xades4j.UnsupportedAlgorithmException：XML 签名提供程序上不支持的转换

Question

我正在尝试为给定的 blob 创建 XAdES-BES 签名。对于此签名，我需要在内容签名之前添加两个转换：Base64 (http://www.w3.org/2000/09/xmldsig#base64) 和一个自定义转换（称为 optional-deflate）。

问题在于该可选转换。我试图弄清楚如何实现自定义转换，注册它，最后让 Xades4J 使用它。

到目前为止，我想了很多（感谢 Google 和很多时间），所以我大致做到了：我有一个 Provider 类，它在构造函数中放置了新的 TransformService；在我的主代码中，我将我的 Provider 添加到 Security 实例中；然后，我尝试将转换添加到我实际的待签名对象。

不幸的是，我总是遇到同样的错误：

Exception in thread "main" xades4j.UnsupportedAlgorithmException: Unsupported transform on XML Signature provider (urn:xml:sig:transform:optional-deflate)
    at xades4j.production.DataObjectDescsProcessor.processTransforms(DataObjectDescsProcessor.java:194)
    at xades4j.production.DataObjectDescsProcessor.process(DataObjectDescsProcessor.java:87)
    at xades4j.production.SignerBES.sign(SignerBES.java:173)
    at xades4j.production.SignerBES.sign(SignerBES.java:122)
    at com.mycompany.Test.createXades(Test.java:199)
    at com.mycompany.Test.main(Test.java:47)
Caused by: org.apache.xml.security.transforms.TransformationException: Unknown transformation. No handler installed for URI urn:xml:sig:transform:optional-deflate
Original Exception was org.apache.xml.security.transforms.InvalidTransformException: Unknown transformation. No handler installed for URI urn:xml:sig:transform:optional-deflate
    at org.apache.xml.security.transforms.Transforms.addTransform(Unknown Source)
    at xades4j.production.DataObjectDescsProcessor.processTransforms(DataObjectDescsProcessor.java:185)
    ... 5 more

所以，我的代码看起来像这样（缩写为我认为必要的）：

TransformService类：

package com.mycompany.security;

import java.io.OutputStream;
import java.security.InvalidAlgorithmParameterException;
import java.security.spec.AlgorithmParameterSpec;

import javax.xml.crypto.Data;
import javax.xml.crypto.MarshalException;
import javax.xml.crypto.XMLCryptoContext;
import javax.xml.crypto.XMLStructure;
import javax.xml.crypto.dsig.TransformService;
import javax.xml.crypto.dsig.TransformException;
import javax.xml.crypto.dsig.spec.TransformParameterSpec;

public class OptionalDeflateTransform extends TransformService {
    public AlgorithmParameterSpec getParameterSpec() {
            return null;
    }
    public Data transform(Data data, XMLCryptoContext context) throws TransformException {
            return null;
    }
    public Data transform(Data data, XMLCryptoContext context, OutputStream os) throws TransformException {
            return null;
    }
    public boolean isFeatureSupported(String feature) {
            return false;
    }
    public void init(TransformParameterSpec params) throws InvalidAlgorithmParameterException {}
    public void marshalParams(XMLStructure parent, XMLCryptoContext context) throws MarshalException {}
    public void init(XMLStructure parent, XMLCryptoContext context) throws InvalidAlgorithmParameterException {}
}

Provider 子类：

package com.mycompany.security;

import java.security.Provider;

public final class OptionalDeflateProvider extends Provider {
    private static final long serialVersionUID = 8849833178389029123L;

    public OptionalDeflateProvider() {
            super("OptionalDeflate", 1.0, "OptionalDeflate provider 1.0 implementing the OptionalDeflate transform algorithm.");
            put("TransformService.urn:xml:sig:transform:optional-deflate", "com.mycompany.security.OptionalDeflateTransform");
    }

}

最后，我的主要Test 类，其中包含实际的签名。没有那个转换，它就可以工作（但是，它不会添加转换，这是必要的）。所以 Base64 可以工作。

protected static void createXades(String content) throws Exception {
    /*Get certificate & private key*/
    Certificates c = new Certificates(); 
    c.initSession(); //some helper class where I can get my certificate & private key for signing

    /*Create a document*/
    DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
    DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
    Document doc = docBuilder.newDocument();
    Element objectElement = doc.createElement("object");
    doc.appendChild(objectElement);
    Element requestElement = doc.createElement("request");
    requestElement.appendChild(doc.createTextNode(content));
    requestElement.setAttribute("ID", UUID.randomUUID().toString());
    objectElement.appendChild(requestElement);

    /*Key provider, signing profile & signer itself*/
    KeyingDataProvider kp = new CustomKeyingDataProvider(c.getCertificate(), c.getPrivateKey());
    XadesSigningProfile p = new XadesBesSigningProfile(kp);
    p.withAlgorithmsProviderEx(new ProviderEx());
    XadesSigner signer = p.newSigner();

    /*Add the optional deflate provider*/
    Security.addProvider(new OptionalDeflateProvider());
    System.out.println("--- installed providers ---");
    for (Provider pr : Security.getProviders())
            System.out.println(pr.getName());
    System.out.println("---");

    /*Test if we can get the transformservice-instance*/
    TransformService ts = TransformService.getInstance("urn:xml:sig:transform:optional-deflate", "DOM");
    System.out.println(ts.getAlgorithm());
    System.out.println("---");

    /*Signed data*/
    DataObjectDesc flatFile = new DataObjectReference("#" + requestElement.getAttribute("ID"))
            .withTransform(new GenericAlgorithm("http://www.w3.org/2000/09/xmldsig#base64"))
            .withTransform(new GenericAlgorithm("urn:xml:sig:transform:optional-deflate"));
    SignedDataObjects dataObjs = new SignedDataObjects(flatFile);

    /*Actual signing*/
    signer.sign(dataObjs, objectElement);
    log(objectElement.getLastChild());
}

如您所见，我打印了一些内容。例如，我记录了安装工作正常，并且还记录了已安装的提供程序。我得到这个作为输出：

--- installed providers ---
SUN
SunRsaSign
SunEC
SunJSSE
SunJCE
SunJGSS
SunSASL
XMLDSig
SunPCSC
SunMSCAPI
OptionalDeflate
---
urn:xml:sig:transform:optional-deflate
---

所以据我所见，提供者已成功注册，transformservice 可以毫无问题地加载，......所以我真的不明白发生了什么？

我也检查了 Xades4j 的源代码，.withTransform(new GenericAlgorithm("urn:xml:sig:transform:optional-deflate")) 行内部发生的事情非常简单：

import org.apache.xml.security.transforms.Transforms;

...

private Transforms processTransforms(DataObjectDesc dataObjDesc, Document document) throws UnsupportedAlgorithmException {
    Collection<Algorithm> dObjTransfs = dataObjDesc.getTransforms();
    if (dObjTransfs.isEmpty()) {
        return null;
    }
    Transforms transforms = new Transforms(document);
    for (Algorithm dObjTransf : dObjTransfs) {
        try {
            List<Node> transfParams = this.algorithmsParametersMarshaller.marshalParameters(dObjTransf, document);
            if (null == transfParams) {
                transforms.addTransform(dObjTransf.getUri());
            } else {
                transforms.addTransform(dObjTransf.getUri(), DOMHelper.nodeList(transfParams));
            }
        } catch (TransformationException ex) {
            throw new UnsupportedAlgorithmException("Unsupported transform on XML Signature provider", dObjTransf.getUri(), ex);
        }
    }
    return transforms;
}

引发错误的确切行是transforms.addTransform(dObjTransf.getUri())。这个transforms 对象是一个“标准” apache 对象（org.apache.xml.security.transforms.Transforms 对象）。所以我猜它应该能够获得与我在代码中所做的相同的 TransformService 两行更高的代码？但不是吗？

谁能指出我缺少什么？我将永远感激不尽。

Answer 1

显然，Apache Santuario loads transforms from a internal map。有一个register 您可能可以用来注册自定义转换的方法。