ExSaml.Core.Xml.Dsig (ex_saml v1.0.2)

Copy Markdown View Source

XML Digital Signatures (XMLDSig) generation and verification.

Implements enveloped XML digital signature generation and verification as specified at http://www.w3.org/TR/xmldsig-core/

Currently supports RSA + SHA1|SHA256 signatures.

Summary

Types

fingerprint()
sig_method()
xml()

Functions

certificate(args \\ [])
certificate(record, args)
digest(element)

Returns the canonical digest of an (optionally signed) element.

digest(element, hash_function)
sign(element_in, private_key, cert_bin)

Signs the given XML element by creating a ds:Signature element within it.

sign(element_in, private_key, cert_bin, sig_method)
strip(rec)

Returns an element without any ds:Signature elements inside it.

subject_public_key_info(args \\ [])
subject_public_key_info(record, args)
tbs_certificate(args \\ [])
tbs_certificate(record, args)
verify(element)

Verifies an XML digital signature, trusting any valid certificate.

verify(element, fingerprints)

Verifies an XML digital signature on the given element.

xmlAttribute(args \\ [])
xmlAttribute(record, args)
xmlDocument(args \\ [])
xmlDocument(record, args)
xmlElement(args \\ [])
xmlElement(record, args)
xmlNamespace(args \\ [])
xmlNamespace(record, args)
xmlText(args \\ [])
xmlText(record, args)

Types

fingerprint()

@type fingerprint() :: binary() | {:sha | :sha256, binary()}

sig_method()

@type sig_method() :: :rsa_sha1 | :rsa_sha256

xml()

@type xml() ::
  {:xmlElement, name :: term(), expanded_name :: term(), nsinfo :: term(),
   namespace :: term(), parents :: term(), pos :: term(), attributes :: term(),
   content :: term(), language :: term(), xmlbase :: term(),
   elementdef :: term()}
  | {:xmlDocument, content :: term()}

Functions

certificate(args \\ [])

(macro)

certificate(record, args)

(macro)

digest(element)

@spec digest(
  {:xmlElement, name :: term(), expanded_name :: term(), nsinfo :: term(),
   namespace :: term(), parents :: term(), pos :: term(), attributes :: term(),
   content :: term(), language :: term(), xmlbase :: term(),
   elementdef :: term()}
) :: binary()

Returns the canonical digest of an (optionally signed) element.

digest(element, hash_function)

@spec digest(
  {:xmlElement, name :: term(), expanded_name :: term(), nsinfo :: term(),
   namespace :: term(), parents :: term(), pos :: term(), attributes :: term(),
   content :: term(), language :: term(), xmlbase :: term(),
   elementdef :: term()},
  :sha | :sha256
) :: binary()

sign(element_in, private_key, cert_bin)

@spec sign(
  {:xmlElement, name :: term(), expanded_name :: term(), nsinfo :: term(),
   namespace :: term(), parents :: term(), pos :: term(), attributes :: term(),
   content :: term(), language :: term(), xmlbase :: term(),
   elementdef :: term()},
  tuple(),
  binary()
) ::
  {:xmlElement, name :: term(), expanded_name :: term(), nsinfo :: term(),
   namespace :: term(), parents :: term(), pos :: term(), attributes :: term(),
   content :: term(), language :: term(), xmlbase :: term(),
   elementdef :: term()}

Signs the given XML element by creating a ds:Signature element within it.

Returns the element with the signature added. Default algorithm is RSA-SHA256.

sign(element_in, private_key, cert_bin, sig_method)

@spec sign(
  {:xmlElement, name :: term(), expanded_name :: term(), nsinfo :: term(),
   namespace :: term(), parents :: term(), pos :: term(), attributes :: term(),
   content :: term(), language :: term(), xmlbase :: term(),
   elementdef :: term()},
  tuple(),
  binary(),
  sig_method() | String.t()
) ::
  {:xmlElement, name :: term(), expanded_name :: term(), nsinfo :: term(),
   namespace :: term(), parents :: term(), pos :: term(), attributes :: term(),
   content :: term(), language :: term(), xmlbase :: term(),
   elementdef :: term()}

strip(rec)

@spec strip(xml()) :: xml()

Returns an element without any ds:Signature elements inside it.

subject_public_key_info(args \\ [])

(macro)

subject_public_key_info(record, args)

(macro)

tbs_certificate(args \\ [])

(macro)

tbs_certificate(record, args)

(macro)

verify(element)

@spec verify(
  {:xmlElement, name :: term(), expanded_name :: term(), nsinfo :: term(),
   namespace :: term(), parents :: term(), pos :: term(), attributes :: term(),
   content :: term(), language :: term(), xmlbase :: term(),
   elementdef :: term()}
) :: :ok | {:error, :bad_digest | :bad_signature | :cert_not_accepted}

Verifies an XML digital signature, trusting any valid certificate.

verify(element, fingerprints)

@spec verify(
  {:xmlElement, name :: term(), expanded_name :: term(), nsinfo :: term(),
   namespace :: term(), parents :: term(), pos :: term(), attributes :: term(),
   content :: term(), language :: term(), xmlbase :: term(),
   elementdef :: term()},
  [fingerprint()] | :any
) ::
  :ok
  | {:error,
     :bad_digest
     | :bad_signature
     | :cert_not_accepted
     | :no_signature
     | :multiple_signatures
     | :insecure_algorithm
     | :unsupported_algorithm}

Verifies an XML digital signature on the given element.

fingerprints is a list of valid cert fingerprints that can be accepted, or :any to accept any valid certificate.

xmlAttribute(args \\ [])

(macro)

xmlAttribute(record, args)

(macro)

xmlDocument(args \\ [])

(macro)

xmlDocument(record, args)

(macro)

xmlElement(args \\ [])

(macro)

xmlElement(record, args)

(macro)

xmlNamespace(args \\ [])

(macro)

xmlNamespace(record, args)

(macro)

xmlText(args \\ [])

(macro)

xmlText(record, args)

(macro)