Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: web-eid/web-eid-authtoken-validation-java
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: web-eid/web-eid-authtoken-validation-java
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: NFC-128
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 15 commits
  • 108 files changed
  • 2 contributors

Commits on Sep 9, 2026

  1. Add web-eid-1.1 token support 

    NFC-46

Signed-off-by: Sander Kondratjev <sander.kondratjev@nortal.com>
Co-authored-by: Mart Aarma <mart.aarma@nortal.com>
    @SanderKondratjevNortal @aarmam
    SanderKondratjevNortal and aarmam committed Sep 9, 2026
    Configuration menu
    Copy the full SHA
    7361f30 View commit details
    Browse the repository at this point in the history

  2. NFC-128 Remove redundant empty AuthTokenValidatorImpl class

    @aarmam
    aarmam committed Sep 9, 2026
    Configuration menu
    Copy the full SHA
    6f6e31c View commit details
    Browse the repository at this point in the history

  3. NFC-128 Increase maximum allowed token size limit

    @aarmam
    aarmam committed Sep 9, 2026
    Configuration menu
    Copy the full SHA
    088f8de View commit details
    Browse the repository at this point in the history

  4. NFC-128 Add intermediate certificates to auth token model

    @aarmam
    aarmam committed Sep 9, 2026
    Configuration menu
    Copy the full SHA
    7ddfc10 View commit details
    Browse the repository at this point in the history

  5. NFC-128 Return the subject's direct issuer or the trust anchor 

    Once intermediate certificates can sit between the leaf and the trust
anchor, the OCSP CertificateID must be built from the certificate that
directly issued the subject, and RFC 6960 responder authorization must
reference the same certificate. Return the direct issuer from the built
certification path; when the path has a single certificate, the trust
anchor is the direct issuer. Behavior is unchanged for configurations
where every configured CA is a trust anchor.
    @aarmam
    aarmam committed Sep 9, 2026
    Configuration menu
    Copy the full SHA
    cb7cfeb View commit details
    Browse the repository at this point in the history

  6. NFC-128 Parameterize the leaf certificate role label in certification… 

    …-path validation

The shared certification-path validation labeled every leaf validity
failure as a user-certificate failure, so the AIA OCSP responder flow
had to duplicate the validity check beforehand to get a correctly
attributed message. Let callers name the certificate role and drop the
duplicate responder pre-check; validity is still checked first, inside
the shared method.
    @aarmam
    aarmam committed Sep 9, 2026
    Configuration menu
    Copy the full SHA
    e6ab9bc View commit details
    Browse the repository at this point in the history

  7. NFC-128 Build certification paths with token-supplied intermediate ce… 

    …rtificates

Web eID 1.1 tokens may carry the intermediate CA certificates of the
certificate chain. Accept them in certification-path validation as
untrusted path candidates only: the path must still terminate at a
configured trust anchor. No caller passes token data yet.
    @aarmam
    aarmam committed Sep 9, 2026
    Configuration menu
    Copy the full SHA
    ab86a95 View commit details
    Browse the repository at this point in the history

  8. NFC-128 Add revocation checking for token-supplied intermediate CA ce… 

    …rtificates

Token-supplied intermediates are attacker-controlled input, so a
revoked intermediate must not become part of a trusted certification
path. Check the CA suffix of the built path (the leaf's role-specific
revocation policy stays with the caller) with the platform JCA
PKIXRevocationChecker, which prefers OCSP and falls back to CRLs;
SOFT_FAIL is deliberately not enabled. Revocation checking is an
explicit caller choice: the authentication and signing certificate
paths enable it, the AIA OCSP responder path does not, per RFC 6960
section 4.2.2.2.1 id-pkix-ocsp-nocheck semantics and because checking
the responder's own chain via OCSP would be circular.

The platform checker is used instead of the application OcspClient
because intermediate CAs commonly publish CRLs without OCSP AIA
records, the OcspClient freshness policy (nonce, time skew, thisUpdate
age) encodes end-entity assumptions that are wrong for CA-tier data,
and the WE2-1030 platform-OCSP refactor removes the OcspClient from
core validation, so platform-based checking ports forward as a block.

A revocation failure names the offending intermediate certificate
instead of the validated leaf.
    @aarmam
    aarmam committed Sep 9, 2026
    Configuration menu
    Copy the full SHA
    0f51396 View commit details
    Browse the repository at this point in the history

  9. NFC-128 Validate authentication certificate chains with token-supplie… 

    …d intermediates
    @aarmam
    aarmam committed Sep 9, 2026
    Configuration menu
    Copy the full SHA
    6e6905b View commit details
    Browse the repository at this point in the history

  10. NFC-128 Validate signing certificate chains with token-supplied inter… 

    …mediates
    @aarmam
    aarmam committed Sep 9, 2026
    Configuration menu
    Copy the full SHA
    31e63c5 View commit details
    Browse the repository at this point in the history

  11. NFC-128 Authorize AIA OCSP responders against the subject certificate… 

    … issuer
    @aarmam
    aarmam committed Sep 9, 2026
    Configuration menu
    Copy the full SHA
    9fa2111 View commit details
    Browse the repository at this point in the history

  12. NFC-128 Require the OCSP-signing extended key usage only for delegate… 

    …d responder certificates
    @aarmam
    aarmam committed Sep 9, 2026
    Configuration menu
    Copy the full SHA
    5deec29 View commit details
    Browse the repository at this point in the history

  13. NFC-128 Document intermediate certificate token fields 

    Signed-off-by: Mart Aarma <mart.aarma@nortal.com>
    @aarmam
    aarmam committed Sep 9, 2026
    Configuration menu
    Copy the full SHA
    1a13f32 View commit details
    Browse the repository at this point in the history

  14. NFC-128 Make AIA OCSP issuer matching configurable

    @aarmam
    aarmam committed Sep 9, 2026
    Configuration menu
    Copy the full SHA
    5e2ee10 View commit details
    Browse the repository at this point in the history

  15. NFC-128 Add OCSP tests for Belgian and Finnish test cards

    @aarmam
    aarmam committed Sep 9, 2026
    Configuration menu
    Copy the full SHA
    fead759 View commit details
    Browse the repository at this point in the history
Loading