Chilkat2-Python

XAdES XML Signature using ARSS (Aruba Remote Signing Service)

See more Signing in the Cloud Examples

Demonstrates how to sign XML using ARSS (Aruba Remote Signing Service). Chilkat2-Python

import sys
import chilkat2

success = False

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# --------------------------------------------------------------------------------
# Also see Chilkat's Online WSDL Code Generator
# to generate code and SOAP Request and Response XML for each operation in a WSDL.
# --------------------------------------------------------------------------------

# Create the XML to be signed.
sbXml = chilkat2.StringBuilder()

bCrlf = True
sbXml.AppendLine("<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\" ?>",bCrlf)
sbXml.AppendLine("<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\">",bCrlf)
sbXml.AppendLine("    <SOAP-ENV:Header>",bCrlf)
sbXml.AppendLine("        <wsse:Security xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" SOAP-ENV:mustUnderstand=\"1\"></wsse:Security>",bCrlf)
sbXml.AppendLine("    </SOAP-ENV:Header>",bCrlf)
sbXml.AppendLine("    <SOAP-ENV:Body xmlns:SOAP-SEC=\"http://schemas.xmlsoap.org/soap/security/2000-12\" SOAP-SEC:id=\"Body\">",bCrlf)
sbXml.AppendLine("        <z:FooBar xmlns:z=\"http://example.com\" />",bCrlf)
sbXml.AppendLine("    </SOAP-ENV:Body>",bCrlf)
sbXml.AppendLine("</SOAP-ENV:Envelope>",bCrlf)

# Specify the signing certificate and the ARSS credentials

# Load the certificate used for signing.  The certificate's private key is stored on 
# the Aruba.it server and the signing will happen remotely using the
# ARSS (Aruba Remote Signing Service).
# However, we still need the certificate locally (without private key).
cert = chilkat2.Cert()
success = cert.LoadFromFile("qa_data/certs/myCert.cer")
if (success == False):
    print(cert.LastErrorText)
    sys.exit()

# To sign using the Aruba Remote Signing Service, 
# add the following lines of code to specify your authentication credentials,
# and the ID of the certificate w/ private key on the server to be used.
jsonArss = chilkat2.JsonObject()

# Set the "service" equal to "ARSS" to tell Chilkat to use ARSS for signing.
jsonArss.UpdateString("service","ARSS")
# Specify the certificate ID, such as "AS0"
# This certificate should match the certificate loaded in the above code.
jsonArss.UpdateString("certID","YOUR_ARSS_CERT_ID")
jsonArss.UpdateString("otpPwd","YOUR_OTP_PWD")

# Specifies the OTP authentication environment.
# 
# Common values are:
#   "demoprod" - Demo/Test environment
#   "prod"     - Production environment
# 
# This value is sent to the ARSS service and determines how the OTP
# authentication is validated.  The correct value depends on the type
# of Aruba account and environment that has been provisioned.
# 
# If signing fails with an authentication-related error, verify that
# the typeOtpAuth value matches the environment associated with the
# ARSS account credentials being used.
jsonArss.UpdateString("typeOtpAuth","demoprod")

jsonArss.UpdateString("user","YOUR_ARSS_USERNAME")
jsonArss.UpdateString("userPWD","YOUR_ARSS_PASSWORD")

# The "endpoint" can be specified starting in Chilkat v11.5.0
jsonArss.UpdateString("endpoint","https://app1.firma-remota.it/ArubaSignerService/webresources/signerservice")

success = cert.SetCloudSigner(jsonArss)

# Prepare for signing...
gen = chilkat2.XmlDSigGen()

# Indicate where the Signature will be inserted.
gen.SigLocation = "SOAP-ENV:Envelope|SOAP-ENV:Header|wsse:Security"

# Add a reference to the fragment of the XML to be signed.

# Note: "Body" refers to the XML element having an "id" equal to "Body", where "id" is case insensitive
# and where any namespace might qualify the attribute.  In this case, the SOAP-ENV:Body fragment is signed
# NOT because the tag = "Body", but because it has SOAP-SEC:id="Body"
gen.AddSameDocRef("Body","sha1","EXCL_C14N","","")

# (You can read about the SignedInfoPrefixList in the online reference documentation.  It's optional..)
gen.SignedInfoPrefixList = "wsse SOAP-ENV"

gen.KeyInfoType = "X509Data"
gen.X509Type = "IssuerSerial"

bUsePrivateKey = True
success = gen.SetX509Cert(cert,bUsePrivateKey)
if (success == False):
    print(gen.LastErrorText)
    sys.exit()

# Everything's specified.  Now create and insert the Signature
# (The actual signing of the hash will happen on the Aruba server.)
success = gen.CreateXmlDSigSb(sbXml)
if (success == False):
    print(gen.LastErrorText)
    sys.exit()

# Examine the XML with the digital signature inserted
print(sbXml.GetAsString())