Rust

Sign Italian SPID Metadata XML

See more XML Digital Signatures Examples

Demonstrates how to create an XML digital signature for Italian SPID Metadata. Rust

// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

let _ = true;

// Load the XML to be signed.
let sb_xml = chilkat::StringBuilder::new();
if sb_xml.load_file("qa_data/xml_dsig/spid_metadata.xml", "utf-8").is_err() {
    println!("Failed to load the input file.");
    return;
}

// The XML to sign contains XML such as this:

// <?xml version="1.0" encoding="utf-8"?>
// <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://***.it" ID="_AE17AFFF-A600-49D5-B81D-76EEA55B50FF">
//     <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true" WantAssertionsSigned="true">
//         <md:KeyDescriptor use="signing">
//             <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
//                 <ds:X509Data>
//                     <ds:X509Certificate>MIIF5...</ds:X509Certificate>
//                 </ds:X509Data>
//             </ds:KeyInfo>
//         </md:KeyDescriptor>
//         <md:KeyDescriptor use="encryption">
//             <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
//                 <ds:X509Data>
//                     <ds:X509Certificate>MIIF5...</ds:X509Certificate>
//                 </ds:X509Data>
//             </ds:KeyInfo>
//         </md:KeyDescriptor>
//         <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://***.it/it-it/spid/logout"/>
//         <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
//         <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://***.it/it-it/spid/loginresp" index="0" isDefault="true"/>
//         <md:AttributeConsumingService index="1">
//             <md:ServiceName xml:lang="it">Servizi Online</md:ServiceName>
//             <md:ServiceDescription xml:lang="it">Accesso ai Servizi Online</md:ServiceDescription>
//             <md:RequestedAttribute Name="spidCode" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
//             <md:RequestedAttribute Name="name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
//             <md:RequestedAttribute Name="familyName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
//             <md:RequestedAttribute Name="fiscalNumber" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
//         </md:AttributeConsumingService>
//     </md:SPSSODescriptor>
//     <md:Organization>
//         <md:OrganizationName xml:lang="it">SomeCompany s.r.l.</md:OrganizationName>
//         <md:OrganizationDisplayName xml:lang="it">SomeCompany s.r.l.</md:OrganizationDisplayName>
//         <md:OrganizationURL xml:lang="it">https://***.it</md:OrganizationURL>
//     </md:Organization>
// </md:EntityDescriptor>

let gen_ = chilkat::XmlDSigGen::new();

gen_.set_sig_location("md:EntityDescriptor|md:SPSSODescriptor");
gen_.set_sig_location_mod(2);
gen_.set_signed_info_canon_alg("EXCL_C14N");
gen_.set_signed_info_digest_method("sha256");

// -------- Reference 1 --------
let _ = gen_.add_same_doc_ref("_AE17AFFF-A600-49D5-B81D-76EEA55B50FF", "sha256", "EXCL_C14N", "", "");

// Provide a certificate + private key. (PFX password is test123)
let cert = chilkat::Cert::new();
if cert.load_pfx_file("qa_data/pfx/cert_test123.pfx", "test123").is_err() {
    println!("{}", cert.last_error_text());
    return;
}

let _ = gen_.set_x509_cert(&cert, true);

gen_.set_key_info_type("X509Data+KeyValue");
gen_.set_x509_type("Certificate");

gen_.set_behaviors("IndentedSignature,ForceAddEnvelopedSignatureTransform,OmitAlreadyDefinedSigNamespace");

// Sign the XML...
if gen_.create_xml_d_sig_sb(&sb_xml).is_err() {
    println!("{}", gen_.last_error_text());
    return;
}

// -----------------------------------------------

// Save the signed XML to a file.
let _ = sb_xml.write_file("qa_output/signedXml.xml", "utf-8", false).is_ok();

println!("{}", sb_xml.get_as_string().unwrap_or_default());

// ----------------------------------------
// Verify the signatures we just produced...
let verifier = chilkat::XmlDSig::new();
if verifier.load_signature_sb(&sb_xml).is_err() {
    println!("{}", verifier.last_error_text());
    return;
}

let num_sigs = verifier.num_signatures();
let mut verify_idx = 0;
while verify_idx < num_sigs {
    verifier.set_selector(verify_idx);
    if verifier.verify_signature(true).is_err() {
        println!("{}", verifier.last_error_text());
        return;
    }

    verify_idx = verify_idx + 1;
}

println!("All signatures were successfully verified.");