From aab3725efba5db70c3faa4299e16b48a47de7adc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 26 Jan 2026 21:54:41 +0000 Subject: [PATCH 01/25] build(deps-dev): bump org.assertj:assertj-core from 3.27.3 to 3.27.7 Bumps [org.assertj:assertj-core](https://github.com/assertj/assertj) from 3.27.3 to 3.27.7. - [Release notes](https://github.com/assertj/assertj/releases) - [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.3...assertj-build-3.27.7) --- updated-dependencies: - dependency-name: org.assertj:assertj-core dependency-version: 3.27.7 dependency-type: direct:development ... Signed-off-by: dependabot[bot] --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 2816da7c..651583a0 100644 --- a/pom.xml +++ b/pom.xml @@ -17,7 +17,7 @@ 2.19.1 2.0.17 5.13.3 - 3.27.3 + 3.27.7 5.18.0 3.5.2 3.3.1 From 32533e14ef038bdf93b012395b95b3b667f0edfb Mon Sep 17 00:00:00 2001 From: Sven Mitt Date: Mon, 2 Feb 2026 10:15:29 +0200 Subject: [PATCH 02/25] build(deps): bump digidoc4j version to 6.1.0 WE2-1175 Signed-off-by: Sven Mitt --- example/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/example/pom.xml b/example/pom.xml index b50adcec..184e0367 100644 --- a/example/pom.xml +++ b/example/pom.xml @@ -20,7 +20,7 @@ 17 3.5.3 3.2.0 - 6.0.1 + 6.1.0 1.44 3.4.6 From 32542d20fdb22e397b872373c133c77b27f25ea2 Mon Sep 17 00:00:00 2001 From: Sven Mitt Date: Mon, 2 Feb 2026 15:44:22 +0200 Subject: [PATCH 03/25] build(deps): versions of dependencies WE2-1175 Signed-off-by: Sven Mitt --- example/pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/example/pom.xml b/example/pom.xml index 184e0367..bdb944bb 100644 --- a/example/pom.xml +++ b/example/pom.xml @@ -5,7 +5,7 @@ org.springframework.boot spring-boot-starter-parent - 3.5.3 + 3.5.10 eu.webeid.example @@ -22,7 +22,7 @@ 3.2.0 6.1.0 1.44 - 3.4.6 + 3.5.1 From c30122fcbac103fafcfc7c94f753df1769312a44 Mon Sep 17 00:00:00 2001 From: Sven Mitt Date: Tue, 3 Feb 2026 15:46:09 +0200 Subject: [PATCH 04/25] build(deps): bump version to 3.2.1-SNAPSHOT WE2-1175 Signed-off-by: Sven Mitt --- example/pom.xml | 4 ++-- pom.xml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/example/pom.xml b/example/pom.xml index bdb944bb..a6bbebb6 100644 --- a/example/pom.xml +++ b/example/pom.xml @@ -10,7 +10,7 @@ eu.webeid.example web-eid-springboot-example - 3.2.0 + 3.2.1-SNAPSHOT web-eid-springboot-example Example Spring Boot application that demonstrates how to use Web eID for authentication and digital signing @@ -19,7 +19,7 @@ 17 3.5.3 - 3.2.0 + 3.2.1-SNAPSHOT 6.1.0 1.44 3.5.1 diff --git a/pom.xml b/pom.xml index 651583a0..4ff90754 100644 --- a/pom.xml +++ b/pom.xml @@ -5,7 +5,7 @@ 4.0.0 authtoken-validation eu.webeid.security - 3.2.0 + 3.2.1-SNAPSHOT jar authtoken-validation Web eID authentication token validation library for Java From d0b3e9e1f708a85cf4cf9dfe56d4f686a0d2a96e Mon Sep 17 00:00:00 2001 From: Sven Mitt Date: Tue, 3 Feb 2026 15:56:00 +0200 Subject: [PATCH 05/25] build: install latest library during example build WE2-1175 Signed-off-by: Sven Mitt --- .github/workflows/maven-build-example.yml | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/.github/workflows/maven-build-example.yml b/.github/workflows/maven-build-example.yml index 3893cbd4..8f044b2a 100644 --- a/.github/workflows/maven-build-example.yml +++ b/.github/workflows/maven-build-example.yml @@ -10,10 +10,6 @@ on: - 'example/**' - '.github/workflows/*example*' -defaults: - run: - working-directory: ./example - jobs: build: runs-on: ubuntu-latest @@ -33,9 +29,9 @@ jobs: key: ${{ runner.os }}-m2-v17-${{ secrets.CACHE_VERSION }}-${{ hashFiles('**/pom.xml') }} restore-keys: ${{ runner.os }}-m2-v17-${{ secrets.CACHE_VERSION }} - - name: Build - run: mvn --batch-mode compile - - - name: Test and package - run: mvn --batch-mode package + - name: Install library + run: mvn -B -ntp install + - name: Build example project + working-directory: ./example + run: mvn -B -ntp package From 5b045cd023d1b372c35911e7488538823ff2bed3 Mon Sep 17 00:00:00 2001 From: Kristel Merilain Date: Fri, 6 Feb 2026 11:07:48 +0200 Subject: [PATCH 06/25] Remove plucky and add questing support Signed-off-by: Kristel Merilain --- .../main/resources/static/scripts/install-web-eid.sh | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/example/src/main/resources/static/scripts/install-web-eid.sh b/example/src/main/resources/static/scripts/install-web-eid.sh index 59f262ed..a48dca63 100755 --- a/example/src/main/resources/static/scripts/install-web-eid.sh +++ b/example/src/main/resources/static/scripts/install-web-eid.sh @@ -119,8 +119,8 @@ test_sudo # version name LTS supported until # 22.04 jammy LTS 2027-04 # 24.04 noble LTS 2029-04 -# 25.04 plucky - 2026-01 -LATEST_SUPPORTED_UBUNTU_CODENAME='plucky' +# 25.10 questing - 2026-07 +LATEST_SUPPORTED_UBUNTU_CODENAME='questing' # check if Debian or Ubuntu distro=$(lsb_release -is | tr '[:upper:]' '[:lower:]') @@ -136,8 +136,8 @@ case $distro in case "$codename" in trixie) make_warn "Debian $codename is not officially supported" - make_warn "Trying to install packages from Ubuntu plucky repository" - add_repository plucky + make_warn "Trying to install packages from Ubuntu questing repository" + add_repository questing ;; bookworm) make_warn "Debian $codename is not officially supported" @@ -161,10 +161,10 @@ case $distro in ;; esac case $codename in - utopic|vivid|wily|trusty|artful|cosmic|disco|xenial|eoan|groovy|hirsute|impish|bionic|zorin|kinetic|lunar|mantic|focal|oracular) + utopic|vivid|wily|trusty|artful|cosmic|disco|xenial|eoan|groovy|hirsute|impish|bionic|zorin|kinetic|lunar|mantic|focal|oracular|plucky) make_fail "Ubuntu $codename is not officially supported" ;; - jammy|noble|plucky) + jammy|noble|questing) add_repository $codename ;; *) From c6abb2f0853c5edd94a7ffc5210c9591e0ad1d2b Mon Sep 17 00:00:00 2001 From: Sven Mitt Date: Mon, 23 Mar 2026 08:17:21 +0200 Subject: [PATCH 07/25] build: Run scheduled sonar analysis as otherwise token will expire in 60 days WE2-964 Signed-off-by: Sven Mitt --- .github/workflows/sonarcloud-analysis.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/sonarcloud-analysis.yml b/.github/workflows/sonarcloud-analysis.yml index ea78e973..4a925a21 100644 --- a/.github/workflows/sonarcloud-analysis.yml +++ b/.github/workflows/sonarcloud-analysis.yml @@ -9,6 +9,8 @@ on: paths-ignore: - 'example/**' - '.github/workflows/*example*' + schedule: + - cron: '45 6 8-14,22-28 * 1' jobs: analyze: From 577bc708612af19d0aad2d8ce6e2774ff69cc769 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 18 Apr 2026 01:14:04 +0000 Subject: [PATCH 08/25] build(deps): bump org.bouncycastle:bcprov-jdk18on from 1.81 to 1.84 Bumps [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) from 1.81 to 1.84. - [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html) - [Commits](https://github.com/bcgit/bc-java/commits) --- updated-dependencies: - dependency-name: org.bouncycastle:bcprov-jdk18on dependency-version: '1.84' dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 4ff90754..99ce27be 100644 --- a/pom.xml +++ b/pom.xml @@ -13,7 +13,7 @@ 11 0.12.6 - 1.81 + 1.84 2.19.1 2.0.17 5.13.3 From c1fe83909fb9587bdc6746d95305b440852f77ba Mon Sep 17 00:00:00 2001 From: Sven Mitt Date: Fri, 24 Apr 2026 13:42:14 +0300 Subject: [PATCH 09/25] build(dep): bump DigiDoc4j to version 6.1.1 WE2-1217 Signed-off-by: Sven Mitt --- example/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/example/pom.xml b/example/pom.xml index a6bbebb6..ff44fe54 100644 --- a/example/pom.xml +++ b/example/pom.xml @@ -20,7 +20,7 @@ 17 3.5.3 3.2.1-SNAPSHOT - 6.1.0 + 6.1.1 1.44 3.5.1 From 6d17656fa7c6368f32bc68fcec041732537740ed Mon Sep 17 00:00:00 2001 From: Sven Mitt Date: Fri, 24 Apr 2026 13:22:09 +0300 Subject: [PATCH 10/25] build(deps): bump spring-boot to 3.5.13 and force thymeleaf to 3.1.4.RELEASE WE2-1215 Signed-off-by: Sven Mitt --- example/pom.xml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/example/pom.xml b/example/pom.xml index ff44fe54..ce27c8fb 100644 --- a/example/pom.xml +++ b/example/pom.xml @@ -5,7 +5,7 @@ org.springframework.boot spring-boot-starter-parent - 3.5.10 + 3.5.13 eu.webeid.example @@ -23,6 +23,9 @@ 6.1.1 1.44 3.5.1 + + + 3.1.4.RELEASE From f14e129fdb33052092e2cb61774d59bdeeff6ae9 Mon Sep 17 00:00:00 2001 From: Sven Mitt Date: Mon, 11 May 2026 10:27:47 +0300 Subject: [PATCH 11/25] build(deps): bump dependencies to most recent versions, simplify warning message WE2-1216 Signed-off-by: Sven Mitt --- example/pom.xml | 5 +---- pom.xml | 18 +++++++++--------- .../validator/AuthTokenValidatorImpl.java | 4 ++-- 3 files changed, 12 insertions(+), 15 deletions(-) diff --git a/example/pom.xml b/example/pom.xml index ce27c8fb..0d6a4d18 100644 --- a/example/pom.xml +++ b/example/pom.xml @@ -5,7 +5,7 @@ org.springframework.boot spring-boot-starter-parent - 3.5.13 + 3.5.14 eu.webeid.example @@ -23,9 +23,6 @@ 6.1.1 1.44 3.5.1 - - - 3.1.4.RELEASE diff --git a/pom.xml b/pom.xml index 99ce27be..94f32af1 100644 --- a/pom.xml +++ b/pom.xml @@ -12,18 +12,18 @@ 11 - 0.12.6 + 0.13.0 1.84 - 2.19.1 + 2.21.3 2.0.17 - 5.13.3 + 5.14.4 3.27.7 - 5.18.0 - 3.5.2 - 3.3.1 - 3.11.2 - 3.6.0 - 0.8.12 + 5.23.0 + 3.5.5 + 3.4.0 + 3.12.0 + 3.6.2 + 0.8.14 ${project.basedir}/../jacoco-coverage-report/target/site/jacoco-aggregate/jacoco.xml diff --git a/src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java b/src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java index 14cf3e78..b26ad653 100644 --- a/src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java +++ b/src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java @@ -107,7 +107,7 @@ public WebEidAuthToken parse(String authToken) throws AuthTokenException { return parseToken(authToken); } catch (Exception e) { // Generally "log and rethrow" is an anti-pattern, but it fits with the surrounding logging style. - LOG.warn("Token parsing was interrupted:", e); + LOG.warn("Token parsing failed: {}: {}", e.getClass().getName(), e.getMessage()); throw e; } } @@ -119,7 +119,7 @@ public X509Certificate validate(WebEidAuthToken authToken, String currentChallen return validateToken(authToken, currentChallengeNonce); } catch (Exception e) { // Generally "log and rethrow" is an anti-pattern, but it fits with the surrounding logging style. - LOG.warn("Token validation was interrupted:", e); + LOG.warn("Token validation failed: {}: {}", e.getClass().getName(), e.getMessage()); throw e; } } From c8e5d601cfdf50da7433ffc32f84ef54b8f12437 Mon Sep 17 00:00:00 2001 From: Sven Mitt Date: Tue, 19 May 2026 16:01:54 +0300 Subject: [PATCH 12/25] build(release): release of 3.2.1 WE2-1216 Signed-off-by: Sven Mitt --- example/pom.xml | 4 ++-- pom.xml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/example/pom.xml b/example/pom.xml index 0d6a4d18..979eea9a 100644 --- a/example/pom.xml +++ b/example/pom.xml @@ -10,7 +10,7 @@ eu.webeid.example web-eid-springboot-example - 3.2.1-SNAPSHOT + 3.2.1 web-eid-springboot-example Example Spring Boot application that demonstrates how to use Web eID for authentication and digital signing @@ -19,7 +19,7 @@ 17 3.5.3 - 3.2.1-SNAPSHOT + 3.2.1 6.1.1 1.44 3.5.1 diff --git a/pom.xml b/pom.xml index 94f32af1..9620b800 100644 --- a/pom.xml +++ b/pom.xml @@ -5,7 +5,7 @@ 4.0.0 authtoken-validation eu.webeid.security - 3.2.1-SNAPSHOT + 3.2.1 jar authtoken-validation Web eID authentication token validation library for Java From 13d2f4528b2a6767345a4f6de76affaa56360191 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mart=20S=C3=B5mermaa?= Date: Fri, 22 May 2026 11:56:47 +0300 Subject: [PATCH 13/25] example: change Web eID application packages' version to 2.9.0 (#114) WE2-1141 Signed-off-by: Mart Somermaa Co-authored-by: Mart Somermaa --- example/src/main/resources/templates/index.html | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/example/src/main/resources/templates/index.html b/example/src/main/resources/templates/index.html index 8e1e760b..fd28a8da 100644 --- a/example/src/main/resources/templates/index.html +++ b/example/src/main/resources/templates/index.html @@ -61,15 +61,15 @@

Usage

| bash
Note: as of the 2.5 version, Web eID supports Firefox installed via Snap. -
  • on macOS 13 or later, for Firefox and Chrome from - here, +
  • on macOS 14 or later, for Firefox and Chrome from + here,
    • -
  • on macOS 13 or later, for Safari, install the extension from +
  • on macOS 14 or later, for Safari, install the extension from App Store,
  • on Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, Windows Server 2025 for Firefox, Chrome and Edge from - here. + here.
    • From 96b460b1ec506861715ce310c69efc91f3ccdb3f Mon Sep 17 00:00:00 2001 From: Sven Mitt Date: Fri, 22 May 2026 11:23:57 +0300 Subject: [PATCH 14/25] build(release): release of 3.2.2 WE2-1216 Signed-off-by: Sven Mitt --- example/pom.xml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/example/pom.xml b/example/pom.xml index 979eea9a..c4f36d9d 100644 --- a/example/pom.xml +++ b/example/pom.xml @@ -10,7 +10,7 @@ eu.webeid.example web-eid-springboot-example - 3.2.1 + 3.2.2 web-eid-springboot-example Example Spring Boot application that demonstrates how to use Web eID for authentication and digital signing @@ -23,7 +23,10 @@ 6.1.1 1.44 3.5.1 -     + + + 10.1.55 +     From 783cc3aad9e3b348c83dcc7448ba8aa6f9ad0442 Mon Sep 17 00:00:00 2001 From: Sven Mitt Date: Fri, 29 May 2026 11:39:19 +0300 Subject: [PATCH 15/25] build: bump docker version to 3.2.2 WE2-1246 Signed-off-by: Sven Mitt --- example/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/example/docker-compose.yml b/example/docker-compose.yml index 3ab40226..293cc99a 100644 --- a/example/docker-compose.yml +++ b/example/docker-compose.yml @@ -1,7 +1,7 @@ version: '2' services: web-eid-springboot-example: - image: web-eid-springboot-example:3.2.0 + image: web-eid-springboot-example:3.2.2 restart: always environment: JAVA_TOOL_OPTIONS: '-Dspring.profiles.active=prod' From 887f11d5b2484c8b6d074c4e87f3aaa76efc4043 Mon Sep 17 00:00:00 2001 From: Kristel Merilain Date: Wed, 10 Jun 2026 09:32:53 +0300 Subject: [PATCH 16/25] Add resolute support (#120) Signed-off-by: Kristel Merilain --- example/src/main/resources/static/scripts/install-web-eid.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/example/src/main/resources/static/scripts/install-web-eid.sh b/example/src/main/resources/static/scripts/install-web-eid.sh index a48dca63..8775e3b5 100755 --- a/example/src/main/resources/static/scripts/install-web-eid.sh +++ b/example/src/main/resources/static/scripts/install-web-eid.sh @@ -120,7 +120,8 @@ test_sudo # 22.04 jammy LTS 2027-04 # 24.04 noble LTS 2029-04 # 25.10 questing - 2026-07 -LATEST_SUPPORTED_UBUNTU_CODENAME='questing' +# 26.04 resolute LTS 2031-05 +LATEST_SUPPORTED_UBUNTU_CODENAME='resolute' # check if Debian or Ubuntu distro=$(lsb_release -is | tr '[:upper:]' '[:lower:]') @@ -164,7 +165,7 @@ case $distro in utopic|vivid|wily|trusty|artful|cosmic|disco|xenial|eoan|groovy|hirsute|impish|bionic|zorin|kinetic|lunar|mantic|focal|oracular|plucky) make_fail "Ubuntu $codename is not officially supported" ;; - jammy|noble|questing) + jammy|noble|questing|resolute) add_repository $codename ;; *) From 7039e7f86711687104871cabd8ef09fc9f3686b2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 30 Jun 2026 04:32:15 +0000 Subject: [PATCH 17/25] build(deps): bump com.fasterxml.jackson.core:jackson-databind Bumps [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson) from 2.21.3 to 2.22.0. - [Commits](https://github.com/FasterXML/jackson/commits) --- updated-dependencies: - dependency-name: com.fasterxml.jackson.core:jackson-databind dependency-version: 2.22.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 9620b800..7211694a 100644 --- a/pom.xml +++ b/pom.xml @@ -14,7 +14,7 @@ 11 0.13.0 1.84 - 2.21.3 + 2.22.0 2.0.17 5.14.4 3.27.7 From 42def06dfff8f44353d777a8937d38bfad5869bb Mon Sep 17 00:00:00 2001 From: Raul Metsma Date: Mon, 25 May 2026 11:18:50 +0300 Subject: [PATCH 18/25] Clarify how URL should be encoded WE2-1241 Signed-off-by: Raul Metsma --- README.md | 10 +++++++++- example/README.md | 5 +++-- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 78818d04..e66db524 100644 --- a/README.md +++ b/README.md @@ -134,6 +134,14 @@ import eu.webeid.security.validator.AuthTokenValidatorBuilder; ... ``` +The site origin configured with `withSiteOrigin()` must match the origin string +signed by the Web eID application. Use the [ASCII serialization of the +origin](https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin) +as specified by the [Web eID architecture +document](https://github.com/web-eid/web-eid-system-architecture-doc#web-eid-authentication-token-specification). +For internationalized domain names, configure the Punycode form, for example +`https://xn--pike-loa.ee` for `https://päike.ee`. + ## 6. Add a REST endpoint for issuing challenge nonces A REST endpoint that issues challenge nonces is required for authentication. The endpoint must support `GET` requests. @@ -262,7 +270,7 @@ The website back end must lookup the challenge nonce from its local store using As described in section *[5. Configure the authentication token validator](#5-configure-the-authentication-token-validator)*, the mandatory authentication token validator configuration parameters are the website origin and trusted certificate authorities. -**Origin** must be the URL serving the web application. Origin URL must be in the form of `"https://" [ ":" ]` as defined in [MDN](https://developer.mozilla.org/en-US/docs/Web/API/Location/origin) and not contain path or query components. **Note that the `origin` URL must not end with a slash `/`**. +**Origin** must be the URL serving the web application. Origin URL must be in the form of `"https://" [ ":" ]` as defined in [MDN](https://developer.mozilla.org/en-US/docs/Web/API/Location/origin) and not contain path or query components. **Note that the `origin` URL must not end with a slash `/`**. The configured origin must use the ASCII serialization that is signed by the Web eID application. For internationalized domain names, use the Punycode form, for example `https://xn--pike-loa.ee` instead of `https://päike.ee`. The **trusted certificate authority certificates** are used to validate that the user certificate from the authentication token and the OCSP responder certificate is signed by a trusted certificate authority. Intermediate CA certificates must be used instead of the root CA certificates so that revoked CA certificates can be removed. Trusted certificate authority certificates configuration is described in more detail in section *[4. Add trusted certificate authority certificates](#4-add-trusted-certificate-authority-certificates)*. diff --git a/example/README.md b/example/README.md index f0e66519..b0b0e6a1 100644 --- a/example/README.md +++ b/example/README.md @@ -33,7 +33,9 @@ web-eid-auth-token: local-origin: "https://<>" ``` -**Note that the origin URL must not end with a slash `/`**. +**Note that the origin URL must not end with a slash `/`**. For internationalized +domain names, use the ASCII/Punycode origin form in `local-origin`, for example +`https://xn--pike-loa.ee` for `https://päike.ee`. ### 3. Configure the trusted certificate authority certificates @@ -262,4 +264,3 @@ When running the application with the `dev` profile in test mode, you need to up ### Why do I get the `401 Unauthorized "Authentication failed: Web eID token validation failed"` response during authentication? One possible reason is that you are using the test ID card on a site that is running in production mode or, vice-versa, a real ID card on a site that is running in test mode; or any other ID card whose certificate authority has not been added to the list of trusted certificate authorities. There will be a `CertificateNotTrustedException` in the logs in this case. - From a9221eda1d14d4320ecceccf5c1c3f0e5c84f099 Mon Sep 17 00:00:00 2001 From: Kristel Merilain Date: Tue, 14 Jul 2026 10:16:23 +0300 Subject: [PATCH 19/25] Remove questing support (#127) Signed-off-by: Kristel Merilain --- .../src/main/resources/static/scripts/install-web-eid.sh | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/example/src/main/resources/static/scripts/install-web-eid.sh b/example/src/main/resources/static/scripts/install-web-eid.sh index 8775e3b5..d3c4939c 100755 --- a/example/src/main/resources/static/scripts/install-web-eid.sh +++ b/example/src/main/resources/static/scripts/install-web-eid.sh @@ -119,7 +119,6 @@ test_sudo # version name LTS supported until # 22.04 jammy LTS 2027-04 # 24.04 noble LTS 2029-04 -# 25.10 questing - 2026-07 # 26.04 resolute LTS 2031-05 LATEST_SUPPORTED_UBUNTU_CODENAME='resolute' @@ -137,8 +136,8 @@ case $distro in case "$codename" in trixie) make_warn "Debian $codename is not officially supported" - make_warn "Trying to install packages from Ubuntu questing repository" - add_repository questing + make_warn "Trying to install packages from Ubuntu noble repository" + add_repository noble ;; bookworm) make_warn "Debian $codename is not officially supported" @@ -162,10 +161,10 @@ case $distro in ;; esac case $codename in - utopic|vivid|wily|trusty|artful|cosmic|disco|xenial|eoan|groovy|hirsute|impish|bionic|zorin|kinetic|lunar|mantic|focal|oracular|plucky) + utopic|vivid|wily|trusty|artful|cosmic|disco|xenial|eoan|groovy|hirsute|impish|bionic|zorin|kinetic|lunar|mantic|focal|oracular|plucky|questing) make_fail "Ubuntu $codename is not officially supported" ;; - jammy|noble|questing|resolute) + jammy|noble|resolute) add_repository $codename ;; *) From 8ab06e08488f6c34377802f4d316e692af932e7f Mon Sep 17 00:00:00 2001 From: Mart Aarma Date: Tue, 14 Jul 2026 09:33:40 +0300 Subject: [PATCH 20/25] Update mock dates in tests --- .../validator/AuthTokenAlgorithmTest.java | 25 ++++++++++++-- .../validator/AuthTokenSignatureTest.java | 33 ++++++++++++++----- .../ocsp/OcspClientOverrideTest.java | 21 ++++++++++++ 3 files changed, 68 insertions(+), 11 deletions(-) diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenAlgorithmTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenAlgorithmTest.java index 3f1e6a78..a29f05fc 100644 --- a/src/test/java/eu/webeid/security/validator/AuthTokenAlgorithmTest.java +++ b/src/test/java/eu/webeid/security/validator/AuthTokenAlgorithmTest.java @@ -22,15 +22,36 @@ package eu.webeid.security.validator; -import org.junit.jupiter.api.Test; import eu.webeid.security.authtoken.WebEidAuthToken; -import eu.webeid.security.exceptions.AuthTokenParseException; import eu.webeid.security.exceptions.AuthTokenException; +import eu.webeid.security.exceptions.AuthTokenParseException; import eu.webeid.security.testutil.AbstractTestWithValidator; +import eu.webeid.security.util.DateAndTime; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; +import org.mockito.MockedStatic; +import static eu.webeid.security.testutil.DateMocker.mockDate; import static org.assertj.core.api.Assertions.assertThatThrownBy; +import static org.mockito.Mockito.mockStatic; class AuthTokenAlgorithmTest extends AbstractTestWithValidator { + private MockedStatic mockedClock; + + @Override + @BeforeEach + protected void setup() { + super.setup(); + mockedClock = mockStatic(DateAndTime.DefaultClock.class); + // Ensure that the certificates do not expire. + mockDate("2021-07-23", mockedClock); + } + + @AfterEach + void tearDown() { + mockedClock.close(); + } @Test void whenAlgorithmNone_thenValidationFails() throws AuthTokenException { diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenSignatureTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenSignatureTest.java index 3f596858..3a43a3e3 100644 --- a/src/test/java/eu/webeid/security/validator/AuthTokenSignatureTest.java +++ b/src/test/java/eu/webeid/security/validator/AuthTokenSignatureTest.java @@ -28,7 +28,10 @@ import eu.webeid.security.testutil.AbstractTestWithValidator; import eu.webeid.security.testutil.AuthTokenValidators; import eu.webeid.security.util.DateAndTime; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; +import org.mockito.MockedStatic; import java.security.cert.X509Certificate; @@ -46,6 +49,22 @@ class AuthTokenSignatureTest extends AbstractTestWithValidator { "\"signature\":\"arx164xRiwhIQDINe0J+ZxJWZFOQTx0PBtOaWaxAe7gofEIHRIbV1w0sOCYBJnvmvMem9hU4nc2+iJx2x8poYck4Z6eI3GwtiksIec3XQ9ZIk1n/XchXnmPn3GYV+HzJ\"," + "\"format\":\"web-eid:1.0\"}"; + private MockedStatic mockedClock; + + @Override + @BeforeEach + protected void setup() { + super.setup(); + mockedClock = mockStatic(DateAndTime.DefaultClock.class); + // Ensure that the certificates do not expire. + mockDate("2021-07-23", mockedClock); + } + + @AfterEach + void tearDown() { + mockedClock.close(); + } + @Test void whenValidTokenAndNonce_thenValidationSucceeds() throws Exception { final X509Certificate result = validator.validate(validAuthToken, VALID_CHALLENGE_NONCE); @@ -80,15 +99,11 @@ void whenValidTokenAndWrongOrigin_thenValidationFails() throws Exception { @Test void whenTokenWithWrongCert_thenValidationFails() throws Exception { - // Ensure that the certificate does not expire. - try (final var mockedClock = mockStatic(DateAndTime.DefaultClock.class)) { - mockDate("2024-08-01", mockedClock); - final AuthTokenValidator authTokenValidator = AuthTokenValidators.getAuthTokenValidator(); - final WebEidAuthToken authTokenWithWrongCert = authTokenValidator.parse(AUTH_TOKEN_WRONG_CERT); - assertThatThrownBy(() -> authTokenValidator - .validate(authTokenWithWrongCert, VALID_CHALLENGE_NONCE)) - .isInstanceOf(AuthTokenSignatureValidationException.class); - } + final AuthTokenValidator authTokenValidator = AuthTokenValidators.getAuthTokenValidator(); + final WebEidAuthToken authTokenWithWrongCert = authTokenValidator.parse(AUTH_TOKEN_WRONG_CERT); + assertThatThrownBy(() -> authTokenValidator + .validate(authTokenWithWrongCert, VALID_CHALLENGE_NONCE)) + .isInstanceOf(AuthTokenSignatureValidationException.class); } } diff --git a/src/test/java/eu/webeid/security/validator/ocsp/OcspClientOverrideTest.java b/src/test/java/eu/webeid/security/validator/ocsp/OcspClientOverrideTest.java index 4cd1d951..c1a66c4e 100644 --- a/src/test/java/eu/webeid/security/validator/ocsp/OcspClientOverrideTest.java +++ b/src/test/java/eu/webeid/security/validator/ocsp/OcspClientOverrideTest.java @@ -25,11 +25,15 @@ import eu.webeid.security.exceptions.JceException; import eu.webeid.security.testutil.AbstractTestWithValidator; import eu.webeid.security.testutil.AuthTokenValidators; +import eu.webeid.security.util.DateAndTime; import eu.webeid.security.validator.AuthTokenValidator; import org.bouncycastle.cert.ocsp.OCSPReq; import org.bouncycastle.cert.ocsp.OCSPResp; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Disabled; import org.junit.jupiter.api.Test; +import org.mockito.MockedStatic; import java.io.IOException; import java.net.URI; @@ -37,10 +41,27 @@ import java.security.cert.CertificateException; import java.time.Duration; +import static eu.webeid.security.testutil.DateMocker.mockDate; import static org.assertj.core.api.Assertions.assertThatCode; import static org.assertj.core.api.Assertions.assertThatThrownBy; +import static org.mockito.Mockito.mockStatic; class OcspClientOverrideTest extends AbstractTestWithValidator { + private MockedStatic mockedClock; + + @Override + @BeforeEach + protected void setup() { + super.setup(); + mockedClock = mockStatic(DateAndTime.DefaultClock.class); + // Ensure that the certificates do not expire. + mockDate("2021-07-23", mockedClock); + } + + @AfterEach + void tearDown() { + mockedClock.close(); + } @Test void whenOcspClientIsOverridden_thenItIsUsed() throws JceException, CertificateException, IOException { From 07f35b9b9aee68f9e4393440294a758129f32b0c Mon Sep 17 00:00:00 2001 From: Mart Somermaa Date: Tue, 14 Jul 2026 14:16:24 +0300 Subject: [PATCH 21/25] build(deps): bump jackson-databind to 2.22.1 Signed-off-by: Mart Somermaa --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 7211694a..c1604d8d 100644 --- a/pom.xml +++ b/pom.xml @@ -14,7 +14,7 @@ 11 0.13.0 1.84 - 2.22.0 + 2.22.1 2.0.17 5.14.4 3.27.7 From 4c2cc54acd13cd80190f6bb275ee6f1d45107eb1 Mon Sep 17 00:00:00 2001 From: Mart Aarma Date: Thu, 16 Jul 2026 09:37:54 +0300 Subject: [PATCH 22/25] Update mock dates in example app tests The test user certificate expired on 2026-07-09, which made auth token validation fail with CertificateExpiredException. Mock the validation clock to a date within the certificate validity period, like commit 8ab06e0 did for the library tests. --- .../eu/webeid/example/WebApplicationTest.java | 1 + .../java/eu/webeid/example/testutil/Dates.java | 16 ++++++++++++++++ 2 files changed, 17 insertions(+) diff --git a/example/src/test/java/eu/webeid/example/WebApplicationTest.java b/example/src/test/java/eu/webeid/example/WebApplicationTest.java index f7f5a3de..fa8197e9 100644 --- a/example/src/test/java/eu/webeid/example/WebApplicationTest.java +++ b/example/src/test/java/eu/webeid/example/WebApplicationTest.java @@ -103,6 +103,7 @@ public void validateOcspResponse(XadesSignature xadesSignature) { session.setAttribute("challenge-nonce", new ChallengeNonce(ObjectMother.VALID_CHALLENGE_NONCE, DateAndTime.utcNow().plusMinutes(1))); Dates.setMockedSignatureDate(Dates.getSigningDateTime()); + Dates.setMockedAuthTokenValidationDate(Dates.getAuthTokenValidationDateTime()); // Act and assert mvcBuilder.build().perform(get("/auth/challenge")); diff --git a/example/src/test/java/eu/webeid/example/testutil/Dates.java b/example/src/test/java/eu/webeid/example/testutil/Dates.java index 3f5f76ae..02f7b1f4 100644 --- a/example/src/test/java/eu/webeid/example/testutil/Dates.java +++ b/example/src/test/java/eu/webeid/example/testutil/Dates.java @@ -23,6 +23,7 @@ package eu.webeid.example.testutil; import eu.europa.esig.dss.model.BLevelParameters; +import eu.webeid.security.util.DateAndTime; import mockit.Mock; import mockit.MockUp; @@ -37,6 +38,12 @@ public static ZonedDateTime getSigningDateTime() { ZoneId.of("Europe/Tallinn")); } + public static ZonedDateTime getAuthTokenValidationDateTime() { + // Ensure that the certificates do not expire. + return ZonedDateTime.of(2021, 7, 23, 0, 0, 0, 0, + ZoneId.of("UTC")); + } + public static void setMockedSignatureDate(ZonedDateTime mockedDateTime) { new MockUp() { @Mock @@ -45,4 +52,13 @@ public Date getSigningDate() { } }; } + + public static void setMockedAuthTokenValidationDate(ZonedDateTime mockedDateTime) { + new MockUp() { + @Mock + public Date now() { + return Date.from(mockedDateTime.toInstant()); + } + }; + } } From 5d9cb3b2716657e674f08b168fd8919e0864ef14 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mart=20S=C3=B5mermaa?= Date: Mon, 24 Aug 2026 09:06:01 +0300 Subject: [PATCH 23/25] example: change Web eID application packages' version to 2.10.0, update .NET example links (#130) WE2-1219 Signed-off-by: Mart Somermaa Co-authored-by: Mart Somermaa --- example/src/main/resources/templates/index.html | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/example/src/main/resources/templates/index.html b/example/src/main/resources/templates/index.html index fd28a8da..c2c0235d 100644 --- a/example/src/main/resources/templates/index.html +++ b/example/src/main/resources/templates/index.html @@ -62,14 +62,14 @@

    Usage

    Note: as of the 2.5 version, Web eID supports Firefox installed via Snap.
  • on macOS 14 or later, for Firefox and Chrome from - here, + here,
  • on macOS 14 or later, for Safari, install the extension from App Store,
  • on Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, Windows Server 2025 for Firefox, Chrome and Edge from - here. + here.
    • @@ -223,7 +223,7 @@

    For developers

  • in .NET/C# use the libdigidocpp library in the back end of the web application according to the instructions - here. + here.
    • @@ -233,7 +233,7 @@

    For developers

    and digital signing is available here. The .NET/C# version of the example is available - here. + here. The PHP version of the example is available here.

    From 61f23cd70050c9e2b8cc9edeaa172d1a76c1f8c0 Mon Sep 17 00:00:00 2001 From: Raul Metsma Date: Tue, 15 Sep 2026 09:13:31 +0300 Subject: [PATCH 24/25] Check copyright headers and add missing headers WE2-1296 Signed-off-by: Raul Metsma --- .github/gitlab-mvn-settings.xml | 2 ++ .github/workflows/codeql-analysis.yml | 3 +++ .github/workflows/copyright.yml | 12 ++++++++++ .github/workflows/coverity-analysis.yml | 3 +++ .github/workflows/maven-build-example.yml | 3 +++ .github/workflows/maven-build.yml | 3 +++ .github/workflows/maven-deploy.yml | 3 +++ .github/workflows/sonarcloud-analysis.yml | 3 +++ LICENSE | 2 +- example/.prettierrc.yaml | 3 +++ example/LICENSE | 2 +- example/docker-compose.yml | 3 +++ example/pom.xml | 2 ++ example/scripts/deployment/fab.sh | 2 ++ example/scripts/deployment/fabfile.py | 3 +++ .../WebEidSpringbootExampleApplication.java | 23 ++---------------- .../config/ApplicationConfiguration.java | 23 ++---------------- .../config/SameSiteCookieConfiguration.java | 23 ++---------------- .../SessionBackedChallengeNonceStore.java | 23 ++---------------- .../config/ValidationConfiguration.java | 23 ++---------------- .../eu/webeid/example/config/YAMLConfig.java | 23 ++---------------- .../AuthTokenDTOAuthenticationProvider.java | 23 ++---------------- .../WebEidAjaxLoginProcessingFilter.java | 23 ++---------------- .../security/WebEidAuthentication.java | 23 ++---------------- .../AjaxAuthenticationFailureHandler.java | 23 ++---------------- .../AjaxAuthenticationSuccessHandler.java | 23 ++---------------- .../example/security/dto/AuthTokenDTO.java | 23 ++---------------- .../example/service/SigningService.java | 23 ++---------------- .../example/service/dto/CertificateDTO.java | 23 ++---------------- .../example/service/dto/ChallengeDTO.java | 23 ++---------------- .../webeid/example/service/dto/DigestDTO.java | 23 ++---------------- .../webeid/example/service/dto/FileDTO.java | 23 ++---------------- .../service/dto/SignatureAlgorithmDTO.java | 23 ++---------------- .../example/service/dto/SignatureDTO.java | 23 ++---------------- .../webeid/example/web/IndexController.java | 23 ++---------------- .../webeid/example/web/WelcomeController.java | 23 ++---------------- .../example/web/rest/ChallengeController.java | 23 ++---------------- .../example/web/rest/SigningController.java | 23 ++---------------- .../src/main/resources/application-dev.yaml | 3 +++ .../src/main/resources/application-prod.yaml | 3 +++ example/src/main/resources/application.yaml | 3 +++ .../src/main/resources/static/css/main.css | 2 ++ .../resources/static/img/eu-fund-flags.svg | 2 ++ .../src/main/resources/static/js/errors.js | 2 +- .../src/main/resources/static/js/web-eid.js | 2 +- .../static/scripts/install-web-eid.sh | 2 ++ .../src/main/resources/templates/index.html | 2 ++ .../welcome-with-file-upload-support.html | 2 ++ .../src/main/resources/templates/welcome.html | 2 ++ .../AuthenticationRestControllerTest.java | 23 ++---------------- .../eu/webeid/example/WebApplicationTest.java | 23 ++---------------- .../WebEidAjaxLoginProcessingFilterTest.java | 23 ++---------------- .../security/WebEidAuthenticationTest.java | 23 ++---------------- .../eu/webeid/example/testutil/Dates.java | 23 ++---------------- .../webeid/example/testutil/HttpHelper.java | 23 ++---------------- .../webeid/example/testutil/ObjectMother.java | 23 ++---------------- .../src/test/resources/application-dev.yaml | 3 +++ pom.xml | 2 ++ .../security/authtoken/WebEidAuthToken.java | 23 ++---------------- .../security/certificate/CertificateData.java | 23 ++---------------- .../certificate/CertificateLoader.java | 23 ++---------------- .../certificate/CertificateValidator.java | 23 ++---------------- .../SubjectCertificatePolicies.java | 23 ++---------------- .../security/challenge/ChallengeNonce.java | 23 ++---------------- .../challenge/ChallengeNonceGenerator.java | 23 ++---------------- .../ChallengeNonceGeneratorBuilder.java | 23 ++---------------- .../ChallengeNonceGeneratorImpl.java | 23 ++---------------- .../challenge/ChallengeNonceStore.java | 23 ++---------------- .../exceptions/AuthTokenException.java | 23 ++---------------- .../exceptions/AuthTokenParseException.java | 23 ++---------------- ...AuthTokenSignatureValidationException.java | 23 ++---------------- .../CertificateDecodingException.java | 23 ++---------------- .../CertificateExpiredException.java | 23 ++---------------- .../CertificateNotTrustedException.java | 23 ++---------------- .../CertificateNotYetValidException.java | 23 ++---------------- .../ChallengeNonceExpiredException.java | 23 ++---------------- .../ChallengeNonceNotFoundException.java | 23 ++---------------- .../ChallengeNullOrEmptyException.java | 23 ++---------------- .../security/exceptions/JceException.java | 23 ++---------------- .../exceptions/OCSPCertificateException.java | 23 ++---------------- ...rCertificateDisallowedPolicyException.java | 23 ++---------------- ...serCertificateMissingPurposeException.java | 23 ++---------------- ...erCertificateOCSPCheckFailedException.java | 23 ++---------------- .../UserCertificateParseException.java | 23 ++---------------- .../UserCertificateRevokedException.java | 23 ++---------------- .../UserCertificateWrongPurposeException.java | 23 ++---------------- .../webeid/security/util/Base64Decoder.java | 23 ++---------------- .../eu/webeid/security/util/Collections.java | 23 ++---------------- .../eu/webeid/security/util/DateAndTime.java | 23 ++---------------- .../java/eu/webeid/security/util/Strings.java | 23 ++---------------- .../AuthTokenSignatureValidator.java | 24 +++---------------- .../AuthTokenValidationConfiguration.java | 23 ++---------------- .../validator/AuthTokenValidator.java | 23 ++---------------- .../validator/AuthTokenValidatorBuilder.java | 23 ++---------------- .../validator/AuthTokenValidatorImpl.java | 23 ++---------------- ...SubjectCertificateNotRevokedValidator.java | 23 ++---------------- .../SubjectCertificatePolicyValidator.java | 23 ++---------------- .../SubjectCertificatePurposeValidator.java | 23 ++---------------- .../SubjectCertificateTrustedValidator.java | 23 ++---------------- .../SubjectCertificateValidator.java | 23 ++---------------- .../SubjectCertificateValidatorBatch.java | 23 ++---------------- .../validator/ocsp/DigestCalculatorImpl.java | 23 ++---------------- .../security/validator/ocsp/OcspClient.java | 23 ++---------------- .../validator/ocsp/OcspClientImpl.java | 23 ++---------------- .../validator/ocsp/OcspRequestBuilder.java | 23 ++---------------- .../validator/ocsp/OcspResponseValidator.java | 23 ++---------------- .../validator/ocsp/OcspServiceProvider.java | 23 ++---------------- .../security/validator/ocsp/OcspUrl.java | 23 ++---------------- .../ocsp/service/AiaOcspService.java | 23 ++---------------- .../service/AiaOcspServiceConfiguration.java | 23 ++---------------- .../ocsp/service/DesignatedOcspService.java | 23 ++---------------- .../DesignatedOcspServiceConfiguration.java | 23 ++---------------- .../validator/ocsp/service/OcspService.java | 23 ++---------------- .../certificate/CertificateDataTest.java | 3 +++ .../ChallengeNonceGeneratorTest.java | 23 ++---------------- .../InMemoryChallengeNonceStore.java | 23 ++---------------- .../testutil/AbstractTestWithValidator.java | 23 ++---------------- .../testutil/AuthTokenValidators.java | 23 ++---------------- .../security/testutil/Certificates.java | 23 ++---------------- .../webeid/security/testutil/DateMocker.java | 23 ++---------------- .../security/testutil/OcspServiceMaker.java | 23 ++---------------- .../validator/AuthTokenAlgorithmTest.java | 23 ++---------------- ...AuthTokenCertificateBelgianIdCardTest.java | 23 ++---------------- ...AuthTokenCertificateFinnishIdCardTest.java | 23 ++---------------- .../validator/AuthTokenCertificateTest.java | 23 ++---------------- .../validator/AuthTokenSignatureTest.java | 23 ++---------------- .../AuthTokenSignatureValidatorTest.java | 23 ++---------------- .../validator/AuthTokenStructureTest.java | 23 ++---------------- .../AuthTokenValidatorBuilderTest.java | 23 ++---------------- ...ectCertificateNotRevokedValidatorTest.java | 23 ++---------------- .../ocsp/OcspClientOverrideTest.java | 23 ++---------------- .../ocsp/OcspResponseValidatorTest.java | 23 ++---------------- .../ocsp/OcspServiceProviderTest.java | 23 ++---------------- .../security/validator/ocsp/OcspUrlTest.java | 23 ++---------------- 134 files changed, 289 insertions(+), 2209 deletions(-) create mode 100644 .github/workflows/copyright.yml diff --git a/.github/gitlab-mvn-settings.xml b/.github/gitlab-mvn-settings.xml index 3caeda83..223f5c63 100644 --- a/.github/gitlab-mvn-settings.xml +++ b/.github/gitlab-mvn-settings.xml @@ -1,3 +1,5 @@ + + diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index c27e2520..539602e5 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -1,3 +1,6 @@ +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: MIT + name: CodeQL code analysis on: diff --git a/.github/workflows/copyright.yml b/.github/workflows/copyright.yml new file mode 100644 index 00000000..93bccd8c --- /dev/null +++ b/.github/workflows/copyright.yml @@ -0,0 +1,12 @@ +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: MIT + +name: Copyright +on: [push, pull_request] +permissions: + contents: read +jobs: + copyright: + name: Check copyright headers + uses: web-eid/.github/.github/workflows/copyright.yml@9ea5bd0c816309493524bce9f96024ed3cc6ff1d # main + diff --git a/.github/workflows/coverity-analysis.yml b/.github/workflows/coverity-analysis.yml index f8035d46..2e8e2285 100644 --- a/.github/workflows/coverity-analysis.yml +++ b/.github/workflows/coverity-analysis.yml @@ -1,3 +1,6 @@ +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: MIT + name: Coverity analysis on: diff --git a/.github/workflows/maven-build-example.yml b/.github/workflows/maven-build-example.yml index 8f044b2a..58aa6920 100644 --- a/.github/workflows/maven-build-example.yml +++ b/.github/workflows/maven-build-example.yml @@ -1,3 +1,6 @@ +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: MIT + name: Maven build example on: diff --git a/.github/workflows/maven-build.yml b/.github/workflows/maven-build.yml index 6528af68..850ad585 100644 --- a/.github/workflows/maven-build.yml +++ b/.github/workflows/maven-build.yml @@ -1,3 +1,6 @@ +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: MIT + name: Maven build on: diff --git a/.github/workflows/maven-deploy.yml b/.github/workflows/maven-deploy.yml index 29a316f5..d2c3af53 100644 --- a/.github/workflows/maven-deploy.yml +++ b/.github/workflows/maven-deploy.yml @@ -1,3 +1,6 @@ +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: MIT + name: Deploy to GitLab Package Repository # Github Packages on: diff --git a/.github/workflows/sonarcloud-analysis.yml b/.github/workflows/sonarcloud-analysis.yml index 4a925a21..e7b57412 100644 --- a/.github/workflows/sonarcloud-analysis.yml +++ b/.github/workflows/sonarcloud-analysis.yml @@ -1,3 +1,6 @@ +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: MIT + name: SonarCloud code analysis on: diff --git a/LICENSE b/LICENSE index a7252dec..422c40b5 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2020-2025 Estonian Information System Authority +Copyright (c) Estonian Information System Authority Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff --git a/example/.prettierrc.yaml b/example/.prettierrc.yaml index 04450cb1..dba6f7db 100644 --- a/example/.prettierrc.yaml +++ b/example/.prettierrc.yaml @@ -1,3 +1,6 @@ +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: MIT + trailingComma: "none" useTabs: false tabWidth: 4 diff --git a/example/LICENSE b/example/LICENSE index 326ac324..422c40b5 100644 --- a/example/LICENSE +++ b/example/LICENSE @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2020-2023 Estonian Information System Authority +Copyright (c) Estonian Information System Authority Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff --git a/example/docker-compose.yml b/example/docker-compose.yml index 293cc99a..403f9c6c 100644 --- a/example/docker-compose.yml +++ b/example/docker-compose.yml @@ -1,3 +1,6 @@ +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: MIT + version: '2' services: web-eid-springboot-example: diff --git a/example/pom.xml b/example/pom.xml index c4f36d9d..6f848dcc 100644 --- a/example/pom.xml +++ b/example/pom.xml @@ -1,4 +1,6 @@ + + 4.0.0 diff --git a/example/scripts/deployment/fab.sh b/example/scripts/deployment/fab.sh index 3082939c..0760296d 100755 --- a/example/scripts/deployment/fab.sh +++ b/example/scripts/deployment/fab.sh @@ -1,4 +1,6 @@ #!/bin/bash +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: MIT set -eu diff --git a/example/scripts/deployment/fabfile.py b/example/scripts/deployment/fabfile.py index 3211f570..bd29d962 100644 --- a/example/scripts/deployment/fabfile.py +++ b/example/scripts/deployment/fabfile.py @@ -1,3 +1,6 @@ +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: MIT + import os from fabric import task diff --git a/example/src/main/java/eu/webeid/example/WebEidSpringbootExampleApplication.java b/example/src/main/java/eu/webeid/example/WebEidSpringbootExampleApplication.java index 5fe5195a..fcf30318 100644 --- a/example/src/main/java/eu/webeid/example/WebEidSpringbootExampleApplication.java +++ b/example/src/main/java/eu/webeid/example/WebEidSpringbootExampleApplication.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example; diff --git a/example/src/main/java/eu/webeid/example/config/ApplicationConfiguration.java b/example/src/main/java/eu/webeid/example/config/ApplicationConfiguration.java index 1728628b..d5d2b584 100644 --- a/example/src/main/java/eu/webeid/example/config/ApplicationConfiguration.java +++ b/example/src/main/java/eu/webeid/example/config/ApplicationConfiguration.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.config; diff --git a/example/src/main/java/eu/webeid/example/config/SameSiteCookieConfiguration.java b/example/src/main/java/eu/webeid/example/config/SameSiteCookieConfiguration.java index 74602523..1c3f78e4 100644 --- a/example/src/main/java/eu/webeid/example/config/SameSiteCookieConfiguration.java +++ b/example/src/main/java/eu/webeid/example/config/SameSiteCookieConfiguration.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.config; diff --git a/example/src/main/java/eu/webeid/example/config/SessionBackedChallengeNonceStore.java b/example/src/main/java/eu/webeid/example/config/SessionBackedChallengeNonceStore.java index 2d57e1f5..c3fdb37f 100644 --- a/example/src/main/java/eu/webeid/example/config/SessionBackedChallengeNonceStore.java +++ b/example/src/main/java/eu/webeid/example/config/SessionBackedChallengeNonceStore.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.config; diff --git a/example/src/main/java/eu/webeid/example/config/ValidationConfiguration.java b/example/src/main/java/eu/webeid/example/config/ValidationConfiguration.java index 0a6c1ad7..540d97f9 100644 --- a/example/src/main/java/eu/webeid/example/config/ValidationConfiguration.java +++ b/example/src/main/java/eu/webeid/example/config/ValidationConfiguration.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.config; diff --git a/example/src/main/java/eu/webeid/example/config/YAMLConfig.java b/example/src/main/java/eu/webeid/example/config/YAMLConfig.java index 1c3359ae..4cf7c660 100644 --- a/example/src/main/java/eu/webeid/example/config/YAMLConfig.java +++ b/example/src/main/java/eu/webeid/example/config/YAMLConfig.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.config; diff --git a/example/src/main/java/eu/webeid/example/security/AuthTokenDTOAuthenticationProvider.java b/example/src/main/java/eu/webeid/example/security/AuthTokenDTOAuthenticationProvider.java index 274a47bf..7104b110 100644 --- a/example/src/main/java/eu/webeid/example/security/AuthTokenDTOAuthenticationProvider.java +++ b/example/src/main/java/eu/webeid/example/security/AuthTokenDTOAuthenticationProvider.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.security; diff --git a/example/src/main/java/eu/webeid/example/security/WebEidAjaxLoginProcessingFilter.java b/example/src/main/java/eu/webeid/example/security/WebEidAjaxLoginProcessingFilter.java index 4782ee93..2af96cfc 100644 --- a/example/src/main/java/eu/webeid/example/security/WebEidAjaxLoginProcessingFilter.java +++ b/example/src/main/java/eu/webeid/example/security/WebEidAjaxLoginProcessingFilter.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.security; diff --git a/example/src/main/java/eu/webeid/example/security/WebEidAuthentication.java b/example/src/main/java/eu/webeid/example/security/WebEidAuthentication.java index 5ba3ebf7..e83c16f6 100644 --- a/example/src/main/java/eu/webeid/example/security/WebEidAuthentication.java +++ b/example/src/main/java/eu/webeid/example/security/WebEidAuthentication.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.security; diff --git a/example/src/main/java/eu/webeid/example/security/ajax/AjaxAuthenticationFailureHandler.java b/example/src/main/java/eu/webeid/example/security/ajax/AjaxAuthenticationFailureHandler.java index 1bec05fd..29061dab 100644 --- a/example/src/main/java/eu/webeid/example/security/ajax/AjaxAuthenticationFailureHandler.java +++ b/example/src/main/java/eu/webeid/example/security/ajax/AjaxAuthenticationFailureHandler.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.security.ajax; diff --git a/example/src/main/java/eu/webeid/example/security/ajax/AjaxAuthenticationSuccessHandler.java b/example/src/main/java/eu/webeid/example/security/ajax/AjaxAuthenticationSuccessHandler.java index a5ea20d0..38ef6e16 100644 --- a/example/src/main/java/eu/webeid/example/security/ajax/AjaxAuthenticationSuccessHandler.java +++ b/example/src/main/java/eu/webeid/example/security/ajax/AjaxAuthenticationSuccessHandler.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.security.ajax; diff --git a/example/src/main/java/eu/webeid/example/security/dto/AuthTokenDTO.java b/example/src/main/java/eu/webeid/example/security/dto/AuthTokenDTO.java index 73a70a4e..07dae682 100644 --- a/example/src/main/java/eu/webeid/example/security/dto/AuthTokenDTO.java +++ b/example/src/main/java/eu/webeid/example/security/dto/AuthTokenDTO.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.security.dto; diff --git a/example/src/main/java/eu/webeid/example/service/SigningService.java b/example/src/main/java/eu/webeid/example/service/SigningService.java index 98abd56d..cd2b5a78 100644 --- a/example/src/main/java/eu/webeid/example/service/SigningService.java +++ b/example/src/main/java/eu/webeid/example/service/SigningService.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.service; diff --git a/example/src/main/java/eu/webeid/example/service/dto/CertificateDTO.java b/example/src/main/java/eu/webeid/example/service/dto/CertificateDTO.java index 7704d015..8bbf1ff8 100644 --- a/example/src/main/java/eu/webeid/example/service/dto/CertificateDTO.java +++ b/example/src/main/java/eu/webeid/example/service/dto/CertificateDTO.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.service.dto; diff --git a/example/src/main/java/eu/webeid/example/service/dto/ChallengeDTO.java b/example/src/main/java/eu/webeid/example/service/dto/ChallengeDTO.java index 4a6b9c93..53a2bd0e 100644 --- a/example/src/main/java/eu/webeid/example/service/dto/ChallengeDTO.java +++ b/example/src/main/java/eu/webeid/example/service/dto/ChallengeDTO.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.service.dto; diff --git a/example/src/main/java/eu/webeid/example/service/dto/DigestDTO.java b/example/src/main/java/eu/webeid/example/service/dto/DigestDTO.java index c567d708..20f68dd2 100644 --- a/example/src/main/java/eu/webeid/example/service/dto/DigestDTO.java +++ b/example/src/main/java/eu/webeid/example/service/dto/DigestDTO.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.service.dto; diff --git a/example/src/main/java/eu/webeid/example/service/dto/FileDTO.java b/example/src/main/java/eu/webeid/example/service/dto/FileDTO.java index 949b358a..44888758 100644 --- a/example/src/main/java/eu/webeid/example/service/dto/FileDTO.java +++ b/example/src/main/java/eu/webeid/example/service/dto/FileDTO.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.service.dto; diff --git a/example/src/main/java/eu/webeid/example/service/dto/SignatureAlgorithmDTO.java b/example/src/main/java/eu/webeid/example/service/dto/SignatureAlgorithmDTO.java index 287682fb..1e5d2e4f 100644 --- a/example/src/main/java/eu/webeid/example/service/dto/SignatureAlgorithmDTO.java +++ b/example/src/main/java/eu/webeid/example/service/dto/SignatureAlgorithmDTO.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.service.dto; diff --git a/example/src/main/java/eu/webeid/example/service/dto/SignatureDTO.java b/example/src/main/java/eu/webeid/example/service/dto/SignatureDTO.java index 68ffd3b8..03b641b0 100644 --- a/example/src/main/java/eu/webeid/example/service/dto/SignatureDTO.java +++ b/example/src/main/java/eu/webeid/example/service/dto/SignatureDTO.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.service.dto; diff --git a/example/src/main/java/eu/webeid/example/web/IndexController.java b/example/src/main/java/eu/webeid/example/web/IndexController.java index 6da1b71a..bc971457 100644 --- a/example/src/main/java/eu/webeid/example/web/IndexController.java +++ b/example/src/main/java/eu/webeid/example/web/IndexController.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.web; diff --git a/example/src/main/java/eu/webeid/example/web/WelcomeController.java b/example/src/main/java/eu/webeid/example/web/WelcomeController.java index bba34c23..5b752f00 100644 --- a/example/src/main/java/eu/webeid/example/web/WelcomeController.java +++ b/example/src/main/java/eu/webeid/example/web/WelcomeController.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.web; diff --git a/example/src/main/java/eu/webeid/example/web/rest/ChallengeController.java b/example/src/main/java/eu/webeid/example/web/rest/ChallengeController.java index df54366a..be3a4a42 100644 --- a/example/src/main/java/eu/webeid/example/web/rest/ChallengeController.java +++ b/example/src/main/java/eu/webeid/example/web/rest/ChallengeController.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.web.rest; diff --git a/example/src/main/java/eu/webeid/example/web/rest/SigningController.java b/example/src/main/java/eu/webeid/example/web/rest/SigningController.java index 2a1c6529..9ce96342 100644 --- a/example/src/main/java/eu/webeid/example/web/rest/SigningController.java +++ b/example/src/main/java/eu/webeid/example/web/rest/SigningController.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.web.rest; diff --git a/example/src/main/resources/application-dev.yaml b/example/src/main/resources/application-dev.yaml index 9c637326..033e8e2b 100644 --- a/example/src/main/resources/application-dev.yaml +++ b/example/src/main/resources/application-dev.yaml @@ -1,3 +1,6 @@ +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: MIT + web-eid-auth-token: validation: use-digidoc4j-prod-configuration: false diff --git a/example/src/main/resources/application-prod.yaml b/example/src/main/resources/application-prod.yaml index 3868f350..50510aa7 100644 --- a/example/src/main/resources/application-prod.yaml +++ b/example/src/main/resources/application-prod.yaml @@ -1,3 +1,6 @@ +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: MIT + web-eid-auth-token: validation: use-digidoc4j-prod-configuration: true diff --git a/example/src/main/resources/application.yaml b/example/src/main/resources/application.yaml index df3117c5..89329c6c 100644 --- a/example/src/main/resources/application.yaml +++ b/example/src/main/resources/application.yaml @@ -1,3 +1,6 @@ +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: MIT + spring: main: allow-circular-references: true diff --git a/example/src/main/resources/static/css/main.css b/example/src/main/resources/static/css/main.css index 3de3421c..0a3df320 100644 --- a/example/src/main/resources/static/css/main.css +++ b/example/src/main/resources/static/css/main.css @@ -1,3 +1,5 @@ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT body { font-family: "Inv Maison Neue","Maison Neue",-apple-system,BlinkMacSystemFont,"Open Sans",open-sans,sans-serif; } diff --git a/example/src/main/resources/static/img/eu-fund-flags.svg b/example/src/main/resources/static/img/eu-fund-flags.svg index 0e99b0d4..82e67e25 100644 --- a/example/src/main/resources/static/img/eu-fund-flags.svg +++ b/example/src/main/resources/static/img/eu-fund-flags.svg @@ -1,4 +1,6 @@ + + + diff --git a/example/src/main/resources/templates/welcome-with-file-upload-support.html b/example/src/main/resources/templates/welcome-with-file-upload-support.html index f13ab589..f2efdc2a 100644 --- a/example/src/main/resources/templates/welcome-with-file-upload-support.html +++ b/example/src/main/resources/templates/welcome-with-file-upload-support.html @@ -1,3 +1,5 @@ + + diff --git a/example/src/main/resources/templates/welcome.html b/example/src/main/resources/templates/welcome.html index 67b31311..73fd03df 100644 --- a/example/src/main/resources/templates/welcome.html +++ b/example/src/main/resources/templates/welcome.html @@ -1,3 +1,5 @@ + + diff --git a/example/src/test/java/eu/webeid/example/AuthenticationRestControllerTest.java b/example/src/test/java/eu/webeid/example/AuthenticationRestControllerTest.java index ec5345a5..b9ac7a85 100644 --- a/example/src/test/java/eu/webeid/example/AuthenticationRestControllerTest.java +++ b/example/src/test/java/eu/webeid/example/AuthenticationRestControllerTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example; diff --git a/example/src/test/java/eu/webeid/example/WebApplicationTest.java b/example/src/test/java/eu/webeid/example/WebApplicationTest.java index fa8197e9..b842a3af 100644 --- a/example/src/test/java/eu/webeid/example/WebApplicationTest.java +++ b/example/src/test/java/eu/webeid/example/WebApplicationTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example; diff --git a/example/src/test/java/eu/webeid/example/security/WebEidAjaxLoginProcessingFilterTest.java b/example/src/test/java/eu/webeid/example/security/WebEidAjaxLoginProcessingFilterTest.java index 828399b1..6f6a20fa 100644 --- a/example/src/test/java/eu/webeid/example/security/WebEidAjaxLoginProcessingFilterTest.java +++ b/example/src/test/java/eu/webeid/example/security/WebEidAjaxLoginProcessingFilterTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.security; diff --git a/example/src/test/java/eu/webeid/example/security/WebEidAuthenticationTest.java b/example/src/test/java/eu/webeid/example/security/WebEidAuthenticationTest.java index 1da776b6..1e9d412b 100644 --- a/example/src/test/java/eu/webeid/example/security/WebEidAuthenticationTest.java +++ b/example/src/test/java/eu/webeid/example/security/WebEidAuthenticationTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.security; diff --git a/example/src/test/java/eu/webeid/example/testutil/Dates.java b/example/src/test/java/eu/webeid/example/testutil/Dates.java index 02f7b1f4..a9cb4603 100644 --- a/example/src/test/java/eu/webeid/example/testutil/Dates.java +++ b/example/src/test/java/eu/webeid/example/testutil/Dates.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.testutil; diff --git a/example/src/test/java/eu/webeid/example/testutil/HttpHelper.java b/example/src/test/java/eu/webeid/example/testutil/HttpHelper.java index 9c8b0dc9..bf2bb01e 100644 --- a/example/src/test/java/eu/webeid/example/testutil/HttpHelper.java +++ b/example/src/test/java/eu/webeid/example/testutil/HttpHelper.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.testutil; diff --git a/example/src/test/java/eu/webeid/example/testutil/ObjectMother.java b/example/src/test/java/eu/webeid/example/testutil/ObjectMother.java index 288b1368..3753c20e 100644 --- a/example/src/test/java/eu/webeid/example/testutil/ObjectMother.java +++ b/example/src/test/java/eu/webeid/example/testutil/ObjectMother.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.example.testutil; diff --git a/example/src/test/resources/application-dev.yaml b/example/src/test/resources/application-dev.yaml index 5e607661..910b04b5 100644 --- a/example/src/test/resources/application-dev.yaml +++ b/example/src/test/resources/application-dev.yaml @@ -1,3 +1,6 @@ +# SPDX-FileCopyrightText: Estonian Information System Authority +# SPDX-License-Identifier: MIT + web-eid-auth-token: validation: use-digidoc4j-prod-configuration: false diff --git a/pom.xml b/pom.xml index c1604d8d..8d28c0fd 100644 --- a/pom.xml +++ b/pom.xml @@ -1,4 +1,6 @@ + + diff --git a/src/main/java/eu/webeid/security/authtoken/WebEidAuthToken.java b/src/main/java/eu/webeid/security/authtoken/WebEidAuthToken.java index 77d80bc4..f3139017 100644 --- a/src/main/java/eu/webeid/security/authtoken/WebEidAuthToken.java +++ b/src/main/java/eu/webeid/security/authtoken/WebEidAuthToken.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.authtoken; diff --git a/src/main/java/eu/webeid/security/certificate/CertificateData.java b/src/main/java/eu/webeid/security/certificate/CertificateData.java index f9486831..192716fe 100644 --- a/src/main/java/eu/webeid/security/certificate/CertificateData.java +++ b/src/main/java/eu/webeid/security/certificate/CertificateData.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.certificate; diff --git a/src/main/java/eu/webeid/security/certificate/CertificateLoader.java b/src/main/java/eu/webeid/security/certificate/CertificateLoader.java index 0da0a670..b9a2576f 100644 --- a/src/main/java/eu/webeid/security/certificate/CertificateLoader.java +++ b/src/main/java/eu/webeid/security/certificate/CertificateLoader.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.certificate; diff --git a/src/main/java/eu/webeid/security/certificate/CertificateValidator.java b/src/main/java/eu/webeid/security/certificate/CertificateValidator.java index 8a6701b3..f479128d 100644 --- a/src/main/java/eu/webeid/security/certificate/CertificateValidator.java +++ b/src/main/java/eu/webeid/security/certificate/CertificateValidator.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.certificate; diff --git a/src/main/java/eu/webeid/security/certificate/SubjectCertificatePolicies.java b/src/main/java/eu/webeid/security/certificate/SubjectCertificatePolicies.java index 19ee8d78..11ef5442 100644 --- a/src/main/java/eu/webeid/security/certificate/SubjectCertificatePolicies.java +++ b/src/main/java/eu/webeid/security/certificate/SubjectCertificatePolicies.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.certificate; diff --git a/src/main/java/eu/webeid/security/challenge/ChallengeNonce.java b/src/main/java/eu/webeid/security/challenge/ChallengeNonce.java index 23f33222..bd7158e2 100644 --- a/src/main/java/eu/webeid/security/challenge/ChallengeNonce.java +++ b/src/main/java/eu/webeid/security/challenge/ChallengeNonce.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.challenge; diff --git a/src/main/java/eu/webeid/security/challenge/ChallengeNonceGenerator.java b/src/main/java/eu/webeid/security/challenge/ChallengeNonceGenerator.java index d32d9a86..f23d94a3 100644 --- a/src/main/java/eu/webeid/security/challenge/ChallengeNonceGenerator.java +++ b/src/main/java/eu/webeid/security/challenge/ChallengeNonceGenerator.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.challenge; diff --git a/src/main/java/eu/webeid/security/challenge/ChallengeNonceGeneratorBuilder.java b/src/main/java/eu/webeid/security/challenge/ChallengeNonceGeneratorBuilder.java index 11da37b8..471a9ccb 100644 --- a/src/main/java/eu/webeid/security/challenge/ChallengeNonceGeneratorBuilder.java +++ b/src/main/java/eu/webeid/security/challenge/ChallengeNonceGeneratorBuilder.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.challenge; diff --git a/src/main/java/eu/webeid/security/challenge/ChallengeNonceGeneratorImpl.java b/src/main/java/eu/webeid/security/challenge/ChallengeNonceGeneratorImpl.java index dd80be87..7e9604ae 100644 --- a/src/main/java/eu/webeid/security/challenge/ChallengeNonceGeneratorImpl.java +++ b/src/main/java/eu/webeid/security/challenge/ChallengeNonceGeneratorImpl.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.challenge; diff --git a/src/main/java/eu/webeid/security/challenge/ChallengeNonceStore.java b/src/main/java/eu/webeid/security/challenge/ChallengeNonceStore.java index 2631cf86..fc39105c 100644 --- a/src/main/java/eu/webeid/security/challenge/ChallengeNonceStore.java +++ b/src/main/java/eu/webeid/security/challenge/ChallengeNonceStore.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.challenge; diff --git a/src/main/java/eu/webeid/security/exceptions/AuthTokenException.java b/src/main/java/eu/webeid/security/exceptions/AuthTokenException.java index 1e270cb4..e1fc27a7 100644 --- a/src/main/java/eu/webeid/security/exceptions/AuthTokenException.java +++ b/src/main/java/eu/webeid/security/exceptions/AuthTokenException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/AuthTokenParseException.java b/src/main/java/eu/webeid/security/exceptions/AuthTokenParseException.java index 810824e6..50f0b09f 100644 --- a/src/main/java/eu/webeid/security/exceptions/AuthTokenParseException.java +++ b/src/main/java/eu/webeid/security/exceptions/AuthTokenParseException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/AuthTokenSignatureValidationException.java b/src/main/java/eu/webeid/security/exceptions/AuthTokenSignatureValidationException.java index 192b6fd5..94ec00f3 100644 --- a/src/main/java/eu/webeid/security/exceptions/AuthTokenSignatureValidationException.java +++ b/src/main/java/eu/webeid/security/exceptions/AuthTokenSignatureValidationException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/CertificateDecodingException.java b/src/main/java/eu/webeid/security/exceptions/CertificateDecodingException.java index 71d5dbe4..843c5071 100644 --- a/src/main/java/eu/webeid/security/exceptions/CertificateDecodingException.java +++ b/src/main/java/eu/webeid/security/exceptions/CertificateDecodingException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/CertificateExpiredException.java b/src/main/java/eu/webeid/security/exceptions/CertificateExpiredException.java index ea3de153..28bc0044 100644 --- a/src/main/java/eu/webeid/security/exceptions/CertificateExpiredException.java +++ b/src/main/java/eu/webeid/security/exceptions/CertificateExpiredException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/CertificateNotTrustedException.java b/src/main/java/eu/webeid/security/exceptions/CertificateNotTrustedException.java index 02e44bdb..c28e2c70 100644 --- a/src/main/java/eu/webeid/security/exceptions/CertificateNotTrustedException.java +++ b/src/main/java/eu/webeid/security/exceptions/CertificateNotTrustedException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/CertificateNotYetValidException.java b/src/main/java/eu/webeid/security/exceptions/CertificateNotYetValidException.java index 90b967fd..5f985022 100644 --- a/src/main/java/eu/webeid/security/exceptions/CertificateNotYetValidException.java +++ b/src/main/java/eu/webeid/security/exceptions/CertificateNotYetValidException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/ChallengeNonceExpiredException.java b/src/main/java/eu/webeid/security/exceptions/ChallengeNonceExpiredException.java index ca5e23c6..2a4030e6 100644 --- a/src/main/java/eu/webeid/security/exceptions/ChallengeNonceExpiredException.java +++ b/src/main/java/eu/webeid/security/exceptions/ChallengeNonceExpiredException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/ChallengeNonceNotFoundException.java b/src/main/java/eu/webeid/security/exceptions/ChallengeNonceNotFoundException.java index a2312123..89e372fe 100644 --- a/src/main/java/eu/webeid/security/exceptions/ChallengeNonceNotFoundException.java +++ b/src/main/java/eu/webeid/security/exceptions/ChallengeNonceNotFoundException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/ChallengeNullOrEmptyException.java b/src/main/java/eu/webeid/security/exceptions/ChallengeNullOrEmptyException.java index 08037248..a30570a5 100644 --- a/src/main/java/eu/webeid/security/exceptions/ChallengeNullOrEmptyException.java +++ b/src/main/java/eu/webeid/security/exceptions/ChallengeNullOrEmptyException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/JceException.java b/src/main/java/eu/webeid/security/exceptions/JceException.java index b9da794a..dba63ce9 100644 --- a/src/main/java/eu/webeid/security/exceptions/JceException.java +++ b/src/main/java/eu/webeid/security/exceptions/JceException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/OCSPCertificateException.java b/src/main/java/eu/webeid/security/exceptions/OCSPCertificateException.java index 397cf23f..0e2b7cb2 100644 --- a/src/main/java/eu/webeid/security/exceptions/OCSPCertificateException.java +++ b/src/main/java/eu/webeid/security/exceptions/OCSPCertificateException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, mergCertificateExpiryValidatore, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/UserCertificateDisallowedPolicyException.java b/src/main/java/eu/webeid/security/exceptions/UserCertificateDisallowedPolicyException.java index a25418b8..1a41cedd 100644 --- a/src/main/java/eu/webeid/security/exceptions/UserCertificateDisallowedPolicyException.java +++ b/src/main/java/eu/webeid/security/exceptions/UserCertificateDisallowedPolicyException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/UserCertificateMissingPurposeException.java b/src/main/java/eu/webeid/security/exceptions/UserCertificateMissingPurposeException.java index 4e3887e3..8b3db74f 100644 --- a/src/main/java/eu/webeid/security/exceptions/UserCertificateMissingPurposeException.java +++ b/src/main/java/eu/webeid/security/exceptions/UserCertificateMissingPurposeException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/UserCertificateOCSPCheckFailedException.java b/src/main/java/eu/webeid/security/exceptions/UserCertificateOCSPCheckFailedException.java index 5ca68dc5..b479ced0 100644 --- a/src/main/java/eu/webeid/security/exceptions/UserCertificateOCSPCheckFailedException.java +++ b/src/main/java/eu/webeid/security/exceptions/UserCertificateOCSPCheckFailedException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/UserCertificateParseException.java b/src/main/java/eu/webeid/security/exceptions/UserCertificateParseException.java index 49c43885..08e47b18 100644 --- a/src/main/java/eu/webeid/security/exceptions/UserCertificateParseException.java +++ b/src/main/java/eu/webeid/security/exceptions/UserCertificateParseException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/UserCertificateRevokedException.java b/src/main/java/eu/webeid/security/exceptions/UserCertificateRevokedException.java index 83eb53ab..315fcfa9 100644 --- a/src/main/java/eu/webeid/security/exceptions/UserCertificateRevokedException.java +++ b/src/main/java/eu/webeid/security/exceptions/UserCertificateRevokedException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/exceptions/UserCertificateWrongPurposeException.java b/src/main/java/eu/webeid/security/exceptions/UserCertificateWrongPurposeException.java index 884280b4..797d325b 100644 --- a/src/main/java/eu/webeid/security/exceptions/UserCertificateWrongPurposeException.java +++ b/src/main/java/eu/webeid/security/exceptions/UserCertificateWrongPurposeException.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.exceptions; diff --git a/src/main/java/eu/webeid/security/util/Base64Decoder.java b/src/main/java/eu/webeid/security/util/Base64Decoder.java index 97aa20af..b6135f8f 100644 --- a/src/main/java/eu/webeid/security/util/Base64Decoder.java +++ b/src/main/java/eu/webeid/security/util/Base64Decoder.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.util; diff --git a/src/main/java/eu/webeid/security/util/Collections.java b/src/main/java/eu/webeid/security/util/Collections.java index 585cb6c4..3b94eca4 100644 --- a/src/main/java/eu/webeid/security/util/Collections.java +++ b/src/main/java/eu/webeid/security/util/Collections.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.util; diff --git a/src/main/java/eu/webeid/security/util/DateAndTime.java b/src/main/java/eu/webeid/security/util/DateAndTime.java index 97b33aad..85eac7dd 100644 --- a/src/main/java/eu/webeid/security/util/DateAndTime.java +++ b/src/main/java/eu/webeid/security/util/DateAndTime.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.util; diff --git a/src/main/java/eu/webeid/security/util/Strings.java b/src/main/java/eu/webeid/security/util/Strings.java index 1e37f2e9..a312409e 100644 --- a/src/main/java/eu/webeid/security/util/Strings.java +++ b/src/main/java/eu/webeid/security/util/Strings.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.util; diff --git a/src/main/java/eu/webeid/security/validator/AuthTokenSignatureValidator.java b/src/main/java/eu/webeid/security/validator/AuthTokenSignatureValidator.java index a0e1f616..5e813552 100644 --- a/src/main/java/eu/webeid/security/validator/AuthTokenSignatureValidator.java +++ b/src/main/java/eu/webeid/security/validator/AuthTokenSignatureValidator.java @@ -1,24 +1,6 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT + package eu.webeid.security.validator; import eu.webeid.security.exceptions.AuthTokenException; diff --git a/src/main/java/eu/webeid/security/validator/AuthTokenValidationConfiguration.java b/src/main/java/eu/webeid/security/validator/AuthTokenValidationConfiguration.java index 6b943bd2..596ff3c0 100644 --- a/src/main/java/eu/webeid/security/validator/AuthTokenValidationConfiguration.java +++ b/src/main/java/eu/webeid/security/validator/AuthTokenValidationConfiguration.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator; diff --git a/src/main/java/eu/webeid/security/validator/AuthTokenValidator.java b/src/main/java/eu/webeid/security/validator/AuthTokenValidator.java index 3476ea41..3f54175e 100644 --- a/src/main/java/eu/webeid/security/validator/AuthTokenValidator.java +++ b/src/main/java/eu/webeid/security/validator/AuthTokenValidator.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator; diff --git a/src/main/java/eu/webeid/security/validator/AuthTokenValidatorBuilder.java b/src/main/java/eu/webeid/security/validator/AuthTokenValidatorBuilder.java index 9122ee67..355c89b5 100644 --- a/src/main/java/eu/webeid/security/validator/AuthTokenValidatorBuilder.java +++ b/src/main/java/eu/webeid/security/validator/AuthTokenValidatorBuilder.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator; diff --git a/src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java b/src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java index b26ad653..0d951323 100644 --- a/src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java +++ b/src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator; diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidator.java b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidator.java index c460d405..bd6d55e8 100644 --- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidator.java +++ b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidator.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.certvalidators; diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePolicyValidator.java b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePolicyValidator.java index 8f584c7e..a7521c96 100644 --- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePolicyValidator.java +++ b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePolicyValidator.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.certvalidators; diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePurposeValidator.java b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePurposeValidator.java index 8332f740..ffacf2b0 100644 --- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePurposeValidator.java +++ b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificatePurposeValidator.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.certvalidators; diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateTrustedValidator.java b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateTrustedValidator.java index a706ffc4..1a619d6a 100644 --- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateTrustedValidator.java +++ b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateTrustedValidator.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.certvalidators; diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidator.java b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidator.java index 08eccdf8..e6e5f2e0 100644 --- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidator.java +++ b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidator.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.certvalidators; diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidatorBatch.java b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidatorBatch.java index 264135e0..5e50ecce 100644 --- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidatorBatch.java +++ b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidatorBatch.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.certvalidators; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/DigestCalculatorImpl.java b/src/main/java/eu/webeid/security/validator/ocsp/DigestCalculatorImpl.java index 35f9fcb7..5910442c 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/DigestCalculatorImpl.java +++ b/src/main/java/eu/webeid/security/validator/ocsp/DigestCalculatorImpl.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.ocsp; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspClient.java b/src/main/java/eu/webeid/security/validator/ocsp/OcspClient.java index 7f2e9477..de67a0e9 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/OcspClient.java +++ b/src/main/java/eu/webeid/security/validator/ocsp/OcspClient.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.ocsp; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspClientImpl.java b/src/main/java/eu/webeid/security/validator/ocsp/OcspClientImpl.java index f0a0c50a..c8f407d6 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/OcspClientImpl.java +++ b/src/main/java/eu/webeid/security/validator/ocsp/OcspClientImpl.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.ocsp; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspRequestBuilder.java b/src/main/java/eu/webeid/security/validator/ocsp/OcspRequestBuilder.java index 27ad87f1..b93009be 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/OcspRequestBuilder.java +++ b/src/main/java/eu/webeid/security/validator/ocsp/OcspRequestBuilder.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.ocsp; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspResponseValidator.java b/src/main/java/eu/webeid/security/validator/ocsp/OcspResponseValidator.java index 0dc4fda5..640c1b5b 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/OcspResponseValidator.java +++ b/src/main/java/eu/webeid/security/validator/ocsp/OcspResponseValidator.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.ocsp; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspServiceProvider.java b/src/main/java/eu/webeid/security/validator/ocsp/OcspServiceProvider.java index 5f83c1d9..d7f0464d 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/OcspServiceProvider.java +++ b/src/main/java/eu/webeid/security/validator/ocsp/OcspServiceProvider.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.ocsp; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspUrl.java b/src/main/java/eu/webeid/security/validator/ocsp/OcspUrl.java index 96894080..59bbfb10 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/OcspUrl.java +++ b/src/main/java/eu/webeid/security/validator/ocsp/OcspUrl.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.ocsp; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspService.java b/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspService.java index e04823c3..fcd8c297 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspService.java +++ b/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspService.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.ocsp.service; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspServiceConfiguration.java b/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspServiceConfiguration.java index 8781e3a5..436f0a42 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspServiceConfiguration.java +++ b/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspServiceConfiguration.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.ocsp.service; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspService.java b/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspService.java index bafba269..586adf98 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspService.java +++ b/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspService.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.ocsp.service; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspServiceConfiguration.java b/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspServiceConfiguration.java index 0bc03193..129366ed 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspServiceConfiguration.java +++ b/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspServiceConfiguration.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.ocsp.service; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/service/OcspService.java b/src/main/java/eu/webeid/security/validator/ocsp/service/OcspService.java index 97bbdf2c..2d83a25f 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/service/OcspService.java +++ b/src/main/java/eu/webeid/security/validator/ocsp/service/OcspService.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.ocsp.service; diff --git a/src/test/java/eu/webeid/security/certificate/CertificateDataTest.java b/src/test/java/eu/webeid/security/certificate/CertificateDataTest.java index d71b8e6d..698f980d 100644 --- a/src/test/java/eu/webeid/security/certificate/CertificateDataTest.java +++ b/src/test/java/eu/webeid/security/certificate/CertificateDataTest.java @@ -1,3 +1,6 @@ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT + package eu.webeid.security.certificate; import org.junit.jupiter.api.Test; diff --git a/src/test/java/eu/webeid/security/challenge/ChallengeNonceGeneratorTest.java b/src/test/java/eu/webeid/security/challenge/ChallengeNonceGeneratorTest.java index 5790e0d2..330cc9d4 100644 --- a/src/test/java/eu/webeid/security/challenge/ChallengeNonceGeneratorTest.java +++ b/src/test/java/eu/webeid/security/challenge/ChallengeNonceGeneratorTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.challenge; diff --git a/src/test/java/eu/webeid/security/challenge/InMemoryChallengeNonceStore.java b/src/test/java/eu/webeid/security/challenge/InMemoryChallengeNonceStore.java index c6c2d1d3..ac5c2773 100644 --- a/src/test/java/eu/webeid/security/challenge/InMemoryChallengeNonceStore.java +++ b/src/test/java/eu/webeid/security/challenge/InMemoryChallengeNonceStore.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.challenge; diff --git a/src/test/java/eu/webeid/security/testutil/AbstractTestWithValidator.java b/src/test/java/eu/webeid/security/testutil/AbstractTestWithValidator.java index fd8896c3..5724d74e 100644 --- a/src/test/java/eu/webeid/security/testutil/AbstractTestWithValidator.java +++ b/src/test/java/eu/webeid/security/testutil/AbstractTestWithValidator.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.testutil; diff --git a/src/test/java/eu/webeid/security/testutil/AuthTokenValidators.java b/src/test/java/eu/webeid/security/testutil/AuthTokenValidators.java index ec977e71..51e8fabd 100644 --- a/src/test/java/eu/webeid/security/testutil/AuthTokenValidators.java +++ b/src/test/java/eu/webeid/security/testutil/AuthTokenValidators.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.testutil; diff --git a/src/test/java/eu/webeid/security/testutil/Certificates.java b/src/test/java/eu/webeid/security/testutil/Certificates.java index 215773b6..ec3dd235 100644 --- a/src/test/java/eu/webeid/security/testutil/Certificates.java +++ b/src/test/java/eu/webeid/security/testutil/Certificates.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.testutil; diff --git a/src/test/java/eu/webeid/security/testutil/DateMocker.java b/src/test/java/eu/webeid/security/testutil/DateMocker.java index ec49a049..23b38bd2 100644 --- a/src/test/java/eu/webeid/security/testutil/DateMocker.java +++ b/src/test/java/eu/webeid/security/testutil/DateMocker.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.testutil; diff --git a/src/test/java/eu/webeid/security/testutil/OcspServiceMaker.java b/src/test/java/eu/webeid/security/testutil/OcspServiceMaker.java index 8f559c4b..c8cf1120 100644 --- a/src/test/java/eu/webeid/security/testutil/OcspServiceMaker.java +++ b/src/test/java/eu/webeid/security/testutil/OcspServiceMaker.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.testutil; diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenAlgorithmTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenAlgorithmTest.java index a29f05fc..280fd898 100644 --- a/src/test/java/eu/webeid/security/validator/AuthTokenAlgorithmTest.java +++ b/src/test/java/eu/webeid/security/validator/AuthTokenAlgorithmTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator; diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenCertificateBelgianIdCardTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenCertificateBelgianIdCardTest.java index c354b47d..0230be19 100644 --- a/src/test/java/eu/webeid/security/validator/AuthTokenCertificateBelgianIdCardTest.java +++ b/src/test/java/eu/webeid/security/validator/AuthTokenCertificateBelgianIdCardTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator; diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenCertificateFinnishIdCardTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenCertificateFinnishIdCardTest.java index c4fe11d2..482f8173 100644 --- a/src/test/java/eu/webeid/security/validator/AuthTokenCertificateFinnishIdCardTest.java +++ b/src/test/java/eu/webeid/security/validator/AuthTokenCertificateFinnishIdCardTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator; diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenCertificateTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenCertificateTest.java index 14ed0666..a13d0e3d 100644 --- a/src/test/java/eu/webeid/security/validator/AuthTokenCertificateTest.java +++ b/src/test/java/eu/webeid/security/validator/AuthTokenCertificateTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator; diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenSignatureTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenSignatureTest.java index 3a43a3e3..50b9010c 100644 --- a/src/test/java/eu/webeid/security/validator/AuthTokenSignatureTest.java +++ b/src/test/java/eu/webeid/security/validator/AuthTokenSignatureTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator; diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenSignatureValidatorTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenSignatureValidatorTest.java index fc7edd0c..773b096e 100644 --- a/src/test/java/eu/webeid/security/validator/AuthTokenSignatureValidatorTest.java +++ b/src/test/java/eu/webeid/security/validator/AuthTokenSignatureValidatorTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator; diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenStructureTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenStructureTest.java index be79c0cb..cde0218f 100644 --- a/src/test/java/eu/webeid/security/validator/AuthTokenStructureTest.java +++ b/src/test/java/eu/webeid/security/validator/AuthTokenStructureTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator; diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenValidatorBuilderTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenValidatorBuilderTest.java index 8e58466f..fcf88f79 100644 --- a/src/test/java/eu/webeid/security/validator/AuthTokenValidatorBuilderTest.java +++ b/src/test/java/eu/webeid/security/validator/AuthTokenValidatorBuilderTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator; diff --git a/src/test/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidatorTest.java b/src/test/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidatorTest.java index 771c3018..bd85e373 100644 --- a/src/test/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidatorTest.java +++ b/src/test/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidatorTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.certvalidators; diff --git a/src/test/java/eu/webeid/security/validator/ocsp/OcspClientOverrideTest.java b/src/test/java/eu/webeid/security/validator/ocsp/OcspClientOverrideTest.java index c1a66c4e..40a1ccde 100644 --- a/src/test/java/eu/webeid/security/validator/ocsp/OcspClientOverrideTest.java +++ b/src/test/java/eu/webeid/security/validator/ocsp/OcspClientOverrideTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.ocsp; diff --git a/src/test/java/eu/webeid/security/validator/ocsp/OcspResponseValidatorTest.java b/src/test/java/eu/webeid/security/validator/ocsp/OcspResponseValidatorTest.java index a8e80ddf..db66ada5 100644 --- a/src/test/java/eu/webeid/security/validator/ocsp/OcspResponseValidatorTest.java +++ b/src/test/java/eu/webeid/security/validator/ocsp/OcspResponseValidatorTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.ocsp; diff --git a/src/test/java/eu/webeid/security/validator/ocsp/OcspServiceProviderTest.java b/src/test/java/eu/webeid/security/validator/ocsp/OcspServiceProviderTest.java index 00337fd9..46c75897 100644 --- a/src/test/java/eu/webeid/security/validator/ocsp/OcspServiceProviderTest.java +++ b/src/test/java/eu/webeid/security/validator/ocsp/OcspServiceProviderTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.ocsp; diff --git a/src/test/java/eu/webeid/security/validator/ocsp/OcspUrlTest.java b/src/test/java/eu/webeid/security/validator/ocsp/OcspUrlTest.java index 95b5759e..0ceca574 100644 --- a/src/test/java/eu/webeid/security/validator/ocsp/OcspUrlTest.java +++ b/src/test/java/eu/webeid/security/validator/ocsp/OcspUrlTest.java @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2020-2025 Estonian Information System Authority - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in all - * copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT package eu.webeid.security.validator.ocsp; From 7b8f2a00fdd62848a18cc9e5568ec30dfe694866 Mon Sep 17 00:00:00 2001 From: Mart Somermaa Date: Fri, 12 Dec 2025 17:37:47 +0200 Subject: [PATCH 25/25] Use plaform OCSP implementation by default, move custom OCSP implementation to eu.webeid.ocsp and make it optional WE2-1030 Signed-off-by: Mart Somermaa Co-authored-by: Sven Mitt --- .github/workflows/coverity-analysis.yml | 2 +- .github/workflows/maven-build.yml | 2 +- .github/workflows/maven-deploy.yml | 2 +- pom.xml | 4 +- .../OcspCertificateRevocationChecker.java} | 125 ++++---- .../ocsp => ocsp/client}/OcspClient.java | 2 +- .../ocsp => ocsp/client}/OcspClientImpl.java | 10 +- .../exceptions/OCSPCertificateException.java | 4 +- .../OcspResponderUriMessageAppender.java | 23 ++ ...erCertificateOCSPCheckFailedException.java | 29 ++ .../UserCertificateRevokedException.java | 43 +++ .../protocol}/DigestCalculatorImpl.java | 2 +- .../protocol}/OcspRequestBuilder.java | 2 +- .../protocol}/OcspResponseValidator.java | 39 +-- .../ocsp => ocsp/protocol}/OcspUrl.java | 2 +- .../ocsp/service/AiaOcspService.java | 23 +- .../service/AiaOcspServiceConfiguration.java | 2 +- .../ocsp/service/DesignatedOcspService.java | 8 +- .../DesignatedOcspServiceConfiguration.java | 9 +- .../ocsp/service/OcspService.java | 2 +- .../service}/OcspServiceProvider.java | 7 +- .../security/authtoken/WebEidAuthToken.java | 45 +-- .../certificate/CertificateValidator.java | 173 +++++++++++- ...erCertificateOCSPCheckFailedException.java | 17 -- .../UserCertificateRevokedException.java | 17 -- .../eu/webeid/security/util/Collections.java | 29 -- .../eu/webeid/security/util/DateAndTime.java | 3 +- .../AuthTokenSignatureValidator.java | 12 +- .../AuthTokenValidationConfiguration.java | 128 +++++---- .../validator/AuthTokenValidator.java | 2 +- .../validator/AuthTokenValidatorBuilder.java | 121 ++------ .../validator/AuthTokenValidatorImpl.java | 94 +++--- .../security/validator/ValidationInfo.java | 15 + .../SubjectCertificateTrustedValidator.java | 59 ---- .../SubjectCertificateValidator.java | 18 -- .../SubjectCertificateValidatorBatch.java | 39 --- .../CertificateRevocationChecker.java | 15 + .../revocationcheck/RevocationInfo.java | 13 + .../revocationcheck/RevocationMode.java | 5 + ...OcspCertificateRevocationCheckerTest.java} | 164 ++++++----- .../client}/OcspClientOverrideTest.java | 30 +- .../protocol}/OcspResponseValidatorTest.java | 27 +- .../ocsp => ocsp/protocol}/OcspUrlTest.java | 4 +- .../service}/OcspServiceMaker.java | 14 +- .../service}/OcspServiceProviderTest.java | 32 ++- .../certificate/CertificateValidatorTest.java | 267 ++++++++++++++++++ .../testutil/AuthTokenValidators.java | 24 +- .../validator/AuthTokenCertificateTest.java | 13 +- .../validator/AuthTokenSignatureTest.java | 2 +- .../AuthTokenSignatureValidatorTest.java | 8 +- .../AuthTokenValidationConfigurationTest.java | 80 ++++++ .../AuthTokenValidationInfoTest.java | 77 +++++ .../AuthTokenValidatorBuilderTest.java | 45 +-- 53 files changed, 1219 insertions(+), 715 deletions(-) rename src/main/java/eu/webeid/{security/validator/certvalidators/SubjectCertificateNotRevokedValidator.java => ocsp/OcspCertificateRevocationChecker.java} (63%) rename src/main/java/eu/webeid/{security/validator/ocsp => ocsp/client}/OcspClient.java (88%) rename src/main/java/eu/webeid/{security/validator/ocsp => ocsp/client}/OcspClientImpl.java (87%) rename src/main/java/eu/webeid/{security => ocsp}/exceptions/OCSPCertificateException.java (79%) create mode 100644 src/main/java/eu/webeid/ocsp/exceptions/OcspResponderUriMessageAppender.java create mode 100644 src/main/java/eu/webeid/ocsp/exceptions/UserCertificateOCSPCheckFailedException.java create mode 100644 src/main/java/eu/webeid/ocsp/exceptions/UserCertificateRevokedException.java rename src/main/java/eu/webeid/{security/validator/ocsp => ocsp/protocol}/DigestCalculatorImpl.java (97%) rename src/main/java/eu/webeid/{security/validator/ocsp => ocsp/protocol}/OcspRequestBuilder.java (98%) rename src/main/java/eu/webeid/{security/validator/ocsp => ocsp/protocol}/OcspResponseValidator.java (81%) rename src/main/java/eu/webeid/{security/validator/ocsp => ocsp/protocol}/OcspUrl.java (97%) rename src/main/java/eu/webeid/{security/validator => }/ocsp/service/AiaOcspService.java (76%) rename src/main/java/eu/webeid/{security/validator => }/ocsp/service/AiaOcspServiceConfiguration.java (96%) rename src/main/java/eu/webeid/{security/validator => }/ocsp/service/DesignatedOcspService.java (90%) rename src/main/java/eu/webeid/{security/validator => }/ocsp/service/DesignatedOcspServiceConfiguration.java (92%) rename src/main/java/eu/webeid/{security/validator => }/ocsp/service/OcspService.java (89%) rename src/main/java/eu/webeid/{security/validator/ocsp => ocsp/service}/OcspServiceProvider.java (81%) delete mode 100644 src/main/java/eu/webeid/security/exceptions/UserCertificateOCSPCheckFailedException.java delete mode 100644 src/main/java/eu/webeid/security/exceptions/UserCertificateRevokedException.java delete mode 100644 src/main/java/eu/webeid/security/util/Collections.java create mode 100644 src/main/java/eu/webeid/security/validator/ValidationInfo.java delete mode 100644 src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateTrustedValidator.java delete mode 100644 src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidator.java delete mode 100644 src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidatorBatch.java create mode 100644 src/main/java/eu/webeid/security/validator/revocationcheck/CertificateRevocationChecker.java create mode 100644 src/main/java/eu/webeid/security/validator/revocationcheck/RevocationInfo.java create mode 100644 src/main/java/eu/webeid/security/validator/revocationcheck/RevocationMode.java rename src/test/java/eu/webeid/{security/validator/certvalidators/SubjectCertificateNotRevokedValidatorTest.java => ocsp/OcspCertificateRevocationCheckerTest.java} (68%) rename src/test/java/eu/webeid/{security/validator/ocsp => ocsp/client}/OcspClientOverrideTest.java (63%) rename src/test/java/eu/webeid/{security/validator/ocsp => ocsp/protocol}/OcspResponseValidatorTest.java (84%) rename src/test/java/eu/webeid/{security/validator/ocsp => ocsp/protocol}/OcspUrlTest.java (93%) rename src/test/java/eu/webeid/{security/testutil => ocsp/service}/OcspServiceMaker.java (86%) rename src/test/java/eu/webeid/{security/validator/ocsp => ocsp/service}/OcspServiceProviderTest.java (66%) create mode 100644 src/test/java/eu/webeid/security/certificate/CertificateValidatorTest.java create mode 100644 src/test/java/eu/webeid/security/validator/AuthTokenValidationConfigurationTest.java create mode 100644 src/test/java/eu/webeid/security/validator/AuthTokenValidationInfoTest.java diff --git a/.github/workflows/coverity-analysis.yml b/.github/workflows/coverity-analysis.yml index 2e8e2285..9f3758c1 100644 --- a/.github/workflows/coverity-analysis.yml +++ b/.github/workflows/coverity-analysis.yml @@ -23,7 +23,7 @@ jobs: - uses: actions/setup-java@v4 with: distribution: zulu - java-version: 11 + java-version: 17 - name: Cache Maven packages uses: actions/cache@v4 diff --git a/.github/workflows/maven-build.yml b/.github/workflows/maven-build.yml index 850ad585..a89b2777 100644 --- a/.github/workflows/maven-build.yml +++ b/.github/workflows/maven-build.yml @@ -23,7 +23,7 @@ jobs: - uses: actions/setup-java@v4 with: distribution: zulu - java-version: 11 + java-version: 17 - name: Cache Maven packages uses: actions/cache@v4 diff --git a/.github/workflows/maven-deploy.yml b/.github/workflows/maven-deploy.yml index d2c3af53..573938af 100644 --- a/.github/workflows/maven-deploy.yml +++ b/.github/workflows/maven-deploy.yml @@ -17,7 +17,7 @@ jobs: - uses: actions/setup-java@v4 with: distribution: zulu - java-version: 11 + java-version: 17 - name: Cache Maven packages uses: actions/cache@v4 diff --git a/pom.xml b/pom.xml index 8d28c0fd..01f01fe6 100644 --- a/pom.xml +++ b/pom.xml @@ -7,13 +7,13 @@ 4.0.0 authtoken-validation eu.webeid.security - 3.2.1 + 4.0.0-SNAPSHOT jar authtoken-validation Web eID authentication token validation library for Java - 11 + 17 0.13.0 1.84 2.22.1 diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidator.java b/src/main/java/eu/webeid/ocsp/OcspCertificateRevocationChecker.java similarity index 63% rename from src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidator.java rename to src/main/java/eu/webeid/ocsp/OcspCertificateRevocationChecker.java index bd6d55e8..74e3d6e0 100644 --- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidator.java +++ b/src/main/java/eu/webeid/ocsp/OcspCertificateRevocationChecker.java @@ -1,17 +1,19 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.certvalidators; +package eu.webeid.ocsp; +import eu.webeid.ocsp.client.OcspClient; +import eu.webeid.ocsp.protocol.DigestCalculatorImpl; +import eu.webeid.ocsp.protocol.OcspRequestBuilder; +import eu.webeid.ocsp.protocol.OcspResponseValidator; import eu.webeid.security.exceptions.AuthTokenException; -import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException; +import eu.webeid.ocsp.exceptions.UserCertificateOCSPCheckFailedException; import eu.webeid.security.util.DateAndTime; -import eu.webeid.security.validator.ocsp.DigestCalculatorImpl; -import eu.webeid.security.validator.ocsp.OcspClient; -import eu.webeid.security.validator.ocsp.OcspRequestBuilder; -import eu.webeid.security.validator.ocsp.OcspResponseValidator; -import eu.webeid.security.validator.ocsp.OcspServiceProvider; -import eu.webeid.security.validator.ocsp.service.OcspService; +import eu.webeid.ocsp.service.OcspServiceProvider; +import eu.webeid.ocsp.service.OcspService; +import eu.webeid.security.validator.revocationcheck.CertificateRevocationChecker; +import eu.webeid.security.validator.revocationcheck.RevocationInfo; import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers; import org.bouncycastle.asn1.ocsp.OCSPResponseStatus; import org.bouncycastle.asn1.x509.Extension; @@ -30,52 +32,64 @@ import java.io.IOException; import java.math.BigInteger; +import java.net.URI; import java.security.Security; import java.security.cert.CertificateEncodingException; import java.security.cert.CertificateException; import java.security.cert.X509Certificate; import java.time.Duration; import java.util.Date; -import java.util.Objects; +import java.util.List; +import java.util.Map; -public final class SubjectCertificateNotRevokedValidator { +import static eu.webeid.security.util.DateAndTime.requirePositiveDuration; +import static java.util.Objects.requireNonNull; - private static final Logger LOG = LoggerFactory.getLogger(SubjectCertificateNotRevokedValidator.class); +public final class OcspCertificateRevocationChecker implements CertificateRevocationChecker { + + public static final Duration DEFAULT_TIME_SKEW = Duration.ofMinutes(15); + public static final Duration DEFAULT_THIS_UPDATE_AGE = Duration.ofMinutes(2); + + private static final Logger LOG = LoggerFactory.getLogger(OcspCertificateRevocationChecker.class); - private final SubjectCertificateTrustedValidator trustValidator; private final OcspClient ocspClient; private final OcspServiceProvider ocspServiceProvider; private final Duration allowedOcspResponseTimeSkew; private final Duration maxOcspResponseThisUpdateAge; static { - Security.addProvider(new BouncyCastleProvider()); + if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) { + Security.addProvider(new BouncyCastleProvider()); + } } - public SubjectCertificateNotRevokedValidator(SubjectCertificateTrustedValidator trustValidator, - OcspClient ocspClient, - OcspServiceProvider ocspServiceProvider, - Duration allowedOcspResponseTimeSkew, - Duration maxOcspResponseThisUpdateAge) { - this.trustValidator = trustValidator; - this.ocspClient = ocspClient; - this.ocspServiceProvider = ocspServiceProvider; - this.allowedOcspResponseTimeSkew = allowedOcspResponseTimeSkew; - this.maxOcspResponseThisUpdateAge = maxOcspResponseThisUpdateAge; + public OcspCertificateRevocationChecker(OcspClient ocspClient, + OcspServiceProvider ocspServiceProvider, + Duration allowedOcspResponseTimeSkew, + Duration maxOcspResponseThisUpdateAge) { + this.ocspClient = requireNonNull(ocspClient, "ocspClient"); + this.ocspServiceProvider = requireNonNull(ocspServiceProvider, "ocspServiceProvider"); + this.allowedOcspResponseTimeSkew = requirePositiveDuration(allowedOcspResponseTimeSkew, "allowedOcspResponseTimeSkew"); + this.maxOcspResponseThisUpdateAge = requirePositiveDuration(maxOcspResponseThisUpdateAge, "maxOcspResponseThisUpdateAge"); } /** - * Validates that the user certificate from the authentication token is not revoked with OCSP. + * Validates with OCSP that the user certificate from the authentication token is not revoked. * * @param subjectCertificate user certificate to be validated * @throws AuthTokenException when user certificate is revoked or revocation check fails. */ - public void validateCertificateNotRevoked(X509Certificate subjectCertificate) throws AuthTokenException { + @Override + public List validateCertificateNotRevoked(X509Certificate subjectCertificate, X509Certificate issuerCertificate) throws AuthTokenException { + requireNonNull(subjectCertificate, "subjectCertificate"); + requireNonNull(issuerCertificate, "issuerCertificate"); + + URI ocspResponderUri = null; try { OcspService ocspService = ocspServiceProvider.getService(subjectCertificate); + ocspResponderUri = requireNonNull(ocspService.getAccessLocation(), "ocspResponderUri"); - final CertificateID certificateId = getCertificateId(subjectCertificate, - Objects.requireNonNull(trustValidator.getSubjectCertificateIssuerCertificate())); + final CertificateID certificateId = getCertificateId(subjectCertificate, issuerCertificate); final OCSPReq request = new OcspRequestBuilder() .withCertificateId(certificateId) @@ -87,21 +101,27 @@ public void validateCertificateNotRevoked(X509Certificate subjectCertificate) th } LOG.debug("Sending OCSP request"); - final OCSPResp response = Objects.requireNonNull(ocspClient.request(ocspService.getAccessLocation(), request)); + final OCSPResp response = requireNonNull(ocspClient.request(ocspResponderUri, request), "OCSPResp"); if (response.getStatus() != OCSPResponseStatus.SUCCESSFUL) { - throw new UserCertificateOCSPCheckFailedException("Response status: " + ocspStatusToString(response.getStatus())); + throw new UserCertificateOCSPCheckFailedException("Response status: " + ocspStatusToString(response.getStatus()), ocspResponderUri); } final BasicOCSPResp basicResponse = (BasicOCSPResp) response.getResponseObject(); if (basicResponse == null) { - throw new UserCertificateOCSPCheckFailedException("Missing Basic OCSP Response"); + throw new UserCertificateOCSPCheckFailedException("Missing Basic OCSP Response", ocspResponderUri); } + LOG.debug("OCSP response received successfully"); + verifyOcspResponse(basicResponse, ocspService, certificateId); if (ocspService.doesSupportNonce()) { - checkNonce(request, basicResponse); + checkNonce(request, basicResponse, ocspResponderUri); } + LOG.debug("OCSP response verified successfully"); + + return List.of(new RevocationInfo(ocspResponderUri, Map.of(RevocationInfo.KEY_OCSP_RESPONSE, response))); + } catch (OCSPException | CertificateException | OperatorCreationException | IOException e) { - throw new UserCertificateOCSPCheckFailedException(e); + throw new UserCertificateOCSPCheckFailedException(e, ocspResponderUri); } } @@ -118,11 +138,12 @@ private void verifyOcspResponse(BasicOCSPResp basicResponse, OcspService ocspSer // As we sent the request for only a single certificate, we expect only a single response. if (basicResponse.getResponses().length != 1) { throw new UserCertificateOCSPCheckFailedException("OCSP response must contain one response, " - + "received " + basicResponse.getResponses().length + " responses instead"); + + "received " + basicResponse.getResponses().length + " responses instead", ocspService.getAccessLocation()); } final SingleResp certStatusResponse = basicResponse.getResponses()[0]; if (!requestCertificateId.equals(certStatusResponse.getCertID())) { - throw new UserCertificateOCSPCheckFailedException("OCSP responded with certificate ID that differs from the requested ID"); + throw new UserCertificateOCSPCheckFailedException("OCSP responded with certificate ID that differs from the requested ID", + ocspService.getAccessLocation()); } // 2. The signature on the response is valid. @@ -132,11 +153,11 @@ private void verifyOcspResponse(BasicOCSPResp basicResponse, OcspService ocspSer // is standard practice. if (basicResponse.getCerts().length < 1) { throw new UserCertificateOCSPCheckFailedException("OCSP response must contain the responder certificate, " - + "but none was provided"); + + "but none was provided", ocspService.getAccessLocation()); } // The first certificate is the responder certificate, other certificates, if given, are the certificate's chain. final X509CertificateHolder responderCert = basicResponse.getCerts()[0]; - OcspResponseValidator.validateResponseSignature(basicResponse, responderCert); + OcspResponseValidator.validateResponseSignature(basicResponse, responderCert, ocspService.getAccessLocation()); // 3. The identity of the signer matches the intended recipient of the // request. @@ -155,23 +176,23 @@ private void verifyOcspResponse(BasicOCSPResp basicResponse, OcspService ocspSer // be available about the status of the certificate (nextUpdate) is // greater than the current time. - OcspResponseValidator.validateCertificateStatusUpdateTime(certStatusResponse, allowedOcspResponseTimeSkew, maxOcspResponseThisUpdateAge); + OcspResponseValidator.validateCertificateStatusUpdateTime(certStatusResponse, allowedOcspResponseTimeSkew, maxOcspResponseThisUpdateAge, ocspService.getAccessLocation()); // Now we can accept the signed response as valid and validate the certificate status. - OcspResponseValidator.validateSubjectCertificateStatus(certStatusResponse); + OcspResponseValidator.validateSubjectCertificateStatus(certStatusResponse, ocspService.getAccessLocation()); LOG.debug("OCSP check result is GOOD"); } - private static void checkNonce(OCSPReq request, BasicOCSPResp response) throws UserCertificateOCSPCheckFailedException { + private static void checkNonce(OCSPReq request, BasicOCSPResp response, URI ocspResponderUri) throws UserCertificateOCSPCheckFailedException { final Extension requestNonce = request.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce); final Extension responseNonce = response.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce); if (requestNonce == null || responseNonce == null) { throw new UserCertificateOCSPCheckFailedException("OCSP request or response nonce extension missing, " + - "possible replay attack"); + "possible replay attack", ocspResponderUri); } if (!requestNonce.equals(responseNonce)) { throw new UserCertificateOCSPCheckFailedException("OCSP request and response nonces differ, " + - "possible replay attack"); + "possible replay attack", ocspResponderUri); } } @@ -183,20 +204,14 @@ private static CertificateID getCertificateId(X509Certificate subjectCertificate } private static String ocspStatusToString(int status) { - switch (status) { - case OCSPResp.MALFORMED_REQUEST: - return "malformed request"; - case OCSPResp.INTERNAL_ERROR: - return "internal error"; - case OCSPResp.TRY_LATER: - return "service unavailable"; - case OCSPResp.SIG_REQUIRED: - return "request signature missing"; - case OCSPResp.UNAUTHORIZED: - return "unauthorized"; - default: - return "unknown"; - } + return switch (status) { + case OCSPResp.MALFORMED_REQUEST -> "malformed request"; + case OCSPResp.INTERNAL_ERROR -> "internal error"; + case OCSPResp.TRY_LATER -> "service unavailable"; + case OCSPResp.SIG_REQUIRED -> "request signature missing"; + case OCSPResp.UNAUTHORIZED -> "unauthorized"; + default -> "unknown"; + }; } } diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspClient.java b/src/main/java/eu/webeid/ocsp/client/OcspClient.java similarity index 88% rename from src/main/java/eu/webeid/security/validator/ocsp/OcspClient.java rename to src/main/java/eu/webeid/ocsp/client/OcspClient.java index de67a0e9..61c2c5bf 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/OcspClient.java +++ b/src/main/java/eu/webeid/ocsp/client/OcspClient.java @@ -1,7 +1,7 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.ocsp; +package eu.webeid.ocsp.client; import org.bouncycastle.cert.ocsp.OCSPReq; import org.bouncycastle.cert.ocsp.OCSPResp; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspClientImpl.java b/src/main/java/eu/webeid/ocsp/client/OcspClientImpl.java similarity index 87% rename from src/main/java/eu/webeid/security/validator/ocsp/OcspClientImpl.java rename to src/main/java/eu/webeid/ocsp/client/OcspClientImpl.java index c8f407d6..4f842446 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/OcspClientImpl.java +++ b/src/main/java/eu/webeid/ocsp/client/OcspClientImpl.java @@ -1,7 +1,7 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.ocsp; +package eu.webeid.ocsp.client; import org.bouncycastle.cert.ocsp.OCSPReq; import org.bouncycastle.cert.ocsp.OCSPResp; @@ -15,6 +15,9 @@ import java.net.http.HttpResponse; import java.time.Duration; +import static eu.webeid.security.util.DateAndTime.requirePositiveDuration; +import static java.util.Objects.requireNonNull; + public class OcspClientImpl implements OcspClient { private static final Logger LOG = LoggerFactory.getLogger(OcspClientImpl.class); @@ -26,6 +29,7 @@ public class OcspClientImpl implements OcspClient { private final Duration ocspRequestTimeout; public static OcspClient build(Duration ocspRequestTimeout) { + requirePositiveDuration(ocspRequestTimeout, "ocspRequestTimeout"); return new OcspClientImpl( HttpClient.newBuilder() .connectTimeout(ocspRequestTimeout) @@ -72,8 +76,8 @@ public OCSPResp request(URI uri, OCSPReq ocspReq) throws IOException { } public OcspClientImpl(HttpClient httpClient, Duration ocspRequestTimeout) { - this.httpClient = httpClient; - this.ocspRequestTimeout = ocspRequestTimeout; + this.httpClient = requireNonNull(httpClient, "httpClient"); + this.ocspRequestTimeout = requirePositiveDuration(ocspRequestTimeout, "ocspRequestTimeout"); } } diff --git a/src/main/java/eu/webeid/security/exceptions/OCSPCertificateException.java b/src/main/java/eu/webeid/ocsp/exceptions/OCSPCertificateException.java similarity index 79% rename from src/main/java/eu/webeid/security/exceptions/OCSPCertificateException.java rename to src/main/java/eu/webeid/ocsp/exceptions/OCSPCertificateException.java index 0e2b7cb2..e07a40ce 100644 --- a/src/main/java/eu/webeid/security/exceptions/OCSPCertificateException.java +++ b/src/main/java/eu/webeid/ocsp/exceptions/OCSPCertificateException.java @@ -1,7 +1,9 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.exceptions; +package eu.webeid.ocsp.exceptions; + +import eu.webeid.security.exceptions.AuthTokenException; public class OCSPCertificateException extends AuthTokenException { diff --git a/src/main/java/eu/webeid/ocsp/exceptions/OcspResponderUriMessageAppender.java b/src/main/java/eu/webeid/ocsp/exceptions/OcspResponderUriMessageAppender.java new file mode 100644 index 00000000..8aac31af --- /dev/null +++ b/src/main/java/eu/webeid/ocsp/exceptions/OcspResponderUriMessageAppender.java @@ -0,0 +1,23 @@ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT + +package eu.webeid.ocsp.exceptions; + +import java.net.URI; + +/** + * Helper class for adding OCSP responder URL to messages. + */ +final class OcspResponderUriMessageAppender { + + static String appendResponderUri(String message, URI ocspResponderUri) { + if (ocspResponderUri == null) { + return message; + } + return message + " (OCSP responder: " + ocspResponderUri + ")"; + } + + private OcspResponderUriMessageAppender() { + throw new IllegalStateException("Utility class"); + } +} diff --git a/src/main/java/eu/webeid/ocsp/exceptions/UserCertificateOCSPCheckFailedException.java b/src/main/java/eu/webeid/ocsp/exceptions/UserCertificateOCSPCheckFailedException.java new file mode 100644 index 00000000..48e55873 --- /dev/null +++ b/src/main/java/eu/webeid/ocsp/exceptions/UserCertificateOCSPCheckFailedException.java @@ -0,0 +1,29 @@ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT + +package eu.webeid.ocsp.exceptions; + +import eu.webeid.security.exceptions.AuthTokenException; + +import java.net.URI; + +import static eu.webeid.ocsp.exceptions.OcspResponderUriMessageAppender.appendResponderUri; + +/** + * Thrown when user certificate revocation check with OCSP fails. + */ +public class UserCertificateOCSPCheckFailedException extends AuthTokenException { + + public UserCertificateOCSPCheckFailedException(Throwable cause, URI ocspResponderUri) { + super(appendResponderUri("User certificate revocation check has failed", ocspResponderUri), cause); + } + + public UserCertificateOCSPCheckFailedException(String message, URI ocspResponderUri) { + super(appendResponderUri("User certificate revocation check has failed: " + message, ocspResponderUri)); + } + + public UserCertificateOCSPCheckFailedException(String message) { + super(message); + } + +} diff --git a/src/main/java/eu/webeid/ocsp/exceptions/UserCertificateRevokedException.java b/src/main/java/eu/webeid/ocsp/exceptions/UserCertificateRevokedException.java new file mode 100644 index 00000000..203f1359 --- /dev/null +++ b/src/main/java/eu/webeid/ocsp/exceptions/UserCertificateRevokedException.java @@ -0,0 +1,43 @@ +/* + * Copyright (c) 2020-2025 Estonian Information System Authority + * + * Permission is hereby granted, free of charge, to any person obtaining a copy + * of this software and associated documentation files (the "Software"), to deal + * in the Software without restriction, including without limitation the rights + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + * copies of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be included in all + * copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + * SOFTWARE. + */ + +package eu.webeid.ocsp.exceptions; + +import eu.webeid.security.exceptions.AuthTokenException; + +import java.net.URI; + +import static eu.webeid.ocsp.exceptions.OcspResponderUriMessageAppender.appendResponderUri; + +/** + * Thrown when the user certificate has been revoked. + */ +public class UserCertificateRevokedException extends AuthTokenException { + + public UserCertificateRevokedException(URI ocspResponderUri) { + super(appendResponderUri("User certificate has been revoked", ocspResponderUri)); + } + + public UserCertificateRevokedException(String msg, URI ocspResponderUri) { + super(appendResponderUri("User certificate has been revoked: " + msg, ocspResponderUri)); + } +} diff --git a/src/main/java/eu/webeid/security/validator/ocsp/DigestCalculatorImpl.java b/src/main/java/eu/webeid/ocsp/protocol/DigestCalculatorImpl.java similarity index 97% rename from src/main/java/eu/webeid/security/validator/ocsp/DigestCalculatorImpl.java rename to src/main/java/eu/webeid/ocsp/protocol/DigestCalculatorImpl.java index 5910442c..a577d215 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/DigestCalculatorImpl.java +++ b/src/main/java/eu/webeid/ocsp/protocol/DigestCalculatorImpl.java @@ -1,7 +1,7 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.ocsp; +package eu.webeid.ocsp.protocol; import org.bouncycastle.asn1.nist.NISTObjectIdentifiers; import org.bouncycastle.asn1.oiw.OIWObjectIdentifiers; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspRequestBuilder.java b/src/main/java/eu/webeid/ocsp/protocol/OcspRequestBuilder.java similarity index 98% rename from src/main/java/eu/webeid/security/validator/ocsp/OcspRequestBuilder.java rename to src/main/java/eu/webeid/ocsp/protocol/OcspRequestBuilder.java index b93009be..736d4a91 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/OcspRequestBuilder.java +++ b/src/main/java/eu/webeid/ocsp/protocol/OcspRequestBuilder.java @@ -1,7 +1,7 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.ocsp; +package eu.webeid.ocsp.protocol; import org.bouncycastle.asn1.DEROctetString; import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspResponseValidator.java b/src/main/java/eu/webeid/ocsp/protocol/OcspResponseValidator.java similarity index 81% rename from src/main/java/eu/webeid/security/validator/ocsp/OcspResponseValidator.java rename to src/main/java/eu/webeid/ocsp/protocol/OcspResponseValidator.java index 640c1b5b..ed09d801 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/OcspResponseValidator.java +++ b/src/main/java/eu/webeid/ocsp/protocol/OcspResponseValidator.java @@ -1,11 +1,11 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.ocsp; +package eu.webeid.ocsp.protocol; -import eu.webeid.security.exceptions.OCSPCertificateException; -import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException; -import eu.webeid.security.exceptions.UserCertificateRevokedException; +import eu.webeid.ocsp.exceptions.OCSPCertificateException; +import eu.webeid.ocsp.exceptions.UserCertificateOCSPCheckFailedException; +import eu.webeid.ocsp.exceptions.UserCertificateRevokedException; import eu.webeid.security.util.DateAndTime; import org.bouncycastle.cert.X509CertificateHolder; import org.bouncycastle.cert.ocsp.BasicOCSPResp; @@ -14,10 +14,12 @@ import org.bouncycastle.cert.ocsp.RevokedStatus; import org.bouncycastle.cert.ocsp.SingleResp; import org.bouncycastle.cert.ocsp.UnknownStatus; +import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.bouncycastle.operator.ContentVerifierProvider; import org.bouncycastle.operator.OperatorCreationException; import org.bouncycastle.operator.jcajce.JcaContentVerifierProviderBuilder; +import java.net.URI; import java.security.cert.CertificateException; import java.security.cert.CertificateParsingException; import java.security.cert.X509Certificate; @@ -47,16 +49,16 @@ public static void validateHasSigningExtension(X509Certificate certificate) thro } } - public static void validateResponseSignature(BasicOCSPResp basicResponse, X509CertificateHolder responderCert) throws CertificateException, OperatorCreationException, OCSPException, UserCertificateOCSPCheckFailedException { + public static void validateResponseSignature(BasicOCSPResp basicResponse, X509CertificateHolder responderCert, URI ocspResponderUri) throws CertificateException, OperatorCreationException, OCSPException, UserCertificateOCSPCheckFailedException { final ContentVerifierProvider verifierProvider = new JcaContentVerifierProviderBuilder() - .setProvider("BC") + .setProvider(BouncyCastleProvider.PROVIDER_NAME) .build(responderCert); if (!basicResponse.isSignatureValid(verifierProvider)) { - throw new UserCertificateOCSPCheckFailedException("OCSP response signature is invalid"); + throw new UserCertificateOCSPCheckFailedException("OCSP response signature is invalid", ocspResponderUri); } } - public static void validateCertificateStatusUpdateTime(SingleResp certStatusResponse, Duration allowedTimeSkew, Duration maxThisupdateAge) throws UserCertificateOCSPCheckFailedException { + public static void validateCertificateStatusUpdateTime(SingleResp certStatusResponse, Duration allowedTimeSkew, Duration maxThisupdateAge, URI ocspResponderUri) throws UserCertificateOCSPCheckFailedException { // From RFC 2560, https://www.ietf.org/rfc/rfc2560.txt: // 4.2.2. Notes on OCSP Responses // 4.2.2.1. Time @@ -75,12 +77,12 @@ public static void validateCertificateStatusUpdateTime(SingleResp certStatusResp if (thisUpdate.isAfter(latestAcceptableTimeSkew)) { throw new UserCertificateOCSPCheckFailedException(ERROR_PREFIX + "thisUpdate '" + thisUpdate + "' is too far in the future, " + - "latest allowed: '" + latestAcceptableTimeSkew + "'"); + "latest allowed: '" + latestAcceptableTimeSkew + "'", ocspResponderUri); } if (thisUpdate.isBefore(minimumValidThisUpdateTime)) { throw new UserCertificateOCSPCheckFailedException(ERROR_PREFIX + "thisUpdate '" + thisUpdate + "' is too old, " + - "minimum time allowed: '" + minimumValidThisUpdateTime + "'"); + "minimum time allowed: '" + minimumValidThisUpdateTime + "'", ocspResponderUri); } if (certStatusResponse.getNextUpdate() == null) { @@ -89,28 +91,27 @@ public static void validateCertificateStatusUpdateTime(SingleResp certStatusResp final Instant nextUpdate = certStatusResponse.getNextUpdate().toInstant(); if (nextUpdate.isBefore(earliestAcceptableTimeSkew)) { throw new UserCertificateOCSPCheckFailedException(ERROR_PREFIX + - "nextUpdate '" + nextUpdate + "' is in the past"); + "nextUpdate '" + nextUpdate + "' is in the past", ocspResponderUri); } if (nextUpdate.isBefore(thisUpdate)) { throw new UserCertificateOCSPCheckFailedException(ERROR_PREFIX + - "nextUpdate '" + nextUpdate + "' is before thisUpdate '" + thisUpdate + "'"); + "nextUpdate '" + nextUpdate + "' is before thisUpdate '" + thisUpdate + "'", ocspResponderUri); } } - public static void validateSubjectCertificateStatus(SingleResp certStatusResponse) throws UserCertificateRevokedException { + public static void validateSubjectCertificateStatus(SingleResp certStatusResponse, URI ocspResponderUri) throws UserCertificateRevokedException { final CertificateStatus status = certStatusResponse.getCertStatus(); if (status == null) { return; } - if (status instanceof RevokedStatus) { - RevokedStatus revokedStatus = (RevokedStatus) status; + if (status instanceof RevokedStatus revokedStatus) { throw (revokedStatus.hasRevocationReason() ? - new UserCertificateRevokedException("Revocation reason: " + revokedStatus.getRevocationReason()) : - new UserCertificateRevokedException()); + new UserCertificateRevokedException("Revocation reason: " + revokedStatus.getRevocationReason(), ocspResponderUri) : + new UserCertificateRevokedException(ocspResponderUri)); } else if (status instanceof UnknownStatus) { - throw new UserCertificateRevokedException("Unknown status"); + throw new UserCertificateRevokedException("Unknown status", ocspResponderUri); } else { - throw new UserCertificateRevokedException("Status is neither good, revoked nor unknown"); + throw new UserCertificateRevokedException("Status is neither good, revoked nor unknown", ocspResponderUri); } } diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspUrl.java b/src/main/java/eu/webeid/ocsp/protocol/OcspUrl.java similarity index 97% rename from src/main/java/eu/webeid/security/validator/ocsp/OcspUrl.java rename to src/main/java/eu/webeid/ocsp/protocol/OcspUrl.java index 59bbfb10..ffad7398 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/OcspUrl.java +++ b/src/main/java/eu/webeid/ocsp/protocol/OcspUrl.java @@ -1,7 +1,7 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.ocsp; +package eu.webeid.ocsp.protocol; import org.bouncycastle.asn1.ASN1String; import org.bouncycastle.asn1.x509.AccessDescription; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspService.java b/src/main/java/eu/webeid/ocsp/service/AiaOcspService.java similarity index 76% rename from src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspService.java rename to src/main/java/eu/webeid/ocsp/service/AiaOcspService.java index fcd8c297..e9d2cd75 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspService.java +++ b/src/main/java/eu/webeid/ocsp/service/AiaOcspService.java @@ -1,13 +1,14 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.ocsp.service; +package eu.webeid.ocsp.service; import eu.webeid.security.certificate.CertificateValidator; import eu.webeid.security.exceptions.AuthTokenException; -import eu.webeid.security.exceptions.OCSPCertificateException; -import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException; -import eu.webeid.security.validator.ocsp.OcspResponseValidator; +import eu.webeid.ocsp.exceptions.OCSPCertificateException; +import eu.webeid.ocsp.exceptions.UserCertificateOCSPCheckFailedException; +import eu.webeid.ocsp.protocol.OcspResponseValidator; +import eu.webeid.security.validator.revocationcheck.RevocationMode; import org.bouncycastle.cert.X509CertificateHolder; import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter; @@ -20,7 +21,7 @@ import java.util.Objects; import java.util.Set; -import static eu.webeid.security.validator.ocsp.OcspUrl.getOcspUri; +import static eu.webeid.ocsp.protocol.OcspUrl.getOcspUri; /** * An OCSP service that uses the responders from the Certificates' Authority Information Access (AIA) extension. @@ -55,10 +56,18 @@ public URI getAccessLocation() { public void validateResponderCertificate(X509CertificateHolder cert, Date now) throws AuthTokenException { try { final X509Certificate certificate = certificateConverter.getCertificate(cert); - CertificateValidator.certificateIsValidOnDate(certificate, now, "AIA OCSP responder"); + CertificateValidator.requireCertificateIsValidOnDate(certificate, now, "AIA OCSP responder"); // Trusted certificates' validity has been already verified in validateCertificateExpiry(). OcspResponseValidator.validateHasSigningExtension(certificate); - CertificateValidator.validateIsSignedByTrustedCA(certificate, trustedCACertificateAnchors, trustedCACertificateCertStore, now); + CertificateValidator.validateCertificateTrustAndRevocation( + certificate, + trustedCACertificateAnchors, + trustedCACertificateCertStore, + now, + RevocationMode.DISABLED, + null, + null + ); } catch (CertificateException e) { throw new OCSPCertificateException("Invalid responder certificate", e); } diff --git a/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspServiceConfiguration.java b/src/main/java/eu/webeid/ocsp/service/AiaOcspServiceConfiguration.java similarity index 96% rename from src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspServiceConfiguration.java rename to src/main/java/eu/webeid/ocsp/service/AiaOcspServiceConfiguration.java index 436f0a42..772fe1a9 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspServiceConfiguration.java +++ b/src/main/java/eu/webeid/ocsp/service/AiaOcspServiceConfiguration.java @@ -1,7 +1,7 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.ocsp.service; +package eu.webeid.ocsp.service; import java.net.URI; import java.security.cert.CertStore; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspService.java b/src/main/java/eu/webeid/ocsp/service/DesignatedOcspService.java similarity index 90% rename from src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspService.java rename to src/main/java/eu/webeid/ocsp/service/DesignatedOcspService.java index 586adf98..a803d6b1 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspService.java +++ b/src/main/java/eu/webeid/ocsp/service/DesignatedOcspService.java @@ -1,11 +1,11 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.ocsp.service; +package eu.webeid.ocsp.service; import org.bouncycastle.cert.X509CertificateHolder; import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter; -import eu.webeid.security.exceptions.OCSPCertificateException; +import eu.webeid.ocsp.exceptions.OCSPCertificateException; import eu.webeid.security.exceptions.AuthTokenException; import java.net.URI; @@ -15,7 +15,7 @@ import java.util.Date; import java.util.Objects; -import static eu.webeid.security.certificate.CertificateValidator.certificateIsValidOnDate; +import static eu.webeid.security.certificate.CertificateValidator.requireCertificateIsValidOnDate; /** * An OCSP service that uses a single designated OCSP responder. @@ -49,7 +49,7 @@ public void validateResponderCertificate(X509CertificateHolder cert, Date now) t throw new OCSPCertificateException("Responder certificate from the OCSP response is not equal to " + "the configured designated OCSP responder certificate"); } - certificateIsValidOnDate(responderCertificate, now, "Designated OCSP responder"); + requireCertificateIsValidOnDate(responderCertificate, now, "Designated OCSP responder"); } catch (CertificateException e) { throw new OCSPCertificateException("X509CertificateHolder conversion to X509Certificate failed", e); } diff --git a/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspServiceConfiguration.java b/src/main/java/eu/webeid/ocsp/service/DesignatedOcspServiceConfiguration.java similarity index 92% rename from src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspServiceConfiguration.java rename to src/main/java/eu/webeid/ocsp/service/DesignatedOcspServiceConfiguration.java index 129366ed..5db67af4 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/service/DesignatedOcspServiceConfiguration.java +++ b/src/main/java/eu/webeid/ocsp/service/DesignatedOcspServiceConfiguration.java @@ -1,19 +1,18 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.ocsp.service; +package eu.webeid.ocsp.service; -import eu.webeid.security.validator.ocsp.OcspResponseValidator; +import eu.webeid.ocsp.protocol.OcspResponseValidator; import org.bouncycastle.asn1.x500.X500Name; import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder; -import eu.webeid.security.exceptions.OCSPCertificateException; +import eu.webeid.ocsp.exceptions.OCSPCertificateException; import java.net.URI; import java.security.cert.CertificateEncodingException; import java.security.cert.X509Certificate; import java.util.Collection; import java.util.Objects; -import java.util.stream.Collectors; public class DesignatedOcspServiceConfiguration { @@ -59,7 +58,7 @@ private Collection getIssuerX500Names(Collection supp try { return supportedIssuers.stream() .map(this::getSubject) - .collect(Collectors.toList()); + .toList(); } catch (IllegalArgumentException e) { throw new OCSPCertificateException("Supported issuer list contains an invalid certificate", e.getCause()); } diff --git a/src/main/java/eu/webeid/security/validator/ocsp/service/OcspService.java b/src/main/java/eu/webeid/ocsp/service/OcspService.java similarity index 89% rename from src/main/java/eu/webeid/security/validator/ocsp/service/OcspService.java rename to src/main/java/eu/webeid/ocsp/service/OcspService.java index 2d83a25f..92a6c155 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/service/OcspService.java +++ b/src/main/java/eu/webeid/ocsp/service/OcspService.java @@ -1,7 +1,7 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.ocsp.service; +package eu.webeid.ocsp.service; import org.bouncycastle.cert.X509CertificateHolder; import eu.webeid.security.exceptions.AuthTokenException; diff --git a/src/main/java/eu/webeid/security/validator/ocsp/OcspServiceProvider.java b/src/main/java/eu/webeid/ocsp/service/OcspServiceProvider.java similarity index 81% rename from src/main/java/eu/webeid/security/validator/ocsp/OcspServiceProvider.java rename to src/main/java/eu/webeid/ocsp/service/OcspServiceProvider.java index d7f0464d..925d9bfc 100644 --- a/src/main/java/eu/webeid/security/validator/ocsp/OcspServiceProvider.java +++ b/src/main/java/eu/webeid/ocsp/service/OcspServiceProvider.java @@ -1,14 +1,9 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.ocsp; +package eu.webeid.ocsp.service; import eu.webeid.security.exceptions.AuthTokenException; -import eu.webeid.security.validator.ocsp.service.AiaOcspService; -import eu.webeid.security.validator.ocsp.service.AiaOcspServiceConfiguration; -import eu.webeid.security.validator.ocsp.service.DesignatedOcspService; -import eu.webeid.security.validator.ocsp.service.DesignatedOcspServiceConfiguration; -import eu.webeid.security.validator.ocsp.service.OcspService; import java.security.cert.CertificateEncodingException; import java.security.cert.X509Certificate; diff --git a/src/main/java/eu/webeid/security/authtoken/WebEidAuthToken.java b/src/main/java/eu/webeid/security/authtoken/WebEidAuthToken.java index f3139017..7dc80a62 100644 --- a/src/main/java/eu/webeid/security/authtoken/WebEidAuthToken.java +++ b/src/main/java/eu/webeid/security/authtoken/WebEidAuthToken.java @@ -6,43 +6,10 @@ import com.fasterxml.jackson.annotation.JsonIgnoreProperties; @JsonIgnoreProperties(ignoreUnknown = true) -public class WebEidAuthToken { - - private String unverifiedCertificate; - private String signature; - private String algorithm; - private String format; - - public String getUnverifiedCertificate() { - return unverifiedCertificate; - } - - public void setUnverifiedCertificate(String unverifiedCertificate) { - this.unverifiedCertificate = unverifiedCertificate; - } - - public String getSignature() { - return signature; - } - - public void setSignature(String signature) { - this.signature = signature; - } - - public String getAlgorithm() { - return algorithm; - } - - public void setAlgorithm(String algorithm) { - this.algorithm = algorithm; - } - - public String getFormat() { - return format; - } - - public void setFormat(String format) { - this.format = format; - } - +public record WebEidAuthToken( + String unverifiedCertificate, + String signature, + String algorithm, + String format +) { } diff --git a/src/main/java/eu/webeid/security/certificate/CertificateValidator.java b/src/main/java/eu/webeid/security/certificate/CertificateValidator.java index f479128d..52ba325e 100644 --- a/src/main/java/eu/webeid/security/certificate/CertificateValidator.java +++ b/src/main/java/eu/webeid/security/certificate/CertificateValidator.java @@ -3,10 +3,14 @@ package eu.webeid.security.certificate; +import eu.webeid.security.exceptions.AuthTokenException; import eu.webeid.security.exceptions.CertificateExpiredException; import eu.webeid.security.exceptions.CertificateNotTrustedException; import eu.webeid.security.exceptions.CertificateNotYetValidException; import eu.webeid.security.exceptions.JceException; +import eu.webeid.security.validator.revocationcheck.CertificateRevocationChecker; +import eu.webeid.security.validator.revocationcheck.RevocationInfo; +import eu.webeid.security.validator.revocationcheck.RevocationMode; import java.security.GeneralSecurityException; import java.security.InvalidAlgorithmParameterException; @@ -17,17 +21,22 @@ import java.security.cert.CollectionCertStoreParameters; import java.security.cert.PKIXBuilderParameters; import java.security.cert.PKIXCertPathBuilderResult; +import java.security.cert.PKIXRevocationChecker; import java.security.cert.TrustAnchor; import java.security.cert.X509CertSelector; import java.security.cert.X509Certificate; import java.util.Collection; import java.util.Date; +import java.util.EnumSet; +import java.util.List; import java.util.Set; import java.util.stream.Collectors; +import static java.util.Objects.requireNonNull; + public final class CertificateValidator { - public static void certificateIsValidOnDate(X509Certificate cert, Date date, String subject) throws CertificateNotYetValidException, CertificateExpiredException { + public static void requireCertificateIsValidOnDate(X509Certificate cert, Date date, String subject) throws CertificateNotYetValidException, CertificateExpiredException { try { cert.checkValidity(date); } catch (java.security.cert.CertificateNotYetValidException e) { @@ -37,32 +46,154 @@ public static void certificateIsValidOnDate(X509Certificate cert, Date date, Str } } - public static X509Certificate validateIsSignedByTrustedCA(X509Certificate certificate, - Set trustedCACertificateAnchors, - CertStore trustedCACertificateCertStore, - Date now) throws CertificateNotTrustedException, JceException, CertificateNotYetValidException, CertificateExpiredException { - certificateIsValidOnDate(certificate, now, "User"); + /** + * Validates that the provided {@code certificate} is trusted and performs certificate revocation checking + * depending on {@code revocationMode}. + *

    + * Trust validation is performed by building a certification path from {@code certificate} to one of the + * configured {@code trustedCACertificateAnchors} using the supplied {@code trustedCACertificateCertStore}. + * The effective validation time is {@code now}. In addition, the trust anchor certificate's validity period + * is explicitly validated. + * It is assumed that each configured trust anchor represents the intermediate certificate authority that directly + * issued the subject certificate. + *

    + * Revocation behavior is controlled by {@code revocationMode}: + *

      + *
    • {@link RevocationMode#DISABLED} - no revocation checking is performed. Both + * {@code certificateRevocationChecker} and {@code customPkixRevocationChecker} must be {@code null}.
      • + *
    • {@link RevocationMode#CUSTOM_CHECKER} - revocation is checked by the provided + * {@code certificateRevocationChecker}. Platform (provider default) revocation checking is disabled. + * {@code customPkixRevocationChecker} must be {@code null}.
      • + *
    • {@link RevocationMode#CUSTOM_PKIX} - revocation is checked by the provided + * {@code customPkixRevocationChecker} installed as the (only) PKIX cert path checker. Provider default + * revocation checking is disabled. {@code certificateRevocationChecker} must be {@code null}.
      • + *
    • {@link RevocationMode#PLATFORM_OCSP} - revocation is checked using the platform PKIX revocation checker + * configured to enforce OCSP checking for the subject certificate with no fallback to CRLs + * ({@link PKIXRevocationChecker.Option#ONLY_END_ENTITY} and {@link PKIXRevocationChecker.Option#NO_FALLBACK}). + * Provider default revocation checking is disabled. Both custom checker parameters must be {@code null}.
      • + *
    + * + * @param certificate the subject certificate to validate + * @param trustedCACertificateAnchors trust anchors used for PKIX path building (Web eID typically configures issuing intermediates) + * @param trustedCACertificateCertStore certificate store containing trusted CA/intermediate certificates used during path building + * @param now validation time used for certificate validity and PKIX path building + * @param revocationMode revocation checking mode + * @param certificateRevocationChecker custom certificate revocation checker (required only for {@code CUSTOM_CHECKER}) + * @param customPkixRevocationChecker custom PKIX revocation checker (required only for {@code CUSTOM_PKIX}) + * @return a list of {@link RevocationInfo} objects; the list is non-null and may be empty. + * It is populated for {@link RevocationMode#CUSTOM_CHECKER}, and may be populated for + * {@link RevocationMode#CUSTOM_PKIX} when the provided {@code customPkixRevocationChecker} + * has an explicit OCSP responder URI configured; otherwise it is empty. + *

    + * @throws NullPointerException if any required parameter is {@code null} + * @throws IllegalArgumentException if the supplied checker parameters are inconsistent with {@code revocationMode} + * @throws CertificateNotYetValidException if the subject or trust anchor certificate is not yet valid at {@code now} + * @throws CertificateExpiredException if the subject or trust anchor certificate is expired at {@code now} + * @throws CertificateNotTrustedException if no valid certification path can be built to the configured trust anchors + * @throws JceException if the underlying JCA/JCE implementation fails unexpectedly + * @throws AuthTokenException if a custom revocation checker fails or reports the certificate as revoked + */ + public static List validateCertificateTrustAndRevocation(X509Certificate certificate, + Set trustedCACertificateAnchors, + CertStore trustedCACertificateCertStore, + Date now, + RevocationMode revocationMode, + CertificateRevocationChecker certificateRevocationChecker, + PKIXRevocationChecker customPkixRevocationChecker) throws AuthTokenException { + + requireNonNull(certificate, "certificate"); + requireNonNull(trustedCACertificateAnchors, "trustedCACertificateAnchors"); + requireNonNull(trustedCACertificateCertStore, "trustedCACertificateCertStore"); + requireNonNull(now, "now"); + requireNonNull(revocationMode, "revocationMode"); + + requireCertificateIsValidOnDate(certificate, now, "User"); final X509CertSelector selector = new X509CertSelector(); selector.setCertificate(certificate); try { final PKIXBuilderParameters pkixBuilderParameters = new PKIXBuilderParameters(trustedCACertificateAnchors, selector); - // Certificate revocation check is intentionally disabled as we do the OCSP check with SubjectCertificateNotRevokedValidator ourselves. - pkixBuilderParameters.setRevocationEnabled(false); pkixBuilderParameters.setDate(now); pkixBuilderParameters.addCertStore(trustedCACertificateCertStore); // See the comment in buildCertStoreFromCertificates() below why we use the default JCE provider. final CertPathBuilder certPathBuilder = CertPathBuilder.getInstance(CertPathBuilder.getDefaultType()); - final PKIXCertPathBuilderResult result = (PKIXCertPathBuilderResult) certPathBuilder.build(pkixBuilderParameters); - final X509Certificate trustedCACert = result.getTrustAnchor().getTrustedCert(); + List revocationInfoList = List.of(); + + switch (revocationMode) { + case DISABLED -> { + if (customPkixRevocationChecker != null || certificateRevocationChecker != null) { + throw new IllegalArgumentException("customPkixRevocationChecker and certificateRevocationChecker must be null when revocationMode is DISABLED"); + } + pkixBuilderParameters.setRevocationEnabled(false); + } + + case CUSTOM_CHECKER -> { + if (customPkixRevocationChecker != null) { + throw new IllegalArgumentException("customPkixRevocationChecker must be null when revocationMode is CUSTOM_OCSP"); + } + if (certificateRevocationChecker == null) { + throw new IllegalArgumentException("certificateRevocationChecker must be provided when revocationMode is CUSTOM_OCSP"); + } + // CertificateRevocationChecker performs revocation checking, disable platform's revocation checks. + pkixBuilderParameters.setRevocationEnabled(false); + } + + case CUSTOM_PKIX -> { + if (certificateRevocationChecker != null) { + throw new IllegalArgumentException("certificateRevocationChecker must be null when revocationMode is CUSTOM_PKIX"); + } + if (customPkixRevocationChecker == null) { + throw new IllegalArgumentException("customPkixRevocationChecker must be provided when revocationMode is CUSTOM_PKIX"); + } + // Setting RevocationEnabled is not required for the checker to run, but disable + // the provider default revocation just in case to avoid surprises across providers. + pkixBuilderParameters.setRevocationEnabled(false); + pkixBuilderParameters.setCertPathCheckers(List.of(customPkixRevocationChecker)); + + if (customPkixRevocationChecker.getOcspResponder() != null) { + revocationInfoList = List.of(new RevocationInfo(customPkixRevocationChecker.getOcspResponder(), null)); + } + } + + case PLATFORM_OCSP -> { + if (customPkixRevocationChecker != null || certificateRevocationChecker != null) { + throw new IllegalArgumentException("customPkixRevocationChecker and certificateRevocationChecker must be null when revocationMode is PLATFORM_OCSP"); + } + + final PKIXRevocationChecker checker = buildOcspEnforcedPkixRevocationChecker(certPathBuilder); + // See the comment in CUSTOM_PKIX case above. + pkixBuilderParameters.setRevocationEnabled(false); + pkixBuilderParameters.setCertPathCheckers(List.of(checker)); + } + + default -> throw new IllegalStateException("Unhandled revocationMode: " + revocationMode); + } - // Verify that the trusted CA cert is presently valid before returning the result. - certificateIsValidOnDate(trustedCACert, now, "Trusted CA"); + final PKIXCertPathBuilderResult result = (PKIXCertPathBuilderResult) certPathBuilder.build(pkixBuilderParameters); - return trustedCACert; + final X509Certificate trustedCACert = result.getTrustAnchor().getTrustedCert(); + if (trustedCACert == null) { + throw new IllegalStateException("TrustAnchor.getTrustedCert() returned null, it must contain a trusted certificate"); + } + + // PKIX path building does not validate trust anchor validity period, do it ourselves. + requireCertificateIsValidOnDate(trustedCACert, now, "Trusted CA"); + + if (revocationMode == RevocationMode.CUSTOM_CHECKER) { + if (!certificate.getIssuerX500Principal().equals(trustedCACert.getSubjectX500Principal())) { + throw new IllegalStateException( + "Trust anchor is not the issuer of the subject certificate, check your configured certificate authorities. " + + "Subject issuer=" + certificate.getIssuerX500Principal() + + ", trust anchor subject=" + trustedCACert.getSubjectX500Principal() + ); + } + revocationInfoList = certificateRevocationChecker.validateCertificateNotRevoked(certificate, trustedCACert); + } + + return revocationInfoList; } catch (InvalidAlgorithmParameterException | NoSuchAlgorithmException e) { throw new JceException(e); @@ -77,7 +208,7 @@ public static Set buildTrustAnchorsFromCertificates(Collection certificates) throws JceException { - // We use the default JCE provider as there is no reason to use Bouncy Castle, moreover BC requires + // Use the default JCE provider as there is no reason to use Bouncy Castle, moreover BC requires // the validated certificate to be in the certificate store which breaks the clean immutable usage of // trustedCACertificateCertStore in SubjectCertificateTrustedValidator. try { @@ -87,6 +218,20 @@ public static CertStore buildCertStoreFromCertificates(Collection Set newHashSet(T... elements) { - final Set set = new HashSet<>(); - java.util.Collections.addAll(set, elements); - return set; - } - - public static byte[] concat(byte[] first, byte[] second) { - byte[] result = Arrays.copyOf(first, first.length + second.length); - System.arraycopy(second, 0, result, first.length, second.length); - return result; - } - - private Collections() { - throw new IllegalStateException("Utility class"); - } - -} diff --git a/src/main/java/eu/webeid/security/util/DateAndTime.java b/src/main/java/eu/webeid/security/util/DateAndTime.java index 85eac7dd..5edf6610 100644 --- a/src/main/java/eu/webeid/security/util/DateAndTime.java +++ b/src/main/java/eu/webeid/security/util/DateAndTime.java @@ -17,11 +17,12 @@ public static ZonedDateTime utcNow() { return ZonedDateTime.now(ZoneOffset.UTC); } - public static void requirePositiveDuration(Duration duration, String fieldName) { + public static Duration requirePositiveDuration(Duration duration, String fieldName) { Objects.requireNonNull(duration, fieldName + " must not be null"); if (duration.isNegative() || duration.isZero()) { throw new IllegalArgumentException(fieldName + " must be greater than zero"); } + return duration; } public static class DefaultClock implements Clock { diff --git a/src/main/java/eu/webeid/security/validator/AuthTokenSignatureValidator.java b/src/main/java/eu/webeid/security/validator/AuthTokenSignatureValidator.java index 5e813552..2e0d57e0 100644 --- a/src/main/java/eu/webeid/security/validator/AuthTokenSignatureValidator.java +++ b/src/main/java/eu/webeid/security/validator/AuthTokenSignatureValidator.java @@ -19,23 +19,21 @@ import java.security.NoSuchAlgorithmException; import java.security.PublicKey; import java.util.Arrays; -import java.util.HashSet; import java.util.Objects; import java.util.Set; import static eu.webeid.security.util.Base64Decoder.decodeBase64; -import static eu.webeid.security.util.Collections.concat; import static eu.webeid.security.util.Strings.isNullOrEmpty; public class AuthTokenSignatureValidator { // Supported subset of JSON Web Signature algorithms as defined in RFC 7518, sections 3.3, 3.4, 3.5. // See https://github.com/web-eid/libelectronic-id/blob/main/include/electronic-id/enums.hpp#L176. - private static final Set ALLOWED_SIGNATURE_ALGORITHMS = new HashSet<>(Arrays.asList( + private static final Set ALLOWED_SIGNATURE_ALGORITHMS = Set.of( "ES256", "ES384", "ES512", // ECDSA "PS256", "PS384", "PS512", // RSASSA-PSS "RS256", "RS384", "RS512" // RSASSA-PKCS1-v1_5 - )); + ); private final byte[] originBytes; @@ -99,4 +97,10 @@ private void requireNotEmpty(String argument, String fieldName) throws AuthToken } } + private static byte[] concat(byte[] first, byte[] second) { + byte[] result = Arrays.copyOf(first, first.length + second.length); + System.arraycopy(second, 0, result, first.length, second.length); + return result; + } + } diff --git a/src/main/java/eu/webeid/security/validator/AuthTokenValidationConfiguration.java b/src/main/java/eu/webeid/security/validator/AuthTokenValidationConfiguration.java index 596ff3c0..cd5db7f6 100644 --- a/src/main/java/eu/webeid/security/validator/AuthTokenValidationConfiguration.java +++ b/src/main/java/eu/webeid/security/validator/AuthTokenValidationConfiguration.java @@ -4,22 +4,19 @@ package eu.webeid.security.validator; import eu.webeid.security.certificate.SubjectCertificatePolicies; -import eu.webeid.security.validator.ocsp.service.DesignatedOcspServiceConfiguration; +import eu.webeid.security.validator.revocationcheck.CertificateRevocationChecker; +import eu.webeid.security.validator.revocationcheck.RevocationMode; import org.bouncycastle.asn1.ASN1ObjectIdentifier; import java.net.MalformedURLException; import java.net.URI; import java.net.URISyntaxException; +import java.security.cert.PKIXRevocationChecker; import java.security.cert.X509Certificate; -import java.time.Duration; import java.util.Collection; import java.util.HashSet; -import java.util.Objects; import java.util.Set; -import static eu.webeid.security.util.Collections.newHashSet; -import static eu.webeid.security.util.DateAndTime.requirePositiveDuration; - /** * Stores configuration parameters for {@link AuthTokenValidatorImpl}. */ @@ -27,19 +24,17 @@ public final class AuthTokenValidationConfiguration { private URI siteOrigin; private Collection trustedCACertificates = new HashSet<>(); - private boolean isUserCertificateRevocationCheckWithOcspEnabled = true; - private Duration ocspRequestTimeout = Duration.ofSeconds(5); - private Duration allowedOcspResponseTimeSkew = Duration.ofMinutes(15); - private Duration maxOcspResponseThisUpdateAge = Duration.ofMinutes(2); - private DesignatedOcspServiceConfiguration designatedOcspServiceConfiguration; // Don't allow Estonian Mobile-ID policy by default. - private Collection disallowedSubjectCertificatePolicies = newHashSet( + private Collection disallowedSubjectCertificatePolicies = new HashSet<>(Set.of( SubjectCertificatePolicies.ESTEID_SK_2015_MOBILE_ID_POLICY_V1, SubjectCertificatePolicies.ESTEID_SK_2015_MOBILE_ID_POLICY_V2, SubjectCertificatePolicies.ESTEID_SK_2015_MOBILE_ID_POLICY_V3, SubjectCertificatePolicies.ESTEID_SK_2015_MOBILE_ID_POLICY - ); - private Collection nonceDisabledOcspUrls = new HashSet<>(); + )); + private boolean isUserCertificateRevocationCheckEnabled = true; + private CertificateRevocationChecker certificateRevocationChecker; + private PKIXRevocationChecker pkixRevocationChecker; + private RevocationMode revocationMode = RevocationMode.PLATFORM_OCSP; AuthTokenValidationConfiguration() { } @@ -47,13 +42,11 @@ public final class AuthTokenValidationConfiguration { private AuthTokenValidationConfiguration(AuthTokenValidationConfiguration other) { this.siteOrigin = other.siteOrigin; this.trustedCACertificates = Set.copyOf(other.trustedCACertificates); - this.isUserCertificateRevocationCheckWithOcspEnabled = other.isUserCertificateRevocationCheckWithOcspEnabled; - this.ocspRequestTimeout = other.ocspRequestTimeout; - this.allowedOcspResponseTimeSkew = other.allowedOcspResponseTimeSkew; - this.maxOcspResponseThisUpdateAge = other.maxOcspResponseThisUpdateAge; - this.designatedOcspServiceConfiguration = other.designatedOcspServiceConfiguration; this.disallowedSubjectCertificatePolicies = Set.copyOf(other.disallowedSubjectCertificatePolicies); - this.nonceDisabledOcspUrls = Set.copyOf(other.nonceDisabledOcspUrls); + this.isUserCertificateRevocationCheckEnabled = other.isUserCertificateRevocationCheckEnabled; + this.certificateRevocationChecker = other.certificateRevocationChecker; + this.pkixRevocationChecker = other.pkixRevocationChecker; + this.revocationMode = other.revocationMode; } void setSiteOrigin(URI siteOrigin) { @@ -68,69 +61,49 @@ Collection getTrustedCACertificates() { return trustedCACertificates; } - boolean isUserCertificateRevocationCheckWithOcspEnabled() { - return isUserCertificateRevocationCheckWithOcspEnabled; - } - - void setUserCertificateRevocationCheckWithOcspDisabled() { - isUserCertificateRevocationCheckWithOcspEnabled = false; - } - - public Duration getOcspRequestTimeout() { - return ocspRequestTimeout; - } - - void setOcspRequestTimeout(Duration ocspRequestTimeout) { - this.ocspRequestTimeout = ocspRequestTimeout; - } - - public Duration getAllowedOcspResponseTimeSkew() { - return allowedOcspResponseTimeSkew; + public Collection getDisallowedSubjectCertificatePolicies() { + return disallowedSubjectCertificatePolicies; } - public void setAllowedOcspResponseTimeSkew(Duration allowedOcspResponseTimeSkew) { - this.allowedOcspResponseTimeSkew = allowedOcspResponseTimeSkew; + boolean isUserCertificateRevocationCheckEnabled() { + return isUserCertificateRevocationCheckEnabled; } - public Duration getMaxOcspResponseThisUpdateAge() { - return maxOcspResponseThisUpdateAge; + void setUserCertificateRevocationCheckDisabled() { + isUserCertificateRevocationCheckEnabled = false; } - public void setMaxOcspResponseThisUpdateAge(Duration maxOcspResponseThisUpdateAge) { - this.maxOcspResponseThisUpdateAge = maxOcspResponseThisUpdateAge; + public void setCertificateRevocationChecker(CertificateRevocationChecker certificateRevocationChecker) { + this.certificateRevocationChecker = certificateRevocationChecker; } - public DesignatedOcspServiceConfiguration getDesignatedOcspServiceConfiguration() { - return designatedOcspServiceConfiguration; + public CertificateRevocationChecker getCertificateRevocationChecker() { + return certificateRevocationChecker; } - public void setDesignatedOcspServiceConfiguration(DesignatedOcspServiceConfiguration designatedOcspServiceConfiguration) { - this.designatedOcspServiceConfiguration = designatedOcspServiceConfiguration; + public void setPkixRevocationChecker(PKIXRevocationChecker pkixRevocationChecker) { + this.pkixRevocationChecker = pkixRevocationChecker; } - public Collection getDisallowedSubjectCertificatePolicies() { - return disallowedSubjectCertificatePolicies; + public PKIXRevocationChecker getPkixRevocationChecker() { + return pkixRevocationChecker; } - public Collection getNonceDisabledOcspUrls() { - return nonceDisabledOcspUrls; + public RevocationMode getRevocationMode() { + return revocationMode; } /** * Checks that the configuration parameters are valid. * - * @throws NullPointerException when required parameters are null * @throws IllegalArgumentException when any parameter is invalid */ void validate() { - Objects.requireNonNull(siteOrigin, "Origin URI must not be null"); validateIsOriginURL(siteOrigin); if (trustedCACertificates.isEmpty()) { throw new IllegalArgumentException("At least one trusted certificate authority must be provided"); } - requirePositiveDuration(ocspRequestTimeout, "OCSP request timeout"); - requirePositiveDuration(allowedOcspResponseTimeSkew, "Allowed OCSP response time-skew"); - requirePositiveDuration(maxOcspResponseThisUpdateAge, "Max OCSP response thisUpdate age"); + validateRevocationConfiguration(); } AuthTokenValidationConfiguration copy() { @@ -146,6 +119,9 @@ AuthTokenValidationConfiguration copy() { */ public static void validateIsOriginURL(URI uri) throws IllegalArgumentException { try { + if (uri == null) { + throw new IllegalArgumentException("Origin URI must not be null"); + } // 1. Verify that the URI can be converted to absolute URL. uri.toURL(); // 2. Verify that the URI contains only HTTPS scheme, host and optional port components. @@ -160,4 +136,42 @@ public static void validateIsOriginURL(URI uri) throws IllegalArgumentException } } + /** + * Validates that the revocation check configuration is consistent and derives the {@link RevocationMode} from it. + *

    + * Configuration is inconsistent if revocation checking is disabled but a checker is configured or if both + * checkers are configured simultaneously. + * + * @throws IllegalArgumentException if configuration is inconsistent + */ + private void validateRevocationConfiguration() { + final boolean hasCustomChecker = certificateRevocationChecker != null; + final boolean hasPkixChecker = pkixRevocationChecker != null; + + if (!isUserCertificateRevocationCheckEnabled) { + if (hasCustomChecker || hasPkixChecker) { + throw new IllegalArgumentException( + "User certificate revocation check is disabled, but a revocation checker was configured. " + + "Do not combine withoutUserCertificateRevocationCheck() with withOcspCertificateRevocationChecker(...) " + + "or withPKIXRevocationChecker(...)." + ); + } + revocationMode = RevocationMode.DISABLED; + } else { + // Revocation check enabled, at most one checker allowed, if no checker provided, use default PKIX revocation checker in OCSP mode. + if (hasCustomChecker && hasPkixChecker) { + throw new IllegalArgumentException( + "Only one of OcspCertificateRevocationChecker or PKIXRevocationChecker may be configured. " + + "Do not combine withOcspCertificateRevocationChecker(...) with withPKIXRevocationChecker(...)." + ); + } + if (hasCustomChecker) { + revocationMode = RevocationMode.CUSTOM_CHECKER; + } else if (hasPkixChecker) { + revocationMode = RevocationMode.CUSTOM_PKIX; + } else { + revocationMode = RevocationMode.PLATFORM_OCSP; + } + } + } } diff --git a/src/main/java/eu/webeid/security/validator/AuthTokenValidator.java b/src/main/java/eu/webeid/security/validator/AuthTokenValidator.java index 3f54175e..da8c3f15 100644 --- a/src/main/java/eu/webeid/security/validator/AuthTokenValidator.java +++ b/src/main/java/eu/webeid/security/validator/AuthTokenValidator.java @@ -38,6 +38,6 @@ public interface AuthTokenValidator { * @return validated subject certificate * @throws AuthTokenException when validation fails */ - X509Certificate validate(WebEidAuthToken authToken, String currentChallengeNonce) throws AuthTokenException; + ValidationInfo validate(WebEidAuthToken authToken, String currentChallengeNonce) throws AuthTokenException; } diff --git a/src/main/java/eu/webeid/security/validator/AuthTokenValidatorBuilder.java b/src/main/java/eu/webeid/security/validator/AuthTokenValidatorBuilder.java index 355c89b5..9a1d2976 100644 --- a/src/main/java/eu/webeid/security/validator/AuthTokenValidatorBuilder.java +++ b/src/main/java/eu/webeid/security/validator/AuthTokenValidatorBuilder.java @@ -4,18 +4,15 @@ package eu.webeid.security.validator; import eu.webeid.security.exceptions.JceException; -import eu.webeid.security.validator.ocsp.OcspClient; -import eu.webeid.security.validator.ocsp.OcspClientImpl; -import eu.webeid.security.validator.ocsp.service.DesignatedOcspServiceConfiguration; +import eu.webeid.security.validator.revocationcheck.CertificateRevocationChecker; import org.bouncycastle.asn1.ASN1ObjectIdentifier; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import java.net.URI; +import java.security.cert.PKIXRevocationChecker; import java.security.cert.X509Certificate; -import java.time.Duration; import java.util.Collections; -import java.util.stream.Collectors; /** * Builder for constructing {@link AuthTokenValidator} instances. @@ -25,7 +22,6 @@ public class AuthTokenValidatorBuilder { private static final Logger LOG = LoggerFactory.getLogger(AuthTokenValidatorBuilder.class); private final AuthTokenValidationConfiguration configuration = new AuthTokenValidationConfiguration(); - private OcspClient ocspClient; /** * Sets the expected site origin, i.e. the domain that the application is running on. @@ -59,7 +55,7 @@ public AuthTokenValidatorBuilder withTrustedCertificateAuthorities(X509Certifica LOG.debug("Trusted intermediate certificate authorities set to {}", configuration.getTrustedCACertificates().stream() .map(X509Certificate::getSubjectX500Principal) - .collect(Collectors.toList())); + .toList()); } return this; } @@ -79,105 +75,50 @@ public AuthTokenValidatorBuilder withDisallowedCertificatePolicies(ASN1ObjectIde } /** - * Turns off user certificate revocation check with OCSP. + * Turns off user certificate revocation check (with OCSP and/or CRL). *

    - * Turning off user certificate revocation check with OCSP is dangerous and should be - * used only in exceptional circumstances. + * Turning off user certificate revocation check is dangerous and should be used only in + * exceptional circumstances. * By default, the revocation check is turned on. * * @return the builder instance for method chaining. */ - public AuthTokenValidatorBuilder withoutUserCertificateRevocationCheckWithOcsp() { - configuration.setUserCertificateRevocationCheckWithOcspDisabled(); - LOG.warn("User certificate revocation check with OCSP is disabled, " + + public AuthTokenValidatorBuilder withoutUserCertificateRevocationCheck() { + configuration.setUserCertificateRevocationCheckDisabled(); + LOG.warn("User certificate revocation check is disabled, " + "you should turn off the revocation check only in exceptional circumstances"); return this; } /** - * Sets both the connection and response timeout of user certificate revocation check OCSP requests. + * Configures a custom certificate revocation checker for validating user certificate revocation status. *

    - * This is an optional configuration parameter, the default is 5 seconds. + * When set, the platform (provider default) revocation mechanism is disabled and revocation checking is + * delegated to the given {@link CertificateRevocationChecker}. This option is mutually exclusive with + * {@link #withPKIXRevocationChecker(PKIXRevocationChecker)} and {@link #withoutUserCertificateRevocationCheck()}. * - * @param ocspRequestTimeout the duration of OCSP request connection and response timeout - * @return the builder instance for method chaining. - */ - public AuthTokenValidatorBuilder withOcspRequestTimeout(Duration ocspRequestTimeout) { - configuration.setOcspRequestTimeout(ocspRequestTimeout); - LOG.debug("OCSP request timeout set to {}", ocspRequestTimeout); - return this; - } - - /** - * Sets the allowed time skew for OCSP response's thisUpdate and nextUpdate times. - * This parameter is used to allow discrepancies between the system clock and the OCSP responder's clock, - * which may occur due to clock drift, network delays or revocation updates that are not published in real time. - *

    - * This is an optional configuration parameter, the default is 15 minutes. - * The relatively long default is specifically chosen to account for one particular OCSP responder that used - * CRLs for authoritative revocation info, these CRLs were updated every 15 minutes. - * - * @param allowedTimeSkew the allowed time skew - * @return the builder instance for method chaining. - */ - public AuthTokenValidatorBuilder withAllowedOcspResponseTimeSkew(Duration allowedTimeSkew) { - configuration.setAllowedOcspResponseTimeSkew(allowedTimeSkew); - LOG.debug("Allowed OCSP response time skew set to {}", allowedTimeSkew); - return this; - } - - /** - * Sets the maximum age of the OCSP response's thisUpdate time before it is considered too old. - *

    - * This is an optional configuration parameter, the default is 2 minutes. - * - * @param maxThisUpdateAge the maximum age of the OCSP response's thisUpdate time - * @return the builder instance for method chaining. - */ - public AuthTokenValidatorBuilder withMaxOcspResponseThisUpdateAge(Duration maxThisUpdateAge) { - configuration.setMaxOcspResponseThisUpdateAge(maxThisUpdateAge); - LOG.debug("Maximum OCSP response thisUpdate age set to {}", maxThisUpdateAge); - return this; - } - - /** - * Adds the given URLs to the list of OCSP URLs for which the nonce protocol extension will be disabled. - * The OCSP URL is extracted from the user certificate and some OCSP services don't support the nonce extension. - * - * @param urls OCSP URLs for which the nonce protocol extension will be disabled - * @return the builder instance for method chaining - */ - public AuthTokenValidatorBuilder withNonceDisabledOcspUrls(URI... urls) { - Collections.addAll(configuration.getNonceDisabledOcspUrls(), urls); - LOG.debug("OCSP URLs for which the nonce protocol extension is disabled set to {}", configuration.getNonceDisabledOcspUrls()); - return this; - } - - /** - * Activates the provided designated OCSP service for user certificate revocation check with OCSP. - * The designated service is only used for checking the status of the certificates whose issuers are - * supported by the service, falling back to the default OCSP service access location from - * the certificate's AIA extension if not. - * - * @param serviceConfiguration configuration of the designated OCSP service + * @param customChecker custom certificate revocation checker implementation * @return the builder instance for method chaining */ - public AuthTokenValidatorBuilder withDesignatedOcspServiceConfiguration(DesignatedOcspServiceConfiguration serviceConfiguration) { - configuration.setDesignatedOcspServiceConfiguration(serviceConfiguration); - LOG.debug("Using designated OCSP service configuration"); + public AuthTokenValidatorBuilder withCertificateRevocationChecker(CertificateRevocationChecker customChecker) { + configuration.setCertificateRevocationChecker(customChecker); return this; } /** - * Uses the provided OCSP client instance during user certificate revocation check with OCSP. - * The provided client instance must be thread-safe. + * Configures a custom {@link PKIXRevocationChecker} to be used as the revocation mechanism during user certificate + * validation with platform PKIX. + *

    + * When set, this checker replaces the platform (provider default) {@link PKIXRevocationChecker}. This option is + * mutually exclusive with {@link #withCertificateRevocationChecker(CertificateRevocationChecker)} + * and {@link #withoutUserCertificateRevocationCheck()}. * - * @param ocspClient OCSP client instance + * @param customChecker custom PKIX revocation checker * @return the builder instance for method chaining + * @throws NullPointerException if {@code customChecker} is null */ - public AuthTokenValidatorBuilder withOcspClient(OcspClient ocspClient) { - this.ocspClient = ocspClient; - LOG.debug("Using the OCSP client provided by API consumer"); + public AuthTokenValidatorBuilder withPKIXRevocationChecker(PKIXRevocationChecker customChecker) { + configuration.setPkixRevocationChecker(customChecker); return this; } @@ -186,16 +127,12 @@ public AuthTokenValidatorBuilder withOcspClient(OcspClient ocspClient) { * The returned {@link AuthTokenValidator} object is immutable/thread-safe. * * @return the configured authentication token validator object - * @throws NullPointerException when required parameters are null * @throws IllegalArgumentException when any parameter is invalid - * @throws RuntimeException when JCE configuration is invalid + * @throws JceException when JCE configuration is invalid */ - public AuthTokenValidator build() throws NullPointerException, IllegalArgumentException, JceException { + public AuthTokenValidator build() throws IllegalArgumentException, JceException { configuration.validate(); - if (configuration.isUserCertificateRevocationCheckWithOcspEnabled() && ocspClient == null) { - ocspClient = OcspClientImpl.build(configuration.getOcspRequestTimeout()); - } - return new AuthTokenValidatorImpl(configuration, ocspClient); + return new AuthTokenValidatorImpl(configuration); } } diff --git a/src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java b/src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java index 0d951323..c2ff88c6 100644 --- a/src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java +++ b/src/main/java/eu/webeid/security/validator/AuthTokenValidatorImpl.java @@ -11,14 +11,11 @@ import eu.webeid.security.exceptions.AuthTokenException; import eu.webeid.security.exceptions.AuthTokenParseException; import eu.webeid.security.exceptions.JceException; -import eu.webeid.security.validator.certvalidators.SubjectCertificateNotRevokedValidator; +import eu.webeid.security.util.DateAndTime; import eu.webeid.security.validator.certvalidators.SubjectCertificatePolicyValidator; import eu.webeid.security.validator.certvalidators.SubjectCertificatePurposeValidator; -import eu.webeid.security.validator.certvalidators.SubjectCertificateTrustedValidator; -import eu.webeid.security.validator.certvalidators.SubjectCertificateValidatorBatch; -import eu.webeid.security.validator.ocsp.OcspClient; -import eu.webeid.security.validator.ocsp.OcspServiceProvider; -import eu.webeid.security.validator.ocsp.service.AiaOcspServiceConfiguration; +import eu.webeid.ocsp.service.OcspServiceProvider; +import eu.webeid.security.validator.revocationcheck.RevocationInfo; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -26,7 +23,8 @@ import java.security.cert.CertStore; import java.security.cert.TrustAnchor; import java.security.cert.X509Certificate; -import java.util.Objects; +import java.util.Date; +import java.util.List; import java.util.Set; /** @@ -41,20 +39,18 @@ final class AuthTokenValidatorImpl implements AuthTokenValidator { private static final ObjectReader OBJECT_READER = new ObjectMapper().readerFor(WebEidAuthToken.class); private final AuthTokenValidationConfiguration configuration; - private final SubjectCertificateValidatorBatch simpleSubjectCertificateValidators; private final Set trustedCACertificateAnchors; private final CertStore trustedCACertificateCertStore; // OcspClient uses built-in HttpClient internally by default. // A single HttpClient instance is reused for all HTTP calls to utilize connection and thread pools. - private OcspClient ocspClient; private OcspServiceProvider ocspServiceProvider; private final AuthTokenSignatureValidator authTokenSignatureValidator; + private final SubjectCertificatePolicyValidator subjectCertificatePolicyValidator; /** * @param configuration configuration parameters for the token validator - * @param ocspClient client for communicating with the OCSP service */ - AuthTokenValidatorImpl(AuthTokenValidationConfiguration configuration, OcspClient ocspClient) throws JceException { + AuthTokenValidatorImpl(AuthTokenValidationConfiguration configuration) throws JceException { // Copy the configuration object to make AuthTokenValidatorImpl immutable and thread-safe. this.configuration = configuration.copy(); @@ -62,20 +58,7 @@ final class AuthTokenValidatorImpl implements AuthTokenValidator { trustedCACertificateAnchors = CertificateValidator.buildTrustAnchorsFromCertificates(configuration.getTrustedCACertificates()); trustedCACertificateCertStore = CertificateValidator.buildCertStoreFromCertificates(configuration.getTrustedCACertificates()); - simpleSubjectCertificateValidators = SubjectCertificateValidatorBatch.createFrom( - SubjectCertificatePurposeValidator::validateCertificatePurpose, - new SubjectCertificatePolicyValidator(configuration.getDisallowedSubjectCertificatePolicies())::validateCertificatePolicies - ); - - if (configuration.isUserCertificateRevocationCheckWithOcspEnabled()) { - // The OCSP client may be provided by the API consumer. - this.ocspClient = Objects.requireNonNull(ocspClient, "OCSP client must not be null when OCSP check is enabled"); - ocspServiceProvider = new OcspServiceProvider( - configuration.getDesignatedOcspServiceConfiguration(), - new AiaOcspServiceConfiguration(configuration.getNonceDisabledOcspUrls(), - trustedCACertificateAnchors, - trustedCACertificateCertStore)); - } + subjectCertificatePolicyValidator = new SubjectCertificatePolicyValidator(configuration.getDisallowedSubjectCertificatePolicies()); authTokenSignatureValidator = new AuthTokenSignatureValidator(configuration.getSiteOrigin()); } @@ -94,7 +77,7 @@ public WebEidAuthToken parse(String authToken) throws AuthTokenException { } @Override - public X509Certificate validate(WebEidAuthToken authToken, String currentChallengeNonce) throws AuthTokenException { + public ValidationInfo validate(WebEidAuthToken authToken, String currentChallengeNonce) throws AuthTokenException { try { LOG.info("Starting token validation"); return validateToken(authToken, currentChallengeNonce); @@ -126,49 +109,42 @@ private WebEidAuthToken parseToken(String authToken) throws AuthTokenParseExcept } } - private X509Certificate validateToken(WebEidAuthToken token, String currentChallengeNonce) throws AuthTokenException { - if (token.getFormat() == null || !token.getFormat().startsWith(CURRENT_TOKEN_FORMAT_VERSION)) { + private ValidationInfo validateToken(WebEidAuthToken token, String currentChallengeNonce) throws AuthTokenException { + if (token.format() == null || !token.format().startsWith(CURRENT_TOKEN_FORMAT_VERSION)) { throw new AuthTokenParseException("Only token format version '" + CURRENT_TOKEN_FORMAT_VERSION + "' is currently supported"); } - if (token.getUnverifiedCertificate() == null || token.getUnverifiedCertificate().isEmpty()) { + if (token.unverifiedCertificate() == null || token.unverifiedCertificate().isEmpty()) { throw new AuthTokenParseException("'unverifiedCertificate' field is missing, null or empty"); } - final X509Certificate subjectCertificate = CertificateLoader.decodeCertificateFromBase64(token.getUnverifiedCertificate()); - - simpleSubjectCertificateValidators.executeFor(subjectCertificate); - getCertTrustValidators().executeFor(subjectCertificate); + final X509Certificate subjectCertificate = CertificateLoader.decodeCertificateFromBase64(token.unverifiedCertificate()); + + SubjectCertificatePurposeValidator.validateCertificatePurpose(subjectCertificate); + subjectCertificatePolicyValidator.validateCertificatePolicies(subjectCertificate); + + // Use the clock instance so that the date can be mocked in tests. + final Date now = DateAndTime.DefaultClock.getInstance().now(); + + final List revocationInfoList = CertificateValidator.validateCertificateTrustAndRevocation( + subjectCertificate, + trustedCACertificateAnchors, + trustedCACertificateCertStore, + now, + configuration.getRevocationMode(), + configuration.getCertificateRevocationChecker(), + configuration.getPkixRevocationChecker() + ); + LOG.debug("Subject certificate is valid and signed by a trusted CA"); // It is guaranteed that if the signature verification succeeds, then the origin and challenge // have been implicitly and correctly verified without the need to implement any additional checks. - authTokenSignatureValidator.validate(token.getAlgorithm(), - token.getSignature(), + authTokenSignatureValidator.validate(token.algorithm(), + token.signature(), subjectCertificate.getPublicKey(), - currentChallengeNonce); - - return subjectCertificate; - } - - /** - * Creates the certificate trust validators batch. - * As SubjectCertificateTrustedValidator has mutable state that SubjectCertificateNotRevokedValidator depends on, - * they cannot be reused/cached in an instance variable in a multi-threaded environment. Hence, they are - * re-created for each validation run for thread safety. - * - * @return certificate trust validator batch - */ - private SubjectCertificateValidatorBatch getCertTrustValidators() { - final SubjectCertificateTrustedValidator certTrustedValidator = - new SubjectCertificateTrustedValidator(trustedCACertificateAnchors, trustedCACertificateCertStore); - return SubjectCertificateValidatorBatch.createFrom( - certTrustedValidator::validateCertificateTrusted - ).addOptional(configuration.isUserCertificateRevocationCheckWithOcspEnabled(), - new SubjectCertificateNotRevokedValidator(certTrustedValidator, - ocspClient, ocspServiceProvider, - configuration.getAllowedOcspResponseTimeSkew(), - configuration.getMaxOcspResponseThisUpdateAge() - )::validateCertificateNotRevoked + currentChallengeNonce ); + + return new ValidationInfo(subjectCertificate, revocationInfoList); } } diff --git a/src/main/java/eu/webeid/security/validator/ValidationInfo.java b/src/main/java/eu/webeid/security/validator/ValidationInfo.java new file mode 100644 index 00000000..11a61561 --- /dev/null +++ b/src/main/java/eu/webeid/security/validator/ValidationInfo.java @@ -0,0 +1,15 @@ +package eu.webeid.security.validator; + +import eu.webeid.security.validator.revocationcheck.RevocationInfo; + +import java.security.cert.X509Certificate; +import java.util.List; + +import static java.util.Objects.requireNonNull; + +public record ValidationInfo(X509Certificate subjectCertificate, List revocationInfoList) { + public ValidationInfo { + requireNonNull(subjectCertificate, "subjectCertificate"); + requireNonNull(revocationInfoList, "revocationInfoList"); + } +} diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateTrustedValidator.java b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateTrustedValidator.java deleted file mode 100644 index 1a619d6a..00000000 --- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateTrustedValidator.java +++ /dev/null @@ -1,59 +0,0 @@ -// SPDX-FileCopyrightText: Estonian Information System Authority -// SPDX-License-Identifier: MIT - -package eu.webeid.security.validator.certvalidators; - -import eu.webeid.security.certificate.CertificateValidator; -import eu.webeid.security.exceptions.AuthTokenException; -import eu.webeid.security.exceptions.CertificateExpiredException; -import eu.webeid.security.exceptions.CertificateNotTrustedException; -import eu.webeid.security.exceptions.CertificateNotYetValidException; -import eu.webeid.security.util.DateAndTime; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; - -import java.security.cert.CertStore; -import java.security.cert.TrustAnchor; -import java.security.cert.X509Certificate; -import java.util.Date; -import java.util.Set; - -public final class SubjectCertificateTrustedValidator { - - private static final Logger LOG = LoggerFactory.getLogger(SubjectCertificateTrustedValidator.class); - - private final Set trustedCACertificateAnchors; - private final CertStore trustedCACertificateCertStore; - private X509Certificate subjectCertificateIssuerCertificate; - - public SubjectCertificateTrustedValidator(Set trustedCACertificateAnchors, CertStore trustedCACertificateCertStore) { - this.trustedCACertificateAnchors = trustedCACertificateAnchors; - this.trustedCACertificateCertStore = trustedCACertificateCertStore; - } - - /** - * Checks that the user certificate from the authentication token is valid and signed by - * a trusted certificate authority. Also checks the validity of the user certificate's - * trusted CA certificate. - * - * @param subjectCertificate user certificate to be validated - * @throws CertificateNotTrustedException when user certificate is not signed by a trusted CA - * @throws CertificateNotYetValidException when a CA certificate in the chain or the user certificate is not yet valid - * @throws CertificateExpiredException when a CA certificate in the chain or the user certificate is expired - */ - public void validateCertificateTrusted(X509Certificate subjectCertificate) throws AuthTokenException { - // Use the clock instance so that the date can be mocked in tests. - final Date now = DateAndTime.DefaultClock.getInstance().now(); - subjectCertificateIssuerCertificate = CertificateValidator.validateIsSignedByTrustedCA( - subjectCertificate, - trustedCACertificateAnchors, - trustedCACertificateCertStore, - now - ); - LOG.debug("Subject certificate is valid and signed by a trusted CA"); - } - - public X509Certificate getSubjectCertificateIssuerCertificate() { - return subjectCertificateIssuerCertificate; - } -} diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidator.java b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidator.java deleted file mode 100644 index e6e5f2e0..00000000 --- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidator.java +++ /dev/null @@ -1,18 +0,0 @@ -// SPDX-FileCopyrightText: Estonian Information System Authority -// SPDX-License-Identifier: MIT - -package eu.webeid.security.validator.certvalidators; - -import eu.webeid.security.exceptions.AuthTokenException; - -import java.security.cert.X509Certificate; - -/** - * Validators perform the actual user certificate validation actions. - *

    - * They are used by AuthTokenValidatorImpl and are not part of the public API. - */ -@FunctionalInterface -public interface SubjectCertificateValidator { - void validate(X509Certificate subjectCertificate) throws AuthTokenException; -} diff --git a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidatorBatch.java b/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidatorBatch.java deleted file mode 100644 index 5e50ecce..00000000 --- a/src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateValidatorBatch.java +++ /dev/null @@ -1,39 +0,0 @@ -// SPDX-FileCopyrightText: Estonian Information System Authority -// SPDX-License-Identifier: MIT - -package eu.webeid.security.validator.certvalidators; - -import eu.webeid.security.exceptions.AuthTokenException; - -import java.security.cert.X509Certificate; -import java.util.ArrayList; -import java.util.Collections; -import java.util.List; - -public final class SubjectCertificateValidatorBatch { - - private final List validatorList; - - public static SubjectCertificateValidatorBatch createFrom(SubjectCertificateValidator... validatorList) { - final List list = new ArrayList<>(); - Collections.addAll(list, validatorList); - return new SubjectCertificateValidatorBatch(list); - } - - public void executeFor(X509Certificate subjectCertificate) throws AuthTokenException { - for (final SubjectCertificateValidator validator : validatorList) { - validator.validate(subjectCertificate); - } - } - - public SubjectCertificateValidatorBatch addOptional(boolean condition, SubjectCertificateValidator optionalValidator) { - if (condition) { - validatorList.add(optionalValidator); - } - return this; - } - - private SubjectCertificateValidatorBatch(List validatorList) { - this.validatorList = validatorList; - } -} diff --git a/src/main/java/eu/webeid/security/validator/revocationcheck/CertificateRevocationChecker.java b/src/main/java/eu/webeid/security/validator/revocationcheck/CertificateRevocationChecker.java new file mode 100644 index 00000000..a3e8ac9d --- /dev/null +++ b/src/main/java/eu/webeid/security/validator/revocationcheck/CertificateRevocationChecker.java @@ -0,0 +1,15 @@ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT +package eu.webeid.security.validator.revocationcheck; + +import eu.webeid.security.exceptions.AuthTokenException; + +import java.security.cert.X509Certificate; +import java.util.List; + +public interface CertificateRevocationChecker { + + List validateCertificateNotRevoked(X509Certificate subjectCertificate, + X509Certificate issuerCertificate) throws AuthTokenException; + +} \ No newline at end of file diff --git a/src/main/java/eu/webeid/security/validator/revocationcheck/RevocationInfo.java b/src/main/java/eu/webeid/security/validator/revocationcheck/RevocationInfo.java new file mode 100644 index 00000000..f2b7265a --- /dev/null +++ b/src/main/java/eu/webeid/security/validator/revocationcheck/RevocationInfo.java @@ -0,0 +1,13 @@ +// SPDX-FileCopyrightText: Estonian Information System Authority +// SPDX-License-Identifier: MIT +package eu.webeid.security.validator.revocationcheck; + +import java.net.URI; +import java.util.Map; + +public record RevocationInfo(URI ocspResponderUri, Map ocspResponseAttributes) { + + public static final String KEY_OCSP_RESPONSE = "OCSP_RESPONSE"; + public static final String KEY_OCSP_ERROR = "OCSP_ERROR"; + +} \ No newline at end of file diff --git a/src/main/java/eu/webeid/security/validator/revocationcheck/RevocationMode.java b/src/main/java/eu/webeid/security/validator/revocationcheck/RevocationMode.java new file mode 100644 index 00000000..eadbfbdc --- /dev/null +++ b/src/main/java/eu/webeid/security/validator/revocationcheck/RevocationMode.java @@ -0,0 +1,5 @@ +package eu.webeid.security.validator.revocationcheck; + +public enum RevocationMode { + PLATFORM_OCSP, CUSTOM_CHECKER, CUSTOM_PKIX, DISABLED +} diff --git a/src/test/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidatorTest.java b/src/test/java/eu/webeid/ocsp/OcspCertificateRevocationCheckerTest.java similarity index 68% rename from src/test/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidatorTest.java rename to src/test/java/eu/webeid/ocsp/OcspCertificateRevocationCheckerTest.java index bd85e373..e48c7590 100644 --- a/src/test/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidatorTest.java +++ b/src/test/java/eu/webeid/ocsp/OcspCertificateRevocationCheckerTest.java @@ -1,17 +1,20 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.certvalidators; +package eu.webeid.ocsp; import eu.webeid.security.exceptions.CertificateExpiredException; import eu.webeid.security.exceptions.CertificateNotTrustedException; import eu.webeid.security.exceptions.JceException; -import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException; -import eu.webeid.security.exceptions.UserCertificateRevokedException; +import eu.webeid.ocsp.exceptions.UserCertificateOCSPCheckFailedException; +import eu.webeid.ocsp.exceptions.UserCertificateRevokedException; +import eu.webeid.security.testutil.AbstractTestWithValidator; +import eu.webeid.security.testutil.AuthTokenValidators; import eu.webeid.security.util.DateAndTime; -import eu.webeid.security.validator.ocsp.OcspClient; -import eu.webeid.security.validator.ocsp.OcspClientImpl; -import eu.webeid.security.validator.ocsp.OcspServiceProvider; +import eu.webeid.ocsp.client.OcspClient; +import eu.webeid.ocsp.client.OcspClientImpl; +import eu.webeid.ocsp.service.OcspServiceProvider; +import eu.webeid.security.validator.AuthTokenValidator; import org.bouncycastle.asn1.ocsp.OCSPResponseStatus; import org.bouncycastle.cert.ocsp.OCSPException; import org.bouncycastle.cert.ocsp.OCSPResp; @@ -21,7 +24,6 @@ import java.io.IOException; import java.io.InputStream; -import java.lang.reflect.Field; import java.net.ConnectException; import java.net.URI; import java.net.URISyntaxException; @@ -37,33 +39,39 @@ import static eu.webeid.security.testutil.Certificates.getJaakKristjanEsteid2018Cert; import static eu.webeid.security.testutil.Certificates.getTestEsteid2018CA; import static eu.webeid.security.testutil.DateMocker.mockDate; -import static eu.webeid.security.testutil.OcspServiceMaker.getAiaOcspServiceProvider; -import static eu.webeid.security.testutil.OcspServiceMaker.getDesignatedOcspServiceProvider; -import static eu.webeid.security.validator.AuthTokenValidatorBuilderTest.CONFIGURATION; +import static eu.webeid.ocsp.service.OcspServiceMaker.getAiaOcspServiceProvider; +import static eu.webeid.ocsp.service.OcspServiceMaker.getDesignatedOcspServiceProvider; import static org.assertj.core.api.Assertions.assertThatCode; import static org.assertj.core.api.Assertions.assertThatExceptionOfType; +import static org.assertj.core.api.Assertions.assertThatThrownBy; import static org.mockito.Mockito.mock; import static org.mockito.Mockito.mockStatic; import static org.mockito.Mockito.when; -class SubjectCertificateNotRevokedValidatorTest { +class OcspCertificateRevocationCheckerTest extends AbstractTestWithValidator { private final OcspClient ocspClient = OcspClientImpl.build(Duration.ofSeconds(5)); - private SubjectCertificateTrustedValidator trustedValidator; private X509Certificate estEid2018Cert; + private X509Certificate testEsteid2018CA; @BeforeEach void setUp() throws Exception { - trustedValidator = new SubjectCertificateTrustedValidator(null, null); - setSubjectCertificateIssuerCertificate(trustedValidator); estEid2018Cert = getJaakKristjanEsteid2018Cert(); + testEsteid2018CA = getTestEsteid2018CA(); + } + + @Test + void whenCustomOcspCheckerWithDefaultConfigurationIsConfigured_thenValidationSucceeds() throws Exception { + final AuthTokenValidator validator = getAuthTokenValidatorWithOcspCertificateRevocationChecker(); + assertThatCode(() -> validator.validate(validAuthToken, VALID_CHALLENGE_NONCE)) + .doesNotThrowAnyException(); } @Test void whenValidAiaOcspResponderConfiguration_thenSucceeds() throws Exception { - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidator(ocspClient, getAiaOcspServiceProvider()); + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationChecker(ocspClient, getAiaOcspServiceProvider()); assertThatCode(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) .doesNotThrowAnyException(); } @@ -71,9 +79,9 @@ void whenValidAiaOcspResponderConfiguration_thenSucceeds() throws Exception { @Disabled("As new designated test OCSP responder certificates are issued more frequently now, it is no longer feasible to keep the certificates up to date") void whenValidDesignatedOcspResponderConfiguration_thenSucceeds() throws Exception { final OcspServiceProvider ocspServiceProvider = getDesignatedOcspServiceProvider(); - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidator(ocspServiceProvider); + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationChecker(ocspServiceProvider); assertThatCode(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) .doesNotThrowAnyException(); } @@ -81,18 +89,18 @@ void whenValidDesignatedOcspResponderConfiguration_thenSucceeds() throws Excepti @Disabled("As new designated test OCSP responder certificates are issued more frequently now, it is no longer feasible to keep the certificates up to date") void whenValidOcspNonceDisabledConfiguration_thenSucceeds() throws Exception { final OcspServiceProvider ocspServiceProvider = getDesignatedOcspServiceProvider(false); - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidator(ocspServiceProvider); + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationChecker(ocspServiceProvider); assertThatCode(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) .doesNotThrowAnyException(); } @Test void whenOcspUrlIsInvalid_thenThrows() throws Exception { final OcspServiceProvider ocspServiceProvider = getDesignatedOcspServiceProvider("http://invalid.invalid"); - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidator(ocspServiceProvider); + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationChecker(ocspServiceProvider); assertThatCode(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) .isInstanceOf(UserCertificateOCSPCheckFailedException.class) .cause() .isInstanceOf(ConnectException.class); @@ -101,9 +109,9 @@ void whenOcspUrlIsInvalid_thenThrows() throws Exception { @Test void whenOcspRequestFails_thenThrows() throws Exception { final OcspServiceProvider ocspServiceProvider = getDesignatedOcspServiceProvider("http://demo.sk.ee/ocsps"); - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidator(ocspServiceProvider); + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationChecker(ocspServiceProvider); assertThatCode(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) .isInstanceOf(UserCertificateOCSPCheckFailedException.class) .cause() .isInstanceOf(IOException.class) @@ -112,11 +120,11 @@ void whenOcspRequestFails_thenThrows() throws Exception { @Test void whenOcspRequestHasInvalidBody_thenThrows() throws Exception { - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp( + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationCheckerWithAiaOcsp( getMockedResponse("invalid".getBytes()) ); assertThatCode(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) .isInstanceOf(UserCertificateOCSPCheckFailedException.class) .cause() .isInstanceOf(IOException.class) @@ -125,44 +133,44 @@ void whenOcspRequestHasInvalidBody_thenThrows() throws Exception { @Test void whenOcspResponseIsNotSuccessful_thenThrows() throws Exception { - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp( + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationCheckerWithAiaOcsp( getMockedResponse(buildOcspResponseBodyWithInternalErrorStatus()) ); assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class) .isThrownBy(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) - .withMessage("User certificate revocation check has failed: Response status: internal error"); + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) + .withMessage("User certificate revocation check has failed: Response status: internal error (OCSP responder: http://aia.demo.sk.ee/esteid2018)"); } @Test void whenOcspResponseHasInvalidCertificateId_thenThrows() throws Exception { - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp( + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationCheckerWithAiaOcsp( getMockedResponse(buildOcspResponseBodyWithInvalidCertificateId()) ); assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class) .isThrownBy(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) - .withMessage("User certificate revocation check has failed: OCSP responded with certificate ID that differs from the requested ID"); + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) + .withMessage("User certificate revocation check has failed: OCSP responded with certificate ID that differs from the requested ID (OCSP responder: http://aia.demo.sk.ee/esteid2018)"); } @Test void whenOcspResponseHasInvalidSignature_thenThrows() throws Exception { - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp( + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationCheckerWithAiaOcsp( getMockedResponse(buildOcspResponseBodyWithInvalidSignature()) ); assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class) .isThrownBy(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) - .withMessage("User certificate revocation check has failed: OCSP response signature is invalid"); + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) + .withMessage("User certificate revocation check has failed: OCSP response signature is invalid (OCSP responder: http://aia.demo.sk.ee/esteid2018)"); } @Test void whenOcspResponseHasInvalidResponderCert_thenThrows() throws Exception { - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp( + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationCheckerWithAiaOcsp( getMockedResponse(buildOcspResponseBodyWithInvalidResponderCert()) ); assertThatCode(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) .isInstanceOf(UserCertificateOCSPCheckFailedException.class) .cause() .isInstanceOf(OCSPException.class) @@ -171,11 +179,11 @@ void whenOcspResponseHasInvalidResponderCert_thenThrows() throws Exception { @Test void whenOcspResponseHasInvalidTag_thenThrows() throws Exception { - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp( + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationCheckerWithAiaOcsp( getMockedResponse(buildOcspResponseBodyWithInvalidTag()) ); assertThatCode(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) .isInstanceOf(UserCertificateOCSPCheckFailedException.class) .cause() .isInstanceOf(OCSPException.class) @@ -184,37 +192,37 @@ void whenOcspResponseHasInvalidTag_thenThrows() throws Exception { @Test void whenOcspResponseHas2CertResponses_thenThrows() throws Exception { - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp( + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationCheckerWithAiaOcsp( getMockedResponse(getOcspResponseBytesFromResources("ocsp_response_with_2_responses.der")) ); assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class) .isThrownBy(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) - .withMessage("User certificate revocation check has failed: OCSP response must contain one response, received 2 responses instead"); + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) + .withMessage("User certificate revocation check has failed: OCSP response must contain one response, received 2 responses instead (OCSP responder: http://aia.demo.sk.ee/esteid2018)"); } @Disabled("It is difficult to make Python and Java CertId equal, needs more work") void whenOcspResponseHas2ResponderCerts_thenThrows() throws Exception { - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp( + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationCheckerWithAiaOcsp( getMockedResponse(getOcspResponseBytesFromResources("ocsp_response_with_2_responder_certs.der")) ); assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class) .isThrownBy(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) .withMessage("User certificate revocation check has failed: OCSP response must contain one responder certificate, received 2 certificates instead"); } @Test void whenOcspResponseRevoked_thenThrows() throws Exception { - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp( + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationCheckerWithAiaOcsp( getMockedResponse(getOcspResponseBytesFromResources("ocsp_response_revoked.der")) ); try (var mockedClock = mockStatic(DateAndTime.DefaultClock.class)) { mockDate("2021-09-18", mockedClock); assertThatExceptionOfType(UserCertificateRevokedException.class) .isThrownBy(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) - .withMessage("User certificate has been revoked: Revocation reason: 0"); + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) + .withMessage("User certificate has been revoked: Revocation reason: 0 (OCSP responder: http://aia.demo.sk.ee/esteid2018)"); } } @@ -222,55 +230,79 @@ void whenOcspResponseRevoked_thenThrows() throws Exception { void whenOcspResponseUnknown_thenThrows() throws Exception { final OcspServiceProvider ocspServiceProvider = getDesignatedOcspServiceProvider("https://web-eid-test.free.beeceptor.com"); final HttpResponse response = getMockedResponse(getOcspResponseBytesFromResources("ocsp_response_unknown.der")); - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidator(getMockClient(response), ocspServiceProvider); + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationChecker(getMockClient(response), ocspServiceProvider); try (var mockedClock = mockStatic(DateAndTime.DefaultClock.class)) { mockDate("2021-09-18T00:16:25", mockedClock); assertThatExceptionOfType(UserCertificateRevokedException.class) .isThrownBy(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) - .withMessage("User certificate has been revoked: Unknown status"); + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) + .withMessage("User certificate has been revoked: Unknown status (OCSP responder: https://web-eid-test.free.beeceptor.com)"); } } @Test void whenOcspResponseCACertNotTrusted_thenThrows() throws Exception { - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp( + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationCheckerWithAiaOcsp( getMockedResponse(getOcspResponseBytesFromResources("ocsp_response_unknown.der")) ); try (var mockedClock = mockStatic(DateAndTime.DefaultClock.class)) { mockDate("2021-09-18T00:16:25", mockedClock); assertThatExceptionOfType(CertificateNotTrustedException.class) .isThrownBy(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) .withMessage("Certificate EMAILADDRESS=pki@sk.ee, CN=TEST of SK OCSP RESPONDER 2020, OU=OCSP, O=AS Sertifitseerimiskeskus, C=EE is not trusted"); } } @Test void whenOcspResponseCACertExpired_thenThrows() throws Exception { - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp( + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationCheckerWithAiaOcsp( getMockedResponse(getOcspResponseBytesFromResources("ocsp_response_unknown.der")) ); assertThatExceptionOfType(CertificateExpiredException.class) .isThrownBy(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) .withMessage("AIA OCSP responder certificate has expired"); } @Test void whenNonceDiffers_thenThrows() throws Exception { - final SubjectCertificateNotRevokedValidator validator = getSubjectCertificateNotRevokedValidatorWithAiaOcsp( + final OcspCertificateRevocationChecker validator = getOcspCertificateRevocationCheckerWithAiaOcsp( getMockedResponse(getOcspResponseBytesFromResources()) ); try (var mockedClock = mockStatic(DateAndTime.DefaultClock.class)) { mockDate("2021-09-17T18:25:24", mockedClock); assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class) .isThrownBy(() -> - validator.validateCertificateNotRevoked(estEid2018Cert)) - .withMessage("User certificate revocation check has failed: OCSP request and response nonces differ, possible replay attack"); + validator.validateCertificateNotRevoked(estEid2018Cert, testEsteid2018CA)) + .withMessage("User certificate revocation check has failed: OCSP request and response nonces differ, possible replay attack (OCSP responder: http://aia.demo.sk.ee/esteid2018)"); } } + @Test + void whenInvalidOcspResponseTimeSkew_thenThrows() { + assertThatThrownBy(() -> getOcspCertificateRevocationCheckerWithTimeSkewAndUpdateAge(Duration.ofMinutes(-1), Duration.ofMinutes(1))) + .isInstanceOf(IllegalArgumentException.class) + .hasMessageStartingWith("allowedOcspResponseTimeSkew must be greater than zero"); + } + + @Test + void whenInvalidMaxOcspResponseThisUpdateAge_thenThrows() { + assertThatThrownBy(() -> getOcspCertificateRevocationCheckerWithTimeSkewAndUpdateAge(Duration.ofMinutes(1), Duration.ZERO)) + .isInstanceOf(IllegalArgumentException.class) + .hasMessageStartingWith("maxOcspResponseThisUpdateAge must be greater than zero"); + } + + private static AuthTokenValidator getAuthTokenValidatorWithOcspCertificateRevocationChecker() throws CertificateException, JceException, IOException { + return AuthTokenValidators.getDefaultAuthTokenValidatorBuilder() + .withCertificateRevocationChecker(new OcspCertificateRevocationChecker( + OcspClientImpl.build(Duration.ofSeconds(5)), + getAiaOcspServiceProvider(), + OcspCertificateRevocationChecker.DEFAULT_TIME_SKEW, + OcspCertificateRevocationChecker.DEFAULT_THIS_UPDATE_AGE + )).build(); + } + private static byte[] buildOcspResponseBodyWithInternalErrorStatus() throws IOException { final byte[] ocspResponseBytes = getOcspResponseBytesFromResources(); final int STATUS_OFFSET = 6; @@ -319,22 +351,20 @@ private static byte[] getOcspResponseBytesFromResources(String resource) throws } } - private SubjectCertificateNotRevokedValidator getSubjectCertificateNotRevokedValidatorWithAiaOcsp(HttpResponse response) throws JceException { - return getSubjectCertificateNotRevokedValidator(getMockClient(response), getAiaOcspServiceProvider()); + private OcspCertificateRevocationChecker getOcspCertificateRevocationCheckerWithAiaOcsp(HttpResponse response) throws JceException { + return getOcspCertificateRevocationChecker(getMockClient(response), getAiaOcspServiceProvider()); } - private SubjectCertificateNotRevokedValidator getSubjectCertificateNotRevokedValidator(OcspServiceProvider ocspServiceProvider) { - return getSubjectCertificateNotRevokedValidator(ocspClient, ocspServiceProvider); + private OcspCertificateRevocationChecker getOcspCertificateRevocationChecker(OcspServiceProvider ocspServiceProvider) { + return getOcspCertificateRevocationChecker(ocspClient, ocspServiceProvider); } - private SubjectCertificateNotRevokedValidator getSubjectCertificateNotRevokedValidator(OcspClient client, OcspServiceProvider ocspServiceProvider) { - return new SubjectCertificateNotRevokedValidator(trustedValidator, client, ocspServiceProvider, CONFIGURATION.getAllowedOcspResponseTimeSkew(), CONFIGURATION.getMaxOcspResponseThisUpdateAge()); + private OcspCertificateRevocationChecker getOcspCertificateRevocationChecker(OcspClient client, OcspServiceProvider ocspServiceProvider) { + return new OcspCertificateRevocationChecker(client, ocspServiceProvider, OcspCertificateRevocationChecker.DEFAULT_TIME_SKEW, OcspCertificateRevocationChecker.DEFAULT_THIS_UPDATE_AGE); } - private static void setSubjectCertificateIssuerCertificate(SubjectCertificateTrustedValidator trustedValidator) throws NoSuchFieldException, IllegalAccessException, CertificateException, IOException { - final Field field = trustedValidator.getClass().getDeclaredField("subjectCertificateIssuerCertificate"); - field.setAccessible(true); - field.set(trustedValidator, getTestEsteid2018CA()); + private void getOcspCertificateRevocationCheckerWithTimeSkewAndUpdateAge(Duration timeSkew, Duration updateAge) throws JceException { + new OcspCertificateRevocationChecker(ocspClient, getAiaOcspServiceProvider(), timeSkew, updateAge); } private HttpResponse getMockedResponse(byte[] bodyContent) throws URISyntaxException { diff --git a/src/test/java/eu/webeid/security/validator/ocsp/OcspClientOverrideTest.java b/src/test/java/eu/webeid/ocsp/client/OcspClientOverrideTest.java similarity index 63% rename from src/test/java/eu/webeid/security/validator/ocsp/OcspClientOverrideTest.java rename to src/test/java/eu/webeid/ocsp/client/OcspClientOverrideTest.java index 40a1ccde..6108f915 100644 --- a/src/test/java/eu/webeid/security/validator/ocsp/OcspClientOverrideTest.java +++ b/src/test/java/eu/webeid/ocsp/client/OcspClientOverrideTest.java @@ -1,8 +1,9 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.ocsp; +package eu.webeid.ocsp.client; +import eu.webeid.ocsp.OcspCertificateRevocationChecker; import eu.webeid.security.exceptions.JceException; import eu.webeid.security.testutil.AbstractTestWithValidator; import eu.webeid.security.testutil.AuthTokenValidators; @@ -12,7 +13,6 @@ import org.bouncycastle.cert.ocsp.OCSPResp; import org.junit.jupiter.api.AfterEach; import org.junit.jupiter.api.BeforeEach; -import org.junit.jupiter.api.Disabled; import org.junit.jupiter.api.Test; import org.mockito.MockedStatic; @@ -22,6 +22,7 @@ import java.security.cert.CertificateException; import java.time.Duration; +import static eu.webeid.ocsp.service.OcspServiceMaker.getAiaOcspServiceProvider; import static eu.webeid.security.testutil.DateMocker.mockDate; import static org.assertj.core.api.Assertions.assertThatCode; import static org.assertj.core.api.Assertions.assertThatThrownBy; @@ -46,22 +47,41 @@ void tearDown() { @Test void whenOcspClientIsOverridden_thenItIsUsed() throws JceException, CertificateException, IOException { - final AuthTokenValidator validator = AuthTokenValidators.getAuthTokenValidatorWithOverriddenOcspClient(new OcpClientThatThrows()); + final AuthTokenValidator validator = getAuthTokenValidatorWithOverriddenOcspClient(new OcpClientThatThrows()); assertThatThrownBy(() -> validator.validate(validAuthToken, VALID_CHALLENGE_NONCE)) .cause() .isInstanceOf(OcpClientThatThrowsException.class); } @Test - @Disabled("Demonstrates how to configure the built-in HttpClient instance for OcspClientImpl") + void whenInvalidOcspRequestTimeout_thenThrows() { + assertThatThrownBy(() -> OcspClientImpl.build(Duration.ofMinutes(-1))) + .isInstanceOf(IllegalArgumentException.class) + .hasMessageStartingWith("ocspRequestTimeout must be greater than zero"); + } + + /** + * Demonstrates how to configure the built-in HttpClient instance for OcspClientImpl. + */ + @Test void whenOcspClientIsConfiguredWithCustomHttpClient_thenOcspCallSucceeds() throws JceException, CertificateException, IOException { - final AuthTokenValidator validator = AuthTokenValidators.getAuthTokenValidatorWithOverriddenOcspClient( + final AuthTokenValidator validator = getAuthTokenValidatorWithOverriddenOcspClient( new OcspClientImpl(HttpClient.newBuilder().build(), Duration.ofSeconds(5)) ); assertThatCode(() -> validator.validate(validAuthToken, VALID_CHALLENGE_NONCE)) .doesNotThrowAnyException(); } + private static AuthTokenValidator getAuthTokenValidatorWithOverriddenOcspClient(OcspClient ocspClient) throws CertificateException, JceException, IOException { + return AuthTokenValidators.getDefaultAuthTokenValidatorBuilder() + .withCertificateRevocationChecker(new OcspCertificateRevocationChecker( + ocspClient, + getAiaOcspServiceProvider(), + OcspCertificateRevocationChecker.DEFAULT_TIME_SKEW, + OcspCertificateRevocationChecker.DEFAULT_THIS_UPDATE_AGE + )).build(); + } + private static class OcpClientThatThrows implements OcspClient { @Override public OCSPResp request(URI url, OCSPReq request) throws IOException { diff --git a/src/test/java/eu/webeid/security/validator/ocsp/OcspResponseValidatorTest.java b/src/test/java/eu/webeid/ocsp/protocol/OcspResponseValidatorTest.java similarity index 84% rename from src/test/java/eu/webeid/security/validator/ocsp/OcspResponseValidatorTest.java rename to src/test/java/eu/webeid/ocsp/protocol/OcspResponseValidatorTest.java index db66ada5..01f5daed 100644 --- a/src/test/java/eu/webeid/security/validator/ocsp/OcspResponseValidatorTest.java +++ b/src/test/java/eu/webeid/ocsp/protocol/OcspResponseValidatorTest.java @@ -1,19 +1,20 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.ocsp; +package eu.webeid.ocsp.protocol; -import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException; +import eu.webeid.ocsp.OcspCertificateRevocationChecker; +import eu.webeid.ocsp.exceptions.UserCertificateOCSPCheckFailedException; import org.bouncycastle.cert.ocsp.SingleResp; import org.junit.jupiter.api.Test; +import java.net.URI; import java.time.Duration; import java.time.Instant; import java.time.temporal.ChronoUnit; import java.util.Date; -import static eu.webeid.security.validator.AuthTokenValidatorBuilderTest.CONFIGURATION; -import static eu.webeid.security.validator.ocsp.OcspResponseValidator.validateCertificateStatusUpdateTime; +import static eu.webeid.ocsp.protocol.OcspResponseValidator.validateCertificateStatusUpdateTime; import static org.assertj.core.api.Assertions.assertThatCode; import static org.assertj.core.api.Assertions.assertThatExceptionOfType; import static org.mockito.Mockito.mock; @@ -21,8 +22,9 @@ class OcspResponseValidatorTest { - private static final Duration TIME_SKEW = CONFIGURATION.getAllowedOcspResponseTimeSkew(); - private static final Duration THIS_UPDATE_AGE = CONFIGURATION.getMaxOcspResponseThisUpdateAge(); + private static final Duration TIME_SKEW = OcspCertificateRevocationChecker.DEFAULT_TIME_SKEW; + private static final Duration THIS_UPDATE_AGE = OcspCertificateRevocationChecker.DEFAULT_THIS_UPDATE_AGE; + private static final URI OCSP_URL = URI.create("https://example.org"); @Test void whenThisAndNextUpdateWithinSkew_thenValidationSucceeds() { @@ -32,7 +34,7 @@ void whenThisAndNextUpdateWithinSkew_thenValidationSucceeds() { var nextUpdateWithinAgeLimit = Date.from(now.minus(THIS_UPDATE_AGE.minusSeconds(2))); when(mockResponse.getThisUpdate()).thenReturn(thisUpdateWithinAgeLimit); when(mockResponse.getNextUpdate()).thenReturn(nextUpdateWithinAgeLimit); - assertThatCode(() -> validateCertificateStatusUpdateTime(mockResponse, TIME_SKEW, THIS_UPDATE_AGE)) + assertThatCode(() -> validateCertificateStatusUpdateTime(mockResponse, TIME_SKEW, THIS_UPDATE_AGE, OCSP_URL)) .doesNotThrowAnyException(); } @@ -46,7 +48,7 @@ void whenNextUpdateBeforeThisUpdate_thenThrows() { when(mockResponse.getNextUpdate()).thenReturn(beforeThisUpdate); assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class) .isThrownBy(() -> - validateCertificateStatusUpdateTime(mockResponse, TIME_SKEW, THIS_UPDATE_AGE)) + validateCertificateStatusUpdateTime(mockResponse, TIME_SKEW, THIS_UPDATE_AGE, OCSP_URL)) .withMessageStartingWith("User certificate revocation check has failed: " + "Certificate status update time check failed: " + "nextUpdate '" + beforeThisUpdate.toInstant() + "' is before thisUpdate '" + thisUpdateWithinAgeLimit.toInstant() + "'"); @@ -60,7 +62,7 @@ void whenThisUpdateHalfHourBeforeNow_thenThrows() { when(mockResponse.getThisUpdate()).thenReturn(halfHourBeforeNow); assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class) .isThrownBy(() -> - validateCertificateStatusUpdateTime(mockResponse, TIME_SKEW, THIS_UPDATE_AGE)) + validateCertificateStatusUpdateTime(mockResponse, TIME_SKEW, THIS_UPDATE_AGE, OCSP_URL)) .withMessageStartingWith("User certificate revocation check has failed: " + "Certificate status update time check failed: " + "thisUpdate '" + halfHourBeforeNow.toInstant() + "' is too old, minimum time allowed: "); @@ -74,7 +76,7 @@ void whenThisUpdateHalfHourAfterNow_thenThrows() { when(mockResponse.getThisUpdate()).thenReturn(halfHourAfterNow); assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class) .isThrownBy(() -> - validateCertificateStatusUpdateTime(mockResponse, TIME_SKEW, THIS_UPDATE_AGE)) + validateCertificateStatusUpdateTime(mockResponse, TIME_SKEW, THIS_UPDATE_AGE, OCSP_URL)) .withMessageStartingWith("User certificate revocation check has failed: " + "Certificate status update time check failed: " + "thisUpdate '" + halfHourAfterNow.toInstant() + "' is too far in the future, latest allowed: "); @@ -90,10 +92,11 @@ void whenNextUpdateHalfHourBeforeNow_thenThrows() { when(mockResponse.getNextUpdate()).thenReturn(halfHourBeforeNow); assertThatExceptionOfType(UserCertificateOCSPCheckFailedException.class) .isThrownBy(() -> - validateCertificateStatusUpdateTime(mockResponse, TIME_SKEW, THIS_UPDATE_AGE)) + validateCertificateStatusUpdateTime(mockResponse, TIME_SKEW, THIS_UPDATE_AGE, OCSP_URL)) .withMessage("User certificate revocation check has failed: " + "Certificate status update time check failed: " - + "nextUpdate '" + halfHourBeforeNow.toInstant() + "' is in the past"); + + "nextUpdate '" + halfHourBeforeNow.toInstant() + "' is in the past" + + " (OCSP responder: https://example.org)"); } private static Date getThisUpdateWithinAgeLimit(Instant now) { diff --git a/src/test/java/eu/webeid/security/validator/ocsp/OcspUrlTest.java b/src/test/java/eu/webeid/ocsp/protocol/OcspUrlTest.java similarity index 93% rename from src/test/java/eu/webeid/security/validator/ocsp/OcspUrlTest.java rename to src/test/java/eu/webeid/ocsp/protocol/OcspUrlTest.java index 0ceca574..12314dc4 100644 --- a/src/test/java/eu/webeid/security/validator/ocsp/OcspUrlTest.java +++ b/src/test/java/eu/webeid/ocsp/protocol/OcspUrlTest.java @@ -1,7 +1,7 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.ocsp; +package eu.webeid.ocsp.protocol; import org.junit.jupiter.api.Test; @@ -11,7 +11,7 @@ import static org.mockito.ArgumentMatchers.anyString; import static org.mockito.Mockito.mock; import static org.mockito.Mockito.when; -import static eu.webeid.security.validator.ocsp.OcspUrl.getOcspUri; +import static eu.webeid.ocsp.protocol.OcspUrl.getOcspUri; class OcspUrlTest { diff --git a/src/test/java/eu/webeid/security/testutil/OcspServiceMaker.java b/src/test/java/eu/webeid/ocsp/service/OcspServiceMaker.java similarity index 86% rename from src/test/java/eu/webeid/security/testutil/OcspServiceMaker.java rename to src/test/java/eu/webeid/ocsp/service/OcspServiceMaker.java index c8cf1120..d7b6af1c 100644 --- a/src/test/java/eu/webeid/security/testutil/OcspServiceMaker.java +++ b/src/test/java/eu/webeid/ocsp/service/OcspServiceMaker.java @@ -1,26 +1,22 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.testutil; +package eu.webeid.ocsp.service; import eu.webeid.security.certificate.CertificateValidator; import eu.webeid.security.exceptions.JceException; -import eu.webeid.security.exceptions.OCSPCertificateException; -import eu.webeid.security.validator.ocsp.OcspServiceProvider; -import eu.webeid.security.validator.ocsp.service.AiaOcspServiceConfiguration; -import eu.webeid.security.validator.ocsp.service.DesignatedOcspServiceConfiguration; +import eu.webeid.ocsp.exceptions.OCSPCertificateException; import java.io.IOException; import java.net.URI; import java.security.cert.CertificateException; import java.security.cert.X509Certificate; -import java.util.Arrays; import java.util.List; +import java.util.Set; import static eu.webeid.security.testutil.Certificates.getTestEsteid2015CA; import static eu.webeid.security.testutil.Certificates.getTestEsteid2018CA; import static eu.webeid.security.testutil.Certificates.getTestSkOcspResponder2020; -import static eu.webeid.security.util.Collections.newHashSet; public class OcspServiceMaker { @@ -30,7 +26,7 @@ public class OcspServiceMaker { static { try { - TRUSTED_CA_CERTIFICATES = Arrays.asList(getTestEsteid2018CA(), getTestEsteid2015CA()); + TRUSTED_CA_CERTIFICATES = List.of(getTestEsteid2018CA(), getTestEsteid2015CA()); } catch (CertificateException | IOException e) { throw new ExceptionInInitializerError(e); } @@ -54,7 +50,7 @@ public static OcspServiceProvider getDesignatedOcspServiceProvider(String ocspSe private static AiaOcspServiceConfiguration getAiaOcspServiceConfiguration() throws JceException { return new AiaOcspServiceConfiguration( - newHashSet(TEST_ESTEID_2015), + Set.of(TEST_ESTEID_2015), CertificateValidator.buildTrustAnchorsFromCertificates(TRUSTED_CA_CERTIFICATES), CertificateValidator.buildCertStoreFromCertificates(TRUSTED_CA_CERTIFICATES)); } diff --git a/src/test/java/eu/webeid/security/validator/ocsp/OcspServiceProviderTest.java b/src/test/java/eu/webeid/ocsp/service/OcspServiceProviderTest.java similarity index 66% rename from src/test/java/eu/webeid/security/validator/ocsp/OcspServiceProviderTest.java rename to src/test/java/eu/webeid/ocsp/service/OcspServiceProviderTest.java index 46c75897..f4db501f 100644 --- a/src/test/java/eu/webeid/security/validator/ocsp/OcspServiceProviderTest.java +++ b/src/test/java/eu/webeid/ocsp/service/OcspServiceProviderTest.java @@ -1,20 +1,25 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -package eu.webeid.security.validator.ocsp; +package eu.webeid.ocsp.service; import org.bouncycastle.cert.X509CertificateHolder; import org.junit.jupiter.api.Test; -import eu.webeid.security.exceptions.OCSPCertificateException; -import eu.webeid.security.validator.ocsp.service.OcspService; +import eu.webeid.ocsp.exceptions.OCSPCertificateException; import java.net.URI; import java.util.Date; -import static org.assertj.core.api.Assertions.*; -import static eu.webeid.security.testutil.Certificates.*; -import static eu.webeid.security.testutil.OcspServiceMaker.getAiaOcspServiceProvider; -import static eu.webeid.security.testutil.OcspServiceMaker.getDesignatedOcspServiceProvider; +import static eu.webeid.ocsp.service.OcspServiceMaker.getAiaOcspServiceProvider; +import static eu.webeid.ocsp.service.OcspServiceMaker.getDesignatedOcspServiceProvider; +import static eu.webeid.security.testutil.Certificates.getJaakKristjanEsteid2018Cert; +import static eu.webeid.security.testutil.Certificates.getMariliisEsteid2015Cert; +import static eu.webeid.security.testutil.Certificates.getTestEsteid2015CA; +import static eu.webeid.security.testutil.Certificates.getTestEsteid2018CA; +import static eu.webeid.security.testutil.Certificates.getTestSkOcspResponder2020; +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatCode; +import static org.assertj.core.api.Assertions.assertThatExceptionOfType; class OcspServiceProviderTest { @@ -64,3 +69,16 @@ void whenAiaOcspServiceConfigurationDoesNotHaveResponderCertTrustedCA_thenThrows } } + +// Old disabled example AuthTokenValidator test with designated OCSP check. +// +// @Test +// @Disabled("A new designated test OCSP responder certificate was issued whose validity period no longer overlaps with the revoked certificate") +// void whenCertificateIsRevoked_thenOcspCheckWithDesignatedOcspServiceFails() throws Exception { +// mockDate("2020-01-01", mockedClock); +// final AuthTokenValidator validatorWithOcspCheck = AuthTokenValidators.getAuthTokenValidatorWithDesignatedOcspCheck(); +// final WebEidAuthToken token = replaceTokenField(AUTH_TOKEN, "X5C", REVOKED_CERT); +// assertThatThrownBy(() -> validatorWithOcspCheck +// .validate(token, VALID_CHALLENGE_NONCE)) +// .isInstanceOf(UserCertificateRevokedException.class); +// } \ No newline at end of file diff --git a/src/test/java/eu/webeid/security/certificate/CertificateValidatorTest.java b/src/test/java/eu/webeid/security/certificate/CertificateValidatorTest.java new file mode 100644 index 00000000..5e6d1a22 --- /dev/null +++ b/src/test/java/eu/webeid/security/certificate/CertificateValidatorTest.java @@ -0,0 +1,267 @@ +/* + * Copyright (c) 2020-2025 Estonian Information System Authority + * + * Permission is hereby granted, free of charge, to any person obtaining a copy + * of this software and associated documentation files (the "Software"), to deal + * in the Software without restriction, including without limitation the rights + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + * copies of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be included in all + * copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + * SOFTWARE. + */ + +package eu.webeid.security.certificate; + +import eu.webeid.security.exceptions.CertificateNotTrustedException; +import eu.webeid.security.testutil.Certificates; +import eu.webeid.security.validator.revocationcheck.RevocationInfo; +import eu.webeid.security.validator.revocationcheck.RevocationMode; +import org.junit.jupiter.api.Test; + +import java.net.URI; +import java.security.cert.CertPathValidatorException; +import java.security.cert.CertStore; +import java.security.cert.Certificate; +import java.security.cert.PKIXRevocationChecker; +import java.security.cert.TrustAnchor; +import java.security.cert.X509Certificate; +import java.util.Collection; +import java.util.Date; +import java.util.List; +import java.util.Set; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; + +class CertificateValidatorTest { + + private static final Date NOW = new Date(1627776000000L); + + @Test + void whenRevocationDisabled_thenValidationSucceedsWithoutRevocationInfo() throws Exception { + final X509Certificate subject = Certificates.getJaakKristjanEsteid2018Cert(); + final X509Certificate issuer = Certificates.getTestEsteid2018CA(); + + final List revocationInfo = CertificateValidator.validateCertificateTrustAndRevocation( + subject, + trustAnchors(issuer), + certStore(issuer), + NOW, + RevocationMode.DISABLED, + null, + null + ); + + assertThat(revocationInfo).isEmpty(); + } + + @Test + void whenRevocationDisabledAndCheckerProvided_thenThrows() throws Exception { + final X509Certificate subject = Certificates.getJaakKristjanEsteid2018Cert(); + final X509Certificate issuer = Certificates.getTestEsteid2018CA(); + + assertThatThrownBy(() -> CertificateValidator.validateCertificateTrustAndRevocation( + subject, + trustAnchors(issuer), + certStore(issuer), + NOW, + RevocationMode.DISABLED, + (s, i) -> List.of(), + null + )) + .isInstanceOf(IllegalArgumentException.class) + .hasMessageStartingWith("customPkixRevocationChecker and certificateRevocationChecker must be null when revocationMode is DISABLED"); + } + + @Test + void whenCustomCheckerMissing_thenThrows() throws Exception { + final X509Certificate subject = Certificates.getJaakKristjanEsteid2018Cert(); + final X509Certificate issuer = Certificates.getTestEsteid2018CA(); + + assertThatThrownBy(() -> CertificateValidator.validateCertificateTrustAndRevocation( + subject, + trustAnchors(issuer), + certStore(issuer), + NOW, + RevocationMode.CUSTOM_CHECKER, + null, + null + )) + .isInstanceOf(IllegalArgumentException.class) + .hasMessageStartingWith("certificateRevocationChecker must be provided when revocationMode is CUSTOM_OCSP"); + } + + @Test + void whenCustomCheckerAndCustomPkixProvided_thenThrows() throws Exception { + final X509Certificate subject = Certificates.getJaakKristjanEsteid2018Cert(); + final X509Certificate issuer = Certificates.getTestEsteid2018CA(); + + assertThatThrownBy(() -> CertificateValidator.validateCertificateTrustAndRevocation( + subject, + trustAnchors(issuer), + certStore(issuer), + NOW, + RevocationMode.CUSTOM_CHECKER, + (s, i) -> List.of(), + new NoopPkixRevocationChecker() + )) + .isInstanceOf(IllegalArgumentException.class) + .hasMessageStartingWith("customPkixRevocationChecker must be null when revocationMode is CUSTOM_OCSP"); + } + + @Test + void whenCustomCheckerReturnsRevocationInfo_thenItIsReturned() throws Exception { + final X509Certificate subject = Certificates.getJaakKristjanEsteid2018Cert(); + final X509Certificate issuer = Certificates.getTestEsteid2018CA(); + final RevocationInfo expected = new RevocationInfo( + URI.create("http://ocsp.example"), + null + ); + + final List revocationInfo = CertificateValidator.validateCertificateTrustAndRevocation( + subject, + trustAnchors(issuer), + certStore(issuer), + NOW, + RevocationMode.CUSTOM_CHECKER, + (s, i) -> List.of(expected), + null + ); + + assertThat(revocationInfo).containsExactly(expected); + } + + @Test + void whenCustomPkixMissing_thenThrows() throws Exception { + final X509Certificate subject = Certificates.getJaakKristjanEsteid2018Cert(); + final X509Certificate issuer = Certificates.getTestEsteid2018CA(); + + assertThatThrownBy(() -> CertificateValidator.validateCertificateTrustAndRevocation( + subject, + trustAnchors(issuer), + certStore(issuer), + NOW, + RevocationMode.CUSTOM_PKIX, + null, + null + )) + .isInstanceOf(IllegalArgumentException.class) + .hasMessageStartingWith("customPkixRevocationChecker must be provided when revocationMode is CUSTOM_PKIX"); + } + + @Test + void whenCustomPkixAndCustomCheckerProvided_thenThrows() throws Exception { + final X509Certificate subject = Certificates.getJaakKristjanEsteid2018Cert(); + final X509Certificate issuer = Certificates.getTestEsteid2018CA(); + + assertThatThrownBy(() -> CertificateValidator.validateCertificateTrustAndRevocation( + subject, + trustAnchors(issuer), + certStore(issuer), + NOW, + RevocationMode.CUSTOM_PKIX, + (s, i) -> List.of(), + new NoopPkixRevocationChecker() + )) + .isInstanceOf(IllegalArgumentException.class) + .hasMessageStartingWith("certificateRevocationChecker must be null when revocationMode is CUSTOM_PKIX"); + } + + @Test + void whenCustomPkixWithOcspResponder_thenRevocationInfoContainsResponder() throws Exception { + final X509Certificate subject = Certificates.getJaakKristjanEsteid2018Cert(); + final X509Certificate issuer = Certificates.getTestEsteid2018CA(); + final NoopPkixRevocationChecker checker = new NoopPkixRevocationChecker(); + checker.setOcspResponder(URI.create("http://ocsp.example")); + + final List revocationInfo = CertificateValidator.validateCertificateTrustAndRevocation( + subject, + trustAnchors(issuer), + certStore(issuer), + NOW, + RevocationMode.CUSTOM_PKIX, + null, + checker + ); + + assertThat(revocationInfo).containsExactly(new RevocationInfo(checker.getOcspResponder(), null)); + } + + @Test + void whenPlatformOcspHasCustomChecker_thenThrows() throws Exception { + final X509Certificate subject = Certificates.getJaakKristjanEsteid2018Cert(); + final X509Certificate issuer = Certificates.getTestEsteid2018CA(); + + assertThatThrownBy(() -> CertificateValidator.validateCertificateTrustAndRevocation( + subject, + trustAnchors(issuer), + certStore(issuer), + NOW, + RevocationMode.PLATFORM_OCSP, + (s, i) -> List.of(), + null + )) + .isInstanceOf(IllegalArgumentException.class) + .hasMessageStartingWith("customPkixRevocationChecker and certificateRevocationChecker must be null when revocationMode is PLATFORM_OCSP"); + } + + @Test + void whenPlatformOcspWithUntrustedIssuer_thenThrowsCertificateNotTrusted() throws Exception { + final X509Certificate subject = Certificates.getJaakKristjanEsteid2018Cert(); + final X509Certificate wrongIssuer = Certificates.getTestEsteid2015CA(); + + assertThatThrownBy(() -> CertificateValidator.validateCertificateTrustAndRevocation( + subject, + trustAnchors(wrongIssuer), + certStore(wrongIssuer), + NOW, + RevocationMode.PLATFORM_OCSP, + null, + null + )) + .isInstanceOf(CertificateNotTrustedException.class); + } + + private static Set trustAnchors(X509Certificate issuer) { + return CertificateValidator.buildTrustAnchorsFromCertificates(List.of(issuer)); + } + + private static CertStore certStore(X509Certificate issuer) throws Exception { + return CertificateValidator.buildCertStoreFromCertificates(List.of(issuer)); + } + + private static final class NoopPkixRevocationChecker extends PKIXRevocationChecker { + @Override + public void init(boolean forward) { + } + + @Override + public boolean isForwardCheckingSupported() { + return false; + } + + @Override + public Set getSupportedExtensions() { + return null; + } + + @Override + public void check(Certificate cert, Collection unresolvedCritExts) { + } + + @Override + public List getSoftFailExceptions() { + return List.of(); + } + } +} diff --git a/src/test/java/eu/webeid/security/testutil/AuthTokenValidators.java b/src/test/java/eu/webeid/security/testutil/AuthTokenValidators.java index 51e8fabd..fd7348e2 100644 --- a/src/test/java/eu/webeid/security/testutil/AuthTokenValidators.java +++ b/src/test/java/eu/webeid/security/testutil/AuthTokenValidators.java @@ -5,19 +5,14 @@ import eu.webeid.security.certificate.CertificateLoader; import eu.webeid.security.exceptions.JceException; -import eu.webeid.security.exceptions.OCSPCertificateException; import eu.webeid.security.validator.AuthTokenValidator; import eu.webeid.security.validator.AuthTokenValidatorBuilder; -import eu.webeid.security.validator.ocsp.OcspClient; import org.bouncycastle.asn1.ASN1ObjectIdentifier; import java.io.IOException; import java.net.URI; import java.security.cert.CertificateException; import java.security.cert.X509Certificate; -import java.time.Duration; - -import static eu.webeid.security.testutil.OcspServiceMaker.getDesignatedOcspServiceConfiguration; public final class AuthTokenValidators { @@ -34,16 +29,7 @@ public static AuthTokenValidator getAuthTokenValidator(String url) throws Certif public static AuthTokenValidator getAuthTokenValidator(String url, X509Certificate... certificates) throws JceException { return getAuthTokenValidatorBuilder(url, certificates) - // Assure that all builder methods are covered with tests. - .withOcspRequestTimeout(Duration.ofSeconds(1)) - .withNonceDisabledOcspUrls(URI.create("http://example.org")) - .withoutUserCertificateRevocationCheckWithOcsp() - .build(); - } - - public static AuthTokenValidator getAuthTokenValidatorWithOverriddenOcspClient(OcspClient ocspClient) throws CertificateException, JceException, IOException { - return getAuthTokenValidatorBuilder(TOKEN_ORIGIN_URL, getCACertificates()) - .withOcspClient(ocspClient) + .withoutUserCertificateRevocationCheck() .build(); } @@ -52,12 +38,6 @@ public static AuthTokenValidator getAuthTokenValidatorWithOcspCheck() throws Cer .build(); } - public static AuthTokenValidator getAuthTokenValidatorWithDesignatedOcspCheck() throws CertificateException, JceException, IOException, OCSPCertificateException { - return getAuthTokenValidatorBuilder(TOKEN_ORIGIN_URL, getCACertificates()) - .withDesignatedOcspServiceConfiguration(getDesignatedOcspServiceConfiguration()) - .build(); - } - public static AuthTokenValidator getAuthTokenValidatorWithWrongTrustedCA() throws CertificateException, JceException, IOException { return getAuthTokenValidator(TOKEN_ORIGIN_URL, CertificateLoader.loadCertificatesFromResources("ESTEID2018.cer")); @@ -71,7 +51,7 @@ public static AuthTokenValidator getAuthTokenValidatorWithJuly2024ExpiredUnrelat public static AuthTokenValidator getAuthTokenValidatorWithDisallowedESTEIDPolicy() throws CertificateException, JceException, IOException { return getAuthTokenValidatorBuilder(TOKEN_ORIGIN_URL, getCACertificates()) .withDisallowedCertificatePolicies(EST_IDEMIA_POLICY) - .withoutUserCertificateRevocationCheckWithOcsp() + .withoutUserCertificateRevocationCheck() .build(); } diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenCertificateTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenCertificateTest.java index a13d0e3d..6ea7802f 100644 --- a/src/test/java/eu/webeid/security/validator/AuthTokenCertificateTest.java +++ b/src/test/java/eu/webeid/security/validator/AuthTokenCertificateTest.java @@ -13,7 +13,7 @@ import eu.webeid.security.exceptions.CertificateNotYetValidException; import eu.webeid.security.exceptions.UserCertificateDisallowedPolicyException; import eu.webeid.security.exceptions.UserCertificateMissingPurposeException; -import eu.webeid.security.exceptions.UserCertificateRevokedException; +import eu.webeid.ocsp.exceptions.UserCertificateRevokedException; import eu.webeid.security.exceptions.UserCertificateWrongPurposeException; import eu.webeid.security.testutil.AbstractTestWithValidator; import eu.webeid.security.testutil.AuthTokenValidators; @@ -262,17 +262,6 @@ void whenCertificateIsRevoked_thenOcspCheckFails() throws Exception { .isInstanceOf(UserCertificateRevokedException.class); } - @Test - @Disabled("A new designated test OCSP responder certificate was issued whose validity period no longer overlaps with the revoked certificate") - void whenCertificateIsRevoked_thenOcspCheckWithDesignatedOcspServiceFails() throws Exception { - mockDate("2020-01-01", mockedClock); - final AuthTokenValidator validatorWithOcspCheck = AuthTokenValidators.getAuthTokenValidatorWithDesignatedOcspCheck(); - final WebEidAuthToken token = replaceTokenField(AUTH_TOKEN, "X5C", REVOKED_CERT); - assertThatThrownBy(() -> validatorWithOcspCheck - .validate(token, VALID_CHALLENGE_NONCE)) - .isInstanceOf(UserCertificateRevokedException.class); - } - @Test void whenCertificateCaIsNotPartOfTrustChain_thenValidationFails() throws Exception { final AuthTokenValidator validatorWithWrongTrustedCA = AuthTokenValidators.getAuthTokenValidatorWithWrongTrustedCA(); diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenSignatureTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenSignatureTest.java index 50b9010c..7cde90a9 100644 --- a/src/test/java/eu/webeid/security/validator/AuthTokenSignatureTest.java +++ b/src/test/java/eu/webeid/security/validator/AuthTokenSignatureTest.java @@ -48,7 +48,7 @@ void tearDown() { @Test void whenValidTokenAndNonce_thenValidationSucceeds() throws Exception { - final X509Certificate result = validator.validate(validAuthToken, VALID_CHALLENGE_NONCE); + final X509Certificate result = validator.validate(validAuthToken, VALID_CHALLENGE_NONCE).subjectCertificate(); assertThat(CertificateData.getSubjectCN(result).orElseThrow()) .isEqualTo("JÕEORG\\,JAAK-KRISTJAN\\,38001085718"); diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenSignatureValidatorTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenSignatureValidatorTest.java index 773b096e..5c512310 100644 --- a/src/test/java/eu/webeid/security/validator/AuthTokenSignatureValidatorTest.java +++ b/src/test/java/eu/webeid/security/validator/AuthTokenSignatureValidatorTest.java @@ -32,10 +32,10 @@ void whenValidES384Signature_thenSucceeds() throws Exception { new AuthTokenSignatureValidator(URI.create("https://ria.ee")); final WebEidAuthToken authToken = OBJECT_READER.readValue(VALID_AUTH_TOKEN); - final X509Certificate x509Certificate = CertificateLoader.decodeCertificateFromBase64(authToken.getUnverifiedCertificate()); + final X509Certificate x509Certificate = CertificateLoader.decodeCertificateFromBase64(authToken.unverifiedCertificate()); assertThatCode(() -> signatureValidator - .validate("ES384", authToken.getSignature(), x509Certificate.getPublicKey(), VALID_CHALLENGE_NONCE)) + .validate("ES384", authToken.signature(), x509Certificate.getPublicKey(), VALID_CHALLENGE_NONCE)) .doesNotThrowAnyException(); } @@ -45,10 +45,10 @@ void whenValidRS256Signature_thenSucceeds() throws Exception { new AuthTokenSignatureValidator(URI.create("https://ria.ee")); final WebEidAuthToken authToken = OBJECT_READER.readValue(VALID_RS256_AUTH_TOKEN); - final X509Certificate x509Certificate = CertificateLoader.decodeCertificateFromBase64(authToken.getUnverifiedCertificate()); + final X509Certificate x509Certificate = CertificateLoader.decodeCertificateFromBase64(authToken.unverifiedCertificate()); assertThatCode(() -> signatureValidator - .validate("RS256", authToken.getSignature(), x509Certificate.getPublicKey(), VALID_CHALLENGE_NONCE)) + .validate("RS256", authToken.signature(), x509Certificate.getPublicKey(), VALID_CHALLENGE_NONCE)) .doesNotThrowAnyException(); } diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenValidationConfigurationTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenValidationConfigurationTest.java new file mode 100644 index 00000000..f70eae22 --- /dev/null +++ b/src/test/java/eu/webeid/security/validator/AuthTokenValidationConfigurationTest.java @@ -0,0 +1,80 @@ +/* + * Copyright (c) 2020-2025 Estonian Information System Authority + * + * Permission is hereby granted, free of charge, to any person obtaining a copy + * of this software and associated documentation files (the "Software"), to deal + * in the Software without restriction, including without limitation the rights + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + * copies of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be included in all + * copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + * SOFTWARE. + */ + +package eu.webeid.security.validator; + +import eu.webeid.security.testutil.Certificates; +import eu.webeid.security.validator.revocationcheck.CertificateRevocationChecker; +import eu.webeid.security.validator.revocationcheck.RevocationMode; +import org.junit.jupiter.api.Test; + +import java.net.URI; +import java.security.cert.PKIXRevocationChecker; +import java.util.List; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.mockito.Mockito.mock; + +class AuthTokenValidationConfigurationTest { + + @Test + void whenNoCustomCheckerProvided_thenRevocationModeIsPlatformOcsp() throws Exception { + final AuthTokenValidationConfiguration configuration = getValidConfiguration(); + configuration.validate(); + assertThat(configuration.getRevocationMode()).isEqualTo(RevocationMode.PLATFORM_OCSP); + } + + @Test + void whenRevocationCheckDisabled_thenRevocationModeIsDisabled() throws Exception { + final AuthTokenValidationConfiguration configuration = getValidConfiguration(); + configuration.setUserCertificateRevocationCheckDisabled(); + configuration.validate(); + assertThat(configuration.getRevocationMode()).isEqualTo(RevocationMode.DISABLED); + } + + @Test + void whenCustomCheckerConfigured_thenRevocationModeIsCustomChecker() throws Exception { + final AuthTokenValidationConfiguration configuration = getValidConfiguration(); + configuration.setCertificateRevocationChecker(getNoopChecker()); + configuration.validate(); + assertThat(configuration.getRevocationMode()).isEqualTo(RevocationMode.CUSTOM_CHECKER); + } + + @Test + void whenCustomPkixCheckerConfigured_thenRevocationModeIsCustomPkix() throws Exception { + final AuthTokenValidationConfiguration configuration = getValidConfiguration(); + configuration.setPkixRevocationChecker(mock(PKIXRevocationChecker.class)); + configuration.validate(); + assertThat(configuration.getRevocationMode()).isEqualTo(RevocationMode.CUSTOM_PKIX); + } + + private static AuthTokenValidationConfiguration getValidConfiguration() throws Exception { + final AuthTokenValidationConfiguration configuration = new AuthTokenValidationConfiguration(); + configuration.setSiteOrigin(URI.create("https://ria.ee")); + configuration.getTrustedCACertificates().add(Certificates.getTestEsteid2018CA()); + return configuration; + } + + private static CertificateRevocationChecker getNoopChecker() { + return (subjectCertificate, issuerCertificate) -> List.of(); + } +} diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenValidationInfoTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenValidationInfoTest.java new file mode 100644 index 00000000..5f6f276d --- /dev/null +++ b/src/test/java/eu/webeid/security/validator/AuthTokenValidationInfoTest.java @@ -0,0 +1,77 @@ +/* + * Copyright (c) 2020-2025 Estonian Information System Authority + * + * Permission is hereby granted, free of charge, to any person obtaining a copy + * of this software and associated documentation files (the "Software"), to deal + * in the Software without restriction, including without limitation the rights + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + * copies of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be included in all + * copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + * SOFTWARE. + */ + +package eu.webeid.security.validator; + +import eu.webeid.security.authtoken.WebEidAuthToken; +import eu.webeid.security.testutil.AuthTokenValidators; +import eu.webeid.security.testutil.DateMocker; +import eu.webeid.security.util.DateAndTime; +import eu.webeid.security.validator.revocationcheck.CertificateRevocationChecker; +import eu.webeid.security.validator.revocationcheck.RevocationInfo; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; +import org.mockito.MockedStatic; + +import java.net.URI; +import java.util.List; +import java.util.Map; + +import static eu.webeid.security.testutil.AbstractTestWithValidator.VALID_AUTH_TOKEN; +import static eu.webeid.security.testutil.AbstractTestWithValidator.VALID_CHALLENGE_NONCE; +import static org.assertj.core.api.Assertions.assertThat; +import static org.mockito.Mockito.mockStatic; + +class AuthTokenValidationInfoTest { + + private MockedStatic mockedClock; + + @BeforeEach + void setup() { + mockedClock = mockStatic(DateAndTime.DefaultClock.class); + DateMocker.mockDate("2021-08-01", mockedClock); + } + + @AfterEach + void tearDown() { + mockedClock.close(); + } + + @Test + void whenCustomRevocationCheckerProvidesInfo_thenValidationInfoContainsIt() throws Exception { + final RevocationInfo expectedInfo = new RevocationInfo( + URI.create("https://ocsp.example"), + Map.of(RevocationInfo.KEY_OCSP_RESPONSE, "dummy-response") + ); + final CertificateRevocationChecker checker = (subjectCertificate, issuerCertificate) -> List.of(expectedInfo); + final AuthTokenValidator validator = AuthTokenValidators.getDefaultAuthTokenValidatorBuilder() + .withCertificateRevocationChecker(checker) + .build(); + + final WebEidAuthToken token = validator.parse(VALID_AUTH_TOKEN); + final ValidationInfo validationInfo = validator.validate(token, VALID_CHALLENGE_NONCE); + + assertThat(validationInfo.revocationInfoList()).containsExactly(expectedInfo); + assertThat(validationInfo.subjectCertificate()).isNotNull(); + } +} diff --git a/src/test/java/eu/webeid/security/validator/AuthTokenValidatorBuilderTest.java b/src/test/java/eu/webeid/security/validator/AuthTokenValidatorBuilderTest.java index fcf88f79..fdc428d9 100644 --- a/src/test/java/eu/webeid/security/validator/AuthTokenValidatorBuilderTest.java +++ b/src/test/java/eu/webeid/security/validator/AuthTokenValidatorBuilderTest.java @@ -4,12 +4,15 @@ package eu.webeid.security.validator; import eu.webeid.security.testutil.AuthTokenValidators; +import eu.webeid.security.validator.revocationcheck.CertificateRevocationChecker; import org.junit.jupiter.api.Test; import java.net.URI; -import java.time.Duration; +import java.security.cert.PKIXRevocationChecker; +import java.util.List; import static org.assertj.core.api.Assertions.assertThatThrownBy; +import static org.mockito.Mockito.mock; public class AuthTokenValidatorBuilderTest { @@ -22,7 +25,7 @@ public class AuthTokenValidatorBuilderTest { @Test void testOriginMissing() { assertThatThrownBy(builder::build) - .isInstanceOf(NullPointerException.class) + .isInstanceOf(IllegalArgumentException.class) .hasMessageStartingWith("Origin URI must not be null"); } @@ -68,29 +71,37 @@ void testValidatorOriginNotValidSyntax() { } @Test - void testInvalidOcspResponseTimeSkew() throws Exception { - final AuthTokenValidatorBuilder builderWithInvalidOcspResponseTimeSkew = AuthTokenValidators.getDefaultAuthTokenValidatorBuilder() - .withAllowedOcspResponseTimeSkew(Duration.ofMinutes(-1)); - assertThatThrownBy(builderWithInvalidOcspResponseTimeSkew::build) + void whenRevocationCheckDisabledAndCustomCheckerConfigured_thenBuildFails() throws Exception { + final AuthTokenValidatorBuilder builderWithRevocationDisabled = AuthTokenValidators.getDefaultAuthTokenValidatorBuilder() + .withoutUserCertificateRevocationCheck() + .withCertificateRevocationChecker(getNoopChecker()); + assertThatThrownBy(builderWithRevocationDisabled::build) .isInstanceOf(IllegalArgumentException.class) - .hasMessageStartingWith("Allowed OCSP response time-skew must be greater than zero"); + .hasMessageStartingWith("User certificate revocation check is disabled, but a revocation checker was configured"); } @Test - void testInvalidMaxOcspResponseThisUpdateAge() throws Exception { - final AuthTokenValidatorBuilder builderWithInvalidOcspResponseTimeSkew = AuthTokenValidators.getDefaultAuthTokenValidatorBuilder() - .withMaxOcspResponseThisUpdateAge(Duration.ZERO); - assertThatThrownBy(builderWithInvalidOcspResponseTimeSkew::build) + void whenRevocationCheckDisabledAndPkixCheckerConfigured_thenBuildFails() throws Exception { + final AuthTokenValidatorBuilder builderWithRevocationDisabled = AuthTokenValidators.getDefaultAuthTokenValidatorBuilder() + .withoutUserCertificateRevocationCheck() + .withPKIXRevocationChecker(mock(PKIXRevocationChecker.class)); + assertThatThrownBy(builderWithRevocationDisabled::build) .isInstanceOf(IllegalArgumentException.class) - .hasMessageStartingWith("Max OCSP response thisUpdate age must be greater than zero"); + .hasMessageStartingWith("User certificate revocation check is disabled, but a revocation checker was configured"); } @Test - void testInvalidOcspRequestTimeout() throws Exception { - final AuthTokenValidatorBuilder builderWithInvalidOcspResponseTimeSkew = AuthTokenValidators.getDefaultAuthTokenValidatorBuilder() - .withOcspRequestTimeout(Duration.ofMinutes(-1)); - assertThatThrownBy(builderWithInvalidOcspResponseTimeSkew::build) + void whenCustomCheckerAndPkixCheckerConfigured_thenBuildFails() throws Exception { + final AuthTokenValidatorBuilder builderWithConflictingCheckers = AuthTokenValidators.getDefaultAuthTokenValidatorBuilder() + .withCertificateRevocationChecker(getNoopChecker()) + .withPKIXRevocationChecker(mock(PKIXRevocationChecker.class)); + assertThatThrownBy(builderWithConflictingCheckers::build) .isInstanceOf(IllegalArgumentException.class) - .hasMessageStartingWith("OCSP request timeout must be greater than zero"); + .hasMessageStartingWith("Only one of OcspCertificateRevocationChecker or PKIXRevocationChecker may be configured"); + } + + private static CertificateRevocationChecker getNoopChecker() { + return (subjectCertificate, issuerCertificate) -> List.of(); } + }