(Delphi ActiveX) Sign Italian SPID Metadata XML

Demonstrates how to create an XML digital signature for Italian SPID Metadata.

Chilkat for Delphi Downloads Chilkat ActiveX DLL for Delphi Chilkat non-ActiveX DLL for Delphi * The examples here use the ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Chilkat_TLB;

...

procedure TForm1.Button1Click(Sender: TObject);
var
success: Integer;
sbXml: TChilkatStringBuilder;
gen: TChilkatXmlDSigGen;
cert: TChilkatCert;
verifier: TChilkatXmlDSig;
numSigs: Integer;
verifyIdx: Integer;
verified: Integer;

begin
// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

success := 1;

// Load the XML to be signed.
sbXml := TChilkatStringBuilder.Create(Self);
success := sbXml.LoadFile('qa_data/xml_dsig/spid_metadata.xml','utf-8');
if (success = 0) then
  begin
    Memo1.Lines.Add('Failed to load the input file.');
    Exit;
  end;

// The XML to sign contains XML such as this:

// <?xml version="1.0" encoding="utf-8"?>
// <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://***.it" ID="_AE17AFFF-A600-49D5-B81D-76EEA55B50FF">
//     <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true" WantAssertionsSigned="true">
//         <md:KeyDescriptor use="signing">
//             <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
//                 <ds:X509Data>
//                     <ds:X509Certificate>MIIF5...</ds:X509Certificate>
//                 </ds:X509Data>
//             </ds:KeyInfo>
//         </md:KeyDescriptor>
//         <md:KeyDescriptor use="encryption">
//             <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
//                 <ds:X509Data>
//                     <ds:X509Certificate>MIIF5...</ds:X509Certificate>
//                 </ds:X509Data>
//             </ds:KeyInfo>
//         </md:KeyDescriptor>
//         <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://***.it/it-it/spid/logout"/>
//         <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
//         <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://***.it/it-it/spid/loginresp" index="0" isDefault="true"/>
//         <md:AttributeConsumingService index="1">
//             <md:ServiceName xml:lang="it">Servizi Online</md:ServiceName>
//             <md:ServiceDescription xml:lang="it">Accesso ai Servizi Online</md:ServiceDescription>
//             <md:RequestedAttribute Name="spidCode" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
//             <md:RequestedAttribute Name="name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
//             <md:RequestedAttribute Name="familyName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
//             <md:RequestedAttribute Name="fiscalNumber" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
//         </md:AttributeConsumingService>
//     </md:SPSSODescriptor>
//     <md:Organization>
//         <md:OrganizationName xml:lang="it">SomeCompany s.r.l.</md:OrganizationName>
//         <md:OrganizationDisplayName xml:lang="it">SomeCompany s.r.l.</md:OrganizationDisplayName>
//         <md:OrganizationURL xml:lang="it">https://***.it</md:OrganizationURL>
//     </md:Organization>
// </md:EntityDescriptor>

gen := TChilkatXmlDSigGen.Create(Self);

gen.SigLocation := 'md:EntityDescriptor|md:SPSSODescriptor';
gen.SigLocationMod := 2;
gen.SignedInfoCanonAlg := 'EXCL_C14N';
gen.SignedInfoDigestMethod := 'sha256';

// -------- Reference 1 --------
gen.AddSameDocRef('_AE17AFFF-A600-49D5-B81D-76EEA55B50FF','sha256','EXCL_C14N','','');

// Provide a certificate + private key. (PFX password is test123)
cert := TChilkatCert.Create(Self);
success := cert.LoadPfxFile('qa_data/pfx/cert_test123.pfx','test123');
if (success <> 1) then
  begin
    Memo1.Lines.Add(cert.LastErrorText);
    Exit;
  end;
gen.SetX509Cert(cert.ControlInterface,1);

gen.KeyInfoType := 'X509Data+KeyValue';
gen.X509Type := 'Certificate';

gen.Behaviors := 'IndentedSignature,ForceAddEnvelopedSignatureTransform,OmitAlreadyDefinedSigNamespace';

// Sign the XML...
success := gen.CreateXmlDSigSb(sbXml.ControlInterface);
if (success <> 1) then
  begin
    Memo1.Lines.Add(gen.LastErrorText);
    Exit;
  end;
// -----------------------------------------------

// Save the signed XML to a file.
success := sbXml.WriteFile('qa_output/signedXml.xml','utf-8',0);

Memo1.Lines.Add(sbXml.GetAsString());

// ----------------------------------------
// Verify the signatures we just produced...
verifier := TChilkatXmlDSig.Create(Self);
success := verifier.LoadSignatureSb(sbXml.ControlInterface);
if (success <> 1) then
  begin
    Memo1.Lines.Add(verifier.LastErrorText);
    Exit;
  end;

numSigs := verifier.NumSignatures;
verifyIdx := 0;
while verifyIdx < numSigs do
  begin
    verifier.Selector := verifyIdx;
    verified := verifier.VerifySignature(1);
    if (verified <> 1) then
      begin
        Memo1.Lines.Add(verifier.LastErrorText);
        Exit;
      end;
    verifyIdx := verifyIdx + 1;
  end;

Memo1.Lines.Add('All signatures were successfully verified.');
end;