Example of How to Digitally Sign XML Files or Content

Suppose you want to digitally sign an XML document, but more specifically, suppose you have multiple instances of the same element in the document and you just want to sign a specific ID. Oxygen XML Author Eclipse plugin includes a signature tool that allows you to digitally sign XML documents or specific content.

The Oxygen XML Author Eclipse plugin installation directory includes a samples folder that contains a file called personal.xml. For the purposes of this example, this file will be used to demonstrate how to digitally sign specific content. Notice that this file has multiple <person> elements inside the <personnel> element. Suppose you want to digitally sign the specific <person> element that contains the id=robert.taylor. To do this, follow this procedure:

Open the personal.xml file in Oxygen XML Author Eclipse plugin in Text editing mode.
Right-click anywhere in the editor and select the Sign action from the Source submenu.
The Sign dialog box is displayed.
If Oxygen XML Author Eclipse plugin cannot find a valid certificate, click the link at the top of the dialog box to configure a valid certificate. This opens the XML Signing Certificates preferences page that allows you to configure and validate a certificate.
Once a valid certificate is recognized, continue to configure the Sign dialog box.
1. Select one of the Transformation Options. For the purposes of this example, select the Inclusive with comments option.
2. Specify the appropriate XPath expression for the specific element that needs to be signed. For this example, type /personnel/person in the XPath text box.
3. Enter the specific ID that needs to be signed. For this example, type robert.taylor in the ID field.
4. Select the Envelope option and leave the other options as their default values.
The digital signature is added at the end of the XML document, just before the end tag. It is always added at the end of the document, even if you only sign specific content within the document.
You can verify the signature by choosing the Verify Signature action from the Source submenu of the contextual menu.