i have started using camel's xml security component pass xml input , signed. discovered output xml signed upon non canonicalized xml. case arises when contains empty element in response.xml. output "direct:detachedsign" route shows signature calculated upon element.
q: why signature route output have canonicalizationmethod , transform still have non-canonical element?
the used input response.xml
<?xml version="1.0" encoding="utf-8" standalone="yes"?> <ns3:response xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" xmlns:ns3="http://example.com"> <sampleholder id="myuniqueid"> <sample></sample> </sampleholder> </ns3:response> the output.xml signing route non-canonical signed element
<?xml version="1.0" encoding="utf-8"?> <ns3:response xmlns:ns3="http://example.com" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#"> <sampleholder id="myuniqueid"> <sample/> </sampleholder> <signature xmlns="http://www.w3.org/2000/09/xmldsig#"> <signedinfo> <canonicalizationmethod algorithm="http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments"/> <signaturemethod algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/> <reference uri="#myuniqueid"> <transforms> <transform algorithm="http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments"/> </transforms> <digestmethod algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/> <digestvalue>...</digestvalue> </reference> </signedinfo> <signaturevalue>...</signaturevalue> <keyinfo>...</keyinfo> </signature> </ns3:response> the signandverifiyxmlsignatureroutes.java signing , verification
public class signandverifiyxmlsignatureroutes extends routebuilder { @override public final void configure() throws exception { // detached signature from("direct:detachedsign")// .to("xmlsecurity:sign://detached"// + "?keyaccessor=#jkskeyaccessor"// + "&xpathstoidattributes=#xpathstoidattributesbean"// + "&schemaresourceuri=xsd/response.xsd"// + "&signatureid="// + "&prefixforxmlsignaturenamespace=" // + "&canonicalizationmethod=#canonicalizationbean" // + "&signaturealgorithm=http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" // + "&digestalgorithm=http://www.w3.org/2001/04/xmlenc#sha256"// + "&transformmethods=#transformmethodsbean" // + "&clearheaders=false"); // from("direct:verify")// .to("xmlsecurity:verify://detached?keyselector=#jkskeyselector" + // "&schemaresourceuri=xsd/response.xsd"); } }
