java - XML Signature Validation -
i have problem can't figure out how solve. application receives (supposedly) signed xml , have validate if right. here's signature part of receive in xml
<signature xmlns="http://www.w3.org/2000/09/xmldsig#"> <signedinfo> <canonicalizationmethod algorithm="http://www.w3.org/tr/2001/rec-xml-c14n-20010315" /> <signaturemethod algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /> <reference uri="35121103220612000188550010000000131000009300"> <transforms> <transform algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /> <transform algorithm="http://www.w3.org/tr/2001/rec-xml-c14n-20010315" /> </transforms> <digestmethod algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /> <digestvalue>ulz/66r6oonlpj5v4cisrv5zmyc=</digestvalue> </reference> </signedinfo> <signaturevalue>encoded</signaturevalue> <keyinfo> <x509data> <x509certificate>encoded</x509certificate> </x509data> </keyinfo> </signature>
everything found on internet validate needs public key. don't have it. have digestvalue. know if possible validate using diggestvalue?
here's have far. problem key x509keyselector
documentbuilderfactory dbf = documentbuilderfactory.newinstance(); dbf.setnamespaceaware(true); documentbuilder builder = dbf.newdocumentbuilder(); document doc = builder.parse("/home/test.xml"); node nl = doc.getelementsbytagnamens(xmlsignature.xmlns, "signature").item(0); domvalidatecontext valcontext = new domvalidatecontext(new x509keyselector(publickey), nl); xmlsignaturefactory factory = xmlsignaturefactory.getinstance("dom"); xmlsignature signature = factory.unmarshalxmlsignature(valcontext); system.out.println(signature.validate(valcontext));
thanks in advance.
you x509 key embedded x509 certificate.
update:
doing google search "xml signature x509certificate" turned this page, seem give answers need.
Comments
Post a Comment