(PowerShell) Create XAdES with ec:InclusiveNamespaces within the Transforms

Demonstrates how to generate XAdES that has a Reference that has Transforms that include an ec:InclusiveNamespaces.

Chilkat .NET Downloads Chilkat .NET Assemblies

Add-Type -Path "C:\chilkat\ChilkatDotNet47-9.5.0-x64\ChilkatDotNet47.dll"

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# This is the XML we'll be signing:

# <soapenv:Envelope xmlns:obs="http://csioz.gov.pl/zsmopl/ws/obslugakomunikatow/" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
# 	<soapenv:Header>
# 		<wsse:Security 
# 		    xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
# 		    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" soapenv:mustUnderstand="1">
# 			<wsse:BinarySecurityToken
# 				EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
# 				ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509PKIPathv1"
# 				wsu:Id="X509-02BF0107214FC61449FD0013DF68F0359">MII...</wsse:BinarySecurityToken>
# 		</wsse:Security>
# 	</soapenv:Header>
# 	<soapenv:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" 
# 		wsu:Id="id-396BB6026342EB5C0E1EA73593B3CC098">
# 		<obs:zapiszKomunikatOS>
# 			<komunikatOS>
# 				<idPodmiotuRaportujacego>
# 					<idBiznesowy>000000011986</idBiznesowy>
# 					<rodzajPodmiotuRaportujacego>PA</rodzajPodmiotuRaportujacego>
# 				</idPodmiotuRaportujacego>
# 			</komunikatOS>
# 		</obs:zapiszKomunikatOS>
# 	</soapenv:Body>
# </soapenv:Envelope>
# 

# ----------------------------------------------------------------------
# IMPORTANT: This generated example requires Chilkat v9.5.0.77 or later.
# ----------------------------------------------------------------------
$success = $true
# Create the above XML to be signed...
$xmlToSign = New-Object Chilkat.Xml
$xmlToSign.Tag = "soapenv:Envelope"
$xmlToSign.AddAttribute("xmlns:obs","http://csioz.gov.pl/zsmopl/ws/obslugakomunikatow/")
$xmlToSign.AddAttribute("xmlns:soapenv","http://schemas.xmlsoap.org/soap/envelope/")
$xmlToSign.UpdateAttrAt("soapenv:Header|wsse:Security",$true,"xmlns:wsse","http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd")
$xmlToSign.UpdateAttrAt("soapenv:Header|wsse:Security",$true,"xmlns:wsu","http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd")
$xmlToSign.UpdateAttrAt("soapenv:Header|wsse:Security",$true,"soapenv:mustUnderstand","1")
$xmlToSign.UpdateAttrAt("soapenv:Header|wsse:Security|wsse:BinarySecurityToken",$true,"EncodingType","http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary")
$xmlToSign.UpdateAttrAt("soapenv:Header|wsse:Security|wsse:BinarySecurityToken",$true,"ValueType","http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509PKIPathv1")
$xmlToSign.UpdateAttrAt("soapenv:Header|wsse:Security|wsse:BinarySecurityToken",$true,"wsu:Id","X509-02BF0107214FC61449FD0013DF68F0359")
# Note: The content of this XML node is a placeholder that will be updated below with the X509PKIPathv1 for the signing certificate.
$xmlToSign.UpdateChildContent("soapenv:Header|wsse:Security|wsse:BinarySecurityToken","BinarySecurityToken_Base64Binary_Content")
$xmlToSign.UpdateAttrAt("soapenv:Body",$true,"xmlns:wsu","http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd")
$xmlToSign.UpdateAttrAt("soapenv:Body",$true,"wsu:Id","id-396BB6026342EB5C0E1EA73593B3CC098")
$xmlToSign.UpdateChildContent("soapenv:Body|obs:zapiszKomunikatOS|komunikatOS|idPodmiotuRaportujacego|idBiznesowy","000000011986")
$xmlToSign.UpdateChildContent("soapenv:Body|obs:zapiszKomunikatOS|komunikatOS|idPodmiotuRaportujacego|rodzajPodmiotuRaportujacego","PA")

$gen = New-Object Chilkat.XmlDSigGen

$gen.SigLocation = "soapenv:Envelope|soapenv:Header|wsse:Security"
$gen.SigLocationMod = 0
$gen.SigId = "SIG-BB965DFC3C8AAF87903C0ED898B8D2A8D"
$gen.SigNamespacePrefix = "ds"
$gen.SigNamespaceUri = "http://www.w3.org/2000/09/xmldsig#"
$gen.SignedInfoCanonAlg = "EXCL_C14N"
$gen.SignedInfoDigestMethod = "sha1"

# Set the KeyInfoId before adding references..
$gen.KeyInfoId = "KI-9D95C38916099AD2EE87DDAC1A76E97E4"

# -------- Reference 1 --------
$gen.AddSameDocRef("id-396BB6026342EB5C0E1EA73593B3CC098","sha1","EXCL_C14N","obs","")

# The reference to be produced in the Signature should look like this:

# <ds:Reference URI="#id-396BB6026342EB5C0E1EA73593B3CC098">
#     <ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
#         <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="obs"></ec:InclusiveNamespaces>
#     </ds:Transform></ds:Transforms>
#     <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></ds:DigestMethod>
#     <ds:DigestValue>2e9hZYj/CN2nPsgQqUraU43k3ds=</ds:DigestValue>
# </ds:Reference>
# 

# Provide a certificate + private key. (PFX password is test123)
$cert = New-Object Chilkat.Cert
$success = $cert.LoadPfxFile("qa_data/pfx/cert_test123.pfx","test123")
if ($success -ne $true) {
    $($cert.LastErrorText)
    exit
}

$gen.SetX509Cert($cert,$true)

$gen.KeyInfoType = "Custom"

# Create the custom KeyInfo XML..
$xmlCustomKeyInfo = New-Object Chilkat.Xml
$xmlCustomKeyInfo.Tag = "wsse:SecurityTokenReference"
$xmlCustomKeyInfo.AddAttribute("wsse11:TokenType","http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509PKIPathv1")
$xmlCustomKeyInfo.AddAttribute("xmlns:wsse11","http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd")
$xmlCustomKeyInfo.AddAttribute("wsu:Id","STR-FF238E7C061332C5B19752C2FBC8CDEF2")
$xmlCustomKeyInfo.UpdateAttrAt("wsse:Reference",$true,"URI","#X509-02BF0107214FC61449FD0013DF68F0359")
$xmlCustomKeyInfo.UpdateAttrAt("wsse:Reference",$true,"ValueType","http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509PKIPathv1")

$xmlCustomKeyInfo.EmitXmlDecl = $false
$gen.CustomKeyInfoXml = $xmlCustomKeyInfo.GetXml()

# Load XML to be signed...
$sbXml = New-Object Chilkat.StringBuilder
$xmlToSign.GetXmlSb($sbXml)

# Update BinarySecurityToken_Base64Binary_Content with the actual X509PKIPathv1 of the signing cert.
$nReplaced = $sbXml.Replace("BinarySecurityToken_Base64Binary_Content",$cert.X509PKIPathv1())

$gen.Behaviors = "IndentedSignature"

# Sign the XML...
$success = $gen.CreateXmlDSigSb($sbXml)
if ($success -ne $true) {
    $($gen.LastErrorText)
    exit
}

# -----------------------------------------------

# Save the signed XML to a file.
$success = $sbXml.WriteFile("qa_output/signedXml.xml","utf-8",$false)

$($sbXml.GetAsString())

# ----------------------------------------
# Verify the signatures we just produced...
$verifier = New-Object Chilkat.XmlDSig
$success = $verifier.LoadSignatureSb($sbXml)
if ($success -ne $true) {
    $($verifier.LastErrorText)
    exit
}

$numSigs = $verifier.NumSignatures
$verifyIdx = 0
while ($verifyIdx -lt $numSigs) {
    $verifier.Selector = $verifyIdx
    $verified = $verifier.VerifySignature($true)
    if ($verified -ne $true) {
        $($verifier.LastErrorText)
        exit
    }

    $verifyIdx = $verifyIdx + 1
}

$("All signatures were successfully verified.")