Signing multiple objects?

[Cantor, Scott]

On 10/25/11 6:40 AM, "Brad Cox" <bradjcox at gmail.com> wrote:
>
>I'd rather not have this restriction, of course, and that the solution be
>fully interoperable. But the signing spec is so over to the top in this
>case that I'd be happy to get something that works at all. The spec is
>far beyond what any impl I know of will support.
>
>Any suggestions on where to start?

Well, you're basically on your own implementing that. You'd need to
manually deal with the signature. You could probably use the existing SAML
shortcuts as an example. I believe the Java code is like mine and has a
ContentReference abstraction that was intended to encapsulate the
signature reference and transforms needed, but worst case you'd be coding
directly to the signature APIs.

If you're asking what the signature needs to be, you'd need to read the
XML Signature standard. A WS-Security signature is normally a
multi-reference enveloped signature. As I said, if you want it to work,
I'd sign the whole document.

-- Scott