(Delphi DLL) Sign SOAP XML for New Zealand Customs Service

See more XAdES Examples

Demonstrates how to create an XAdES signed SOAP XML pertaining to the New Zealand Customs Service.

Note: This example requires Chilkat v9.5.0.96 or later.

Chilkat for Delphi Downloads Chilkat non-ActiveX DLL for Delphi Chilkat ActiveX DLL for Delphi * The examples here use the non-ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, StringBuilder, XmlDSigGen, Xml, CkDateTime, Cert;

...

procedure TForm1.Button1Click(Sender: TObject);
var
success: Boolean;
tsId: HCkStringBuilder;
strId: HCkStringBuilder;
keyInfoId: HCkStringBuilder;
dt: HCkDateTime;
sbNow: HCkStringBuilder;
n: Integer;
sbNowPlusOneHour: HCkStringBuilder;
xmlToSign: HCkXml;
gen: HCkXmlDSigGen;
xml1: HCkXml;
xml2: HCkXml;
cert: HCkCert;
xmlCustomKeyInfo: HCkXml;
sbXml: HCkStringBuilder;

begin
// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

success := True;

// Create the following XML to be signed:

// <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
//     xmlns:v1="http://customs.govt.nz/jbms/msggate/reqresp/v1">
//     <soapenv:Header>
//         <wsse:Security soapenv:mustUnderstand="1"
//             xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
//             xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
//             <wsu:Timestamp wsu:Id="TS-037E78514E9B9132CB16817563559151">
//                 <wsu:Created>2023-04-17T18:32:35.913Z</wsu:Created>
//                 <wsu:Expires>2023-04-17T19:32:35.913Z</wsu:Expires>
//             </wsu:Timestamp>
//         </wsse:Security>
//     </soapenv:Header>
//     <soapenv:Body wsu:Id="id-8"
//         xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
//         <v1:RequestResponse>
//             <v1:Submitter>TEST1234</v1:Submitter>
//             <v1:MailboxMsgId>999999</v1:MailboxMsgId>
//         </v1:RequestResponse>
//     </soapenv:Body>
// </soapenv:Envelope>

// Create a random ID like this: TS-037E78514E9B9132CB16817563559151
tsId := CkStringBuilder_Create();
CkStringBuilder_Append(tsId,'TS-');
CkStringBuilder_AppendRandom(tsId,16,'hex');

// STR-037E78514E9B9132CB16817563559614
strId := CkStringBuilder_Create();
CkStringBuilder_Append(strId,'STR-');
CkStringBuilder_AppendRandom(strId,16,'hex');

// KI-037E78514E9B9132CB16817563559583
keyInfoId := CkStringBuilder_Create();
CkStringBuilder_Append(keyInfoId,'KI-');
CkStringBuilder_AppendRandom(keyInfoId,16,'hex');

// Create a date/time for the current time with this format:  2023-04-17T18:32:35.913Z
dt := CkDateTime_Create();
CkDateTime_SetFromCurrentSystemTime(dt);

sbNow := CkStringBuilder_Create();
CkStringBuilder_Append(sbNow,CkDateTime__getAsTimestamp(dt,False));
// If we really need the milliseconds, we can replace the "Z" with ".000Z"
// The server will also likely accept a timestamp without milliseconds, such as 2023-04-17T18:32:35Z
n := CkStringBuilder_Replace(sbNow,'Z','.000Z');

sbNowPlusOneHour := CkStringBuilder_Create();
CkDateTime_AddSeconds(dt,3600);
CkStringBuilder_Append(sbNowPlusOneHour,CkDateTime__getAsTimestamp(dt,False));
n := CkStringBuilder_Replace(sbNowPlusOneHour,'Z','.000Z');

xmlToSign := CkXml_Create();
CkXml_putTag(xmlToSign,'soapenv:Envelope');
CkXml_AddAttribute(xmlToSign,'xmlns:soapenv','http://schemas.xmlsoap.org/soap/envelope/');
CkXml_AddAttribute(xmlToSign,'xmlns:v1','http://customs.govt.nz/jbms/msggate/reqresp/v1');
CkXml_UpdateAttrAt(xmlToSign,'soapenv:Header|wsse:Security',True,'soapenv:mustUnderstand','1');
CkXml_UpdateAttrAt(xmlToSign,'soapenv:Header|wsse:Security',True,'xmlns:wsse','http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd');
CkXml_UpdateAttrAt(xmlToSign,'soapenv:Header|wsse:Security',True,'xmlns:wsu','http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd');
CkXml_UpdateAttrAt(xmlToSign,'soapenv:Header|wsse:Security|wsu:Timestamp',True,'wsu:Id',CkStringBuilder__getAsString(tsId));
CkXml_UpdateChildContent(xmlToSign,'soapenv:Header|wsse:Security|wsu:Timestamp|wsu:Created',CkStringBuilder__getAsString(sbNow));
CkXml_UpdateChildContent(xmlToSign,'soapenv:Header|wsse:Security|wsu:Timestamp|wsu:Expires',CkStringBuilder__getAsString(sbNowPlusOneHour));
CkXml_UpdateAttrAt(xmlToSign,'soapenv:Body',True,'wsu:Id','id-8');
CkXml_UpdateAttrAt(xmlToSign,'soapenv:Body',True,'xmlns:wsu','http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd');
CkXml_UpdateChildContent(xmlToSign,'soapenv:Body|v1:RequestResponse|v1:Submitter','TEST1234');
CkXml_UpdateChildContent(xmlToSign,'soapenv:Body|v1:RequestResponse|v1:MailboxMsgId','999999');

gen := CkXmlDSigGen_Create();

CkXmlDSigGen_putSigLocation(gen,'soapenv:Envelope|soapenv:Header|wsse:Security');
CkXmlDSigGen_putSigLocationMod(gen,0);
CkXmlDSigGen_putSigId(gen,'SIG-037E78514E9B9132CB16817563559695');
CkXmlDSigGen_putSigNamespacePrefix(gen,'ds');
CkXmlDSigGen_putSigNamespaceUri(gen,'http://www.w3.org/2000/09/xmldsig#');
CkXmlDSigGen_putSignedInfoPrefixList(gen,'soapenv v1');
CkXmlDSigGen_putIncNamespacePrefix(gen,'ec');
CkXmlDSigGen_putIncNamespaceUri(gen,'http://www.w3.org/2001/10/xml-exc-c14n#');
CkXmlDSigGen_putSignedInfoCanonAlg(gen,'EXCL_C14N');
CkXmlDSigGen_putSignedInfoDigestMethod(gen,'sha256');

// Set the KeyInfoId before adding references..
CkXmlDSigGen_putKeyInfoId(gen,CkStringBuilder__getAsString(keyInfoId));

// -------- Reference 1 --------
xml1 := CkXml_Create();
CkXml_putTag(xml1,'ds:Transforms');
CkXml_UpdateAttrAt(xml1,'ds:Transform',True,'Algorithm','http://www.w3.org/2001/10/xml-exc-c14n#');
CkXml_UpdateAttrAt(xml1,'ds:Transform|ec:InclusiveNamespaces',True,'PrefixList','wsse soapenv v1');
CkXml_UpdateAttrAt(xml1,'ds:Transform|ec:InclusiveNamespaces',True,'xmlns:ec','http://www.w3.org/2001/10/xml-exc-c14n#');

CkXmlDSigGen_AddSameDocRef2(gen,CkStringBuilder__getAsString(tsId),'sha256',xml1,'');

// -------- Reference 2 --------
xml2 := CkXml_Create();
CkXml_putTag(xml2,'ds:Transforms');
CkXml_UpdateAttrAt(xml2,'ds:Transform',True,'Algorithm','http://www.w3.org/2001/10/xml-exc-c14n#');
CkXml_UpdateAttrAt(xml2,'ds:Transform|ec:InclusiveNamespaces',True,'PrefixList','v1');
CkXml_UpdateAttrAt(xml2,'ds:Transform|ec:InclusiveNamespaces',True,'xmlns:ec','http://www.w3.org/2001/10/xml-exc-c14n#');

CkXmlDSigGen_AddSameDocRef2(gen,'id-8','sha256',xml2,'');

// Provide a certificate + private key. (PFX password is test123)
cert := CkCert_Create();
success := CkCert_LoadPfxFile(cert,'qa_data/pfx/cert_test123.pfx','test123');
if (success <> True) then
  begin
    Memo1.Lines.Add(CkCert__lastErrorText(cert));
    Exit;
  end;
CkXmlDSigGen_SetX509Cert(gen,cert,True);

CkXmlDSigGen_putKeyInfoType(gen,'Custom');

// Create the custom KeyInfo XML..
xmlCustomKeyInfo := CkXml_Create();
CkXml_putTag(xmlCustomKeyInfo,'wsse:SecurityTokenReference');
CkXml_AddAttribute(xmlCustomKeyInfo,'wsu:Id',CkStringBuilder__getAsString(strId));
CkXml_UpdateAttrAt(xmlCustomKeyInfo,'wsse:KeyIdentifier',True,'EncodingType','http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary');
CkXml_UpdateAttrAt(xmlCustomKeyInfo,'wsse:KeyIdentifier',True,'ValueType','http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3');
// Insert the single-line base64 of the signing certificate's DER
CkCert_putUncommonOptions(cert,'Base64CertNoCRLF');
CkXml_UpdateChildContent(xmlCustomKeyInfo,'wsse:KeyIdentifier',CkCert__getEncoded(cert));

CkXml_putEmitXmlDecl(xmlCustomKeyInfo,False);
CkXmlDSigGen_putCustomKeyInfoXml(gen,CkXml__getXml(xmlCustomKeyInfo));

// Load XML to be signed...
sbXml := CkStringBuilder_Create();
CkXml_GetXmlSb(xmlToSign,sbXml);

CkXmlDSigGen_putBehaviors(gen,'IndentedSignature');

// Sign the XML...
CkXmlDSigGen_putVerboseLogging(gen,True);
success := CkXmlDSigGen_CreateXmlDSigSb(gen,sbXml);
if (success <> True) then
  begin
    Memo1.Lines.Add(CkXmlDSigGen__lastErrorText(gen));
    Exit;
  end;

// Save the signed XML to a file.
success := CkStringBuilder_WriteFile(sbXml,'c:/temp/qa_output/signedXml.xml','utf-8',False);

Memo1.Lines.Add(CkStringBuilder__getAsString(sbXml));

CkStringBuilder_Dispose(tsId);
CkStringBuilder_Dispose(strId);
CkStringBuilder_Dispose(keyInfoId);
CkDateTime_Dispose(dt);
CkStringBuilder_Dispose(sbNow);
CkStringBuilder_Dispose(sbNowPlusOneHour);
CkXml_Dispose(xmlToSign);
CkXmlDSigGen_Dispose(gen);
CkXml_Dispose(xml1);
CkXml_Dispose(xml2);
CkCert_Dispose(cert);
CkXml_Dispose(xmlCustomKeyInfo);
CkStringBuilder_Dispose(sbXml);

end;