Package org.apache.poi.poifs.crypt.dsig
Class SignatureInfo
java.lang.Object
org.apache.poi.poifs.crypt.dsig.SignatureInfo
- All Implemented Interfaces:
SignatureConfig.SignatureConfigurable
This class is the default entry point for XML signatures and can be used for validating an existing signed office document and signing a office document.
Validating a signed office document
OPCPackage pkg = OPCPackage.open(..., PackageAccess.READ); SignatureConfig sic = new SignatureConfig(); sic.setOpcPackage(pkg); SignatureInfo si = new SignatureInfo(); si.setSignatureConfig(sic); boolean isValid = si.validate(); ...
Signing an office document
// loading the keystore - pkcs12 is used here, but of course jks & co are also valid // the keystore needs to contain a private key and it's certificate having a // 'digitalSignature' key usage char password[] = "test".toCharArray(); File file = new File("test.pfx"); KeyStore keystore = KeyStore.getInstance("PKCS12"); FileInputStream fis = new FileInputStream(file); keystore.load(fis, password); fis.close(); // extracting private key and certificate String alias = "xyz"; // alias of the keystore entry Key key = keystore.getKey(alias, password); X509Certificate x509 = (X509Certificate)keystore.getCertificate(alias); // filling the SignatureConfig entries (minimum fields, more options are available ...) SignatureConfig signatureConfig = new SignatureConfig(); signatureConfig.setKey(keyPair.getPrivate()); signatureConfig.setSigningCertificateChain(Collections.singletonList(x509)); OPCPackage pkg = OPCPackage.open(..., PackageAccess.READ_WRITE); signatureConfig.setOpcPackage(pkg); // adding the signature document to the package SignatureInfo si = new SignatureInfo(); si.setSignatureConfig(signatureConfig); si.confirmSignature(); // optionally verify the generated signature boolean b = si.verifySignature(); assert (b); // write the changes back to disc pkg.close();
Implementation notes:
Although there's a XML signature implementation in the Oracle JDKs 6 and higher, compatibility with IBM JDKs is also in focus (... but maybe not thoroughly tested ...). Therefore we are using the Apache Santuario libs (xmlsec) instead of the built-in classes, as the compatibility seems to be provided there.
To use SignatureInfo and its sibling classes, you'll need to have the following libs in the classpath:
- BouncyCastle bcpkix and bcprov (tested against 1.60)
- Apache Santuario "xmlsec" (tested against 2.1.0)
- and slf4j-api (tested against 1.7.25)
-
Constructor Summary
ConstructorsConstructorDescriptionConstructor initializes xml signature environment, if it hasn't been initialized before -
Method Summary
Modifier and TypeMethodDescriptionvoid
add the xml signature to the documentcreateXMLSignContext
(Document document) Convenience method for creating the signature contextprotected static void
Initialize the xml signing environment and the bouncycastle providervoid
postSign
(DOMSignContext xmlSignContext, String signatureValue) Helper method for adding informations after the signing.org.apache.jcp.xml.dsig.internal.dom.DOMSignedInfo
preSign
(DOMSignContext xmlSignContext) Helper method for adding informations before the signing.void
setSignatureConfig
(SignatureConfig signatureConfig) signDigest
(DOMSignContext xmlSignContext, org.apache.jcp.xml.dsig.internal.dom.DOMSignedInfo signedInfo) Sign (encrypt) the digest with the private key.boolean
protected void
writeDocument
(Document document) Write XML signature into the OPC package
-
Constructor Details
-
SignatureInfo
public SignatureInfo()Constructor initializes xml signature environment, if it hasn't been initialized before
-
-
Method Details
-
getSignatureConfig
- Returns:
- the signature config
-
setSignatureConfig
- Specified by:
setSignatureConfig
in interfaceSignatureConfig.SignatureConfigurable
- Parameters:
signatureConfig
- the signature config, needs to be set before a SignatureInfo object is used
-
verifySignature
public boolean verifySignature()- Returns:
- true, if first signature part is valid
-
confirmSignature
add the xml signature to the document -
createXMLSignContext
Convenience method for creating the signature context- Parameters:
document
- the document the signature is based on- Returns:
- the initialized signature context
-
signDigest
public String signDigest(DOMSignContext xmlSignContext, org.apache.jcp.xml.dsig.internal.dom.DOMSignedInfo signedInfo) Sign (encrypt) the digest with the private key. Currently only rsa is supported.- Parameters:
digest
- the hashed input- Returns:
- the encrypted hash
-
getSignatureParts
- Returns:
- a signature part for each signature document. the parts can be validated independently.
-
initXmlProvider
protected static void initXmlProvider()Initialize the xml signing environment and the bouncycastle provider -
preSign
public org.apache.jcp.xml.dsig.internal.dom.DOMSignedInfo preSign(DOMSignContext xmlSignContext) throws XMLSignatureException, MarshalException Helper method for adding informations before the signing. NormallyconfirmSignature()
is sufficient to be used. -
postSign
Helper method for adding informations after the signing. NormallyconfirmSignature()
is sufficient to be used.- Throws:
MarshalException
-
writeDocument
Write XML signature into the OPC package- Parameters:
document
- the xml signature document- Throws:
MarshalException
-