12</version>
1010

1111
<properties>
1212
<cas.version>5.3.9</cas.version>
1313
<springboot.version>1.5.18.RELEASE</springboot.version>
1414
<banklink.version>2.1.15</banklink.version>
15+
<jersey.version>2.28</jersey.version>
1516
<!-- app.server could be -jetty, -undertow, -tomcat, or blank if you plan to provide appserver -->
1617
<app.server>-tomcat</app.server>
1718
<maven.compiler.source>1.8</maven.compiler.source>
@@ -149,6 +150,14 @@
149150
<type>pom</type>
150151
<scope>import</scope>
151152
</dependency>
153+
154+
<!-- Force-override given dependency version used by mid-rest-java-client -->
155+
<!-- At the moment version 2.27 is for some reason taken from spring, even tho jersey is only used by mid-rest-java-client and it has defined use of ${jersey.version} -->
156+
<dependency>
157+
<groupId>org.glassfish.jersey.inject</groupId>
158+
<artifactId>jersey-hk2</artifactId>
159+
<version>${jersey.version}</version>
160+
</dependency>
152161
</dependencies>
153162
</dependencyManagement>
154163

@@ -324,12 +333,21 @@
324333
<version>${banklink.version}</version>
325334
</dependency>
326335

327-
<!-- mobileid -->
336+
<!-- Mobile-ID SOAP client -->
328337
<dependency>
329338
<groupId>com.codeborne</groupId>
330339
<artifactId>mobileid</artifactId>
331-
<version>1.3</version>
340+
<version>1.4</version>
332341
</dependency>
342+
343+
<!-- Mobile-ID REST client -->
344+
<!-- NB! When updating must also update explicitly defined 'org.glassfish.jersey.inject.jersey-hk2' version -->
345+
<dependency>
346+
<groupId>ee.sk.mid</groupId>
347+
<artifactId>mid-rest-java-client</artifactId>
348+
<version>1.1</version>
349+
</dependency>
350+
333351
<dependency>
334352
<groupId>org.bouncycastle</groupId>
335353
<artifactId>bcprov-jdk15on</artifactId>

‎src/main/java/ee/ria/sso/Constants.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99
public final class Constants {
1010

1111
public static final String CERTIFICATE_SESSION_ATTRIBUTE = "Client-Certificate";
12-
public static final String MOBILE_CHALLENGE = "mobileChallenge";
13-
public static final String MOBILE_SESSION = "mobileSession";
12+
public static final String MOBILE_ID_VERIFICATION_CODE = "mobileIdVerificationCode";
13+
public static final String MOBILE_ID_AUTHENTICATION_SESSION = "mobileIdAuthenticationSession";
1414
public static final String AUTH_COUNT = "authCount";
1515
public static final String ERROR_MESSAGE = "TARA_ERROR_MESSAGE";
1616
public static final String EVENT_OUTSTANDING = "outstanding";
@@ -29,6 +29,7 @@ public final class Constants {
2929
public static final String MDC_ATTRIBUTE_OCSP_ID = "ocspUrl";
3030

3131
public static final String TARA_OIDC_SESSION_SCOPES = "taraOidcSessionScopes";
32+
public static final String TARA_OIDC_SESSION_SCOPE_EIDAS_COUNTRY = "taraOidcSessionScopeEidasCountry";
3233
public static final String TARA_OIDC_SESSION_CLIENT_ID = "taraOidcSessionClientId";
3334
public static final String TARA_OIDC_SESSION_REDIRECT_URI = "taraOidcSessionRedirectUri";
3435
public static final String TARA_OIDC_SESSION_AUTH_METHODS = "taraOidcSessionAllowedAuthMethods";

‎src/main/java/ee/ria/sso/config/TaraOidcConfiguration.java‎

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,14 @@
11
package ee.ria.sso.config;
22

3+
import ee.ria.sso.config.eidas.EidasConfigurationProvider;
34
import ee.ria.sso.i18n.TaraLocaleChangeInterceptor;
4-
import ee.ria.sso.oidc.*;
5+
import ee.ria.sso.oidc.OidcAuthorizeRequestValidationServletFilter;
6+
import ee.ria.sso.oidc.OidcAuthorizeRequestValidator;
7+
import ee.ria.sso.oidc.TaraDefaultOAuthCodeFactory;
8+
import ee.ria.sso.oidc.TaraOidcAccessTokenEndpointController;
9+
import ee.ria.sso.oidc.TaraOidcAuthorizeEndpointController;
10+
import ee.ria.sso.oidc.TaraOidcIdTokenGeneratorService;
11+
import ee.ria.sso.oidc.TaraOidcServerDiscoverySettings;
512
import org.apache.http.HttpStatus;
613
import org.apereo.cas.audit.AuditableExecution;
714
import org.apereo.cas.authentication.principal.PrincipalFactory;
@@ -32,7 +39,6 @@
3239
import org.apereo.cas.support.oauth.web.response.accesstoken.ext.BaseAccessTokenGrantRequestExtractor;
3340
import org.apereo.cas.support.oauth.web.response.callback.OAuth20AuthorizationResponseBuilder;
3441
import org.apereo.cas.support.oauth.web.views.ConsentApprovalViewResolver;
35-
import org.apereo.cas.support.oauth.web.views.OAuth20UserProfileViewRenderer;
3642
import org.apereo.cas.ticket.ExpirationPolicy;
3743
import org.apereo.cas.ticket.UniqueTicketIdGenerator;
3844
import org.apereo.cas.ticket.accesstoken.AccessTokenFactory;
@@ -56,7 +62,13 @@
5662
import org.springframework.context.annotation.Configuration;
5763
import org.springframework.core.Ordered;
5864

59-
import java.util.*;
65+
import java.util.Arrays;
66+
import java.util.Collection;
67+
import java.util.Collections;
68+
import java.util.HashMap;
69+
import java.util.List;
70+
import java.util.Map;
71+
import java.util.Set;
6072
import java.util.stream.Collectors;
6173
import java.util.stream.Stream;
6274

@@ -149,6 +161,9 @@ public class TaraOidcConfiguration {
149161
@Qualifier("consentApprovalViewResolver")
150162
private ConsentApprovalViewResolver consentApprovalViewResolver;
151163

164+
@Autowired
165+
private EidasConfigurationProvider eidasConfigurationProvider;
166+
152167
@Bean
153168
public OidcAuthorizeEndpointController oidcAuthorizeController() {
154169
return new TaraOidcAuthorizeEndpointController(
@@ -201,7 +216,7 @@ public TaraOidcServerDiscoverySettings getObject() {
201216
final TaraOidcServerDiscoverySettings discoveryProperties =
202217
new TaraOidcServerDiscoverySettings(taraProperties, casProperties, oidc.getIssuer());
203218
discoveryProperties.setClaimsSupported(oidc.getClaims());
204-
discoveryProperties.setScopesSupported(oidc.getScopes());
219+
discoveryProperties.setScopesSupported(determineSupportedScopes(oidc.getScopes()));
205220
discoveryProperties.setResponseTypesSupported(
206221
Collections.singletonList(OAuth20ResponseTypes.CODE.getType()));
207222
discoveryProperties.setSubjectTypesSupported(oidc.getSubjectTypes());
@@ -235,7 +250,7 @@ protected HttpAction unauthorized(J2EContext context, List<Client> currentClient
235250
public FilterRegistrationBean oidcAuthorizeCheckingServletFilter(OidcAuthorizeRequestValidator oidcAuthorizeRequestValidator) {
236251
final Map<String, String> initParams = new HashMap<>();
237252
final FilterRegistrationBean bean = new FilterRegistrationBean();
238-
bean.setFilter(new OidcAuthorizeRequestValidationServletFilter(oidcAuthorizeRequestValidator));
253+
bean.setFilter(new OidcAuthorizeRequestValidationServletFilter(oidcAuthorizeRequestValidator, eidasConfigurationProvider));
239254
bean.setUrlPatterns(Collections.singleton("/oidc/authorize"));
240255
bean.setInitParameters(initParams);
241256
bean.setName("oidcAuthorizeCheckingServletFilter");
@@ -261,4 +276,10 @@ private ExpirationPolicy oAuthCodeExpirationPolicy() {
261276
oauth.getCode().getTimeToKillInSeconds());
262277
}
263278
}
279+
280+
private List<String> determineSupportedScopes(List<String> oidcScopes) {
281+
return Stream.of(oidcScopes, eidasConfigurationProvider.getAllowedEidasCountryScopeAttributes())
282+
.flatMap(Collection::stream)
283+
.collect(Collectors.collectingAndThen(Collectors.toList(), Collections::unmodifiableList));
284+
}
264285
}

‎src/main/java/ee/ria/sso/config/eidas/EidasConfigurationProvider.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package ee.ria.sso.config.eidas;
22

33
import ee.ria.sso.config.TaraResourceBundleMessageSource;
4+
import ee.ria.sso.oidc.TaraScopeValuedAttributeName;
45
import ee.ria.sso.utils.CountryCodeUtil;
56
import lombok.Getter;
67
import lombok.Setter;
@@ -50,6 +51,8 @@ public class EidasConfigurationProvider {
5051

5152
private List<String> listOfCountries;
5253

54+
private List<String> allowedEidasCountryScopeAttributes;
55+
5356
private boolean clientCertificateEnabled;
5457

5558
private String clientCertificateKeystore;
@@ -68,6 +71,7 @@ public void init() {
6871
}
6972

7073
listOfCountries = parseAvailableCountries(availableCountries);
74+
allowedEidasCountryScopeAttributes = constructEidasCountryScopeAttributes(listOfCountries);
7175
}
7276

7377
private static List<String> parseAvailableCountries(String input) {
@@ -79,6 +83,12 @@ private static List<String> parseAvailableCountries(String input) {
7983
return countryCodes;
8084
}
8185

86+
private List<String> constructEidasCountryScopeAttributes(List<String> allowedCountryCodes) {
87+
return allowedCountryCodes.stream()
88+
.map(countryCode -> TaraScopeValuedAttributeName.EIDAS_COUNTRY.getFormalName() + ":" + countryCode.toLowerCase())
89+
.collect(Collectors.toList());
90+
}
91+
8292
private static void validateCountryCodes(List<String> countryCodes) {
8393
for (String countryCode : countryCodes) {
8494
Assert.isTrue(CountryCodeUtil.isValidCountryCode(countryCode), "Invalid ISO 3166-1 alpha-2 country code '" + countryCode + "'");

‎src/main/java/ee/ria/sso/config/mobileid/MobileIDConfiguration.java‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
package ee.ria.sso.config.mobileid;
2+
3+
import ee.ria.sso.service.mobileid.MobileIDAuthenticationClient;
4+
import ee.ria.sso.service.mobileid.MobileIDAuthenticationService;
5+
import ee.ria.sso.service.mobileid.rest.MobileIDRESTAuthClient;
6+
import ee.ria.sso.service.mobileid.soap.MobileIDAuthenticatorWrapper;
7+
import ee.ria.sso.service.mobileid.soap.MobileIDSOAPAuthClient;
8+
import ee.ria.sso.statistics.StatisticsHandler;
9+
import ee.sk.mid.MidClient;
10+
import ee.sk.mid.rest.MidLoggingFilter;
11+
import lombok.extern.slf4j.Slf4j;
12+
import org.glassfish.jersey.client.ClientConfig;
13+
import org.glassfish.jersey.client.ClientProperties;
14+
import org.springframework.beans.factory.annotation.Autowired;
15+
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
16+
import org.springframework.context.annotation.Bean;
17+
import org.springframework.context.annotation.Configuration;
18+
19+
@ConditionalOnProperty("mobile-id.enabled")
20+
@Configuration
21+
@Slf4j
22+
public class MobileIDConfiguration {
23+
24+
@Autowired
25+
private StatisticsHandler statisticsHandler;
26+
27+
@Autowired
28+
private MobileIDConfigurationProvider configurationProvider;
29+
30+
@Bean
31+
public MobileIDAuthenticationClient constructAuthenticationClient() {
32+
if (configurationProvider.isUseDdsService()) {
33+
log.info("Initializing SOAP protocol based authentication client for DDS Mobile-ID service");
34+
return new MobileIDSOAPAuthClient(mobileIDAuthenticatorWrapper());
35+
} else {
36+
log.info("Initializing REST protocol based authentication client for Mobile-ID REST service");
37+
return new MobileIDRESTAuthClient(configurationProvider, midClient());
38+
}
39+
}
40+
41+
@Bean
42+
public MobileIDAuthenticationService mobileIDAuthenticationService() {
43+
return new MobileIDAuthenticationService(
44+
statisticsHandler, configurationProvider, constructAuthenticationClient());
45+
}
46+
47+
private MobileIDAuthenticatorWrapper mobileIDAuthenticatorWrapper() {
48+
MobileIDAuthenticatorWrapper authenticator = new MobileIDAuthenticatorWrapper();
49+
authenticator.setDigidocServiceURL(configurationProvider.getHostUrl());
50+
authenticator.setLoginMessage(configurationProvider.getMessageToDisplay());
51+
authenticator.setServiceName(configurationProvider.getServiceName());
52+
return authenticator;
53+
}
54+
55+
private MidClient midClient() {
56+
return MidClient.newBuilder()
57+
.withHostUrl(configurationProvider.getHostUrl())
58+
.withRelyingPartyUUID(configurationProvider.getRelyingPartyUuid())
59+
.withRelyingPartyName(configurationProvider.getRelyingPartyName())
60+
.withNetworkConnectionConfig(clientConfig())
61+
.withLongPollingTimeoutSeconds(configurationProvider.getSessionStatusSocketOpenDuration())
62+
.build();
63+
}
64+
65+
private ClientConfig clientConfig() {
66+
ClientConfig clientConfig = new ClientConfig();
67+
clientConfig.property(ClientProperties.CONNECT_TIMEOUT, configurationProvider.getConnectionTimeout());
68+
clientConfig.property(ClientProperties.READ_TIMEOUT, configurationProvider.getReadTimeout());
69+
clientConfig.register(new MidLoggingFilter());
70+
return clientConfig;
71+
}
72+
}

0 commit comments

Comments
 (0)