signer 1.6.0 → 1.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 1ee493581c699bac6cedcc5dade885fe7901bebe
-  data.tar.gz: 3e2e76ecef50b8830f0c1b46cfe294734b747698
+SHA256:
+  metadata.gz: 7401c27eba7c1c1e0982f73d50841f4597ecc9f03dbcc8ee459812aa20bbb7ae
+  data.tar.gz: 614b4e14d376489299b3476b26838e71131604df13b5200ebf9fd8e4b712bdb1
 SHA512:
-  metadata.gz: 2bb34c6474b97a9729a9179343331b8c22ef8313b64160afa3a4079814a3e095a75c5f0456e86263550ba9c985dffefdbad18e542620479313bd81200d2a55d1
-  data.tar.gz: 503971e5792ea1cd9ccaba1e988c35693fbd4b3141ffe83564a2c9ccdc34f5c0f48f736fa89bf89dce7417b287b14e4b077ccda0d53d5c62dd8901dc9b3f9016
+  metadata.gz: 77e5d5dcdde818d0713b7d9bb859c8c7ed0c0f0aa90969b4d48c385463d0bf07aead94e1cd8844c7cc943023ceb0c2682ccf5fb31bfa9be92e69349011ba582c
+  data.tar.gz: 308cb0b72d15012366e26bfed84aef33b39126d6b5e1af466a919ae32bc58fec24cbc8651abee5cf61e3aabc096493d71a6ad5d68523916fc63c87d87b403644

data/CHANGELOG.md

@@ -1,3 +1,24 @@
+## 1.10.0 (2021-10-22)
+
+- Ensure compatibility with Nokogiri 1.12.4+ (#31, @flavorjones)
+- fix #26: add xml-exc-c14n Transform when :enveloped option is true. (#27, @kunxi)
+
+## 1.9.0 (2019-04-16)
+
+- Refactor digest!() method for better extensibility, add GOST-R 34.10/11-2012 algorithms, fix digest node ID reference, cleanup (#22, @netcitylife)
+
+## 1.8.0 (2018-11-14)
+
+- Add parameter to customize canonicalize algorithm (#19, @pistachiology)
+- Add references node type on digest (for xades-bes signing properties) (#19, @pistachiology)
+- change issuer x509 content to be more standard way (#19, @pistachiology)
+
+## 1.7.0 (2018-11-06)
+
+- Add wss option for XML only signing (#18, @pistachiology)
+- Add support for SHA512 Digest
+- Rename id for SHA256 Digest
+
 ## 1.6.0 (2017-09-14)
 
 - X509 in SecurityTokenReference node (#17, @tiagocasanovapt)

data/lib/signer/digester.rb

@@ -12,9 +12,15 @@ class Signer
     },
     # SHA 256
     sha256: {
-        name: 'SHA256',
-        id: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
-        digester: lambda { OpenSSL::Digest::SHA256.new },
+      name: 'SHA256',
+      id: 'http://www.w3.org/2001/04/xmlenc#sha256',
+      digester: lambda { OpenSSL::Digest::SHA256.new },
+    },
+    # SHA512
+    sha512: {
+      name: 'SHA512',
+      id: 'http://www.w3.org/2001/04/xmlenc#sha512',
+      digester: lambda { OpenSSL::Digest::SHA512.new },
     },
     # GOST R 34-11 94
     gostr3411: {
@@ -22,7 +28,13 @@ class Signer
       id: 'http://www.w3.org/2001/04/xmldsig-more#gostr3411',
       digester: lambda { OpenSSL::Digest.new('md_gost94') },
     },
-  }
+    # GOST R 34-11 2012 256 bit
+    gostr34112012_256: {
+      name: 'GOST R 34.11-2012 256',
+      id: 'urn:ietf:params:xml:ns:cpxmlsec:algorithms:gostr34112012-256',
+      digester: lambda { begin OpenSSL::Digest.new('streebog256') rescue OpenSSL::Digest.new('md_gost12_256') end },
+    },
+  }.freeze
 
   # Class that holds +OpenSSL::Digest+ instance with some meta information for digesting in XML.
   class Digester
@@ -63,7 +75,5 @@ class Signer
     def digest_id
       @digest_info[:id]
     end
-
   end
-
 end

data/lib/signer/version.rb

@@ -1,3 +1,3 @@
 class Signer
-  VERSION = '1.6.0'
+  VERSION = '1.10.0'
 end

data/lib/signer.rb

@@ -7,24 +7,89 @@ require "signer/digester"
 require "signer/version"
 
 class Signer
-  attr_accessor :document, :private_key, :signature_algorithm_id, :ds_namespace_prefix
+  attr_accessor :document, :private_key, :signature_algorithm_id, :ds_namespace_prefix, :wss
   attr_reader :cert
   attr_writer :security_node, :signature_node, :security_token_id
 
-  WSU_NAMESPACE = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd'
-  WSSE_NAMESPACE = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'
-  DS_NAMESPACE = 'http://www.w3.org/2000/09/xmldsig#'
-
-  def initialize(document, noblanks: true)
+  WSU_NAMESPACE = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd'.freeze
+  WSSE_NAMESPACE = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'.freeze
+  DS_NAMESPACE = 'http://www.w3.org/2000/09/xmldsig#'.freeze
+
+  SIGNATURE_ALGORITHM = {
+    # SHA 1
+    sha1: {
+      id: 'http://www.w3.org/2000/09/xmldsig#rsa-sha1',
+      name: 'SHA1'
+    },
+    # SHA 256
+    sha256: {
+      id: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
+      name: 'SHA256'
+    },
+    # SHA512
+    sha512: {
+      id: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512',
+      name: 'SHA512'
+    },
+    # GOST R 34-11 94
+    gostr3411: {
+      id: 'http://www.w3.org/2001/04/xmldsig-more#gostr34102001-gostr3411',
+      name: 'GOST R 34.11-94'
+    },
+    # GOST R 34-11 2012 256 bit
+    gostr34112012_256: {
+      id: 'urn:ietf:params:xml:ns:cpxmlsec:algorithms:gostr34102012-gostr34112012-256',
+      name: 'GOST R 34.11-2012 256',
+    },
+  }.freeze
+
+  CANONICALIZE_ALGORITHM = {
+    c14n_exec_1_0: {
+      name: 'c14n execlusive 1.0',
+      value: Nokogiri::XML::XML_C14N_EXCLUSIVE_1_0,
+      id: 'http://www.w3.org/2001/10/xml-exc-c14n#'
+    },
+    c14n_1_0: {
+      name: 'c14n 1.0',
+      value: Nokogiri::XML::XML_C14N_1_0,
+      id: 'http://www.w3.org/TR/2001/REC-xml-c14n-20010315'
+    },
+    c14n_1_1: {
+      name: 'c14n 1.1',
+      value: Nokogiri::XML::XML_C14N_1_1,
+      id: 'https://www.w3.org/TR/2008/REC-xml-c14n11-20080502/'
+    }
+  }.freeze
+
+  def initialize(document, noblanks: true, wss: true, canonicalize_algorithm: :c14n_exec_1_0)
     self.document = Nokogiri::XML(document.to_s) do |config|
       config.noblanks if noblanks
     end
+    self.document.namespace_inheritance = true if self.document.respond_to?(:namespace_inheritance)
     self.digest_algorithm = :sha1
-    self.set_default_signature_method!
+    self.wss = wss
+    self.canonicalize_algorithm = canonicalize_algorithm
+    self.signature_digest_algorithm = :sha1
   end
 
   def to_xml
-    document.to_xml(:save_with => 0)
+    document.to_xml(save_with: 0)
+  end
+
+  def canonicalize_name
+    @canonicalize_algorithm[:name]
+  end
+
+  def canonicalize_id
+    @canonicalize_algorithm[:id]
+  end
+
+  def canonicalize_algorithm
+    @canonicalize_algorithm[:value]
+  end
+
+  def canonicalize_algorithm=(algorithm)
+    @canonicalize_algorithm = CANONICALIZE_ALGORITHM[algorithm]
   end
 
   # Return symbol name for supported digest algorithms and string name for custom ones.
@@ -49,6 +114,7 @@ class Signer
   # Allows to change digesting algorithm for signature creation. Same as +digest_algorithm=+
   def signature_digest_algorithm=(algorithm)
     @sign_digester = Signer::Digester.new(algorithm)
+    self.signature_algorithm_id = SIGNATURE_ALGORITHM[algorithm][:id]
   end
 
   # Receives certificate for signing and tries to guess a digest algorithm for signature creation.
@@ -58,25 +124,21 @@ class Signer
     @cert = certificate
     # Try to guess a digest algorithm for signature creation
     case @cert.signature_algorithm
-      when 'GOST R 34.11-94 with GOST R 34.10-2001'
-        self.signature_digest_algorithm = :gostr3411
-        self.signature_algorithm_id = 'http://www.w3.org/2001/04/xmldsig-more#gostr34102001-gostr3411'
-      # Add clauses for other types of keys that require other digest algorithms and identifiers
-      else # most common 'sha1WithRSAEncryption' type included here
-        self.set_default_signature_method! # Reset any changes as they can become malformed
+    when 'GOST R 34.11-94 with GOST R 34.10-2001'
+      self.signature_digest_algorithm = :gostr3411
     end
   end
 
   def security_token_id
-    @security_token_id ||= "uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"
+    @security_token_id ||= wss? ? "uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1" : ""
   end
 
   def security_node
-    @security_node ||= document.xpath('//wsse:Security', wsse: WSSE_NAMESPACE).first
+    @security_node ||= wss? ? document.xpath('//wsse:Security', wsse: WSSE_NAMESPACE).first : ''
   end
 
-  def canonicalize(node = document, inclusive_namespaces=nil)
-    node.canonicalize(Nokogiri::XML::XML_C14N_EXCLUSIVE_1_0, inclusive_namespaces, nil) # The last argument should be exactly +nil+ to remove comments from result
+  def canonicalize(node = document, inclusive_namespaces=nil, algorithm: canonicalize_algorithm)
+    node.canonicalize(algorithm, inclusive_namespaces, nil)
   end
 
   # <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
@@ -104,7 +166,7 @@ class Signer
       signature_node.add_child(node)
       set_namespace_for_node(node, DS_NAMESPACE, ds_namespace_prefix)
       canonicalization_method_node = Nokogiri::XML::Node.new('CanonicalizationMethod', document)
-      canonicalization_method_node['Algorithm'] = 'http://www.w3.org/2001/10/xml-exc-c14n#'
+      canonicalization_method_node['Algorithm'] = canonicalize_id
       node.add_child(canonicalization_method_node)
       set_namespace_for_node(canonicalization_method_node, DS_NAMESPACE, ds_namespace_prefix)
       signature_method_node = Nokogiri::XML::Node.new('SignatureMethod', document)
@@ -127,6 +189,7 @@ class Signer
   #   </o:SecurityTokenReference>
   # </KeyInfo>
   def binary_security_token_node
+    return unless wss?
     node = document.at_xpath('wsse:BinarySecurityToken', wsse: WSSE_NAMESPACE)
     unless node
       node = Nokogiri::XML::Node.new('BinarySecurityToken', document)
@@ -163,7 +226,7 @@ class Signer
   # </KeyInfo>
   def x509_data_node(issuer_in_security_token = false)
     issuer_name_node   = Nokogiri::XML::Node.new('X509IssuerName', document)
-    issuer_name_node.content = cert.issuer.to_s[1..-1].gsub(/\//, ',')
+    issuer_name_node.content = cert.issuer.to_s(OpenSSL::X509::Name::RFC2253)
 
     issuer_number_node = Nokogiri::XML::Node.new('X509SerialNumber', document)
     issuer_number_node.content = cert.serial
@@ -173,7 +236,7 @@ class Signer
     issuer_serial_node.add_child(issuer_number_node)
 
     cetificate_node    = Nokogiri::XML::Node.new('X509Certificate', document)
-    cetificate_node.content = Base64.encode64(cert.to_der).gsub("\n", '')
+    cetificate_node.content = Base64.encode64(cert.to_der).delete("\n")
 
     data_node          = Nokogiri::XML::Node.new('X509Data', document)
     data_node.add_child(issuer_serial_node)
@@ -208,6 +271,8 @@ class Signer
   # * [+:id+]                   Id for the node, if you don't want to use automatically calculated one
   # * [+:inclusive_namespaces+] Array of namespace prefixes which definitions should be added to node during canonicalization
   # * [+:enveloped+]
+  # * [+:enveloped_legacy+]     add solely `enveloped-signature` in `Transforms` with :enveloped:.
+  # * [+:ref_type+]             add `Type` attribute to Reference node, if ref_type is not nil
   #
   # Example of XML that will be inserted in message for call like <tt>digest!(node, inclusive_namespaces: ['soap'])</tt>:
   #
@@ -222,42 +287,41 @@ class Signer
   #   </Reference>
 
   def digest!(target_node, options = {})
-    wsu_ns = namespace_prefix(target_node, WSU_NAMESPACE)
-    current_id = target_node["#{wsu_ns}:Id"]  if wsu_ns
-    id = options[:id] || current_id || "_#{Digest::SHA1.hexdigest(target_node.to_s)}"
-    if id.to_s.size > 0
-      wsu_ns ||= namespace_prefix(target_node, WSU_NAMESPACE, 'wsu')
-      target_node["#{wsu_ns}:Id"] = id.to_s
+    if wss?
+      wsu_ns = namespace_prefix(target_node, WSU_NAMESPACE)
+      current_id = target_node["#{wsu_ns}:Id"] if wsu_ns
+      id = options[:id] || current_id || "_#{Digest::SHA1.hexdigest(target_node.to_s)}"
+      unless id.to_s.empty?
+        wsu_ns ||= namespace_prefix(target_node, WSU_NAMESPACE, 'wsu')
+        target_node["#{wsu_ns}:Id"] = id.to_s
+      end
+    elsif target_node['Id'].nil?
+      id = options[:id] || "_#{Digest::SHA1.hexdigest(target_node.to_s)}"
+      target_node['Id'] = id.to_s unless id.empty?
+    else
+      id = options[:id] || target_node['Id']
     end
+
     target_canon = canonicalize(target_node, options[:inclusive_namespaces])
     target_digest = Base64.encode64(@digester.digest(target_canon)).strip
 
     reference_node = Nokogiri::XML::Node.new('Reference', document)
     reference_node['URI'] = id.to_s.size > 0 ? "##{id}" : ""
+    reference_node['Type'] = options[:ref_type] if options[:ref_type]
+
     signed_info_node.add_child(reference_node)
     set_namespace_for_node(reference_node, DS_NAMESPACE, ds_namespace_prefix)
 
     transforms_node = Nokogiri::XML::Node.new('Transforms', document)
-    reference_node.add_child(transforms_node)
+    reference_node.add_child(transforms_node) unless options[:no_transform]
     set_namespace_for_node(transforms_node, DS_NAMESPACE, ds_namespace_prefix)
 
-    transform_node = Nokogiri::XML::Node.new('Transform', document)
-    set_namespace_for_node(transform_node, DS_NAMESPACE, ds_namespace_prefix)
-    if options[:enveloped]
-      transform_node['Algorithm'] = 'http://www.w3.org/2000/09/xmldsig#enveloped-signature'
-    else
-      transform_node['Algorithm'] = 'http://www.w3.org/2001/10/xml-exc-c14n#'
-    end
-    if options[:inclusive_namespaces]
-      inclusive_namespaces_node = Nokogiri::XML::Node.new('ec:InclusiveNamespaces', document)
-      inclusive_namespaces_node.add_namespace_definition('ec', transform_node['Algorithm'])
-      inclusive_namespaces_node['PrefixList'] = options[:inclusive_namespaces].join(' ')
-      transform_node.add_child(inclusive_namespaces_node)
-    end
-    transforms_node.add_child(transform_node)
+    # create reference + transforms node
+    transform!(transforms_node, options)
 
     digest_method_node = Nokogiri::XML::Node.new('DigestMethod', document)
     digest_method_node['Algorithm'] = @digester.digest_id
+
     reference_node.add_child(digest_method_node)
     set_namespace_for_node(digest_method_node, DS_NAMESPACE, ds_namespace_prefix)
 
@@ -299,7 +363,7 @@ class Signer
     signed_info_canon = canonicalize(signed_info_node, options[:inclusive_namespaces])
 
     signature = private_key.sign(@sign_digester.digester, signed_info_canon)
-    signature_value_digest = Base64.encode64(signature).gsub("\n", '')
+    signature_value_digest = Base64.encode64(signature).delete("\n")
 
     signature_value_node = Nokogiri::XML::Node.new('SignatureValue', document)
     signature_value_node.content = signature_value_digest
@@ -310,10 +374,40 @@ class Signer
 
   protected
 
-  # Reset digest algorithm for signature creation and signature algorithm identifier
-  def set_default_signature_method!
-    self.signature_digest_algorithm = :sha1
-    self.signature_algorithm_id = 'http://www.w3.org/2000/09/xmldsig#rsa-sha1'
+  # Create transform nodes
+  def transform_node(algorithm, options)
+    transform_node = Nokogiri::XML::Node.new('Transform', document)
+    set_namespace_for_node(transform_node, DS_NAMESPACE, ds_namespace_prefix)
+    transform_node['Algorithm'] = algorithm
+
+    if options[:inclusive_namespaces]
+      inclusive_namespaces_node = Nokogiri::XML::Node.new('ec:InclusiveNamespaces', document)
+      inclusive_namespaces_node.add_namespace_definition('ec', transform_node['Algorithm'])
+      inclusive_namespaces_node['PrefixList'] = options[:inclusive_namespaces].join(' ')
+      transform_node.add_child(inclusive_namespaces_node)
+    end
+
+    transform_node
+  end
+
+  def transform!(transforms_node, options)
+    # With PR-26, a new flag :enveloped_legacy is introduced for backward compatibility, the logics are:
+    # - :enveloped is false, include xml-exc-c14n
+    # - :enveloped is true, include xml-exc-c14n and enveloped-signature
+    # - :enveloped is true and :enveloped_legacy is true, include enveloped-signature.
+
+    if options[:enveloped] && options[:enveloped_legacy]
+      transforms_node.add_child(transform_node('http://www.w3.org/2000/09/xmldsig#enveloped-signature', options))
+      return
+    end
+
+    transforms_node.add_child(transform_node('http://www.w3.org/2001/10/xml-exc-c14n#', options))
+    transforms_node.add_child(transform_node('http://www.w3.org/2000/09/xmldsig#enveloped-signature', options)) if options[:enveloped]
+  end
+
+  # Check are we using ws security?
+  def wss?
+    wss
   end
 
   ##

data/spec/fixtures/output_1_sha256.xml

@@ -1,2 +1,2 @@
 <?xml version="1.0"?>
-<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:wsurandom="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><s:Header><a:Action s:mustUnderstand="1">http://tempuri.org/IDocumentService/SearchDocuments</a:Action><a:MessageID>urn:uuid:30db5d4f-ab84-46be-907c-be690a92979b</a:MessageID><a:ReplyTo><a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address></a:ReplyTo><To xmlns="http://www.w3.org/2005/08/addressing" xmlns:a="http://www.w3.org/2003/05/soap-envelope" a:mustUnderstand="1">http://tempuri.org/PublicServices/Test/1.0.12/PublicServices/DocumentService.svc</To><wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" s:mustUnderstand="1"><wsurandom:Timestamp><wsurandom:Created>2012-05-02T18:17:14.467Z</wsurandom:Created><wsurandom:Expires>2012-05-02T18:22:14.467Z</wsurandom:Expires></wsurandom:Timestamp><wsse:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" wsurandom:Id="uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1">MIICsDCCAhmgAwIBAgIJAOUHvh4oho0tMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTIwNTAzMTMxODIyWhcNMTMwNTAzMTMxODIyWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvK5hMPv/R5IFmwWyJOyEaFUrF/ZsmN+Gip8hvR6rLP3YPNx9iFYvPcZllFmuVwyaz7YT2N5BsqTwLdyi5v4HY4fUtuz0p8jIPoSd6dfDvcnSpf4QLTOgOaL3ciPEbgDHH2tnIksukoWzqCYva+qFZ74NFl19swXotW9fA4Jzs4QIDAQABo4GnMIGkMB0GA1UdDgQWBBRU1WEHDnP8Hr7ZulxrSzEwOcYpMzB1BgNVHSMEbjBsgBRU1WEHDnP8Hr7ZulxrSzEwOcYpM6FJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAOUHvh4oho0tMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEASY/9SAOK57q9mGnNJJeyDbmyGrAHSJTod646xTHYkMvhUqwHyk9PTr5bdfmswpmyVn+AQ43U2tU5vnpTBmKpHWD2+HSHgGa92mMLrfBOd8EBZ329NL3N2HDPIaHr4NPGyhNrSK3QVOnAq2D0jlyrGYJlLli1NxHiBz7FCEJaVI8=</wsse:BinarySecurityToken><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><Reference URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><DigestValue>2ca0eR2o1+y/CovNwnle3yEK1wI+ztlKQfCqcGvoSAA=</DigestValue></Reference></SignedInfo><SignatureValue>ml/HJ0ouBwAag9Kr4yTyrc4RrHc3sspx2YbQHPiTxB3QOT+T2kM5wU+gnHVIk5VOYVR9FIvm/bb6RWnLyW78/7eN6eIoh+Zr1YsEavCHw3AR9Zf4d7S+9ugCrPmrrEO1lOiyEHU0HuWS5gqua+/ttuTPtV24fGeWvxl15SIxFa8=</SignatureValue><KeyInfo><wsse:SecurityTokenReference><wsse:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"/></wsse:SecurityTokenReference></KeyInfo></Signature></wsse:Security></s:Header><s:Body><SearchDocuments xmlns="http://tempuri.org/"><searchCriteria xmlns:b="http://schemas.datacontract.org/2004/07/BusinessLogic.Data.Documents.Integration" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><b:RegistrationNo>1</b:RegistrationNo></searchCriteria></SearchDocuments></s:Body></s:Envelope>
+<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:wsurandom="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><s:Header><a:Action s:mustUnderstand="1">http://tempuri.org/IDocumentService/SearchDocuments</a:Action><a:MessageID>urn:uuid:30db5d4f-ab84-46be-907c-be690a92979b</a:MessageID><a:ReplyTo><a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address></a:ReplyTo><To xmlns="http://www.w3.org/2005/08/addressing" xmlns:a="http://www.w3.org/2003/05/soap-envelope" a:mustUnderstand="1">http://tempuri.org/PublicServices/Test/1.0.12/PublicServices/DocumentService.svc</To><wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" s:mustUnderstand="1"><wsurandom:Timestamp><wsurandom:Created>2012-05-02T18:17:14.467Z</wsurandom:Created><wsurandom:Expires>2012-05-02T18:22:14.467Z</wsurandom:Expires></wsurandom:Timestamp><wsse:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" wsurandom:Id="uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1">MIICsDCCAhmgAwIBAgIJAOUHvh4oho0tMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTIwNTAzMTMxODIyWhcNMTMwNTAzMTMxODIyWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvK5hMPv/R5IFmwWyJOyEaFUrF/ZsmN+Gip8hvR6rLP3YPNx9iFYvPcZllFmuVwyaz7YT2N5BsqTwLdyi5v4HY4fUtuz0p8jIPoSd6dfDvcnSpf4QLTOgOaL3ciPEbgDHH2tnIksukoWzqCYva+qFZ74NFl19swXotW9fA4Jzs4QIDAQABo4GnMIGkMB0GA1UdDgQWBBRU1WEHDnP8Hr7ZulxrSzEwOcYpMzB1BgNVHSMEbjBsgBRU1WEHDnP8Hr7ZulxrSzEwOcYpM6FJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAOUHvh4oho0tMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEASY/9SAOK57q9mGnNJJeyDbmyGrAHSJTod646xTHYkMvhUqwHyk9PTr5bdfmswpmyVn+AQ43U2tU5vnpTBmKpHWD2+HSHgGa92mMLrfBOd8EBZ329NL3N2HDPIaHr4NPGyhNrSK3QVOnAq2D0jlyrGYJlLli1NxHiBz7FCEJaVI8=</wsse:BinarySecurityToken><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><Reference URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>2ca0eR2o1+y/CovNwnle3yEK1wI+ztlKQfCqcGvoSAA=</DigestValue></Reference></SignedInfo><SignatureValue>PoUuYfxElOzG8Dw8/zdDrgPXxbFpj+Gxz4Fi7KDJ0XUgUNcQ6/Tk871cwdFA641Pkqo2DvyD2RIylXEuaY57abDQ4JTB86KCqrdt1cgAecn/lqfoojdTflrq+ugc1JGm6UZFQRcHrW4m2wjQgWFFAPFwNnRVdNGTRf5SHtmbMvc=</SignatureValue><KeyInfo><wsse:SecurityTokenReference><wsse:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"/></wsse:SecurityTokenReference></KeyInfo></Signature></wsse:Security></s:Header><s:Body><SearchDocuments xmlns="http://tempuri.org/"><searchCriteria xmlns:b="http://schemas.datacontract.org/2004/07/BusinessLogic.Data.Documents.Integration" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><b:RegistrationNo>1</b:RegistrationNo></searchCriteria></SearchDocuments></s:Body></s:Envelope>

data/spec/fixtures/output_2.xml

@@ -11,17 +11,18 @@
       <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
       <Reference URI="">
         <Transforms>
+          <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
           <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
         </Transforms>
         <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
         <DigestValue>U9tsT4lrRMp8ZdKMnblgeMCGfvI=</DigestValue>
       </Reference>
     </SignedInfo>
-    <SignatureValue>HpRIiW6/yGyAI0AwVaaGp3PltD3JOCFfxZLVt+kQD05u1tz9EA91/5CbvCNfn1ljoObMSGe3+W9gXFZewCXANu5VXMnt+FeZ42QYNuYj2oUCFaWlg3NcThWnehE1W/R+QPLJVgk4RxpSntNLK0WWtFy79JbAh0NO4CcD84/HEo8=</SignatureValue>
+    <SignatureValue>pjz9q0RI02SGuFs3ok+qQjKKyibAG+dScZBIxmWebD4JmfjIMOCTvk7RR1S5ZqJqkDp2kMV4DOBg+AqJAEu9ZO6gBBceCfYHYgmdvKWz3Ex42fyRYjfZlnR/7Vxk94VJ806J/H+7n2TBJlSndkMGJ2X8agKq1Zto0ip/k2qDfm4=</SignatureValue>
     <KeyInfo>
       <X509Data>
         <X509IssuerSerial>
-          <X509IssuerName>C=AU,ST=Some-State,O=Internet Widgits Pty Ltd</X509IssuerName>
+          <X509IssuerName>O=Internet Widgits Pty Ltd,ST=Some-State,C=AU</X509IssuerName>
           <X509SerialNumber>16503368396260674861</X509SerialNumber>
         </X509IssuerSerial>
         <X509Certificate>MIICsDCCAhmgAwIBAgIJAOUHvh4oho0tMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTIwNTAzMTMxODIyWhcNMTMwNTAzMTMxODIyWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvK5hMPv/R5IFmwWyJOyEaFUrF/ZsmN+Gip8hvR6rLP3YPNx9iFYvPcZllFmuVwyaz7YT2N5BsqTwLdyi5v4HY4fUtuz0p8jIPoSd6dfDvcnSpf4QLTOgOaL3ciPEbgDHH2tnIksukoWzqCYva+qFZ74NFl19swXotW9fA4Jzs4QIDAQABo4GnMIGkMB0GA1UdDgQWBBRU1WEHDnP8Hr7ZulxrSzEwOcYpMzB1BgNVHSMEbjBsgBRU1WEHDnP8Hr7ZulxrSzEwOcYpM6FJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAOUHvh4oho0tMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEASY/9SAOK57q9mGnNJJeyDbmyGrAHSJTod646xTHYkMvhUqwHyk9PTr5bdfmswpmyVn+AQ43U2tU5vnpTBmKpHWD2+HSHgGa92mMLrfBOd8EBZ329NL3N2HDPIaHr4NPGyhNrSK3QVOnAq2D0jlyrGYJlLli1NxHiBz7FCEJaVI8=</X509Certificate>

data/spec/fixtures/output_2_legacy.xml

@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+<ApplicationRequest xmlns="http://bxd.fi/xmldata/">
+  <CustomerId>679155330</CustomerId>
+  <Command>GetUserInfo</Command>
+  <Timestamp>2010-05-10T13:22:19.847+03:00</Timestamp>
+  <Environment>PRODUCTION</Environment>
+  <SoftwareId>Petri</SoftwareId>
+  <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
+    <SignedInfo>
+      <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+      <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+      <Reference URI="">
+        <Transforms>
+          <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+        </Transforms>
+        <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+        <DigestValue>U9tsT4lrRMp8ZdKMnblgeMCGfvI=</DigestValue>
+      </Reference>
+    </SignedInfo>
+    <SignatureValue>HpRIiW6/yGyAI0AwVaaGp3PltD3JOCFfxZLVt+kQD05u1tz9EA91/5CbvCNfn1ljoObMSGe3+W9gXFZewCXANu5VXMnt+FeZ42QYNuYj2oUCFaWlg3NcThWnehE1W/R+QPLJVgk4RxpSntNLK0WWtFy79JbAh0NO4CcD84/HEo8=</SignatureValue>
+    <KeyInfo>
+      <X509Data>
+        <X509IssuerSerial>
+          <X509IssuerName>O=Internet Widgits Pty Ltd,ST=Some-State,C=AU</X509IssuerName>
+          <X509SerialNumber>16503368396260674861</X509SerialNumber>
+        </X509IssuerSerial>
+        <X509Certificate>MIICsDCCAhmgAwIBAgIJAOUHvh4oho0tMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTIwNTAzMTMxODIyWhcNMTMwNTAzMTMxODIyWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvK5hMPv/R5IFmwWyJOyEaFUrF/ZsmN+Gip8hvR6rLP3YPNx9iFYvPcZllFmuVwyaz7YT2N5BsqTwLdyi5v4HY4fUtuz0p8jIPoSd6dfDvcnSpf4QLTOgOaL3ciPEbgDHH2tnIksukoWzqCYva+qFZ74NFl19swXotW9fA4Jzs4QIDAQABo4GnMIGkMB0GA1UdDgQWBBRU1WEHDnP8Hr7ZulxrSzEwOcYpMzB1BgNVHSMEbjBsgBRU1WEHDnP8Hr7ZulxrSzEwOcYpM6FJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAOUHvh4oho0tMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEASY/9SAOK57q9mGnNJJeyDbmyGrAHSJTod646xTHYkMvhUqwHyk9PTr5bdfmswpmyVn+AQ43U2tU5vnpTBmKpHWD2+HSHgGa92mMLrfBOd8EBZ329NL3N2HDPIaHr4NPGyhNrSK3QVOnAq2D0jlyrGYJlLli1NxHiBz7FCEJaVI8=</X509Certificate>
+      </X509Data>
+    </KeyInfo>
+  </Signature>
+</ApplicationRequest>

data/spec/fixtures/output_2_with_ds_prefix.xml

@@ -1,31 +1,32 @@
 <?xml version="1.0"?>
 <ApplicationRequest xmlns="http://bxd.fi/xmldata/">
-  <CustomerId>679155330</CustomerId>
-  <Command>GetUserInfo</Command>
-  <Timestamp>2010-05-10T13:22:19.847+03:00</Timestamp>
-  <Environment>PRODUCTION</Environment>
-  <SoftwareId>Petri</SoftwareId>
-  <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
-    <ds:SignedInfo>
-      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
-      <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
-      <ds:Reference URI="">
-        <ds:Transforms>
-          <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
-        </ds:Transforms>
-        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
-        <ds:DigestValue>U9tsT4lrRMp8ZdKMnblgeMCGfvI=</ds:DigestValue>
-      </ds:Reference>
-    </ds:SignedInfo>
-    <ds:SignatureValue>rOCe8McbIFa4Ul3pnzd/dBjFWoT4JtSghJgzZGLrz17K/j0W1JyaopcZeMD+8M5/GplAlQrJg3ZSkQvY9Sf7WpqZeLYHW17J0ZJpwas+/OOXUEdyUiec7q9OgWsFLH9DBNuJdLKE3CO6w/8tTKQ/kidYnPBXT6FKioNlSJVZsuI=</ds:SignatureValue>
-    <ds:KeyInfo>
-      <ds:X509Data>
-        <ds:X509IssuerSerial>
-          <ds:X509IssuerName>C=AU,ST=Some-State,O=Internet Widgits Pty Ltd</ds:X509IssuerName>
-          <ds:X509SerialNumber>16503368396260674861</ds:X509SerialNumber>
-        </ds:X509IssuerSerial>
-        <ds:X509Certificate>MIICsDCCAhmgAwIBAgIJAOUHvh4oho0tMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTIwNTAzMTMxODIyWhcNMTMwNTAzMTMxODIyWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvK5hMPv/R5IFmwWyJOyEaFUrF/ZsmN+Gip8hvR6rLP3YPNx9iFYvPcZllFmuVwyaz7YT2N5BsqTwLdyi5v4HY4fUtuz0p8jIPoSd6dfDvcnSpf4QLTOgOaL3ciPEbgDHH2tnIksukoWzqCYva+qFZ74NFl19swXotW9fA4Jzs4QIDAQABo4GnMIGkMB0GA1UdDgQWBBRU1WEHDnP8Hr7ZulxrSzEwOcYpMzB1BgNVHSMEbjBsgBRU1WEHDnP8Hr7ZulxrSzEwOcYpM6FJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAOUHvh4oho0tMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEASY/9SAOK57q9mGnNJJeyDbmyGrAHSJTod646xTHYkMvhUqwHyk9PTr5bdfmswpmyVn+AQ43U2tU5vnpTBmKpHWD2+HSHgGa92mMLrfBOd8EBZ329NL3N2HDPIaHr4NPGyhNrSK3QVOnAq2D0jlyrGYJlLli1NxHiBz7FCEJaVI8=</ds:X509Certificate>
-      </ds:X509Data>
-    </ds:KeyInfo>
-  </ds:Signature>
+    <CustomerId>679155330</CustomerId>
+    <Command>GetUserInfo</Command>
+    <Timestamp>2010-05-10T13:22:19.847+03:00</Timestamp>
+    <Environment>PRODUCTION</Environment>
+    <SoftwareId>Petri</SoftwareId>
+    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+        <ds:SignedInfo>
+            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+            <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+            <ds:Reference URI="">
+                <ds:Transforms>
+                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+                </ds:Transforms>
+                <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+                <ds:DigestValue>U9tsT4lrRMp8ZdKMnblgeMCGfvI=</ds:DigestValue>
+            </ds:Reference>
+        </ds:SignedInfo>
+        <ds:SignatureValue>oh0PAqWsOY+QROz2ks9rJ6wqD8756qC+Gg2uj9lfR75khHS9LBY0jidThh18iynkflluqD1/gA98Hze8raYjmXdw09X7z+kYkxRB/QBY6YkqsWdxSDMhuW63XynrI372bv5p4fC0YjS1lix195qFbk2i0h5LcTByimquzkwEMUk=</ds:SignatureValue>
+        <ds:KeyInfo>
+            <ds:X509Data>
+                <ds:X509IssuerSerial>
+                    <ds:X509IssuerName>O=Internet Widgits Pty Ltd,ST=Some-State,C=AU</ds:X509IssuerName>
+                    <ds:X509SerialNumber>16503368396260674861</ds:X509SerialNumber>
+                </ds:X509IssuerSerial>
+                <ds:X509Certificate>MIICsDCCAhmgAwIBAgIJAOUHvh4oho0tMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTIwNTAzMTMxODIyWhcNMTMwNTAzMTMxODIyWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvK5hMPv/R5IFmwWyJOyEaFUrF/ZsmN+Gip8hvR6rLP3YPNx9iFYvPcZllFmuVwyaz7YT2N5BsqTwLdyi5v4HY4fUtuz0p8jIPoSd6dfDvcnSpf4QLTOgOaL3ciPEbgDHH2tnIksukoWzqCYva+qFZ74NFl19swXotW9fA4Jzs4QIDAQABo4GnMIGkMB0GA1UdDgQWBBRU1WEHDnP8Hr7ZulxrSzEwOcYpMzB1BgNVHSMEbjBsgBRU1WEHDnP8Hr7ZulxrSzEwOcYpM6FJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAOUHvh4oho0tMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEASY/9SAOK57q9mGnNJJeyDbmyGrAHSJTod646xTHYkMvhUqwHyk9PTr5bdfmswpmyVn+AQ43U2tU5vnpTBmKpHWD2+HSHgGa92mMLrfBOd8EBZ329NL3N2HDPIaHr4NPGyhNrSK3QVOnAq2D0jlyrGYJlLli1NxHiBz7FCEJaVI8=</ds:X509Certificate>
+            </ds:X509Data>
+        </ds:KeyInfo>
+    </ds:Signature>
 </ApplicationRequest>

data/spec/fixtures/output_2_with_ds_prefix_and_wss_disabled.xml

@@ -0,0 +1,40 @@
+<?xml version="1.0"?>
+<ApplicationRequest xmlns="http://bxd.fi/xmldata/">
+    <CustomerId Id="_8ea8b0fa3fe774fc4942779a3e53620e6d389667">679155330</CustomerId>
+    <Command>GetUserInfo</Command>
+    <Timestamp>2010-05-10T13:22:19.847+03:00</Timestamp>
+    <Environment>PRODUCTION</Environment>
+    <SoftwareId>Petri</SoftwareId>
+    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+        <ds:SignedInfo>
+            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+            <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+            <ds:Reference URI="#_8ea8b0fa3fe774fc4942779a3e53620e6d389667">
+                <ds:Transforms>
+                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+                </ds:Transforms>
+                <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+                <ds:DigestValue>AttQv5nkiNZFLKlFfVfX5+JYmSA=</ds:DigestValue>
+            </ds:Reference>
+            <ds:Reference URI="">
+                <ds:Transforms>
+                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+                </ds:Transforms>
+                <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+                <ds:DigestValue>gZjyHqoTlsz5D1JQJEFNvSmtwjk=</ds:DigestValue>
+            </ds:Reference>
+        </ds:SignedInfo>
+        <ds:SignatureValue>Vhsr3WaCPA0dDB6THouzG9/EA0xfhzHzfbyCn1PY8+Y9MMsLpiW0KHOWtAiWLULDN2mFvTFDr90kCZR6YzgdaztbQewiZHeeu7M0WEC5f8VCgfO0N8J7mzOCWHBELHtDzoN+9phTbqDqbX06TH0mszIpZhnsGa4d+Ko3Y+AA3cs=</ds:SignatureValue>
+        <ds:KeyInfo>
+            <ds:X509Data>
+                <ds:X509IssuerSerial>
+                    <ds:X509IssuerName>O=Internet Widgits Pty Ltd,ST=Some-State,C=AU</ds:X509IssuerName>
+                    <ds:X509SerialNumber>16503368396260674861</ds:X509SerialNumber>
+                </ds:X509IssuerSerial>
+                <ds:X509Certificate>MIICsDCCAhmgAwIBAgIJAOUHvh4oho0tMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTIwNTAzMTMxODIyWhcNMTMwNTAzMTMxODIyWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvK5hMPv/R5IFmwWyJOyEaFUrF/ZsmN+Gip8hvR6rLP3YPNx9iFYvPcZllFmuVwyaz7YT2N5BsqTwLdyi5v4HY4fUtuz0p8jIPoSd6dfDvcnSpf4QLTOgOaL3ciPEbgDHH2tnIksukoWzqCYva+qFZ74NFl19swXotW9fA4Jzs4QIDAQABo4GnMIGkMB0GA1UdDgQWBBRU1WEHDnP8Hr7ZulxrSzEwOcYpMzB1BgNVHSMEbjBsgBRU1WEHDnP8Hr7ZulxrSzEwOcYpM6FJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAOUHvh4oho0tMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEASY/9SAOK57q9mGnNJJeyDbmyGrAHSJTod646xTHYkMvhUqwHyk9PTr5bdfmswpmyVn+AQ43U2tU5vnpTBmKpHWD2+HSHgGa92mMLrfBOd8EBZ329NL3N2HDPIaHr4NPGyhNrSK3QVOnAq2D0jlyrGYJlLli1NxHiBz7FCEJaVI8=</ds:X509Certificate>
+            </ds:X509Data>
+        </ds:KeyInfo>
+    </ds:Signature>
+</ApplicationRequest>

data/spec/fixtures/output_2_with_ds_prefix_and_wss_disabled_legacy.xml

@@ -0,0 +1,38 @@
+<?xml version="1.0"?>
+<ApplicationRequest xmlns="http://bxd.fi/xmldata/">
+  <CustomerId Id="_8ea8b0fa3fe774fc4942779a3e53620e6d389667">679155330</CustomerId>
+  <Command>GetUserInfo</Command>
+  <Timestamp>2010-05-10T13:22:19.847+03:00</Timestamp>
+  <Environment>PRODUCTION</Environment>
+  <SoftwareId>Petri</SoftwareId>
+  <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+    <ds:SignedInfo>
+      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+      <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+      <ds:Reference URI="#_8ea8b0fa3fe774fc4942779a3e53620e6d389667">
+        <ds:Transforms>
+          <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+        </ds:Transforms>
+        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+        <ds:DigestValue>AttQv5nkiNZFLKlFfVfX5+JYmSA=</ds:DigestValue>
+      </ds:Reference>
+      <ds:Reference URI="">
+        <ds:Transforms>
+          <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+        </ds:Transforms>
+        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+        <ds:DigestValue>9Z9YtwWWlyGnFB36gxXj+mGcv14=</ds:DigestValue>
+      </ds:Reference>
+    </ds:SignedInfo>
+    <ds:SignatureValue>YwPuF4il34qUeAhIfzsLy/oKr4gxB9hlCYqEhVo8nYsrnDJKtBMznvkmi89TuKJ4FIibWnjsMqDDC74rpkcoUVs9O4pE/zLQxdRnQeRWPZjZnwEsmbBirFK+uk+Q7aVMUTRxxQwjZQRfBain4YdatqKDYCq/VkX4muAzxtHBYN4=</ds:SignatureValue>
+    <ds:KeyInfo>
+      <ds:X509Data>
+        <ds:X509IssuerSerial>
+          <ds:X509IssuerName>O=Internet Widgits Pty Ltd,ST=Some-State,C=AU</ds:X509IssuerName>
+          <ds:X509SerialNumber>16503368396260674861</ds:X509SerialNumber>
+        </ds:X509IssuerSerial>
+        <ds:X509Certificate>MIICsDCCAhmgAwIBAgIJAOUHvh4oho0tMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTIwNTAzMTMxODIyWhcNMTMwNTAzMTMxODIyWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvK5hMPv/R5IFmwWyJOyEaFUrF/ZsmN+Gip8hvR6rLP3YPNx9iFYvPcZllFmuVwyaz7YT2N5BsqTwLdyi5v4HY4fUtuz0p8jIPoSd6dfDvcnSpf4QLTOgOaL3ciPEbgDHH2tnIksukoWzqCYva+qFZ74NFl19swXotW9fA4Jzs4QIDAQABo4GnMIGkMB0GA1UdDgQWBBRU1WEHDnP8Hr7ZulxrSzEwOcYpMzB1BgNVHSMEbjBsgBRU1WEHDnP8Hr7ZulxrSzEwOcYpM6FJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAOUHvh4oho0tMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEASY/9SAOK57q9mGnNJJeyDbmyGrAHSJTod646xTHYkMvhUqwHyk9PTr5bdfmswpmyVn+AQ43U2tU5vnpTBmKpHWD2+HSHgGa92mMLrfBOd8EBZ329NL3N2HDPIaHr4NPGyhNrSK3QVOnAq2D0jlyrGYJlLli1NxHiBz7FCEJaVI8=</ds:X509Certificate>
+      </ds:X509Data>
+    </ds:KeyInfo>
+  </ds:Signature>
+</ApplicationRequest>

data/spec/fixtures/output_2_with_ds_prefix_legacy.xml

@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+<ApplicationRequest xmlns="http://bxd.fi/xmldata/">
+  <CustomerId>679155330</CustomerId>
+  <Command>GetUserInfo</Command>
+  <Timestamp>2010-05-10T13:22:19.847+03:00</Timestamp>
+  <Environment>PRODUCTION</Environment>
+  <SoftwareId>Petri</SoftwareId>
+  <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+    <ds:SignedInfo>
+      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+      <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+      <ds:Reference URI="">
+        <ds:Transforms>
+          <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+        </ds:Transforms>
+        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+        <ds:DigestValue>U9tsT4lrRMp8ZdKMnblgeMCGfvI=</ds:DigestValue>
+      </ds:Reference>
+    </ds:SignedInfo>
+    <ds:SignatureValue>rOCe8McbIFa4Ul3pnzd/dBjFWoT4JtSghJgzZGLrz17K/j0W1JyaopcZeMD+8M5/GplAlQrJg3ZSkQvY9Sf7WpqZeLYHW17J0ZJpwas+/OOXUEdyUiec7q9OgWsFLH9DBNuJdLKE3CO6w/8tTKQ/kidYnPBXT6FKioNlSJVZsuI=</ds:SignatureValue>
+    <ds:KeyInfo>
+      <ds:X509Data>
+        <ds:X509IssuerSerial>
+          <ds:X509IssuerName>O=Internet Widgits Pty Ltd,ST=Some-State,C=AU</ds:X509IssuerName>
+          <ds:X509SerialNumber>16503368396260674861</ds:X509SerialNumber>
+        </ds:X509IssuerSerial>
+        <ds:X509Certificate>MIICsDCCAhmgAwIBAgIJAOUHvh4oho0tMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTIwNTAzMTMxODIyWhcNMTMwNTAzMTMxODIyWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvK5hMPv/R5IFmwWyJOyEaFUrF/ZsmN+Gip8hvR6rLP3YPNx9iFYvPcZllFmuVwyaz7YT2N5BsqTwLdyi5v4HY4fUtuz0p8jIPoSd6dfDvcnSpf4QLTOgOaL3ciPEbgDHH2tnIksukoWzqCYva+qFZ74NFl19swXotW9fA4Jzs4QIDAQABo4GnMIGkMB0GA1UdDgQWBBRU1WEHDnP8Hr7ZulxrSzEwOcYpMzB1BgNVHSMEbjBsgBRU1WEHDnP8Hr7ZulxrSzEwOcYpM6FJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAOUHvh4oho0tMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEASY/9SAOK57q9mGnNJJeyDbmyGrAHSJTod646xTHYkMvhUqwHyk9PTr5bdfmswpmyVn+AQ43U2tU5vnpTBmKpHWD2+HSHgGa92mMLrfBOd8EBZ329NL3N2HDPIaHr4NPGyhNrSK3QVOnAq2D0jlyrGYJlLli1NxHiBz7FCEJaVI8=</ds:X509Certificate>
+      </ds:X509Data>
+    </ds:KeyInfo>
+  </ds:Signature>
+</ApplicationRequest>

data/spec/fixtures/output_5_with_security_token.xml

@@ -21,7 +21,7 @@
           <wsse:SecurityTokenReference>
             <ds:X509Data>
               <ds:X509IssuerSerial>
-                <ds:X509IssuerName>C=AU,ST=Some-State,O=Internet Widgits Pty Ltd</ds:X509IssuerName>
+                <ds:X509IssuerName>O=Internet Widgits Pty Ltd,ST=Some-State,C=AU</ds:X509IssuerName>
                 <ds:X509SerialNumber>16503368396260674861</ds:X509SerialNumber>
               </ds:X509IssuerSerial>
               <ds:X509Certificate>MIICsDCCAhmgAwIBAgIJAOUHvh4oho0tMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTIwNTAzMTMxODIyWhcNMTMwNTAzMTMxODIyWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvK5hMPv/R5IFmwWyJOyEaFUrF/ZsmN+Gip8hvR6rLP3YPNx9iFYvPcZllFmuVwyaz7YT2N5BsqTwLdyi5v4HY4fUtuz0p8jIPoSd6dfDvcnSpf4QLTOgOaL3ciPEbgDHH2tnIksukoWzqCYva+qFZ74NFl19swXotW9fA4Jzs4QIDAQABo4GnMIGkMB0GA1UdDgQWBBRU1WEHDnP8Hr7ZulxrSzEwOcYpMzB1BgNVHSMEbjBsgBRU1WEHDnP8Hr7ZulxrSzEwOcYpM6FJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAOUHvh4oho0tMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEASY/9SAOK57q9mGnNJJeyDbmyGrAHSJTod646xTHYkMvhUqwHyk9PTr5bdfmswpmyVn+AQ43U2tU5vnpTBmKpHWD2+HSHgGa92mMLrfBOd8EBZ329NL3N2HDPIaHr4NPGyhNrSK3QVOnAq2D0jlyrGYJlLli1NxHiBz7FCEJaVI8=</ds:X509Certificate>

data/spec/fixtures/output_5_with_x509_data.xml

@@ -20,7 +20,7 @@
         <ds:KeyInfo>
           <ds:X509Data>
             <ds:X509IssuerSerial>
-              <ds:X509IssuerName>C=AU,ST=Some-State,O=Internet Widgits Pty Ltd</ds:X509IssuerName>
+              <ds:X509IssuerName>O=Internet Widgits Pty Ltd,ST=Some-State,C=AU</ds:X509IssuerName>
               <ds:X509SerialNumber>16503368396260674861</ds:X509SerialNumber>
             </ds:X509IssuerSerial>
             <ds:X509Certificate>MIICsDCCAhmgAwIBAgIJAOUHvh4oho0tMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTIwNTAzMTMxODIyWhcNMTMwNTAzMTMxODIyWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvK5hMPv/R5IFmwWyJOyEaFUrF/ZsmN+Gip8hvR6rLP3YPNx9iFYvPcZllFmuVwyaz7YT2N5BsqTwLdyi5v4HY4fUtuz0p8jIPoSd6dfDvcnSpf4QLTOgOaL3ciPEbgDHH2tnIksukoWzqCYva+qFZ74NFl19swXotW9fA4Jzs4QIDAQABo4GnMIGkMB0GA1UdDgQWBBRU1WEHDnP8Hr7ZulxrSzEwOcYpMzB1BgNVHSMEbjBsgBRU1WEHDnP8Hr7ZulxrSzEwOcYpM6FJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAOUHvh4oho0tMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEASY/9SAOK57q9mGnNJJeyDbmyGrAHSJTod646xTHYkMvhUqwHyk9PTr5bdfmswpmyVn+AQ43U2tU5vnpTBmKpHWD2+HSHgGa92mMLrfBOd8EBZ329NL3N2HDPIaHr4NPGyhNrSK3QVOnAq2D0jlyrGYJlLli1NxHiBz7FCEJaVI8=</ds:X509Certificate>

data/spec/signer_spec.rb

@@ -27,7 +27,7 @@ describe Signer do
     # end
     output_xml_file = File.join(File.dirname(__FILE__), 'fixtures', 'output_1.xml')
 
-    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(:save_with => 0)
+    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(save_with: 0)
   end
 
   it "should correctly canonicalize digested nodes (shouldn't account comments)" do
@@ -44,7 +44,7 @@ describe Signer do
 
     output_xml_file = File.join(File.dirname(__FILE__), 'fixtures', 'output_3_c14n_comments.xml')
 
-    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(:save_with => 0)
+    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(save_with: 0)
   end
 
   it "should digest and sign SOAP XML with SHA256" do
@@ -57,7 +57,7 @@ describe Signer do
     signer.private_key = OpenSSL::PKey::RSA.new(File.read(private_key_file), "test")
     signer.digest_algorithm = :sha256
     signer.signature_digest_algorithm = :sha256
-    signer.signature_algorithm_id = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'
+    signer.signature_algorithm_id = 'http://www.w3.org/2001/04/xmlenc#sha256'
 
     signer.digest!(signer.binary_security_token_node)
 
@@ -65,7 +65,7 @@ describe Signer do
 
     output_xml_file = File.join(File.dirname(__FILE__), 'fixtures', 'output_1_sha256.xml')
 
-    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(:save_with => 0)
+    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(save_with: 0)
   end
 
   it "should digest and sign SOAP XML with inclusive namespaces" do
@@ -85,30 +85,37 @@ describe Signer do
 
     output_xml_file = File.join(File.dirname(__FILE__), 'fixtures', 'output_1_inclusive_namespaces.xml')
 
-    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(:save_with => 0)
+    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(save_with: 0)
   end
 
-  it "should sign simple XML" do
-    input_xml_file   = File.join(File.dirname(__FILE__), 'fixtures', 'input_2.xml')
-    cert_file        = File.join(File.dirname(__FILE__), 'fixtures', 'cert.pem')
-    private_key_file = File.join(File.dirname(__FILE__), 'fixtures', 'key.pem')
-
-    signer = Signer.new(File.read(input_xml_file))
-    signer.cert = OpenSSL::X509::Certificate.new(File.read(cert_file))
-    signer.private_key = OpenSSL::PKey::RSA.new(File.read(private_key_file), "test")
-    signer.security_node = signer.document.root
-    signer.security_token_id = ""
-    signer.digest!(signer.document.root, :id => "", :enveloped => true)
-    signer.sign!(:issuer_serial => true)
-
-    # File.open(File.join(File.dirname(__FILE__), 'fixtures', 'output_2.xml'), "w") do |f|
-    #   f.write signer.document.to_s
-    # end
-    output_xml_file = File.join(File.dirname(__FILE__), 'fixtures', 'output_2.xml')
-
-    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(:save_with => 0)
+  [
+    [{ enveloped: true, enveloped_legacy: true }, 'output_2_legacy.xml'],
+    [{ enveloped: true, enveloped_legacy: false }, 'output_2.xml'],
+    [{ enveloped: true }, 'output_2.xml']
+  ].each do |options, output_xml|
+    it "should sign simple XML with options=#{options}" do
+      input_xml_file   = File.join(File.dirname(__FILE__), 'fixtures', 'input_2.xml')
+      cert_file        = File.join(File.dirname(__FILE__), 'fixtures', 'cert.pem')
+      private_key_file = File.join(File.dirname(__FILE__), 'fixtures', 'key.pem')
+
+      signer = Signer.new(File.read(input_xml_file))
+      signer.cert = OpenSSL::X509::Certificate.new(File.read(cert_file))
+      signer.private_key = OpenSSL::PKey::RSA.new(File.read(private_key_file), "test")
+      signer.security_node = signer.document.root
+      signer.security_token_id = ""
+      signer.digest!(signer.document.root, id: "", **options)
+      signer.sign!(:issuer_serial => true)
+
+      # File.open(File.join(File.dirname(__FILE__), 'fixtures', 'output_2.xml'), "w") do |f|
+      #   f.write signer.document.to_s
+      # end
+      output_xml_file = File.join(File.dirname(__FILE__), 'fixtures', output_xml)
+
+      signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(save_with: 0)
+    end
   end
 
+
   it "should digest and sign SOAP XML with security node and digested binary token" do
     input_xml_file   = File.join(File.dirname(__FILE__), 'fixtures', 'input_4_with_nested_signatures.xml')
     cert_file        = File.join(File.dirname(__FILE__), 'fixtures', 'cert.pem')
@@ -136,10 +143,39 @@ describe Signer do
     # end
     output_xml_file = File.join(File.dirname(__FILE__), 'fixtures', 'output_4_with_nested_signatures.xml')
 
-    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(:save_with => 0)
+    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(save_with: 0)
+  end
+
+  [
+    [{ enveloped: true, enveloped_legacy: true }, 'output_2_with_ds_prefix_legacy.xml'],
+    [{ enveloped: true, enveloped_legacy: false }, 'output_2_with_ds_prefix.xml'],
+    [{ enveloped: true }, 'output_2_with_ds_prefix.xml']
+  ].each do |options, output_xml|
+    it "should sign simple XML with custom DS namespace prefix with options=#{options}" do
+      input_xml_file   = File.join(File.dirname(__FILE__), 'fixtures', 'input_2.xml')
+      cert_file        = File.join(File.dirname(__FILE__), 'fixtures', 'cert.pem')
+      private_key_file = File.join(File.dirname(__FILE__), 'fixtures', 'key.pem')
+
+      signer = Signer.new(File.read(input_xml_file))
+      signer.cert = OpenSSL::X509::Certificate.new(File.read(cert_file))
+      signer.private_key = OpenSSL::PKey::RSA.new(File.read(private_key_file), "test")
+      signer.security_node = signer.document.root
+      signer.security_token_id = ""
+      signer.ds_namespace_prefix = 'ds'
+
+      signer.digest!(signer.document.root, id: "", **options)
+      signer.sign!(issuer_serial: true)
+
+      # File.open(File.join(File.dirname(__FILE__), 'fixtures', 'output_2_with_ds_prefix.xml'), "w") do |f|
+      #   f.write signer.document.to_s
+      # end
+      output_xml_file = File.join(File.dirname(__FILE__), 'fixtures', output_xml)
+
+      signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(save_with: 0)
+    end
   end
 
-  it "should sign simple XML with custom DS namespace prefix" do
+  it "should digest simple XML without transforms node" do
     input_xml_file   = File.join(File.dirname(__FILE__), 'fixtures', 'input_2.xml')
     cert_file        = File.join(File.dirname(__FILE__), 'fixtures', 'cert.pem')
     private_key_file = File.join(File.dirname(__FILE__), 'fixtures', 'key.pem')
@@ -150,15 +186,43 @@ describe Signer do
     signer.security_node = signer.document.root
     signer.security_token_id = ""
     signer.ds_namespace_prefix = 'ds'
-    signer.digest!(signer.document.root, :id => "", :enveloped => true)
-    signer.sign!(:issuer_serial => true)
 
-    # File.open(File.join(File.dirname(__FILE__), 'fixtures', 'output_2_with_ds_prefix.xml'), "w") do |f|
-    #   f.write signer.document.to_s
-    # end
-    output_xml_file = File.join(File.dirname(__FILE__), 'fixtures', 'output_2_with_ds_prefix.xml')
+    signer.digest!(signer.document.root, id: "", no_transform: true)
+    signer.sign!(issuer_serial: true)
 
-    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(:save_with => 0)
+    expect(signer.document.at_xpath('//ds:Transforms', ds: Signer::DS_NAMESPACE)).to be_nil
+  end
+
+  [
+    [{ enveloped: true, enveloped_legacy: true }, 'output_2_with_ds_prefix_and_wss_disabled_legacy.xml'],
+    [{ enveloped: true, enveloped_legacy: false }, 'output_2_with_ds_prefix_and_wss_disabled.xml'],
+    [{ enveloped: true }, 'output_2_with_ds_prefix_and_wss_disabled.xml']
+  ].each do |options, output_xml|
+    it "should partially sign element and simple XML with custom DS namespace prefix when wss is false with options=#{options}" do
+      input_xml_file   = File.join(File.dirname(__FILE__), 'fixtures', 'input_2.xml')
+      cert_file        = File.join(File.dirname(__FILE__), 'fixtures', 'cert.pem')
+      private_key_file = File.join(File.dirname(__FILE__), 'fixtures', 'key.pem')
+
+      signer = Signer.new(File.read(input_xml_file), wss: false)
+      signer.cert = OpenSSL::X509::Certificate.new(File.read(cert_file))
+      signer.private_key = OpenSSL::PKey::RSA.new(File.read(private_key_file), "test")
+      signer.security_node = signer.document.root
+      signer.security_token_id = ""
+      signer.ds_namespace_prefix = 'ds'
+
+      # partially sign element
+      signer.digest!(signer.document.root.children.first, **options)
+
+      signer.digest!(signer.document.root, id: "", **options)
+      signer.sign!(issuer_serial: true)
+
+      # File.open(File.join(File.dirname(__FILE__), 'fixtures', 'output_2_with_ds_prefix_and_wss_disabled.xml'), "w") do |f|
+      #   f.write signer.document.to_s
+      # end
+      output_xml_file = File.join(File.dirname(__FILE__), 'fixtures', output_xml)
+
+      signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(:save_with => 0)
+    end
   end
 
   it "should digest and sign SOAP XML with security node and digested binary token with noblanks disabled" do
@@ -187,7 +251,7 @@ describe Signer do
                                 'fixtures',
                                 'output_4_with_nested_signatures_with_noblanks_disabled.xml')
 
-    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file)).to_xml(:save_with => 0)
+    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file)).to_xml(save_with: 0)
   end
 
   it "should digest and sign SOAP XML with X509Data inside SecurityTokenReference node" do
@@ -209,7 +273,7 @@ describe Signer do
                                 'fixtures',
                                 'output_5_with_security_token.xml')
 
-    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(:save_with => 0)
+    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(save_with: 0)
   end
 
   it "should digest and sign SOAP XML with X509Data" do
@@ -231,6 +295,6 @@ describe Signer do
                                 'fixtures',
                                 'output_5_with_x509_data.xml')
 
-    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(:save_with => 0)
+    signer.to_xml.should == Nokogiri::XML(File.read(output_xml_file), &:noblanks).to_xml(save_with: 0)
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: signer
 version: !ruby/object:Gem::Version
-  version: 1.6.0
+  version: 1.10.0
 platform: ruby
 authors:
 - Edgars Beigarts
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2017-09-14 00:00:00.000000000 Z
+date: 2021-10-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -45,6 +45,18 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.5.1
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 1.12.0
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 1.12.1
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 1.12.2
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 1.12.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -52,6 +64,18 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.5.1
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 1.12.0
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 1.12.1
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 1.12.2
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 1.12.3
 description: WS Security XML signer
 email:
 - edgars.beigarts@gmail.com
@@ -76,7 +100,11 @@ files:
 - spec/fixtures/output_1_inclusive_namespaces.xml
 - spec/fixtures/output_1_sha256.xml
 - spec/fixtures/output_2.xml
+- spec/fixtures/output_2_legacy.xml
 - spec/fixtures/output_2_with_ds_prefix.xml
+- spec/fixtures/output_2_with_ds_prefix_and_wss_disabled.xml
+- spec/fixtures/output_2_with_ds_prefix_and_wss_disabled_legacy.xml
+- spec/fixtures/output_2_with_ds_prefix_legacy.xml
 - spec/fixtures/output_3_c14n_comments.xml
 - spec/fixtures/output_4_with_nested_signatures.xml
 - spec/fixtures/output_4_with_nested_signatures_with_noblanks_disabled.xml
@@ -87,7 +115,7 @@ files:
 homepage: ''
 licenses: []
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -102,28 +130,31 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.11
-signing_key: 
+rubygems_version: 3.0.1
+signing_key:
 specification_version: 4
 summary: WS Security XML signer
 test_files:
+- spec/spec_helper.rb
+- spec/fixtures/output_5_with_x509_data.xml
+- spec/fixtures/output_2_with_ds_prefix_legacy.xml
+- spec/fixtures/key.pem
+- spec/fixtures/input_5.xml
+- spec/fixtures/input_4_with_nested_signatures.xml
 - spec/fixtures/cert.pem
 - spec/fixtures/input_1.xml
 - spec/fixtures/input_2.xml
-- spec/fixtures/input_3_c14n_comments.xml
-- spec/fixtures/input_4_with_nested_signatures.xml
-- spec/fixtures/input_5.xml
-- spec/fixtures/key.pem
+- spec/fixtures/output_4_with_nested_signatures.xml
+- spec/fixtures/output_2_with_ds_prefix_and_wss_disabled_legacy.xml
 - spec/fixtures/output_1.xml
-- spec/fixtures/output_1_inclusive_namespaces.xml
-- spec/fixtures/output_1_sha256.xml
 - spec/fixtures/output_2.xml
-- spec/fixtures/output_2_with_ds_prefix.xml
-- spec/fixtures/output_3_c14n_comments.xml
-- spec/fixtures/output_4_with_nested_signatures.xml
+- spec/fixtures/output_1_sha256.xml
+- spec/fixtures/input_3_c14n_comments.xml
+- spec/fixtures/output_2_with_ds_prefix_and_wss_disabled.xml
+- spec/fixtures/output_2_legacy.xml
 - spec/fixtures/output_4_with_nested_signatures_with_noblanks_disabled.xml
+- spec/fixtures/output_3_c14n_comments.xml
+- spec/fixtures/output_2_with_ds_prefix.xml
+- spec/fixtures/output_1_inclusive_namespaces.xml
 - spec/fixtures/output_5_with_security_token.xml
-- spec/fixtures/output_5_with_x509_data.xml
 - spec/signer_spec.rb
-- spec/spec_helper.rb