Tcl
Tcl
Sign with BinarySecurityToken
See more XML Digital Signatures Examples
Demonstrates creating an XML signature using a BinarySecurityToken.Chilkat Tcl Downloads
load ./chilkat.dll
set success 0
# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.
# -------------------------------------------------------------------------
# Load a cert + private key from a PFX.
set cert [new_CkCert]
set success [CkCert_LoadPfxFile $cert "qa_data/pfx/cert_test123.pfx" "test123"]
if {$success != 1} then {
puts [CkCert_lastErrorText $cert]
delete_CkCert $cert
exit
}
# -------------------------------------------------------------------------
# Create the XML that is to be signed.
#
# The XML we're creating can be found at Sample Pre-Signed XML with BinarySecurityToken
# The online tool at http://tools.chilkat.io/xmlCreate.cshtml can be used to generate the following XML creation code.
#
set xml [new_CkXml]
CkXml_put_Tag $xml "S:Envelope"
CkXml_AddAttribute $xml "xmlns:S" "http://www.w3.org/2003/05/soap-envelope"
CkXml_AddAttribute $xml "xmlns:wsse11" "http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"
CkXml_AddAttribute $xml "xmlns:wsse" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
CkXml_AddAttribute $xml "xmlns:wsu" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
CkXml_AddAttribute $xml "xmlns:xs" "http://www.w3.org/2001/XMLSchema"
CkXml_AddAttribute $xml "xmlns:ds" "http://www.w3.org/2000/09/xmldsig#"
CkXml_AddAttribute $xml "xmlns:exc14n" "http://www.w3.org/2001/10/xml-exc-c14n#"
CkXml_UpdateAttrAt $xml "S:Header|To" 1 "xmlns" "http://www.w3.org/2005/08/addressing"
CkXml_UpdateAttrAt $xml "S:Header|To" 1 "wsu:Id" "_5002"
CkXml_UpdateChildContent $xml "S:Header|To" "https://XXXXXXXXX"
CkXml_UpdateAttrAt $xml "S:Header|Action" 1 "xmlns" "http://www.w3.org/2005/08/addressing"
CkXml_UpdateAttrAt $xml "S:Header|Action" 1 "xmlns:S" "http://www.w3.org/2003/05/soap-envelope"
CkXml_UpdateAttrAt $xml "S:Header|Action" 1 "S:mustUnderstand" "true"
CkXml_UpdateChildContent $xml "S:Header|Action" "http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"
CkXml_UpdateAttrAt $xml "S:Header|ReplyTo" 1 "xmlns" "http://www.w3.org/2005/08/addressing"
CkXml_UpdateChildContent $xml "S:Header|ReplyTo|Address" "http://www.w3.org/2005/08/addressing/anonymous"
CkXml_UpdateAttrAt $xml "S:Header|FaultTo" 1 "xmlns" "http://www.w3.org/2005/08/addressing"
CkXml_UpdateChildContent $xml "S:Header|FaultTo|Address" "http://www.w3.org/2005/08/addressing/anonymous"
CkXml_UpdateAttrAt $xml "S:Header|MessageID" 1 "xmlns" "http://www.w3.org/2005/08/addressing"
CkXml_UpdateChildContent $xml "S:Header|MessageID" "uuid:e9033251-4ff0-4618-8baf-4952ab5fd207"
CkXml_UpdateAttrAt $xml "S:Header|wsse:Security" 1 "S:mustUnderstand" "true"
CkXml_UpdateAttrAt $xml "S:Header|wsse:Security|wsu:Timestamp" 1 "xmlns:ns17" "http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512"
CkXml_UpdateAttrAt $xml "S:Header|wsse:Security|wsu:Timestamp" 1 "xmlns:ns16" "http://schemas.xmlsoap.org/soap/envelope/"
CkXml_UpdateAttrAt $xml "S:Header|wsse:Security|wsu:Timestamp" 1 "wsu:Id" "_1"
# Get the current date/time in timestamp format, such as "2018-05-23T02:38:27Z"
set dt [new_CkDateTime]
CkDateTime_SetFromCurrentSystemTime $dt
CkXml_UpdateChildContent $xml "S:Header|wsse:Security|wsu:Timestamp|wsu:Created" [CkDateTime_getAsTimestamp $dt 0]
# Add 5 minutes.
CkDateTime_AddSeconds $dt 300
CkXml_UpdateChildContent $xml "S:Header|wsse:Security|wsu:Timestamp|wsu:Expires" [CkDateTime_getAsTimestamp $dt 0]
CkXml_UpdateAttrAt $xml "S:Header|wsse:Security|wsse:BinarySecurityToken" 1 "xmlns:ns17" "http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512"
CkXml_UpdateAttrAt $xml "S:Header|wsse:Security|wsse:BinarySecurityToken" 1 "xmlns:ns16" "http://schemas.xmlsoap.org/soap/envelope/"
CkXml_UpdateAttrAt $xml "S:Header|wsse:Security|wsse:BinarySecurityToken" 1 "ValueType" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
CkXml_UpdateAttrAt $xml "S:Header|wsse:Security|wsse:BinarySecurityToken" 1 "EncodingType" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
CkXml_UpdateAttrAt $xml "S:Header|wsse:Security|wsse:BinarySecurityToken" 1 "wsu:Id" "uuid_43470044-78b4-4b23-926a-b7f590d24cb8"
set bdCert [new_CkBinData]
CkCert_ExportCertDerBd $cert $bdCert
# Get the cert as base64 on one line.
CkXml_UpdateChildContent $xml "S:Header|wsse:Security|wsse:BinarySecurityToken" [CkBinData_getEncoded $bdCert "base64"]
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken" 1 "xmlns" "http://docs.oasis-open.org/ws-sx/ws-trust/200512"
CkXml_UpdateChildContent $xml "S:Body|RequestSecurityToken|RequestType" "http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|wsp:AppliesTo" 1 "xmlns:wsp" "http://schemas.xmlsoap.org/ws/2004/09/policy"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|wsp:AppliesTo|EndpointReference:EndpointReference" 1 "xmlns:EndpointReference" "http://www.w3.org/2005/08/addressing"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|wsp:AppliesTo|EndpointReference:EndpointReference" 1 "xmlns" "http://www.w3.org/2005/08/addressing"
CkXml_UpdateChildContent $xml "S:Body|RequestSecurityToken|wsp:AppliesTo|EndpointReference:EndpointReference|Address" "https://XXXXXXXXX/services"
CkXml_UpdateChildContent $xml "S:Body|RequestSecurityToken|TokenType" "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims" 1 "xmlns:i" "http://schemas.xmlsoap.org/ws/2005/05/identity"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims" 1 "Dialect" "http://schemas.xmlsoap.org/ws/2005/05/identity"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType" 1 "Optional" "false"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/abn"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[1]" 1 "Optional" "false"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[1]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/commonname"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[2]" 1 "Optional" "false"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[2]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/credentialtype"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[3]" 1 "Optional" "false"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[3]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/samlsubjectid"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[4]" 1 "Optional" "false"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[4]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/fingerprint"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[5]" 1 "Optional" "true"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[5]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/sbr_personid"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[6]" 1 "Optional" "true"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[6]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/givennames"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[7]" 1 "Optional" "true"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[7]" 1 "Uri" "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[8]" 1 "Optional" "true"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[8]" 1 "Uri" "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[9]" 1 "Optional" "true"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[9]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/credentialadministrator"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[10]" 1 "Optional" "true"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[10]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/stalecrlminutes"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[11]" 1 "Optional" "true"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[11]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/subjectdn"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[12]" 1 "Optional" "true"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[12]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/issuerdn"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[13]" 1 "Optional" "true"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[13]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/notafterdate"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[14]" 1 "Optional" "true"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[14]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/certificateserialnumber"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[15]" 1 "Optional" "true"
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Claims|i:ClaimType[15]" 1 "Uri" "http://XXXXXXXXX/2008/06/identity/claims/previoussubject"
CkDateTime_SetFromCurrentSystemTime $dt
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Lifetime|wsu:Created" 1 "xmlns:wsu" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
CkXml_UpdateChildContent $xml "S:Body|RequestSecurityToken|Lifetime|wsu:Created" [CkDateTime_getAsTimestamp $dt 0]
# Add 40 minutes.
CkDateTime_AddSeconds $dt 2400
CkXml_UpdateAttrAt $xml "S:Body|RequestSecurityToken|Lifetime|wsu:Expires" 1 "xmlns:wsu" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
CkXml_UpdateChildContent $xml "S:Body|RequestSecurityToken|Lifetime|wsu:Expires" [CkDateTime_getAsTimestamp $dt 0]
CkXml_UpdateChildContent $xml "S:Body|RequestSecurityToken|KeyType" "http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey"
CkXml_UpdateChildContent $xml "S:Body|RequestSecurityToken|KeySize" "512"
# Examine the pre-signed XML
# println xml.GetXml();
# Build the custom KeyInfo XML we'll use:
#
# <wsse:SecurityTokenReference>
# <wsse:Reference URI="#uuid_43470044-78b4-4b23-926a-b7f590d24cb8" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" /></wsse:SecurityTokenReference>
set keyInfoXml [new_CkXml]
CkXml_put_Tag $keyInfoXml "wsse:SecurityTokenReference"
CkXml_UpdateAttrAt $keyInfoXml "wsse:Reference" 1 "URI" "#uuid_43470044-78b4-4b23-926a-b7f590d24cb8"
CkXml_UpdateAttrAt $keyInfoXml "wsse:Reference" 1 "ValueType" "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
# -------------------------------------------------------------------------
# Setup the XML Digital Signature Generator and add the XML Signature.
#
set gen [new_CkXmlDSigGen]
CkXmlDSigGen_put_SigLocation $gen "S:Envelope|S:Header|wsse:Security"
CkXmlDSigGen_put_SignedInfoPrefixList $gen "wsse S"
CkXmlDSigGen_AddSameDocRef $gen "_1" "sha1" "EXCL_C14N" "wsu wsse S" ""
CkXmlDSigGen_AddSameDocRef $gen "_5002" "sha1" "EXCL_C14N" "S" ""
CkXmlDSigGen_put_KeyInfoType $gen "Custom"
CkXml_put_EmitXmlDecl $keyInfoXml 0
CkXmlDSigGen_put_CustomKeyInfoXml $gen [CkXml_getXml $keyInfoXml]
# Specify the cert for signing (which has a private key because it was loaded from a PFX)
CkXmlDSigGen_SetX509Cert $gen $cert 1
# Indicated we want an indented signature for easier human reading.
CkXmlDSigGen_put_Behaviors $gen "IndentedSignature"
# Sign the XML..
set sbXml [new_CkStringBuilder]
CkXml_GetXmlSb $xml $sbXml
set success [CkXmlDSigGen_CreateXmlDSigSb $gen $sbXml]
if {$success != 1} then {
puts [CkXmlDSigGen_lastErrorText $gen]
delete_CkCert $cert
delete_CkXml $xml
delete_CkDateTime $dt
delete_CkBinData $bdCert
delete_CkXml $keyInfoXml
delete_CkXmlDSigGen $gen
delete_CkStringBuilder $sbXml
exit
}
# Examine the signed XML
puts [CkStringBuilder_getAsString $sbXml]
# The resulting signature (extracted from the surrounding XML) looks something like this:
# <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
# <ds:SignedInfo>
# <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
# <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="wsse S" />
# </ds:CanonicalizationMethod>
# <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
# <ds:Reference URI="#_1">
# <ds:Transforms>
# <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
# <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="wsu wsse S" />
# </ds:Transform>
# </ds:Transforms>
# <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
# <ds:DigestValue>VAJMC/L/BDvml7Qv5CBMePbKDE8=</ds:DigestValue>
# </ds:Reference>
# <ds:Reference URI="#_5002">
# <ds:Transforms>
# <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
# <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="S" />
# </ds:Transform>
# </ds:Transforms>
# <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
# <ds:DigestValue>sW/QFsk6kGv1dzeu0H9Qc/2kvAQ=</ds:DigestValue>
# </ds:Reference>
# </ds:SignedInfo>
# <ds:SignatureValue>....</ds:SignatureValue>
# <ds:KeyInfo>
# <wsse:SecurityTokenReference>
# <wsse:Reference URI="#uuid_43470044-78b4-4b23-926a-b7f590d24cb8" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" />
# </wsse:SecurityTokenReference>
# </ds:KeyInfo>
# </ds:Signature>
#
delete_CkCert $cert
delete_CkXml $xml
delete_CkDateTime $dt
delete_CkBinData $bdCert
delete_CkXml $keyInfoXml
delete_CkXmlDSigGen $gen
delete_CkStringBuilder $sbXml