R2.4.1

Author: Gematik-Entwicklung

ReleaseNotes.md

@@ -6,14 +6,24 @@
 - If your eGK has an older CVCA you may get problems while testing with the RÍSE PoPP-Service
 - Standard-Kartenleser with Docker is not supported
 
+## Release 2.4.1
+
+### added
+- Added support for selecting a specific card terminal via ct-id when multiple terminals are connected to a Konnektor
+- Added endpoint (popp-client) for popp token verification: /token/verify
+
+### changed
+- Replaced static actorId value with value extracted from the zeta-user-info header
+- Updated ZETA version to 1.0.1
+
 ## Release 2.4.0
 
 ### changed
 - Replaced the former Smartcard-library based CVC and trusted-channel handling in PoPP client and server with OpenHealth-based `CvCertificate`, healthcard parsing, and crypto verification APIs
 - Reworked trusted CVC directory loading and trusted-channel chain building on the server to use OpenHealth instead of `TrustCenter` and `SecureMessagingConverterSoftware`
 - Switched the configured trusted-channel service identity validation to OpenHealth using the configured PKCS#8 key material directly
 - Simplified server-side key handling by removing obsolete parser and factory layers around private keys and JCA key store access
-- Add support for Contactless Virtual Card
+- Added support for Contactless Virtual Card
 
 ### fixed
 - Fixed contact-based and contactless CVC signature verification and nonce verification to use the same OpenHealth-based verification logic across scenarios

docker/compose.yaml

@@ -6,6 +6,7 @@ services:
     environment:
       - SPRING_PROFILES_ACTIVE=dev-local
       - ZETA_AUTHENTICATION_SMB_KEYFILE=/app/smcb_private.p12
+      - FEDERATION_ENTITY_STATEMENT_URL=http://popp-server:8443/.well-known/openid-federation
     networks:
       - popp-network
     ports:
@@ -26,6 +27,7 @@ services:
       - IDENTITIES_LOCATION=classpath:identities
       - CERT_HASH_IMPORT_LOCATION=file:/app/import
       - SPRING_DATASOURCE_URL=jdbc:postgresql://popp-server-db:5432/egk_hash_db
+      - FEDERATION_JWKS_URL=http://popp-server:8443
     networks:
       - popp-network
     depends_on:
@@ -60,7 +62,7 @@ services:
       - popp-zeta-pep
 
   popp-zeta-pep:
-    image: europe-west3-docker.pkg.dev/gematik-pt-zeta-prod/zeta-dcr/ngx_pep:0.5.1
+    image: europe-west3-docker.pkg.dev/gematik-pt-zeta-prod/zeta-dcr/ngx_pep:1.0.1
     environment:
       - POPP_SERVER_HOST=popp-server:8443
       - HTTP_PROXY=
@@ -85,7 +87,7 @@ services:
       popp-server:
         condition: service_started # TODO: change to "service_healthy" when healthcheck is available
   popp-zeta-pdp:
-    image: europe-west3-docker.pkg.dev/gematik-pt-zeta-prod/zeta-dcr/keycloak-zeta:0.5.1
+    image: europe-west3-docker.pkg.dev/gematik-pt-zeta-prod/zeta-dcr/keycloak-zeta:1.0.1
     environment:
       KC_BOOTSTRAP_ADMIN_USERNAME: admin
       KC_BOOTSTRAP_ADMIN_PASSWORD: admin
@@ -162,7 +164,7 @@ services:
 
   popp-zeta-pdp-opa:
     container_name: popp-zeta-pdp-opa
-    image: openpolicyagent/opa:1.15.2-static
+    image: openpolicyagent/opa:1.16.2
     environment:
       HTTP_PROXY: ""
       HTTPS_PROXY: ""

pom.xml

@@ -7,7 +7,7 @@
   </parent>
   <groupId>de.gematik.refpopp</groupId>
   <artifactId>popp-example-impl-global</artifactId>
-  <version>2.4.0</version>
+  <version>2.4.1</version>
   <packaging>pom</packaging>
   <name>popp-sample-code</name>
   <description>PoPP - example implementation</description>
@@ -64,7 +64,7 @@
     <version.maven>3.8.6</version.maven>
     <version.maven-clean-plugin>3.5.0</version.maven-clean-plugin>
     <version.maven-compiler-plugin>3.15.0</version.maven-compiler-plugin>
-    <version.maven-enforcer-plugin>3.6.2</version.maven-enforcer-plugin>
+    <version.maven-enforcer-plugin>3.6.3</version.maven-enforcer-plugin>
     <version.maven-failsafe-plugin>3.5.5</version.maven-failsafe-plugin>
     <version.maven-gpg-plugin>3.2.8</version.maven-gpg-plugin>
     <version.maven-javadoc-plugin>3.12.0</version.maven-javadoc-plugin>
@@ -78,10 +78,10 @@
     <version.central-publishing-maven-plugin>0.10.0</version.central-publishing-maven-plugin>
     <version.openhealth.healthcard>0.4.0-alpha1</version.openhealth.healthcard>
     <version.sonar-maven-plugin>5.6.0.6792</version.sonar-maven-plugin>
-    <version.spotless-maven-plugin>3.4.0</version.spotless-maven-plugin>
+    <version.spotless-maven-plugin>3.5.1</version.spotless-maven-plugin>
     <version.spotless.google-java-format>1.27.0</version.spotless.google-java-format>
     <version.spring-boot-maven-plugin>3.3.2</version.spring-boot-maven-plugin>
-    <version.zeta-sdk-jvm>0.5.1</version.zeta-sdk-jvm>
+    <version.zeta-sdk-jvm>1.0.1</version.zeta-sdk-jvm>
     <jackson-2-bom.version>2.21.1</jackson-2-bom.version>
     <jackson-bom.version>3.1.1</jackson-bom.version>
     <mockito.agent.jar>${settings.localRepository}/org/mockito/mockito-core/${mockito.version}/mockito-core-${mockito.version}.jar</mockito.agent.jar>

popp-client/pom.xml

@@ -7,7 +7,7 @@
   <parent>
     <groupId>de.gematik.refpopp</groupId>
     <artifactId>popp-example-impl-global</artifactId>
-    <version>2.4.0</version>
+    <version>2.4.1</version>
     <relativePath>../pom.xml</relativePath>
   </parent>
 
@@ -149,6 +149,11 @@
       <artifactId>javase</artifactId>
       <version>3.5.4</version>
     </dependency>
+    <dependency>
+      <groupId>com.nimbusds</groupId>
+      <artifactId>nimbus-jose-jwt</artifactId>
+      <version>10.9</version>
+    </dependency>
   </dependencies>
 
   <build>

popp-client/src/main/java/de/gematik/refpopp/popp_client/client/SecureWebSocketClient.java

@@ -26,7 +26,6 @@
 import de.gematik.refpopp.popp_client.client.events.WebSocketConnectionOpenedEvent;
 import de.gematik.refpopp.popp_client.configuration.PathResolver;
 import de.gematik.zeta.sdk.BuildConfig;
-import de.gematik.zeta.sdk.StorageConfig;
 import de.gematik.zeta.sdk.TpmConfig;
 import de.gematik.zeta.sdk.WsClientExtension;
 import de.gematik.zeta.sdk.ZetaSdk;
@@ -38,6 +37,7 @@
 import de.gematik.zeta.sdk.authentication.smb.SmbTokenProvider;
 import de.gematik.zeta.sdk.network.http.client.ZetaHttpClientBuilder;
 import de.gematik.zeta.sdk.storage.InMemoryStorage;
+import de.gematik.zeta.sdk.storage.StorageConfig;
 import io.ktor.client.plugins.logging.LogLevel;
 import jakarta.annotation.PostConstruct;
 import java.net.URI;
@@ -107,15 +107,20 @@ public SecureWebSocketClient(
                 "demo-client",
                 "0.2.0",
                 "sdk-client",
-                new StorageConfig(
-                    new InMemoryStorage(), "7aae7xXr8rnzVqjpYbosS0CFMrlprkD7jbVotm0fd+w="),
+                new StorageConfig.Custom(new InMemoryStorage()),
                 new TpmConfig() {},
                 new AuthConfig(
-                    List.of("popp"), 30L, true, getTokenProvider(), AttestationConfig.software()),
+                    List.of("popp"),
+                    30L,
+                    true,
+                    getTokenProvider(),
+                    AttestationConfig.software(),
+                    ""),
                 createPlatformProductId(),
                 new ZetaHttpClientBuilder("")
                     .disableServerValidation(disableServerValidation)
-                    .logging(LogLevel.ALL, message -> log.info("Ktor HttpClient: {}", message)),
+                    .logging(LogLevel.ALL),
+                null,
                 null,
                 null));
   }
@@ -207,7 +212,7 @@ public void connectBlocking() {
                 zetaSdk,
                 this.serverUri.toString(),
                 builder -> {
-                  builder.disableServerValidation(true);
+                  builder.disableServerValidation(disableServerValidation);
                   return Unit.INSTANCE;
                 },
                 new HashMap<>(),

popp-client/src/main/java/de/gematik/refpopp/popp_client/configuration/PoppTokenVerificationConfiguration.java

@@ -0,0 +1,51 @@
+/*
+ * Copyright (Date see Readme), gematik GmbH
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * *******
+ *
+ * For additional notes and disclaimer from gematik and in case of changes by gematik find details in the "Readme" file.
+ */
+
+package de.gematik.refpopp.popp_client.configuration;
+
+import java.security.KeyStore;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.io.Resource;
+
+@Configuration
+public class PoppTokenVerificationConfiguration {
+  private final Resource location;
+  private final String password;
+
+  public PoppTokenVerificationConfiguration(
+      @Value("${federation.keystore.location}") Resource location,
+      @Value("${federation.keystore.password}") String password) {
+    this.location = location;
+    this.password = password;
+  }
+
+  @Bean
+  public KeyStore keyStore() {
+    try (var is = location.getInputStream()) {
+      final var keyStore = KeyStore.getInstance("jks");
+      keyStore.load(is, password.toCharArray());
+      return keyStore;
+    } catch (Exception e) {
+      throw new IllegalStateException("Could not load key store", e);
+    }
+  }
+}

popp-client/src/main/java/de/gematik/refpopp/popp_client/configuration/RestClientConfig.java

@@ -0,0 +1,34 @@
+/*
+ * Copyright (Date see Readme), gematik GmbH
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * *******
+ *
+ * For additional notes and disclaimer from gematik and in case of changes by gematik find details in the "Readme" file.
+ */
+
+package de.gematik.refpopp.popp_client.configuration;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.client.RestClient;
+
+@Configuration
+public class RestClientConfig {
+
+  @Bean
+  public RestClient.Builder restClientBuilder() {
+    return RestClient.builder();
+  }
+}

popp-client/src/main/java/de/gematik/refpopp/popp_client/connector/eventservice/GetCardsClient.java

@@ -31,12 +31,11 @@
 import de.gematik.ws.conn.connectorcontext.v2.ContextType;
 import de.gematik.ws.conn.eventservice.v7.GetCards;
 import de.gematik.ws.conn.eventservice.v7.GetCardsResponse;
-import java.util.List;
-import java.util.function.Supplier;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.hc.client5.http.classic.HttpClient;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Lazy;
 import org.springframework.oxm.jaxb.Jaxb2Marshaller;
 import org.springframework.stereotype.Component;
@@ -49,18 +48,21 @@ public class GetCardsClient extends SoapClient {
 
   private final Context context;
   private final ServiceEndpointProvider serviceEndpointProvider;
+  private final String ctId;
 
   public GetCardsClient(
       final Jaxb2Marshaller eventServiceMarshaller,
       final Context context,
       final ServiceEndpointProvider serviceEndpointProvider,
-      @Autowired(required = false) @Qualifier("httpClientWithBC") HttpClient httpClient) {
+      @Autowired(required = false) @Qualifier("httpClientWithBC") HttpClient httpClient,
+      @Value("${connector.terminal-configuration.ct-id:}") String ctId) {
     super(
         eventServiceMarshaller,
-        (Supplier<String>) () -> buildSoapAction(serviceEndpointProvider, SoapActions.GET_CARDS),
+        () -> buildSoapAction(serviceEndpointProvider, SoapActions.GET_CARDS),
         httpClient);
     this.context = context;
     this.serviceEndpointProvider = serviceEndpointProvider;
+    this.ctId = ctId;
   }
 
   public DetermineCardHandleResponse performGetCards() {
@@ -69,14 +71,10 @@ public DetermineCardHandleResponse performGetCards() {
     log.info("Sending GetCards request to connector at {}", endpoint);
     final GetCardsResponse soapResponse =
         sendRequest(soapRequest, endpoint, GetCardsResponse.class);
-    final DetermineCardHandleResponse determineCardHandleResponse =
-        new DetermineCardHandleResponse();
+    final var determineCardHandleResponse = new DetermineCardHandleResponse();
 
-    final List<String> cardHandles =
-        soapResponse.getCards().getCard().stream()
-            .filter(card -> CardTypeType.EGK.equals(card.getCardType()))
-            .map(CardInfoType::getCardHandle)
-            .toList();
+    final var cardHandles =
+        soapResponse.getCards().getCard().stream().map(CardInfoType::getCardHandle).toList();
 
     determineCardHandleResponse.setCardHandles(cardHandles);
     return determineCardHandleResponse;
@@ -90,6 +88,10 @@ private GetCards createGetCards() {
     final ContextType contextType = getContextType();
     final GetCards getCards = new GetCards();
     getCards.setContext(contextType);
+    if (!ctId.isBlank()) {
+      getCards.setCtId(ctId);
+    }
+    getCards.setCardType(CardTypeType.EGK);
 
     return getCards;
   }

popp-client/src/main/java/de/gematik/refpopp/popp_client/controller/ErrorCode.java

@@ -0,0 +1,56 @@
+/*
+ * Copyright (Date see Readme), gematik GmbH
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * *******
+ *
+ * For additional notes and disclaimer from gematik and in case of changes by gematik find details in the "Readme" file.
+ */
+
+package de.gematik.refpopp.popp_client.controller;
+
+import lombok.Getter;
+import org.springframework.http.HttpStatus;
+
+@Getter
+public enum ErrorCode {
+  TOKEN_MISSING(HttpStatus.BAD_REQUEST),
+  TOKEN_MALFORMED(HttpStatus.BAD_REQUEST),
+
+  SIGNATURE_INVALID(HttpStatus.UNAUTHORIZED),
+  ALGORITHM_INVALID(HttpStatus.UNAUTHORIZED),
+  KID_NOT_FOUND(HttpStatus.UNAUTHORIZED),
+
+  ISSUER_INVALID(HttpStatus.UNAUTHORIZED),
+  ACTOR_MISMATCH(HttpStatus.FORBIDDEN),
+  TOKEN_EXPIRED(HttpStatus.UNAUTHORIZED),
+
+  JWKS_FETCH_FAILED(HttpStatus.SERVICE_UNAVAILABLE),
+  ENTITY_STATEMENT_INVALID(HttpStatus.UNAUTHORIZED),
+
+  OCSP_CHECK_FAILED(HttpStatus.SERVICE_UNAVAILABLE),
+  CERTIFICATE_INVALID(HttpStatus.UNAUTHORIZED),
+
+  INTERNAL_ERROR(HttpStatus.INTERNAL_SERVER_ERROR),
+
+  ENTITY_STATEMENT_FETCH_FAILED(HttpStatus.SERVICE_UNAVAILABLE),
+  PUBLIC_KEY_UNSUPPORTED(HttpStatus.UNAUTHORIZED),
+  ACTOR_ID_INVALID(HttpStatus.UNAUTHORIZED);
+
+  private final HttpStatus httpStatus;
+
+  ErrorCode(HttpStatus httpStatus) {
+    this.httpStatus = httpStatus;
+  }
+}