Re: XML Signature ?

[Adam Glauser <adamglauser@xxxxxxxxxxxx>]

Dominique Couture wrote:
> Is there anyone on this forum that have a clue on how to implement XML
> Signature to do WebService using RPG ?

Do you need to sign requests to the web service, verify signatures on 
responses, or both?

This page overview of the W3C spec for attaching digital signatures to 
XML documents: http://www.xml.com/pub/a/2001/08/08/xmldsig.html#xml-sig. 
 There have been some discussions on this list and Midrange-L about 
using the Cryptographic APIs, check the archives for these.

If all else fails, I think you could build or verify all of the required 
sub-elements in the <Signature> element using the Cryptographic APIs 
provided by i5/OS.  I don't have experience doing this personally, but I 
have a reasonably good understanding of the mechanics of digital 
signatures and I can't imagine why it wouldn't be possibly technically.

If I were you, I'd start by looking at the <DigestMethod> and 
<SignatureMethod> tags on the XML responses you are getting from the web 
service, and verify that those algorithms are provided by i5/OS APIs. 
Secondly, I'd find out how the key exchange takes place (the <KeyInfo> 
element) and figure out how to extract the signature from the responses, 
or if you will need to use some key exchange software.

Hope this helps,
Adam