xades4j.UnsupportedAlgorithmException: Unsupported transform on XML Signature provider

Question

I'm trying to create a XAdES-BES signature for a given blob. For this signature, I'd need to add two transforms on the content before it is signed: Base64 (http://www.w3.org/2000/09/xmldsig#base64) & a custom one (called optional-deflate).

The problems lies with that optional transform. I'm trying to figure out how to implement a custom Transform, register it, and finally have Xades4J use it.

So far I figured a lot (thanks Google and a lot of time), so I got roughly to this: I've got a Provider-class that, in the constructor, puts the new TransformService; In my main code I add my Provider to the Security instance; then, I try to add the transform to my actual to-be-signed object.

Unfortunately, I always get the same error:

Exception in thread "main" xades4j.UnsupportedAlgorithmException: Unsupported transform on XML Signature provider (urn:xml:sig:transform:optional-deflate)
    at xades4j.production.DataObjectDescsProcessor.processTransforms(DataObjectDescsProcessor.java:194)
    at xades4j.production.DataObjectDescsProcessor.process(DataObjectDescsProcessor.java:87)
    at xades4j.production.SignerBES.sign(SignerBES.java:173)
    at xades4j.production.SignerBES.sign(SignerBES.java:122)
    at com.mycompany.Test.createXades(Test.java:199)
    at com.mycompany.Test.main(Test.java:47)
Caused by: org.apache.xml.security.transforms.TransformationException: Unknown transformation. No handler installed for URI urn:xml:sig:transform:optional-deflate
Original Exception was org.apache.xml.security.transforms.InvalidTransformException: Unknown transformation. No handler installed for URI urn:xml:sig:transform:optional-deflate
    at org.apache.xml.security.transforms.Transforms.addTransform(Unknown Source)
    at xades4j.production.DataObjectDescsProcessor.processTransforms(DataObjectDescsProcessor.java:185)
    ... 5 more

So, my code looks like this (abbreviated to what I think is necessary here):

TransformService class:

package com.mycompany.security;

import java.io.OutputStream;
import java.security.InvalidAlgorithmParameterException;
import java.security.spec.AlgorithmParameterSpec;

import javax.xml.crypto.Data;
import javax.xml.crypto.MarshalException;
import javax.xml.crypto.XMLCryptoContext;
import javax.xml.crypto.XMLStructure;
import javax.xml.crypto.dsig.TransformService;
import javax.xml.crypto.dsig.TransformException;
import javax.xml.crypto.dsig.spec.TransformParameterSpec;

public class OptionalDeflateTransform extends TransformService {
    public AlgorithmParameterSpec getParameterSpec() {
            return null;
    }
    public Data transform(Data data, XMLCryptoContext context) throws TransformException {
            return null;
    }
    public Data transform(Data data, XMLCryptoContext context, OutputStream os) throws TransformException {
            return null;
    }
    public boolean isFeatureSupported(String feature) {
            return false;
    }
    public void init(TransformParameterSpec params) throws InvalidAlgorithmParameterException {}
    public void marshalParams(XMLStructure parent, XMLCryptoContext context) throws MarshalException {}
    public void init(XMLStructure parent, XMLCryptoContext context) throws InvalidAlgorithmParameterException {}
}

Provider subclass:

package com.mycompany.security;

import java.security.Provider;

public final class OptionalDeflateProvider extends Provider {
    private static final long serialVersionUID = 8849833178389029123L;

    public OptionalDeflateProvider() {
            super("OptionalDeflate", 1.0, "OptionalDeflate provider 1.0 implementing the OptionalDeflate transform algorithm.");
            put("TransformService.urn:xml:sig:transform:optional-deflate", "com.mycompany.security.OptionalDeflateTransform");
    }

}

And finally, my main Test class, which contains the actual signing. Without that transform, it works (but well, doesn't add the transform, which is necessary). So Base64 works.

protected static void createXades(String content) throws Exception {
    /*Get certificate & private key*/
    Certificates c = new Certificates(); 
    c.initSession(); //some helper class where I can get my certificate & private key for signing

    /*Create a document*/
    DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
    DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
    Document doc = docBuilder.newDocument();
    Element objectElement = doc.createElement("object");
    doc.appendChild(objectElement);
    Element requestElement = doc.createElement("request");
    requestElement.appendChild(doc.createTextNode(content));
    requestElement.setAttribute("ID", UUID.randomUUID().toString());
    objectElement.appendChild(requestElement);

    /*Key provider, signing profile & signer itself*/
    KeyingDataProvider kp = new CustomKeyingDataProvider(c.getCertificate(), c.getPrivateKey());
    XadesSigningProfile p = new XadesBesSigningProfile(kp);
    p.withAlgorithmsProviderEx(new ProviderEx());
    XadesSigner signer = p.newSigner();

    /*Add the optional deflate provider*/
    Security.addProvider(new OptionalDeflateProvider());
    System.out.println("--- installed providers ---");
    for (Provider pr : Security.getProviders())
            System.out.println(pr.getName());
    System.out.println("---");

    /*Test if we can get the transformservice-instance*/
    TransformService ts = TransformService.getInstance("urn:xml:sig:transform:optional-deflate", "DOM");
    System.out.println(ts.getAlgorithm());
    System.out.println("---");

    /*Signed data*/
    DataObjectDesc flatFile = new DataObjectReference("#" + requestElement.getAttribute("ID"))
            .withTransform(new GenericAlgorithm("http://www.w3.org/2000/09/xmldsig#base64"))
            .withTransform(new GenericAlgorithm("urn:xml:sig:transform:optional-deflate"));
    SignedDataObjects dataObjs = new SignedDataObjects(flatFile);

    /*Actual signing*/
    signer.sign(dataObjs, objectElement);
    log(objectElement.getLastChild());
}

As you can see I print some things out. I for instance logged that the installation works fine and I also logged the installed providers. I get this as output:

--- installed providers ---
SUN
SunRsaSign
SunEC
SunJSSE
SunJCE
SunJGSS
SunSASL
XMLDSig
SunPCSC
SunMSCAPI
OptionalDeflate
---
urn:xml:sig:transform:optional-deflate
---

So as far as I can see, the provider has succesfully been registered, the transformservice can be loaded without a problem, ... So I don't really see what's going on?

I've checked the source code of Xades4j as well, and what's happening internally on the line .withTransform(new GenericAlgorithm("urn:xml:sig:transform:optional-deflate")) is pretty straight forward:

import org.apache.xml.security.transforms.Transforms;

...

private Transforms processTransforms(DataObjectDesc dataObjDesc, Document document) throws UnsupportedAlgorithmException {
    Collection<Algorithm> dObjTransfs = dataObjDesc.getTransforms();
    if (dObjTransfs.isEmpty()) {
        return null;
    }
    Transforms transforms = new Transforms(document);
    for (Algorithm dObjTransf : dObjTransfs) {
        try {
            List<Node> transfParams = this.algorithmsParametersMarshaller.marshalParameters(dObjTransf, document);
            if (null == transfParams) {
                transforms.addTransform(dObjTransf.getUri());
            } else {
                transforms.addTransform(dObjTransf.getUri(), DOMHelper.nodeList(transfParams));
            }
        } catch (TransformationException ex) {
            throw new UnsupportedAlgorithmException("Unsupported transform on XML Signature provider", dObjTransf.getUri(), ex);
        }
    }
    return transforms;
}

The exact line throwing up the error is transforms.addTransform(dObjTransf.getUri()). This transforms object is a 'standard' apache object (org.apache.xml.security.transforms.Transforms object). So I'd guess it should be able to get the same TransformService as I do in code litteraly two lines up higher? But it isn't?

Anyone that can point me out what I'm missing? I'll be eternally grateful.

Answer 1

Apparently, Apache Santuario loads transforms from a internal map. There is a register method that you probably can use to register your custom transform.