signer 1.0.0 → 1.1.0

data/README.md

@@ -27,7 +27,7 @@ signer.document.xpath("//a:To", { "a" => "http://www.w3.org/2005/08/addressing"
   signer.digest!(node)
 end
 
-signer.sign!
+signer.sign!(:security_token => true)
 
 signer.to_xml
 ```

data/lib/signer.rb

@@ -7,6 +7,7 @@ require "signer/version"
 
 class Signer
   attr_accessor :document, :cert, :private_key
+  attr_writer :security_node, :security_token_id
 
   def initialize(document)
     self.document = Nokogiri::XML(document.to_s, &:noblanks)
@@ -17,11 +18,15 @@ class Signer
   end
 
   def security_token_id
-    "uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"
+    @security_token_id ||= "uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"
   end
 
   def security_node
-    document.xpath("//o:Security", "o" => "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd").first
+    @security_node ||= document.xpath("//o:Security", "o" => "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd").first
+  end
+
+  def canonicalize(node = document)
+    node.canonicalize(Nokogiri::XML::XML_C14N_EXCLUSIVE_1_0)
   end
 
   # <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
@@ -74,7 +79,7 @@ class Signer
       node['ValueType']    = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3'
       node['EncodingType'] = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary'
       node.content = Base64.encode64(cert.to_der).gsub("\n", '')
-      security_node.add_child(node)
+      signature_node.add_previous_sibling(node)
       key_info_node = Nokogiri::XML::Node.new('KeyInfo', document)
       security_token_reference_node = Nokogiri::XML::Node.new('o:SecurityTokenReference', document)
       key_info_node.add_child(security_token_reference_node)
@@ -87,6 +92,41 @@ class Signer
     node
   end
 
+  # <KeyInfo>
+  #   <X509Data>
+  #     <X509IssuerSerial>
+  #       <X509IssuerName>System.Security.Cryptography.X509Certificates.X500DistinguishedName</X509IssuerName>
+  #       <X509SerialNumber>13070789</X509SerialNumber>
+  #     </X509IssuerSerial>
+  #     <X509Certificate>MIID+jCCAuKgAwIBAgIEAMdxxTANBgkqhkiG9w0BAQUFADBsMQswCQYDVQQGEwJTRTEeMBwGA1UEChMVTm9yZGVhIEJhbmsgQUIgKHB1YmwpMScwJQYDVQQDEx5Ob3JkZWEgcm9sZS1jZXJ0aWZpY2F0ZXMgQ0EgMDExFDASBgNVBAUTCzUxNjQwNi0wMTIwMB4XDTA5MDYxMTEyNTAxOVoXDTExMDYxMTEyNTAxOVowcjELMAkGA1UEBhMCU0UxIDAeBgNVBAMMF05vcmRlYSBEZW1vIENlcnRpZmljYXRlMRQwEgYDVQQEDAtDZXJ0aWZpY2F0ZTEUMBIGA1UEKgwLTm9yZGVhIERlbW8xFTATBgNVBAUTDDAwOTU1NzI0Mzc3MjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwcgz5AzbxTbsCE51No7fPnSqmQBIMW9OiPkiHotwYQTl+H9qwDvQRyBqHN26tnw7hNvEShd1ZRGUg4drMEXDV5CmKqsAevs9lauWDaHnGKPNHZJ1hNNYXHwymksEz5zMnG8eqRdhb4vOV2FzreJeYpsgx31Bv0aTofHcHVz4uGcCAwEAAaOCASAwggEcMAkGA1UdEwQCMAAwEQYDVR0OBAoECEj6Y9/vU03WMBMGA1UdIAQMMAowCAYGKoVwRwEDMBMGA1UdIwQMMAqACEIFjfLBeTpRMDcGCCsGAQUFBwEBBCswKTAnBggrBgEFBQcwAYYbaHR0cDovL29jc3Aubm9yZGVhLnNlL1JDQTAxMA4GA1UdDwEB/wQEAwIGQDCBiAYDVR0fBIGAMH4wfKB6oHiGdmxkYXA6Ly9sZGFwLm5iLnNlL2NuPU5vcmRlYSUyMHJvbGUtY2VydGlmaWNhdGVzJTIwQ0ElMjAwMSxvPU5vcmRlYSUyMEJhbmslMjBBQiUyMChwdWJsKSxjPVNFP2NlcnRpZmljYXRlcmV2b2NhdGlvbmxpc3QwDQYJKoZIhvcNAQEFBQADggEBAEXUv87VpHk51y3TqkMb1MYDqeKvQRE1cNcvhEJhIzdDpXMA9fG0KqvSTT1e0ZI2r78mXDvtTZnpic44jX2XMSmKO6n+1taAXq940tJUhF4arYMUxwDKOso0Doanogug496gipqMlpLgvIhGt06sWjNrvHzp2eGydUFdCsLr2ULqbDcut7g6eMcmrsnrOntjEU/J3hO8gyCeldJ+fI81qarrK/I0MZLR5LWCyVG/SKduoxHLX7JohsbIGyK1qAh9fi8l6X1Rcu80v5inpu71E/DnjbkAZBo7vsj78zzdk7KNliBIqBcIszdJ3dEHRWSI7FspRxyiR0NDm4lpyLwFtfw=</X509Certificate>
+  #   </X509Data>
+  # </KeyInfo>
+  def x509_data_node
+    issuer_name_node   = Nokogiri::XML::Node.new('X509IssuerName', document)
+    issuer_name_node.content = "System.Security.Cryptography.X509Certificates.X500DistinguishedName"
+
+    issuer_number_node = Nokogiri::XML::Node.new('X509SerialNumber', document)
+    issuer_number_node.content = cert.serial
+
+    issuer_serial_node = Nokogiri::XML::Node.new('X509IssuerSerial', document)
+    issuer_serial_node.add_child(issuer_name_node)
+    issuer_serial_node.add_child(issuer_number_node)
+
+    cetificate_node    = Nokogiri::XML::Node.new('X509Certificate', document)
+    cetificate_node.content = Base64.encode64(cert.to_der).gsub("\n", '')
+
+    data_node          = Nokogiri::XML::Node.new('X509Data', document)
+    data_node.add_child(issuer_serial_node)
+    data_node.add_child(cetificate_node)
+
+    key_info_node      = Nokogiri::XML::Node.new('KeyInfo', document)
+    key_info_node.add_child(data_node)
+
+    signed_info_node.add_next_sibling(key_info_node)
+
+    data_node
+  end
+
   # <Reference URI="#_0">
   #   <Transforms>
   #     <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
@@ -94,14 +134,14 @@ class Signer
   #   <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
   #   <DigestValue>aeqXriJuUCk4tPNPAGDXGqHj6ao=</DigestValue>
   # </Reference>
-  def digest!(target_node)
-    binary_security_token_node
-
-    id = "_#{Digest::SHA1.hexdigest(target_node.to_s)}"
-    target_node['u:Id'] = id
+  def digest!(target_node, options = {})
+    id = options[:id] || "_#{Digest::SHA1.hexdigest(target_node.to_s)}"
+    target_node['u:Id'] = id if id.size > 0
+    target_canon = canonicalize(target_node)
+    target_digest = Base64.encode64(OpenSSL::Digest::SHA1.digest(target_canon)).strip
 
     reference_node = Nokogiri::XML::Node.new('Reference', document)
-    reference_node['URI'] = "##{id}"
+    reference_node['URI'] = id.size > 0 ? "##{id}" : ""
     signed_info_node.add_child(reference_node)
 
     transforms_node = Nokogiri::XML::Node.new('Transforms', document)
@@ -116,16 +156,22 @@ class Signer
     reference_node.add_child(digest_method_node)
 
     digest_value_node = Nokogiri::XML::Node.new('DigestValue', document)
-    target_canon = target_node.canonicalize(Nokogiri::XML::XML_C14N_EXCLUSIVE_1_0)
-    target_digest = Base64.encode64(OpenSSL::Digest::SHA1.digest(target_canon)).strip
     digest_value_node.content = target_digest
     reference_node.add_child(digest_value_node)
     self
   end
 
   # <SignatureValue>...</SignatureValue>
-  def sign!
-    signed_info_canon = signed_info_node.canonicalize(Nokogiri::XML::XML_C14N_EXCLUSIVE_1_0)
+  def sign!(options = {})
+    if options[:security_token]
+      binary_security_token_node
+    end
+
+    if options[:issuer_serial]
+      x509_data_node
+    end
+
+    signed_info_canon = canonicalize(signed_info_node)
 
     signature = private_key.sign(OpenSSL::Digest::SHA1.new, signed_info_canon)
     signature_value_digest = Base64.encode64(signature).gsub("\n", '')

data/lib/signer/version.rb

@@ -1,3 +1,3 @@
 class Signer
-  VERSION = "1.0.0"
+  VERSION = "1.1.0"
 end

data/spec/fixtures/input_2.xml

@@ -0,0 +1,7 @@
+<ApplicationRequest xmlns="http://bxd.fi/xmldata/">
+  <CustomerId>679155330</CustomerId>
+  <Command>GetUserInfo</Command>
+  <Timestamp>2010-05-10T13:22:19.847+03:00</Timestamp>
+  <Environment>PRODUCTION</Environment>
+  <SoftwareId>Petri</SoftwareId>
+</ApplicationRequest>

data/spec/fixtures/output_2.xml

@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+<ApplicationRequest xmlns="http://bxd.fi/xmldata/">
+  <CustomerId>679155330</CustomerId>
+  <Command>GetUserInfo</Command>
+  <Timestamp>2010-05-10T13:22:19.847+03:00</Timestamp>
+  <Environment>PRODUCTION</Environment>
+  <SoftwareId>Petri</SoftwareId>
+  <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
+    <SignedInfo>
+      <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+      <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+      <Reference URI="">
+        <Transforms>
+          <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+        </Transforms>
+        <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+        <DigestValue>U9tsT4lrRMp8ZdKMnblgeMCGfvI=</DigestValue>
+      </Reference>
+    </SignedInfo>
+    <SignatureValue>GoikOue0l0ZZBkEoZ+kDvFJ0YJl1nW4zFLe8IsMcqPFFE2xOK1lO/YHKpc49CNQFs2ZhOiGwCseOg0F/8FUWp9hiAOTLlYrKVd61FErifakLw/mirP2SB3J9npPh6Idt9LMQWU+O+aRdyJMF7HLpx03GML2IF9ejKVUBTWTrcpU=</SignatureValue>
+    <KeyInfo>
+      <X509Data>
+        <X509IssuerSerial>
+          <X509IssuerName>System.Security.Cryptography.X509Certificates.X500DistinguishedName</X509IssuerName>
+          <X509SerialNumber>16503368396260674861</X509SerialNumber>
+        </X509IssuerSerial>
+        <X509Certificate>MIICsDCCAhmgAwIBAgIJAOUHvh4oho0tMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTIwNTAzMTMxODIyWhcNMTMwNTAzMTMxODIyWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvK5hMPv/R5IFmwWyJOyEaFUrF/ZsmN+Gip8hvR6rLP3YPNx9iFYvPcZllFmuVwyaz7YT2N5BsqTwLdyi5v4HY4fUtuz0p8jIPoSd6dfDvcnSpf4QLTOgOaL3ciPEbgDHH2tnIksukoWzqCYva+qFZ74NFl19swXotW9fA4Jzs4QIDAQABo4GnMIGkMB0GA1UdDgQWBBRU1WEHDnP8Hr7ZulxrSzEwOcYpMzB1BgNVHSMEbjBsgBRU1WEHDnP8Hr7ZulxrSzEwOcYpM6FJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAOUHvh4oho0tMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEASY/9SAOK57q9mGnNJJeyDbmyGrAHSJTod646xTHYkMvhUqwHyk9PTr5bdfmswpmyVn+AQ43U2tU5vnpTBmKpHWD2+HSHgGa92mMLrfBOd8EBZ329NL3N2HDPIaHr4NPGyhNrSK3QVOnAq2D0jlyrGYJlLli1NxHiBz7FCEJaVI8=</X509Certificate>
+      </X509Data>
+    </KeyInfo>
+  </Signature>
+</ApplicationRequest>

data/spec/signer_spec.rb

@@ -1,8 +1,8 @@
 require "spec_helper"
 
 describe Signer do
-  it "should digest and sign the XML" do
-    input_xml_file   = File.join(File.dirname(__FILE__), 'fixtures', 'input.xml')
+  it "should digest and sign SOAP XML with security node and binary token" do
+    input_xml_file   = File.join(File.dirname(__FILE__), 'fixtures', 'input_1.xml')
     cert_file        = File.join(File.dirname(__FILE__), 'fixtures', 'cert.pem')
     private_key_file = File.join(File.dirname(__FILE__), 'fixtures', 'key.pem')
 
@@ -18,12 +18,33 @@ describe Signer do
       signer.digest!(node)
     end
 
-    signer.sign!
+    signer.sign!(:security_token => true)
 
-    # File.open(File.join(File.dirname(__FILE__), 'fixtures', 'output.xml'), "w") do |f|
+    # File.open(File.join(File.dirname(__FILE__), 'fixtures', 'output_1.xml'), "w") do |f|
     #   f.write signer.document.to_s
     # end
-    output_xml_file = File.join(File.dirname(__FILE__), 'fixtures', 'output.xml')
+    output_xml_file = File.join(File.dirname(__FILE__), 'fixtures', 'output_1.xml')
+
+    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(:save_with => 0)
+  end
+
+  it "should sign simple XML" do
+    input_xml_file   = File.join(File.dirname(__FILE__), 'fixtures', 'input_2.xml')
+    cert_file        = File.join(File.dirname(__FILE__), 'fixtures', 'cert.pem')
+    private_key_file = File.join(File.dirname(__FILE__), 'fixtures', 'key.pem')
+
+    signer = Signer.new(File.read(input_xml_file))
+    signer.cert = OpenSSL::X509::Certificate.new(File.read(cert_file))
+    signer.private_key = OpenSSL::PKey::RSA.new(File.read(private_key_file), "test")
+    signer.security_node = signer.document.root
+    signer.security_token_id = ""
+    signer.digest!(signer.document, :id => "")
+    signer.sign!(:issuer_serial => true)
+
+    # File.open(File.join(File.dirname(__FILE__), 'fixtures', 'output_2.xml'), "w") do |f|
+    #   f.write signer.document.to_s
+    # end
+    output_xml_file = File.join(File.dirname(__FILE__), 'fixtures', 'output_2.xml')
 
     signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(:save_with => 0)
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: signer
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-05-03 00:00:00.000000000 Z
+date: 2012-06-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -71,9 +71,11 @@ files:
 - README.md
 - LICENSE
 - spec/fixtures/cert.pem
-- spec/fixtures/input.xml
+- spec/fixtures/input_1.xml
+- spec/fixtures/input_2.xml
 - spec/fixtures/key.pem
-- spec/fixtures/output.xml
+- spec/fixtures/output_1.xml
+- spec/fixtures/output_2.xml
 - spec/signer_spec.rb
 - spec/spec_helper.rb
 homepage: ''
@@ -96,15 +98,16 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.21
+rubygems_version: 1.8.24
 signing_key: 
 specification_version: 3
 summary: WS Security XML signer
 test_files:
 - spec/fixtures/cert.pem
-- spec/fixtures/input.xml
+- spec/fixtures/input_1.xml
+- spec/fixtures/input_2.xml
 - spec/fixtures/key.pem
-- spec/fixtures/output.xml
+- spec/fixtures/output_1.xml
+- spec/fixtures/output_2.xml
 - spec/signer_spec.rb
 - spec/spec_helper.rb
-has_rdoc: