XML Digital Signature Tool
XML Encryption Tool
SAML Assertion Tool
HTML Document Signing Tool
How To Use the Tools in this Add-on
The XML digital signature tool is built on top of Apache XML security library (called XSEC). The Apache XML security library has a plug-in for Mozilla NSS library. We added an XPCOM based thin layer for accessing the Mozilla NSS plug-in in XSEC library from the browser. Our XPCOM IDL based layers allows any Firefox based extension to access XSEC library using JavaScript and C++.
This tool visually guides an user to select various XML signature parameters. All the options are presented for the user and user has to choose form the listed options. This tool allows an user to build the whole XML Signature element before sending it to the apache library for signature.
The following picture describes a snapshots of the XUL based Signing form for the tool.
This tools automatically selects a list of user signing certificates which can be used to sign XML documents and present them as a menu list. The XML file to be signed is picked using the file browser. The signature parameters are chosen form a set of lists.
The figure below describes the wizard for implementing workflow for signing and verification of XML Digital Signature and encryption and decryption of XML documents.
/* Create an instance of XML Signature Tool */ var /* alrIXPXmlDSigTool */ xmlDSigTool = null; try { xmlDSigTool = Components.classes["@avaya.com/pkm/xmldsigtool;1"]. createInstance(Components.interfaces.alrIXPXmlDSigTool); } catch (ex) { throw ex; }
var /* nsIX509Cert */ signerCert; var /* nsILocalFile */ inputXMLFile; var /* nsIProperties */ xmlSigProps; var /* nsILocalFile */ outSignedXMLFile;
xmlSigProps = Components.classes["@mozilla.org/persistent-properties;1"]. createInstance(Components.interfaces.nsIPersistentProperties); var propKey; var propValue; var propOldValue; var trueValue = "true"; propKey = "keyinfoName"; propValue = trueValue;propOldValue = xmlSigProps.setStringProperty(propKey, propValue); propKey = "keyinfoX509"; propValue = trueValue; propOldValue = xmlSigProps.setStringProperty(propKey, propValue); propKey = "canonicalizationMethod"; propValue = "C14N_NOC"; propOldValue = xmlSigProps.setStringProperty(propKey, propValue); propKey = "hashAlgorithm"; propValue = "SHA1"; propOldValue = xmlSigProps.setStringProperty(propKey, propValue); propKey = "transformType"; propValue = "ENVELOPED_SIGNATURE"; propOldValue = xmlSigProps.setStringProperty(propKey, propValue);
try { // Token login // xmldsigffext_loginToCertToken(signerCert);
xmlDSigTool.signXMLFileByX509Cert( signerCert, inputXMLFile, xmlSigProps, outSignedXMLFile ); } catch (ex) { throw ex; } |
Encryption Form :
Decryption Form :
The Figure above describes the XUL GUI for the Self-issued SAML token. The XUL GUI reuses the XUL based XML Signature GUI elements for the signing the XML document for the SAML token. The XML document for the self-issued token is derived from the selected user certificate. The certificate selection element (labeled “Signer Certificate”) lists only those user certificates (in the browser’s certificate DB) that match key usage criteria for document signing. Depending upon the type of the SAML version, appropriate SAML token document is generated. If the version 1.1 is chosen for the token type, then it presents two different options for the name space prefix for the attribute names: MS Info card or SAML Basic . If the version 2.0 is chosen, then the two different options are presented: SAMLv2 Basic and SAMLv2 X500 LDAP .
As described before, we have used the following the recommendation for the XML signature profile that is used to create the SAML self-issued token:
Used enveloped signature format for the token signature.
Selected signer certificate with RSA or DSA key and used the related algorithm identifier (e.g. for RSA we use the URI http://www.w3.org/2000/09/xmldsig#rsa-sha1).
Used exclusive canonicalization without comments method with the algorithm identifier given by the URI http://www.w3.org/2001/10/xml-exc-c14n#.
Used SHA1 digest method for the data elements being signed with the algorithm identifier http://www.w3.org/2000/09/xmldsig#sha1.
The ds:KeyInfo element is always present in the signature and contains the following child elements (the last two elements are our additions for experimentation) :
signing RSA key value in the form of a ds:RSAKeyValue element
Subject DN of in the certificate in the form of ds:keyName element and ds:X509Data/X509Subject element
Base64 data for the certificate in the form of ds:X509Data/X509Certificate element
Since the signature parameters are fixed, the input control for the signature parameter elements in the XUL GUI are disabled.
HTML document signing tool and HTML signature validation is an implementation of the HTML Signing Profile.
HTML document signing tool and HTML signature validation is disabled by default. You have to explicitly enable it to use it. Use the Preference window to enable it as follows:
If the HTML signature validation is enabled, then a small icon appears on the status bar of the browser if the page contains HTML signature. This status icon displays the information about the signature and the results of the signature validation.
Note: If you are going to generate WebLM license file in DTD format (which is not consistent with XML Signature spec), then you won't need to install Apache XML libraries and skip this section.
Note: XPI file for this add-on includes Apache XML security libraries for C++. The default XSEC-binary from Apache is not compiled for Mozilla NSS. So we provide our compiled version of NSS-enabled XSEC-C++ library.
Note:
If the signing does not work, re-install (uninstall then install - do not install over existing XPI file) the XPI file only.
Also, check to make sure that DLLs (shared libraries) from Apache Xerces-C++ is in your PATH (LD_LIBRARY_PATH). environment variable.
The tools for XML Digital signature, XML enryption and SAML self-token will appear as menu-items under "Key Manager Tool Box" menu which is under "Tools" menu in the (Firefox) browser toolbar.
Launch the XML Digital Signature Tool by selecting the menu-item under "Key Manager Tool Box"
SAML Token Tool
Launch the SAML Token Tool by selecting the menu-item for "SAML Self Token"
HTML Document Signing Tool
Launch the HTML Digital Signature Tool by selecting the menu-item for "HTML Digital Signature Tool"
function xmldsigtool_cmdSignXmlDoc(unsignedXmlDocFilePath, signedXmlDocFilePath) { dump("xmldsigtool_cmdSignXmlDoc():..................Start.\n");
dump("xmldsigtool_cmdSignXmlDoc():unsignedXmlDocFilePath: " + unsignedXmlDocFilePath + "\n"); dump("xmldsigtool_cmdSignXmlDoc():signedXmlDocFilePath: " + signedXmlDocFilePath + "\n");
// We are now ready to sign the unsigned XML doc file.
// TODO: If you invoking this method from a downloaded HTML file uncomment the following line. // netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
var dialogParams = Components.classes["@mozilla.org/embedcomp/dialogparam;1"] .createInstance(Components.interfaces.nsIDialogParamBlock); var argc = 0; dialogParams.SetString(argc, unsignedXmlDocFilePath); argc++; dialogParams.SetString(argc, signedXmlDocFilePath); argc++; dialogParams.SetInt(0, argc); window.openDialog('chrome://xmldsigffext/content/xmldsig/XmlDigitalSigTool.xul', '_blank', 'chrome,centerscreen,resizable,modal,titlebar', dialogParams); var retVal = dialogParams.GetInt(0); if (retVal == 0) { alert("Failed to sign the input XML doc"); return false; } dump("xmldsigtool_cmdSignXmlDoc():..................End.\n"); return true; } function signXMLDoc() { var unsignedXmlDocFilePath = null; /* input unsigned XML doc path */ var signedXmlDocFilePath = null; /* out signed XML doc */
// TODO: Initilize the path for inout and putput XML docs.
xmldsigtool_cmdSignXmlDoc(unsignedXmlDocFilePath, signedXmlDocFilePath); }
|
KeyManager Add-on for Firefox : https://addons.mozilla.org/en-US/firefox/addon/4471.
XML Digital Signature Tool: http://pubs.research.avayalabs.com/pdfs/ALR-2007-013.pdf.