Sample code for 30+ languages & platforms
Tcl

Sign SOAP XML for New Zealand Customs Service

See more XAdES Examples

Demonstrates how to create an XAdES signed SOAP XML pertaining to the New Zealand Customs Service.

Note: This example requires Chilkat v9.5.0.96 or later.

Chilkat Tcl Downloads

Download Chilkat for Tcl
Tcl 

load ./chilkat.dll

set success 0

# This example assumes the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

set success 1

# Create the following XML to be signed:

# <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
#     xmlns:v1="http://customs.govt.nz/jbms/msggate/reqresp/v1">
#     <soapenv:Header>
#         <wsse:Security soapenv:mustUnderstand="1"
#             xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
#             xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
#             <wsu:Timestamp wsu:Id="TS-037E78514E9B9132CB16817563559151">
#                 <wsu:Created>2023-04-17T18:32:35.913Z</wsu:Created>
#                 <wsu:Expires>2023-04-17T19:32:35.913Z</wsu:Expires>
#             </wsu:Timestamp>
#         </wsse:Security>
#     </soapenv:Header>
#     <soapenv:Body wsu:Id="id-8"
#         xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
#         <v1:RequestResponse>
#             <v1:Submitter>TEST1234</v1:Submitter>
#             <v1:MailboxMsgId>999999</v1:MailboxMsgId>
#         </v1:RequestResponse>
#     </soapenv:Body>
# </soapenv:Envelope>

# Create a random ID like this: TS-037E78514E9B9132CB16817563559151
set tsId [new_CkStringBuilder]

CkStringBuilder_Append $tsId "TS-"
CkStringBuilder_AppendRandom $tsId 16 "hex"

# STR-037E78514E9B9132CB16817563559614
set strId [new_CkStringBuilder]

CkStringBuilder_Append $strId "STR-"
CkStringBuilder_AppendRandom $strId 16 "hex"

# KI-037E78514E9B9132CB16817563559583
set keyInfoId [new_CkStringBuilder]

CkStringBuilder_Append $keyInfoId "KI-"
CkStringBuilder_AppendRandom $keyInfoId 16 "hex"

# Create a date/time for the current time with this format:  2023-04-17T18:32:35.913Z
set dt [new_CkDateTime]

CkDateTime_SetFromCurrentSystemTime $dt

set sbNow [new_CkStringBuilder]

CkStringBuilder_Append $sbNow [CkDateTime_getAsTimestamp $dt 0]
# If we really need the milliseconds, we can replace the "Z" with ".000Z"
# The server will also likely accept a timestamp without milliseconds, such as 2023-04-17T18:32:35Z
set n [CkStringBuilder_Replace $sbNow "Z" ".000Z"]

set sbNowPlusOneHour [new_CkStringBuilder]

CkDateTime_AddSeconds $dt 3600
CkStringBuilder_Append $sbNowPlusOneHour [CkDateTime_getAsTimestamp $dt 0]
set n [CkStringBuilder_Replace $sbNowPlusOneHour "Z" ".000Z"]

set xmlToSign [new_CkXml]

CkXml_put_Tag $xmlToSign "soapenv:Envelope"
CkXml_AddAttribute $xmlToSign "xmlns:soapenv" "http://schemas.xmlsoap.org/soap/envelope/"
CkXml_AddAttribute $xmlToSign "xmlns:v1" "http://customs.govt.nz/jbms/msggate/reqresp/v1"
CkXml_UpdateAttrAt $xmlToSign "soapenv:Header|wsse:Security" 1 "soapenv:mustUnderstand" "1"
CkXml_UpdateAttrAt $xmlToSign "soapenv:Header|wsse:Security" 1 "xmlns:wsse" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
CkXml_UpdateAttrAt $xmlToSign "soapenv:Header|wsse:Security" 1 "xmlns:wsu" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
CkXml_UpdateAttrAt $xmlToSign "soapenv:Header|wsse:Security|wsu:Timestamp" 1 "wsu:Id" [CkStringBuilder_getAsString $tsId]
CkXml_UpdateChildContent $xmlToSign "soapenv:Header|wsse:Security|wsu:Timestamp|wsu:Created" [CkStringBuilder_getAsString $sbNow]
CkXml_UpdateChildContent $xmlToSign "soapenv:Header|wsse:Security|wsu:Timestamp|wsu:Expires" [CkStringBuilder_getAsString $sbNowPlusOneHour]
CkXml_UpdateAttrAt $xmlToSign "soapenv:Body" 1 "wsu:Id" "id-8"
CkXml_UpdateAttrAt $xmlToSign "soapenv:Body" 1 "xmlns:wsu" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
CkXml_UpdateChildContent $xmlToSign "soapenv:Body|v1:RequestResponse|v1:Submitter" "TEST1234"
CkXml_UpdateChildContent $xmlToSign "soapenv:Body|v1:RequestResponse|v1:MailboxMsgId" "999999"

set gen [new_CkXmlDSigGen]

CkXmlDSigGen_put_SigLocation $gen "soapenv:Envelope|soapenv:Header|wsse:Security"
CkXmlDSigGen_put_SigLocationMod $gen 0
CkXmlDSigGen_put_SigId $gen "SIG-037E78514E9B9132CB16817563559695"
CkXmlDSigGen_put_SigNamespacePrefix $gen "ds"
CkXmlDSigGen_put_SigNamespaceUri $gen "http://www.w3.org/2000/09/xmldsig#"
CkXmlDSigGen_put_SignedInfoPrefixList $gen "soapenv v1"
CkXmlDSigGen_put_IncNamespacePrefix $gen "ec"
CkXmlDSigGen_put_IncNamespaceUri $gen "http://www.w3.org/2001/10/xml-exc-c14n#"
CkXmlDSigGen_put_SignedInfoCanonAlg $gen "EXCL_C14N"
CkXmlDSigGen_put_SignedInfoDigestMethod $gen "sha256"

# Set the KeyInfoId before adding references..
CkXmlDSigGen_put_KeyInfoId $gen [CkStringBuilder_getAsString $keyInfoId]

# -------- Reference 1 --------
set xml1 [new_CkXml]

CkXml_put_Tag $xml1 "ds:Transforms"
CkXml_UpdateAttrAt $xml1 "ds:Transform" 1 "Algorithm" "http://www.w3.org/2001/10/xml-exc-c14n#"
CkXml_UpdateAttrAt $xml1 "ds:Transform|ec:InclusiveNamespaces" 1 "PrefixList" "wsse soapenv v1"
CkXml_UpdateAttrAt $xml1 "ds:Transform|ec:InclusiveNamespaces" 1 "xmlns:ec" "http://www.w3.org/2001/10/xml-exc-c14n#"

CkXmlDSigGen_AddSameDocRef2 $gen [CkStringBuilder_getAsString $tsId] "sha256" $xml1 ""

# -------- Reference 2 --------
set xml2 [new_CkXml]

CkXml_put_Tag $xml2 "ds:Transforms"
CkXml_UpdateAttrAt $xml2 "ds:Transform" 1 "Algorithm" "http://www.w3.org/2001/10/xml-exc-c14n#"
CkXml_UpdateAttrAt $xml2 "ds:Transform|ec:InclusiveNamespaces" 1 "PrefixList" "v1"
CkXml_UpdateAttrAt $xml2 "ds:Transform|ec:InclusiveNamespaces" 1 "xmlns:ec" "http://www.w3.org/2001/10/xml-exc-c14n#"

CkXmlDSigGen_AddSameDocRef2 $gen "id-8" "sha256" $xml2 ""

# Provide a certificate + private key. (PFX password is test123)
set cert [new_CkCert]

set success [CkCert_LoadPfxFile $cert "qa_data/pfx/cert_test123.pfx" "test123"]
if {$success != 1} then {
    puts [CkCert_lastErrorText $cert]
    delete_CkStringBuilder $tsId
    delete_CkStringBuilder $strId
    delete_CkStringBuilder $keyInfoId
    delete_CkDateTime $dt
    delete_CkStringBuilder $sbNow
    delete_CkStringBuilder $sbNowPlusOneHour
    delete_CkXml $xmlToSign
    delete_CkXmlDSigGen $gen
    delete_CkXml $xml1
    delete_CkXml $xml2
    delete_CkCert $cert
    exit
}

CkXmlDSigGen_SetX509Cert $gen $cert 1

CkXmlDSigGen_put_KeyInfoType $gen "Custom"

# Create the custom KeyInfo XML..
set xmlCustomKeyInfo [new_CkXml]

CkXml_put_Tag $xmlCustomKeyInfo "wsse:SecurityTokenReference"
CkXml_AddAttribute $xmlCustomKeyInfo "wsu:Id" [CkStringBuilder_getAsString $strId]
CkXml_UpdateAttrAt $xmlCustomKeyInfo "wsse:KeyIdentifier" 1 "EncodingType" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
CkXml_UpdateAttrAt $xmlCustomKeyInfo "wsse:KeyIdentifier" 1 "ValueType" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
# Insert the single-line base64 of the signing certificate's DER
CkCert_put_UncommonOptions $cert "Base64CertNoCRLF"
CkXml_UpdateChildContent $xmlCustomKeyInfo "wsse:KeyIdentifier" [CkCert_getEncoded $cert]

CkXml_put_EmitXmlDecl $xmlCustomKeyInfo 0
CkXmlDSigGen_put_CustomKeyInfoXml $gen [CkXml_getXml $xmlCustomKeyInfo]

# Load XML to be signed...
set sbXml [new_CkStringBuilder]

CkXml_GetXmlSb $xmlToSign $sbXml

CkXmlDSigGen_put_Behaviors $gen "IndentedSignature"

# Sign the XML...
CkXmlDSigGen_put_VerboseLogging $gen 1
set success [CkXmlDSigGen_CreateXmlDSigSb $gen $sbXml]
if {$success != 1} then {
    puts [CkXmlDSigGen_lastErrorText $gen]
    delete_CkStringBuilder $tsId
    delete_CkStringBuilder $strId
    delete_CkStringBuilder $keyInfoId
    delete_CkDateTime $dt
    delete_CkStringBuilder $sbNow
    delete_CkStringBuilder $sbNowPlusOneHour
    delete_CkXml $xmlToSign
    delete_CkXmlDSigGen $gen
    delete_CkXml $xml1
    delete_CkXml $xml2
    delete_CkCert $cert
    delete_CkXml $xmlCustomKeyInfo
    delete_CkStringBuilder $sbXml
    exit
}

# Save the signed XML to a file.
set success [CkStringBuilder_WriteFile $sbXml "c:/temp/qa_output/signedXml.xml" "utf-8" 0]

puts [CkStringBuilder_getAsString $sbXml]

delete_CkStringBuilder $tsId
delete_CkStringBuilder $strId
delete_CkStringBuilder $keyInfoId
delete_CkDateTime $dt
delete_CkStringBuilder $sbNow
delete_CkStringBuilder $sbNowPlusOneHour
delete_CkXml $xmlToSign
delete_CkXmlDSigGen $gen
delete_CkXml $xml1
delete_CkXml $xml2
delete_CkCert $cert
delete_CkXml $xmlCustomKeyInfo
delete_CkStringBuilder $sbXml