Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Problem signing XML with namespaces #264

Open
KevinVG opened this issue Oct 15, 2024 · 3 comments
Open

Problem signing XML with namespaces #264

KevinVG opened this issue Oct 15, 2024 · 3 comments

Comments

@KevinVG
Copy link

KevinVG commented Oct 15, 2024

We are having an issue signing XML with namespaces. Simplified code example:

        $xml = '<?xml version="1.0"?><smp:SignedServiceMetadata xmlns:smp="http://busdox.org/serviceMetadata/publishing/1.0/"><smp:ServiceMetadata></smp:ServiceMetadata></smp:SignedServiceMetadata>';
        $doc = new \DOMDocument();
        $doc->loadXML($xml);

        $privateKey = '...';
        $certificate = '...';
        $passphrase = '...';

        $DSig = new XMLSecurityDSig();
        $DSig->setCanonicalMethod(XMLSecurityDSig::C14N);
        $DSig->addReference(
            $doc,
            XMLSecurityDSig::SHA256,
            ['http://www.w3.org/2000/09/xmldsig#enveloped-signature'],
            ['force_uri' => true]
        );
        // Create a new (private) Security key
        $key = new XMLSecurityKey(
            XMLSecurityKey::RSA_SHA256,
            ['type' => 'private', 'passphrase' => $passphrase]
        );
        // Load the private key
        $key->loadKey($privateKey);

        // Add the associated public key to the signature
        $DSig->add509Cert($certificate, true, false, ['subjectName' => true]);

        // Sign the XML file
        $DSig->sign($key);

        $DSig->appendSignature($doc->documentElement);


        $signedXml = $doc->saveXML();

Gives an invalid signature. ( Tool used to check: https://tools.chilkat.io/xmlDsigVerify.cshtml )

Changing the xml input to input without namespaces works:

$xml = '<?xml version="1.0"?><SignedServiceMetadata><ServiceMetadata></ServiceMetadata></SignedServiceMetadata>';
@tvdijen
Copy link
Contributor

tvdijen commented Oct 15, 2024

They're both invalid when I try and verify the above. It's not adding a proper reference URI, so the validator-tool will be unable to know what to verify

@KevinVG
Copy link
Author

KevinVG commented Oct 15, 2024

@KevinVG
Copy link
Author

KevinVG commented Oct 16, 2024

We were able to fix the issue by replacing:

        // Sign the XML file
        $DSig->sign($key);
        $DSig->appendSignature($doc->documentElement);

With

        $DSig->sign($key, $doc->documentElement);

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants