How to generate a "Partial Xml Signature" (ie the content of the SignedInfo tag)?

Question

I need to generate a "partial XML Signature" message.

To summarize, when we need to sign one kind of XML document, we create a digested "partial XML Signature" message, this "partial XML Signature" message is forwarded (with some credentials) to another service which is in charge of sign it and return it, and finally we extract this signature to inject it in the origin message.

Typically, the "partial XML Signature" message looks like that:

<soap:Envelope xmlns:soap ="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
  <W3CComputeSignature xmlns="urn:swift:amh:xsd:signature">
    <user>
      <name> sign_ws_user </name>
      <password>P@ssword01</ password>
    </user>
  < .... />
  <signature><![CDATA[<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="_wwwwww">

<ds:Signature xmlns:ds ="http://www.w3.org/2000/09/xmldsig#" Id="_xxxxxx">
  <ds:SignedInfo>
    <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml exc c14n#"/>
    <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig more#rsa sha256"/>
    <ds:Reference URI="">
      <ds:Transforms>
        <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped signature"/>
        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml exc c14n#"/>
      </ds:Transforms>
      <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
      <ds:DigestValue > </ds:DigestValue>
    </ds:Reference>
    <ds:Reference>
      <ds:Transforms>
        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml exc c14n#"/>
      </ds:Transforms>
      <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
      <ds:DigestValue > </ds:DigestValue>
    </ds:Reference>
  </ds:SignedInfo>
</ds:Signature>

]]></signature>
</W3CComputeSignature>
</soap:Body>
</soap:Envelope>

I have some problems to obtain this <ds:SignedInfo> and generate the file. I followed some examples found on Oracle website, like https://www.oracle.com/technical-resources/articles/java/dig-signature-api.html

Based on this example, I am able to build the SignedInfo object with the References, Transforms and Digest I need. But I do not understand how to adapt the code after this step.

In Oracle's webpage, they create the keypairs in order to effectively sign the document. In my case I do not need to sign the document ! My idea is to keep this SignedInfo object and materialize it in a <ds:SignedInfo> tag I would wrap in the <soap:Envelope><soap:Body>...<signature> CDATA .

But I found no suitable method on SignedInfo to help me. I tried to work with DOMSignedInfo but I have a classcast Exception :

XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM");
SignedInfo si = fac.newSignedInfo(.......);
DOMSignedInfo domSi = (DOMSignedInfo) si;

-->  java.lang.ClassCastException: org.jcp.xml.dsig.internal.dom.DOMSignedInfo cannot be cast to org.apache.jcp.xml.dsig.internal.dom.DOMSignedInfo

And I am unsure what I could do with a DOMSignedInfo.

Any clues to help me?

How to generate a "Partial Xml Signature" (ie the content of the SignedInfo tag)?

0 Answers0