Mailing-List: contact security-dev-help@xml.apache.org; run by ezmlm
Precedence: bulk
Reply-To: security-dev@xml.apache.org
Received-SPF: pass (athena.apache.org: local policy)
From: "Scott Cantor" <cantor.2@osu.edu>
To: <security-dev@xml.apache.org>
References: <200708131646.07770.ralph-xmlsecurity@ralphholz.de>
 <00a401c7ddcb$b26101f0$172305d0$%2@osu.edu>
 <200708141121.24753.ralph-xmlsecurity@ralphholz.de>
In-Reply-To: <200708141121.24753.ralph-xmlsecurity@ralphholz.de>
Subject: RE: Can I set the BaseURI to empty?
Date: Tue, 14 Aug 2007 11:25:38 -0400
Organization: The Ohio State University
Message-ID: <005101c7de87$5e12cc70$1a386550$@2@osu.edu>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Thread-index: AcfeVPRDDw926n5/Qu+aMLwSCQExfQAMPzCQ
Content-language: en-us

> I'll rephrase my question: How do I sign and verify Documents that I =
only
> have as Java objects, because they are retrieved via Java =
deserialisation? In
> particular, what is the BaseURI expected to be in such cases?

That depends on how the Signature relates to the content. Is it =
enveloped, enveloping, or detached?

The BaseURI doesn't matter in enveloped or enveloping cases, only the =
URI in the Reference element matters. The signature constructor takes a =
base URI, for which I use an empty string to prevent anything =
inadvertent from happening. The addDocument method creates References, =
and I use a fragment identifier there ("#foo"). If you don't use IDs, =
you'd use an empty string and then add XPath other transforms.

> Sorry for all these questions and demand on your time, but XML =
Security
> needs more documentation, quite badly, I think.
=09
These libraries just aren't set up for novices. Mine aren't either. =
Documentation takes a lot of effort and not one person who has ever =
complained about it ever donates any back, so that kind of says it all. =
At least there are some samples here. That's more than I bother to do.

-- Scott