xsign

The xsign accessor generates a standard XML signature consisting of a DSA signature and SHA1 digest of a part of an xml document located by an xpath expression. The signature is attached to the root element of the signed document together with an X509 certificate for validation.

The xsign accessor requires a private key together with other properties. The properties for the PKI keystore, PKI private key password, xpath location and certificate alias are passed in the operator document - see description below.

It is important to provide an xpath location that does not include the ds:signature element which will be attached to the root document element as the signature.

This implementation uses the Apache XML Security package. The xsign accessor uses the DSA algorithm to generate the XML signature. It uses the SHA1 algorithm to create a hash of the document fragment given by the xpath target. This accessor provides a general purpose xml sig but it is not as comprehensive as the full features offered by xmlsec. If XML Sig is important for your application we recommend you customize this accessor to suit your requirements.

Security

In the demonstration, the xmlsig properties are hard coded into the demonstration idoc. This is highly undesirable in a real implementation. It is recommended that the xmlsig properties document be placed in a trusted location with suitable access control. Preferrably the application should be written to request the passwords dynamically at runtime.

Keystore

The default PKI keystore is located in <dexter_install_directory>/security/demo_keystore. The java keytool application, shipped with most JDK's, can be used to register and administer PKI keys and certificates. Do not use the demo keystore or any keys it contains in a real application. It is for illustration only! Create your own keystore using keytool and obtain a certified private key from a reputable Certification Authority.

Operator Syntax

The xsign accessor requires a set of configurable properties in order to sign a document. These are passed in by the operator in an <xmlsig> document. The element names and properties are illustrated below.

<keystore> contains the <uri> element which holds the uri to a java keystore located relative to the install directory of the dexter kernel. In the default demonstrations this is security/demo_keystore. The <password> element contains the password to the keystore.

<privateKey> contains the properties necessary to specify and access the PKI private key with which the signature will be made. <privateKeyAlias> is the alias name with which the key is registered in the java keystore. <privateKeyPassword> is the password used to secure the key within java keystore. <certificateAlias> is alias name for the X509 certificate corresponding to the associated public key registered in the java keystore.

<algorithm> is not currently used. xmlsig defaults to the DSA algorithm.

<targetXpath> is xpath location for the xml-fragment that is actually signed. Repeated xmlsig operations with the same document and different values for targetXPath will generate multiple signatures of the document. It is important not to include either the signature <ds:Signature> element or unwanted parts of the document in this xpath or the generated signature may be unverifiable.

<publicURI> is the uri expressed in the signature as the public URI of the document. See xmlsig specification for details