WE2-680 Added session based caching

WE2-683 Added nonce generation and saving to cache
WE2-684 Added AuthTokenValidator (builder, implementation, batch)
WE2-685 Added simple subject certificate validators
WE2-686 Added token body validators
WE2-688 Implement certificate utility classes
WE2-689 Updated README
WE2-687 Added initial certificate trust validators and initial OCSP request
Added phpseclib3/X509 class as certificate parser
Added logging util
Added util class Collection for objects array

Author: Guido Gröön

.gitignore

@@ -1,4 +1,5 @@
 vendor
 composer.lock
 .DS_Store
-.phpunit.result.cache
+.phpunit.result.cache
+web-eid-authtoken-validation-php.log

README.md

@@ -1,2 +1,103 @@
 # web-eid-authtoken-validation-php
-Web eID authentication token validation library for PHP
+
+![European Regional Development Fund](https://github.com/open-eid/DigiDoc4-Client/blob/master/client/images/EL_Regionaalarengu_Fond.png)
+
+Web eID authentication token validation library a PHP library for issuing challenge nonces and validating Web eID authentication tokens during secure authentication with electronic ID (eID) smart cards in web applications.
+
+More information about the Web eID project is available on the project [website](https://web-eid.eu/).
+
+# Quickstart
+
+Complete the steps below to add support for secure authentication with eID cards to your PHP web application back end. Instructions for the front end are available [here](https://github.com/web-eid/web-eid.js).
+
+A PHP web application that uses Composer to manage packages is needed for running this quickstart.
+
+## 1. Add the library to your project
+
+Add the following lines to `composer.json` to include the Web eID authentication token validation library in your project:
+
+```json
+```
+
+## 2. Configure the challenge nonce store
+
+## 3. Add trusted certificate authority certificates
+
+## 4. Configure the authentication token validator
+
+## 5. Add a REST endpoint for issuing challenge nonces
+
+## 6. Implement authentication
+
+# Table of contents
+
+- [Quickstart](#quickstart)
+
+# Introduction
+
+The Web eID authentication token validation library for PHP contains the implementation of the Web eID authentication token validation process in its entirety to ensure that the authentication token sent by the Web eID browser extension contains valid, consistent data that has not been modified by a third party. It also implements secure challenge nonce generation as required by the Web eID authentication protocol. It is easy to configure and integrate into your authentication service.
+
+The authentication protocol, authentication token format, validation requirements and challenge nonce usage is described in more detail in the [Web eID system architecture document](https://github.com/web-eid/web-eid-system-architecture-doc#authentication-1).
+
+# Authentication token format
+
+In the following, 
+
+- **origin** is defined as the website origin, the URL serving the web application,
+- **challenge nonce** (or challenge) is defined as a cryptographic nonce, a large random number that can be used only once, with at least 256 bits of entropy.
+
+The Web eID authentication token is a JSON data structure that looks like the following example:
+
+```json
+{
+  "unverifiedCertificate": "MIIFozCCA4ugAwIBAgIQHFpdK-zCQsFW4...",
+  "algorithm": "RS256",
+  "signature": "HBjNXIaUskXbfhzYQHvwjKDUWfNu4yxXZha...",
+  "format": "web-eid:1.0",
+  "appVersion": "https://web-eid.eu/web-eid-app/releases/v2.0.0"
+}
+```
+
+It contains the following fields:
+
+- `unverifiedCertificate`: the base64-encoded DER-encoded authentication certificate of the eID user; the public key contained in this certificate should be used to verify the signature; the certificate cannot be trusted as it is received from client side and the client can submit a malicious certificate; to establish trust, it must be verified that the certificate is signed by a trusted certificate authority,
+
+- `algorithm`: the signature algorithm used to produce the signature; the allowed values are the algorithms specified in [JWA RFC](https://www.ietf.org/rfc/rfc7518.html) sections 3.3, 3.4 and 3.5:
+
+    ```
+      "ES256", "ES384", "ES512", // ECDSA
+      "PS256", "PS384", "PS512", // RSASSA-PSS
+      "RS256", "RS384", "RS512"  // RSASSA-PKCS1-v1_5
+    ```
+
+- `signature`: the base64-encoded signature of the token (see the description below),
+
+- `format`: the type identifier and version of the token format separated by a colon character '`:`', `web-eid:1.0` as of now; the version number consists of the major and minor number separated by a dot, major version changes are incompatible with previous versions, minor version changes are backwards-compatible within the given major version,
+
+- `appVersion`: the URL identifying the name and version of the application that issued the token; informative purpose, can be used to identify the affected application in case of faulty tokens.
+
+The value that is signed by the user’s authentication private key and included in the `signature` field is `hash(origin)+hash(challenge)`. The hash function is used before concatenation to ensure field separation as the hash of a value is guaranteed to have a fixed length. Otherwise the origin `example.com` with challenge nonce `.eu1234` and another origin `example.com.eu` with challenge nonce `1234` would result in the same value after concatenation. The hash function `hash` is the same hash function that is used in the signature algorithm, for example SHA256 in case of RS256.
+
+# Authentication token validation
+
+The authentication token validation process consists of two stages:
+
+- First, **user certificate validation**: the validator parses the token and extracts the user certificate from the *unverifiedCertificate* field. Then it checks the certificate expiration, purpose and policies. Next it checks that the certificate is signed by a trusted CA and checks the certificate status with OCSP.
+- Second, **token signature validation**: the validator validates that the token signature was created using the provided user certificate by reconstructing the signed data `hash(origin)+hash(challenge)` and using the public key from the certificate to verify the signature in the `signature` field. If the signature verification succeeds, then the origin and challenge nonce have been implicitly and correctly verified without the need to implement any additional security checks.
+
+The website back end must lookup the challenge nonce from its local store using an identifier specific to the browser session, to guarantee that the authentication token was received from the same browser to which the corresponding challenge nonce was issued. The website back end must guarantee that the challenge nonce lifetime is limited and that its expiration is checked, and that it can be used only once by removing it from the store during validation.
+
+## Basic usage
+
+## Extended configuration
+
+## Certificates' Authority Information Access (AIA) extension
+
+## Possible validation errors
+
+# Challenge nonce generation
+
+## Basic usage
+
+
+

composer.json

@@ -9,21 +9,27 @@
             "role" : "developer"
         }
     ],
-    "require": {
-        "mlocati/ocsp": "1.0.2"
-    },    
     "require-dev": {
 		"phpunit/phpunit": "^9.5"
 	},    
     "autoload": {
         "psr-4": {
             "web_eid\\web_eid_authtoken_validation_php\\": ["src"]
-        }
+        },
+        "files": [
+            "config/configuration.php"
+        ],
+		"classmap": [
+			"src/util/CollectionsUtil.php"
+		]
     },
     "autoload-dev": {
         "psr-4": {
             "web_eid\\web_eid_authtoken_validation_php\\": ["tests"]
         }
-    }    
-
-}
+    },
+    "require": {
+        "lyquidity/requester": "^1.0",
+        "phpseclib/phpseclib": "3.0.14"
+    }
+}

examples/index.html

@@ -0,0 +1,3 @@
+<?php
+// Coming
+?>

examples/index.php

@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2020 The Web eID Project
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+"use strict";
+
+const alertUi = {
+    alert: document.querySelector("#error-message"),
+    alertMessage: document.querySelector("#error-message .message"),
+    alertDetails: document.querySelector("#error-message .details")
+};
+
+export function hideErrorMessage() {
+    alertUi.alert.style.display = "none";
+}
+
+export function showErrorMessage(error) {
+    const message = "Authentication failed";
+    const details =
+        `[Code]\n${error.code}` +
+        `\n\n[Message]\n${error.message}` +
+        (error.response ? `\n\n[response]\n${JSON.stringify(error.response, null, " ")}` : "");
+
+    alertUi.alertMessage.innerText = message;
+    alertUi.alertDetails.innerText = details;
+    alertUi.alert.style.display = "block";
+}
+
+export async function checkHttpError(response) {
+    if (!response.ok) {
+        let body;
+        try {
+            body = await response.text();
+        } catch (error) {
+            body = "<<unable to retrieve response body>>";
+        }
+        const error = new Error("Server error: " + body);
+        error.code = response.status;
+        throw error;
+    }
+}