Skip to content

Commit 64f0e6b

Browse files
NFC-66 Example readme updates (review)
Signed-off-by: Sander Kondratjev <sander.kondratjev@nortal.com>
1 parent 3d36d51 commit 64f0e6b

2 files changed

Lines changed: 5 additions & 5 deletions

File tree

README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ import eu.webeid.security.challenge.ChallengeNonceStore;
9999

100100
## 4. Add trusted certificate authority certificates
101101

102-
You must explicitly specify which **intermediate** certificate authorities (CAs) are trusted to issue the eID authentication and OCSP responder certificates. CA certificates can be loaded from either the truststore file, resources or any stream source. We use the [`CertificateLoader`](src/main/java/eu/webeid/security/certificate/CertificateLoader.java) helper class to load CA certificates from resources here, but consider loading the truststore file (see [loadTrustedCACertificatesFromTrustStore](example/main/src/main/java/eu/webeid/example/config/ValidationConfiguration.java#L104-L123)) instead.
102+
You must explicitly specify which **intermediate** certificate authorities (CAs) are trusted to issue the eID authentication and OCSP responder certificates. CA certificates can be loaded from either the truststore file, resources or any stream source. We use the [`CertificateLoader`](src/main/java/eu/webeid/security/certificate/CertificateLoader.java) helper class to load CA certificates from resources here, but consider loading the truststore file (see [loadTrustedCACertificatesFromTrustStore](example/src/main/java/eu/webeid/example/config/ValidationConfiguration.java#L104-L123)) instead.
103103

104104
First, copy the trusted certificates, for example `ESTEID2018.cer`, to `resources/cacerts/`, then load the certificates as follows:
105105

@@ -496,7 +496,7 @@ The Web eID authentication protocol defines two token formats currently supporte
496496
497497
- **Format v1.0** – Used in desktop Web eID authentication flows with traditional smart card readers.
498498
499-
- **Format v1.1** – An extended authentication token format that allows including signing certificate information in the authentication response.
499+
- **Format v1.1** – An extended authentication token format that allows signing certificate information to be included in the authentication response.
500500
- `unverifiedSigningCertificates` – an array of signing certificate entries. Each entry contains:
501501
- `certificate` – a base64-encoded DER-encoded signing certificate;
502502
- `supportedSignatureAlgorithms` – a list of supported signature algorithms associated with that certificate;

example/README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -150,17 +150,17 @@ Spring Security has CSRF protection enabled by default. Web eID requires CSRF pr
150150

151151
### Integration with Web eID components
152152

153-
Detailed overview of Java code changes required for integrating Web eID authentication token validation is available in the [_web-eid-authtoken-validation-java_ library README](https://github.com/web-eid/web-eid-authtoken-validation-java/README.md). There are instructions for configuring the nonce generator, trusted certificate authority certificates, authentication token validator, Spring Security authentication integration and security filters. The corresponding Java code is in the `src/main/java/eu/webeid/example/{config,security,web/rest}` directories.
153+
Detailed overview of Java code changes required for integrating Web eID authentication token validation is available in the [_web-eid-authtoken-validation-java_ library README](https://github.com/web-eid/web-eid-authtoken-validation-java/blob/main/README.md). There are instructions for configuring the nonce generator, trusted certificate authority certificates, authentication token validator, Spring Security authentication integration and security filters. The corresponding Java code is in the `src/main/java/eu/webeid/example/{config,security,web/rest}` directories.
154154

155-
A similar overview of JavaScript and HTML code changes required for authentication and digital signing with Web eID is available in the [web-eid.js library README](https://github.com/web-eid/web-eid.js/README.md). The corresponding JavaScript and HTML code is in the `src/resources/{static,templates}` directories.
155+
A similar overview of JavaScript and HTML code changes required for authentication and digital signing with Web eID is available in the [web-eid.js library README](https://github.com/web-eid/web-eid.js/blob/main/README.md). The corresponding JavaScript and HTML code is in the `src/resources/{static,templates}` directories.
156156

157157
### Integration with DigiDoc4j components
158158

159159
Java code examples that show how to create and sign data containers that hold signed file objects and digital signatures is available in the [DigiDoc4j wiki](https://github.com/open-eid/digidoc4j/wiki/Examples-of-using-it). Further information and links to the API documentation is available in the project [README](https://github.com/open-eid/digidoc4j/blob/master/README.md). The corresponding Java code is in the `src/main/java/eu/webeid/example/{service,web/rest}` directories.
160160

161161
#### Using the Certificates' _Authority Information Access_ (AIA) extension in DigiDoc4j
162162

163-
In the `SigningService` constructor we have configured DigiDoc4j to use the AIA extension that contains the certificates’ OCSP service location with `signingConfiguration.setPreferAiaOcsp(true)`. Note that there may be limitations to using AIA URLs during signing as the services behind these URLs provide different security and SLA guarantees than dedicated OCSP services, so you should consider using a dedicated OCSP service instead. See the instructions in DigiDoc4j documentation and also the [corresponding section in _web-eid-authtoken-validation-java_ README](https://github.com/web-eid/web-eid-authtoken-validation-java/README.md#certificates-authority-information-access-aia-extension).
163+
In the `SigningService` constructor we have configured DigiDoc4j to use the AIA extension that contains the certificates’ OCSP service location with `signingConfiguration.setPreferAiaOcsp(true)`. Note that there may be limitations to using AIA URLs during signing as the services behind these URLs provide different security and SLA guarantees than dedicated OCSP services, so you should consider using a dedicated OCSP service instead. See the instructions in DigiDoc4j documentation and also the [corresponding section in _web-eid-authtoken-validation-java_ README](https://github.com/web-eid/web-eid-authtoken-validation-java/blob/main/README.md#certificates-authority-information-access-aia-extension).
164164

165165
#### Using DigiDoc4j in test mode with the `dev` profile
166166

0 commit comments

Comments
 (0)