AutoIt

Sign Italian SPID Metadata XML

See more XML Digital Signatures Examples

Demonstrates how to create an XML digital signature for Italian SPID Metadata. AutoIt

Local $bSuccess = False

; This example assumes the Chilkat API to have been previously unlocked.
; See Global Unlock Sample for sample code.

$bSuccess = True

; Load the XML to be signed.
$oSbXml = ObjCreate("Chilkat.StringBuilder")
$bSuccess = $oSbXml.LoadFile("qa_data/xml_dsig/spid_metadata.xml","utf-8")
If ($bSuccess = False) Then
    ConsoleWrite("Failed to load the input file." & @CRLF)
    Exit
EndIf

; The XML to sign contains XML such as this:

; <?xml version="1.0" encoding="utf-8"?>
; <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://***.it" ID="_AE17AFFF-A600-49D5-B81D-76EEA55B50FF">
;     <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true" WantAssertionsSigned="true">
;         <md:KeyDescriptor use="signing">
;             <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
;                 <ds:X509Data>
;                     <ds:X509Certificate>MIIF5...</ds:X509Certificate>
;                 </ds:X509Data>
;             </ds:KeyInfo>
;         </md:KeyDescriptor>
;         <md:KeyDescriptor use="encryption">
;             <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
;                 <ds:X509Data>
;                     <ds:X509Certificate>MIIF5...</ds:X509Certificate>
;                 </ds:X509Data>
;             </ds:KeyInfo>
;         </md:KeyDescriptor>
;         <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://***.it/it-it/spid/logout"/>
;         <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
;         <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://***.it/it-it/spid/loginresp" index="0" isDefault="true"/>
;         <md:AttributeConsumingService index="1">
;             <md:ServiceName xml:lang="it">Servizi Online</md:ServiceName>
;             <md:ServiceDescription xml:lang="it">Accesso ai Servizi Online</md:ServiceDescription>
;             <md:RequestedAttribute Name="spidCode" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
;             <md:RequestedAttribute Name="name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
;             <md:RequestedAttribute Name="familyName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
;             <md:RequestedAttribute Name="fiscalNumber" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
;         </md:AttributeConsumingService>
;     </md:SPSSODescriptor>
;     <md:Organization>
;         <md:OrganizationName xml:lang="it">SomeCompany s.r.l.</md:OrganizationName>
;         <md:OrganizationDisplayName xml:lang="it">SomeCompany s.r.l.</md:OrganizationDisplayName>
;         <md:OrganizationURL xml:lang="it">https://***.it</md:OrganizationURL>
;     </md:Organization>
; </md:EntityDescriptor>

$oGen = ObjCreate("Chilkat.XmlDSigGen")

$oGen.SigLocation = "md:EntityDescriptor|md:SPSSODescriptor"
$oGen.SigLocationMod = 2
$oGen.SignedInfoCanonAlg = "EXCL_C14N"
$oGen.SignedInfoDigestMethod = "sha256"

; -------- Reference 1 --------
$oGen.AddSameDocRef("_AE17AFFF-A600-49D5-B81D-76EEA55B50FF","sha256","EXCL_C14N","","")

; Provide a certificate + private key. (PFX password is test123)
$oCert = ObjCreate("Chilkat.Cert")
$bSuccess = $oCert.LoadPfxFile("qa_data/pfx/cert_test123.pfx","test123")
If ($bSuccess <> True) Then
    ConsoleWrite($oCert.LastErrorText & @CRLF)
    Exit
EndIf

$oGen.SetX509Cert($oCert,True)

$oGen.KeyInfoType = "X509Data+KeyValue"
$oGen.X509Type = "Certificate"

$oGen.Behaviors = "IndentedSignature,ForceAddEnvelopedSignatureTransform,OmitAlreadyDefinedSigNamespace"

; Sign the XML...
$bSuccess = $oGen.CreateXmlDSigSb($oSbXml)
If ($bSuccess <> True) Then
    ConsoleWrite($oGen.LastErrorText & @CRLF)
    Exit
EndIf

; -----------------------------------------------

; Save the signed XML to a file.
$bSuccess = $oSbXml.WriteFile("qa_output/signedXml.xml","utf-8",False)

ConsoleWrite($oSbXml.GetAsString() & @CRLF)

; ----------------------------------------
; Verify the signatures we just produced...
$oVerifier = ObjCreate("Chilkat.XmlDSig")
$bSuccess = $oVerifier.LoadSignatureSb($oSbXml)
If ($bSuccess <> True) Then
    ConsoleWrite($oVerifier.LastErrorText & @CRLF)
    Exit
EndIf

Local $iNumSigs = $oVerifier.NumSignatures
Local $iVerifyIdx = 0
While $iVerifyIdx < $iNumSigs
    $oVerifier.Selector = $iVerifyIdx
Local $bVerified = $oVerifier.VerifySignature(True)
    If ($bVerified <> True) Then
        ConsoleWrite($oVerifier.LastErrorText & @CRLF)
        Exit
    EndIf

    $iVerifyIdx = $iVerifyIdx + 1
Wend
ConsoleWrite("All signatures were successfully verified." & @CRLF)