Signature Reference can not be resolved (Apache Santuario)

Question

I want to create an xml signature by use of apache santuario lib and include a custom element into the signature calculation by referencing that element. Here is what I got so far, and is working fine:

public void signXmlNode(Node n) {
    try {
        Reference qSigRef = sigFactory.newReference(
                "#SignatureProperties", sigFactory.newDigestMethod(
                        this.refAlgo, null), Collections
                        .singletonList(sigFactory.newTransform(
                                CanonicalizationMethod.EXCLUSIVE,
                                (TransformParameterSpec) null)),
                "http://uri.etsi.org/01903#SignedProperties",
                "Reference-SignedProperties-1497606229690");

        SignedInfo signedInfo = sigFactory.newSignedInfo(sigFactory
                .newCanonicalizationMethod(
                        CanonicalizationMethod.EXCLUSIVE,
                        (C14NMethodParameterSpec) null), sigFactory
                .newSignatureMethod(this.sigAlgo, null), Arrays.asList(
                qSigRef));
        Element qSig = createXades(n.getOwnerDocument());
        XMLObject xmlObject = sigFactory.newXMLObject(
                Collections.singletonList(new DOMStructure(qSig)),
                "SignatureProperties", null, null);

        KeyInfoFactory keyInfoFactory = sigFactory.getKeyInfoFactory();
        List<Object> x509Content = new ArrayList<>();
        x509Content.add(signerCert);
        X509Data xd = keyInfoFactory.newX509Data(x509Content);
        KeyInfo keyInfo = keyInfoFactory.newKeyInfo(Collections
                .singletonList(xd));

        XMLSignature xmlSignature = sigFactory.newXMLSignature(signedInfo,
                keyInfo, Collections.singletonList(xmlObject), "Signature-"
                        + SIGNATURE_ID, null);
        DOMSignContext signContext = new DOMSignContext(signerKey, n);
        signContext.setDefaultNamespacePrefix("ds");
        xmlSignature.sign(signContext);
        final Transformer t = TransformerFactory.newInstance()
                .newTransformer();
        t.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes");
        t.setOutputProperty(OutputKeys.INDENT, "yes");
        final StringWriter w = new StringWriter();
        t.transform(new DOMSource(n), new StreamResult(w));
        System.out.println(w.toString());
    } catch (MarshalException ex) {
        log.log(Level.WARNING, "MarshalException in handler!", ex);
    } catch (XMLSignatureException ex) {
        log.log(Level.WARNING, "XMLSignatureException in handler!", ex);
    } catch (InvalidAlgorithmParameterException ex) {
        log.log(Level.SEVERE, "InvalidAlgorithmParameterException "
                + "while signing message!", ex);
        logSecurityProviders();
    } catch (NoSuchAlgorithmException ex) {
        log.log(Level.SEVERE, "NoSuchAlgorithmException "
                + "while signing message!", ex);
        logSecurityProviders();
    } catch (TransformerConfigurationException e) {
        e.printStackTrace();
    } catch (TransformerFactoryConfigurationError e) {
        e.printStackTrace();
    } catch (TransformerException e) {
        e.printStackTrace();
    }
}

private Element createXades(Document doc) {
    Element qualifyingProperties = doc.createElementNS(
            "http://uri.etsi.org/01903/v1.3.2#",
            "xades:QualifyingProperties");
    qualifyingProperties.setAttribute("Target", "#Signature-"
            + SIGNATURE_ID);
    Element signedProperties = qualifyingProperties.getOwnerDocument()
            .createElementNS("http://uri.etsi.org/01903/v1.3.2#",
                    "xades:SignedProperties");
    signedProperties.setAttribute("Id", "SignedProperties-" + SIGNATURE_ID);
    Element signedSignatureProperties = signedProperties.getOwnerDocument()
            .createElementNS("http://uri.etsi.org/01903/v1.3.2#",
                    "xades:SignedSignatureProperties");


    signedProperties.appendChild(signedSignatureProperties);
    qualifyingProperties.appendChild(signedProperties);
    return qualifyingProperties;
}

Now, I want the reference qSigRef referring to the xml element <xades:SignedProperties Id="SignedProperties-0123456789"> rather than <Object ID="SignatureProperties">. Upon changing the URI from "#SignatureProperties" to "SignedProperties-0123456789" (as shown below):

Reference qSigRef = sigFactory.newReference(
                "#SignatureProperties", sigFactory.newDigestMethod(
                        this.refAlgo, null), Collections
                        .singletonList(sigFactory.newTransform(
                                CanonicalizationMethod.EXCLUSIVE,
                                (TransformParameterSpec) null)),
                "http://uri.etsi.org/01903#SignedProperties",
                "Reference-SignedProperties-1497606229690");

to

Reference qSigRef = sigFactory.newReference(
                "#SignedProperties-0123456789", sigFactory.newDigestMethod(
                        this.refAlgo, null), Collections
                        .singletonList(sigFactory.newTransform(
                                CanonicalizationMethod.EXCLUSIVE,
                                (TransformParameterSpec) null)),
                "http://uri.etsi.org/01903#SignedProperties",
                "Reference-SignedProperties-1497606229690");

an XMLSignatureException is thrown stateing:

javax.xml.crypto.dsig.XMLSignatureException: javax.xml.crypto.URIReferenceException: org.apache.xml.security.utils.resolver.ResourceResolverException:  Cannot resolve element with ID SignedProperties-0123456789

Since, I can not find any solution nor reason why the exception is thrown I decided to ask this question over here.

score 2 · Accepted Answer · answered Jul 05 '17 at 14:09

I solved the issue.

I had to register the id attribute of the SignedProperties element.

This is archived implcitly by calling setIdAttributeNS() of the related Element:

Element signedProperties = qualifyingProperties.getOwnerDocument()
                .createElementNS("http://uri.etsi.org/01903/v1.3.2#",
                        "xades:SignedProperties");
        signedProperties.setAttributeNS("", "Id", "SignedProperties-"
                + SIGNATURE_ID);//Set ID attribute

        signedProperties.setIdAttributeNS("", "Id", true);//register attribute as id

Signature Reference can not be resolved (Apache Santuario)

1 Answers1