Java & XMLDSig: Reference with no URI

问题

I'm trying to sign some text using XMLDSig with javax.xml.crypto.dsig.* package. I need to make a reference to some content being signed. And according to project requirements this reference should not have any URI, it means not <Reference URI="">...</Reference>, but <Reference>...</Reference>.

I haven't found any info whether it is possible and correct, but requirement says that XMLDSig allows such references, maximum one per signature.

Have someone faced the same problem? What can be done to produce signature with such reference using javax.xml.crypto.dsig.* package and no magic?

As I understood the package mentioned above only allows to reference some data with URI (or with empty URI), but not without any URI at all. May be I've missed something in its usage?

回答1:

Indeed, XML Signature can contain one Reference with no URI, but you need to tell sign context how to find object referenced this way. This can be done by using custom implementation of URIDereferencer.

So, to reference some content in signature without any URI you can do the following:

Reference dataReference = xmlSigFactory.newReference(null, <your digest method>, <your transformations list>, <needed type>, <id>);

Where the very first null parameter means null as URI, i.e. no URI.

To make this reference valid you need to specify your custom URIDereferencer implementation in DOMSignContext object which holds all the references to content being signed. This custom URIDereferencer should contain logic to find content being signed, it's your own implementation so you should know how to find needed content.

回答2:

Create NoUriDereferencer implement URIDereferencer and set it for your XmlSignContect

public class NoUriDereferencer implements URIDereferencer {

private Node data = null;

public NoUriDereferencer(Node node) {
    data = node;
}

public Data dereference(URIReference ref, XMLCryptoContext ctxt) {
    return new NodeSetData() {
        public Iterator iterator() {
            return Collections.singletonList(data).iterator();
        }
    };
}
}

来源：https://stackoverflow.com/questions/15522098/java-xmldsig-reference-with-no-uri

标签

java

xml-signature

xml-dsig