|
Chilkat • HOME • .NET Core C# • Android™ • AutoIt • C • C# • C++ • Chilkat2-Python • CkPython • Classic ASP • DataFlex • Delphi ActiveX • Delphi DLL • Go • Java • Lianja • Mono C# • Node.js • Objective-C • PHP ActiveX • PHP Extension • Perl • PowerBuilder • PowerShell • PureBasic • Ruby • SQL Server • Swift 2 • Swift 3,4,5... • Tcl • Unicode C • Unicode C++ • VB.NET • VBScript • Visual Basic 6.0 • Visual FoxPro • Xojo Plugin
(Tcl) Sign with BinarySecurityTokenDemonstrates creating an XML signature using a BinarySecurityToken.
load ./chilkat.dll # This example requires the Chilkat API to have been previously unlocked. # See Global Unlock Sample for sample code. # ------------------------------------------------------------------------- # Load a cert + private key from a PFX. set cert [new_CkCert] set success [CkCert_LoadPfxFile $cert "qa_data/pfx/cert_test123.pfx" "test123"] if {$success != 1} then { puts [CkCert_lastErrorText $cert] delete_CkCert $cert exit } # ------------------------------------------------------------------------- # Create the XML that is to be signed. # # The XML we're creating can be found at Sample Pre-Signed XML with BinarySecurityToken # The online tool at http://tools.chilkat.io/xmlCreate.cshtml can be used to generate the following XML creation code. # set xml [new_CkXml] CkXml_put_Tag $xml "S:Envelope" CkXml_AddAttribute $xml "xmlns:S" "http://www.w3.org/2003/05/soap-envelope" CkXml_AddAttribute $xml "xmlns:wsse11" "http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd" CkXml_AddAttribute $xml "xmlns:wsse" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" CkXml_AddAttribute $xml "xmlns:wsu" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" CkXml_AddAttribute $xml "xmlns:xs" "http://www.w3.org/2001/XMLSchema" CkXml_AddAttribute $xml "xmlns:ds" "http://www.w3.org/2000/09/xmldsig#" CkXml_AddAttribute $xml "xmlns:exc14n" "http://www.w3.org/2001/10/xml-exc-c14n#" CkXml_UpdateAttrAt $xml "S:Header|To" 1 "xmlns" "http://www.w3.org/2005/08/addressing" CkXml_UpdateAttrAt $xml "S:Header|To" 1 "wsu:Id" "_5002" CkXml_UpdateChildContent $xml "S:Header|To" "https://XXXXXXXXX" CkXml_UpdateAttrAt $xml "S:Header|Action" 1 "xmlns" "http://www.w3.org/2005/08/addressing" CkXml_UpdateAttrAt $xml "S:Header|Action" 1 "xmlns:S" "http://www.w3.org/2003/05/soap-envelope" CkXml_UpdateAttrAt $xml "S:Header|Action" 1 "S:mustUnderstand" "true" CkXml_UpdateChildContent $xml "S:Header|Action" "http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue" CkXml_UpdateAttrAt $xml "S:Header|ReplyTo" 1 "xmlns" "http://www.w3.org/2005/08/addressing" CkXml_UpdateChildContent $xml "S:Header|ReplyTo|Address" "http://www.w3.org/2005/08/addressing/anonymous" CkXml_UpdateAttrAt $xml "S:Header|FaultTo" 1 "xmlns" "http://www.w3.org/2005/08/addressing" CkXml_UpdateChildContent $xml "S:Header|FaultTo|Address" "http://www.w3.org/2005/08/addressing/anonymous" CkXml_UpdateAttrAt $xml "S:Header|MessageID" 1 "xmlns" "http://www.w3.org/2005/08/addressing" CkXml_UpdateChildContent $xml "S:Header|MessageID" "uuid:e9033251-4ff0-4618-8baf-4952ab5fd207" CkXml_UpdateAttrAt $xml "S:Header|wsse:Security" 1 "S:mustUnderstand" "true" CkXml_UpdateAttrAt $xml "S:Header|wsse:Security|wsu:Timestamp" 1 "xmlns:ns17" "http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" CkXml_UpdateAttrAt $xml "S:Header|wsse:Security|wsu:Timestamp" 1 "xmlns:ns16" "http://schemas.xmlsoap.org/soap/envelope/" CkXml_UpdateAttrAt $xml "S:Header|wsse:Security|wsu:Timestamp" 1 "wsu:Id" "_1" # Get the current date/time in timestamp format, such as "2018-05-23T02:38:27Z" set dt [new_CkDateTime] CkDateTime_SetFromCurrentSystemTime $dt CkXml_UpdateChildContent $xml "S:Header|wsse:Security|wsu:Timestamp|wsu:Created" [CkDateTime_getAsTimestamp $dt 0] # Add 5 minutes. CkDateTime_AddSeconds $dt 300 CkXml_UpdateChildContent $xml "S:Header|wsse:Security|wsu:Timestamp|wsu:Expires" [CkDateTime_getAsTimestamp $dt 0] CkXml_UpdateAttrAt $xml "S:Header|wsse:Security|wsse:BinarySecurityToken" 1 "xmlns:ns17" "http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" CkXml_UpdateAttrAt $xml "S:Header|wsse:Security|wsse:BinarySecurityToken" 1 "xmlns:ns16" "http://schemas.xmlsoap.org/soap/envelope/" CkXml_UpdateAttrAt $xml "S:Header|wsse:Security|wsse:BinarySecurityToken" 1 "ValueType" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" CkXml_UpdateAttrAt $xml "S:Header|wsse:Security|wsse:BinarySecurityToken" 1 "EncodingType" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" CkXml_UpdateAttrAt $xml "S:Header|wsse:Security|wsse:BinarySecurityToken" 1 "wsu:Id" "uuid_43470044-78b4-4b23-926a-b7f590d24cb8" set bdCert [new_CkBinData] CkCert_ExportCertDerBd $cert $bdCert # Get the cert as base64 on one line. CkXml_UpdateChildContent $xml "S:Header|wsse:Security|wsse:BinarySecurityToken" [CkBinData_getEncoded $bdCert "base64"] CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken" 1 "xmlns" "http://docs.oasis-open.org/ws-sx/ws-trust/200512" CkXml_UpdateChildContent $xml "S:Body|RequestSecurityToken|RequestType" "http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|wsp:AppliesTo" 1 "xmlns:wsp" "http://schemas.xmlsoap.org/ws/2004/09/policy" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|wsp:AppliesTo|EndpointReference:EndpointReference" 1 "xmlns:EndpointReference" "http://www.w3.org/2005/08/addressing" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|wsp:AppliesTo|EndpointReference:EndpointReference" 1 "xmlns" "http://www.w3.org/2005/08/addressing" CkXml_UpdateChildContent $xml "S:Body|RequestSecurityToken|wsp:AppliesTo|EndpointReference:EndpointReference|Address" "https://XXXXXXXXX/services" CkXml_UpdateChildContent $xml "S:Body|RequestSecurityToken|TokenType" "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims" 1 "xmlns:i" "http://schemas.xmlsoap.org/ws/2005/05/identity" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims" 1 "Dialect" "http://schemas.xmlsoap.org/ws/2005/05/identity" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType" 1 "Optional" "false" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/abn" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[1]" 1 "Optional" "false" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[1]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/commonname" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[2]" 1 "Optional" "false" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[2]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/credentialtype" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[3]" 1 "Optional" "false" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[3]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/samlsubjectid" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[4]" 1 "Optional" "false" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[4]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/fingerprint" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[5]" 1 "Optional" "true" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[5]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/sbr_personid" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[6]" 1 "Optional" "true" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[6]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/givennames" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[7]" 1 "Optional" "true" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[7]" 1 "Uri" "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[8]" 1 "Optional" "true" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[8]" 1 "Uri" "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[9]" 1 "Optional" "true" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[9]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/credentialadministrator" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[10]" 1 "Optional" "true" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[10]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/stalecrlminutes" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[11]" 1 "Optional" "true" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[11]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/subjectdn" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[12]" 1 "Optional" "true" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[12]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/issuerdn" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[13]" 1 "Optional" "true" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[13]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/notafterdate" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[14]" 1 "Optional" "true" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[14]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/certificateserialnumber" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[15]" 1 "Optional" "true" CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[15]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/previoussubject" CkDateTime_SetFromCurrentSystemTime $dt CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Lifetime|wsu:Created" 1 "xmlns:wsu" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" CkXml_UpdateChildContent $xml "S:Body|RequestSecurityToken|Lifetime|wsu:Created" [CkDateTime_getAsTimestamp $dt 0] # Add 40 minutes. CkDateTime_AddSeconds $dt 2400 CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Lifetime|wsu:Expires" 1 "xmlns:wsu" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" CkXml_UpdateChildContent $xml "S:Body|RequestSecurityToken|Lifetime|wsu:Expires" [CkDateTime_getAsTimestamp $dt 0] CkXml_UpdateChildContent $xml "S:Body|RequestSecurityToken|KeyType" "http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey" CkXml_UpdateChildContent $xml "S:Body|RequestSecurityToken|KeySize" "512" # Examine the pre-signed XML # println xml.GetXml(); # Build the custom KeyInfo XML we'll use: # # <wsse:SecurityTokenReference> # <wsse:Reference URI="#uuid_43470044-78b4-4b23-926a-b7f590d24cb8" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" /></wsse:SecurityTokenReference> set keyInfoXml [new_CkXml] CkXml_put_Tag $keyInfoXml "wsse:SecurityTokenReference" CkXml_UpdateAttrAt $keyInfoXml "wsse:Reference" 1 "URI" "#uuid_43470044-78b4-4b23-926a-b7f590d24cb8" CkXml_UpdateAttrAt $keyInfoXml "wsse:Reference" 1 "ValueType" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" # ------------------------------------------------------------------------- # Setup the XML Digital Signature Generator and add the XML Signature. # set gen [new_CkXmlDSigGen] CkXmlDSigGen_put_SigLocation $gen "S:Envelope|S:Header|wsse:Security" CkXmlDSigGen_put_SignedInfoPrefixList $gen "wsse S" CkXmlDSigGen_AddSameDocRef $gen "_1" "sha1" "EXCL_C14N" "wsu wsse S" "" CkXmlDSigGen_AddSameDocRef $gen "_5002" "sha1" "EXCL_C14N" "S" "" CkXmlDSigGen_put_KeyInfoType $gen "Custom" CkXml_put_EmitXmlDecl $keyInfoXml 0 CkXmlDSigGen_put_CustomKeyInfoXml $gen [CkXml_getXml $keyInfoXml] # Specify the cert for signing (which has a private key because it was loaded from a PFX) CkXmlDSigGen_SetX509Cert $gen $cert 1 # Indicated we want an indented signature for easier human reading. CkXmlDSigGen_put_Behaviors $gen "IndentedSignature" # Sign the XML.. set sbXml [new_CkStringBuilder] CkXml_GetXmlSb $xml $sbXml set success [CkXmlDSigGen_CreateXmlDSigSb $gen $sbXml] if {$success != 1} then { puts [CkXmlDSigGen_lastErrorText $gen] delete_CkCert $cert delete_CkXml $xml delete_CkDateTime $dt delete_CkBinData $bdCert delete_CkXml $keyInfoXml delete_CkXmlDSigGen $gen delete_CkStringBuilder $sbXml exit } # Examine the signed XML puts [CkStringBuilder_getAsString $sbXml] # The resulting signature (extracted from the surrounding XML) looks something like this: # <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> # <ds:SignedInfo> # <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> # <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="wsse S" /> # </ds:CanonicalizationMethod> # <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /> # <ds:Reference URI="#_1"> # <ds:Transforms> # <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> # <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="wsu wsse S" /> # </ds:Transform> # </ds:Transforms> # <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> # <ds:DigestValue>VAJMC/L/BDvml7Qv5CBMePbKDE8=</ds:DigestValue> # </ds:Reference> # <ds:Reference URI="#_5002"> # <ds:Transforms> # <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> # <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="S" /> # </ds:Transform> # </ds:Transforms> # <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> # <ds:DigestValue>sW/QFsk6kGv1dzeu0H9Qc/2kvAQ=</ds:DigestValue> # </ds:Reference> # </ds:SignedInfo> # <ds:SignatureValue>....</ds:SignatureValue> # <ds:KeyInfo> # <wsse:SecurityTokenReference> # <wsse:Reference URI="#uuid_43470044-78b4-4b23-926a-b7f590d24cb8" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" /> # </wsse:SecurityTokenReference> # </ds:KeyInfo> # </ds:Signature> # delete_CkCert $cert delete_CkXml $xml delete_CkDateTime $dt delete_CkBinData $bdCert delete_CkXml $keyInfoXml delete_CkXmlDSigGen $gen delete_CkStringBuilder $sbXml |
||||
© 2000-2024 Chilkat Software, Inc. All Rights Reserved.