(PowerBuilder) Verify XML Signature with External URL References

Demonstrates how to verify an XML digital signature that includes references to URLs where the data to be digested is on a web server.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

integer li_rc
oleobject loo_Verifier
oleobject loo_Http
oleobject loo_SbSignedXml
integer li_Success
oleobject loo_SbRefUri
oleobject loo_Bd
integer li_NumRefs
integer i
integer li_BVerified

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// The signed XML we wish to verify contains external references such as this:

//     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref0" URI="https://www.chilkatsoft.com/images/starfish.jpg">
//       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//       <ds:DigestValue>AOU810yJV5Np/DnO29qpObqiTSTTCDvxGsX5ayiTYXI=</ds:DigestValue>
//     </ds:Reference>
//     <ds:Reference Id="xmldsig-e7ae7ce2-9133-4d56-bd97-0a6aef738cc2-ref1" URI="https://www.chilkatsoft.com/hamlet.xml">
//       <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
//       <ds:DigestValue>4sRRyWOzC7EOic4fQ9+Op1pa10DbgoBGjBvkq09LZmE=</ds:DigestValue>
//     </ds:Reference>

loo_Verifier = create oleobject
// Use "Chilkat_9_5_0.XmlDSig" for versions of Chilkat < 10.0.0
li_rc = loo_Verifier.ConnectToNewObject("Chilkat.XmlDSig")
if li_rc < 0 then
    destroy loo_Verifier
    MessageBox("Error","Connecting to COM object failed")
    return
end if
loo_Http = create oleobject
// Use "Chilkat_9_5_0.Http" for versions of Chilkat < 10.0.0
li_rc = loo_Http.ConnectToNewObject("Chilkat.Http")

// First load the signed XML
loo_SbSignedXml = create oleobject
// Use "Chilkat_9_5_0.StringBuilder" for versions of Chilkat < 10.0.0
li_rc = loo_SbSignedXml.ConnectToNewObject("Chilkat.StringBuilder")

li_Success = loo_SbSignedXml.LoadFile("qa_data/xml_dsig_verify/signedWithExternalUrlRefs.xml","utf-8")
if li_Success = 0 then
    Write-Debug "Failed to load signed XML."
    destroy loo_Verifier
    destroy loo_Http
    destroy loo_SbSignedXml
    return
end if

li_Success = loo_Verifier.LoadSignatureSb(loo_SbSignedXml)
if li_Success = 0 then
    Write-Debug loo_Verifier.LastErrorText
    destroy loo_Verifier
    destroy loo_Http
    destroy loo_SbSignedXml
    return
end if

// Iterate over each reference.  If it is an external URL reference, download the data and provide it to the verifier.
loo_SbRefUri = create oleobject
// Use "Chilkat_9_5_0.StringBuilder" for versions of Chilkat < 10.0.0
li_rc = loo_SbRefUri.ConnectToNewObject("Chilkat.StringBuilder")

loo_Bd = create oleobject
// Use "Chilkat_9_5_0.BinData" for versions of Chilkat < 10.0.0
li_rc = loo_Bd.ConnectToNewObject("Chilkat.BinData")

li_NumRefs = loo_Verifier.NumReferences
i = 0
do while i < li_NumRefs
    if loo_Verifier.IsReferenceExternal(i) = 1 then
        loo_SbRefUri.Clear()
        loo_SbRefUri.Append(loo_Verifier.ReferenceUri(i))
        if loo_SbRefUri.StartsWith("https://",0) = 1 then
            Write-Debug "External URL Reference: " + loo_SbRefUri.GetAsString()

            // Download the data at the URL and provide to the verifier.
            li_Success = loo_Http.DownloadBd(loo_SbRefUri.GetAsString(),loo_Bd)
            if li_Success = 0 then
                Write-Debug loo_Http.LastErrorText
                destroy loo_Verifier
                destroy loo_Http
                destroy loo_SbSignedXml
                destroy loo_SbRefUri
                destroy loo_Bd
                return
            end if

            li_Success = loo_Verifier.SetRefDataBd(i,loo_Bd)
            if li_Success = 0 then
                Write-Debug loo_Verifier.LastErrorText
                destroy loo_Verifier
                destroy loo_Http
                destroy loo_SbSignedXml
                destroy loo_SbRefUri
                destroy loo_Bd
                return
            end if

        end if

    end if

    i = i + 1
loop

// Now that we have the external data, verify the signature..
li_BVerified = loo_Verifier.VerifySignature(1)
if li_BVerified = 0 then
    Write-Debug loo_Verifier.LastErrorText
end if

Write-Debug "Signature verified = " + string(li_BVerified)


destroy loo_Verifier
destroy loo_Http
destroy loo_SbSignedXml
destroy loo_SbRefUri
destroy loo_Bd