Skip to content

Problem signing XML with namespaces #264

@KevinVG

Description

@KevinVG

We are having an issue signing XML with namespaces. Simplified code example:

        $xml = '<?xml version="1.0"?><smp:SignedServiceMetadata xmlns:smp="http://busdox.org/serviceMetadata/publishing/1.0/"><smp:ServiceMetadata></smp:ServiceMetadata></smp:SignedServiceMetadata>';
        $doc = new \DOMDocument();
        $doc->loadXML($xml);

        $privateKey = '...';
        $certificate = '...';
        $passphrase = '...';

        $DSig = new XMLSecurityDSig();
        $DSig->setCanonicalMethod(XMLSecurityDSig::C14N);
        $DSig->addReference(
            $doc,
            XMLSecurityDSig::SHA256,
            ['http://www.w3.org/2000/09/xmldsig#enveloped-signature'],
            ['force_uri' => true]
        );
        // Create a new (private) Security key
        $key = new XMLSecurityKey(
            XMLSecurityKey::RSA_SHA256,
            ['type' => 'private', 'passphrase' => $passphrase]
        );
        // Load the private key
        $key->loadKey($privateKey);

        // Add the associated public key to the signature
        $DSig->add509Cert($certificate, true, false, ['subjectName' => true]);

        // Sign the XML file
        $DSig->sign($key);

        $DSig->appendSignature($doc->documentElement);


        $signedXml = $doc->saveXML();

Gives an invalid signature. ( Tool used to check: https://tools.chilkat.io/xmlDsigVerify.cshtml )

Changing the xml input to input without namespaces works:

$xml = '<?xml version="1.0"?><SignedServiceMetadata><ServiceMetadata></ServiceMetadata></SignedServiceMetadata>';

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions