(Delphi DLL) Sign XML (XAdES) in the Cloud using Azure Key Vault

See more Signing in the Cloud Examples

Note: This example requires Chilkat v9.5.0.96 or greater.

Chilkat for Delphi Downloads Chilkat non-ActiveX DLL for Delphi Chilkat ActiveX DLL for Delphi * The examples here use the non-ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, StringBuilder, XmlDSigGen, Cert, JsonObject;

...

procedure TForm1.Button1Click(Sender: TObject);
var
sbXml: HCkStringBuilder;
bCrlf: Boolean;
cert: HCkCert;
success: Boolean;
jsonAzure: HCkJsonObject;
gen: HCkXmlDSigGen;
bUsePrivateKey: Boolean;

begin
// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// Create the XML to be signed.
sbXml := CkStringBuilder_Create();

bCrlf := True;
CkStringBuilder_AppendLine(sbXml,'<?xml version="1.0" encoding="UTF-8" standalone="no" ?>',bCrlf);
CkStringBuilder_AppendLine(sbXml,'<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">',bCrlf);
CkStringBuilder_AppendLine(sbXml,'    <SOAP-ENV:Header>',bCrlf);
CkStringBuilder_AppendLine(sbXml,'        <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" SOAP-ENV:mustUnderstand="1"></wsse:Security>',bCrlf);
CkStringBuilder_AppendLine(sbXml,'    </SOAP-ENV:Header>',bCrlf);
CkStringBuilder_AppendLine(sbXml,'    <SOAP-ENV:Body xmlns:SOAP-SEC="http://schemas.xmlsoap.org/soap/security/2000-12" SOAP-SEC:id="Body">',bCrlf);
CkStringBuilder_AppendLine(sbXml,'        <z:FooBar xmlns:z="http://example.com" />',bCrlf);
CkStringBuilder_AppendLine(sbXml,'    </SOAP-ENV:Body>',bCrlf);
CkStringBuilder_AppendLine(sbXml,'</SOAP-ENV:Envelope>',bCrlf);

// Load the certificate used for signing.  The certificate's private key is stored in 
// the Azure Key Vault.
// However, we still need the certificate locally (without private key).
cert := CkCert_Create();
success := CkCert_LoadFromFile(cert,'qa_data/certs/myCert.cer');
if (success = False) then
  begin
    Memo1.Lines.Add(CkCert__lastErrorText(cert));
    Exit;
  end;

// Here's a screenshot of our certificate with private key on Azure Key Vault:


// To sign using the Azure Key Vault, 
// add the following lines of code to specify your authentication credentials,
// and the name of the certificate w/ private key on the Azure server to be used.
jsonAzure := CkJsonObject_Create();
// Set the "service" equal to "azure_keyvault" to tell Chilkat to use Azure Key Vault for signing.
CkJsonObject_UpdateString(jsonAzure,'service','azure_keyvault');
CkJsonObject_UpdateString(jsonAzure,'client_id','APP_ID');
CkJsonObject_UpdateString(jsonAzure,'client_secret','APP_PASSWORD');
CkJsonObject_UpdateString(jsonAzure,'tenant_id','TENANT_ID');
// In the above screenshot, our vault name is "kvchilkat".  You will use your vault name.
CkJsonObject_UpdateString(jsonAzure,'vault_name','VAULT_NAME');
// In the above screenshot, our cert name is "ChilkatTest1".  You will use your cert name.
CkJsonObject_UpdateString(jsonAzure,'cert_name','CERT_NAME');
// In the above screenshot, our cert version is "63b94a23389546ecbc8eb6208a1bef37".  You will use your cert version.
CkJsonObject_UpdateString(jsonAzure,'cert_version','CERT_VERSION');
success := CkCert_SetCloudSigner(cert,jsonAzure);

// Prepare for signing...
gen := CkXmlDSigGen_Create();

// Indicate where the Signature will be inserted.
CkXmlDSigGen_putSigLocation(gen,'SOAP-ENV:Envelope|SOAP-ENV:Header|wsse:Security');

// Add a reference to the fragment of the XML to be signed.

// Note: "Body" refers to the XML element having an "id" equal to "Body", where "id" is case insensitive
// and where any namespace might qualify the attribute.  In this case, the SOAP-ENV:Body fragment is signed
// NOT because the tag = "Body", but because it has SOAP-SEC:id="Body"
CkXmlDSigGen_AddSameDocRef(gen,'Body','sha1','EXCL_C14N','','');

// (You can read about the SignedInfoPrefixList in the online reference documentation.  It's optional..)
CkXmlDSigGen_putSignedInfoPrefixList(gen,'wsse SOAP-ENV');

CkXmlDSigGen_putKeyInfoType(gen,'X509Data');
CkXmlDSigGen_putX509Type(gen,'IssuerSerial');

bUsePrivateKey := True;
success := CkXmlDSigGen_SetX509Cert(gen,cert,bUsePrivateKey);
if (success <> True) then
  begin
    Memo1.Lines.Add(CkXmlDSigGen__lastErrorText(gen));
    CkCert_Dispose(cert);
    Exit;
  end;
// Everything's specified.  Now create and insert the Signature
// (The actual signing of the hash will happen on the Aruba server.)
success := CkXmlDSigGen_CreateXmlDSigSb(gen,sbXml);
if (success <> True) then
  begin
    Memo1.Lines.Add(CkXmlDSigGen__lastErrorText(gen));
    Exit;
  end;

// Examine the XML with the digital signature inserted
Memo1.Lines.Add(CkStringBuilder__getAsString(sbXml));

// --------------------------------------------------------------------------------
// Also see Chilkat's Online WSDL Code Generator
// to generate code and SOAP Request and Response XML for each operation in a WSDL.
// --------------------------------------------------------------------------------

CkStringBuilder_Dispose(sbXml);
CkCert_Dispose(cert);
CkJsonObject_Dispose(jsonAzure);
CkXmlDSigGen_Dispose(gen);

end;