(Unicode C++) Sign XML (XAdES) in the Cloud using Azure Key Vault

See more Signing in the Cloud Examples

Note: This example requires Chilkat v9.5.0.96 or greater.

Chilkat C/C++ Library Downloads
MS Visual C/C++ C++ Builder Linux C/C++ Alpine Linux C/C++	MacOS C/C++ iOS C/C++ Android C/C++ MinGW C/C++

#include <CkStringBuilderW.h>
#include <CkCertW.h>
#include <CkJsonObjectW.h>
#include <CkXmlDSigGenW.h>

void ChilkatSample(void)
    {
    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Create the XML to be signed.
    CkStringBuilderW sbXml;

    bool bCrlf = true;
    sbXml.AppendLine(L"<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\" ?>",bCrlf);
    sbXml.AppendLine(L"<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\">",bCrlf);
    sbXml.AppendLine(L"    <SOAP-ENV:Header>",bCrlf);
    sbXml.AppendLine(L"        <wsse:Security xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" SOAP-ENV:mustUnderstand=\"1\"></wsse:Security>",bCrlf);
    sbXml.AppendLine(L"    </SOAP-ENV:Header>",bCrlf);
    sbXml.AppendLine(L"    <SOAP-ENV:Body xmlns:SOAP-SEC=\"http://schemas.xmlsoap.org/soap/security/2000-12\" SOAP-SEC:id=\"Body\">",bCrlf);
    sbXml.AppendLine(L"        <z:FooBar xmlns:z=\"http://example.com\" />",bCrlf);
    sbXml.AppendLine(L"    </SOAP-ENV:Body>",bCrlf);
    sbXml.AppendLine(L"</SOAP-ENV:Envelope>",bCrlf);

    // Load the certificate used for signing.  The certificate's private key is stored in 
    // the Azure Key Vault.
    // However, we still need the certificate locally (without private key).
    CkCertW cert;
    bool success = cert.LoadFromFile(L"qa_data/certs/myCert.cer");
    if (success == false) {
        wprintf(L"%s\n",cert.lastErrorText());
        return;
    }

    // Here's a screenshot of our certificate with private key on Azure Key Vault:
    

    // To sign using the Azure Key Vault, 
    // add the following lines of code to specify your authentication credentials,
    // and the name of the certificate w/ private key on the Azure server to be used.
    CkJsonObjectW jsonAzure;
    // Set the "service" equal to "azure_keyvault" to tell Chilkat to use Azure Key Vault for signing.
    jsonAzure.UpdateString(L"service",L"azure_keyvault");
    jsonAzure.UpdateString(L"client_id",L"APP_ID");
    jsonAzure.UpdateString(L"client_secret",L"APP_PASSWORD");
    jsonAzure.UpdateString(L"tenant_id",L"TENANT_ID");
    // In the above screenshot, our vault name is "kvchilkat".  You will use your vault name.
    jsonAzure.UpdateString(L"vault_name",L"VAULT_NAME");
    // In the above screenshot, our cert name is "ChilkatTest1".  You will use your cert name.
    jsonAzure.UpdateString(L"cert_name",L"CERT_NAME");
    // In the above screenshot, our cert version is "63b94a23389546ecbc8eb6208a1bef37".  You will use your cert version.
    jsonAzure.UpdateString(L"cert_version",L"CERT_VERSION");
    success = cert.SetCloudSigner(jsonAzure);

    // Prepare for signing...
    CkXmlDSigGenW gen;

    // Indicate where the Signature will be inserted.
    gen.put_SigLocation(L"SOAP-ENV:Envelope|SOAP-ENV:Header|wsse:Security");

    // Add a reference to the fragment of the XML to be signed.

    // Note: "Body" refers to the XML element having an "id" equal to "Body", where "id" is case insensitive
    // and where any namespace might qualify the attribute.  In this case, the SOAP-ENV:Body fragment is signed
    // NOT because the tag = "Body", but because it has SOAP-SEC:id="Body"
    gen.AddSameDocRef(L"Body",L"sha1",L"EXCL_C14N",L"",L"");

    // (You can read about the SignedInfoPrefixList in the online reference documentation.  It's optional..)
    gen.put_SignedInfoPrefixList(L"wsse SOAP-ENV");

    gen.put_KeyInfoType(L"X509Data");
    gen.put_X509Type(L"IssuerSerial");

    bool bUsePrivateKey = true;
    success = gen.SetX509Cert(cert,bUsePrivateKey);
    if (success != true) {
        wprintf(L"%s\n",gen.lastErrorText());
        delete cert;
        return;
    }

    // Everything's specified.  Now create and insert the Signature
    // (The actual signing of the hash will happen on the Aruba server.)
    success = gen.CreateXmlDSigSb(sbXml);
    if (success != true) {
        wprintf(L"%s\n",gen.lastErrorText());
        return;
    }

    // Examine the XML with the digital signature inserted
    wprintf(L"%s\n",sbXml.getAsString());

    // --------------------------------------------------------------------------------
    // Also see Chilkat's Online WSDL Code Generator
    // to generate code and SOAP Request and Response XML for each operation in a WSDL.
    // --------------------------------------------------------------------------------
    }