Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
57 commits
Select commit Hold shift + click to select a range
775cf41
docs(index.html): Belgian cards are supported now
mrts Jan 20, 2023
e21c1a2
chore: update copyright year
mrts Jan 20, 2023
9b4e8e5
Remove bionic support (#22)
kristelmerilain Mar 1, 2023
6837a64
Update Ubuntu package version and add bookworm support
kristelmerilain Apr 19, 2023
d10286b
Update copyright year (#24)
kristelmerilain Apr 27, 2023
742d2fd
build(deps): bump guava from 31.1-jre to 32.0.0-jre
dependabot[bot] Jun 14, 2023
7273a6a
release: Web eID release v2.3.0/1
mrts Jul 11, 2023
2c2e977
Update download-install-web-eid.sh
metsma Jul 28, 2023
e582617
Update Ubuntu package version (#28)
kristelmerilain Aug 4, 2023
360ed81
deps: update to Java 11 and web-eid-authtoken-validation v3, get rid …
mrts Aug 7, 2023
e5a629b
deps: update DigiDoc4j to v5.1.0
mrts Aug 24, 2023
6f1aaa6
refactor: use ZonedDateTime in tests instead of Date
mrts Aug 24, 2023
3aec54d
refactor: better signature digest algorithm handling and name validation
mrts Aug 24, 2023
58cc9be
refactor,fix(tests): mock BLevelParameters.getSigningDate() instead o…
mrts Aug 25, 2023
f109125
deps: upgrade DigiDoc4j to v5.2.0 and Spring Boot to 2.7.15
mrts Sep 5, 2023
478dc30
fix: use correct JSON property names in SignatureAlgorithmDTO, add d…
mrts Sep 5, 2023
1b5760f
feat: validate signature algorithm values
mrts Sep 7, 2023
6184e4b
Remove kinetic support (#33)
kristelmerilain Oct 2, 2023
5857eba
Update download-install-web-eid.sh (#34)
kristelmerilain Oct 9, 2023
21f06e6
Add mantic support (#35)
kristelmerilain Nov 3, 2023
f9bd2da
Update tests
metsma Nov 7, 2023
ff5489f
Update Ubuntu package version (#37)
kristelmerilain Nov 29, 2023
1938c02
Logout accpets POST requests
metsma Jan 5, 2024
9998db7
Use session fixation protection strategy
metsma Jan 5, 2024
7e5df44
All ID-Card certificates are expired in EstEID 2015
metsma Jan 5, 2024
79e6d64
Set __Host- prefix to session cookie
metsma Jan 5, 2024
1315346
Update copyright year
metsma Mar 19, 2024
254a02f
Remove lunar support (#46)
kristelmerilain Apr 11, 2024
afd2535
Add v2.5.0 release
mrts Apr 26, 2024
69959fd
Upgrade to Spring Boot 3/Spring Security 6
Apr 3, 2024
7ef2e40
Clean up pom.xml
mrts Apr 5, 2024
4d96fdb
Make FileDTO Serializable, enable Thymeleaf cache in production, use …
mrts Apr 5, 2024
777df3f
Secure endpoints and services that require authentication
mrts Apr 5, 2024
2d3214b
Override equals() and hashCode() in WebEidAuthentication
mrts Apr 5, 2024
7fb83fd
Use method injection to provide AuthTokenDTOAuthenticationProvider an…
mrts Apr 5, 2024
10b5406
Use Java 17 base image in Jib
mrts Apr 30, 2024
3ed17e5
Use Optional in CertificateData
mrts May 7, 2024
eaa6fed
Add new TEST ORG certificate issuers
metsma May 1, 2024
566c7ac
Update Web eID group ID to eu.webeid.security, amend REAME (#51)
mrts May 31, 2024
4b08fc8
Add Belgian test CA certs, bump Docker image to 3.1.0 and update path…
mrts Jun 3, 2024
e5a99b0
Add noble support
kristelmerilain Jun 14, 2024
1b6b995
Remove mantic support (#54)
kristelmerilain Aug 1, 2024
8947ab3
Update and rename download-install-web-eid.sh to install-web-eid.sh (…
kristelmerilain Oct 3, 2024
df07380
Add v2.6.0 release (#56)
mrts Oct 22, 2024
23b3d00
Add oracular support (#57)
kristelmerilain Nov 19, 2024
9f5935e
Remove focal support
kristelmerilain Jan 27, 2025
7dee583
Add Thales test ID card intermediate CA to trusted certificates in de…
mrts Mar 20, 2025
2f2684d
Update copyright year to 2025
mrts Mar 21, 2025
f70c0ee
Bump version to 3.1.1, update dependencies
mrts Mar 21, 2025
996dbe1
Update README.md
svenzik May 6, 2025
214e907
Move example project workflow to parent, add build scripts and sonar
svenzik May 6, 2025
5463ec3
Update links in readme
svenzik May 21, 2025
2858169
Fix web-eid.eu page links to reference the new example repository loc…
svenzik May 21, 2025
90e2c5c
Fix web-eid.eu page link for PHP example
svenzik May 21, 2025
ceb083e
Add instructions to use latest build from authtoken-validation
svenzik May 26, 2025
5962d96
Fix error CodeQL Action major versions v1 and v2 have been deprecated
svenzik May 26, 2025
0954087
Upgrade all actions to latest
svenzik May 26, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/codeql-analysis.yml
Original file line number Diff line number Diff line change
Expand Up @@ -16,16 +16,16 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v3
uses: actions/checkout@v4

- name: Initialize CodeQL
uses: github/codeql-action/init@v2
uses: github/codeql-action/init@v3
with:
languages: java
queries: +security-and-quality

- name: Autobuild
uses: github/codeql-action/autobuild@v2
uses: github/codeql-action/autobuild@v3

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
uses: github/codeql-action/analyze@v3
8 changes: 4 additions & 4 deletions .github/workflows/coverity-analysis.yml
Original file line number Diff line number Diff line change
Expand Up @@ -15,15 +15,15 @@ jobs:
PROJECTNAME: 'web-eid/web-eid-authtoken-validation-java'

steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v4

- uses: actions/setup-java@v3
- uses: actions/setup-java@v4
with:
distribution: zulu
java-version: 11

- name: Cache Maven packages
uses: actions/cache@v3
uses: actions/cache@v4
with:
path: ~/.m2
key: ${{ runner.os }}-m2-v8-${{ hashFiles('**/pom.xml') }}
Expand All @@ -50,4 +50,4 @@ jobs:
--form file=@upload.tgz \
--form version=master \
--form description="Github Actions CI build" \
https://scan.coverity.com/builds?project=$PROJECTNAME
https://scan.coverity.com/builds?project=$PROJECTNAME
41 changes: 41 additions & 0 deletions .github/workflows/maven-build-example.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
name: Maven build example

on:
push:
paths:
- 'example/**'
- '.github/workflows/*example*'
pull_request:
paths:
- 'example/**'
- '.github/workflows/*example*'

defaults:
run:
working-directory: ./example

jobs:
build:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4

- uses: actions/setup-java@v4
with:
distribution: zulu
java-version: 17

- name: Cache Maven packages
uses: actions/cache@v4
with:
path: ~/.m2
key: ${{ runner.os }}-m2-v17-${{ secrets.CACHE_VERSION }}-${{ hashFiles('**/pom.xml') }}
restore-keys: ${{ runner.os }}-m2-v17-${{ secrets.CACHE_VERSION }}

- name: Build
run: mvn --batch-mode compile

- name: Test and package
run: mvn --batch-mode package

16 changes: 12 additions & 4 deletions .github/workflows/maven-build.yml
Original file line number Diff line number Diff line change
@@ -1,21 +1,29 @@
name: Maven build

on: [ push, pull_request ]
on:
push:
paths-ignore:
- 'example/**'
- '.github/workflows/*example*'
pull_request:
paths-ignore:
- 'example/**'
- '.github/workflows/*example*'

jobs:
build:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v4

- uses: actions/setup-java@v3
- uses: actions/setup-java@v4
with:
distribution: zulu
java-version: 11

- name: Cache Maven packages
uses: actions/cache@v3
uses: actions/cache@v4
with:
path: ~/.m2
key: ${{ runner.os }}-m2-v8-${{ hashFiles('**/pom.xml') }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/maven-deploy.yml
Original file line number Diff line number Diff line change
Expand Up @@ -9,15 +9,15 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v4

- uses: actions/setup-java@v3
- uses: actions/setup-java@v4
with:
distribution: zulu
java-version: 11

- name: Cache Maven packages
uses: actions/cache@v3
uses: actions/cache@v4
with:
path: ~/.m2
key: ${{ runner.os }}-m2-v8-${{ hashFiles('**/pom.xml') }}
Expand Down
16 changes: 12 additions & 4 deletions .github/workflows/sonarcloud-analysis.yml
Original file line number Diff line number Diff line change
@@ -1,6 +1,14 @@
name: SonarCloud code analysis

on: [push, pull_request]
on:
push:
paths-ignore:
- 'example/**'
- '.github/workflows/*example*'
pull_request:
paths-ignore:
- 'example/**'
- '.github/workflows/*example*'

jobs:
analyze:
Expand All @@ -13,18 +21,18 @@ jobs:
with:
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
- name: Set up JDK 17
uses: actions/setup-java@v3
uses: actions/setup-java@v4
with:
distribution: zulu
java-version: 17
- name: Cache SonarCloud packages
uses: actions/cache@v3
uses: actions/cache@v4
with:
path: ~/.sonar/cache
key: ${{ runner.os }}-sonar
restore-keys: ${{ runner.os }}-sonar
- name: Cache Maven packages
uses: actions/cache@v3
uses: actions/cache@v4
with:
path: ~/.m2
key: ${{ runner.os }}-m2-v11-${{ hashFiles('**/pom.xml') }}
Expand Down
15 changes: 8 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,8 @@ A Java web application that uses Maven or Gradle to manage packages is needed fo

In the following example we are using the [Spring Framework](https://spring.io/), but the examples can be easily ported to other Java web application frameworks.

See the full example [here](https://github.com/web-eid/web-eid-spring-boot-example).
## Full example project using the validation library in spring-boot
[example/README.md](example/README.md)

## 1. Add the library to your project

Expand Down Expand Up @@ -98,7 +99,7 @@ import eu.webeid.security.challenge.ChallengeNonceStore;

## 4. Add trusted certificate authority certificates

You must explicitly specify which **intermediate** certificate authorities (CAs) are trusted to issue the eID authentication and OCSP responder certificates. CA certificates can be loaded from either the truststore file, resources or any stream source. We use the [`CertificateLoader`](https://github.com/web-eid/web-eid-authtoken-validation-java/blob/main/src/main/java/eu/webeid/security/certificate/CertificateLoader.java) helper class to load CA certificates from resources here, but consider using [the truststore file](https://github.com/web-eid/web-eid-spring-boot-example/blob/main/src/main/java/eu/webeid/example/config/ValidationConfiguration.java#L104-L123) instead.
You must explicitly specify which **intermediate** certificate authorities (CAs) are trusted to issue the eID authentication and OCSP responder certificates. CA certificates can be loaded from either the truststore file, resources or any stream source. We use the [`CertificateLoader`](https://github.com/web-eid/web-eid-authtoken-validation-java/blob/main/src/main/java/eu/webeid/security/certificate/CertificateLoader.java) helper class to load CA certificates from resources here, but consider using [the truststore file](./blob/example/main/src/main/java/eu/webeid/example/config/ValidationConfiguration.java#L104-L123) instead.

First, copy the trusted certificates, for example `ESTEID2018.cer`, to `resources/cacerts/`, then load the certificates as follows:

Expand Down Expand Up @@ -137,7 +138,7 @@ import eu.webeid.security.validator.AuthTokenValidatorBuilder;

A REST endpoint that issues challenge nonces is required for authentication. The endpoint must support `GET` requests.

In the following example, we are using the [Spring RESTful Web Services framework](https://spring.io/guides/gs/rest-service/) to implement the endpoint, see also the full implementation [here](https://github.com/web-eid/web-eid-spring-boot-example/blob/main/src/main/java/eu/webeid/example/web/rest/ChallengeController.java).
In the following example, we are using the [Spring RESTful Web Services framework](https://spring.io/guides/gs/rest-service/) to implement the endpoint, see also the full implementation [here](example/blob/main/src/main/java/eu/webeid/example/web/rest/ChallengeController.java).

```java
import org.springframework.web.bind.annotation.GetMapping;
Expand Down Expand Up @@ -171,11 +172,11 @@ Authentication consists of calling the `validate()` method of the authentication

When using [Spring Security](https://spring.io/guides/topicals/spring-security-architecture) with standard cookie-based authentication,

- implement a custom authentication provider that uses the authentication token validator for authentication as shown [here](https://github.com/web-eid/web-eid-spring-boot-example/blob/main/src/main/java/eu/webeid/example/security/AuthTokenDTOAuthenticationProvider.java),
- implement an AJAX authentication processing filter that extracts the authentication token and passes it to the authentication manager as shown [here](https://github.com/web-eid/web-eid-spring-boot-example/blob/main/src/main/java/eu/webeid/example/security/WebEidAjaxLoginProcessingFilter.java),
- configure the authentication provider and authentication processing filter in the application configuration as shown [here](https://github.com/web-eid/web-eid-spring-boot-example/blob/main/src/main/java/eu/webeid/example/config/ApplicationConfiguration.java).
- implement a custom authentication provider that uses the authentication token validator for authentication as shown [here](example/blob/main/src/main/java/eu/webeid/example/security/AuthTokenDTOAuthenticationProvider.java),
- implement an AJAX authentication processing filter that extracts the authentication token and passes it to the authentication manager as shown [here](example/blob/main/src/main/java/eu/webeid/example/security/WebEidAjaxLoginProcessingFilter.java),
- configure the authentication provider and authentication processing filter in the application configuration as shown [here](example/blob/main/src/main/java/eu/webeid/example/config/ApplicationConfiguration.java).

The gist of the validation is [in the `authenticate()` method](https://github.com/web-eid/web-eid-spring-boot-example/blob/main/src/main/java/eu/webeid/example/security/AuthTokenDTOAuthenticationProvider.java#L74-L76) of the authentication provider:
The gist of the validation is [in the `authenticate()` method](example/blob/main/src/main/java/eu/webeid/example/security/AuthTokenDTOAuthenticationProvider.java#L74-L76) of the authentication provider:

```java
try {
Expand Down
27 changes: 0 additions & 27 deletions example/.github/workflows/maven-build.yml

This file was deleted.

2 changes: 1 addition & 1 deletion example/LICENSE
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
MIT License

Copyright (c) 2020-2022 Estonian Information System Authority
Copyright (c) 2020-2023 Estonian Information System Authority

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
Expand Down
14 changes: 8 additions & 6 deletions example/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ Web eID only works over a HTTPS connection with a trusted HTTPS certificate.
You can either setup a reverse HTTPS proxy during development or, alternatively, configure
HTTPS support directly in the bundled web server. HTTPS configuration is described in more detail in section _[HTTPS support](#https-support)_ below.

You can use, for example, [_ngrok_](https://ngrok.com/) to get a reverse HTTPS proxy. Download _ngrok_ and run it in a terminal window by providing the protocol and Spring Boot application port arguments as follows:
You can use solutions like [_ngrok_](https://ngrok.com/), [_localtunnel_](https://theboroer.github.io/localtunnel-www/), or any other reverse HTTPS proxy tool. For example, with _ngrok_, download and run it in a terminal window by providing the protocol and the Spring Boot application port arguments as follows:

ngrok http 8080

Expand All @@ -33,9 +33,11 @@ web-eid-auth-token:
local-origin: "https://<<NGROK HOSTNAME HERE>>"
```

**Note that the origin URL must not end with a slash `/`**.

### 3. Configure the trusted certificate authority certificates

The algorithm, which performs the validation of the Web eID authentication token, needs to know which intermediate certificate authorities (CA) are trusted to issue the eID authentication certificates. CA certificates are loaded either from `.cer` files in the profile-specific subdirectory of the [`certs`resource directory](src/main/resources/certs) or the [truststore file](src/main/resources/certs/prod/trusted_certificates.jks). By default, Estonian eID test CA certificates are included in the `dev` profile and production CA certificates in the `prod` profile.
The algorithm, which performs the validation of the Web eID authentication token, needs to know which intermediate certificate authorities (CA) are trusted to issue the eID authentication certificates. CA certificates are loaded either from `.cer` files in the profile-specific subdirectory of the [`certs` resource directory](src/main/resources/certs) or the [truststore file](src/main/resources/certs/prod/trusted_certificates.jks). By default, Estonian eID test CA certificates are included in the `dev` profile and production CA certificates in the `prod` profile.

In case you need to provide your own CA certificates, either add the `.cer` files to the `src/main/resources/certs/{dev,prod}` profile-specific directory or add the certificates to the truststore file.

Expand All @@ -49,7 +51,7 @@ You can specify the profile as a command-line argument to the Maven wrapper comm

### 5. Run the application

Spring Boot web applications can be run from the command-line. You need to have the Java Development Kit 8 installed for building the application package and running the application.
Spring Boot web applications can be run from the command-line. You need to have the Java Development Kit 17 installed for building the application package and running the application.

Build and run the application with the following command in a terminal window:

Expand Down Expand Up @@ -108,7 +110,7 @@ There is also a Docker Compose configuration file `docker-compose.yml` in the ro

The source code folder `src` contains the application source code and resources in the `main` subdirectory and tests in the `test` subdirectory.

The `src/main/java/org/webeid/example` directory contains the Spring Boot application Java class and the following subdirectories:
The `src/main/java/eu/webeid/example` directory contains the Spring Boot application Java class and the following subdirectories:

- `config`: Spring and HTTP security configuration, Web eID authentication token validation library configuration, trusted CA certificates loading etc,
- `security`: Web eID authentication token validation library integration with Spring Security via an `AuthenticationProvider` and `AuthenticationProcessingFilter`,
Expand Down Expand Up @@ -142,13 +144,13 @@ Spring Security has CSRF protection enabled by default. Web eID requires CSRF pr

### Integration with Web eID components

Detailed overview of Java code changes required for integrating Web eID authentication token validation is available in the [_web-eid-authtoken-validation-java_ library README](https://github.com/web-eid/web-eid-authtoken-validation-java/blob/main/README.md). There are instructions for configuring the nonce generator, trusted certificate authority certificates, authentication token validator, Spring Security authentication integration and REST endpoints. The corresponding Java code is in the `src/main/java/org/webeid/example/{config,security,web/rest}` directories.
Detailed overview of Java code changes required for integrating Web eID authentication token validation is available in the [_web-eid-authtoken-validation-java_ library README](https://github.com/web-eid/web-eid-authtoken-validation-java/blob/main/README.md). There are instructions for configuring the nonce generator, trusted certificate authority certificates, authentication token validator, Spring Security authentication integration and REST endpoints. The corresponding Java code is in the `src/main/java/eu/webeid/example/{config,security,web/rest}` directories.

A similar overview of JavaScript and HTML code changes required for authentication and digital signing with Web eID is available in the [web-eid.js library README](https://github.com/web-eid/web-eid.js/blob/main/README.md). The corresponding JavaScript and HTML code is in the `src/resources/{static,templates}` directories.

### Integration with DigiDoc4j components

Java code examples that show how to create and sign data containers that hold signed file objects and digital signatures is available in the [DigiDoc4j wiki](https://github.com/open-eid/digidoc4j/wiki/Examples-of-using-it). Further information and links to the API documentation is available in the project [README](https://github.com/open-eid/digidoc4j/blob/master/README.md). The corresponding Java code is in the `src/main/java/org/webeid/example/{service,web/rest}` directories.
Java code examples that show how to create and sign data containers that hold signed file objects and digital signatures is available in the [DigiDoc4j wiki](https://github.com/open-eid/digidoc4j/wiki/Examples-of-using-it). Further information and links to the API documentation is available in the project [README](https://github.com/open-eid/digidoc4j/blob/master/README.md). The corresponding Java code is in the `src/main/java/eu/webeid/example/{service,web/rest}` directories.

#### Using the Certificates' _Authority Information Access_ (AIA) extension in DigiDoc4j

Expand Down
2 changes: 1 addition & 1 deletion example/docker-compose.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
version: '2'
services:
web-eid-springboot-example:
image: web-eid-springboot-example:2.0.0-SNAPSHOT
image: web-eid-springboot-example:3.1.1
restart: always
environment:
JAVA_TOOL_OPTIONS: '-Dspring.profiles.active=prod'
Expand Down
Loading
Loading