R2.3.0

Author: Gematik-Entwicklung

README.md

@@ -363,22 +363,19 @@ For an IDE start:
 
 #### Prerequisites:
 
-Connecting to the RISE PoPP Server only works if you’ve been granted access. To get onto the allowlist, please visit the [gematik Anfrageportal](https://service.gematik.de/servicedesk/customer/portal/37).
-You will get the correct endpoint with your request.
-
-#### 1. Choose the profile
-
-External customers use no Spring profile. Configure the RISE endpoint you received via the [gematik Anfrageportal](https://service.gematik.de/servicedesk/customer/portal/37) in `application.yaml`.
-
-#### 2. Start the PoPP-Client locally
+Configure the `application.yaml` to match your setup. The correct endpoint
+```
+wss://popp.dev.poppservice.de:443/popp/practitioner/api/v1/token-generation-ehc
+```
+is already included.
 
-External customers:
+#### 1a. Start the PoPP-Client locally
 
 ```bash
 ./mvnw -pl popp-client spring-boot:run
 ```
 
-#### 3. Start the PoPP-Client via Docker
+#### 1b. Start the PoPP-Client via Docker
 
 ```bash
 docker run --rm -p 8081:8081 -p 9001:9001 \

ReleaseNotes.md

@@ -6,6 +6,17 @@
 - If your eGK has an older CVCA you may get problems while testing with the RÍSE PoPP-Service
 - Standard-Kartenleser with Docker is not supported
 
+## Release 2.3.0
+
+### added
+- Added Well-Known endpoints for OpenID Federation and signed JWKS:
+  - /.well-known/openid-federation (entity statement JWT)
+  - /.well-known/signed-jwks (signed JWK set)
+- URL for RISE PoPP Service is now public in README and application.yaml
+
+### fixed
+- PoPP server health check
+
 ## Release 2.2.0
 
 ### added

pom.xml

@@ -3,11 +3,11 @@
   <parent>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-parent</artifactId>
-    <version>4.0.5</version>
+    <version>4.0.6</version>
   </parent>
   <groupId>de.gematik.refpopp</groupId>
   <artifactId>popp-example-impl-global</artifactId>
-  <version>2.2.0</version>
+  <version>2.3.0</version>
   <packaging>pom</packaging>
   <name>popp-sample-code</name>
   <description>PoPP - example implementation</description>
@@ -42,7 +42,7 @@
     <!-- docker.registry.gematik will be set in Jenkinsfile -->
     <docker.registry.gematik>local</docker.registry.gematik>
     <java.version>21</java.version>
-    <spring-boot.version>4.0.5</spring-boot.version>
+    <spring-boot.version>4.0.6</spring-boot.version>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
     <sonar.coverage.jacoco.xmlReportPaths>
@@ -60,7 +60,7 @@
     <version.docker-maven-plugin>0.48.1</version.docker-maven-plugin>
     <version.jacoco-maven-plugin>0.8.14</version.jacoco-maven-plugin>
     <version.jjwt>0.13.0</version.jjwt>
-    <version.lombok>1.18.44</version.lombok>
+    <version.lombok>1.18.46</version.lombok>
     <version.maven>3.8.6</version.maven>
     <version.maven-clean-plugin>3.5.0</version.maven-clean-plugin>
     <version.maven-compiler-plugin>3.15.0</version.maven-compiler-plugin>
@@ -77,7 +77,7 @@
     <version.maven-surefire-plugin>3.5.5</version.maven-surefire-plugin>
     <version.central-publishing-maven-plugin>0.10.0</version.central-publishing-maven-plugin>
     <version.openhealth.healthcard>0.3.0-alpha1</version.openhealth.healthcard>
-    <version.sonar-maven-plugin>5.5.0.6356</version.sonar-maven-plugin>
+    <version.sonar-maven-plugin>5.6.0.6792</version.sonar-maven-plugin>
     <version.spotless-maven-plugin>3.4.0</version.spotless-maven-plugin>
     <version.spotless.google-java-format>1.27.0</version.spotless.google-java-format>
     <version.spring-boot-maven-plugin>3.3.2</version.spring-boot-maven-plugin>
@@ -146,7 +146,7 @@
       <dependency>
         <groupId>commons-io</groupId>
         <artifactId>commons-io</artifactId>
-        <version>2.21.0</version>
+        <version>2.22.0</version>
       </dependency>
       <dependency>
         <groupId>org.jacoco</groupId>

popp-client/docker/Dockerfile

@@ -7,7 +7,7 @@ ARG VERSION
 LABEL de.gematik.vendor="gematik GmbH" \
       maintainer="software-development@gematik.de" \
       de.gematik.app="Gematik POPP-Client Example" \
-      de.gematik.git-repo-name="...popp-example-impl-global.git" \
+      de.gematik.git-repo-name="https://github.com/gematik/popp-sample-code.git" \
       de.gematik.commit-sha=$COMMIT_HASH \
       de.gematik.version=$VERSION
 
@@ -30,7 +30,8 @@ ARG GROUPID=10000
 # Run as User (not root)
 USER $USERID:$GROUPID
 
-COPY --chown=$USERID:$GROUPID popp-client*.jar /app/popp-client.jar
+ARG JAR_PATH=popp-client*.jar
+COPY --chown=$USERID:$GROUPID ${JAR_PATH} /app/popp-client.jar
 
 # Expose the port that the application runs on
 EXPOSE 8081

popp-client/pom.xml

@@ -7,12 +7,12 @@
   <parent>
     <groupId>de.gematik.refpopp</groupId>
     <artifactId>popp-example-impl-global</artifactId>
-    <version>2.2.0</version>
+    <version>2.3.0</version>
     <relativePath>../pom.xml</relativePath>
   </parent>
 
   <artifactId>popp-client</artifactId>
-  <version>2.2.0</version>
+  <version>2.3.0</version>
   <packaging>jar</packaging>
 
   <name>popp-client</name>
@@ -124,17 +124,17 @@
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bcprov-jdk18on</artifactId>
-      <version>1.83</version>
+      <version>1.84</version>
     </dependency>
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bcpkix-jdk18on</artifactId>
-      <version>1.83</version>
+      <version>1.84</version>
     </dependency>
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bctls-jdk18on</artifactId>
-      <version>1.83</version>
+      <version>1.84</version>
     </dependency>
     <dependency>
       <groupId>org.springframework.boot</groupId>
@@ -143,7 +143,7 @@
     <dependency>
       <groupId>org.apache.httpcomponents.client5</groupId>
       <artifactId>httpclient5</artifactId>
-      <version>5.6</version>
+      <version>5.6.1</version>
     </dependency>
     <dependency>
       <groupId>com.google.zxing</groupId>
@@ -223,7 +223,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-dependency-plugin</artifactId>
-        <version>3.9.0</version>
+        <version>3.10.0</version>
         <executions>
           <execution>
             <id>unpack-openhealth-linux-natives</id>

popp-client/src/main/java/de/gematik/refpopp/popp_client/client/ClientServerCommunicationService.java

@@ -54,7 +54,7 @@ public void connect() {
       try {
         secureWebSocketClient.connectBlocking();
       } catch (final Exception e) {
-        log.error("Error connecting to WebSocket server: {}", e.getMessage());
+        log.error("Error connecting to WebSocket server: {}", e.getMessage(), e);
         Thread.currentThread().interrupt();
       }
     }

popp-client/src/main/java/de/gematik/refpopp/popp_client/client/SecureWebSocketClient.java

@@ -237,7 +237,8 @@ public void connectBlocking() {
       }
     } catch (InterruptedException e) {
       Thread.currentThread().interrupt();
-      throw new RuntimeException(e);
+      throw new IllegalStateException(
+          "Thread was interrupted while waiting for WebSocket connection", e);
     }
   }
 

popp-client/src/main/java/de/gematik/refpopp/popp_client/controller/TokenController.java

@@ -131,27 +131,27 @@ public class TokenController {
   public ResponseEntity<PoppClientResponse> createToken(
       @Valid @RequestBody PoppClientRequest request) {
     String clientSessionId = request.clientSessionId();
+    log.info(
+        "| Started 'generate PoPP Token' with clientSessionId '{}' and communicationType" + " '{}'",
+        clientSessionId,
+        request.communicationType().getType());
     try {
       if (request.communicationType().requiresCardReader()) {
         cardReaderService.startCheckForCardReader();
       }
       String token = startCommunication(request.communicationType(), clientSessionId);
-
+      log.info("| Finished 'generate PoPP Token' successfully");
       return ResponseEntity.ok(PoppClientResponse.ok(token));
     } catch (UnsupportedOperationException e) {
-      return ResponseEntity.status(HttpStatus.BAD_REQUEST)
-          .body(PoppClientResponse.error(e.getMessage()));
+      return buildErrorResponse(HttpStatus.BAD_REQUEST, e.getMessage(), e);
     } catch (RuntimeException e) {
       if (e.getCause() instanceof java.util.concurrent.TimeoutException) {
-        return ResponseEntity.status(HttpStatus.GATEWAY_TIMEOUT)
-            .body(PoppClientResponse.error("Token generation timed out"));
+        return buildErrorResponse(HttpStatus.GATEWAY_TIMEOUT, "Token generation timed out", e);
       }
-
-      return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
-          .body(PoppClientResponse.error("Unexpected error: " + e.getMessage()));
+      return buildErrorResponse(
+          HttpStatus.INTERNAL_SERVER_ERROR, "Unexpected error: " + e.getMessage(), e);
     } catch (Exception e) {
-      return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
-          .body(PoppClientResponse.error(e.getMessage()));
+      return buildErrorResponse(HttpStatus.INTERNAL_SERVER_ERROR, e.getMessage(), e);
     }
   }
 
@@ -169,4 +169,16 @@ private String startCommunication(CardConnectionType type, String clientSessionI
       default -> throw new UnsupportedOperationException("Unsupported type: " + type);
     };
   }
+
+  private ResponseEntity<PoppClientResponse> buildErrorResponse(
+      HttpStatus status, String errorMessage, Exception exception) {
+    log.error(
+        "| Finished 'generate PoPP Token' with HTTP status '{}', error message '{}' and stack trace"
+            + " '{}'",
+        status.getReasonPhrase(),
+        exception.getMessage(),
+        exception.getStackTrace());
+
+    return ResponseEntity.status(status).body(PoppClientResponse.error(errorMessage));
+  }
 }

popp-client/src/main/resources/application.yaml

@@ -7,9 +7,8 @@ springdoc:
   api-docs:
     enabled: true
 
-# obtain the Rise URL via the "Gematik-Anfrageportal" and configure it here
 popp-server:
-  url: wss://popp-zeta-ingress:443/ws
+  url: wss://popp.dev.poppservice.de:443/popp/practitioner/api/v1/token-generation-ehc
 connector:
   end-point-url: ${CONNECTOR_END_POINT_URL:http://ti-konnektor/cardservice}
 

popp-client/src/test/java/de/gematik/refpopp/popp_client/client/SecureWebSocketClientTest.java

@@ -21,6 +21,7 @@
 package de.gematik.refpopp.popp_client.client;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.*;
@@ -210,7 +211,7 @@ void testConnectBlocking() {
   }
 
   @Test
-  void testConnectBlocking_timeout() throws Exception {
+  void testConnectBlockingTimeout() throws Exception {
     // given
     var latchSpy = spy(new CountDownLatch(1));
     setPrivateField(sut, "sessionReady", latchSpy);
@@ -234,7 +235,7 @@ void testConnectBlocking_timeout() throws Exception {
   }
 
   @Test
-  void testConnectBlocking_interrupted() throws Exception {
+  void testConnectBlockingInterrupted() throws Exception {
     // given
     var latchSpy = spy(new CountDownLatch(1));
     setPrivateField(sut, "sessionReady", latchSpy);
@@ -258,7 +259,7 @@ void testConnectBlocking_interrupted() throws Exception {
   }
 
   @Test
-  void testConnectBlocking_handlesTextMessage() throws Exception {
+  void testConnectBlockingHandlesTextMessage() throws Exception {
     // given
     var sessionMock = mock(WsClientExtension.WsSession.class);
     var textMsg = mock(WsClientExtension.WsMessage.Text.class);
@@ -296,7 +297,7 @@ void testConnectBlocking_handlesTextMessage() throws Exception {
   }
 
   @Test
-  void testConnectBlocking_handlesBinaryMessage() throws Exception {
+  void testConnectBlockingHandlesBinaryMessage() throws Exception {
     // given
     var sessionMock = mock(WsClientExtension.WsSession.class);
     var bytes = new byte[] {1, 2, 3, 4};
@@ -328,6 +329,31 @@ void testConnectBlocking_handlesBinaryMessage() throws Exception {
     assertThat(sutSpy.isOpen()).isTrue();
   }
 
+  @Test
+  void connectBlockingThrowsIllegalStateExceptionAndInterruptsThreadWhenAwaitIsInterrupted()
+      throws Exception {
+    // given
+    var latchSpy = spy(new CountDownLatch(1));
+    setPrivateField(sut, "sessionReady", latchSpy);
+
+    doThrow(new InterruptedException("interrupted"))
+        .when(latchSpy)
+        .await(anyLong(), any(TimeUnit.class));
+
+    // clear interrupted flag before test
+    Thread.interrupted();
+
+    // when / then
+    assertThatThrownBy(() -> sut.connectBlocking())
+        .isInstanceOf(IllegalStateException.class)
+        .hasMessage("Thread was interrupted while waiting for WebSocket connection")
+        .hasCauseInstanceOf(InterruptedException.class);
+
+    assertThat(Thread.currentThread().isInterrupted()).isTrue();
+
+    Thread.interrupted();
+  }
+
   private void setPrivateField(Object target, String fieldName, Object value) throws Exception {
     Field field = target.getClass().getDeclaredField(fieldName);
     field.setAccessible(true);