Using JAXB with signatures, encryption and encoding

Question

Recently we've been tasked with coming up with a XML communication specification for our products. A few of my coworkers have high opinions of JAXB for marshalling and unmarshalling XML docs. I've spent some time playing around with it and I understand where they are coming from. It makes life simple for simple XML docs.

Now to take it up a notch. One of the things that I would like to see in our communication model "built in" signature validation for people who use it after me. One of the problems I'm running into is that to validate a signature I need to treat the corresponding XML as bytes. So let's take this example...

<topLevel>
    <sensitiveData encoding="UTF8">
        <creditCard>
            <number>1234-1234-1234-1234</number>
            <expDate>Oct 2020</expDate>
        </creditCard>
    </sensitiveData>
    <signatureOfSensitiveData algorithm="SHA1WithRSA">VGhpc0lzQVNpZ25hdHVyZQ==</signatureOfSensitiveData>
</topLevel>

Edit: I am not actually passing credit card data. Just an example here.

What would be great is if I could get the byte[] (determined by the encoding) representation of everything inside of the "sensitiveData" tag. I wouldn't even mind having to call "unmarshall" again on that byte[].

This also opens up other doors for us. We could actually introduce "compression" and "encryption" attributes into elements. If we could treat them as a byte[] we could then inflate and decrypt them and then pass them on to be unmarshalled again.

Side note: I think this works if you base64 encode the XML and then include it in an element. But that then forces us to base64 even simple documents and introduce some unnecessary bloat into our messages.

Any ideas for solutions to this? My hope is that I'm just missing something basic in JAXB and it will be a breeze after I get that.

Thanks!

Just a few notes: don't reinvent the wheel. If you _really_ need signing and encryption, stick with the specs: http://www.w3.org/TR/xmldsig-core/ . (there are great libraries for that, though you won't find __direct__ support for it in jaxb as far as I know). If you are concerned about `bloat`, why use xml in the first place? It's a great tool, but when it comes to compactness XML should be your _last_ choice. — Gergely Szilagyi, Jul 02 '12 at 22:00

score 0 · Answer 1 · answered Feb 17 '19 at 18:56

You can use a JAX-WS framework that supports WS-Security. JAX-WS relies on JAXB but adds the communication part with support for the SOAP protocol, and WS-Security is the standard for XML signature, encryption and other security features in SOAP/XML. WS-Security relies on the XML signature & encryption standard mentioned in a comment.

Examples of such frameworks (non-exhaustive list): Apache CXF, Glassfish Metro, etc. More info.

Using JAXB with signatures, encryption and encoding

1 Answers1