Soap request signing - soap

Question

Hello fellow developers,
I have no experience working on soap, saml and xml signing,
I am trying to generate this structure and then add 2 signature tags to it.
<env:Envelope xmlns:env="http://www.w3.org/2003/05/soap-envelope">
<env:Header xmlns:a="http://www.w3.org/2005/08/addressing">
<a:MessageID></a:MessageID>
<a:To env:mustUnderstand="true"></a:To>
<a:Action env:mustUnderstand="true">urn:hl7-org:v3:PRPA_IN201305UV02:CrossGatewayPatientDiscovery</a:Action>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsu:Timestamp wsu:Id="timestamp_ID">
<wsu:Created>2022-10-13T18:18:17.763Z</wsu:Created>
<wsu:Expires>2023-10-13T18:23:17.763Z</wsu:Expires>
</wsu:Timestamp>
<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="assertion_ID" IssueInstant="2022-10-13T18:18:17.763Z" Version="2.0">
<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName"></saml2:Issuer>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<Reference URI="#assertion_ID">
<Transforms>
<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue></DigestValue>
</Reference>
</SignedInfo>
<SignatureValue></SignatureValue>
<KeyInfo>
<X509Data>
<X509Certificate></X509Certificate>
</X509Data>
</KeyInfo>
</Signature>
<saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName"></saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key">
<saml2:SubjectConfirmationData>
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<KeyValue>
<RSAKeyValue>
<Modulus></Modulus>
<Exponent>AQAB</Exponent>
</RSAKeyValue>
</KeyValue>
</KeyInfo>
</saml2:SubjectConfirmationData>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2022-10-13T18:15:17.763Z" NotOnOrAfter="2022-10-13T18:23:17.763Z">
<saml2:AudienceRestriction>
<saml2:Audience></saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2022-10-13T17:55:17.743Z" SessionIndex="1234567890">
<saml2:SubjectLocality Address="10.1.1.144" DNSName="localhost"/>
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
<saml2:AttributeStatement>
<saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:subject-id">
<saml2:AttributeValue>John Doe</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:organization">
<saml2:AttributeValue>Dr. John M Doe, MD Practice</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:organization-id">
<saml2:AttributeValue></saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="urn:nhin:names:saml:homeCommunityId">
<saml2:AttributeValue></saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="urn:oasis:names:tc:xacml:2.0:subject:role">
<saml2:AttributeValue>
<Role xmlns="urn:hl7-org:v3" code="112247003" codeSystem="2.16.840.1.113883.6.96" codeSystemName="SNOMED CT" displayName="Medical doctor" xsi:type="CE"/>
</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:purposeofuse">
<saml2:AttributeValue>
<PurposeOfUse xmlns="urn:hl7-org:v3" code="TREATMENT" codeSystem="2.16.840.1.113883.3.18.7.1" codeSystemName="nhin-purpose" displayName="Treatment" xsi:type="CE"/>
</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="urn:oasis:names:tc:xacml:2.0:resource:resource-id">
<saml2:AttributeValue></saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<Reference URI="#timestamp_ID">
<Transforms>
<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue></DigestValue>
</Reference>
</SignedInfo>
<SignatureValue></SignatureValue>
<KeyInfo>
<wsse:SecurityTokenReference xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd" wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0">
<wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID">assertion_ID</wsse:KeyIdentifier>
</wsse:SecurityTokenReference>
</KeyInfo>
</Signature>
</wsse:Security>
</env:Header>
<env:Body>
<PRPA_IN201305UV02 xmlns="urn:hl7-org:v3" ITSVersion="XML_1.0">
<id extension="126627497759" root="1.3.6.1.4.1.52618.1.3"/>
<creationTime value="20221013181817"/>
<interactionId extension="PRPA_IN201305UV02" root="2.16.840.1.113883.1.6"/>
<processingCode code="P"/>
<processingModeCode code="T"/>
<acceptAckCode code="AL"/>
<receiver typeCode="RCV">
<device classCode="DEV" determinerCode="INSTANCE">
<id root="0.0.0"/>
<telecom value="https://RH-Windows-TMP-b994dba9f85ba908.elb.us-east-1.amazonaws.com:4437/"/>
<asAgent classCode="AGNT">
<representedOrganization classCode="ORG" determinerCode="INSTANCE">
<id root=""/>
</representedOrganization>
</asAgent>
</device>
</receiver>
<sender typeCode="SND">
<device classCode="DEV" determinerCode="INSTANCE">
<id root="1.3.6.1.4.1.52618.1.2"/>
<asAgent classCode="AGNT">
<representedOrganization classCode="ORG" determinerCode="INSTANCE">
<id root="1.3.6.1.4.1.52618.1"/>
</representedOrganization>
</asAgent>
</device>
</sender>
<controlActProcess classCode="CACT" moodCode="EVN">
<code code="PRPA_TE201305UV02" codeSystem="2.16.840.1.113883.1.6"/>
<authorOrPerformer typeCode="AUT">
<assignedDevice classCode="ASSIGNED">
<id root="1.3.6.1.4.1.52618.1.1"/>
</assignedDevice>
</authorOrPerformer>
<queryByParameter>
<queryId extension="126627497760" root="1.3.6.1.4.1.52618.1.3.1"/>
<statusCode code="new"/>
<responseModalityCode code="R"/>
<responsePriorityCode code="I"/>
<parameterList>
<livingSubjectAdministrativeGender>
<value code="M"/>
<semanticsText>LivingSubject.administrativeGender</semanticsText>
</livingSubjectAdministrativeGender>
<livingSubjectBirthTime>
<value value=""/>
<semanticsText>LivingSubject.birthTime</semanticsText>
</livingSubjectBirthTime>
<livingSubjectId>
<value extension="" root="1.3.6.1.4.1.52618.1.1"/>
<semanticsText>LivingSubject.id</semanticsText>
</livingSubjectId>
<livingSubjectName>
<value>
<given></given>
<family>TEST</family>
</value>
<semanticsText>LivingSubject.name</semanticsText>
</livingSubjectName>
<patientAddress>
<value>
<streetAddressLine>Home Dr</streetAddressLine>
<city>Charlotte</city>
<state>NC</state>
<postalCode></postalCode>
<country>US</country>
</value>
<semanticsText>Patient.addr</semanticsText>
</patientAddress>
</parameterList>
</queryByParameter>
</controlActProcess>
</PRPA_IN201305UV02>
</env:Body>
</env:Envelope>
I am using rhino javascript and below is the code
//////////////////////////////////////////////////////////////////////////////////
// Generate our dynamic message values
//
var timestampId = UUIDGenerator.getUUID();
var assertionId = UUIDGenerator.getUUID();
var createdTimestamp = new Date().toISOString();
var expiresTimestamp = new Date((new Date()).getTime() + 10000*10).toISOString();
var samlenvelope="<env:Envelope xmlns:env=\"http://www.w3.org/2003/05/soap-envelope\">"+
"<env:Header xmlns:a=\"http://www.w3.org/2005/08/addressing\">"+
"<a:MessageID>urn:uuid:32886a29-98ad-4284-b00e-3fe4ded10d16</a:MessageID>"+
"<a:To env:mustUnderstand=\"true\"></a:To>"+
"<a:Action env:mustUnderstand=\"true\">urn:hl7-org:v3:PRPA_IN201305UV02:CrossGatewayPatientDiscovery</a:Action>"+
"<wsse:Security xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\">"+
"<wsu:Timestamp wsu:Id=\"timestamp_ID\">"+
"<wsu:Created>2022-10-13T18:18:17.763Z</wsu:Created>"+
"<wsu:Expires>2023-10-13T18:23:17.763Z</wsu:Expires>"+
"</wsu:Timestamp>"+
"<saml2:Assertion xmlns:saml2=\"urn:oasis:names:tc:SAML:2.0:assertion\" xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" ID=\"assertion_ID\" IssueInstant=\"2022-10-13T18:18:17.763Z\" Version=\"2.0\">"+
"<saml2:Issuer Format=\"urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName\"></saml2:Issuer>"+
"<saml2:Subject>"+
"<saml2:NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName\"></saml2:NameID>"+
"<saml2:SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:holder-of-key\">"+
"<saml2:SubjectConfirmationData>"+
"<KeyInfo xmlns=\"http://www.w3.org/2000/09/xmldsig#\">"+
"<KeyValue>"+
"<RSAKeyValue>"+
"<Modulus></Modulus>"+
"<Exponent>AQAB</Exponent>"+
"</RSAKeyValue>"+
"</KeyValue>"+
"</KeyInfo>"+
"</saml2:SubjectConfirmationData>"+
"</saml2:SubjectConfirmation>"+
"</saml2:Subject>"+
"<saml2:Conditions NotBefore=\"2022-10-13T18:15:17.763Z\" NotOnOrAfter=\"2022-10-13T18:23:17.763Z\">"+
"</saml2:Conditions>"+
"<saml2:AuthnStatement AuthnInstant=\"2022-10-13T17:55:17.743Z\" SessionIndex=\"1234567890\">"+
"<saml2:SubjectLocality Address=\"10.1.1.144\" DNSName=\"localhost\"/>"+
"<saml2:AuthnContext>"+
"<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>"+
"</saml2:AuthnContext>"+
"</saml2:AuthnStatement>"+
"<saml2:AttributeStatement>"+
"<saml2:Attribute Name=\"urn:oasis:names:tc:xspa:1.0:subject:subject-id\">"+
"<saml2:AttributeValue>John Doe</saml2:AttributeValue>"+
"</saml2:Attribute>"+
"<saml2:Attribute Name=\"urn:oasis:names:tc:xspa:1.0:subject:organization\">"+
"<saml2:AttributeValue>Dr. John M Doe, MD Practice</saml2:AttributeValue>"+
"</saml2:Attribute>"+
"<saml2:Attribute Name=\"urn:oasis:names:tc:xspa:1.0:subject:organization-id\">"+
"<saml2:AttributeValue></saml2:AttributeValue>"+
"</saml2:Attribute>"+
"<saml2:Attribute Name=\"urn:nhin:names:saml:homeCommunityId\">"+
"<saml2:AttributeValue></saml2:AttributeValue>"+
"</saml2:Attribute>"+
"<saml2:Attribute Name=\"urn:oasis:names:tc:xacml:2.0:subject:role\">"+
"<saml2:AttributeValue>"+
"<Role xmlns=\"urn:hl7-org:v3\" code=\"112247003\" codeSystem=\"2.16.840.1.113883.6.96\" codeSystemName=\"SNOMED CT\" displayName=\"Medical doctor\" xsi:type=\"CE\"/>"+
"</saml2:AttributeValue>"+
"</saml2:Attribute>"+
"<saml2:Attribute Name=\"urn:oasis:names:tc:xspa:1.0:subject:purposeofuse\">"+
"<saml2:AttributeValue>"+
"<PurposeOfUse xmlns=\"urn:hl7-org:v3\" code=\"TREATMENT\" codeSystem=\"2.16.840.1.113883.3.18.7.1\" codeSystemName=\"nhin-purpose\" displayName=\"Treatment\" xsi:type=\"CE\"/>"+
"</saml2:AttributeValue>"+
"</saml2:Attribute>"+
"<saml2:Attribute Name=\"urn:oasis:names:tc:xacml:2.0:resource:resource-id\">"+
"<saml2:AttributeValue></saml2:AttributeValue>"+
"</saml2:Attribute>"+
"</saml2:AttributeStatement>"+
"</saml2:Assertion>"+
"</wsse:Security>"+
"</env:Header>"+
"<env:Body>"+
"<PRPA_IN201305UV02 xmlns=\"urn:hl7-org:v3\" ITSVersion=\"XML_1.0\">"+
"<id extension=\"126627497759\" root=\"1.3.6.1.4.1.52618.1.3\"/>"+
"<creationTime value=\"20221013181817\"/>"+
"<interactionId extension=\"PRPA_IN201305UV02\" root=\"2.16.840.1.113883.1.6\"/>"+
"<processingCode code=\"P\"/>"+
"<processingModeCode code=\"T\"/>"+
"<acceptAckCode code=\"AL\"/>"+
"<receiver typeCode=\"RCV\">"+
"<device classCode=\"DEV\" determinerCode=\"INSTANCE\">"+
"<id root=\"0.0.0\"/>"+
"<telecom value=\"https://RH-Windows-TMP-b994dba9f85ba908.elb.us-east-1.amazonaws.com:4437/\"/>"+
"<asAgent classCode=\"AGNT\">"+
"<representedOrganization classCode=\"ORG\" determinerCode=\"INSTANCE\">"+
"<id root=\"\"/>"+
"</representedOrganization>"+
"</asAgent>"+
"</device>"+
"</receiver>"+
"<sender typeCode=\"SND\">"+
"<device classCode=\"DEV\" determinerCode=\"INSTANCE\">"+
"<id root=\"1.3.6.1.4.1.52618.1.2\"/>"+
"<asAgent classCode=\"AGNT\">"+
"<representedOrganization classCode=\"ORG\" determinerCode=\"INSTANCE\">"+
"<id root=\"1.3.6.1.4.1.52618.1\"/>"+
"</representedOrganization>"+
"</asAgent>"+
"</device>"+
"</sender>"+
"<controlActProcess classCode=\"CACT\" moodCode=\"EVN\">"+
"<code code=\"PRPA_TE201305UV02\" codeSystem=\"2.16.840.1.113883.1.6\"/>"+
"<authorOrPerformer typeCode=\"AUT\">"+
"<assignedDevice classCode=\"ASSIGNED\">"+
"<id root=\"1.3.6.1.4.1.52618.1.1\"/>"+
"</assignedDevice>"+
"</authorOrPerformer>"+
"<queryByParameter>"+
"<queryId extension=\"\" root=\"1.3.6.1.4.1.52618.1.3.1\"/>"+
"<statusCode code=\"new\"/>"+
"<responseModalityCode code=\"R\"/>"+
"<responsePriorityCode code=\"I\"/>"+
"<parameterList>"+
"<livingSubjectAdministrativeGender>"+
"<value code=\"M\"/>"+
"<semanticsText>LivingSubject.administrativeGender</semanticsText>"+
"</livingSubjectAdministrativeGender>"+
"<livingSubjectBirthTime>"+
"<value value=\"\"/>"+
"<semanticsText>LivingSubject.birthTime</semanticsText>"+
"</livingSubjectBirthTime>"+
"<livingSubjectId>"+
"<value extension=\"\" root=\"1.3.6.1.4.1.52618.1.1\"/>"+
"<semanticsText>LivingSubject.id</semanticsText>"+
"</livingSubjectId>"+
"<livingSubjectName>"+
"<value>"+
"<given></given>"+
"<family>TEST</family>"+
"</value>"+
"<semanticsText>LivingSubject.name</semanticsText>"+
"</livingSubjectName>"+
"<patientAddress>"+
"<value>"+
"<streetAddressLine>Home Dr</streetAddressLine>"+
"<city>Charlotte</city>"+
"<state>NC</state>"+
"<postalCode></postalCode>"+
"<country>US</country>"+
"</value>"+
"<semanticsText>Patient.addr</semanticsText>"+
"</patientAddress>"+
"</parameterList>"+
"</queryByParameter>"+
"</controlActProcess>"+
"</PRPA_IN201305UV02>"+
"</env:Body>"+
"</env:Envelope>"+;
var samlString = new java.lang.String(samlenvelope);
////////////////////////////////////////////////////////////////////////////////////
// Build our XML DOM for signature
//
var documentBuilderFactory = javax.xml.parsers.DocumentBuilderFactory.newInstance();
documentBuilderFactory.setNamespaceAware(true);
var document = documentBuilderFactory.newDocumentBuilder().parse(new java.io.ByteArrayInputStream(samlString.getBytes("utf-8")));
////////////////////////////////////////////////////////////////////////////////////
// Configure Digital Signature utilities for required crypto operations
//
var xmlDsigFactory = javax.xml.crypto.dsig.XMLSignatureFactory.getInstance("DOM");
var parameterSpec = new javax.xml.crypto.dsig.spec.ExcC14NParameterSpec();
var reference = xmlDsigFactory.newReference
(
"#assertion_ID",
xmlDsigFactory.newDigestMethod(javax.xml.crypto.dsig.DigestMethod.SHA1, null),
java.util.Collections.singletonList(xmlDsigFactory.newTransform("http://www.w3.org/2001/10/xml-exc-c14n#", parameterSpec)),
null, //type
null //id
)
var signedInfo = xmlDsigFactory.newSignedInfo
(
xmlDsigFactory.newCanonicalizationMethod
(
javax.xml.crypto.dsig.CanonicalizationMethod.EXCLUSIVE,
parameterSpec
),
xmlDsigFactory.newSignatureMethod(javax.xml.crypto.dsig.SignatureMethod.RSA_SHA1, null),
java.util.Collections.singletonList(reference)
)
var reference1 = xmlDsigFactory.newReference
(
"#timestamp_ID",
xmlDsigFactory.newDigestMethod(javax.xml.crypto.dsig.DigestMethod.SHA1, null),
java.util.Collections.singletonList(xmlDsigFactory.newTransform("http://www.w3.org/2001/10/xml-exc-c14n#", parameterSpec)),
null, //type
null //id
)
var signedInfo1 = xmlDsigFactory.newSignedInfo
(
xmlDsigFactory.newCanonicalizationMethod
(
javax.xml.crypto.dsig.CanonicalizationMethod.EXCLUSIVE,
parameterSpec
),
xmlDsigFactory.newSignatureMethod(javax.xml.crypto.dsig.SignatureMethod.RSA_SHA1, null),
java.util.Collections.singletonList(reference1)
)
//////////////////////////////////////////////////////
// Fetch our certificate and key
//
var certificate;
try
{
var inputStream = new java.io.FileInputStream("test.crt");
var certificateFactory = java.security.cert.CertificateFactory.getInstance("X.509");
certificate = certificateFactory.generateCertificate(inputStream);
}
finally
{
if (inputStream != null)
inputStream.close();
}
var privateKey;
var keyFactory = java.security.KeyFactory.getInstance("RSA");
var keySpec = new java.security.spec.PKCS8EncodedKeySpec(java.nio.file.Files.readAllBytes(new java.io.File("private_key.der").toPath()));
privateKey = keyFactory.generatePrivate(keySpec);
////////////////////////////////////////////////////////
// Generate the KeyInfo for our signature
//
var keyInfoFactory = xmlDsigFactory.getKeyInfoFactory();
var x509Content = new java.util.ArrayList();
x509Content.add(certificate);
var x509Data = keyInfoFactory.newX509Data(x509Content);
var keyInfo = keyInfoFactory.newKeyInfo(java.util.Collections.singletonList(x509Data));
var signature = xmlDsigFactory.newXMLSignature(signedInfo, keyInfo);
var dsc = new javax.xml.crypto.dsig.dom.DOMSignContext(privateKey, document.getDocumentElement());
var rootEl = document.getDocumentElement();
rootEl.setIdAttribute("ID",true);
signature.sign(dsc);
var signature1 = xmlDsigFactory.newXMLSignature(signedInfo1, keyInfo1);
var dsc = new javax.xml.crypto.dsig.dom.DOMSignContext(privateKey, document.getDocumentElement());
signature1.sign(dsc);
/*
var newEle=document.createElement("Transform");
newEle.setAttribute('Algorithm', 'http://www.w3.org/2000/09/xmldsig#enveloped-signature');
document.getElementsByTagName("Transforms").item(0).appendChild(newEle);*/
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// Define any formatting preferences get the signed document as a string
//
var transformerFactory = javax.xml.transform.TransformerFactory.newInstance();
var transformer = transformerFactory.newTransformer();
transformer.setOutputProperty(javax.xml.transform.OutputKeys.OMIT_XML_DECLARATION, "yes");
var stringWriter = new java.io.StringWriter();
transformer.transform(new javax.xml.transform.dom.DOMSource(document), new javax.xml.transform.stream.StreamResult(stringWriter));
channelMap.put("soapMessage", stringWriter.toString());
when I run the code I get this error
Wrapped org.w3c.dom.DOMException: NOT_FOUND_ERR: An attempt is made to
reference a node in a context where it does not exist.
Will appreciate your help