(Delphi DLL) Belgium eHealth Platform - checkAccessControl

See more Belgian eHealth Platform Examples

Note: This example requires Chilkat v11.0.0 or greater.

For more information, see https://www.ehealth.fgov.be/ehealthplatform/nl/beveiliging-van-webservices#1

Chilkat for Delphi Downloads Chilkat non-ActiveX DLL for Delphi Chilkat ActiveX DLL for Delphi * The examples here use the non-ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, XmlDSigGen, CkDateTime, HttpResponse, StringBuilder, BinData, Cert, Http, Xml;

...

procedure TForm1.Button1Click(Sender: TObject);
var
success: Boolean;
cert: HCkCert;
xmlToSign: HCkXml;
bdCert: HCkBinData;
dt: HCkDateTime;
gen: HCkXmlDSigGen;
xmlCustomKeyInfo: HCkXml;
sbXml: HCkStringBuilder;
http: HCkHttp;
resp: HCkHttpResponse;

begin
success := False;

// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// Provide a certificate + private key.
// Note: If your certificate + private key is located on a hardware token or smartcard, you can call a different function to load from smartcard..
cert := CkCert_Create();
success := CkCert_LoadPfxFile(cert,'SSIN=12345678.acc.p12','p12_password');
if (success = False) then
  begin
    Memo1.Lines.Add(CkCert__lastErrorText(cert));
    Exit;
  end;

// Create the XML to be signed...
xmlToSign := CkXml_Create();
CkXml_putTag(xmlToSign,'soapenv:Envelope');
CkXml_AddAttribute(xmlToSign,'xmlns:soapenv','http://schemas.xmlsoap.org/soap/envelope/');
CkXml_AddAttribute(xmlToSign,'xmlns:urn','urn:be:fgov:ehealth:platformintegrationconsumertest:v1');
CkXml_AddAttribute(xmlToSign,'xmlns:urn1','urn:be:fgov:ehealth:platformintegrationconsumertest:types:v1');
CkXml_UpdateAttrAt(xmlToSign,'soapenv:Header|wsse:Security',True,'xmlns:wsse','http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd');
CkXml_UpdateAttrAt(xmlToSign,'soapenv:Header|wsse:Security',True,'xmlns:wsu','http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd');
CkXml_UpdateAttrAt(xmlToSign,'soapenv:Header|wsse:Security|wsse:BinarySecurityToken',True,'EncodingType','http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary');
CkXml_UpdateAttrAt(xmlToSign,'soapenv:Header|wsse:Security|wsse:BinarySecurityToken',True,'ValueType','http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3');
CkXml_UpdateAttrAt(xmlToSign,'soapenv:Header|wsse:Security|wsse:BinarySecurityToken',True,'wsu:Id','X509-FC77E2C72083DA8E0F16711753508182856');

// ---------------------------------------------------------------------------------------------------------------
// A note about the Id's, such as X509-FC77E2C72083DA8E0F16711753508182856, TS-FC77E2C72083DA8E0F16711753508042855, etc.
// These Id's simply need to be unique within the XML document.  You don't need to generate new Id's every time.
// You can use the same Id's in each XML document that is submitted. The purpose of each Id is to
// match the XMLDsig Reference to the element in XML being referenced. 
// In other words, you could use the Id's "mickey_mouse", "donald_duck", and "goofy", and it would work perfectly OK,
// as long as no other XML elements also use the Id's "mickey_mouse", "donald_duck", or "goofy"
// ---------------------------------------------------------------------------------------------------------------

bdCert := CkBinData_Create();
CkCert_ExportCertDerBd(cert,bdCert);

CkXml_UpdateChildContent(xmlToSign,'soapenv:Header|wsse:Security|wsse:BinarySecurityToken',CkBinData__getEncoded(bdCert,'base64'));
CkXml_UpdateAttrAt(xmlToSign,'soapenv:Header|wsse:Security|wsu:Timestamp',True,'wsu:Id','TS-FC77E2C72083DA8E0F16711753508042855');

dt := CkDateTime_Create();
CkDateTime_SetFromCurrentSystemTime(dt);
CkXml_UpdateChildContent(xmlToSign,'soapenv:Header|wsse:Security|wsu:Timestamp|wsu:Created',CkDateTime__getAsTimestamp(dt,False));
CkDateTime_AddSeconds(dt,3600);
CkXml_UpdateChildContent(xmlToSign,'soapenv:Header|wsse:Security|wsu:Timestamp|wsu:Expires',CkDateTime__getAsTimestamp(dt,False));
CkDateTime_AddSeconds(dt,-3600);

CkXml_UpdateAttrAt(xmlToSign,'soapenv:Body',True,'wsu:Id','id-FC77E2C72083DA8E0F16711753508182859');
CkXml_UpdateAttrAt(xmlToSign,'soapenv:Body',True,'xmlns:wsu','http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd');
CkXml_UpdateChildContent(xmlToSign,'soapenv:Body|urn:CheckAccessControlRequest|urn1:Message','Hello World');

// Create a timestamp with the current date/time in the following format: 2014-12-30T15:29:03.157+01:00

CkXml_UpdateChildContent(xmlToSign,'soapenv:Body|urn:CheckAccessControlRequest|urn1:Timestamp',CkDateTime__getAsTimestamp(dt,True));

gen := CkXmlDSigGen_Create();

CkXmlDSigGen_putSigLocation(gen,'soapenv:Envelope|soapenv:Header|wsse:Security|wsse:BinarySecurityToken');
CkXmlDSigGen_putSigLocationMod(gen,1);
CkXmlDSigGen_putSigId(gen,'SIG-FC77E2C72083DA8E0F16711753508252860');
CkXmlDSigGen_putSigNamespacePrefix(gen,'ds');
CkXmlDSigGen_putSigNamespaceUri(gen,'http://www.w3.org/2000/09/xmldsig#');
CkXmlDSigGen_putSignedInfoPrefixList(gen,'soapenv urn urn1');
CkXmlDSigGen_putIncNamespacePrefix(gen,'ec');
CkXmlDSigGen_putIncNamespaceUri(gen,'http://www.w3.org/2001/10/xml-exc-c14n#');
CkXmlDSigGen_putSignedInfoCanonAlg(gen,'EXCL_C14N');
CkXmlDSigGen_putSignedInfoDigestMethod(gen,'sha256');

// Set the KeyInfoId before adding references..
CkXmlDSigGen_putKeyInfoId(gen,'KI-FC77E2C72083DA8E0F16711753508182857');

// -------- Reference 1 --------
CkXmlDSigGen_AddSameDocRef(gen,'TS-FC77E2C72083DA8E0F16711753508042855','sha256','EXCL_C14N','wsse soapenv urn urn1','');

// -------- Reference 2 --------
CkXmlDSigGen_AddSameDocRef(gen,'id-FC77E2C72083DA8E0F16711753508182859','sha256','EXCL_C14N','urn urn1','');

// -------- Reference 3 --------
CkXmlDSigGen_AddSameDocRef(gen,'X509-FC77E2C72083DA8E0F16711753508182856','sha256','EXCL_C14N','_EMPTY_','');

CkXmlDSigGen_SetX509Cert(gen,cert,True);

CkXmlDSigGen_putKeyInfoType(gen,'Custom');

// Create the custom KeyInfo XML..
xmlCustomKeyInfo := CkXml_Create();
CkXml_putTag(xmlCustomKeyInfo,'wsse:SecurityTokenReference');
CkXml_AddAttribute(xmlCustomKeyInfo,'wsu:Id','STR-FC77E2C72083DA8E0F16711753508182858');
CkXml_UpdateAttrAt(xmlCustomKeyInfo,'wsse:Reference',True,'URI','#X509-FC77E2C72083DA8E0F16711753508182856');
CkXml_UpdateAttrAt(xmlCustomKeyInfo,'wsse:Reference',True,'ValueType','http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3');

CkXml_putEmitXmlDecl(xmlCustomKeyInfo,False);
CkXmlDSigGen_putCustomKeyInfoXml(gen,CkXml__getXml(xmlCustomKeyInfo));

// Load XML to be signed...
sbXml := CkStringBuilder_Create();
CkXml_GetXmlSb(xmlToSign,sbXml);

CkXmlDSigGen_putBehaviors(gen,'IndentedSignature');

// Sign the XML...
success := CkXmlDSigGen_CreateXmlDSigSb(gen,sbXml);
if (success = False) then
  begin
    Memo1.Lines.Add(CkXmlDSigGen__lastErrorText(gen));
    Exit;
  end;

// -----------------------------------------------
// Send the signed XML...
http := CkHttp_Create();

success := CkHttp_SetSslClientCert(http,cert);
if (success = False) then
  begin
    Memo1.Lines.Add(CkHttp__lastErrorText(http));
    Exit;
  end;

CkHttp_SetRequestHeader(http,'Content-Type','text/xml');

// Change to services.ehealth.fgov.be for the production environment.
resp := CkHttpResponse_Create();
success := CkHttp_HttpSb(http,'POST','https://services-acpt.ehealth.fgov.be/PlatformIntegrationConsumerTest/v1',sbXml,'utf-8','application/xml',resp);
if (success = False) then
  begin
    Memo1.Lines.Add(CkHttp__lastErrorText(http));
    Exit;
  end;

Memo1.Lines.Add(CkHttpResponse__bodyStr(resp));
Memo1.Lines.Add('response status code = ' + IntToStr(CkHttpResponse_getStatusCode(resp)));

// A successful response is a 200 status code, with this sample response:

// <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
//    <soapenv:Header xmlns:v1="urn:be:fgov:ehealth:platformintegrationconsumertest:v1" xmlns:v11="urn:be:fgov:ehealth:platformintegrationconsumertest:types:v1"/>
//    <soapenv:Body xmlns:ic="urn:be:fgov:ehealth:platformintegrationconsumertest:v1" xmlns:type="urn:be:fgov:ehealth:platformintegrationconsumertest:types:v1">
//       <ic:CheckAccessControlResponse>
//          <type:Message>Hello World</type:Message>
//          <type:Timestamp>2023-09-28T22:17:26.643+02:00</type:Timestamp>
//          <type:AuthenticatedConsumer>CN="SSIN=aaaaaa", OU=eHealth-platform Belgium, OU=bbbb, OU="SSIN=aaaaaaa", O=Federal Government, C=BE</type:AuthenticatedConsumer>
//       </ic:CheckAccessControlResponse>
//    </soapenv:Body>
// </soapenv:Envelope>

CkCert_Dispose(cert);
CkXml_Dispose(xmlToSign);
CkBinData_Dispose(bdCert);
CkDateTime_Dispose(dt);
CkXmlDSigGen_Dispose(gen);
CkXml_Dispose(xmlCustomKeyInfo);
CkStringBuilder_Dispose(sbXml);
CkHttp_Dispose(http);
CkHttpResponse_Dispose(resp);

end;