Package org.apache.poi.poifs.crypt.dsig

Class SignatureInfo

  • public class SignatureInfo
extends Object

    This class is the default entry point for XML signatures and can be used for validating an existing signed office document and signing a office document.

    Validating a signed office document

     OPCPackage pkg = OPCPackage.open(..., PackageAccess.READ);
 SignatureConfig sic = new SignatureConfig();
 sic.setOpcPackage(pkg);
 SignatureInfo si = new SignatureInfo();
 si.setSignatureConfig(sic);
 boolean isValid = si.validate();
 ...

    Signing an office document

     // loading the keystore - pkcs12 is used here, but of course jks & co are also valid
 // the keystore needs to contain a private key and its certificate having a
 // 'digitalSignature' key usage
 char password[] = "test".toCharArray();
 File file = new File("test.pfx");
 KeyStore keystore = KeyStore.getInstance("PKCS12");
 FileInputStream fis = new FileInputStream(file);
 keystore.load(fis, password);
 fis.close();

 // extracting private key and certificate
 String alias = "xyz"; // alias of the keystore entry
 Key key = keystore.getKey(alias, password);
 X509Certificate x509 = (X509Certificate)keystore.getCertificate(alias);

 // filling the SignatureConfig entries (minimum fields, more options are available ...)
 SignatureConfig signatureConfig = new SignatureConfig();
 signatureConfig.setKey(keyPair.getPrivate());
 signatureConfig.setSigningCertificateChain(Collections.singletonList(x509));
 OPCPackage pkg = OPCPackage.open(..., PackageAccess.READ_WRITE);
 signatureConfig.setOpcPackage(pkg);

 // adding the signature document to the package
 SignatureInfo si = new SignatureInfo();
 si.setSignatureConfig(signatureConfig);
 si.confirmSignature();
 // optionally verify the generated signature
 boolean b = si.verifySignature();
 assert (b);
 // write the changes back to disc
 pkg.close();

    Implementation notes:

    Although there's a XML signature implementation in the Oracle JDKs 6 and higher, compatibility with IBM JDKs is also in focus (... but maybe not thoroughly tested ...). Therefore we are using the Apache Santuario libs (xmlsec) instead of the built-in classes, as the compatibility seems to be provided there.

    To use SignatureInfo and its sibling classes, you'll need to have the following libs in the classpath:

    • BouncyCastle bcpkix and bcprov (tested against 1.70)
    • Apache Santuario "xmlsec" (tested against 2.3.0)
    • and log4j-api (tested against 2.17.x)

    • Constructor Detail

      • SignatureInfo

        public SignatureInfo()

    • Method Detail

      • getSignatureConfig

        public SignatureConfig getSignatureConfig()
        Returns:
        the signature config

      • setSignatureConfig

        public void setSignatureConfig​(SignatureConfig signatureConfig)
        Parameters:
        signatureConfig - the signature config, needs to be set before a SignatureInfo object is used

      • setOpcPackage

        public void setOpcPackage​(OPCPackage opcPackage)

      • getOpcPackage

        public OPCPackage getOpcPackage()

      • setUriDereferencer

        public void setUriDereferencer​(URIDereferencer uriDereferencer)

      • verifySignature

        public boolean verifySignature()
        Returns:
        true, if first signature part is valid

      • createXMLSignContext

        public DOMSignContext createXMLSignContext​(Document document)
        Convenience method for creating the signature context
        Parameters:
        document - the document the signature is based on
        Returns:
        the initialized signature context

      • signDigest

        public String signDigest​(DOMSignContext xmlSignContext,
                         org.apache.jcp.xml.dsig.internal.dom.DOMSignedInfo signedInfo)
        Sign (encrypt) the digest with the private key. Currently only rsa is supported.
        Returns:
        the encrypted hash

      • getSignatureParts

        public Iterable<SignaturePart> getSignatureParts()
        Returns:
        a signature part for each signature document. the parts can be validated independently.

      • registerEventListener

        protected void registerEventListener​(Document document)

      • writeDocument

        protected void writeDocument​(Document document)
                      throws MarshalException
        Write XML signature into the OPC package
        Parameters:
        document - the xml signature document
        Throws:
        MarshalException - if the document can't be serialized

      • setProvider

        public void setProvider​(Provider provider)

      • setSignatureFactory

        public void setSignatureFactory​(XMLSignatureFactory signatureFactory)

      • setKeyInfoFactory

        public void setKeyInfoFactory​(KeyInfoFactory keyInfoFactory)

      • initXmlProvider

        protected void initXmlProvider()
        Initialize the xml signing environment and the bouncycastle provider