Android™

Verify XML Signature with External URL References

See more XML Digital Signatures Examples

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server. Android™

// Important: Don't forget to include the call to System.loadLibrary
// as shown at the bottom of this code sample.
package com.test;

import android.app.Activity;
import com.chilkatsoft.*;

import android.widget.TextView;
import android.os.Bundle;

public class SimpleActivity extends Activity {

  private static final String TAG = "Chilkat";

  // Called when the activity is first created.
  @Override
  public void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);

    boolean success = false;

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // The signed XML we wish to verify contains external references such as this:

    //     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
    //       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    //       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
    //     </ds:Reference>
    //     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
    //       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    //       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
    //     </ds:Reference>

    CkXmlDSig verifier = new CkXmlDSig();
    CkHttp http = new CkHttp();

    // First load the signed XML
    CkStringBuilder sbSignedXml = new CkStringBuilder();
    success = sbSignedXml.LoadFile("qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml","utf-8");
    if (success == false) {
        Log.i(TAG, "Failed to load signed XML.");
        return;
        }

    success = verifier.LoadSignatureSb(sbSignedXml);
    if (success == false) {
        Log.i(TAG, verifier.lastErrorText());
        return;
        }

    // Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
    CkStringBuilder sbRefUri = new CkStringBuilder();
    CkBinData bd = new CkBinData();
    int numRefs = verifier.get_NumReferences();
    int i = 0;
    while (i < numRefs) {
        if (verifier.IsReferenceExternal(i) == true) {
            sbRefUri.Clear();
            sbRefUri.Append(verifier.referenceUri(i));
            if (sbRefUri.StartsWith("https://",false) == true) {
                Log.i(TAG, "External URL Reference: " + sbRefUri.getAsString());

                // Download the data at the URL and provide to the verifier.
                success = http.DownloadBd(sbRefUri.getAsString(),bd);
                if (success == false) {
                    Log.i(TAG, http.lastErrorText());
                    return;
                    }

                success = verifier.SetRefDataBd(i,bd);
                if (success == false) {
                    Log.i(TAG, verifier.lastErrorText());
                    return;
                    }

                }

            }

        i = i + 1;
        }

    // Now that we have the external data, verify the signature..
    boolean bVerified = verifier.VerifySignature(true);
    if (bVerified == false) {
        Log.i(TAG, verifier.lastErrorText());
        }

    Log.i(TAG, "Signature verified = " + String.valueOf(bVerified));

  }

  static {
      System.loadLibrary("chilkat");

      // Note: If the incorrect library name is passed to System.loadLibrary,
      // then you will see the following error message at application startup:
      //"The application <your-application-name> has stopped unexpectedly. Please try again."
  }
}