RE: How to sign a sub-tree

2007-08-08 Thread Scott Cantor
> And I reference it by: > > sig.addDocument(BaseURI+"#pdpaId", transforms, > Constants.ALGO_ID_DIGEST_SHA1); Yes, if the signature is detached. If it's in the same document, the reference is just a bare fragment. > Do you mean that - would that select the subtree if both the attribute > name

Re: How to sign a sub-tree

2007-08-08 Thread ralph-xmlsecurity
Hi, > > I think I could also have an identifying attribute in the , > > and replace the expression with id("nameOfIDAttr"). Which is, I think, > > the recommended way as it is faster and less error-prone (I can assume > > Schema-aware entities). > > Then by all means do not use XPath. But if you u

RE: How to sign a sub-tree

2007-08-07 Thread Scott Cantor
> where I *hope* the XPath expression returns exactly the element I wanted, > i.e. the intersection of the whole document (BaseURI, nothing else specified) > with the Body/message portion. I don't speak XPath, so as I said earlier, I'm not the one to ask. Conceptually that would be the right trac

Re: How to sign a sub-tree

2007-08-07 Thread ralph-xmlsecurity
Scott, thanks, that was exactly the pointer I needed! If you have a minute to have a look at this. My doc looks like this ... ... I would like to sign the "message" payload in the Body. So I did transforms.addTransform(Transforms.TRANSFORM_ENVELOPED_SIGNATURE); String

RE: How to sign a sub-tree

2007-08-06 Thread Scott Cantor
> Following up on kb's thread on signing less than the whole document, I > would like to ask how to use the API to sign a sub-tree of my document. It is > easy for me to retrieve the sub-tree (i.e. the parent element) because it's > unique. Retrieving it via some kind of DOM call is not relevant,