(Delphi ActiveX) Create XML Signature using Java KeyStore (.jks)

Demonstrates how to create an XML digital signature using a certificate and private key from a Java KeyStore (.jks)

Chilkat for Delphi Downloads Chilkat ActiveX DLL for Delphi Chilkat non-ActiveX DLL for Delphi * The examples here use the ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Chilkat_TLB;

...

procedure TForm1.Button1Click(Sender: TObject);
var
xml: TChilkatXml;
jks: TChilkatJavaKeyStore;
password: WideString;
success: Integer;
chain: IChilkatCertChain;
cert: IChilkatCert;
gen: TChilkatXmlDSigGen;
bUsePrivateKey: Integer;
sbXml: TChilkatStringBuilder;

begin
// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// The SOAP XML to be signed in this example contains the following:

// <?xml version="1.0" encoding="UTF-8" standalone="no" ?>
// <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
//     <SOAP-ENV:Header>
//         <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" SOAP-ENV:mustUnderstand="1"></wsse:Security>
//     </SOAP-ENV:Header>
//     <SOAP-ENV:Body xmlns:SOAP-SEC="http://schemas.xmlsoap.org/soap/security/2000-12" SOAP-SEC:id="Body">
//         <z:FooBar xmlns:z="http://example.com" />
//     </SOAP-ENV:Body>
// </SOAP-ENV:Envelope>
// 

// Build the XML to sign.
// Use this online tool to generate the code from sample XML: 
// Generate Code to Create XML

xml := TChilkatXml.Create(Self);
xml.Tag := 'SOAP-ENV:Envelope';
xml.AddAttribute('xmlns:SOAP-ENV','http://schemas.xmlsoap.org/soap/envelope/');
xml.UpdateAttrAt('SOAP-ENV:Header|wsse:Security',1,'xmlns:wsse','http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd');
xml.UpdateAttrAt('SOAP-ENV:Header|wsse:Security',1,'SOAP-ENV:mustUnderstand','1');
xml.UpdateAttrAt('SOAP-ENV:Body',1,'xmlns:SOAP-SEC','http://schemas.xmlsoap.org/soap/security/2000-12');
xml.UpdateAttrAt('SOAP-ENV:Body',1,'SOAP-SEC:id','Body');
xml.UpdateAttrAt('SOAP-ENV:Body|z:FooBar',1,'xmlns:z','http://example.com');

// Load a JavaKeyStore file containing the certificate + private key.
jks := TChilkatJavaKeyStore.Create(Self);
password := 'secret';
success := jks.LoadFile(password,'qa_data/jks/test_secret.jks');
if (success <> 1) then
  begin
    Memo1.Lines.Add(jks.LastErrorText);
    Exit;
  end;

// Make sure we have a private key.
if (jks.NumPrivateKeys < 1) then
  begin
    Memo1.Lines.Add('No private key available.');
    Exit;
  end;

// -------------------------------------------------------------------------
// Get the certificate chain associated with the 1st (and probably only) private key in the JKS.
chain := jks.GetCertChain(0);
if (jks.LastMethodSuccess <> 1) then
  begin
    Memo1.Lines.Add(jks.LastErrorText);
    Exit;
  end;

cert := chain.GetCert(0);
if (chain.LastMethodSuccess <> 1) then
  begin
    Memo1.Lines.Add(chain.LastErrorText);

    Exit;
  end;

// Verify again that this cert has a private key.
if (cert.HasPrivateKey() <> 1) then
  begin
    Memo1.Lines.Add('Certificate has no associated private key.');

    Exit;
  end;

// Prepare for signing...
// Use this online tool to generate the following code from an already-signed XML sample: 
// Generate Code to Create an XML Signature
gen := TChilkatXmlDSigGen.Create(Self);

// Indicate where the Signature will be inserted.
gen.SigLocation := 'SOAP-ENV:Envelope|SOAP-ENV:Header|wsse:Security';

// Add a reference to the fragment of the XML to be signed.
gen.AddSameDocRef('Body','sha1','EXCL_C14N','','');

// (You can read about the SignedInfoPrefixList in the online reference documentation.  It's optional..)
gen.SignedInfoPrefixList := 'wsse SOAP-ENV';

// Provide the private key for signing via the certificate, and indicate that
// we want the base64 of the certificate embedded in the KeyInfo.
gen.KeyInfoType := 'X509Data';
gen.X509Type := 'Certificate';

// Note: Because our certificate was loaded from a JKS which also contained the private key,
// Chilkat automatically knows and has the private key associated with the certificate.
// We set bUsePrivateKey to tell the SetX509Cert method to automatically use the private key
// associated with the certificate for signing.
bUsePrivateKey := 1;
success := gen.SetX509Cert(cert,bUsePrivateKey);
if (success <> 1) then
  begin
    Memo1.Lines.Add(gen.LastErrorText);

    Exit;
  end;

// Everything's specified.  Now create and insert the Signature
sbXml := TChilkatStringBuilder.Create(Self);
xml.GetXmlSb(sbXml.ControlInterface);
success := gen.CreateXmlDSigSb(sbXml.ControlInterface);
if (success <> 1) then
  begin
    Memo1.Lines.Add(gen.LastErrorText);
    Exit;
  end;

// Examine the XML with the digital signature inserted
Memo1.Lines.Add(sbXml.GetAsString());
end;