Skip to content

Commit 0053680

Browse files
svenziksvenzik
committed
feat: remove ESTEID_SK_2015_MOBILE_ID disallowed policy from configuration
WE2-1308 Signed-off-by: Sven Mitt <svenzik@users.noreply.github.com>
1 parent 52f86e8 commit 0053680

5 files changed

Lines changed: 33 additions & 30 deletions

File tree

‎README.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -360,8 +360,6 @@ AuthTokenValidator tokenValidator = new AuthTokenValidatorBuilder()
360360
.build();
361361
```
362362

363-
See the [certificate policy allow-list guide](readme-policy.md) for the Estonian ID-card whitelist and its rationale.
364-
365363
For more advanced revocation requirements, supply a `CertificateRevocationChecker` with `withCertificateRevocationChecker(...)`. The [OCSP configuration guide](src/main/java/eu/webeid/ocsp/README.md) covers custom implementations, the bundled OCSP checker, custom PKIX checkers, responder selection, HTTP settings, and nonce policies.
366364

367365
## Possible validation errors

‎src/main/java/eu/webeid/security/certificate/SubjectCertificatePolicies.java‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -30,33 +30,36 @@ public final class SubjectCertificatePolicies {
3030
* ID.ee certificate policy index for Estonian identity documents</a>
3131
* @see <a href="https://www.id.ee/wp-content/uploads/2026/08/cp_esteid_v4.1_17.08.2026_allkirjastatud.pdf">
3232
* IDEMIA-generation certificate policy</a>
33-
* @see <a href="https://www.skidsolutions.eu/resources/certificate-policies/">
34-
* SK ID Solutions certificate policies</a>
35-
* @see <a href="https://www.skidsolutions.eu/resources/profiles/">
36-
* SK ID Solutions certificate profiles</a>
37-
* @see <a href="https://www.skidsolutions.eu/upload/files/SK-CPR-ESTEID2018-EN-v1_3_20220217.pdf">
38-
* ESTEID2018 certificate profile</a>
3933
* @see <a href="https://www.id.ee/wp-content/uploads/2026/06/eid-cp-v-2.0_04.06.2026_allkirjastatud.pdf">
4034
* Thales-generation certificate policy</a>
41-
* @see <a href="https://repository.eidpki.ee/repository/">
42-
* Zetes Estonia trust-service repository</a>
4335
* @see <a href="https://repository.eidpki.ee/static/documents/CertificateProfiles-20260520.pdf">
4436
* ESTEID2025 certificate profile</a>
4537
*/
4638
public static final Map<X500Principal, Set<ASN1ObjectIdentifier>> ESTEID_ID_CARD_POLICIES = Map.of(
4739
new X500Principal(
4840
"CN=ESTEID2018,2.5.4.97=#0c0e4e545245452d3130373437303133,O=SK ID Solutions AS,C=EE"
4941
), Set.of(
50-
// ESTEID2018 / IDEMIA generation
51-
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.1"),
52-
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.2")
42+
// https://www.id.ee/wp-content/uploads/2026/08/cp_esteid_v4.1_17.08.2026_allkirjastatud.pdf Chapter 1.2. Document Name and Identification
43+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.1"), // Identity card of Estonian citizens
44+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.2"), // Identity card of European Union citizens
45+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.3"), // Digital identity card for Estonian residents
46+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.4"), // Digital identity card for e-residents
47+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.5"), // Residence permit card for long-term residents
48+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.6"), // Residence permit card for temporary residents and NATO SOFA
49+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.7"), // Residence permit card for family members of European Union citizens
50+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51455.1.1.1") // Diplomatic identity card
5351
),
5452
new X500Principal(
5553
"C=EE,O=Zetes Estonia OÜ,2.5.4.97=#0c0e4e545245452d3137303636303439,CN=ESTEID2025"
5654
), Set.of(
57-
// eID / Thales generation
58-
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.1"),
59-
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.2")
55+
// https://www.id.ee/wp-content/uploads/2026/06/eid-cp-v-2.0_04.06.2026_allkirjastatud.pdf Chapter 1.2. Document Name and Identification
56+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.1"), // Identity card of Estonian citizens
57+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.2"), // Identity card of European Union citizens
58+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.3"), // Residence permit card for long-term residents
59+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.4"), // Residence permit card for temporary residents and the right of stay in the Republic of Estonia.
60+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.5"), // Residence permit card for family members of EU and UK citizens and the right of residence of UK citizens
61+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.6"), // Digital identity card of e-residents
62+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51455.2.1.1") // Diplomatic identity card
6063
)
6164
);
6265

‎src/main/java/eu/webeid/security/validator/AuthTokenValidationConfiguration.java‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -90,15 +90,6 @@ public Collection<ASN1ObjectIdentifier> getDisallowedSubjectCertificatePolicies(
9090
return disallowedSubjectCertificatePolicies;
9191
}
9292

93-
/**
94-
* @deprecated Configure allowed certificate policies instead.
95-
*/
96-
@Deprecated(since = "4.0.0")
97-
void setDisallowedSubjectCertificatePolicies(
98-
Collection<ASN1ObjectIdentifier> disallowedSubjectCertificatePolicies) {
99-
this.disallowedSubjectCertificatePolicies = new HashSet<>(disallowedSubjectCertificatePolicies);
100-
}
101-
10293
boolean isUserCertificateRevocationCheckEnabled() {
10394
return isUserCertificateRevocationCheckEnabled;
10495
}

‎src/main/java/eu/webeid/security/validator/AuthTokenValidatorBuilder.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ public AuthTokenValidatorBuilder withAllowedCertificatePolicies(
9292
*/
9393
@Deprecated(since = "4.0.0")
9494
public AuthTokenValidatorBuilder withDisallowedCertificatePolicies(ASN1ObjectIdentifier... policies) {
95-
configuration.setDisallowedSubjectCertificatePolicies(Arrays.asList(policies));
95+
Collections.addAll(configuration.getDisallowedSubjectCertificatePolicies(), policies);
9696
LOG.debug("Disallowed subject certificate policies set to {}", configuration.getDisallowedSubjectCertificatePolicies());
9797
return this;
9898
}

‎src/test/java/eu/webeid/security/certificate/SubjectCertificatePoliciesTest.java‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,23 @@ void esteidIdCardPoliciesContainOnlyProductionIdCardPolicies() {
2626
assertThat(SubjectCertificatePolicies.ESTEID_ID_CARD_POLICIES.get(ESTEID2018_ISSUER))
2727
.containsExactlyInAnyOrder(
2828
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.1"),
29-
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.2")
30-
);
29+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.2"),
30+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.3"),
31+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.4"),
32+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.5"),
33+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.6"),
34+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.1.1.7"),
35+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51455.1.1.1")
36+
);
3137
assertThat(SubjectCertificatePolicies.ESTEID_ID_CARD_POLICIES.get(ESTEID2025_ISSUER))
3238
.containsExactlyInAnyOrder(
3339
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.1"),
34-
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.2")
35-
);
40+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.2"),
41+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.3"),
42+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.4"),
43+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.5"),
44+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51361.2.1.6"),
45+
new ASN1ObjectIdentifier("1.3.6.1.4.1.51455.2.1.1")
46+
);
3647
}
3748
}

0 commit comments

Comments
 (0)