Lazarus Pascal

Sign Italian SPID Metadata XML

See more XML Digital Signatures Examples

Demonstrates how to create an XML digital signature for Italian SPID Metadata. Lazarus Pascal

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.StringBuilder,
  Chilkat.XmlDSigGen,
  Chilkat.Cert,
  Chilkat.XmlDSig;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  sbXml: TStringBuilder;
  gen: TXmlDSigGen;
  cert: TCert;
  verifier: TXmlDSig;
  numSigs: Integer;
  verifyIdx: Integer;
  verified: Boolean;

begin
  success := False;

  //  This example assumes the Chilkat API to have been previously unlocked.
  //  See Global Unlock Sample for sample code.

  success := True;

  //  Load the XML to be signed.
  sbXml := TStringBuilder.Create;
  success := sbXml.LoadFile('qa_data/xml_dsig/spid_metadata.xml','utf-8');
  if (success = False) then
    begin
      WriteLn('Failed to load the input file.');
      Exit;
    end;

  //  The XML to sign contains XML such as this:

  //  <?xml version="1.0" encoding="utf-8"?>
  //  <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://***.it" ID="_AE17AFFF-A600-49D5-B81D-76EEA55B50FF">
  //      <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true" WantAssertionsSigned="true">
  //          <md:KeyDescriptor use="signing">
  //              <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
  //                  <ds:X509Data>
  //                      <ds:X509Certificate>MIIF5...</ds:X509Certificate>
  //                  </ds:X509Data>
  //              </ds:KeyInfo>
  //          </md:KeyDescriptor>
  //          <md:KeyDescriptor use="encryption">
  //              <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
  //                  <ds:X509Data>
  //                      <ds:X509Certificate>MIIF5...</ds:X509Certificate>
  //                  </ds:X509Data>
  //              </ds:KeyInfo>
  //          </md:KeyDescriptor>
  //          <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://***.it/it-it/spid/logout"/>
  //          <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
  //          <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://***.it/it-it/spid/loginresp" index="0" isDefault="true"/>
  //          <md:AttributeConsumingService index="1">
  //              <md:ServiceName xml:lang="it">Servizi Online</md:ServiceName>
  //              <md:ServiceDescription xml:lang="it">Accesso ai Servizi Online</md:ServiceDescription>
  //              <md:RequestedAttribute Name="spidCode" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
  //              <md:RequestedAttribute Name="name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
  //              <md:RequestedAttribute Name="familyName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
  //              <md:RequestedAttribute Name="fiscalNumber" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
  //          </md:AttributeConsumingService>
  //      </md:SPSSODescriptor>
  //      <md:Organization>
  //          <md:OrganizationName xml:lang="it">SomeCompany s.r.l.</md:OrganizationName>
  //          <md:OrganizationDisplayName xml:lang="it">SomeCompany s.r.l.</md:OrganizationDisplayName>
  //          <md:OrganizationURL xml:lang="it">https://***.it</md:OrganizationURL>
  //      </md:Organization>
  //  </md:EntityDescriptor>

  gen := TXmlDSigGen.Create;

  gen.SigLocation := 'md:EntityDescriptor|md:SPSSODescriptor';
  gen.SigLocationMod := 2;
  gen.SignedInfoCanonAlg := 'EXCL_C14N';
  gen.SignedInfoDigestMethod := 'sha256';

  //  -------- Reference 1 --------
  gen.AddSameDocRef('_AE17AFFF-A600-49D5-B81D-76EEA55B50FF','sha256','EXCL_C14N','','');

  //  Provide a certificate + private key. (PFX password is test123)
  cert := TCert.Create;
  success := cert.LoadPfxFile('qa_data/pfx/cert_test123.pfx','test123');
  if (success <> True) then
    begin
      WriteLn(cert.LastErrorText);
      Exit;
    end;
  gen.SetX509Cert(cert,True);

  gen.KeyInfoType := 'X509Data+KeyValue';
  gen.X509Type := 'Certificate';

  gen.Behaviors := 'IndentedSignature,ForceAddEnvelopedSignatureTransform,OmitAlreadyDefinedSigNamespace';

  //  Sign the XML...
  success := gen.CreateXmlDSigSb(sbXml);
  if (success <> True) then
    begin
      WriteLn(gen.LastErrorText);
      Exit;
    end;
  //  -----------------------------------------------

  //  Save the signed XML to a file.
  success := sbXml.WriteFile('qa_output/signedXml.xml','utf-8',False);

  WriteLn(sbXml.GetAsString());

  //  ----------------------------------------
  //  Verify the signatures we just produced...
  verifier := TXmlDSig.Create;
  success := verifier.LoadSignatureSb(sbXml);
  if (success <> True) then
    begin
      WriteLn(verifier.LastErrorText);
      Exit;
    end;

  numSigs := verifier.NumSignatures;
  verifyIdx := 0;
  while verifyIdx < numSigs do
    begin
      verifier.Selector := verifyIdx;
      verified := verifier.VerifySignature(True);
      if (verified <> True) then
        begin
          WriteLn(verifier.LastErrorText);
          Exit;
        end;
      verifyIdx := verifyIdx + 1;
    end;

  WriteLn('All signatures were successfully verified.');


  sbXml.Free;
  gen.Free;
  cert.Free;
  verifier.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.