【发布时间】：2019-12-05 23:14:05
【问题描述】：
我正在尝试对 xml 文档的一部分进行签名，但出现错误“javax.xml.crypto.URIReferenceException: com.sun.org.apache.xml.internal.security.utils.resolver.ResourceResolverException: Cannot resolve element with身份证件”。我不明白这个错误，因为肥皂体有一个名为“身体”的 id 属性。为什么找不到呢？
这是创建初始 xml 文档的代码：
//create Document, create envelope and append it to document, create header
//and append it to envelope, create body and append it to envelope
private Document startDocument() {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
Document doc = null;
try {
DocumentBuilder builder = factory.newDocumentBuilder();
doc = builder.newDocument();
System.out.println("" + doc.getXmlVersion());
//Envelope
Element envelope = doc.createElementNS("http://schemas.xmlsoap.org/soap/envelope/", "B:Envelope");
envelope.setAttribute("xmlns:B", "http://schemas.xmlsoap.org/soap/envelope/");
envelope.setAttribute("xmlns:SOAP-SEC", "http://schemas.xmlsoap.org/soap/security/2000-12");
envelope.setAttribute("xmlns:xsi", "http://www.w3.org/2001/XMLSchema-instance");
doc.appendChild(envelope);
//Header
Element header = doc.createElementNS("http://schemas.xmlsoap.org/soap/envelope/", "SOAP:Header");
header.setAttribute("xmlns:SOAP", "http://schemas.xmlsoap.org/soap/envelope/");
header.setAttribute("xmlns:SOAP-SEC", "http://schemas.xmlsoap.org/soap/security/2000-12");
envelope.appendChild(header);
//Body
Element body = doc.createElementNS("http://schemas.xmlsoap.org/soap/envelope/", "SOAP:Body");
body.setAttribute("xmlns:SOAP", "http://schemas.xmlsoap.org/soap/envelope/");
body.setAttribute("ID", "Body");
envelope.appendChild(body);
//Save document nodes
envelopeNode = envelope;
headerNode = header;
bodyNode = body;
} catch (ParserConfigurationException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
return doc;
}
此代码将“SOAP-SEC:Signature”节点添加到标头节点：
private void makeHeader() {
//$document = $this->document;
Element header = headerNode;
// SOAP-SEC:Security
Element security = document.createElementNS("http://schemas.xmlsoap.org/soap/security/2000-12", "SOAP-SEC:Signature");
security.setAttribute("SOAP:mustUnderstand", "1");
header.appendChild(security);
// Add Signature Later in sign()
this.securityNode = security;
}
然后此代码尝试对文档的正文部分进行签名并将签名添加到 SOAP-SEC:Signature 节点。
private void buildSignatureBlock5(String privateKeyPath, String publicKeyPath) {
// Create a DOM XMLSignatureFactory that will be used to generate the enveloped signature.
XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM");
//Create a Reference to the enveloped document (in this case, you are signing the Body
//section of the document), and also specify the SHA1 digest algorithm and the ENVELOPED Transform.
Reference ref = null;
try {
ref = fac.newReference
("#Body", fac.newDigestMethod(DigestMethod.SHA1, null),
Collections.singletonList
(fac.newTransform
(Transform.ENVELOPED, (TransformParameterSpec) null)),
null, null);
} catch (NoSuchAlgorithmException | InvalidAlgorithmParameterException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
// Create the SignedInfo.
SignedInfo si = null;
try {
si = fac.newSignedInfo
(fac.newCanonicalizationMethod
(CanonicalizationMethod.INCLUSIVE,
(C14NMethodParameterSpec) null),
fac.newSignatureMethod(SignatureMethod.RSA_SHA1, null),
Collections.singletonList(ref));
} catch (NoSuchAlgorithmException | InvalidAlgorithmParameterException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
// Load the KeyStore and get the signing key and certificate.
KeyStore ks = null;
try {
ks = KeyStore.getInstance("JKS");
} catch (KeyStoreException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
try {
ks.load(new FileInputStream(storage_path +"/keys/myproject.jks"), "changeit".toCharArray());
} catch (NoSuchAlgorithmException | CertificateException | IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
KeyStore.PrivateKeyEntry keyEntry = null;
try {
keyEntry = (KeyStore.PrivateKeyEntry) ks.getEntry
("1", new KeyStore.PasswordProtection("changeit".toCharArray()));
} catch (NoSuchAlgorithmException | UnrecoverableEntryException | KeyStoreException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
X509Certificate cert = (X509Certificate) keyEntry.getCertificate();
// Create the KeyInfo containing the X509Data.
KeyInfoFactory kif = fac.getKeyInfoFactory();
List x509Content = new ArrayList();
String issuerName = cert.getIssuerX500Principal().getName();
BigInteger serialNumber = cert.getSerialNumber();
X509IssuerSerial issuer = kif.newX509IssuerSerial(issuerName, serialNumber);
x509Content.add(issuer);
x509Content.add(cert);
X509Data xd = kif.newX509Data(x509Content);
KeyInfo ki = kif.newKeyInfo(Collections.singletonList(xd));
// Create a DOMSignContext and specify the RSA PrivateKey and
// location of the resulting XMLSignature's parent element.
Element envHeaderSig = (Element) document.getElementsByTagName("SOAP-SEC:Signature").item(0);
DOMSignContext dsc = new DOMSignContext(keyEntry.getPrivateKey(), envHeaderSig);
// Create the XMLSignature, but don't sign it yet.
XMLSignature signature = fac.newXMLSignature(si, ki);
// Marshal, generate, and sign the enveloped signature.
try {
signature.sign(dsc); //error occurs here
} catch (MarshalException | XMLSignatureException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
失败，在 signature.sign 行出现主题错误。我已经无计可施了！有什么建议吗？
【问题讨论】：
标签： java digital-signature x509certificate