Objective-C

Sign Italian SPID Metadata XML

See more XML Digital Signatures Examples

Demonstrates how to create an XML digital signature for Italian SPID Metadata. Objective-C

#import <CkoStringBuilder.h>
#import <CkoXmlDSigGen.h>
#import <CkoCert.h>
#import <CkoXmlDSig.h>

BOOL success = NO;

// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

success = YES;

// Load the XML to be signed.
CkoStringBuilder *sbXml = [[CkoStringBuilder alloc] init];
success = [sbXml LoadFile: @"qa_data/xml_dsig/spid_metadata.xml" charset: @"utf-8"];
if (success == NO) {
    NSLog(@"%@",@"Failed to load the input file.");
    return;
}

// The XML to sign contains XML such as this:

// <?xml version="1.0" encoding="utf-8"?>
// <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://***.it" ID="_AE17AFFF-A600-49D5-B81D-76EEA55B50FF">
//     <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true" WantAssertionsSigned="true">
//         <md:KeyDescriptor use="signing">
//             <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
//                 <ds:X509Data>
//                     <ds:X509Certificate>MIIF5...</ds:X509Certificate>
//                 </ds:X509Data>
//             </ds:KeyInfo>
//         </md:KeyDescriptor>
//         <md:KeyDescriptor use="encryption">
//             <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
//                 <ds:X509Data>
//                     <ds:X509Certificate>MIIF5...</ds:X509Certificate>
//                 </ds:X509Data>
//             </ds:KeyInfo>
//         </md:KeyDescriptor>
//         <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://***.it/it-it/spid/logout"/>
//         <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
//         <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://***.it/it-it/spid/loginresp" index="0" isDefault="true"/>
//         <md:AttributeConsumingService index="1">
//             <md:ServiceName xml:lang="it">Servizi Online</md:ServiceName>
//             <md:ServiceDescription xml:lang="it">Accesso ai Servizi Online</md:ServiceDescription>
//             <md:RequestedAttribute Name="spidCode" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
//             <md:RequestedAttribute Name="name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
//             <md:RequestedAttribute Name="familyName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
//             <md:RequestedAttribute Name="fiscalNumber" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
//         </md:AttributeConsumingService>
//     </md:SPSSODescriptor>
//     <md:Organization>
//         <md:OrganizationName xml:lang="it">SomeCompany s.r.l.</md:OrganizationName>
//         <md:OrganizationDisplayName xml:lang="it">SomeCompany s.r.l.</md:OrganizationDisplayName>
//         <md:OrganizationURL xml:lang="it">https://***.it</md:OrganizationURL>
//     </md:Organization>
// </md:EntityDescriptor>

CkoXmlDSigGen *gen = [[CkoXmlDSigGen alloc] init];

gen.SigLocation = @"md:EntityDescriptor|md:SPSSODescriptor";
gen.SigLocationMod = [NSNumber numberWithInt:2];
gen.SignedInfoCanonAlg = @"EXCL_C14N";
gen.SignedInfoDigestMethod = @"sha256";

// -------- Reference 1 --------
[gen AddSameDocRef: @"_AE17AFFF-A600-49D5-B81D-76EEA55B50FF" digestMethod: @"sha256" canonMethod: @"EXCL_C14N" prefixList: @"" refType: @""];

// Provide a certificate + private key. (PFX password is test123)
CkoCert *cert = [[CkoCert alloc] init];
success = [cert LoadPfxFile: @"qa_data/pfx/cert_test123.pfx" password: @"test123"];
if (success != YES) {
    NSLog(@"%@",cert.LastErrorText);
    return;
}

[gen SetX509Cert: cert usePrivateKey: YES];

gen.KeyInfoType = @"X509Data+KeyValue";
gen.X509Type = @"Certificate";

gen.Behaviors = @"IndentedSignature,ForceAddEnvelopedSignatureTransform,OmitAlreadyDefinedSigNamespace";

// Sign the XML...
success = [gen CreateXmlDSigSb: sbXml];
if (success != YES) {
    NSLog(@"%@",gen.LastErrorText);
    return;
}

// -----------------------------------------------

// Save the signed XML to a file.
success = [sbXml WriteFile: @"qa_output/signedXml.xml" charset: @"utf-8" emitBom: NO];

NSLog(@"%@",[sbXml GetAsString]);

// ----------------------------------------
// Verify the signatures we just produced...
CkoXmlDSig *verifier = [[CkoXmlDSig alloc] init];
success = [verifier LoadSignatureSb: sbXml];
if (success != YES) {
    NSLog(@"%@",verifier.LastErrorText);
    return;
}

int numSigs = [verifier.NumSignatures intValue];
int verifyIdx = 0;
while (verifyIdx < numSigs) {
    verifier.Selector = [NSNumber numberWithInt: verifyIdx];
    BOOL verified = [verifier VerifySignature: YES];
    if (verified != YES) {
        NSLog(@"%@",verifier.LastErrorText);
        return;
    }

    verifyIdx = verifyIdx + 1;
}

NSLog(@"%@",@"All signatures were successfully verified.");