Dart

Sign Italian SPID Metadata XML

See more XML Digital Signatures Examples

Demonstrates how to create an XML digital signature for Italian SPID Metadata. Dart

import 'package:chilkat/chilkat.dart';

void main() {
  // This example assumes the Chilkat API to have been previously unlocked.
  // See Global Unlock Sample for sample code.

  // Load the XML to be signed.
  final sbXml = CkStringBuilder();
  try {
    sbXml.loadFile('qa_data/xml_dsig/spid_metadata.xml', 'utf-8');
  } on ChilkatException {
    print('Failed to load the input file.');
    return;
  }

  // The XML to sign contains XML such as this:

  // <?xml version="1.0" encoding="utf-8"?>
  // <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://***.it" ID="_AE17AFFF-A600-49D5-B81D-76EEA55B50FF">
  //     <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true" WantAssertionsSigned="true">
  //         <md:KeyDescriptor use="signing">
  //             <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
  //                 <ds:X509Data>
  //                     <ds:X509Certificate>MIIF5...</ds:X509Certificate>
  //                 </ds:X509Data>
  //             </ds:KeyInfo>
  //         </md:KeyDescriptor>
  //         <md:KeyDescriptor use="encryption">
  //             <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
  //                 <ds:X509Data>
  //                     <ds:X509Certificate>MIIF5...</ds:X509Certificate>
  //                 </ds:X509Data>
  //             </ds:KeyInfo>
  //         </md:KeyDescriptor>
  //         <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://***.it/it-it/spid/logout"/>
  //         <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
  //         <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://***.it/it-it/spid/loginresp" index="0" isDefault="true"/>
  //         <md:AttributeConsumingService index="1">
  //             <md:ServiceName xml:lang="it">Servizi Online</md:ServiceName>
  //             <md:ServiceDescription xml:lang="it">Accesso ai Servizi Online</md:ServiceDescription>
  //             <md:RequestedAttribute Name="spidCode" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
  //             <md:RequestedAttribute Name="name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
  //             <md:RequestedAttribute Name="familyName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
  //             <md:RequestedAttribute Name="fiscalNumber" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
  //         </md:AttributeConsumingService>
  //     </md:SPSSODescriptor>
  //     <md:Organization>
  //         <md:OrganizationName xml:lang="it">SomeCompany s.r.l.</md:OrganizationName>
  //         <md:OrganizationDisplayName xml:lang="it">SomeCompany s.r.l.</md:OrganizationDisplayName>
  //         <md:OrganizationURL xml:lang="it">https://***.it</md:OrganizationURL>
  //     </md:Organization>
  // </md:EntityDescriptor>

  final gen = CkXmlDSigGen();

  gen.sigLocation = 'md:EntityDescriptor|md:SPSSODescriptor';
  gen.sigLocationMod = 2;
  gen.signedInfoCanonAlg = 'EXCL_C14N';
  gen.signedInfoDigestMethod = 'sha256';

  // -------- Reference 1 --------
  gen.addSameDocRef('_AE17AFFF-A600-49D5-B81D-76EEA55B50FF', 'sha256', 'EXCL_C14N', '', '');

  // Provide a certificate + private key. (PFX password is test123)
  final cert = CkCert();
  try {
    cert.loadPfxFile('qa_data/pfx/cert_test123.pfx', 'test123');
  } on ChilkatException catch (e) {
    print(e.lastErrorText);
    return;
  }

  gen.setX509Cert(cert, true);

  gen.keyInfoType = 'X509Data+KeyValue';
  gen.x509Type = 'Certificate';

  gen.behaviors = 'IndentedSignature,ForceAddEnvelopedSignatureTransform,OmitAlreadyDefinedSigNamespace';

  // Sign the XML...
  try {
    gen.createXmlDSigSb(sbXml);
  } on ChilkatException catch (e) {
    print(e.lastErrorText);
    return;
  }

  // -----------------------------------------------

  // Save the signed XML to a file.
  sbXml.writeFile('qa_output/signedXml.xml', 'utf-8', false);

  print(sbXml.getAsString());

  // ----------------------------------------
  // Verify the signatures we just produced...
  final verifier = CkXmlDSig();
  try {
    verifier.loadSignatureSb(sbXml);
  } on ChilkatException catch (e) {
    print(e.lastErrorText);
    return;
  }

  final numSigs = verifier.numSignatures;
  var verifyIdx = 0;
  while (verifyIdx < numSigs) {
    verifier.selector = verifyIdx;
    try {
      verifier.verifySignature(true);
    } on ChilkatException catch (e) {
      print(e.lastErrorText);
      return;
    }

    verifyIdx++;
  }

  print('All signatures were successfully verified.');
}