Sample code for 30+ languages & platforms
Lua Requires Chilkat v9.5.0.96+

Sign SOAP XML for New Zealand Customs Service

See more XAdES Examples

Demonstrates how to create an XAdES signed SOAP XML pertaining to the New Zealand Customs Service.

Chilkat Lua Downloads

Download Chilkat for Lua
Lua 
local chilkat = require("chilkat")

-- This example assumes the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

local success = true

-- Create the following XML to be signed:

-- <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
--     xmlns:v1="http://customs.govt.nz/jbms/msggate/reqresp/v1">
--     <soapenv:Header>
--         <wsse:Security soapenv:mustUnderstand="1"
--             xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
--             xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
--             <wsu:Timestamp wsu:Id="TS-037E78514E9B9132CB16817563559151">
--                 <wsu:Created>2023-04-17T18:32:35.913Z</wsu:Created>
--                 <wsu:Expires>2023-04-17T19:32:35.913Z</wsu:Expires>
--             </wsu:Timestamp>
--         </wsse:Security>
--     </soapenv:Header>
--     <soapenv:Body wsu:Id="id-8"
--         xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
--         <v1:RequestResponse>
--             <v1:Submitter>TEST1234</v1:Submitter>
--             <v1:MailboxMsgId>999999</v1:MailboxMsgId>
--         </v1:RequestResponse>
--     </soapenv:Body>
-- </soapenv:Envelope>

-- Create a random ID like this: TS-037E78514E9B9132CB16817563559151
local tsId = chilkat.StringBuilder.new()
tsId:append("TS-")
tsId:append_random(16, "hex")

-- STR-037E78514E9B9132CB16817563559614
local strId = chilkat.StringBuilder.new()
strId:append("STR-")
strId:append_random(16, "hex")

-- KI-037E78514E9B9132CB16817563559583
local keyInfoId = chilkat.StringBuilder.new()
keyInfoId:append("KI-")
keyInfoId:append_random(16, "hex")

-- Create a date/time for the current time with this format:  2023-04-17T18:32:35.913Z
local dt = chilkat.DateTime.new()
dt:set_from_current_system_time()

local sbNow = chilkat.StringBuilder.new()
sbNow:append(dt:get_as_timestamp(false))
-- If we really need the milliseconds, we can replace the "Z" with ".000Z"
-- The server will also likely accept a timestamp without milliseconds, such as 2023-04-17T18:32:35Z
local n = sbNow:replace("Z", ".000Z")

local sbNowPlusOneHour = chilkat.StringBuilder.new()
dt:add_seconds(3600)
sbNowPlusOneHour:append(dt:get_as_timestamp(false))
n = sbNowPlusOneHour:replace("Z", ".000Z")

local xmlToSign = chilkat.Xml.new()
xmlToSign.tag = "soapenv:Envelope"
xmlToSign:add_attribute("xmlns:soapenv", "http://schemas.xmlsoap.org/soap/envelope/")
xmlToSign:add_attribute("xmlns:v1", "http://customs.govt.nz/jbms/msggate/reqresp/v1")
xmlToSign:update_attr_at("soapenv:Header|wsse:Security", true, "soapenv:mustUnderstand", "1")
xmlToSign:update_attr_at("soapenv:Header|wsse:Security", true, "xmlns:wsse", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd")
xmlToSign:update_attr_at("soapenv:Header|wsse:Security", true, "xmlns:wsu", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd")
xmlToSign:update_attr_at("soapenv:Header|wsse:Security|wsu:Timestamp", true, "wsu:Id", tsId:get_as_string())
xmlToSign:update_child_content("soapenv:Header|wsse:Security|wsu:Timestamp|wsu:Created", sbNow:get_as_string())
xmlToSign:update_child_content("soapenv:Header|wsse:Security|wsu:Timestamp|wsu:Expires", sbNowPlusOneHour:get_as_string())
xmlToSign:update_attr_at("soapenv:Body", true, "wsu:Id", "id-8")
xmlToSign:update_attr_at("soapenv:Body", true, "xmlns:wsu", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd")
xmlToSign:update_child_content("soapenv:Body|v1:RequestResponse|v1:Submitter", "TEST1234")
xmlToSign:update_child_content("soapenv:Body|v1:RequestResponse|v1:MailboxMsgId", "999999")

local gen = chilkat.XmlDSigGen.new()

gen.sig_location = "soapenv:Envelope|soapenv:Header|wsse:Security"
gen.sig_location_mod = 0
gen.sig_id = "SIG-037E78514E9B9132CB16817563559695"
gen.sig_namespace_prefix = "ds"
gen.sig_namespace_uri = "http://www.w3.org/2000/09/xmldsig#"
gen.signed_info_prefix_list = "soapenv v1"
gen.inc_namespace_prefix = "ec"
gen.inc_namespace_uri = "http://www.w3.org/2001/10/xml-exc-c14n#"
gen.signed_info_canon_alg = "EXCL_C14N"
gen.signed_info_digest_method = "sha256"

-- Set the KeyInfoId before adding references..
gen.key_info_id = keyInfoId:get_as_string()

-- -------- Reference 1 --------
local xml1 = chilkat.Xml.new()
xml1.tag = "ds:Transforms"
xml1:update_attr_at("ds:Transform", true, "Algorithm", "http://www.w3.org/2001/10/xml-exc-c14n#")
xml1:update_attr_at("ds:Transform|ec:InclusiveNamespaces", true, "PrefixList", "wsse soapenv v1")
xml1:update_attr_at("ds:Transform|ec:InclusiveNamespaces", true, "xmlns:ec", "http://www.w3.org/2001/10/xml-exc-c14n#")

gen:add_same_doc_ref2(tsId:get_as_string(), "sha256", xml1, "")

-- -------- Reference 2 --------
local xml2 = chilkat.Xml.new()
xml2.tag = "ds:Transforms"
xml2:update_attr_at("ds:Transform", true, "Algorithm", "http://www.w3.org/2001/10/xml-exc-c14n#")
xml2:update_attr_at("ds:Transform|ec:InclusiveNamespaces", true, "PrefixList", "v1")
xml2:update_attr_at("ds:Transform|ec:InclusiveNamespaces", true, "xmlns:ec", "http://www.w3.org/2001/10/xml-exc-c14n#")

gen:add_same_doc_ref2("id-8", "sha256", xml2, "")

-- Provide a certificate + private key. (PFX password is test123)
local cert = chilkat.Cert.new()
success = cert:load_pfx_file("qa_data/pfx/cert_test123.pfx", "test123")
if not success then
    print(cert.last_error_text)
    return
end

gen:set_x509_cert(cert, true)

gen.key_info_type = "Custom"

-- Create the custom KeyInfo XML..
local xmlCustomKeyInfo = chilkat.Xml.new()
xmlCustomKeyInfo.tag = "wsse:SecurityTokenReference"
xmlCustomKeyInfo:add_attribute("wsu:Id", strId:get_as_string())
xmlCustomKeyInfo:update_attr_at("wsse:KeyIdentifier", true, "EncodingType", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary")
xmlCustomKeyInfo:update_attr_at("wsse:KeyIdentifier", true, "ValueType", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3")
-- Insert the single-line base64 of the signing certificate's DER
cert.uncommon_options = "Base64CertNoCRLF"
xmlCustomKeyInfo:update_child_content("wsse:KeyIdentifier", cert:get_encoded())

xmlCustomKeyInfo.emit_xml_decl = false
gen.custom_key_info_xml = xmlCustomKeyInfo:get_xml()

-- Load XML to be signed...
local sbXml = chilkat.StringBuilder.new()
xmlToSign:get_xml_sb(sbXml)

gen.behaviors = "IndentedSignature"

-- Sign the XML...
gen.verbose_logging = true
success = gen:create_xml_dsig_sb(sbXml)
if not success then
    print(gen.last_error_text)
    return
end

-- Save the signed XML to a file.
success = sbXml:write_file("c:/temp/qa_output/signedXml.xml", "utf-8", false)

print(sbXml:get_as_string())