IAS4ProfileValidator: validate if initiator party ID, signature certificate and TLS client certificate match

[koes-soptim]

Hi,

for security reasons, it would be very helpful (especially for the BDEW profile) if IAS4ProfileValidator could validate the following:

In any given UserMessage, the ID of the initiator party, the ID in the signature certificate (market participant ID in the OU part) and the ID in the TLS client certificate (also OU part) should match. This is an implicit requirement of the BDEW AS4 profile. I think this could be also helpful for other profiles.

I'll suggest a potential solution (via pull request) for BDEWCompatibilityValidator in a few minutes. Would be very grateful if you'd take a look at it.

---

Edit:

It is a requirement by the BSI that the OU (organisational unit) part in the subject DN of the certificates is filled with the market participant ID. (see BSI PKI Certificate Policy Appendix A.3)

[phax]

Thanks, the PR was included basically as-is. Will be part of the 2.5.0 release